Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.
Bug: 36991414
AOSP-Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
(cherry picked from commit 90ce2a9c1d3af422c66b4061805831cb208263d8)
CVE-2017-0665
Change-Id: If0fd4864b9fc4ea5a1c83d10adef26cdabb0f7e8
Inside Surface::lock if new buffer is allocated
and DirtyRegion does not cover complete buffer
bounds then copyback may not cover all remaining area
as it copyback only area covered by dirty regions
from other buffers. This will lead to left out
black area which may cause flicker.
Change-Id: I4a3f7a56fc5fbaf4af926584919577d8d34bed57
Copyback dirty region logic does copyback,
even when its not necessary causing 2ms delay.
Fix the logic to copy back only what is necessary
CRs-fixed: 562334
Change-Id: I52de68258ac9f87d704ee5401f93417805fa6773
Incoming surface damage was not aware that the EGL implementation was
rotating buffers in response to SurfaceFlinger's transform hint. This
didn't affect all cases because the effect was to apply a 90 degree
rotation instead of a 270 degree rotation. For full-screen updates,
things more or less worked, but in other cases this caused corruption.
This fixes that by correctly undoing the effect of rotated buffers on
the incoming surface damage, and then passing that damage down
untouched to HWC.
Bug: 22068334
Change-Id: I226ecfc7a91fe2e16edd2aa6d9149f0d26b529d6
Adds a getConsumerName method to IGraphicBufferProducer and Surface.
Currently, the name is cached inside of IGBP and is update on connect
and dequeueBuffer, which should be good enough for most uses.
Bug: 6667401
Change-Id: I22c7881d778e495cf8276de7bbcd769e52429915
Adds a getConsumerName method to IGraphicBufferProducer and Surface.
Currently, the name is cached inside of IGBP and is updated on connect
and dequeueBuffer, which should be good enough for most uses.
Bug: 6667401
Change-Id: Ife94bd89023fe7c00bad916932b9a19233fd2290
This change allows producers to set a generation number on a
BufferQueue. This number will be embedded in any new GraphicBuffers
created in that BufferQueue, and attempts to attach buffers which have
a different generation number will fail.
It also plumbs the setGenerationNumber method through Surface, with the
additional effect that any buffers attached to the Surface after
setting a new generation number will automatically be updated with the
new number (as opposed to failing, as would happen on through IGBP).
Bug: 20923096
Change-Id: I32bf726b035f99c3e5834beaf76afb9f01adcbc2
Flips the width and height when the buffer comes in with a 90 degree
rotation so that performing the Y-flip from GL works correctly.
Bug: 20761426
Change-Id: I41c9edc8549c6cbdb534277b996ff20c59034582
Surface::{cancel,queue}Buffer and GraphicBufferMapper::lockAsyncYCbCr take the
ownership of |fenceFd|s. Though they don't close it on error cases.
Change-Id: I49a7ce8837d5c510c4ac4ad4649f310d18610e80
(cherry picked from commit c7263fb432)
Changes Surface::detachNextBuffer to return an sp<GraphicBuffer>
instead of an ANativeWindowBuffer* to ensure that reference counting
works correctly.
Bug: 20092217
Change-Id: I3979ea6121aaf14845f0554477b778770413581e
(cherry picked from commit 8b2daa3ca29492b181fb67840640d771c4a2b3ac)
When the surface damage code went in, it incorrectly assumed that if
an application was doing CPU rendering, it would be using lock and
unlockAndPost instead of dequeue and queue, so it repurposed the dirty
region too aggressively. This change keeps it from clobbering the
dirty region if a CPU producer is attached.
Bug: 20431815
Change-Id: Id4dfd71378311ea822f0289f6de2d20a7bd84014
This change adds support for passing surface damage all of the way
down from the EGL interface through the consumer side of the
BufferQueue. Depends on system/core change
Ie645e6a52b37b5c1b3be19481e8348570d1aa62c
Bug: 11239309
Change-Id: I4457ea826e9ade4ec187f973851d855b7b93a31b
Exposes the attachBuffer and detachNextBuffer calls from
IGraphicBufferProducer to the public Surface interface. Also moves
the version of connect that takes a producer callback from protected
to public.
Bug: 19628705
Change-Id: I9ebc3013c4d9c84c4e8ef150c00e03f8af80319e
(cherry picked from commit c14ecb9de2)
- Wire up new dataSpace parameter through buffer queue stack
- Update tests to include the parameter
- Switch eglApi to using dataSpace to indicate sRGB gamma/linear
difference
- Remove RAW_SENSOR in favor of RAW16
- Remove use of sRGB format enums
- Add default dataspace to buffer queue core
- Add query for default dataspace
Cherry pick of I070bd2e7c56506055c419004c29e2e3feac725df
Change-Id: I461952389c18051176c6b75e664f20ad369f5760
This change allows clients of Surface to provide an IProducerListener
callback object to Surface::connect, which will be passed down to the
underlying IGraphicBufferProducer.
Cherry pick of I5ea5229bf3a329bf02c6bd20e7247039c75d136b
Change-Id: I6f8f52c72654e4cee649721383819bafe378f964
Enables -Weverything and -Werror, with just a few exceptions for
warnings we can't (or shouldn't need to) work around.
Cherry pick of I034abec27bf4020d84af60d7acc1939c59986dd6 plus a
couple of minor changes to CpuConsumer.cpp to make it work with a
prior change:
Uncomment CC_LOGV on line 46
Change C-style cast to static_cast on line 71
Change-Id: Iaec610477ea0122317b0578fb74caf2383d4cf08
Enables -Weverything and -Werror, with just a few exceptions for
warnings we can't (or shouldn't need to) work around.
