OSDN Git Service
Chih-Wei Huang [Mon, 16 Mar 2020 10:41:26 +0000 (18:41 +0800)]
Merge tag 'android-8.1.0_r74' into oreo-x86
Android 8.1.0 release 74
Chih-Wei Huang [Fri, 21 Feb 2020 07:52:13 +0000 (15:52 +0800)]
inputflinger: fix relative mouse movement
Since commit
78f97b326 ("Support pointer capture in InputReader") the
logic to determine whether mouse input is relative was changed.
However, commit
bf8d48c17 was forward ported from nougat-x86. It doesn't
consider that.
Fixes:
bf8d48c17 ("inputflinger: treat tablet-style inputs as absolute coordinate mouse pointer")
Reported-and-tested-by: MrARM Slack <mrarm.slack@gmail.com>
Ashwini Oruganti [Wed, 4 Dec 2019 21:21:09 +0000 (13:21 -0800)]
Don't leak input events to dumpsys on user builds
Remove the details of KeyEvent and MotionEvent logs.
Bug:
139945049
Test: Tested on a device, the input functions work as expected and input
event logs are not leaked to dumpsys on user builds.
Change-Id: I98c9c375f18963177bf0c1d8829a217b4ad4acc6
Merged-In: I98c9c375f18963177bf0c1d8829a217b4ad4acc6
(cherry picked from commit
c2ddb61f37b2f7a1067534fc3a950c7fe4677818)
Michael Wachenschwanz [Tue, 15 Oct 2019 18:49:22 +0000 (11:49 -0700)]
Resize object capacity when shrinking Parcel
Bug:
140419401
Test: atest android.os.cts.ParcelTest
Change-Id: I04edee415e1984ba5fb97c5c1b09892a360cf221
(cherry picked from commit
c67d9f33b36cbb95b121d058f51d6653f1ec4334)
(cherry picked from commit
d9d10dbdf2f20af3dd01376d2130c71c052e42f3)
Steven Moreland [Tue, 8 Oct 2019 00:30:23 +0000 (17:30 -0700)]
Sensor: use FlattenableUtils::align
Since it memsets skipped over memory now.
Bug:
141890807
Test: boot, check buffer is zero'd here
Change-Id: Ieb3cd90215a3ccc1dc43365ecde251a50db08553
(cherry picked from commit
d58cf5acb863eddbbeb9982439965e259045940e)
(cherry picked from commit
dbd0eecfc7570231d5cbb76678b0358c43ee6d3c)
Chih-Wei Huang [Thu, 24 Oct 2019 04:06:09 +0000 (12:06 +0800)]
Merge tag 'android-8.1.0_r69' into oreo-x86
Android 8.1.0 Release 69 (
5794017)
Brian Duddie [Thu, 6 Jun 2019 23:43:41 +0000 (16:43 -0700)]
Fix race between SensorManager ctor and callback
Avoids potential invalid memory access if system server crashes during
initialization.
Bug:
132927376
Test: confirm sensors initialize
Change-Id: If7421c452b5893ab2567323d265503a1ce304482
Merged-In: If7421c452b5893ab2567323d265503a1ce304482
(cherry picked from commit
231a12189b2b820843ebf5d002876a23e0890c09)
Michael Wachenschwanz [Tue, 4 Jun 2019 00:24:51 +0000 (17:24 -0700)]
Free mObjects if no objects left to realloc on resize
Bug:
134168436
Bug:
133785589
Bug:
34175893
Test: atest CtsOsTestCases:ParcelTest#testObjectDoubleFree
Change-Id: I82e7e8c7b4206fb45b832a71d174df45edb62710
Merged-In: I82e7e8c7b4206fb45b832a71d174df45edb62710
(cherry picked from commit
edd3e3d8f441131b02e5a78d18babf9d16ef9e6e)
Steven Moreland [Mon, 20 May 2019 22:28:13 +0000 (15:28 -0700)]
[RESTRICT AUTOMERGE] libbinder: Status: check dataPosition sets.
Bug:
132650049
Test: fuzzer
Change-Id: Id230eae4316a444bc82b416b2049d5a5f589f89a
(cherry picked from commit
00d4358fcd2875b1e26ac50d620f2dec439ef3ee)
Steven Moreland [Fri, 17 May 2019 20:14:06 +0000 (13:14 -0700)]
libbinder: readCString: no ubsan sub-overflow
Bug:
131859347
Test: fuzzer
Change-Id: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
Merged-In: I95a0f59684a172925f1eab97ff21e5d14bc79cc8
(cherry picked from commit
d0d4b584fc294d2c124385644099852918416344)
Chih-Wei Huang [Mon, 20 May 2019 09:26:31 +0000 (17:26 +0800)]
Merge tag 'android-8.1.0_r64' into oreo-x86
Android 8.1.0 Release 64 (OPM8.190505.001)
Pawin Vongmasa [Thu, 25 Apr 2019 10:44:52 +0000 (03:44 -0700)]
Zero-initialize HIDL structs before passing
Test: cts-tradefed run cts-dev --module CtsMediaTestCases --compatibility:module-arg CtsMediaTestCases:include-annotation:android.platform.test.annotations.RequiresDevice
(only existing failures/flakes)
Bug:
131267328
Bug:
131356202
Change-Id: I91e6e0c692d470f4d3a713068545cedf5ae925a7
Merged-In: I91e6e0c692d470f4d3a713068545cedf5ae925a7
(cherry picked from commit
c4a5f5ec811b149428e0835b7aabc6c4c802e720)
android-build-team Robot [Wed, 16 Jan 2019 18:57:15 +0000 (18:57 +0000)]
Merge cherrypicks of [
6072696,
6072074,
6072757,
6072120,
6072121,
6072122,
6072123,
6072575,
6072576,
6072577,
6072578,
6072579,
6072193,
6072131,
6072194,
6072076,
6072210,
6072759,
6072760,
6072698,
6072699,
6072700,
6072701,
6072702,
6072703,
6072704,
6072905,
6072906,
6072907,
6072761] into oc-m8-release
Change-Id: I62ea33011cde9be9d5ab9163d57b4be2c9b4e9a2
Siarhei Vishniakou [Sat, 17 Nov 2018 06:18:53 +0000 (22:18 -0800)]
Sanitize InputMessage before sending
The struct InputMessage has many fields, and is force-aligned to 8-byte
boundaries. There are also some padding fields that carry no
information.
This struct is typically allocated in the stack and populated with
various values before being sent across as a stream of bytes through the
socket.
Therefore, the "unused" data portions of the struct could contain
portions of the stack, since there aren't ever writes to those memory
locations.
