Merge "Add android.intent.action.REMOTE_COPY to allowlist to fix CTS failure" into stage-aosp-tm-ts-dev am: acbe431cea

Original change: https://googleplex-android-review.googlesource.com/c/platform/cts/+/19194228

Change-Id: Iebd3a53e5144bf4859a4b2af9b6bad41f08abef2
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/apps/CameraITS/tests/scene4/test_preview_stabilization_fov.py b/apps/CameraITS/tests/scene4/test_preview_stabilization_fov.py
index 3959b42..1f5b7c0 100644
--- a/apps/CameraITS/tests/scene4/test_preview_stabilization_fov.py
+++ b/apps/CameraITS/tests/scene4/test_preview_stabilization_fov.py
@@ -35,7 +35,7 @@
 _ROUNDESS_DELTA_THRESHOLD = 0.05
 
 _MAX_CENTER_THRESHOLD_PERCENT = 0.075
-_MAX_DIMENSION_SIZE = (1920, 1080)  # max preview size in Android
+_MAX_DIMENSION_SIZE = (1920, 1440)  # max mandatory preview stream resolution
 _MIN_CENTER_THRESHOLD_PERCENT = 0.02
 _MIN_DIMENSION_SIZE = (176, 144)  # assume QCIF to be min preview size
 
@@ -90,7 +90,7 @@
                 calculated. ex. (1920, 1080)
 
   Returns:
-    threshold value in pixels be which the circle centers can differ
+    threshold value ratio between which the circle centers can differ
   """
 
   max_diagonal = _point_distance(0, 0,
@@ -103,14 +103,17 @@
   normalized_diagonal = ((img_diagonal - min_diagonal) /
                          (max_diagonal - min_diagonal))
 
+  if normalized_diagonal > 1 or normalized_diagonal < 0:
+    raise AssertionError(f'normalized diagonal > 1 or < 0!'
+                         f' img_diag: {img_diagonal}, '
+                         f' normalized_diagonal: {normalized_diagonal}')
+
   # Threshold should be larger for images with smaller resolution
   normalized_threshold_percent = ((1 - normalized_diagonal) *
                                   (_MAX_CENTER_THRESHOLD_PERCENT -
                                    _MIN_CENTER_THRESHOLD_PERCENT))
 
-  return ((normalized_threshold_percent + _MIN_CENTER_THRESHOLD_PERCENT)
-          * img_diagonal)
-
+  return (normalized_threshold_percent + _MIN_CENTER_THRESHOLD_PERCENT)
 
 class PreviewStabilizationFoVTest(its_base_test.ItsBaseTest):
   """Tests if stabilized preview FoV is within spec.
diff --git a/hostsidetests/appcompat/strictjavapackages/src/android/compat/sjp/cts/StrictJavaPackagesTest.java b/hostsidetests/appcompat/strictjavapackages/src/android/compat/sjp/cts/StrictJavaPackagesTest.java
index e5916f7..6821c4f 100644
--- a/hostsidetests/appcompat/strictjavapackages/src/android/compat/sjp/cts/StrictJavaPackagesTest.java
+++ b/hostsidetests/appcompat/strictjavapackages/src/android/compat/sjp/cts/StrictJavaPackagesTest.java
@@ -728,6 +728,8 @@
                 BLUETOOTH_APK_IN_APEX_BURNDOWN_LIST)
             .put("/apex/com.android.btservices/app/BluetoothGoogle/BluetoothGoogle.apk",
                 BLUETOOTH_APK_IN_APEX_BURNDOWN_LIST)
+            .put("/apex/com.android.bluetooth/app/BluetoothGoogle/BluetoothGoogle.apk",
+                BLUETOOTH_APK_IN_APEX_BURNDOWN_LIST)
             .put("/apex/com.android.permission/priv-app/PermissionController/PermissionController.apk",
                 PERMISSION_CONTROLLER_APK_IN_APEX_BURNDOWN_LIST)
             .put("/apex/com.android.permission/priv-app/GooglePermissionController/GooglePermissionController.apk",
diff --git a/hostsidetests/media/bitstreams/AndroidTest.xml b/hostsidetests/media/bitstreams/AndroidTest.xml
index 070b44d..c07fa07 100644
--- a/hostsidetests/media/bitstreams/AndroidTest.xml
+++ b/hostsidetests/media/bitstreams/AndroidTest.xml
@@ -25,6 +25,11 @@
         <option name="dynamic-config-name" value="cts-dynamic-config" />
         <option name="version" value="9.0_r1"/>
     </target_preparer>
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.DynamicConfigPusher">
+        <option name="target" value="device" />
+        <option name="config-filename" value="CtsMediaBitstreamsTestCases" />
+        <option name="version" value="9.0_r1"/>
+    </target_preparer>
     <target_preparer class="com.android.compatibility.common.tradefed.targetprep.MediaPreparer">
         <option name="media-download-only" value="true" />
     </target_preparer>
@@ -32,11 +37,6 @@
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="CtsMediaBitstreamsDeviceSideTestApp.apk" />
     </target_preparer>
-    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.DynamicConfigPusher">
-        <option name="target" value="device" />
-        <option name="config-filename" value="CtsMediaBitstreamsTestCases" />
-        <option name="version" value="9.0_r1"/>
-    </target_preparer>
     <target_preparer class="com.android.compatibility.common.tradefed.targetprep.ReportLogCollector">
         <option name="src-dir" value="/sdcard/report-log-files/"/>
         <option name="dest-dir" value="report-log-files/"/>
diff --git a/hostsidetests/securitybulletin/Android.bp b/hostsidetests/securitybulletin/Android.bp
index 323d5b7..30b6161 100644
--- a/hostsidetests/securitybulletin/Android.bp
+++ b/hostsidetests/securitybulletin/Android.bp
@@ -23,7 +23,6 @@
     java_resource_dirs: ["res"],
     // tag this module as a cts test artifact
     test_suites: [
-        "cts",
         "general-tests",
         "sts",
     ],
@@ -60,7 +59,6 @@
         },
     },
     test_suites: [
-        "cts",
         "sts",
         "general-tests",
     ],
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0954.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0954.java
index 5532e46..12287b0 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0954.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0954.java
@@ -21,7 +21,7 @@
 
