BufferQueue: plumbing mConsumerIsProtected

This replaces current logic in BufferQueue that uses
GRALLOC_USAGE_PROTECTED to indicate whether an ANativeWindow is capable
of handling hardware protected gralloc buffers. Current logic is
problematic as it enforces producer to use protected buffer no matter
whether producer side is capable of writing into a protected buffer.

This new solution, however, introduces a new NATIVE_WINDOW_* flag that
consumer can set on IGraphicBufferConsumer to indicate its capacity,
which can then be queried by producer via Surface::query (or
IGraphicBufferProducer::query).

When consumer is capable of reading protected buffer (e.g. a protected
GL context), the producer can generate either a protected or unprotected
buffer.

When consumer is not capable of reading protected buffer, the producer
should only generate unprotected buffer.

Bug: 35726763
Test: videoplayer-nodrm-protected.apk and videoplayer-drm-protected.apk
both works.

Change-Id: I1bf6814c9f1f81f9e04f0e89646b0733ff1a4758

8 files changed, 42 insertions, 0 deletions

diff --git a/include/gui/BufferQueueConsumer.h b/include/gui/BufferQueueConsumer.h
index 1e22d2823a..b383056c6e 100644
--- a/include/gui/BufferQueueConsumer.h
+++ b/include/gui/BufferQueueConsumer.h
@@ -129,6 +129,12 @@ public:
     // enumerated in gralloc.h, e.g. GRALLOC_USAGE_HW_RENDER; the default is 0.
     virtual status_t setConsumerUsageBits(uint32_t usage);
 
+    // setConsumerIsProtected will turn on an internal bit that indicates whether
+    // the consumer can handle protected gralloc buffers (i.e. with
+    // GRALLOC_USAGE_PROTECTED set). IGraphicBufferProducer can query this
+    // capability using NATIVE_WINDOW_CONSUMER_IS_PROTECTED.
+    virtual status_t setConsumerIsProtected(bool isProtected);
+
     // setTransformHint bakes in rotation to buffers so overlays can be used.
     // The values are enumerated in window.h, e.g.
     // NATIVE_WINDOW_TRANSFORM_ROT_90.  The default is 0 (no transform).
diff --git a/include/gui/BufferQueueCore.h b/include/gui/BufferQueueCore.h
index cfe716ff39..dd8b992ce1 100644
--- a/include/gui/BufferQueueCore.h
+++ b/include/gui/BufferQueueCore.h
@@ -172,6 +172,10 @@ private:
     // GraphicBuffers.
     uint32_t mConsumerUsageBits;
 
+    // mConsumerIsProtected indicates the consumer is ready to handle protected
+    // buffer.
+    bool mConsumerIsProtected;
+
     // mConnectedApi indicates the producer API that is currently connected
     // to this BufferQueue. It defaults to NO_CONNECTED_API, and gets updated
     // by the connect and disconnect methods.
diff --git a/include/gui/IGraphicBufferConsumer.h b/include/gui/IGraphicBufferConsumer.h
index 63254ed5b0..57cce16d10 100644
--- a/include/gui/IGraphicBufferConsumer.h
+++ b/include/gui/IGraphicBufferConsumer.h
@@ -243,6 +243,12 @@ public:
     // Return of a value other than NO_ERROR means an unknown error has occurred.
     virtual status_t setConsumerUsageBits(uint32_t usage) = 0;
 
+    // setConsumerIsProtected will turn on an internal bit that indicates whether
+    // the consumer can handle protected gralloc buffers (i.e. with
+    // GRALLOC_USAGE_PROTECTED set). IGraphicBufferProducer can query this
+    // capability using NATIVE_WINDOW_CONSUMER_IS_PROTECTED.
+    virtual status_t setConsumerIsProtected(bool isProtected) = 0;
+
     // setTransformHint bakes in rotation to buffers so overlays can be used. The values are
     // enumerated in window.h, e.g. NATIVE_WINDOW_TRANSFORM_ROT_90. The default is 0
     // (no transform).
diff --git a/libs/gui/BufferQueueConsumer.cpp b/libs/gui/BufferQueueConsumer.cpp
index cd8e696d8d..5e5de443f4 100644
--- a/libs/gui/BufferQueueConsumer.cpp
+++ b/libs/gui/BufferQueueConsumer.cpp
@@ -709,6 +709,14 @@ status_t BufferQueueConsumer::setConsumerUsageBits(uint32_t usage) {
     return NO_ERROR;
 }
 