To avoid this information leak, forcefully sanitize the struct. Create a
new struct that is explicitly set to zero. Next, only fill the
meaningful fields manually.
Bug:
115739809
Test: cts-tradefed run cts -m CtsSecurityBulletinHostTestCases -t android.security.cts.Poc18_12; adb shell monkey 100000
Change-Id: I7e44dacf1e8fa3156c8e4d2f7784ef0c53dab507
Merged-In: I7e44dacf1e8fa3156c8e4d2f7784ef0c53dab507
(cherry picked from commit
e730f5aaa1c726ee9998a080e2d7f6284f4afec8)
Siarhei Vishniakou [Sat, 17 Nov 2018 06:18:53 +0000 (22:18 -0800)]
Sanitize InputMessage before sending
The struct InputMessage has many fields, and is force-aligned to 8-byte
boundaries. There are also some padding fields that carry no
information.
This struct is typically allocated in the stack and populated with
various values before being sent across as a stream of bytes through the
socket.
Therefore, the "unused" data portions of the struct could contain
portions of the stack, since there aren't ever writes to those memory
locations.
To avoid this information leak, forcefully sanitize the struct. Create a
new struct that is explicitly set to zero. Next, only fill the
meaningful fields manually.
Bug:
115739809
Test: cts-tradefed run cts -m CtsSecurityBulletinHostTestCases -t android.security.cts.Poc18_12; adb shell monkey 100000
Change-Id: I7e44dacf1e8fa3156c8e4d2f7784ef0c53dab507
Merged-In: I7e44dacf1e8fa3156c8e4d2f7784ef0c53dab507
(cherry picked from commit
e730f5aaa1c726ee9998a080e2d7f6284f4afec8)
Jon Doe [Sun, 23 Dec 2018 14:50:00 +0000 (22:50 +0800)]
inputflinger: treat tablet-style inputs as absolute coordinate mouse pointer
Qemu and VirtualBox use tablet-style inputs. However, it's difficult to
work with the current "invisible finger" or "drag pointer" interface
provided to the virtual absolute coordinate pointing devices.
Instead, this patch classifies them as a regular mouse pointer
(INPUT_DEVICE_CLASS_CURSOR), which is more intuitive to work with.
Chih-Wei Huang [Fri, 21 Dec 2018 08:58:30 +0000 (16:58 +0800)]
Merge tag 'android-8.1.0_r53' into oreo-x86
Android 8.1.0 release 53
android-build-team Robot [Fri, 19 Oct 2018 16:33:45 +0000 (16:33 +0000)]
Merge cherrypicks of [
5313290,
5313323,
5313343,
5313415,
5313291,
5313441,
5313557,
5313344,
5313383,
5313384,
5313324,
5313325,
5313326,
5313294,
5313295,
5313296,
5313498] into oc-m8-release
Change-Id: I62e39466baf7cbb474eb521994e39f55b1fd3205
Chia-I Wu [Tue, 9 Oct 2018 22:22:46 +0000 (15:22 -0700)]
libui: add boundary check to GraphicBuffer::unflatten
Commit
cb496acbe593326e8d5d563847067d02b2df40ec removed the boundary
check by accident.
Bug:
114223584
Test: manual
Change-Id: I057bc02d5807e438530d1a5327c2e02b9d154151
(cherry picked from commit
bf8d7210c4bbbdc875e9695a301cdf9c3b544279)
Chia-I Wu [Tue, 9 Oct 2018 22:22:46 +0000 (15:22 -0700)]
libui: add boundary check to GraphicBuffer::unflatten
Commit
cb496acbe593326e8d5d563847067d02b2df40ec removed the boundary
check by accident.
Bug:
114223584
Test: manual
Change-Id: I057bc02d5807e438530d1a5327c2e02b9d154151
(cherry picked from commit
bf8d7210c4bbbdc875e9695a301cdf9c3b544279)
Chih-Wei Huang [Tue, 9 Oct 2018 09:52:29 +0000 (17:52 +0800)]
Merge tag 'android-8.1.0_r48' into oreo-x86
Android 8.1.0 release 48
Chih-Wei Huang [Mon, 10 Sep 2018 15:49:36 +0000 (23:49 +0800)]
Merge tag 'android-8.1.0_r46' into oreo-x86
Android 8.1.0 Release 46 (OPM6.171019.030.K1)
android-build-team Robot [Fri, 10 Aug 2018 20:32:14 +0000 (20:32 +0000)]
Merge cherrypicks of [
4741663,
4741664,
4741665,
4741666,
4743080,
4743081,
4743082,
4743083,
4741262,
4741263,
4741264,
4741265,
4741266,
4741667,
4743084,
4741242,
4741243,
4741741,
4741742,
4741743,
4741744,
4741822,
4743085,
4741668,
4741338,
4743055,
4743056,
4743070,
4743073,
4743075,
4743076,
4743078,
4743079,
4743161,
4743162,
4743164,
4743165,
4743167,
4743168,
4743169,
4743170,
4741681,
4741682,
4741683,
4741684,
4741685,
4741686,
4741687,
4741688,
4741689,
4741690,
4741691,
4741692,
4741693,
4741694,
4741695,
4741696,
4741697,
4741698,
4741699,
4743240,
4743241,
4743242,
4743243,
4741745,
4741823,
4741824,
4741825,
4741267,
4741268,
4743244,
4743280,
4743281,
4743224,
4743203,
4743204,
4743205,
4741746,
4741747,
4743245,
4741826,
4741827,
4741828,
4741829,
4741748,
4741749,
4741750,
4743233,
4743282,
4741244,
4741245,
4741246,
4741247,
4743206,
4743207,
4743208,
4743209,
4743210,
4743211,
4743212,
4743213,
4743214,
4743215,
4743216,
4743217,
4743218,
4743219,
4743360,
4743361,
4743362,
4743363,
4743364,
4743365,
4743366,
4743367,
4743368,
4743369,
4743370,
4743371,
4743372,
4743373,
4743374,
4743375,
4743376,
4743377,
4743283,
4743284,
4741830,
4742501,
4743246,
4743086,
4743087,
4743378,
4743379,
4741751] into sparse-
4749909-L04200000199131547
Change-Id: Iead43bb0deac18379a0a05dff4cadc3a86e59d1b
Martijn Coenen [Wed, 4 Apr 2018 09:46:56 +0000 (11:46 +0200)]
Don't pad before calling writeInPlace().
writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.
