1 /*
2  * Copyright (C) 2018 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <poll.h>
18 
19 #include <android-base/unique_fd.h>
20 #include <android/frameworks/bufferhub/1.0/IBufferHub.h>
21 #include <log/log.h>
22 #include <ui/BufferHubBuffer.h>
23 #include <ui/BufferHubDefs.h>
24 #include <utils/Trace.h>
25 
26 using ::android::base::unique_fd;
27 using ::android::BufferHubDefs::isAnyClientAcquired;
28 using ::android::BufferHubDefs::isAnyClientGained;
29 using ::android::BufferHubDefs::isClientAcquired;
30 using ::android::BufferHubDefs::isClientGained;
31 using ::android::BufferHubDefs::isClientPosted;
32 using ::android::BufferHubDefs::isClientReleased;
33 using ::android::frameworks::bufferhub::V1_0::BufferHubStatus;
34 using ::android::frameworks::bufferhub::V1_0::BufferTraits;
35 using ::android::frameworks::bufferhub::V1_0::IBufferClient;
36 using ::android::frameworks::bufferhub::V1_0::IBufferHub;
37 using ::android::hardware::hidl_handle;
38 using ::android::hardware::graphics::common::V1_2::HardwareBufferDescription;
39 
40 namespace android {
41 
create(uint32_t width,uint32_t height,uint32_t layerCount,uint32_t format,uint64_t usage,size_t userMetadataSize)42 std::unique_ptr<BufferHubBuffer> BufferHubBuffer::create(uint32_t width, uint32_t height,
43                                                          uint32_t layerCount, uint32_t format,
44                                                          uint64_t usage, size_t userMetadataSize) {
45     auto buffer = std::unique_ptr<BufferHubBuffer>(
46             new BufferHubBuffer(width, height, layerCount, format, usage, userMetadataSize));
47     return buffer->isValid() ? std::move(buffer) : nullptr;
48 }
49 
import(const sp<NativeHandle> & token)50 std::unique_ptr<BufferHubBuffer> BufferHubBuffer::import(const sp<NativeHandle>& token) {
51     if (token == nullptr || token.get() == nullptr) {
52         ALOGE("%s: token cannot be nullptr!", __FUNCTION__);
53         return nullptr;
54     }
55 
56     auto buffer = std::unique_ptr<BufferHubBuffer>(new BufferHubBuffer(token));
57     return buffer->isValid() ? std::move(buffer) : nullptr;
58 }
59 
BufferHubBuffer(uint32_t width,uint32_t height,uint32_t layerCount,uint32_t format,uint64_t usage,size_t userMetadataSize)60 BufferHubBuffer::BufferHubBuffer(uint32_t width, uint32_t height, uint32_t layerCount,
61                                  uint32_t format, uint64_t usage, size_t userMetadataSize) {
62     ATRACE_CALL();
63     ALOGD("%s: width=%u height=%u layerCount=%u, format=%u "
64           "usage=%" PRIx64 " mUserMetadataSize=%zu",
65           __FUNCTION__, width, height, layerCount, format, usage, userMetadataSize);
66 
67     sp<IBufferHub> bufferhub = IBufferHub::getService();
68     if (bufferhub.get() == nullptr) {
69         ALOGE("%s: BufferHub service not found!", __FUNCTION__);
70         return;
71     }
72 
73     AHardwareBuffer_Desc aDesc = {width, height,         layerCount,   format,
74                                   usage, /*stride=*/0UL, /*rfu0=*/0UL, /*rfu1=*/0ULL};
75     HardwareBufferDescription desc;
76     memcpy(&desc, &aDesc, sizeof(HardwareBufferDescription));
77 
78     BufferHubStatus ret;
79     sp<IBufferClient> client;
80     BufferTraits bufferTraits;
81     IBufferHub::allocateBuffer_cb allocCb = [&](const auto& status, const auto& outClient,
82                                                 const auto& outTraits) {
83         ret = status;
84         client = std::move(outClient);
85         bufferTraits = std::move(outTraits);
