1 /*
2  * Copyright (C) 2021 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "ipc_dev_auth_stub.h"
17 
18 #include "common_defs.h"
19 #include "device_auth_defines.h"
20 #include "hc_log.h"
21 #include "hc_mutex.h"
22 #include "hc_types.h"
23 #include "ipc_skeleton.h"
24 #include "ipc_adapt.h"
25 #include "ipc_callback_proxy.h"
26 #include "ipc_sdk.h"
27 #include "securec.h"
28 
29 #ifdef __cplusplus
30 extern "C" {
31 #endif
32 
33 #define MAX_DATA_LEN 102400
34 static HcMutex g_cBMutex;
35 
36 struct CbStubInfo {
37     SvcIdentity cbStub;
38     uint32_t cbDieId;
39     bool inUse;
40 };
41 static struct CbStubInfo g_cbStub[MAX_CBSTUB_SIZE];
42 
43 IpcServiceCallMap *g_callMapTable = NULL;
44 int32_t g_maxCallMapSz = MAX_CALLMAP_SIZE;
45 int32_t g_callMapElemNum = 0;
46 
47 #define BINDER_TYPE_ACQUIRE 1
48 #define BINDER_TYPE_ACQUIRE_AND_FREE 2
49 #define BINDER_TYPE_RELEASE 3
50 
51 #define IPC_IO_BUFF_SZ 1024
52 
ResetCallMap(void)53 void ResetCallMap(void)
54 {
55     g_maxCallMapSz = MAX_CALLMAP_SIZE;
56     if (g_callMapTable != NULL) {
57         HcFree(g_callMapTable);
58         g_callMapTable = NULL;
59     }
60     g_callMapElemNum = 0;
61 }
62 
GetCallMethodByMethodId(int32_t methodId)63 static IpcServiceCall GetCallMethodByMethodId(int32_t methodId)
64 {
65     int32_t i;
66 
67     if (g_callMapTable == NULL) {
68         return NULL;
69     }
70 
71     for (i = 0; i < g_maxCallMapSz; i++) {
72         if ((g_callMapTable[i].methodId == methodId) && (g_callMapTable[i].method != NULL)) {
73             return g_callMapTable[i].method;
74         }
75     }
76     return NULL;
77 }
78 
DecodeCallRequest(IpcIo * data,IpcDataInfo * paramsCache,int32_t cacheNum,int32_t * inParamNum)79 static int32_t DecodeCallRequest(IpcIo *data, IpcDataInfo *paramsCache, int32_t cacheNum, int32_t *inParamNum)
80 {
81     int32_t dataLen;
82     int32_t i;
83     int32_t ret;
84 
85     if (GetIpcIoDataLength(data) > MAX_DATA_LEN) {
86         LOGE("Data len over MAX_DATA_LEN");
87         return HC_ERR_IPC_BAD_MESSAGE_LENGTH;
88     }
89 
90     ReadInt32(data, &dataLen);
91     if (dataLen <= 0) {
92         return HC_ERR_IPC_BAD_MESSAGE_LENGTH;
93     }
94 
95     ReadInt32(data, inParamNum);
96     if ((*inParamNum < 0) || (*inParamNum > cacheNum)) {
97         LOGE("param number invalid, inParamNum(%d)", *inParamNum);
98         return HC_ERR_IPC_BAD_PARAM_NUM;
99     }
100 
101     uint32_t len = 0;
102     ReadUint32(data, &len); /* skip flat object length information */
103     for (i = 0; i < *inParamNum; i++) {
104         ret = DecodeIpcData((uintptr_t)data, &(paramsCache[i].type), &(paramsCache[i].val), &(paramsCache[i].valSz));
105         if (ret != HC_SUCCESS) {
106             LOGE("decode failed, ret %d", ret);
107             return ret;
108         }
109     }
110     return HC_SUCCESS;
111 }
112 
GetMethodId(IpcIo * data,int32_t * methodId)113 static int32_t GetMethodId(IpcIo *data, int32_t *methodId)
114 {
115     ReadInt32(data, methodId);
116     return HC_SUCCESS;
117 }
118 
WithObject(int32_t methodId,IpcIo * data,IpcDataInfo * ipcData,int32_t * cnt)119 static void WithObject(int32_t methodId, IpcIo *data, IpcDataInfo *ipcData, int32_t *cnt)
120 {
121     if (!IsCallbackMethod(methodId)) {
122         return;
123     }
124     ReadInt32(data, &(ipcData->type));
125     ipcData->valSz = 0;
126     SvcIdentity tmp;
127     bool ret = ReadRemoteObject(data, &tmp);
128     if (!ret || (ipcData->type != PARAM_TYPE_CB_OBJECT)) {
129         LOGE("should with remote object, but failed, param type %d", ipcData->type);
130         return;
131     }
132     ShowIpcSvcInfo(&tmp);
133     ipcData->idx = SetRemoteObject(&tmp);
134     if (ipcData->idx >= 0) {
135         ipcData->val = (uint8_t *)(&(ipcData->idx));
136         LOGI("object trans success, set id %d", ipcData->idx);
137         (*cnt)++;
138     }
139 }
140 
