Snap for 8701376 from 4c4de5a85712ffe49c39f3bb5a07a77f9f69c8c8 to mainline-appsearch-releaseaml_ase_331011020

Change-Id: I4a9a36fefefde9116f96d0719efb13f7c2477c72

8 files changed, 84 insertions, 125 deletions

diff --git a/gralloc4/service/4.x/Android.bp b/gralloc4/service/4.x/Android.bp
deleted file mode 100644
index dbdfbec..0000000
--- a/gralloc4/service/4.x/Android.bp
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2020 Arm Limited.
- * SPDX-License-Identifier: Apache-2.0
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_binary {
-	name: "android.hardware.graphics.allocator@4.0-service",
-	proprietary: true,
-	relative_install_path: "hw",
-	srcs: [
-		"service.cpp",
-	],
-	init_rc: [
-		"android.hardware.graphics.allocator@4.0-service.rc",
-	],
-	header_libs: [
-		"libgralloc_headers",
-	],
-	shared_libs: [
-		"android.hardware.graphics.allocator@4.0",
-		"android.hardware.graphics.allocator@4.0-impl",
-		"android.hardware.graphics.common-V3-ndk",
-		"libhidlbase",
-		"liblog",
-		"libutils",
-	],
-	required: [
-		"android.hardware.graphics.allocator@4.0-impl",
-	],
-}
diff --git a/gralloc4/service/4.x/android.hardware.graphics.allocator@4.0-service.rc b/gralloc4/service/4.x/android.hardware.graphics.allocator@4.0-service.rc
deleted file mode 100644
index 6523f4e..0000000
--- a/gralloc4/service/4.x/android.hardware.graphics.allocator@4.0-service.rc
+++ /dev/null
@@ -1,7 +0,0 @@
-service vendor.gralloc-4-0 /vendor/bin/hw/android.hardware.graphics.allocator@4.0-service
-    class hal animation
-    interface android.hardware.graphics.allocator@4.0::IAllocator default
-    user system
-    group graphics drmrpc
-    capabilities SYS_NICE
-    onrestart restart surfaceflinger
diff --git a/gralloc4/service/4.x/service.cpp b/gralloc4/service/4.x/service.cpp
deleted file mode 100644
index d540086..0000000
--- a/gralloc4/service/4.x/service.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2020 Arm Limited.
- * SPDX-License-Identifier: Apache-2.0
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define LOG_TAG "android.hardware.graphics.allocator@4.0-service"
-
-#include <hidl/HidlTransportSupport.h>
-#include <hidl/Status.h>
-#include <utils/StrongPointer.h>
-
-#include "4.x/GrallocAllocator.h"
-
-using android::hardware::configureRpcThreadpool;
-using android::hardware::joinRpcThreadpool;
-using android::hardware::setMinSchedulerPolicy;
-using arm::allocator::GrallocAllocator;
-
-int main() {
-    android::sp<GrallocAllocator> service = new GrallocAllocator();
-    configureRpcThreadpool(4, true /* callerWillJoin */);
-
-    if (!setMinSchedulerPolicy(service, SCHED_NORMAL, -20)) {
-        ALOGW("Cannot bump allocator priority");
-    }
-
-    if (service->registerAsService() != android::OK) {
-        ALOGE("Cannot register allocator service");
-        return -EINVAL;
-    }
-
-    joinRpcThreadpool();
-    return 0;
-}
diff --git a/gralloc4/src/4.x/Android.bp b/gralloc4/src/4.x/Android.bp
index ab0fead..88c7a01 100644
--- a/gralloc4/src/4.x/Android.bp
+++ b/gralloc4/src/4.x/Android.bp
@@ -73,25 +73,6 @@ cc_defaults {
 }
 
 cc_library_shared {
-	name: "android.hardware.graphics.allocator@4.0-impl",
-	defaults: [
-		"arm_gralloc_api_4x_defaults",
-	],
-	shared_libs: [
-		"android.hardware.graphics.allocator@4.0",
-		"android.hardware.graphics.mapper@4.0",
-	],
-	srcs: [
-		"GrallocAllocator.cpp",
-		":libgralloc_hidl_common_allocator",
-		":libgralloc_hidl_common_shared_metadata",
-	],
-	include_dirs: [
-		"hardware/google/gchips/include",
-	],
-}
-
-cc_library_shared {
 	name: "android.hardware.graphics.mapper@4.0-impl",
 	defaults: [
 		"arm_gralloc_api_4x_defaults",
diff --git a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
index 12e4494..7656fcf 100644
--- a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
+++ b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
@@ -535,6 +535,7 @@ static void calc_allocation_size(const int width,
                                  const bool has_cpu_usage,
                                  const bool has_hw_usage,
                                  const bool has_gpu_usage,
+                                 const bool has_camera_usage,
                                  int * const pixel_stride,
                                  uint64_t * const size,
                                  plane_info_t plane_info[MAX_PLANES])
@@ -606,15 +607,17 @@ static void calc_allocation_size(const int width,
 