This is a squashed commit based on an initial change with a couple of
fixes to avoid breaking certain targets. The source commits are:
d723bd766900d504c06e429ba89cd2
Change-Id: I034abec27bf4020d84af60d7acc1939c59986dd6
Bug: 15116722
- Adds a sticky transform field that can be set from a
SurfaceFlinger client Surface. This transform is
added to any transform applied to the Surface.
Change-Id: Idaa4311dfd027b2d2b8ea5e2c6cba2da5779d753
This adds an allocateBuffers method to BufferQueue, which instructs
it to allocate up to the maximum number of buffers allowed by the
current configuration. The goal is that this method can be called
ahead of render time, which will prevent dequeueBuffers from blocking
in allocation and inducing jank.
This interface is also plumbed up to the native Surface (and, in
another change, up to the Java Surface and ThreadedRenderer).
Bug: 11792166
Change-Id: I4aa96b4351ea1c95ed5db228ca3ef98303229c74
The gralloc API now provides a way for using lock/unlock with the Android
explicit synchronisation concept. This changes updates the GraphicBuffer class
to also expose this functionality, and updates the Surface class to make use of
in line with the dequeueBuffer/queueBuffer mechanism.
This new behaviour is dependent on GRALLOC_MODULE_API_VERSION_0_3. If the local
gralloc module does not support this then the existing synchronous lock/unlock
mechanism will be used.
Change-Id: I8c3fd9592e0c5400ac9be84450f55a77cc0bbdc5
The gralloc API now provides a way for using lock/unlock with the Android
explicit synchronisation concept. This changes updates the GraphicBuffer class
to also expose this functionality, and updates the Surface class to make use of
in line with the dequeueBuffer/queueBuffer mechanism.
This new behaviour is dependent on GRALLOC_MODULE_API_VERSION_0_3. If the local
gralloc module does not support this then the existing synchronous lock/unlock
mechanism will be used.
Change-Id: I77daa1beb197b63b1c2f281b8414ac4ae4b5b03c
Add a callback to the producer side, onBufferReleased, which will be
called every time the consumer releases a buffer back to the
BufferQueue. This will enable a buffer stream splitter to work
autonomously without having to block on dequeueBuffer.
The binder object used for the callback replaces the generic IBinder
token that was passed into IGraphicBufferProducer::connect to detect
the death of the producer. If a producer does not wish to listen for
buffer release events, it can pass in an instance of the
DummyProducerListener class defined in IProducerListener.h, if it even
cares about death events (BufferQueue doesn't enforce the token being
non-NULL, though perhaps we should).
Change-Id: I23935760673524abeafea2b58dccc3583b368710
- This also fixes a hang in the camera service when trying to shut down
if the producer is infinitely blocked while trying to get a new buffer.
Bug: 13250382
Change-Id: I32ca82162bb8645b97dbe084e13e05ca05529a42
This change adds an entire field to note whether the timestamp was
auto-generated by Surface or supplied by the application.
The value is used when deciding whether or not to drop frames based
on buffer presentation timestamps. If a desired presentation time
was set explicitly, BufferQueue will use that value to decide if a
frame should be dropped. If the timestamp was generated by Surface
at the time the buffer was queued, the timestamp is ignored.
Bug 10151804
Change-Id: Ibd571a7578351063b813cbdad2ddbeed70655ba5
Disable dropping of frames based on timestamp. Resume auto-
generating timestamps in Surface.
Bug 10151804
Change-Id: I15de26158e1d7ef22a5b150e685a126dc48ae2b4
If there are two or more buffers pending that are ready for
immediate presentation, drop all but the last one.
Any code that didn't explicitly specify timestamps for buffers
was using the default value (auto-generated "now"). As a result,
surfaceflinger would drop frames whenever more than one buffer
was queued. We now use zero as the auto-generated timestamp,
and we don't set the timestamp in eglBeginFrame().
Change-Id: I187f42d33de227cd3411ff0dcd3b9ce1961457eb
we can now queue/dequeue a buffer in asynchrnous mode by using the
async parameter to these calls. async mode is only specified
with those calls (it is not modal anymore).
as a consequence it can only be specified when the buffer count
is not overidden, as error is returned otherwise.
Change-Id: Ic63f4f96f671cb9d65c4cecbcc192615e09a8b6b
this is the first step of a series of improvements to
BufferQueue. A few things happen in this change:
- setSynchronousMode() goes away as well as the SynchronousModeAllowed flag
- BufferQueue now defaults to (what used to be) synchronous mode
- a new "controlled by app" flag is passed when creating consumers and producers
those flags are used to put the BufferQueue in a mode where it
will never block if both flags are set. This is achieved by:
- returning an error from dequeueBuffer() if it would block
- making sure a buffer is always available by replacing
the previous buffer with the new one in queueBuffer()
(note: this is similar to what asynchrnous mode used to be)
Note: in this change EGL's swap-interval 0 is broken; this will be
fixed in another change.
Change-Id: I691f9507d6e2e158287e3039f2a79a4d4434211d
- timeout is now 3 seconds instead of 1
- simplifies the API a bit
- allows us to change/tweak this timeout globaly
Bug: 8988871
Change-Id: I8d3c6ec43a372f602fb3f29856710339f86c0ec9
Writing a NULL Surface was being read as a non-NULL Surface with NULL
mGraphicBufferProducer. Before the SurfaceTextureClient -> Surface
refactoring, you'd get a NULL Surface, and some code relies on that.
Bug: 8291161
Change-Id: I477bfe8882693e53a5f604a3d2c9e3cfe24473b4
Dan Stoza