release-request-33b11ddd-d658-45bf-bdb2-acceb024fe39-for-git_oc-release-404276... (ef9418f5) · Commits · e / devices / smdk4412 / android_frameworks_native

libs/gui/tests/Android.bp

+1 −0

Original line number	Diff line number	Diff line
		@@ -14,6 +14,7 @@ cc_test {
		"FillBuffer.cpp",
		"GLTest.cpp",
		"IGraphicBufferProducer_test.cpp",
		"Malicious.cpp",
		"MultiTextureConsumer_test.cpp",
		"StreamSplitter_test.cpp",
		"SurfaceTextureClient_test.cpp",

libs/gui/tests/Malicious.cpp

0 → 100644

+202 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright 2017 The Android Open Source Project
		*
		* Licensed under the Apache License, Version 2.0 (the "License");
		* you may not use this file except in compliance with the License.
		* You may obtain a copy of the License at
		*
		* http://www.apache.org/licenses/LICENSE-2.0
		*
		* Unless required by applicable law or agreed to in writing, software
		* distributed under the License is distributed on an "AS IS" BASIS,
		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		* See the License for the specific language governing permissions and
		* limitations under the License.
		*/

		#include <gui/BufferQueue.h>
		#include <gui/IProducerListener.h>
		#include <gui/Surface.h>

		#include <android/native_window.h>

		#include <gtest/gtest.h>

		namespace android {
		namespace test {

		class ProxyBQP : public BnGraphicBufferProducer {
		public:
		ProxyBQP(const sp<IGraphicBufferProducer>& producer) : mProducer(producer) {}

		// Pass through calls to mProducer
		status_t requestBuffer(int slot, sp<GraphicBuffer>* buf) override {
		return mProducer->requestBuffer(slot, buf);
		}
		status_t setMaxDequeuedBufferCount(int maxDequeuedBuffers) override {
		return mProducer->setMaxDequeuedBufferCount(maxDequeuedBuffers);
		}
		status_t setAsyncMode(bool async) override { return mProducer->setAsyncMode(async); }
		status_t dequeueBuffer(int* slot, sp<Fence>* fence, uint32_t w, uint32_t h, PixelFormat format,
		uint32_t usage, FrameEventHistoryDelta* outTimestamps) override {
		return mProducer->dequeueBuffer(slot, fence, w, h, format, usage, outTimestamps);
		}
		status_t detachBuffer(int slot) override { return mProducer->detachBuffer(slot); }
		status_t detachNextBuffer(sp<GraphicBuffer>* outBuffer, sp<Fence>* outFence) override {
		return mProducer->detachNextBuffer(outBuffer, outFence);
		}
		status_t attachBuffer(int* outSlot, const sp<GraphicBuffer>& buffer) override {
		return mProducer->attachBuffer(outSlot, buffer);
		}
		status_t queueBuffer(int slot, const QueueBufferInput& input,
		QueueBufferOutput* output) override {
		return mProducer->queueBuffer(slot, input, output);
		}
		status_t cancelBuffer(int slot, const sp<Fence>& fence) override {
		return mProducer->cancelBuffer(slot, fence);
		}
		int query(int what, int* value) override { return mProducer->query(what, value); }
		status_t connect(const sp<IProducerListener>& listener, int api, bool producerControlledByApp,
		QueueBufferOutput* output) override {
		return mProducer->connect(listener, api, producerControlledByApp, output);
		}
		status_t disconnect(int api, DisconnectMode mode) override {
		return mProducer->disconnect(api, mode);
		}
		status_t setSidebandStream(const sp<NativeHandle>& stream) override {
		return mProducer->setSidebandStream(stream);
		}
		void allocateBuffers(uint32_t width, uint32_t height, PixelFormat format,
		uint32_t usage) override {
		mProducer->allocateBuffers(width, height, format, usage);
		}
		status_t allowAllocation(bool allow) override { return mProducer->allowAllocation(allow); }
		status_t setGenerationNumber(uint32_t generationNumber) override {
		return mProducer->setGenerationNumber(generationNumber);
		}
		String8 getConsumerName() const override { return mProducer->getConsumerName(); }
		status_t setSharedBufferMode(bool sharedBufferMode) override {
		return mProducer->setSharedBufferMode(sharedBufferMode);
		}
		status_t setAutoRefresh(bool autoRefresh) override {
		return mProducer->setAutoRefresh(autoRefresh);
		}
		status_t setDequeueTimeout(nsecs_t timeout) override {
		return mProducer->setDequeueTimeout(timeout);
		}
		status_t getLastQueuedBuffer(sp<GraphicBuffer>* outBuffer, sp<Fence>* outFence,
		float outTransformMatrix[16]) override {
		return mProducer->getLastQueuedBuffer(outBuffer, outFence, outTransformMatrix);
		}
		void getFrameTimestamps(FrameEventHistoryDelta*) override {}
		status_t getUniqueId(uint64_t* outId) const override { return mProducer->getUniqueId(outId); }