86     };
87 
88     if (!bufferhub->allocateBuffer(desc, static_cast<uint32_t>(userMetadataSize), allocCb).isOk()) {
89         ALOGE("%s: allocateBuffer transaction failed!", __FUNCTION__);
90         return;
91     } else if (ret != BufferHubStatus::NO_ERROR) {
92         ALOGE("%s: allocateBuffer failed with error %u.", __FUNCTION__, ret);
93         return;
94     } else if (client == nullptr) {
95         ALOGE("%s: allocateBuffer got null BufferClient.", __FUNCTION__);
96         return;
97     }
98 
99     const int importRet = initWithBufferTraits(bufferTraits);
100     if (importRet < 0) {
101         ALOGE("%s: Failed to import buffer: %s", __FUNCTION__, strerror(-importRet));
102         client->close();
103     }
104     mBufferClient = std::move(client);
105 }
106 
BufferHubBuffer(const sp<NativeHandle> & token)107 BufferHubBuffer::BufferHubBuffer(const sp<NativeHandle>& token) {
108     sp<IBufferHub> bufferhub = IBufferHub::getService();
109     if (bufferhub.get() == nullptr) {
110         ALOGE("%s: BufferHub service not found!", __FUNCTION__);
111         return;
112     }
113 
114     BufferHubStatus ret;
115     sp<IBufferClient> client;
116     BufferTraits bufferTraits;
117     IBufferHub::importBuffer_cb importCb = [&](const auto& status, const auto& outClient,
118                                                const auto& outTraits) {
119         ret = status;
120         client = std::move(outClient);
121         bufferTraits = std::move(outTraits);
122     };
123 
124     // hidl_handle(native_handle_t*) simply creates a raw pointer reference withouth ownership
125     // transfer.
126     if (!bufferhub->importBuffer(hidl_handle(token.get()->handle()), importCb).isOk()) {
127         ALOGE("%s: importBuffer transaction failed!", __FUNCTION__);
128         return;
129     } else if (ret != BufferHubStatus::NO_ERROR) {
130         ALOGE("%s: importBuffer failed with error %u.", __FUNCTION__, ret);
131         return;
132     } else if (client == nullptr) {
133         ALOGE("%s: importBuffer got null BufferClient.", __FUNCTION__);
134         return;
135     }
136 
137     const int importRet = initWithBufferTraits(bufferTraits);
138     if (importRet < 0) {
139         ALOGE("%s: Failed to import buffer: %s", __FUNCTION__, strerror(-importRet));
140         client->close();
141     }
142     mBufferClient = std::move(client);
143 }
144 
~BufferHubBuffer()145 BufferHubBuffer::~BufferHubBuffer() {
146     // Close buffer client to avoid possible race condition: user could first duplicate and hold
147     // token with the original buffer gone, and then try to import the token. The close function
148     // will explicitly invalidate the token to avoid this.
149     if (mBufferClient != nullptr) {
150         if (!mBufferClient->close().isOk()) {
151             ALOGE("%s: close BufferClient transaction failed!", __FUNCTION__);
152         }
153     }
154 }
155 
initWithBufferTraits(const BufferTraits & bufferTraits)156 int BufferHubBuffer::initWithBufferTraits(const BufferTraits& bufferTraits) {
157     ATRACE_CALL();
158 
159     if (bufferTraits.bufferInfo.getNativeHandle() == nullptr) {
160         ALOGE("%s: missing buffer info handle.", __FUNCTION__);
161         return -EINVAL;
162     }
163 
164     if (bufferTraits.bufferHandle.getNativeHandle() == nullptr) {
165         ALOGE("%s: missing gralloc handle.", __FUNCTION__);
166         return -EINVAL;
167     }
168 
169     // Import fds. Dup fds because hidl_handle owns the fds.