+status_t BufferQueueConsumer::setConsumerIsProtected(bool isProtected) {
+    ATRACE_CALL();
+    BQ_LOGV("setConsumerIsProtected: %s", isProtected ? "true" : "false");
+    Mutex::Autolock lock(mCore->mMutex);
+    mCore->mConsumerIsProtected = isProtected;
+    return NO_ERROR;
+}
+
 status_t BufferQueueConsumer::setTransformHint(uint32_t hint) {
     ATRACE_CALL();
     BQ_LOGV("setTransformHint: %#x", hint);
diff --git a/libs/gui/BufferQueueCore.cpp b/libs/gui/BufferQueueCore.cpp
index cd9425335d..cfb25e0503 100644
--- a/libs/gui/BufferQueueCore.cpp
+++ b/libs/gui/BufferQueueCore.cpp
@@ -59,6 +59,7 @@ BufferQueueCore::BufferQueueCore() :
     mConsumerName(getUniqueName()),
     mConsumerListener(),
     mConsumerUsageBits(0),
+    mConsumerIsProtected(false),
     mConnectedApi(NO_CONNECTED_API),
     mLinkedToDeath(),
     mConnectedProducerListener(),
diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index cddb1fd71b..8159aefc08 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -1105,6 +1105,9 @@ int BufferQueueProducer::query(int what, int *outValue) {
                 value = static_cast<int32_t>(mCore->mBufferAge);
             }
             break;
+        case NATIVE_WINDOW_CONSUMER_IS_PROTECTED:
+            value = static_cast<int32_t>(mCore->mConsumerIsProtected);
+            break;
         default:
             return BAD_VALUE;
     }
diff --git a/libs/gui/IGraphicBufferConsumer.cpp b/libs/gui/IGraphicBufferConsumer.cpp
index 568c318f0e..a573bee651 100644
--- a/libs/gui/IGraphicBufferConsumer.cpp
+++ b/libs/gui/IGraphicBufferConsumer.cpp
@@ -46,6 +46,7 @@ enum class Tag : uint32_t {
     SET_DEFAULT_BUFFER_FORMAT,
     SET_DEFAULT_BUFFER_DATA_SPACE,
     SET_CONSUMER_USAGE_BITS,
+    SET_CONSUMER_IS_PROTECTED,
     SET_TRANSFORM_HINT,
     GET_SIDEBAND_STREAM,
     GET_OCCUPANCY_HISTORY,
@@ -136,6 +137,11 @@ public:
         return callRemote<Signature>(Tag::SET_CONSUMER_USAGE_BITS, usage);
     }
 
+    status_t setConsumerIsProtected(bool isProtected) override {
+        using Signature = decltype(&IGraphicBufferConsumer::setConsumerIsProtected);
+        return callRemote<Signature>(Tag::SET_CONSUMER_IS_PROTECTED, isProtected);
+    }
+
     status_t setTransformHint(uint32_t hint) override {
         using Signature = decltype(&IGraphicBufferConsumer::setTransformHint);
         return callRemote<Signature>(Tag::SET_TRANSFORM_HINT, hint);
@@ -204,6 +210,8 @@ status_t BnGraphicBufferConsumer::onTransact(uint32_t code, const Parcel& data,
             return callLocal(data, reply, &IGraphicBufferConsumer::setDefaultBufferDataSpace);
         case Tag::SET_CONSUMER_USAGE_BITS:
             return callLocal(data, reply, &IGraphicBufferConsumer::setConsumerUsageBits);
+        case Tag::SET_CONSUMER_IS_PROTECTED:
+            return callLocal(data, reply, &IGraphicBufferConsumer::setConsumerIsProtected);
         case Tag::SET_TRANSFORM_HINT:
             return callLocal(data, reply, &IGraphicBufferConsumer::setTransformHint);
         case Tag::GET_SIDEBAND_STREAM:
diff --git a/libs/nativewindow/include/system/window.h b/libs/nativewindow/include/system/window.h
index fb67a5169c..45110c490b 100644
--- a/libs/nativewindow/include/system/window.h
+++ b/libs/nativewindow/include/system/window.h
@@ -192,6 +192,12 @@ enum {
      * present info, 0 if it won't.
      */
     NATIVE_WINDOW_FRAME_TIMESTAMPS_SUPPORTS_PRESENT = 18,
+
+    /*
+     * The consumer end is capable of handling protected buffers, i.e. buffer
+     * with GRALLOC_USAGE_PROTECTED usage bits on.
+     */
+    NATIVE_WINDOW_CONSUMER_IS_PROTECTED = 19,
 };
 
 /* Valid operations for the (*perform)() hook.