Bug:
77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44
(cherry picked from commit
f8542381b72a7bb2452a5278a00ca8c34edbf8a0)
(cherry picked from commit
732132b765cd7b667f16cf32f0fe4c852d7d44dd)
Change-Id: I59a088c75353786ca105a3735886af372592c759
Michael Wachenschwanz [Tue, 17 Apr 2018 23:52:40 +0000 (16:52 -0700)]
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug:
29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit
6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
Michael Wachenschwanz [Sat, 18 Nov 2017 02:25:05 +0000 (18:25 -0800)]
Disallow reading object data from Parcels with non-object reads
The check added to each non-object reads adds an overhead. If the
objects (binders and file descriptors) were written to the Parcel in
sequential order then check adds a small O(1) overhead to each read,
plus an O(N) overhead to the first read (to verify the N objects were
added in order).
If the objects were written out of order (as in by jumping around the Parcel
with setDataPosition and writing Binder, DON'T DO THIS!!) (writing non
objects out of order is fine), the first read is forced to sort the objects
in the internal bookkeeping. Based on the assumption non sequential writes
are infrequent and overall Parcels are probably mostly sorted, insertion
sort was used. Worst case sorts will add an O(N^2) overhead to the first
non object read from the Parcel.
Test: run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Bug:
29833520
Change-Id: I82de8eb5f5eb56f869542d5358e96884c24301b2
(cherry picked from commit
c517681c66a1a387be657e0cf06da8d19659dd14)
android-build-team Robot [Fri, 3 Aug 2018 19:20:58 +0000 (19:20 +0000)]
Merge cherrypicks of [
4691111,
4689862,
4690575,
4690576,
4690577,
4690578,
4689866,
4689868,
4689869,
4689870,
4691132,
4689456,
4689963,
4691133,
4691134,
4691156,
4691157,
4691159,
4691161,
4690581,
4689964,
4689460,
4691112,
4690582,
4690583,
4691165,
4691166,
4691167,
4691168,
4691169,
4691170,
4691211,
4691212,
4691213,
4691214,
4691215,
4691216,
4691217,
4691218,
4691219,
4691232,
4691233,
4691234,
4691235,
4691236,
4691237,
4691238,
4691239,
4691240,
4691241,
4691243,
4691245,
4691247,
4691249,
4691250,
4691291,
4691292,
4691293,
4691294,
4691295,
4691296,
4691255,
4689476,
4689477,
4689478,
4691223,
4691224,
4691136,
4689479,
4689480,
4691137,
4691225,
4691226,
4691227,
4691371,
4691228,
4691328,
4689967,
4691138,
4691139,
4691140,
4691433,
4689968,
4689969,
4691395,
4691230,
4691297,
4691298,
4691299,
4691300,
4691396,
4691397,
4691398,
4691399,
4691400,
4691401,
4691402,
4691403,
4691404,
4691405,
4691406,
4691407,
4691408,
4691409,
4691410,
4691471,
4691472,
4691473,
4691474,
4691475,
4691476,
4691477,
4691478,
4691479,
4691480,
4691481,
4691482,
4691483,
4691484,
4691485,
4691486,
4691487,
4691488,
4691143,
4691144,
4691511,
4691113,
4689482,
4691533,
4691145,
4691146,
4691147,
4691148,
4691536] into sparse-
4732991-L01200000196794104
Change-Id: Ic56fd5b5b159876b0ce7d37011d773ae71fa9946
Martijn Coenen [Wed, 4 Apr 2018 09:46:56 +0000 (11:46 +0200)]
Don't pad before calling writeInPlace().
writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.
Bug:
77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44
(cherry picked from commit
f8542381b72a7bb2452a5278a00ca8c34edbf8a0)
(cherry picked from commit
732132b765cd7b667f16cf32f0fe4c852d7d44dd)
Change-Id: Ia9d0e50488ee1f427c182b6277f877d4eda76f77
Michael Wachenschwanz [Tue, 17 Apr 2018 23:52:40 +0000 (16:52 -0700)]
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug:
29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit
6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
Michael Wachenschwanz [Sat, 18 Nov 2017 02:25:05 +0000 (18:25 -0800)]
Disallow reading object data from Parcels with non-object reads
The check added to each non-object reads adds an overhead. If the
objects (binders and file descriptors) were written to the Parcel in
sequential order then check adds a small O(1) overhead to each read,
plus an O(N) overhead to the first read (to verify the N objects were
added in order).
If the objects were written out of order (as in by jumping around the Parcel
with setDataPosition and writing Binder, DON'T DO THIS!!) (writing non
objects out of order is fine), the first read is forced to sort the objects
in the internal bookkeeping. Based on the assumption non sequential writes
are infrequent and overall Parcels are probably mostly sorted, insertion
sort was used. Worst case sorts will add an O(N^2) overhead to the first
non object read from the Parcel.
Test: run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Bug:
29833520
Change-Id: I82de8eb5f5eb56f869542d5358e96884c24301b2
(cherry picked from commit
c517681c66a1a387be657e0cf06da8d19659dd14)
Chih-Wei Huang [Fri, 13 Jul 2018 06:45:43 +0000 (14:45 +0800)]
Merge tag 'android-8.1.0_r41' into oreo-x86
Android 8.1.0 Release 41 (OPM6.171019.030.E1)
Chih-Wei Huang [Thu, 14 Jun 2018 09:25:46 +0000 (17:25 +0800)]
Merge tag 'android-8.1.0_r33' into oreo-x86
Android 8.1.0 release 33
android-build-team Robot [Fri, 25 May 2018 18:42:25 +0000 (18:42 +0000)]
Merge cherrypicks of [
4195294,
4195296,
4195440,
4195441,
4186165,
4186166,
4186580,
4195442,
4195443,
4186193,
4186194,
4186195,
4186196,
4186607,
4195444,
4195297,
4186608,
4186609,
4186610,
4186611,
4186612,
4186613,
4186614,
4186649,
4186650,
4186651,
4186652,
4186653,
4186654,
4186655,
4186656,
4186657,
4195518,
4195519,
4195520,
4195521,
4195522,
4186406,
4186407,
4186408,
4195523,
4195558,
4195559,
4186197,
4195524,
4186615,
4195445,
4195446,
4186829,
4186830,
4186831,
4186832,
4186833,
4186834,
4186835,
4186836,
4186837,
4195578,
4195579,
4195580,
4195581,
4195447,
4186581,
4195448,
4195560] into sparse-
4749909-L06000000176800346
Change-Id: I7dfd4ea22fb57dc5742f3bf46b72d8efe6adbe99
Martijn Coenen [Wed, 4 Apr 2018 09:46:56 +0000 (11:46 +0200)]
Don't pad before calling writeInPlace().
writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.
