SurfaceFlinger: Safely cast from IBinder to Layer::Handle am: a8c7c54eed (7a8447fa) · Commits · e / os / android_frameworks_native-old

services/surfaceflinger/Layer.cpp

+20 −22

Original line number	Original line	Diff line number	Diff line
	@@ -819,11 +819,7 @@ void Layer::setZOrderRelativeOf(const wp<Layer>& relativeOf) {
	}		}

	bool Layer::setRelativeLayer(const sp<IBinder>& relativeToHandle, int32_t relativeZ) {		bool Layer::setRelativeLayer(const sp<IBinder>& relativeToHandle, int32_t relativeZ) {
	sp<Handle> handle = static_cast<Handle*>(relativeToHandle.get());		sp<Layer> relative = fromHandle(relativeToHandle).promote();
	if (handle == nullptr) {
	return false;
	}
	sp<Layer> relative = handle->owner.promote();
	if (relative == nullptr) {		if (relative == nullptr) {
	return false;		return false;
	}		}
	@@ -1609,8 +1605,7 @@ void Layer::setChildrenDrawingParent(const sp<Layer>& newParent) {
	bool Layer::reparent(const sp<IBinder>& newParentHandle) {		bool Layer::reparent(const sp<IBinder>& newParentHandle) {
	sp<Layer> newParent;		sp<Layer> newParent;
	if (newParentHandle != nullptr) {		if (newParentHandle != nullptr) {
	auto handle = static_cast<Handle*>(newParentHandle.get());		newParent = fromHandle(newParentHandle).promote();
	newParent = handle->owner.promote();
	if (newParent == nullptr) {		if (newParent == nullptr) {
	ALOGE("Unable to promote Layer handle");		ALOGE("Unable to promote Layer handle");
	return false;		return false;
	@@ -1985,24 +1980,10 @@ void Layer::commitChildList() {
	mDrawingParent = mCurrentParent;		mDrawingParent = mCurrentParent;
	}		}

	static wp<Layer> extractLayerFromBinder(const wp<IBinder>& weakBinderHandle) {
	if (weakBinderHandle == nullptr) {
	return nullptr;
	}
	sp<IBinder> binderHandle = weakBinderHandle.promote();
	if (binderHandle == nullptr) {
	return nullptr;
	}
	sp<Layer::Handle> handle = static_cast<Layer::Handle*>(binderHandle.get());
	if (handle == nullptr) {
	return nullptr;
	}
	return handle->owner;
	}

	void Layer::setInputInfo(const InputWindowInfo& info) {		void Layer::setInputInfo(const InputWindowInfo& info) {
	mDrawingState.inputInfo = info;		mDrawingState.inputInfo = info;
	mDrawingState.touchableRegionCrop = extractLayerFromBinder(info.touchableRegionCropHandle);		mDrawingState.touchableRegionCrop = fromHandle(info.touchableRegionCropHandle.promote());
	mDrawingState.modified = true;		mDrawingState.modified = true;
	mFlinger->mInputInfoChanged = true;		mFlinger->mInputInfoChanged = true;
	setTransactionFlags(eTransactionNeeded);		setTransactionFlags(eTransactionNeeded);
	@@ -2561,6 +2542,23 @@ void Layer::setClonedChild(const sp<Layer>& clonedChild) {
	mFlinger->mNumClones++;		mFlinger->mNumClones++;
	}		}

			const String16 Layer::Handle::kDescriptor = String16("android.Layer.Handle");

			wp<Layer> Layer::fromHandle(const sp<IBinder>& handleBinder) {
			if (handleBinder == nullptr) {
			return nullptr;
			}

			BBinder* b = handleBinder->localBinder();
			if (b == nullptr \|\| b->getInterfaceDescriptor() != Handle::kDescriptor) {
			return nullptr;
			}

			// We can safely cast this binder since its local and we verified its interface descriptor.
			sp<Handle> handle = static_cast<Handle*>(handleBinder.get());
			return handle->owner;
			}

	// ---------------------------------------------------------------------------		// ---------------------------------------------------------------------------

	std::ostream& operator<<(std::ostream& stream, const Layer::FrameRate& rate) {		std::ostream& operator<<(std::ostream& stream, const Layer::FrameRate& rate) {

services/surfaceflinger/Layer.h

+9 −4

Original line number	Original line	Diff line number	Diff line
	@@ -289,16 +289,17 @@ public:
	class LayerCleaner {		class LayerCleaner {
	sp<SurfaceFlinger> mFlinger;		sp<SurfaceFlinger> mFlinger;
	sp<Layer> mLayer;		sp<Layer> mLayer;
			BBinder* mHandle;

	protected:		protected:
	~LayerCleaner() {		~LayerCleaner() {
	// destroy client resources		// destroy client resources
	mFlinger->onHandleDestroyed(mLayer);		mFlinger->onHandleDestroyed(mHandle, mLayer);
	}		}

	public:		public:
	LayerCleaner(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer)		LayerCleaner(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer, BBinder* handle)
	: mFlinger(flinger), mLayer(layer) {}		: mFlinger(flinger), mLayer(layer), mHandle(handle) {}
	};		};