 import com.android.tradefed.device.ITestDevice;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
 
 import org.junit.Assert;
 import org.junit.Before;
@@ -29,7 +29,7 @@
 import org.junit.runner.RunWith;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_0954 extends BaseHostJUnit4Test {
+public class CVE_2021_0954 extends StsExtraBusinessLogicHostTestBase {
     private static final String TEST_PKG = "android.security.cts.cve_2021_0954";
     private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
     private static final String TEST_APP = "CVE-2021-0954.apk";
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20348.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20348.java
new file mode 100644
index 0000000..0f66dfd
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20348.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assume.assumeNoException;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2022_20348 extends StsExtraBusinessLogicHostTestBase {
+    static final String TEST_PKG = "android.security.cts.CVE_2022_20348";
+    public static final String TEST_DEVICE_ADMIN_RECEIVER = ".PocDeviceAdminReceiver";
+
+    @AsbSecurityTest(cveBugId = 228315529)
+    @Test
+    public void testPocCVE_2022_20348() throws Exception {
+        try {
+            ITestDevice device = getDevice();
+
+            /* Wake up the screen */
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+
+            /* Install the test application */
+            installPackage("CVE-2022-20348.apk");
+
+            /* Set Device Admin Component */
+            AdbUtils.runCommandLine(
+                    "dpm set-device-owner '" + TEST_PKG + "/" + TEST_DEVICE_ADMIN_RECEIVER + "'",
+                    device);
+
+            /* Run the test "testWifiScanningDisallowed" */
+            runDeviceTests(TEST_PKG, TEST_PKG + ".DeviceTest", "testWifiScanningDisallowed");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/Android.bp
index d3e2302..2f87b9c 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/Android.bp
@@ -30,10 +30,10 @@
     test_suites: [
         "sts",
     ],
-    sdk_version: "current",
     static_libs: [
         "androidx.test.core",
         "androidx.test.rules",
         "androidx.test.uiautomator_uiautomator",
     ],
+    platform_apis: true,
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/AndroidManifest.xml
index f097825..74e263c 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/AndroidManifest.xml
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/AndroidManifest.xml
@@ -22,12 +22,8 @@
     <uses-permission android:name="android.permission.BLUETOOTH"/>
     <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"/>
     <uses-permission android:name="android.permission.BLUETOOTH_SCAN"/>
-    <application
-        android:testOnly="true"
-        android:label="CVE-2021-39626"
-        android:supportsRtl="true">
-        <activity
-            android:name=".PocActivity"
+    <application>
+        <activity android:name=".PocActivity"
             android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
@@ -35,7 +31,6 @@
             </intent-filter>
         </activity>
     </application>
-
     <instrumentation
         android:name="androidx.test.runner.AndroidJUnitRunner"
         android:targetPackage="android.security.cts.CVE_2021_39626" />
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/integers.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/integers.xml
new file mode 100644
index 0000000..d5ae744
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/integers.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <integer name="assumptionFailure">-1</integer>
+    <integer name="pass">0</integer>
+    <integer name="enabled">1</integer>
+    <integer name="disabled">2</integer>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/strings.xml
new file mode 100644
index 0000000..e6f53e7
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/res/values/strings.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <string name="allowButtonResName">android:id/button1</string>
+    <string name="btAction">btAction</string>
+    <string name="className">.Settings$ConnectedDeviceDashboardActivity</string>
+    <string name="defaultSemaphoreMsg">Could not get message key in shared preferences</string>
+    <string name="defaultSettingsPkg">com.android.settings</string>
+    <string name="failMessage">Vulnerable to b/194695497 !!</string>
+    <string name="messageKey">message</string>
+    <string name="resultKey">result</string>
+    <string name="sharedPreferences">CVE_2021_39626_prefs</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java
index cd24540..6bb8d16 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/DeviceTest.java
@@ -18,14 +18,15 @@
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assume.assumeNoException;
-import static org.junit.Assume.assumeNotNull;
 import static org.junit.Assume.assumeTrue;
 
