GitLab

Because of lack of mutex lock when get mSidebandStream, if one thread
getSidebandStream, another thread setSidebandStream frequently, an UAF
will be triggered.

Bug: 32660278
Test: Marlin device with poc
Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45
(cherry picked from commit 2d8a2432e04234d9edbb3b099f9bbbaa36ad4843)

This method releases all free buffers owned by the buffer queue,
in order to save memory (at the cost of potential future
reallocation of buffers).

Bug: 28695173
Change-Id: I458d10373e639e3144faf673af2ba01aca36e65a

This method releases all free buffers owned by the buffer queue,
in order to save memory (at the cost of potential future
reallocation of buffers).

Bug: 28695173
Change-Id: I458d10373e639e3144faf673af2ba01aca36e65a

Adds an OccupancyTracker to BufferQueue. This module keeps track of
how many buffers are in the queue over time, which, in combination
with various aggregation of these statistics, allows SurfaceFlinger
to report what fraction of the time a given layer was double- or
triple-buffered.

Change-Id: Ida6e967dc5483c00a633e9fe03998e420dd88502

Try to avoid unnecessary calls to the consumer listener's
onBuffersReleased() since they can potentially deadlock.

Bug 28254168

Change-Id: Ib064e5ebe1403a1028589342b3c33e6f40bb54a9

Change-Id: Id43d0737d9367981644e498942ebc0077d61038c

This reverts commit 16c9c304.

Change-Id: Icbdcba8a646ac40c0533c1c04f5b15769332976c

Bug 27046057

Change-Id: Iede7c92e59e60795df1ec7768ebafd6b090f1c27

This reverts commit 981066c3.

- Partially reverts commit 789a0c82.
- Leaves the fix in Surface, but reverts all changes to the
  Producer/Consumer listeners.

Bug 27246023
Bug 27229287

Change-Id: I9283f9e59e666b5ae44c0db25f99a80d05eea3ee

Bug 27046057

Change-Id: Id7bd8cf95045b497943ea39dde49e877aa6f5c4e

- Now that it's possible to resize a BufferQueue while buffers are
  dequeued/acquired, it's no longer correct for Surface to clear its
  cache when the BufferQueue is resized since it must keep at least
  the currently dequeued buffers.
- Add an onSlotsFreed callback to IProducerListener so that producers
  that wish to be notified about buffers being freed can do so. Note
  that this isn't currently used in Surface.
- Review and fixup all the places where the producer/consumer
  listeners for freed buffers should be called.

Change-Id: I4ab0c92bc69b75a3c072ddf5d74d78f941dba4c8

- Adds a boolean to BufferQueue that controls whether or not auto
  refresh is enabled in SurfaceFlinger when in single buffer mode.
- Adds plumbing up to ANativeWindow.
- When enabled, it will cache the shared buffer slot in Surface in
  order to prevent the Binder transaction with SurfaceFlinger.

Bug 24940410

Change-Id: I83142afdc00e203f198a32288f071d926f8fda95

- Allow the producer to call setMaxDequeuedBufferCount and the
  consumer to call setMaxAcquiredBufferCount when buffers are
  currently dequeued/acquired as long as the new value is not less
  than the number of dequeued/acquired buffers.

Bug 22768206

Change-Id: I599a4027a6ae9cb0a1c0d5ec60cb5e65b86a345b

- Only enable it on userdebug and eng builds so that it won't slow
  down user builds.

Change-Id: I70933a23d54657fdf5cbc23873da4fbee84b9a26

- Explicitly track active buffers and unused slots on top of the
  already existing tracking for free slots and free buffers.

Change-Id: Ife2678678e96f0eb0b3fb21571058378134bd868

- Add a boolean to BufferItem to track whether single buffer mode is
  enabled. When it is, force SurfaceFlinger to acquire a new buffer
  and refresh on every vsync.

Bug 24940410

Change-Id: Iea67330c416b6fb14500865f98c67f1c12f23197

- Adds a single buffer mode to BufferQueue. In this mode designate the
  first dequeued buffer as the shared buffer. All calls to dequeue()
  and acquire() will then return the shared buffer, allowing the
  producer and consumer to share it.
- Modify the buffer slot state tracking. Add a new SHARED state for
  the shared buffer in single buffer mode. Also track how many times
  a buffer has been dequeued/queued/acquired as it's possible for a
  shared buffer to be both dequeued and acquired at the same time, or
  dequeued/acquired multiple times. This tracking is needed to know
  when to drop the buffer out of the SHARED state after single buffer
  mode has been disabled.
- Add plumbing for enabling/disabling single buffer mode from Surface.