		protected:
		sp<IGraphicBufferProducer> mProducer;
		};

		class MaliciousBQP : public ProxyBQP {
		public:
		MaliciousBQP(const sp<IGraphicBufferProducer>& producer) : ProxyBQP(producer) {}

		void beMalicious(int32_t value) { mMaliciousValue = value; }

		void setExpectedSlot(int32_t slot) { mExpectedSlot = slot; }

		// Override dequeueBuffer, optionally corrupting the returned slot number
		status_t dequeueBuffer(int* buf, sp<Fence>* fence, uint32_t width, uint32_t height,
		PixelFormat format, uint32_t usage,
		FrameEventHistoryDelta* outTimestamps) override {
		EXPECT_EQ(BUFFER_NEEDS_REALLOCATION,
		mProducer->dequeueBuffer(buf, fence, width, height, format, usage,
		outTimestamps));
		EXPECT_EQ(mExpectedSlot, *buf);
		if (mMaliciousValue != 0) {
		*buf = mMaliciousValue;
		return NO_ERROR;
		} else {
		return BUFFER_NEEDS_REALLOCATION;
		}
		}

		private:
		int32_t mMaliciousValue = 0;
		int32_t mExpectedSlot = 0;
		};

		class DummyListener : public BnConsumerListener {
		public:
		void onFrameAvailable(const BufferItem&) override {}
		void onBuffersReleased() override {}
		void onSidebandStreamChanged() override {}
		};

		sp<MaliciousBQP> getMaliciousBQP() {
		sp<IGraphicBufferProducer> producer;
		sp<IGraphicBufferConsumer> consumer;
		BufferQueue::createBufferQueue(&producer, &consumer);
		sp<IConsumerListener> listener = new DummyListener;
		consumer->consumerConnect(listener, false);

		sp<MaliciousBQP> malicious = new MaliciousBQP(producer);
		return malicious;
		}

		TEST(Malicious, Bug36991414Max) {
		sp<MaliciousBQP> malicious = getMaliciousBQP();
		sp<Surface> surface = new Surface(malicious);

		ASSERT_EQ(NO_ERROR, surface->connect(NATIVE_WINDOW_API_CPU, nullptr, false));
		ANativeWindow_Buffer buffer;
		ASSERT_EQ(NO_ERROR, surface->lock(&buffer, nullptr));
		ASSERT_EQ(NO_ERROR, surface->unlockAndPost());

		malicious->setExpectedSlot(1);
		malicious->beMalicious(std::numeric_limits<int32_t>::max());
		ASSERT_EQ(FAILED_TRANSACTION, surface->lock(&buffer, nullptr));
		}

		TEST(Malicious, Bug36991414Min) {
		sp<MaliciousBQP> malicious = getMaliciousBQP();
		sp<Surface> surface = new Surface(malicious);

		ASSERT_EQ(NO_ERROR, surface->connect(NATIVE_WINDOW_API_CPU, nullptr, false));
		ANativeWindow_Buffer buffer;
		ASSERT_EQ(NO_ERROR, surface->lock(&buffer, nullptr));
		ASSERT_EQ(NO_ERROR, surface->unlockAndPost());

		malicious->setExpectedSlot(1);
		malicious->beMalicious(std::numeric_limits<int32_t>::min());
		ASSERT_EQ(FAILED_TRANSACTION, surface->lock(&buffer, nullptr));
		}

		TEST(Malicious, Bug36991414NegativeOne) {
		sp<MaliciousBQP> malicious = getMaliciousBQP();
		sp<Surface> surface = new Surface(malicious);