 			uint32_t cpu_align = 0;
 
+			if (!(has_camera_usage && !has_cpu_usage && format.id == MALI_GRALLOC_FORMAT_INTERNAL_RAW10)) {
 #if CAN_SKIP_CPU_ALIGN == 1
-			if (has_cpu_usage)
+				if (has_cpu_usage)
 #endif
-			{
-				assert((format.bpp[plane] * format.align_w_cpu) % 8 == 0);
-	            const bool is_primary_plane = (plane == 0 || !format.planes_contiguous);
-				if (is_primary_plane)
 				{
-					cpu_align = (format.bpp[plane] * format.align_w_cpu) / 8;
+					assert((format.bpp[plane] * format.align_w_cpu) % 8 == 0);
+					const bool is_primary_plane = (plane == 0 || !format.planes_contiguous);
+					if (is_primary_plane)
+					{
+						cpu_align = (format.bpp[plane] * format.align_w_cpu) / 8;
+					}
 				}
 			}
 
@@ -977,6 +980,16 @@ static int prepare_descriptor_exynos_formats(
 	return 0;
 }
 
+static bool validate_usage(const uint64_t usage) {
+	if (usage & GRALLOC_USAGE_FRONT_BUFFER) {
+		/* TODO(b/218383959): Enable front buffer rendering */
+		MALI_GRALLOC_LOGW("Front buffer rendering is disabled.");
+		return false;
+	}
+
+	return true;
+}
+
 int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescriptor)
 {
 	alloc_type_t alloc_type{};
@@ -985,6 +998,11 @@ int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescripto
 	int alloc_height = bufDescriptor->height;
 	uint64_t usage = bufDescriptor->producer_usage | bufDescriptor->consumer_usage;
 
+	if (!validate_usage(usage)) {
+		MALI_GRALLOC_LOGE("Usage flag validation failed.");
+		return -EINVAL;
+	}
+
 	/*
 	* Select optimal internal pixel format based upon
 	* usage and requested format.
@@ -1048,6 +1066,7 @@ int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescripto
 		                     usage & (GRALLOC_USAGE_SW_READ_MASK | GRALLOC_USAGE_SW_WRITE_MASK),
 		                     usage & ~(GRALLOC_USAGE_PRIVATE_MASK | GRALLOC_USAGE_SW_READ_MASK | GRALLOC_USAGE_SW_WRITE_MASK),
 		                     usage & (GRALLOC_USAGE_HW_TEXTURE | GRALLOC_USAGE_HW_RENDER | GRALLOC_USAGE_GPU_DATA_BUFFER),
+		                     usage & (GRALLOC_USAGE_HW_CAMERA_WRITE | GRALLOC_USAGE_HW_CAMERA_READ),
 		                     &bufDescriptor->pixel_stride,
 		                     &bufDescriptor->alloc_sizes[0],
 		                     bufDescriptor->plane_info);
diff --git a/gralloc4/src/core/mali_gralloc_reference.cpp b/gralloc4/src/core/mali_gralloc_reference.cpp
index 954c2b3..8f12975 100644
--- a/gralloc4/src/core/mali_gralloc_reference.cpp
+++ b/gralloc4/src/core/mali_gralloc_reference.cpp
@@ -21,6 +21,7 @@
 #include <android-base/thread_annotations.h>
 #include <hardware/gralloc1.h>
 
+#include <algorithm>
 #include <map>
 #include <mutex>
 
@@ -58,6 +59,54 @@ private:
         return hnd->get_usage() & cpu_access_usage;
     }
 