Bug 24940410

Change-Id: I3fc550c74bacb5523c049a227111356257386853

- Get rid of the async flag in dequeueBuffer, allocateBuffers,
  waitForFreeSlotThenRelock, and QueueBufferInput.
- Instead use the persistent flags mDequeueBufferCannotBlock and
  mAsyncMode to determine whether to use the async behavior.

Bug 13174928

Change-Id: Ie6f7b9e46ee3844ee77b102003c84dddf1bcafdd

- Rename setDefaultMaxBufferCount() to setMaxBufferCount(). Modify it
  to be hard maximum on the number of buffers that can't be overwritten
  by the producer.
- Enforce the maximum buffer count in setMaxAcquiredBufferCount(),
  setMaxDequeuedBufferCount(), and setAsyncMode().
- Remove mOverrideMaxBufferCount as it's no longer needed since
  overriding is no longer possible.
- Expose setMaxAcquiredBufferCount() in GLConsumer.
- Remove disableAsyncBuffer(), it was only being used for single buffer
  mode. Single buffer mode is now achievable with setMaxBufferCount().

Bug 13174928

Change-Id: Ia33799f42751272a711fbd8559f7602ce9f18e4f

Bug: 22552826
Change-Id: I9bdfeb8c68f403301af90d4b494f0ae7166a767c

This change allows producers to set a generation number on a
BufferQueue. This number will be embedded in any new GraphicBuffers
created in that BufferQueue, and attempts to attach buffers which have
a different generation number will fail.

It also plumbs the setGenerationNumber method through Surface, with the
additional effect that any buffers attached to the Surface after
setting a new generation number will automatically be updated with the
new number (as opposed to failing, as would happen on through IGBP).

Bug: 20923096
Change-Id: I32bf726b035f99c3e5834beaf76afb9f01adcbc2
(cherry picked from commit 812ed064)

This change allows producers to set a generation number on a
BufferQueue. This number will be embedded in any new GraphicBuffers
created in that BufferQueue, and attempts to attach buffers which have
a different generation number will fail.

It also plumbs the setGenerationNumber method through Surface, with the
additional effect that any buffers attached to the Surface after
setting a new generation number will automatically be updated with the
new number (as opposed to failing, as would happen on through IGBP).

Bug: 20923096
Change-Id: I32bf726b035f99c3e5834beaf76afb9f01adcbc2

This changes the way that SurfaceFlinger's shadow buffer management
works such that instead of tracking the size of the shadow queue in the
BufferQueue, SF tracks the last frame number it has seen, and passes
that into the acquireBuffer call. BufferQueueConsumer then ensures that
it never returns a buffer newer than that frame number, even if that
means that it must return PRESENT_LATER for an otherwise valid buffer.

Change-Id: I3fcb45f683ed660c3f18a8b85ae1f8a962ba6f0e
(cherry picked from commit a4650a50)

This changes the way that SurfaceFlinger's shadow buffer management
works such that instead of tracking the size of the shadow queue in the
BufferQueue, SF tracks the last frame number it has seen, and passes
that into the acquireBuffer call. BufferQueueConsumer then ensures that
it never returns a buffer newer than that frame number, even if that
means that it must return PRESENT_LATER for an otherwise valid buffer.

Change-Id: I3fcb45f683ed660c3f18a8b85ae1f8a962ba6f0e

Clears the frame number of a slot when it is freed, since it is used
to determine if a released buffer is stale.

Bug: 20445852
Change-Id: I02415e7b25a1eafe7414d6eb1cedf62ac5543cd9
(cherry picked from commit 52937cd9)

Clears the frame number of a slot when it is freed, since it is used
to determine if a released buffer is stale.

Bug: 20445852
Change-Id: I02415e7b25a1eafe7414d6eb1cedf62ac5543cd9

SurfaceFlinger's (Layer's) shadow copy of the BufferQueue queue was
getting out of sync for a few reasons. This change fixes these by
doing the following:

- Adds a check to re-synchronize the shadow copy every time we
  successfully acquire a buffer by first dropping stale buffers before
  removing the current buffer.
- Avoids trying to perform updates for buffers which have been rejected
  (for incorrect dimensions) by SurfaceFlinger.
- Adds IGraphicBufferConsumer::setShadowQueueSize, which allows the
  consumer to notify the BufferQueue that it is maintaining a shadow
  copy of the queue and prevents it from dropping so many buffers
  during acquireBuffer that it ends up returning a buffer for which the
  consumer has not yet received an onFrameAvailable call.