		ASSERT_EQ(NO_ERROR, surface->connect(NATIVE_WINDOW_API_CPU, nullptr, false));
		ANativeWindow_Buffer buffer;
		ASSERT_EQ(NO_ERROR, surface->lock(&buffer, nullptr));
		ASSERT_EQ(NO_ERROR, surface->unlockAndPost());

		malicious->setExpectedSlot(1);
		malicious->beMalicious(-1);
		ASSERT_EQ(FAILED_TRANSACTION, surface->lock(&buffer, nullptr));
		}

		TEST(Malicious, Bug36991414NumSlots) {
		sp<MaliciousBQP> malicious = getMaliciousBQP();
		sp<Surface> surface = new Surface(malicious);

		ASSERT_EQ(NO_ERROR, surface->connect(NATIVE_WINDOW_API_CPU, nullptr, false));
		ANativeWindow_Buffer buffer;
		ASSERT_EQ(NO_ERROR, surface->lock(&buffer, nullptr));
		ASSERT_EQ(NO_ERROR, surface->unlockAndPost());

		malicious->setExpectedSlot(1);
		malicious->beMalicious(BufferQueueDefs::NUM_BUFFER_SLOTS);
		ASSERT_EQ(FAILED_TRANSACTION, surface->lock(&buffer, nullptr));
		}

		} // namespace test
		} // namespace android

services/surfaceflinger/Android.mk

+0 −4

Original line number	Diff line number	Diff line
		@@ -54,11 +54,7 @@ ifeq ($(TARGET_USES_HWC2),true)
		LOCAL_SRC_FILES += \
		SurfaceFlinger.cpp \
		DisplayHardware/HWComposer.cpp
		ifeq ($(TARGET_USES_HWC2ON1ADAPTER), true)
		LOCAL_CFLAGS += -DBYPASS_IHWC
		endif
		else
		LOCAL_CFLAGS += -DBYPASS_IHWC
		LOCAL_SRC_FILES += \
		SurfaceFlinger_hwc1.cpp \
		DisplayHardware/HWComposer_hwc1.cpp

services/surfaceflinger/DisplayHardware/HWC2.cpp

+0 −514

File changed.

Preview size limit exceeded, changes collapsed.

services/surfaceflinger/DisplayHardware/HWC2.h

+0 −88

Original line number	Diff line number	Diff line
		@@ -62,14 +62,10 @@ typedef std::function<void(std::shared_ptr<Display>, nsecs_t)> VsyncCallback;
		class Device
		{
		public:
		#ifdef BYPASS_IHWC
		explicit Device(hwc2_device_t* device);
		#else
		// useVrComposer is passed to the composer HAL. When true, the composer HAL
		// will use the vr composer service, otherwise it uses the real hardware
		// composer.
		Device(bool useVrComposer);
		#endif
		~Device();

		friend class HWC2::Display;
		@@ -107,43 +103,12 @@ public:

		bool hasCapability(HWC2::Capability capability) const;

		#ifdef BYPASS_IHWC
		android::Hwc2::Composer* getComposer() { return nullptr; }
		#else
		android::Hwc2::Composer* getComposer() { return mComposer.get(); }
		#endif

		private:
		// Initialization methods

		#ifdef BYPASS_IHWC
		template <typename PFN>
		[[clang::warn_unused_result]] bool loadFunctionPointer(
		FunctionDescriptor desc, PFN& outPFN) {
		auto intDesc = static_cast<int32_t>(desc);
		auto pfn = mHwcDevice->getFunction(mHwcDevice, intDesc);
		if (pfn != nullptr) {
		outPFN = reinterpret_cast<PFN>(pfn);
		return true;
		} else {
		ALOGE("Failed to load function %s", to_string(desc).c_str());
		return false;
		}
		}

		template <typename PFN, typename HOOK>
		void registerCallback(Callback callback, HOOK hook) {
		static_assert(std::is_same<PFN, HOOK>::value,
		"Incompatible function pointer");
		auto intCallback = static_cast<int32_t>(callback);
		auto callbackData = static_cast<hwc2_callback_data_t>(this);
		auto pfn = reinterpret_cast<hwc2_function_pointer_t>(hook);
		mRegisterCallback(mHwcDevice, intCallback, callbackData, pfn);
		}
		#endif

		void loadCapabilities();
		void loadFunctionPointers();
		void registerCallbacks();

		// For use by Display
		@@ -151,60 +116,7 @@ private:
		void destroyVirtualDisplay(hwc2_display_t display);