Bug:
77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44
(cherry picked from commit
f8542381b72a7bb2452a5278a00ca8c34edbf8a0)
(cherry picked from commit
732132b765cd7b667f16cf32f0fe4c852d7d44dd)
Change-Id: Id65e4573e18ab68b804f1cf63a6977a71da01e5d
Michael Wachenschwanz [Tue, 17 Apr 2018 23:52:40 +0000 (16:52 -0700)]
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug:
29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit
6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
Michael Wachenschwanz [Sat, 18 Nov 2017 02:25:05 +0000 (18:25 -0800)]
Disallow reading object data from Parcels with non-object reads
The check added to each non-object reads adds an overhead. If the
objects (binders and file descriptors) were written to the Parcel in
sequential order then check adds a small O(1) overhead to each read,
plus an O(N) overhead to the first read (to verify the N objects were
added in order).
If the objects were written out of order (as in by jumping around the Parcel
with setDataPosition and writing Binder, DON'T DO THIS!!) (writing non
objects out of order is fine), the first read is forced to sort the objects
in the internal bookkeeping. Based on the assumption non sequential writes
are infrequent and overall Parcels are probably mostly sorted, insertion
sort was used. Worst case sorts will add an O(N^2) overhead to the first
non object read from the Parcel.
Test: run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Bug:
29833520
Change-Id: I82de8eb5f5eb56f869542d5358e96884c24301b2
(cherry picked from commit
c517681c66a1a387be657e0cf06da8d19659dd14)
Chih-Wei Huang [Fri, 25 May 2018 07:41:36 +0000 (15:41 +0800)]
Merge tag 'android-8.1.0_r29' into oreo-x86
Android 8.1.0 Release 29 (OPM4.171019.016.C1)
Chih-Wei Huang [Thu, 17 May 2018 09:29:48 +0000 (17:29 +0800)]
SurfaceFlinger: support higher resolution
Michael Wachenschwanz [Tue, 17 Apr 2018 23:52:40 +0000 (16:52 -0700)]
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug:
29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit
6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
Martijn Coenen [Wed, 4 Apr 2018 09:46:56 +0000 (11:46 +0200)]
Don't pad before calling writeInPlace().
writeInplace() itself already pads securely, by masking off
the padded bytes. If the padding is done before calling
writeInplace(), no mask is applied, and heap data can leak.
Bug:
77237570
Test: builds
Change-Id: Ide27a0002d4ed4196530430760245b971f6a3f44
Merged-In: Ide27a0002d4ed4196530430760245b971f6a3f44
(cherry picked from commit
f8542381b72a7bb2452a5278a00ca8c34edbf8a0)
(cherry picked from commit
732132b765cd7b667f16cf32f0fe4c852d7d44dd)
Michael Wachenschwanz [Sat, 18 Nov 2017 02:25:05 +0000 (18:25 -0800)]
Disallow reading object data from Parcels with non-object reads
The check added to each non-object reads adds an overhead. If the
objects (binders and file descriptors) were written to the Parcel in
sequential order then check adds a small O(1) overhead to each read,
plus an O(N) overhead to the first read (to verify the N objects were
added in order).
If the objects were written out of order (as in by jumping around the Parcel
with setDataPosition and writing Binder, DON'T DO THIS!!) (writing non
objects out of order is fine), the first read is forced to sort the objects
in the internal bookkeeping. Based on the assumption non sequential writes
are infrequent and overall Parcels are probably mostly sorted, insertion
sort was used. Worst case sorts will add an O(N^2) overhead to the first
non object read from the Parcel.
Test: run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Bug:
29833520
Change-Id: I82de8eb5f5eb56f869542d5358e96884c24301b2
(cherry picked from commit
c517681c66a1a387be657e0cf06da8d19659dd14)
Chih-Wei Huang [Tue, 15 May 2018 08:06:27 +0000 (16:06 +0800)]
inputflinger: change right mouse button to send Back command
People think this is more convenient.
android-build-team Robot [Tue, 17 Apr 2018 18:03:48 +0000 (18:03 +0000)]
Merge cherrypicks of [
3912569,
3913632,
3913633,
3913557,
3913471,
3913509,
3913558,
3913541,
3913542,
3913472,
3913473,
3913735,
3913736,
3913737,
3913738,
3913739,
3913510,
3913511,
3913512,
3913513,
3913514,
3913559,
3913560,
3913755,
3913795,
3912643,
3913543,
3912570,
3913057] into sparse-
4669640-L32000000164199687
Change-Id: I375b1cbf5434c8f86200075ebd5aa228292bffd9
Siarhei Vishniakou [Tue, 7 Nov 2017 05:16:47 +0000 (21:16 -0800)]
Fix resampling for multiple pointers
If more than one pointer is present and identical coordinates are
encountered for any pointer, the lastResample value will not be
invalidated (by clearing its bits). As a result, the same lastResample
value will be used to subsequently rewriteMessage any time in the
future. This can cause significant jumps in the pointer coordinates, and
is a bug. To further clarify, this bug has only to do with resampling
and nothing to do with both pointers having the same X or Y value.
This CL makes this logic to be per-pointer. As soon as non-identical
value is encountered and the timing conditions are such that the
resampled value is not needed to be used, the lastResample bit for that
pointer will be cleared, meaning that the value in lastResample for this
pointer is stale. This value will no longer be used anywhere.
When performing resampling, allow the process to happen on a per-pointer
basis. If one of the pointers has encountered events with identical
coordinates, then use the previously resampled value (do not resample
again), if that value is still valid (see above). Otherwise, the normal
resampling path will be taken. On the other pointers that do not have
identical coordinates, go through the normal path as well.
Bug:
68840121
Test: recorded a repro event with inputstudio and replayed it while
observing the screen. Saw that the coordinates jump before the fix,
and do not jump with the fix.
Change-Id: If43c323759de8f0184b76221d1ae599a75349ce9
Merged-In: If43c323759de8f0184b76221d1ae599a75349ce9
(cherry picked from commit
3bb597138bc53416b3049caa48c618075ec24231)
Brian Duddie [Thu, 15 Feb 2018 23:02:29 +0000 (15:02 -0800)]
Add bounds check to sensors direct channel creation
Avoids attempting to read a 0-size array during input validation. Adds
SafetyNet logging when this is triggered.
Also, change the cast for the ashmem size check from int to int64_t to
avoid potential conversion to negative number on 32-bit systems.