	/*		/*
	@@ -312,11 +313,15 @@ public:
	class Handle : public BBinder, public LayerCleaner {		class Handle : public BBinder, public LayerCleaner {
	public:		public:
	Handle(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer)		Handle(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer)
	: LayerCleaner(flinger, layer), owner(layer) {}		: LayerCleaner(flinger, layer, this), owner(layer) {}
			const String16& getInterfaceDescriptor() const override { return kDescriptor; }

			static const String16 kDescriptor;
	wp<Layer> owner;		wp<Layer> owner;
	};		};

			static wp<Layer> fromHandle(const sp<IBinder>& handle);

	explicit Layer(const LayerCreationArgs& args);		explicit Layer(const LayerCreationArgs& args);
	virtual ~Layer();		virtual ~Layer();

services/surfaceflinger/SurfaceFlinger.cpp

+11 −39

Original line number	Original line	Diff line number	Diff line
	@@ -3611,7 +3611,7 @@ bool SurfaceFlinger::transactionIsReadyToBeApplied(

	sp<Layer> layer = nullptr;		sp<Layer> layer = nullptr;
	if (s.surface) {		if (s.surface) {
	layer = fromHandleLocked(s.surface).promote();		layer = fromHandle(s.surface).promote();
	} else if (s.hasBufferChanges()) {		} else if (s.hasBufferChanges()) {
	ALOGW("Transaction with buffer, but no Layer?");		ALOGW("Transaction with buffer, but no Layer?");
	continue;		continue;
	@@ -3778,7 +3778,7 @@ void SurfaceFlinger::applyTransactionState(const FrameTimelineInfo& frameTimelin
	setClientStateLocked(frameTimelineInfo, state, desiredPresentTime, isAutoTimestamp,		setClientStateLocked(frameTimelineInfo, state, desiredPresentTime, isAutoTimestamp,
	postTime, permissions, listenerCallbacksWithSurfaces);		postTime, permissions, listenerCallbacksWithSurfaces);
	if ((flags & eAnimation) && state.state.surface) {		if ((flags & eAnimation) && state.state.surface) {
	if (const auto layer = fromHandleLocked(state.state.surface).promote(); layer) {		if (const auto layer = fromHandle(state.state.surface).promote(); layer) {
	mScheduler->recordLayerHistory(layer.get(),		mScheduler->recordLayerHistory(layer.get(),
	isAutoTimestamp ? 0 : desiredPresentTime,		isAutoTimestamp ? 0 : desiredPresentTime,
	LayerHistory::LayerUpdateType::AnimationTX);		LayerHistory::LayerUpdateType::AnimationTX);
	@@ -3933,13 +3933,11 @@ uint32_t SurfaceFlinger::setClientStateLocked(
	if (what & layer_state_t::eLayerCreated) {		if (what & layer_state_t::eLayerCreated) {
	layer = handleLayerCreatedLocked(s.surface);		layer = handleLayerCreatedLocked(s.surface);
	if (layer) {		if (layer) {
	// put the created layer into mLayersByLocalBinderToken.
	mLayersByLocalBinderToken.emplace(s.surface->localBinder(), layer);
	flags \|= eTransactionNeeded \| eTraversalNeeded;		flags \|= eTransactionNeeded \| eTraversalNeeded;
	mLayersAdded = true;		mLayersAdded = true;
	}		}
	} else {		} else {
	layer = fromHandleLocked(s.surface).promote();		layer = fromHandle(s.surface).promote();
	}		}
	} else {		} else {
	// The client may provide us a null handle. Treat it as if the layer was removed.		// The client may provide us a null handle. Treat it as if the layer was removed.
	@@ -4267,7 +4265,7 @@ status_t SurfaceFlinger::mirrorLayer(const sp<Client>& client, const sp<IBinder>