170     unique_fd ashmemFd(fcntl(bufferTraits.bufferInfo->data[0], F_DUPFD_CLOEXEC, 0));
171     mMetadata = BufferHubMetadata::import(std::move(ashmemFd));
172     if (!mMetadata.isValid()) {
173         ALOGE("%s: Received an invalid metadata.", __FUNCTION__);
174         return -EINVAL;
175     }
176 
177     mEventFd = BufferHubEventFd(fcntl(bufferTraits.bufferInfo->data[1], F_DUPFD_CLOEXEC, 0));
178     if (!mEventFd.isValid()) {
179         ALOGE("%s: Received ad invalid event fd.", __FUNCTION__);
180         return -EINVAL;
181     }
182 
183     int bufferId = bufferTraits.bufferInfo->data[2];
184     if (bufferId < 0) {
185         ALOGE("%s: Received an invalid (negative) id.", __FUNCTION__);
186         return -EINVAL;
187     }
188 
189     uint32_t clientBitMask;
190     memcpy(&clientBitMask, &bufferTraits.bufferInfo->data[3], sizeof(clientBitMask));
191     if (clientBitMask == 0U) {
192         ALOGE("%s: Received an invalid client state mask.", __FUNCTION__);
193         return -EINVAL;
194     }
195 
196     uint32_t userMetadataSize;
197     memcpy(&userMetadataSize, &bufferTraits.bufferInfo->data[4], sizeof(userMetadataSize));
198     if (mMetadata.userMetadataSize() != userMetadataSize) {
199         ALOGE("%s: user metadata size not match: expected %u, actual %zu.", __FUNCTION__,
200               userMetadataSize, mMetadata.userMetadataSize());
201         return -EINVAL;
202     }
203 
204     size_t metadataSize = static_cast<size_t>(mMetadata.metadataSize());
205     if (metadataSize < BufferHubDefs::kMetadataHeaderSize) {
206         ALOGE("%s: metadata too small: %zu", __FUNCTION__, metadataSize);
207         return -EINVAL;
208     }
209 
210     // Populate shortcuts to the atomics in metadata.
211     auto metadataHeader = mMetadata.metadataHeader();
212     mBufferState = &metadataHeader->bufferState;
213     mFenceState = &metadataHeader->fenceState;
214     mActiveClientsBitMask = &metadataHeader->activeClientsBitMask;
215     // The C++ standard recommends (but does not require) that lock-free atomic operations are
216     // also address-free, that is, suitable for communication between processes using shared
217     // memory.
218     LOG_ALWAYS_FATAL_IF(!std::atomic_is_lock_free(mBufferState) ||
219                                 !std::atomic_is_lock_free(mFenceState) ||
220                                 !std::atomic_is_lock_free(mActiveClientsBitMask),
221                         "Atomic variables in ashmen are not lock free.");
222 
223     // Import the buffer: We only need to hold on the native_handle_t here so that
224     // GraphicBuffer instance can be created in future.
225     mBufferHandle = std::move(bufferTraits.bufferHandle);
226     memcpy(&mBufferDesc, &bufferTraits.bufferDesc, sizeof(AHardwareBuffer_Desc));
227 
228     mId = bufferId;
229     mClientStateMask = clientBitMask;
230 
231     // TODO(b/112012161) Set up shared fences.
232     ALOGD("%s: id=%d, mBufferState=%" PRIx32 ".", __FUNCTION__, mId,
233           mBufferState->load(std::memory_order_acquire));
234     return 0;
235 }
236 
gain()237 int BufferHubBuffer::gain() {
238     uint32_t currentBufferState = mBufferState->load(std::memory_order_acquire);
239     if (isClientGained(currentBufferState, mClientStateMask)) {
240         ALOGV("%s: Buffer is already gained by this client %" PRIx32 ".", __FUNCTION__,
241               mClientStateMask);
242         return 0;
243     }
244     do {
245         if (isAnyClientGained(currentBufferState & (~mClientStateMask)) ||
246             isAnyClientAcquired(currentBufferState)) {
247             ALOGE("%s: Buffer is in use, id=%d mClientStateMask=%" PRIx32 " state=%" PRIx32 ".",
248                   __FUNCTION__, mId, mClientStateMask, currentBufferState);
249             return -EBUSY;
250         }
251         // Change the buffer state to gained state, whose value happens to be the same as
252         // mClientStateMask.
253     } while (!mBufferState->compare_exchange_weak(currentBufferState, mClientStateMask,
254                                                   std::memory_order_acq_rel,
255                                                   std::memory_order_acquire));
256     // TODO(b/119837586): Update fence state and return GPU fence.
257     return 0;
258 }
259 
post()260 int BufferHubBuffer::post() {
261     uint32_t currentBufferState = mBufferState->load(std::memory_order_acquire);
262     uint32_t updatedBufferState = (~mClientStateMask) & BufferHubDefs::kHighBitsMask;
263     do {
264         if (!isClientGained(currentBufferState, mClientStateMask)) {
265             ALOGE("%s: Cannot post a buffer that is not gained by this client. buffer_id=%d "
266                   "mClientStateMask=%" PRIx32 " state=%" PRIx32 ".",
267                   __FUNCTION__, mId, mClientStateMask, currentBufferState);
268             return -EBUSY;
269         }
270         // Set the producer client buffer state to released, other clients' buffer state to posted.
