1 /* 2 * Copyright (C) 2007 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 // tag as surfaceflinger 18 #define LOG_TAG "SurfaceFlinger" 19 20 #include <stdio.h> 21 #include <stdint.h> 22 #include <sys/types.h> 23 24 #include <binder/Parcel.h> 25 #include <binder/IMemory.h> 26 #include <binder/IPCThreadState.h> 27 #include <binder/IServiceManager.h> 28 29 #include <ui/Point.h> 30 #include <ui/Rect.h> 31 32 #include <surfaceflinger/ISurface.h> 33 #include <surfaceflinger/ISurfaceComposerClient.h> 34 #include <private/surfaceflinger/LayerState.h> 35 36 // --------------------------------------------------------------------------- 37 38 /* ideally AID_GRAPHICS would be in a semi-public header 39 * or there would be a way to map a user/group name to its id 40 */ 41 #ifndef AID_GRAPHICS 42 #define AID_GRAPHICS 1003 43 #endif 44 45 #define LIKELY( exp ) (__builtin_expect( (exp) != 0, true )) 46 #define UNLIKELY( exp ) (__builtin_expect( (exp) != 0, false )) 47 48 // --------------------------------------------------------------------------- 49 50 namespace android { 51 52 enum { 53 GET_CBLK = IBinder::FIRST_CALL_TRANSACTION, 54 GET_TOKEN, 55 CREATE_SURFACE, 56 DESTROY_SURFACE, 57 SET_STATE 58 }; 59 60 class BpSurfaceComposerClient : public BpInterface<ISurfaceComposerClient> 61 { 62 public: 63 BpSurfaceComposerClient(const sp<IBinder>& impl) 64 : BpInterface<ISurfaceComposerClient>(impl) 65 { 66 } 67 68 virtual sp<IMemoryHeap> getControlBlock() const 69 { 70 Parcel data, reply; 71 data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor()); 72 remote()->transact(GET_CBLK, data, &reply); 73 return interface_cast<IMemoryHeap>(reply.readStrongBinder()); 74 } 75 76 virtual ssize_t getTokenForSurface(const sp<ISurface>& sur) const 77 { 78 Parcel data, reply; 79 data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor()); 80 data.writeStrongBinder(sur->asBinder()); 81 remote()->transact(GET_TOKEN, data, &reply); 82 return reply.readInt32(); 83 } 84 85 virtual sp<ISurface> createSurface( surface_data_t* params, 86 int pid, 87 const String8& name, 88 DisplayID display, 89 uint32_t w, 90 uint32_t h, 91 PixelFormat format, 92 uint32_t flags) 93 { 94 Parcel data, reply; 95 data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor()); 96 data.writeInt32(pid); 97 data.writeString8(name); 98 data.writeInt32(display); 99 data.writeInt32(w); 100 data.writeInt32(h); 101 data.writeInt32(format); 102 data.writeInt32(flags); 103 remote()->transact(CREATE_SURFACE, data, &reply); 104 params->readFromParcel(reply); 105 return interface_cast<ISurface>(reply.readStrongBinder()); 106 } 107 108 virtual status_t destroySurface(SurfaceID sid) 109 { 110 Parcel data, reply; 111 data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor()); 112 data.writeInt32(sid); 113 remote()->transact(DESTROY_SURFACE, data, &reply); 114 return reply.readInt32(); 115 } 116 117 virtual status_t setState(int32_t count, const layer_state_t* states) 118 { 119 Parcel data, reply; 120 data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor()); 121 data.writeInt32(count); 122 for (int i=0 ; i<count ; i++) 123 states[i].write(data); 124 remote()->transact(SET_STATE, data, &reply); 125 return reply.readInt32(); 126 } 127 }; 128 129 IMPLEMENT_META_INTERFACE(SurfaceComposerClient, "android.ui.ISurfaceComposerClient"); 130 131 // ---------------------------------------------------------------------- 132 133 status_t BnSurfaceComposerClient::onTransact( 134 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) 135 { 136 // codes that don't require permission check 137 138 switch(code) { 139 case GET_CBLK: { 140 CHECK_INTERFACE(ISurfaceComposerClient, data, reply); 141 sp<IMemoryHeap> ctl(getControlBlock()); 142 reply->writeStrongBinder(ctl->asBinder()); 143 return NO_ERROR; 144 } break; 145 case GET_TOKEN: { 146 CHECK_INTERFACE(ISurfaceComposerClient, data, reply); 147 sp<ISurface> sur = interface_cast<ISurface>(data.readStrongBinder()); 148 ssize_t token = getTokenForSurface(sur); 149 reply->writeInt32(token); 150 return NO_ERROR; 151 } break; 152 } 153 154 // these must be checked 155 156 IPCThreadState* ipc = IPCThreadState::self(); 157 const int pid = ipc->getCallingPid(); 158 const int uid = ipc->getCallingUid(); 159 const int self_pid = getpid(); 160 if (UNLIKELY(pid != self_pid && uid != AID_GRAPHICS)) { 161 // we're called from a different process, do the real check 162 if (!checkCallingPermission( 163 String16("android.permission.ACCESS_SURFACE_FLINGER"))) 164 { 165 LOGE("Permission Denial: " 166 "can't openGlobalTransaction pid=%d, uid=%d", pid, uid); 167 return PERMISSION_DENIED; 168 } 169 } 170 171 switch(code) { 172 case CREATE_SURFACE: { 173 CHECK_INTERFACE(ISurfaceComposerClient, data, reply); 174 surface_data_t params; 175 int32_t pid = data.readInt32(); 176 String8 name = data.readString8(); 177 DisplayID display = data.readInt32(); 178 uint32_t w = data.readInt32(); 179 uint32_t h = data.readInt32(); 180 PixelFormat format = data.readInt32(); 181 uint32_t flags = data.readInt32(); 182 sp<ISurface> s = createSurface(¶ms, pid, name, display, w, h, 183 format, flags); 184 params.writeToParcel(reply); 185 reply->writeStrongBinder(s->asBinder()); 186 return NO_ERROR; 187 } break; 188 case DESTROY_SURFACE: { 189 CHECK_INTERFACE(ISurfaceComposerClient, data, reply); 190 reply->writeInt32( destroySurface( data.readInt32() ) ); 191 return NO_ERROR; 192 } break; 193 case SET_STATE: { 194 CHECK_INTERFACE(ISurfaceComposerClient, data, reply); 195 int32_t count = data.readInt32(); 196 layer_state_t* states = new layer_state_t[count]; 197 for (int i=0 ; i<count ; i++) 198 states[i].read(data); 199 status_t err = setState(count, states); 200 delete [] states; 201 reply->writeInt32(err); 202 return NO_ERROR; 203 } break; 204 default: 205 return BBinder::onTransact(code, data, reply, flags); 206 } 207 } 208 209 // ---------------------------------------------------------------------- 210 211 status_t ISurfaceComposerClient::surface_data_t::readFromParcel(const Parcel& parcel) 212 { 213 token = parcel.readInt32(); 214 identity = parcel.readInt32(); 215 width = parcel.readInt32(); 216 height = parcel.readInt32(); 217 format = parcel.readInt32(); 218 return NO_ERROR; 219 } 220 221 status_t ISurfaceComposerClient::surface_data_t::writeToParcel(Parcel* parcel) const 222 { 223 parcel->writeInt32(token); 224 parcel->writeInt32(identity); 225 parcel->writeInt32(width); 226 parcel->writeInt32(height); 227 parcel->writeInt32(format); 228 return NO_ERROR; 229 } 230 231 }; // namespace android 232
