Migrate IDisplayEventConnection interface to AIDL
This addresses security vulnerabilities due to hard coded binder
interface.
Bug: 195660647
Test: atest services/surfaceflinger/tests/unittests/SchedulerTest.cpp
Change-Id: I948e97e37056286d54623ca6232580187b138e62
diff --git a/services/surfaceflinger/Scheduler/EventThread.cpp b/services/surfaceflinger/Scheduler/EventThread.cpp
index 455289f..627c49a 100644
--- a/services/surfaceflinger/Scheduler/EventThread.cpp
+++ b/services/surfaceflinger/Scheduler/EventThread.cpp
@@ -170,20 +170,21 @@
mEventThread->registerDisplayEventConnection(this);
}
-status_t EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) {
+binder::Status EventThreadConnection::stealReceiveChannel(gui::BitTube* outChannel) {
outChannel->setReceiveFd(mChannel.moveReceiveFd());
outChannel->setSendFd(base::unique_fd(dup(mChannel.getSendFd())));
- return NO_ERROR;
+ return binder::Status::ok();
}
-status_t EventThreadConnection::setVsyncRate(uint32_t rate) {
- mEventThread->setVsyncRate(rate, this);
- return NO_ERROR;
+binder::Status EventThreadConnection::setVsyncRate(int rate) {
+ mEventThread->setVsyncRate(static_cast<uint32_t>(rate), this);
+ return binder::Status::ok();
}
-void EventThreadConnection::requestNextVsync() {
+binder::Status EventThreadConnection::requestNextVsync() {
ATRACE_NAME("requestNextVsync");
mEventThread->requestNextVsync(this);
+ return binder::Status::ok();
}
status_t EventThreadConnection::postEvent(const DisplayEventReceiver::Event& event) {
diff --git a/services/surfaceflinger/Scheduler/EventThread.h b/services/surfaceflinger/Scheduler/EventThread.h
index de43570..fa9af09 100644
--- a/services/surfaceflinger/Scheduler/EventThread.h
+++ b/services/surfaceflinger/Scheduler/EventThread.h
@@ -17,8 +17,8 @@
#pragma once
#include <android-base/thread_annotations.h>
+#include <android/gui/BnDisplayEventConnection.h>
#include <gui/DisplayEventReceiver.h>
-#include <gui/IDisplayEventConnection.h>
#include <private/gui/BitTube.h>
#include <sys/types.h>
#include <utils/Errors.h>
@@ -80,7 +80,7 @@
virtual void dump(std::string& result) const = 0;
};
-class EventThreadConnection : public BnDisplayEventConnection {
+class EventThreadConnection : public gui::BnDisplayEventConnection {
public:
EventThreadConnection(EventThread*, uid_t callingUid, ResyncCallback,
ISurfaceComposer::EventRegistrationFlags eventRegistration = {});
@@ -88,9 +88,9 @@
virtual status_t postEvent(const DisplayEventReceiver::Event& event);
- status_t stealReceiveChannel(gui::BitTube* outChannel) override;
- status_t setVsyncRate(uint32_t rate) override;
- void requestNextVsync() override; // asynchronous
+ binder::Status stealReceiveChannel(gui::BitTube* outChannel) override;
+ binder::Status setVsyncRate(int rate) override;
+ binder::Status requestNextVsync() override; // asynchronous
// Called in response to requestNextVsync.
const ResyncCallback resyncCallback;
diff --git a/services/surfaceflinger/Scheduler/MessageQueue.h b/services/surfaceflinger/Scheduler/MessageQueue.h
index dd69d60..9532e26 100644
--- a/services/surfaceflinger/Scheduler/MessageQueue.h
+++ b/services/surfaceflinger/Scheduler/MessageQueue.h
@@ -22,7 +22,7 @@
#include <utility>
#include <android-base/thread_annotations.h>
-#include <gui/IDisplayEventConnection.h>
+#include <android/gui/IDisplayEventConnection.h>
#include <private/gui/BitTube.h>
#include <utils/Looper.h>
#include <utils/Timers.h>
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 14761ea..08d8527 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -26,6 +26,7 @@
#include <android-base/properties.h>
#include <android/configuration.h>
+#include <android/gui/IDisplayEventConnection.h>
#include <android/hardware/configstore/1.0/ISurfaceFlingerConfigs.h>
#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
#include <android/hardware/configstore/1.1/types.h>
@@ -51,7 +52,6 @@
#include <ftl/future.h>
#include <gui/BufferQueue.h>
#include <gui/DebugEGLImageTracker.h>
-#include <gui/IDisplayEventConnection.h>
#include <gui/IProducerListener.h>
#include <gui/LayerDebugInfo.h>
#include <gui/LayerMetadata.h>
@@ -169,6 +169,7 @@
using android::hardware::power::Boost;
using base::StringAppendF;
using gui::DisplayInfo;
+using gui::IDisplayEventConnection;
using gui::IWindowInfosListener;
using gui::WindowInfo;
using ui::ColorMode;
diff --git a/services/surfaceflinger/tests/unittests/SchedulerTest.cpp b/services/surfaceflinger/tests/unittests/SchedulerTest.cpp
index a6fd378..f48abb7 100644
--- a/services/surfaceflinger/tests/unittests/SchedulerTest.cpp
+++ b/services/surfaceflinger/tests/unittests/SchedulerTest.cpp
@@ -48,9 +48,9 @@
: EventThreadConnection(eventThread, /*callingUid=*/0, ResyncCallback()) {}
~MockEventThreadConnection() = default;
- MOCK_METHOD1(stealReceiveChannel, status_t(gui::BitTube* outChannel));
- MOCK_METHOD1(setVsyncRate, status_t(uint32_t count));
- MOCK_METHOD0(requestNextVsync, void());
+ MOCK_METHOD1(stealReceiveChannel, binder::Status(gui::BitTube* outChannel));
+ MOCK_METHOD1(setVsyncRate, binder::Status(int count));
+ MOCK_METHOD0(requestNextVsync, binder::Status());
};
SchedulerTest();