271         // Post to all existing and non-existing clients.
272     } while (!mBufferState->compare_exchange_weak(currentBufferState, updatedBufferState,
273                                                   std::memory_order_acq_rel,
274                                                   std::memory_order_acquire));
275     // TODO(b/119837586): Update fence state and return GPU fence if needed.
276     return 0;
277 }
278 
acquire()279 int BufferHubBuffer::acquire() {
280     uint32_t currentBufferState = mBufferState->load(std::memory_order_acquire);
281     if (isClientAcquired(currentBufferState, mClientStateMask)) {
282         ALOGV("%s: Buffer is already acquired by this client %" PRIx32 ".", __FUNCTION__,
283               mClientStateMask);
284         return 0;
285     }
286     uint32_t updatedBufferState = 0U;
287     do {
288         if (!isClientPosted(currentBufferState, mClientStateMask)) {
289             ALOGE("%s: Cannot acquire a buffer that is not in posted state. buffer_id=%d "
290                   "mClientStateMask=%" PRIx32 " state=%" PRIx32 ".",
291                   __FUNCTION__, mId, mClientStateMask, currentBufferState);
292             return -EBUSY;
293         }
294         // Change the buffer state for this consumer from posted to acquired.
295         updatedBufferState = currentBufferState ^ mClientStateMask;
296     } while (!mBufferState->compare_exchange_weak(currentBufferState, updatedBufferState,
297                                                   std::memory_order_acq_rel,
298                                                   std::memory_order_acquire));
299     // TODO(b/119837586): Update fence state and return GPU fence.
300     return 0;
301 }
302 
release()303 int BufferHubBuffer::release() {
304     uint32_t currentBufferState = mBufferState->load(std::memory_order_acquire);
305     if (isClientReleased(currentBufferState, mClientStateMask)) {
306         ALOGV("%s: Buffer is already released by this client %" PRIx32 ".", __FUNCTION__,
307               mClientStateMask);
308         return 0;
309     }
310     uint32_t updatedBufferState = 0U;
311     do {
312         updatedBufferState = currentBufferState & (~mClientStateMask);
313     } while (!mBufferState->compare_exchange_weak(currentBufferState, updatedBufferState,
314                                                   std::memory_order_acq_rel,
315                                                   std::memory_order_acquire));
316     // TODO(b/119837586): Update fence state and return GPU fence if needed.
317     return 0;
318 }
319 
isReleased() const320 bool BufferHubBuffer::isReleased() const {
321     return (mBufferState->load(std::memory_order_acquire) &
322             mActiveClientsBitMask->load(std::memory_order_acquire)) == 0;
323 }
324 
isValid() const325 bool BufferHubBuffer::isValid() const {
326     return mBufferHandle.getNativeHandle() != nullptr && mId >= 0 && mClientStateMask != 0U &&
327             mEventFd.get() >= 0 && mMetadata.isValid() && mBufferClient != nullptr;
328 }
329 
duplicate()330 sp<NativeHandle> BufferHubBuffer::duplicate() {
331     if (mBufferClient == nullptr) {
332         ALOGE("%s: missing BufferClient!", __FUNCTION__);
333         return nullptr;
334     }
335 
336     hidl_handle token;
337     BufferHubStatus ret;
338     IBufferClient::duplicate_cb dupCb = [&](const auto& outToken, const auto& status) {
339         token = std::move(outToken);
340         ret = status;
341     };
342 
343     if (!mBufferClient->duplicate(dupCb).isOk()) {
344         ALOGE("%s: duplicate transaction failed!", __FUNCTION__);
345         return nullptr;
346     } else if (ret != BufferHubStatus::NO_ERROR) {
347         ALOGE("%s: duplicate failed with error %u.", __FUNCTION__, ret);
348         return nullptr;
349     } else if (token.getNativeHandle() == nullptr) {
350         ALOGE("%s: duplicate got null token.", __FUNCTION__);
351         return nullptr;
352     }
353 
354     return NativeHandle::create(native_handle_clone(token.getNativeHandle()), /*ownsHandle=*/true);
355 }
356 
357 } // namespace android
358