		// Member variables

		#ifdef BYPASS_IHWC
		hwc2_device_t* mHwcDevice;

		// Device function pointers
		HWC2_PFN_CREATE_VIRTUAL_DISPLAY mCreateVirtualDisplay;
		HWC2_PFN_DESTROY_VIRTUAL_DISPLAY mDestroyVirtualDisplay;
		HWC2_PFN_DUMP mDump;
		HWC2_PFN_GET_MAX_VIRTUAL_DISPLAY_COUNT mGetMaxVirtualDisplayCount;
		HWC2_PFN_REGISTER_CALLBACK mRegisterCallback;

		// Display function pointers
		HWC2_PFN_ACCEPT_DISPLAY_CHANGES mAcceptDisplayChanges;
		HWC2_PFN_CREATE_LAYER mCreateLayer;
		HWC2_PFN_DESTROY_LAYER mDestroyLayer;
		HWC2_PFN_GET_ACTIVE_CONFIG mGetActiveConfig;
		HWC2_PFN_GET_CHANGED_COMPOSITION_TYPES mGetChangedCompositionTypes;
		HWC2_PFN_GET_COLOR_MODES mGetColorModes;
		HWC2_PFN_GET_DISPLAY_ATTRIBUTE mGetDisplayAttribute;
		HWC2_PFN_GET_DISPLAY_CONFIGS mGetDisplayConfigs;
		HWC2_PFN_GET_DISPLAY_NAME mGetDisplayName;
		HWC2_PFN_GET_DISPLAY_REQUESTS mGetDisplayRequests;
		HWC2_PFN_GET_DISPLAY_TYPE mGetDisplayType;
		HWC2_PFN_GET_DOZE_SUPPORT mGetDozeSupport;
		HWC2_PFN_GET_HDR_CAPABILITIES mGetHdrCapabilities;
		HWC2_PFN_GET_RELEASE_FENCES mGetReleaseFences;
		HWC2_PFN_PRESENT_DISPLAY mPresentDisplay;
		HWC2_PFN_SET_ACTIVE_CONFIG mSetActiveConfig;
		HWC2_PFN_SET_CLIENT_TARGET mSetClientTarget;
		HWC2_PFN_SET_COLOR_MODE mSetColorMode;
		HWC2_PFN_SET_COLOR_TRANSFORM mSetColorTransform;
		HWC2_PFN_SET_OUTPUT_BUFFER mSetOutputBuffer;
		HWC2_PFN_SET_POWER_MODE mSetPowerMode;
		HWC2_PFN_SET_VSYNC_ENABLED mSetVsyncEnabled;
		HWC2_PFN_VALIDATE_DISPLAY mValidateDisplay;

		// Layer function pointers
		HWC2_PFN_SET_CURSOR_POSITION mSetCursorPosition;
		HWC2_PFN_SET_LAYER_BUFFER mSetLayerBuffer;
		HWC2_PFN_SET_LAYER_SURFACE_DAMAGE mSetLayerSurfaceDamage;
		HWC2_PFN_SET_LAYER_BLEND_MODE mSetLayerBlendMode;
		HWC2_PFN_SET_LAYER_COLOR mSetLayerColor;
		HWC2_PFN_SET_LAYER_COMPOSITION_TYPE mSetLayerCompositionType;
		HWC2_PFN_SET_LAYER_DATASPACE mSetLayerDataspace;
		HWC2_PFN_SET_LAYER_DISPLAY_FRAME mSetLayerDisplayFrame;
		HWC2_PFN_SET_LAYER_PLANE_ALPHA mSetLayerPlaneAlpha;
		HWC2_PFN_SET_LAYER_SIDEBAND_STREAM mSetLayerSidebandStream;
		HWC2_PFN_SET_LAYER_SOURCE_CROP mSetLayerSourceCrop;
		HWC2_PFN_SET_LAYER_TRANSFORM mSetLayerTransform;
		HWC2_PFN_SET_LAYER_VISIBLE_REGION mSetLayerVisibleRegion;
		HWC2_PFN_SET_LAYER_Z_ORDER mSetLayerZOrder;
		#else
		std::unique_ptr<android::Hwc2::Composer> mComposer;
		#endif // BYPASS_IHWC

		std::unordered_set<Capability> mCapabilities;
		std::unordered_map<hwc2_display_t, std::weak_ptr<Display>> mDisplays;