Bug:
70986337
Test: run POC, confirm via logs that function bails early
Change-Id: I674285738983f18de3466f9e818d83dabe269b7d
(cherry picked from commit
0eb4624b33aeb375ae431a6b1e2b787c959968fe)
android-build-team Robot [Fri, 13 Apr 2018 22:47:42 +0000 (22:47 +0000)]
Merge cherrypicks of [
3898937,
3898958,
3899077,
3897885,
3898496,
3898245,
3898959,
3898960,
3897790,
3898312,
3898313,
3898314,
3899155,
3899156,
3899157,
3898289,
3898290,
3899061,
3898291,
3898292,
3896951,
3899158,
3898961,
3898938,
3898246] into sparse-
4657601-L30800000163316240
Change-Id: Ic0d6e84bbc01ff709ad9fc8eb646e4c53453ebe2
Brian Duddie [Thu, 15 Feb 2018 23:02:29 +0000 (15:02 -0800)]
Add bounds check to sensors direct channel creation
Avoids attempting to read a 0-size array during input validation. Adds
SafetyNet logging when this is triggered.
Also, change the cast for the ashmem size check from int to int64_t to
avoid potential conversion to negative number on 32-bit systems.
Bug:
70986337
Test: run POC, confirm via logs that function bails early
Change-Id: I674285738983f18de3466f9e818d83dabe269b7d
(cherry picked from commit
0eb4624b33aeb375ae431a6b1e2b787c959968fe)
android-build-team Robot [Thu, 22 Mar 2018 23:35:52 +0000 (23:35 +0000)]
Merge cherrypicks of [
3783728,
3783729] into oc-m4-release
Change-Id: I9e1c316fea8f2bdf18fb8ad0bb38f5c4d6485fe7
Siarhei Vishniakou [Tue, 7 Nov 2017 05:16:47 +0000 (21:16 -0800)]
Fix resampling for multiple pointers
If more than one pointer is present and identical coordinates are
encountered for any pointer, the lastResample value will not be
invalidated (by clearing its bits). As a result, the same lastResample
value will be used to subsequently rewriteMessage any time in the
future. This can cause significant jumps in the pointer coordinates, and
is a bug. To further clarify, this bug has only to do with resampling
and nothing to do with both pointers having the same X or Y value.
This CL makes this logic to be per-pointer. As soon as non-identical
value is encountered and the timing conditions are such that the
resampled value is not needed to be used, the lastResample bit for that
pointer will be cleared, meaning that the value in lastResample for this
pointer is stale. This value will no longer be used anywhere.
When performing resampling, allow the process to happen on a per-pointer
basis. If one of the pointers has encountered events with identical
coordinates, then use the previously resampled value (do not resample
again), if that value is still valid (see above). Otherwise, the normal
resampling path will be taken. On the other pointers that do not have
identical coordinates, go through the normal path as well.
Bug:
68840121
Test: recorded a repro event with inputstudio and replayed it while
observing the screen. Saw that the coordinates jump before the fix,
and do not jump with the fix.
Change-Id: If43c323759de8f0184b76221d1ae599a75349ce9
Merged-In: If43c323759de8f0184b76221d1ae599a75349ce9
(cherry picked from commit
3bb597138bc53416b3049caa48c618075ec24231)
android-build-team Robot [Thu, 22 Mar 2018 20:42:51 +0000 (20:42 +0000)]
Merge cherrypicks of [
3782287,
3782954,
3783025,
3783026,
3783027,
3783028,
3783029,
3783030,
3783164,
3783165,
3783167,
3783168,
3783170,
3783171,
3783172,
3782288,
3783031,
3782196,
3782955] into oc-m4-release
Change-Id: I829c1af8a0e059880daf61bdd4aca5cc9132c345
Brian Duddie [Thu, 15 Feb 2018 23:02:29 +0000 (15:02 -0800)]
Add bounds check to sensors direct channel creation
Avoids attempting to read a 0-size array during input validation. Adds
SafetyNet logging when this is triggered.
Also, change the cast for the ashmem size check from int to int64_t to
avoid potential conversion to negative number on 32-bit systems.
Bug:
70986337
Test: run POC, confirm via logs that function bails early
Change-Id: I674285738983f18de3466f9e818d83dabe269b7d
(cherry picked from commit
0eb4624b33aeb375ae431a6b1e2b787c959968fe)
android-build-team Robot [Wed, 21 Mar 2018 21:25:58 +0000 (21:25 +0000)]
Snap for
4657601 from
b2e8c5a20709ff8273236ab76f3a2caa9b83630e to oc-m4-release
Change-Id: Ic38ee6339dd717720126bf9e16c404d37136feaf
Brian Duddie [Thu, 15 Feb 2018 23:02:29 +0000 (15:02 -0800)]
Add bounds check to sensors direct channel creation
Avoids attempting to read a 0-size array during input validation. Adds
SafetyNet logging when this is triggered.
Also, change the cast for the ashmem size check from int to int64_t to
avoid potential conversion to negative number on 32-bit systems.
Bug:
70986337
Test: run POC, confirm via logs that function bails early
Change-Id: I674285738983f18de3466f9e818d83dabe269b7d
(cherry picked from commit
0eb4624b33aeb375ae431a6b1e2b787c959968fe)
Chih-Wei Huang [Wed, 7 Mar 2018 08:40:40 +0000 (16:40 +0800)]
Merge tag 'android-8.1.0_r18' into oreo-x86
Android 8.1.0 Release 18 (OPM5.171019.017)
android-build-team Robot [Mon, 26 Feb 2018 18:04:44 +0000 (18:04 +0000)]
Snap for
4565141 from
fe29ba7a9c86bf37b24f9dcf6e765978bc5a9dd0 to oc-m4-release
Change-Id: I4589d60c744dbd4cdb448d12d1b3c5839a48eca7
android-build-team Robot [Wed, 3 Jan 2018 22:36:51 +0000 (22:36 +0000)]
Snap for
4485699 from
fe29ba7a9c86bf37b24f9dcf6e765978bc5a9dd0 to oc-m2-release
Change-Id: Ia10521643f057e000f1e59febfd77668963597e2
Chih-Wei Huang [Wed, 20 Dec 2017 13:09:39 +0000 (21:09 +0800)]
SurfaceFlinger_hwc1: fix timed out waiting for hw vsync
The commit
f4174530 changed DispSync initialization to an init method.
However, the hwc1 version of SurfaceFlinger is not updated to call
this method. As a result, DispSync is not initialized.
Chih-Wei Huang [Thu, 14 Sep 2017 10:20:23 +0000 (18:20 +0800)]
libEGL: use SwiftShader if hardware gralloc is not set
Chih-Wei Huang [Mon, 4 Sep 2017 11:26:33 +0000 (19:26 +0800)]
libEGL: select pixel format by EGL_NATIVE_VISUAL_ID
We need this workaround until Mesa supports HAL_PIXEL_FORMAT_RGBA_8888.