InitCbStubTable(void)141 void InitCbStubTable(void)
142 {
143     (void)InitHcMutex(&g_cBMutex);
144     (void)memset_s(g_cbStub, sizeof(g_cbStub), 0, sizeof(g_cbStub));
145     return;
146 }
147 
LockCbStubTable(void)148 static void LockCbStubTable(void)
149 {
150     (void)g_cBMutex.lock(&g_cBMutex);
151     return;
152 }
153 
UnLockCbStubTable(void)154 static void UnLockCbStubTable(void)
155 {
156     g_cBMutex.unlock(&g_cBMutex);
157     return;
158 }
159 
DevAuthRequestCall(void * origin,IpcIo * req,IpcIo * reply)160 static int32_t DevAuthRequestCall(void *origin, IpcIo *req, IpcIo *reply)
161 {
162     int32_t ret;
163     int32_t methodId = -1;
164     int32_t reqParamNum = 0;
165     IpcDataInfo reqParams[MAX_REQUEST_PARAMS_NUM] = { { 0 } };
166     IpcServiceCall serviceCall = NULL;
167 
168     (void)origin;
169     ret = GetMethodId(req, &methodId);
170     if (ret != HC_SUCCESS || methodId <= 0) {
171         LOGE("GetMethodId failed, ret = %d", ret);
172         return HC_ERR_IPC_METHOD_ID_INVALID;
173     }
174     serviceCall = GetCallMethodByMethodId(methodId);
175     if (serviceCall == NULL) {
176         return HC_ERR_IPC_METHOD_ID_INVALID;
177     }
178     ret = DecodeCallRequest(req, reqParams, MAX_REQUEST_PARAMS_NUM, &reqParamNum);
179     if (ret != HC_SUCCESS) {
180         return ret;
181     }
182     if (reqParamNum < (MAX_REQUEST_PARAMS_NUM - 1)) {
183         WithObject(methodId, req, &reqParams[reqParamNum], &reqParamNum);
184     }
185     return serviceCall(reqParams, reqParamNum, (uintptr_t)(reply));
186 }
187 
188 static struct {
189     int32_t (*callCtx)(void *origin, IpcIo *req, IpcIo *reply);
190     int32_t reqId;
191 } g_reqCallMaps[] = {
192     {DevAuthRequestCall, DEV_AUTH_CALL_REQUEST},
193 };
194 
OnRemoteInvoke(IServerProxy * iProxy,int32_t reqId,void * origin,IpcIo * req,IpcIo * reply)195 int32_t OnRemoteInvoke(IServerProxy *iProxy, int32_t reqId, void *origin, IpcIo *req, IpcIo *reply)
196 {
197     int32_t i;
198     int32_t n;
199     int32_t (*callCtx)(void *origin, IpcIo *req, IpcIo *reply) = NULL;
200     IpcIo replyTmp;
201     uint8_t dataBuff[IPC_IO_BUFF_SZ] = { 0 };
202     int32_t ret = HC_ERR_IPC_UNKNOW_OPCODE;
203 
204     (void)origin;
205     (void)iProxy;
206     LOGI("request code %u", reqId);
207     n = sizeof(g_reqCallMaps) / sizeof(g_reqCallMaps[0]);
208     for (i = 0; i < n; i++) {
209         if ((int32_t)reqId == g_reqCallMaps[i].reqId) {
210             callCtx = g_reqCallMaps[i].callCtx;
211             break;
212         }
213     }
214     (void)memset_s(&replyTmp, sizeof(IpcIo), 0, sizeof(IpcIo));
215     IpcIoInit(&replyTmp, dataBuff, sizeof(dataBuff), 0);
216     if (callCtx) {
217         ret = callCtx(origin, req, &replyTmp);
218     }
219     WriteInt32(reply, ret);
220     if (reply != NULL) {
221         n = GetIpcIoDataLength(&replyTmp);
222         if (n > 0) {
223             WriteUint32(reply, n);
224             if (!WriteBuffer(reply, (const void *)(replyTmp.bufferBase + IpcIoBufferOffset()), n)) {
225                 LOGI("WriteBuffer faild");
226                 return HC_ERROR;
227             }
228             LOGI("form service result done, result length(%d)", n);
229         }
230     }
231     LOGI("done, request code %d, call result %d", reqId, ret);
232     return 0;
233 }
234 
SetCallMap(IpcServiceCall method,int32_t methodId)235 int32_t SetCallMap(IpcServiceCall method, int32_t methodId)
236 {
237     int32_t len;
238     IpcServiceCallMap *callMapTmp = NULL;
239 
240     if ((1 + g_callMapElemNum) > g_maxCallMapSz) {
241         g_maxCallMapSz += MAX_CALLMAP_SIZE;
242         if (g_callMapTable != NULL) {
243             callMapTmp = g_callMapTable;
244             g_callMapTable = NULL;
245         }
246     }
247     if (g_callMapTable == NULL) {
248         len = sizeof(IpcServiceCallMap) * g_maxCallMapSz;
249         g_callMapTable = (IpcServiceCallMap *)HcMalloc(len, 0);