Bug: 20096136
Change-Id: I78d0738428005fc19b3be85cc8f1db498043612f
(cherry picked from commit 2e36f228)

SurfaceFlinger's (Layer's) shadow copy of the BufferQueue queue was
getting out of sync for a few reasons. This change fixes these by
doing the following:

- Adds a check to re-synchronize the shadow copy every time we
  successfully acquire a buffer by first dropping stale buffers before
  removing the current buffer.
- Avoids trying to perform updates for buffers which have been rejected
  (for incorrect dimensions) by SurfaceFlinger.
- Adds IGraphicBufferConsumer::setShadowQueueSize, which allows the
  consumer to notify the BufferQueue that it is maintaining a shadow
  copy of the queue and prevents it from dropping so many buffers
  during acquireBuffer that it ends up returning a buffer for which the
  consumer has not yet received an onFrameAvailable call.

Bug: 20096136
Change-Id: I78d0738428005fc19b3be85cc8f1db498043612f

BufferQueue used to choose free buffers by scanning through its array
of slots and picking one based on timestamp. This changes that
mechanism to use a pair of free lists: one with buffers attached and
one without. This makes it easier to choose either type of free slot
depending on the needs of the current operation.

Fixes an issue with the first version of this change, found in bugs
20482952, 20443314, and 20464549.

Bug: 13175420
Change-Id: I9b6e83cfe8f9b4329a976025cb8e291d51fb6d4a

This reverts commit 8dddc990.

Change-Id: I0b0fed9f1394c6f6ae812f6c562ead4473a8226e

BufferQueue used to choose free buffers by scanning through its array
of slots and picking one based on timestamp. This changes that
mechanism to use a pair of free lists: one with buffers attached and
one without. This makes it easier to choose either type of free slot
depending on the needs of the current operation.

Bug: 13175420
Change-Id: Ic8398e7511bd11a60a1c82e3ad2ee271c9822be1

Removes IGraphicBufferConsumer::BufferItem. Depends on the
following changes:
    I187b3a7d05196b6289596afac8fb9a9d4aebff76
    I0ddd38df37500cfd6b21d1e768ed14e39c5cd9fc

Change-Id: I3edf0db8fba656fd78e18a5a7f1137f0fb6b237d
(cherry picked from commit 1c87e474)

Add dataSpace to buffer queues; remove old format enums.
(cherry picked from commit 82c6bcc9)

libgui: Prepare for IGBC::BufferItem removal
(cherry picked from commit cf3834db)

SurfaceFlinger: Stop using IGBC::BufferItem
(cherry picked from commit 11611f9b)

Change-Id: Ic2e4770b916d2d1477e5ce98c4b49a0072ea03ff
(cherry picked from commit 6c450101)

DO NOT MERGE Add dataSpace to buffer queues; remove old format enums.
(cherry picked from commit 82c6bcc9)

DO NOT MERGE libgui: Prepare for IGBC::BufferItem removal
(cherry picked from commit cf3834db)

DO NOT MERGE SurfaceFlinger: Stop using IGBC::BufferItem
(cherry picked from commit 11611f9b)

This reverts commit 20c56728.

- Wire up new dataSpace parameter through buffer queue stack
- Update tests to include the parameter
- Switch eglApi to using dataSpace to indicate sRGB gamma/linear
  difference
- Remove RAW_SENSOR in favor of RAW16
- Remove use of sRGB format enums
- Add default dataspace to buffer queue core
- Add query for default dataspace

Change-Id: I070bd2e7c56506055c419004c29e2e3feac725df

Removes IGraphicBufferConsumer::BufferItem. Depends on the
following changes:
    I187b3a7d05196b6289596afac8fb9a9d4aebff76
    I0ddd38df37500cfd6b21d1e768ed14e39c5cd9fc

Cherry-pick of Id1fa56d092188f2cb712768d5d2fc6a9027fb73c

Change-Id: I3edf0db8fba656fd78e18a5a7f1137f0fb6b237d

Currently, there are two instances of BufferItem: one inside of
IGraphicBufferConsumer, and a standalone one inside of libgui. They
only differ in the name of one of the fields, and we want to remove
the IGBC version. This changes things so that client code may be
incrementally switched over to the libgui version.

This is a squashed commit containing the following changes:
    I64f495105f56cbf5803cea4aa6b072ea29b70cf5
    I1394e693314429ada93427889f10b7b01c948053
    I9c3bc8037fa9438d4d9080b8afb694219ef2f71f
    I699ed0a6837076867ca756b28d1ffb2238f7a0d9
    Iac8425e1241774304a131da2fb9dec6e82922f13

Change-Id: Ic4d51f5df6dbc70b376d13fceba2335b9bae4f3d

- Wire up new dataSpace parameter through buffer queue stack
- Update tests to include the parameter
- Switch eglApi to using dataSpace to indicate sRGB gamma/linear
  difference
- Remove RAW_SENSOR in favor of RAW16
- Remove use of sRGB format enums
- Add default dataspace to buffer queue core
- Add query for default dataspace

Cherry pick of I070bd2e7c56506055c419004c29e2e3feac725df

Change-Id: I461952389c18051176c6b75e664f20ad369f5760