Chih-Wei Huang [Fri, 28 Jul 2017 11:44:57 +0000 (19:44 +0800)]
RenderEngine: support non-RGBA_8888 format
Some of our GPUs (e.g., radeon) don't support RGBA_8888 well.
To workaround it, just get the EGL config by a simpler query.
This patch should be reverted once all of our GPUs support
RGBA_8888.
Chih-Wei Huang [Tue, 27 Jun 2017 06:21:26 +0000 (14:21 +0800)]
installd: a workaround for 9p filesystem
SELinux and getxattr seem not work on 9p filesystem.
Ignore the errors as a workaround.
TEST: be able to boot to Home on QEMU with shared 'data' folder.
Chih-Wei Huang [Wed, 3 Aug 2016 17:38:50 +0000 (01:38 +0800)]
Run SurfaceFlinger with root privilege
To control virtual consoles, SurfaceFlinger needs the root privilege.
Chih-Wei Huang [Sun, 10 Dec 2017 15:21:22 +0000 (23:21 +0800)]
Merge branch 'android-ia' into oreo-x86
Chih-Wei Huang [Sat, 1 Nov 2014 17:21:12 +0000 (01:21 +0800)]
InputReader: add 5-point calibration
Updated for Android 5.0.
Chih-Wei Huang [Sun, 26 Oct 2014 07:39:53 +0000 (15:39 +0800)]
auto determine the density if not provided in surfaceflinger
We hope to support tablet UI for different resolutions.
So adjust the density according to the resolution.
Chih-Wei Huang [Sun, 26 Oct 2014 07:38:15 +0000 (15:38 +0800)]
SurfaceFlinger: enable console management
The console management was removed since ICS. But it's useful for debugging.
Re-implement it based on the original class ConsoleManagerThread of class
DisplayHardwareBase.
Edward Peek [Tue, 3 Apr 2012 18:17:00 +0000 (06:17 +1200)]
Added option to disable touchscreen pressure sensitivity from idc files
DanielK [Tue, 20 Mar 2012 06:28:43 +0000 (14:28 +0800)]
Support old single-touch touchscreens with BTN_LEFT
Byron Gardner [Mon, 3 Nov 2014 23:54:28 +0000 (15:54 -0800)]
Enable 64-bit support in libs/gui/Sensor.cpp
Change-Id: Iaaa112bd821a6a0e3234461df8f7b6acc47b254e
Orig-Change-Id: I04c22e6f2c6f4271ca451b775c8d7f86e4c97c38
Tracked-On: https://jira01.devtools.intel.com/browse/IMINAN-9998
Category: aosp improvement
Domain: SENSORS.VIRT-Common
Origin: internal
Upstream-Candidate: yes
Signed-off-by: Byron Gardner <byron.gardner@intel.com>
Reviewed-on: https://android.intel.com:443/296325
Wang, Yue A [Tue, 21 Jan 2014 09:42:13 +0000 (17:42 +0800)]
SurfaceFlinger: disable VSync thread if no clients requiring.
In EventThread, 2 VSYNCs are needed to do composition and update
the client status. So, a 30FPS video may leads to 60FPS VSYNC,
which means the DispSync thread would be waked 60FPS. This is a
unexpected behavior which takes more power consumption. Now we
update the SF status soon after the first VSYNC, which means no
extra VSYNC needed, and the DispSync could be awaked as expected,
and consequently power get saved.
Change-Id: If486eb9b87f109a71f71b510768f15dd733f1233
Orig-Change-Id: I1d3b166021e15a81b2ad770b039761fc2c15fddf
Tracked-On: https://jira01.devtools.intel.com/browse/IMINAN-12211
Category: aosp improvement
Domain: Graphics-SF
Origin: internal
Upstream-Candidate: yes
Signed-off-by: Wang, Yue A <yue.a.wang@intel.com>
Reviewed-on: https://android.intel.com:443/238344
juntingwang [Fri, 1 Mar 2013 08:02:56 +0000 (16:02 +0800)]
Set PS2 Keyboard controller as not a ketboard type
The Eventhub detects the platforms built-in PS/2 keyboard controller
as a physical keyboard. So the system will not display the software
keyboard by default. Modify it device type in Keyboard-less tablets,
so that ActivityManager will not ignore the PS/2 controller.
Issue: AXIA-1875
Change-Id: Ia5b7592e82aaf1970066bab5e9ca5f46ac83ab1c
Signed-off-by: juntingwang <Junting.Wang@windriver.com>
Andy Ross [Tue, 19 Feb 2013 22:39:34 +0000 (14:39 -0800)]
binder: Fix service initialization race vs. service manager
The framework relies on the global IServiceManager running before a
BinderService object is instantiated. But there was no detection of
the error condition when it was not (specifically: mediaserver can be
initialized before system_server), and in fact the default error
behavior (kill the proxy object) ensured that the process would never
be able to add services again. Retry the addService() code, and allow
transient binder failures for the special case of the service manager
proxy.
Issue: AXIA-1706
Change-Id: Icac10bb0f47a2fe33ac9605a13633b83afa3ebff
Signed-off-by: Andy Ross <andy.ross@windriver.com>
Daniel Leung [Thu, 13 Sep 2012 20:43:41 +0000 (13:43 -0700)]
Prevent EventHub from adding input device twice
When Android first starts up, it scans /dev/input for input devices.
In some rare instances, the EventHub gets another notification that
some device nodes are created. It then proceeds to add the same
input device again. This causes the system to get two events per
touch or key stroke.
This adds a check to prevent adding the same device if the operation
is triggerd by inotify.