+    static off_t get_buffer_size(unsigned int fd) {
+        off_t current = lseek(fd, 0, SEEK_CUR);
+        off_t size = lseek(fd, 0, SEEK_END);
+        lseek(fd, current, SEEK_SET);
+        return size;
+    }
+
+    static bool dmabuf_sanity_check(buffer_handle_t handle) {
+        private_handle_t *hnd =
+                static_cast<private_handle_t *>(const_cast<native_handle_t *>(handle));
+
+        int valid_fd_count = std::find(hnd->fds, hnd->fds + MAX_FDS, -1) - hnd->fds;
+        // One fd is reserved for metadata which is not accounted for in fd_count
+        if (hnd->fd_count != valid_fd_count - 1) {
+            MALI_GRALLOC_LOGE("%s failed: count of valid buffer fds does not match fd_count",
+                              __func__);
+            return false;
+        }
+
+        auto check_pid = [&](int fd, uint64_t allocated_size) -> bool {
+            auto size = get_buffer_size(fd);
+            auto size_padding = size - (off_t)allocated_size;
+            if ((size != -1) && ((size_padding < 0) || (size_padding > PAGE_SIZE))) {
+                MALI_GRALLOC_LOGE("%s failed: fd (%d) size (%jd) is not within a PAGE_SIZE of "
+                                  "expected size (%" PRIx64 ")",
+                                  __func__, fd, static_cast<intmax_t>(size), allocated_size);
+                return false;
+            }
+            return true;
+        };
+
+        // Check client facing dmabufs
+        for (auto i = 0; i < hnd->fd_count; i++) {
+            if (!check_pid(hnd->fds[i], hnd->alloc_sizes[i])) {
+                MALI_GRALLOC_LOGE("%s failed: Size check failed for alloc_sizes[%d]", __func__, i);
+                return false;
+            }
+        }
+
+        // Check metadata dmabuf
+        if (!check_pid(hnd->get_share_attr_fd(), hnd->attr_size)) {
+            MALI_GRALLOC_LOGE("%s failed: Size check failed for metadata fd", __func__);
+            return false;
+        }
+
+        return true;
+    }
+
     int map_locked(buffer_handle_t handle) REQUIRES(lock) {
         private_handle_t *hnd = (private_handle_t *)handle;
         auto it = buffer_map.find(hnd);
@@ -72,10 +121,15 @@ private:
             MALI_GRALLOC_LOGE("BUG: Found an imported buffer with ref count 0, expect errors");
         }
 
+        // Return early if buffer is already mapped
         if (data.bases[0] != nullptr) {
             return 0;
         }
 
+        if (!dmabuf_sanity_check(handle)) {
+            return -EINVAL;
+        }
+
         int error = mali_gralloc_ion_map(hnd);
         if (error != 0) {
             return error;
@@ -115,7 +169,7 @@ private:
         } else {
             for (auto i = 0; i < MAX_BUFFER_FDS; i++) {
                 if (hnd->bases[i] != 0 || data.bases[i] != nullptr) {
-                    MALI_GRALLOC_LOGE("Validation failed: Expected nullptr for unmaped buffer");
+                    MALI_GRALLOC_LOGE("Validation failed: Expected nullptr for unmapped buffer");
                     return -EINVAL;
                 }
             }
diff --git a/gralloc4/src/hidl_common/Mapper.cpp b/gralloc4/src/hidl_common/Mapper.cpp
index e8f5b10..f6ebe6f 100644
--- a/gralloc4/src/hidl_common/Mapper.cpp
+++ b/gralloc4/src/hidl_common/Mapper.cpp
@@ -563,7 +563,7 @@ void isSupported(const IMapper::BufferDescriptorInfo& description, IMapper::isSu
 	if (result != 0)
 	{
 		MALI_GRALLOC_LOGV("Allocation for the given description will not succeed. error: %d", result);
-		hidl_cb(Error::NO_RESOURCES, false);
+		hidl_cb(Error::NONE, false);
 	}
 	else
 	{
diff --git a/gralloc4/src/mali_gralloc_buffer.h b/gralloc4/src/mali_gralloc_buffer.h
index 02172c6..3863342 100644
--- a/gralloc4/src/mali_gralloc_buffer.h
+++ b/gralloc4/src/mali_gralloc_buffer.h
@@ -177,6 +177,9 @@ struct private_handle_t
 	int magic DEFAULT_INITIALIZER(sMagic);
 	int flags DEFAULT_INITIALIZER(0);
 
+	/*
+	 * Number of dmabuf fds, NOT including the metadata fd
+	 */
 	int fd_count DEFAULT_INITIALIZER(1);
 
 	/*