	{		{
	Mutex::Autolock _l(mStateLock);		Mutex::Autolock _l(mStateLock);
	mirrorFrom = fromHandleLocked(mirrorFromHandle).promote();		mirrorFrom = fromHandle(mirrorFromHandle).promote();
	if (!mirrorFrom) {		if (!mirrorFrom) {
	return NAME_NOT_FOUND;		return NAME_NOT_FOUND;
	}		}
	@@ -4465,7 +4463,7 @@ void SurfaceFlinger::markLayerPendingRemovalLocked(const sp<Layer>& layer) {
	setTransactionFlags(eTransactionNeeded);		setTransactionFlags(eTransactionNeeded);
	}		}

	void SurfaceFlinger::onHandleDestroyed(sp<Layer>& layer) {		void SurfaceFlinger::onHandleDestroyed(BBinder* handle, sp<Layer>& layer) {
	Mutex::Autolock lock(mStateLock);		Mutex::Autolock lock(mStateLock);
	// If a layer has a parent, we allow it to out-live it's handle		// If a layer has a parent, we allow it to out-live it's handle
	// with the idea that the parent holds a reference and will eventually		// with the idea that the parent holds a reference and will eventually
	@@ -4476,17 +4474,7 @@ void SurfaceFlinger::onHandleDestroyed(sp<Layer>& layer) {
	mCurrentState.layersSortedByZ.remove(layer);		mCurrentState.layersSortedByZ.remove(layer);
	}		}
	markLayerPendingRemovalLocked(layer);		markLayerPendingRemovalLocked(layer);
			mBufferCountTracker.remove(handle);
	auto it = mLayersByLocalBinderToken.begin();
	while (it != mLayersByLocalBinderToken.end()) {
	if (it->second == layer) {
	mBufferCountTracker.remove(it->first->localBinder());
	it = mLayersByLocalBinderToken.erase(it);
	} else {
	it++;
	}
	}

	layer.clear();		layer.clear();
	}		}

	@@ -6089,7 +6077,7 @@ status_t SurfaceFlinger::captureLayers(const LayerCaptureArgs& args,
	{		{
	Mutex::Autolock lock(mStateLock);		Mutex::Autolock lock(mStateLock);

	parent = fromHandleLocked(args.layerHandle).promote();		parent = fromHandle(args.layerHandle).promote();
	if (parent == nullptr \|\| parent->isRemovedFromCurrentState()) {		if (parent == nullptr \|\| parent->isRemovedFromCurrentState()) {
	ALOGE("captureLayers called with an invalid or removed parent");		ALOGE("captureLayers called with an invalid or removed parent");
	return NAME_NOT_FOUND;		return NAME_NOT_FOUND;
	@@ -6120,7 +6108,7 @@ status_t SurfaceFlinger::captureLayers(const LayerCaptureArgs& args,
	reqSize = ui::Size(crop.width() * args.frameScaleX, crop.height() * args.frameScaleY);		reqSize = ui::Size(crop.width() * args.frameScaleX, crop.height() * args.frameScaleY);

	for (const auto& handle : args.excludeHandles) {		for (const auto& handle : args.excludeHandles) {
	sp<Layer> excludeLayer = fromHandleLocked(handle).promote();		sp<Layer> excludeLayer = fromHandle(handle).promote();
	if (excludeLayer != nullptr) {		if (excludeLayer != nullptr) {
	excludeLayers.emplace(excludeLayer);		excludeLayers.emplace(excludeLayer);
	} else {		} else {
	@@ -6616,24 +6604,8 @@ status_t SurfaceFlinger::getDesiredDisplayModeSpecs(const sp<IBinder>& displayTo
	}		}
	}		}

	wp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) {		wp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) const {
	Mutex::Autolock _l(mStateLock);		return Layer::fromHandle(handle);
	return fromHandleLocked(handle);
	}

	wp<Layer> SurfaceFlinger::fromHandleLocked(const sp<IBinder>& handle) const {
	BBinder* b = nullptr;
	if (handle) {
	b = handle->localBinder();
	}
	if (b == nullptr) {
	return nullptr;
	}
	auto it = mLayersByLocalBinderToken.find(b);
	if (it != mLayersByLocalBinderToken.end()) {
	return it->second;
	}
	return nullptr;
	}		}

	void SurfaceFlinger::onLayerFirstRef(Layer* layer) {		void SurfaceFlinger::onLayerFirstRef(Layer* layer) {
	@@ -6938,7 +6910,7 @@ sp<Layer> SurfaceFlinger::handleLayerCreatedLocked(const sp<IBinder>& handle) {
	sp<Layer> parent;		sp<Layer> parent;
	bool allowAddRoot = state->addToRoot;		bool allowAddRoot = state->addToRoot;
	if (state->initialParent != nullptr) {		if (state->initialParent != nullptr) {
	parent = fromHandleLocked(state->initialParent.promote()).promote();		parent = fromHandle(state->initialParent.promote()).promote();
	if (parent == nullptr) {		if (parent == nullptr) {
	ALOGE("Invalid parent %p", state->initialParent.unsafe_get());		ALOGE("Invalid parent %p", state->initialParent.unsafe_get());
	allowAddRoot = false;		allowAddRoot = false;