Issue: AXIA-858
Change-Id: I68b02594f1c7f14067611735db0b3763378ec7ea
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
android-build-team Robot [Wed, 29 Nov 2017 18:11:51 +0000 (18:11 +0000)]
Merge cherrypicks of [
3287457,
3287458,
3286978,
3286979,
3287477,
3287478,
3287479,
3287480,
3287517,
3287518,
3287537,
3287538,
3287539,
3287540,
3287481,
3287482,
3287483,
3287484,
3287485,
3287486,
3287487,
3287488,
3287359,
3287459,
3287360,
3287361,
3287362,
3287363,
3287364,
3287365,
3287366,
3287367,
3287489,
3287490,
3287491,
3287557,
3287577,
3287558,
3287492,
3287493,
3287597,
3287617,
3286980,
3287460,
3287494] into oc-m3-release
Change-Id: I34c0761000c9003b56371511682f4bed7e99b706
Chia-I Wu [Thu, 5 Oct 2017 21:24:41 +0000 (14:24 -0700)]
surfaceflinger: make vsync injection more robust
There are more issues than I expected :)
- no lock to synchronize enable/disable and injection
- Every time injection is diabled and enabled, a new EventThread is
created
- mCallback might be nullptr
- ENABLE_VSYNC_INJECTIONS/INJECT_VSYNC should require special
permission
- MessageQueue::setEventThread must be called from the main thread
- MessageQueue::setEventThread does not handle EventThread switch
well
Bug:
65483324
Test: manual
Merged-In: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
Change-Id: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
(cherry picked from commit
6200eacdc927776483d775562db11cce284cc7e0)
Chia-I Wu [Thu, 5 Oct 2017 21:24:41 +0000 (14:24 -0700)]
surfaceflinger: make vsync injection more robust
There are more issues than I expected :)
- no lock to synchronize enable/disable and injection
- Every time injection is diabled and enabled, a new EventThread is
created
- mCallback might be nullptr
- ENABLE_VSYNC_INJECTIONS/INJECT_VSYNC should require special
permission
- MessageQueue::setEventThread must be called from the main thread
- MessageQueue::setEventThread does not handle EventThread switch
well
Bug:
65483324
Test: manual
Merged-In: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
Change-Id: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
(cherry picked from commit
6200eacdc927776483d775562db11cce284cc7e0)
android-build-team Robot [Wed, 29 Nov 2017 00:32:19 +0000 (00:32 +0000)]
Snap for
4448085 from
f2b791587c15ec5028d0b266d415c631a4078916 to oc-m3-release
Change-Id: Id0e8bb274f32339b9889c9b0de619e011711c5c7
android-build-team Robot [Tue, 28 Nov 2017 03:35:57 +0000 (03:35 +0000)]
Merge cherrypicks of [
3276508,
3277765,
3277766,
3277904,
3276473,
3278009,
3278010,
3277767,
3277768,
3277769,
3277770,
3276509,
3276510,
3278011,
3278012,
3278013,
3278014,
3278099,
3278100,
3278101,
3278102,
3278103,
3278104,
3278105,
3278106,
3277800,
3276474,
3278015,
3278016,
3278017,
3278118,
3278119,
3278120,
3278121,
3278122,
3277946,
3277905,
3277947,
3277906,
3277751,
3278123,
3277752,
3278110,
3277771,
3277907,
3278095,
3277908,
3278111,
3277772,
3276475,
3276476] into oc-mr1-release
Change-Id: Ife900dfa51f88db5508d790a3db28251a7038f23
Chia-I Wu [Thu, 5 Oct 2017 21:24:41 +0000 (14:24 -0700)]
surfaceflinger: make vsync injection more robust
There are more issues than I expected :)
- no lock to synchronize enable/disable and injection
- Every time injection is diabled and enabled, a new EventThread is
created
- mCallback might be nullptr
- ENABLE_VSYNC_INJECTIONS/INJECT_VSYNC should require special
permission
- MessageQueue::setEventThread must be called from the main thread
- MessageQueue::setEventThread does not handle EventThread switch
well
Bug:
65483324
Test: manual
Merged-In: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
Change-Id: I7d7b98d1f57afc64af0f2065a9bc7c8ad004ca9f
(cherry picked from commit
6200eacdc927776483d775562db11cce284cc7e0)
android-build-team Robot [Thu, 26 Oct 2017 20:01:39 +0000 (20:01 +0000)]
Snap for
4417144 from
f2b791587c15ec5028d0b266d415c631a4078916 to oc-m2-release
Change-Id: I6f114a47469ab69f46bf9d9b7c1429294bb80ec2
android-build-team Robot [Wed, 25 Oct 2017 05:31:29 +0000 (05:31 +0000)]
Merge cherrypicks of [
3122088,
3121430,
3119129,
3119130,
3119131,
3120667] into oc-mr1-release
Change-Id: If407b5d78299ba0be9410de4546042986fd65758
Romain Guy [Tue, 24 Oct 2017 20:40:32 +0000 (21:40 +0100)]
Add new color setting
On devices that support wide color rendering and color management,
add a new setting to disable color management ("saturated" color
mode). To disable color management, the framework can set a persistent
property. Color management can be also toggled by using a Binder
transaction. Finally this change adds a new Binder query so Settings
can easily check whether the device supports wide color rendering.
Bug:
68159303
Test: manual (adb shell + apps)
Change-Id: If74d9b0273bc04f4a3d11e63fe2ec96451fbcc2e
(cherry picked from commit
54f154a28284eabb52ade2689d4a9f8fa190163b)
android-build-team Robot [Wed, 18 Oct 2017 16:59:13 +0000 (16:59 +0000)]
Snap for
4402310 from
d8f66b08ea607fb6c4bcbb8a62a0a99f82d909f9 to oc-m2-release
Change-Id: I625ea121635c45f347aa3498eb7aa6c818e5a33f
android-build-team Robot [Thu, 12 Oct 2017 07:25:50 +0000 (07:25 +0000)]
Snap for
4391495 from
331d79d26b237a6ebf4284dd99c79b0fe5ab55df to oc-mr1-release
Change-Id: Ia1a538a97249d77b25b1f1568df514547c0bcd5f
Corey Tabaka [Thu, 12 Oct 2017 02:00:50 +0000 (19:00 -0700)]
Add missing transitive dependency to pdx_tool.
Bug:
65455724
Test: make -j30
Change-Id: I03a22e10d92ea53bb2e1631e4203a186e42fa265
Corey Tabaka [Wed, 11 Oct 2017 17:52:54 +0000 (10:52 -0700)]
Revert "Revert PDX tracing."
This reverts commit
05cd77c494aa7042fca7978e1b934855598b765e.
Bug:
65455724
Test: make -j30
Change-Id: Id531101cc35b661f02291eed0c044e96f5a91a12
Corey Tabaka [Wed, 11 Oct 2017 17:49:57 +0000 (10:49 -0700)]
Add missing transitive dependency to atrace.
This is the proper fix for the revert in ag/
3048738.
Bug:
65455724
Test: lunch full-eng && make -j30
Change-Id: I88d37fca2d1f71a46595dd74b5fd6749fa4b477d
Michael Wright [Wed, 11 Oct 2017 14:44:26 +0000 (15:44 +0100)]
Revert PDX tracing.
This broke full-eng / docs / m_e_arm-eng builds.