250         if (g_callMapTable == NULL) {
251             return HC_ERR_ALLOC_MEMORY;
252         }
253         (void)memset_s(g_callMapTable, len, 0, len);
254         if (callMapTmp != NULL) {
255             errno_t eno = memcpy_s(g_callMapTable, len, callMapTmp, (sizeof(IpcServiceCallMap) * g_callMapElemNum));
256             if (eno != EOK) {
257                 HcFree((void *)g_callMapTable);
258                 g_callMapTable = callMapTmp;
259                 g_maxCallMapSz -= MAX_CALLMAP_SIZE;
260                 return HC_ERR_MEMORY_COPY;
261             }
262             HcFree((void *)callMapTmp);
263             callMapTmp = NULL;
264         }
265     }
266     g_callMapTable[g_callMapElemNum].method = method;
267     g_callMapTable[g_callMapElemNum].methodId = methodId;
268     g_callMapElemNum++;
269     return HC_SUCCESS;
270 }
271 
SetRemoteObject(const SvcIdentity * object)272 int32_t SetRemoteObject(const SvcIdentity *object)
273 {
274     int32_t idx = -1;
275     int32_t i;
276 
277     LockCbStubTable();
278     for (i = 0; i < MAX_CBSTUB_SIZE; i++) {
279         if (!g_cbStub[i].inUse) {
280             idx = i;
281             break;
282         }
283     }
284     LOGI("remote object cache index %d", idx);
285     if (idx == -1) {
286         UnLockCbStubTable();
287         return -1;
288     }
289     g_cbStub[idx].cbStub = *object;
290     g_cbStub[idx].cbDieId = 0;
291     g_cbStub[idx].inUse = true;
292     UnLockCbStubTable();
293     ShowIpcSvcInfo(&(g_cbStub[idx].cbStub));
294     return idx;
295 }
296 
ClientDeathCallback(void * arg)297 static void ClientDeathCallback(void *arg)
298 {
299     int32_t callbackIdx = (int32_t)(size_t)arg;
300 
301     LOGI("remote is not actively, to reset local resource");
302     ResetIpcCallBackNodeByNodeId(callbackIdx);
303 }
304 
AddCbDeathRecipient(int32_t cbStubIdx,int32_t cbDataIdx)305 void AddCbDeathRecipient(int32_t cbStubIdx, int32_t cbDataIdx)
306 {
307     int32_t ret;
308     uint32_t cbId = 0;
309     if ((cbStubIdx < 0) || (cbStubIdx >= MAX_CBSTUB_SIZE)) {
310         return;
311     }
312 
313     LockCbStubTable();
314     if (!g_cbStub[cbStubIdx].inUse) {
315         UnLockCbStubTable();
316         return;
317     }
318     ret = AddDeathRecipient(g_cbStub[cbStubIdx].cbStub, ClientDeathCallback, (void *)(size_t)cbDataIdx, &cbId);
319     if (ret == 0) {
320         g_cbStub[cbStubIdx].cbDieId = cbId;
321     }
322     UnLockCbStubTable();
323     LOGI("done, ret %d, callback stub idx %d", ret, cbStubIdx);
324     return;
325 }
326 
ResetRemoteObject(int32_t idx)327 void ResetRemoteObject(int32_t idx)
328 {
329     if ((idx >= 0) && (idx < MAX_CBSTUB_SIZE)) {
330         LOGI("object idx %d", idx);
331         LockCbStubTable();
332         if (!g_cbStub[idx].inUse) {
333             UnLockCbStubTable();
334             return;
335         }
336         RemoveDeathRecipient(g_cbStub[idx].cbStub, g_cbStub[idx].cbDieId);
337         (void)memset_s(&(g_cbStub[idx].cbStub), sizeof(g_cbStub[idx].cbStub), 0, sizeof(g_cbStub[idx].cbStub));
338         g_cbStub[idx].inUse = false;
339         UnLockCbStubTable();
340         LOGI("remote object used done, idx %d", idx);
341     }
342     return;
343 }
344 
ActCallback(int32_t objIdx,int32_t callbackId,uintptr_t cbHook,IpcIo * dataParcel,IpcIo * reply)345 void ActCallback(int32_t objIdx, int32_t callbackId, uintptr_t cbHook, IpcIo *dataParcel, IpcIo *reply)
346 {
347     if ((objIdx < 0) || (objIdx >= MAX_CBSTUB_SIZE) || (!g_cbStub[objIdx].inUse)) {
348         LOGW("nothing to do, callback id %d, remote object id %d", callbackId, objIdx);
349         return;
350     }
351 
352     ShowIpcSvcInfo(&g_cbStub[objIdx].cbStub);
353     LockCbStubTable();
354     CbProxySendRequest(g_cbStub[objIdx].cbStub, callbackId, cbHook, dataParcel, reply);
355     UnLockCbStubTable();
356     return;
357 }
358 
359 #ifdef __cplusplus
360 }
361 #endif
362