services/surfaceflinger/SurfaceFlinger.h

+2 −5

services/surfaceflinger/SurfaceInterceptor.cpp

+5 −9

Original line number	Original line	Diff line number	Diff line
	@@ -183,12 +183,9 @@ status_t SurfaceInterceptor::writeProtoFileLocked() {
	return NO_ERROR;		return NO_ERROR;
	}		}

	const sp<const Layer> SurfaceInterceptor::getLayer(const wp<const IBinder>& weakHandle) const {		const sp<const Layer> SurfaceInterceptor::getLayer(const wp<IBinder>& weakHandle) const {
	const sp<const IBinder>& handle(weakHandle.promote());		sp<IBinder> handle = weakHandle.promote();
	const auto layerHandle(static_cast<const Layer::Handle*>(handle.get()));		return Layer::fromHandle(handle).promote();
	const sp<const Layer> layer(layerHandle->owner.promote());
	// layer could be a nullptr at this point
	return layer;
	}		}

	int32_t SurfaceInterceptor::getLayerId(const sp<const Layer>& layer) const {		int32_t SurfaceInterceptor::getLayerId(const sp<const Layer>& layer) const {
	@@ -203,12 +200,11 @@ int32_t SurfaceInterceptor::getLayerIdFromWeakRef(const wp<const Layer>& layer)
	return strongLayer == nullptr ? -1 : getLayerId(strongLayer);		return strongLayer == nullptr ? -1 : getLayerId(strongLayer);
	}		}

	int32_t SurfaceInterceptor::getLayerIdFromHandle(const sp<const IBinder>& handle) const {		int32_t SurfaceInterceptor::getLayerIdFromHandle(const sp<IBinder>& handle) const {
	if (handle == nullptr) {		if (handle == nullptr) {
	return -1;		return -1;
	}		}
	const auto layerHandle(static_cast<const Layer::Handle*>(handle.get()));		const sp<const Layer> layer = Layer::fromHandle(handle).promote();
	const sp<const Layer> layer(layerHandle->owner.promote());
	return layer == nullptr ? -1 : getLayerId(layer);		return layer == nullptr ? -1 : getLayerId(layer);
	}		}

Original line number	Original line	Diff line number	Diff line
	@@ -327,8 +327,7 @@ public:
	// Returns nullptr if the handle does not point to an existing layer.		// Returns nullptr if the handle does not point to an existing layer.
	// Otherwise, returns a weak reference so that callers off the main-thread		// Otherwise, returns a weak reference so that callers off the main-thread
	// won't accidentally hold onto the last strong reference.		// won't accidentally hold onto the last strong reference.
	wp<Layer> fromHandle(const sp<IBinder>& handle);		wp<Layer> fromHandle(const sp<IBinder>& handle) const;
	wp<Layer> fromHandleLocked(const sp<IBinder>& handle) const REQUIRES(mStateLock);

	// If set, disables reusing client composition buffers. This can be set by		// If set, disables reusing client composition buffers. This can be set by
	// debug.sf.disable_client_composition_cache		// debug.sf.disable_client_composition_cache
	@@ -898,7 +897,7 @@ private:
	// called when all clients have released all their references to		// called when all clients have released all their references to
	// this layer meaning it is entirely safe to destroy all		// this layer meaning it is entirely safe to destroy all
	// resources associated to this layer.		// resources associated to this layer.
	void onHandleDestroyed(sp<Layer>& layer);		void onHandleDestroyed(BBinder* handle, sp<Layer>& layer);
	void markLayerPendingRemovalLocked(const sp<Layer>& layer);		void markLayerPendingRemovalLocked(const sp<Layer>& layer);

	// add a layer to SurfaceFlinger		// add a layer to SurfaceFlinger
	@@ -1290,8 +1289,6 @@ private:
	std::optional<DisplayIdGenerator<HalVirtualDisplayId>> hal;		std::optional<DisplayIdGenerator<HalVirtualDisplayId>> hal;
	} mVirtualDisplayIdGenerators;		} mVirtualDisplayIdGenerators;

	std::unordered_map<BBinder*, wp<Layer>> mLayersByLocalBinderToken GUARDED_BY(mStateLock);

	// don't use a lock for these, we don't care		// don't use a lock for these, we don't care
	int mDebugRegion = 0;		int mDebugRegion = 0;
	bool mDebugDisableHWC = false;		bool mDebugDisableHWC = false;