Test: lunch full-eng && m-j8
Change-Id: I79b0176738e4de35cca25e9618e64aa2bd4c4316
android-build-team Robot [Wed, 11 Oct 2017 07:21:48 +0000 (07:21 +0000)]
Snap for
4388906 from
52ea25cf06cef250ec73052611b48556b3fce4d5 to oc-mr1-release
Change-Id: I8be8e1ad05e7445a5c03a3f6009b5e1e30171a59
Corey Tabaka [Thu, 14 Sep 2017 01:02:48 +0000 (18:02 -0700)]
Add shared memory based buffer metadata
This CLs reduces BufferHub CPU consumption by adding asynchronous
state transition so that out-of-process VR composition can run on 2016
pixel devices smoothly. In addition, this CL addresses a couple corner
cases in the existing bufferhub logic, which fixes various blackscreen
issues.
1/ Tracks buffer transition states (gained, posted, acquired, released)
from the client side via atomic shared memory and adds
PostAsync/AcquireAsync/ReleaseAsync/GainAsync with metadata and
fence support.
2/ Adds dequeue order guarantee for buffers enqueued with
dvrWriteBufferQueuePostBuffer.
3/ Synchronous BuffeHub operations are still supported.
4/ Bump up the bufferhubd's soft limit of open file descriptor.
5/ Handle orphaned consumer in acquired state. This is a corner case
that consumer process goes aways (most likely due to a crash) leaving
buffer stuck in acquired state with inconsistent buffer state.
6/ Fixes a race condition for released buffer to be Gain'ed and
Acquire'd when a new consumer is created in released state.
7/ Improve silent consumer queue efficiency: Silent queues no longer
import buffers or receive signals about new buffers and they are
limited to only spawning other consumers and notifications about
producers hanging up.
8/ Modify PDX/UDS channel event signaling to work around epoll
behavior. PDX UDS uses a combination of an eventfd and an epoll set
to simulate the original PDX transport channel events. An odd
behavior discovered in the kernel implementation of epoll was found
that causes the epoll fd to "unsignal" itself whenever epoll_wait()
is called on it, regardless of whether it should still be
pending. This breaks the edge triggerd behavior in nested epoll sets
that channel events depend on. Since this is unlikely to ever be
fixed in the kernel we work around the behavior by using the epoll
set only as a logical OR of two eventfds and never calling
epoll_wait() on it. When polling is required we use regluar poll()
with the eventfds and data fd to avoid the bad behavior in
epoll_wait().
9/ Keep reading data after PDX hangup signal. UDS will signal hangup
when the other end of the socket closes. However, data could still be
in the kerenl buffer and should be consumed. Fix an issue where the
service misses an impulse sent right before the socket is closed.
Bug:
65455724
Bug:
65458354
Bug:
65458312
Bug:
64027135
Bug:
67424527
Test: libpdx_uds_tests
bufferhub_tests
buffer_hub_queue-test
buffer_hub_queue_producer-test
dvr_api-test
Change-Id: Id07db1f206ccf4e06f7ee3c671193334408971ca
android-build-team Robot [Mon, 9 Oct 2017 19:05:23 +0000 (19:05 +0000)]
Snap for
4384531 from
666e90ffc939a27db63bd7c031fe70ebc8676b73 to oc-m2-release
Change-Id: I860ab87bb8fafc7accdc5600e52929f8df68f075
android-build-team Robot [Thu, 5 Oct 2017 07:30:32 +0000 (07:30 +0000)]
Snap for
4378450 from
35b5114be8da71c69fc8a1ff8fb457c912c0992f to oc-mr1-release
Change-Id: I93cf952e3df19205d63b3d3bd4fccc22cd262432
Randy Xu [Wed, 5 Jul 2017 06:18:38 +0000 (14:18 +0800)]
Solve the composer service NULL pointer crash
The callback functions are set nullptr in ComposerClient::~ComposerClient()
./composer/2.1/default/ComposerClient.cpp:160: mHal.enableCallback(false)
However, the callbacks are still used in hwc2on1adaptor, it will cause segment fault.
Bug:
64650599
Test: adb shell stop
Change-Id: I92e6a6b42418e987a7ead041f2d95c194b6a16e8
Signed-off-by: Randy Xu <randy.xu@intel.com>
Signed-off-by: Qiming Shi <qiming.shi@intel.com>
Signed-off-by: Yong Yao <yong.yao@intel.com>
Signed-off-by: Gaurav Sarode <sgaurav@google.com>
android-build-team Robot [Tue, 3 Oct 2017 07:28:35 +0000 (07:28 +0000)]
Snap for
4373604 from
8c6462c8c48022a4a77ab8ed218551880d2bbab9 to oc-mr1-release
Change-Id: Iabc1c91c428511b1f337ef6e548dc69df13ebb02
Courtney Goeltzenleuchter [Mon, 2 Oct 2017 21:31:43 +0000 (21:31 +0000)]
Merge "Limit Display-P3 surface formats to 8888" into oc-mr1-dev
android-build-team Robot [Mon, 2 Oct 2017 04:19:31 +0000 (04:19 +0000)]
release-request-
53526352-7b51-4ab1-a661-
632ffc55dd7c-for-git_oc-mr1-release-
4371241 snap-temp-L10900000107789672
Change-Id: I4a64d37aab8dde4ad6abc1bc37a2477683696a39
Steven Thomas [Sat, 30 Sep 2017 00:51:21 +0000 (00:51 +0000)]
Merge "Fix deadlock when transitioning to vr flinger" into oc-mr1-dev
android-build-team Robot [Fri, 29 Sep 2017 20:02:51 +0000 (20:02 +0000)]
release-request-
99856c15-b008-4977-9971-
f86523a23c0a-for-git_oc-m2-release-
4367109 snap-temp-L18300000107415568
Change-Id: Iedb5b2ab04d4740b203022eb17cfe693dcfe6875
TreeHugger Robot [Fri, 29 Sep 2017 18:05:21 +0000 (18:05 +0000)]
Merge "Use the HWC caching mechanism to avoid stalls in the ion driver." into oc-mr1-dev
Steven Thomas [Thu, 28 Sep 2017 22:30:23 +0000 (15:30 -0700)]
Fix deadlock when transitioning to vr flinger
If we were unlucky with the timing when switching to vr flinger we would
sometimes deadlock. The vr dispatch thread would request the display
from surface flinger, locking mStateLock in the process. mStateLock was
being held by the surface flinger main thread, which was processing a
previous request to switch to vr flinger. The main thread was trying to
connect to the vr hardware composer service, which sent a request to the
vr dispatch thread as part of its initialization, leading to the
deadlock.
The deadlock is easily fixed by posting a message to request the vr
flinger switch to the surface flinger main thread, instead of doing it
on the vr dispatch thread.
Bug:
66916578
Test: Confirmed I can still get into/out of vr flinger on
Marlin. There's no longer code to acquire mStateLock in the vr dispatch
thread, so the deadlock is no longer possible.
Change-Id: I3de5476f698ed798f6b9afe927cc733f0f38c56e