 import android.bluetooth.BluetoothAdapter;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
-import android.content.pm.PackageManager;
+import android.content.SharedPreferences;
+import android.content.SharedPreferences.OnSharedPreferenceChangeListener;
+import android.content.res.Resources;
 import android.provider.Settings;
 
 import androidx.test.InstrumentationRegistry;
@@ -34,69 +35,121 @@
 import androidx.test.uiautomator.UiDevice;
 import androidx.test.uiautomator.Until;
 
+import org.junit.After;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+
 @RunWith(AndroidJUnit4.class)
 public class DeviceTest {
-    private static final int TIMEOUT = 5000;
-    private static Context context;
+    static final int TIMEOUT = 10000;
+    boolean mBtState = false;
+    BluetoothAdapter mBtAdapter;
+    Context mContext;
+    OnSharedPreferenceChangeListener mListener;
+    Resources mResources;
+    SharedPreferences mSharedPrefs;
+    Semaphore mPreferenceChanged;
+    UiDevice mDevice;
 
-    private static String getSettingsPkgName() {
+    private String getSettingsPkgName() {
         Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
         ComponentName settingsComponent =
-                settingsIntent.resolveActivity(context.getPackageManager());
+                settingsIntent.resolveActivity(mContext.getPackageManager());
         String pkgName = settingsComponent != null ? settingsComponent.getPackageName()
-                : "com.android.settings";
-        assumeNotNull(pkgName);
+                : mContext.getString(R.string.defaultSettingsPkg);
         return pkgName;
     }
 
-    private void openApplication(String applicationName) {
-        Intent intent = context.getPackageManager().getLaunchIntentForPackage(applicationName);
-        assumeNotNull(intent);
-        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+    @After
+    public void tearDown() {
         try {
-            context.startActivity(intent);
+            // Disable bluetooth if it was OFF before the test
+            if (!mBtState) {
+                Intent intent = new Intent(mContext, PocActivity.class);
+                intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                intent.putExtra(mContext.getString(R.string.btAction),
+                        BluetoothAdapter.ACTION_REQUEST_DISABLE);
+                mContext.startActivity(intent);
+            }
+            mPreferenceChanged = new Semaphore(0);
+            mPreferenceChanged.tryAcquire(TIMEOUT, TimeUnit.MILLISECONDS);
+            int result = mSharedPrefs.getInt(mResources.getString(R.string.resultKey),
+                    mResources.getInteger(R.integer.assumptionFailure));
+            String message = mSharedPrefs.getString(mResources.getString(R.string.messageKey),
+                    mResources.getString(R.string.defaultSemaphoreMsg));
+
+            // Go to home screen
+            mDevice.pressHome();
         } catch (Exception e) {
-            assumeNoException(e);
+            // ignore the exception
         }
     }
 
     @Test
     public void testBtDiscoverable() {
-        // Initialize UiDevice instance
-        UiDevice device = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
-        context = InstrumentationRegistry.getInstrumentation().getContext();
-        BluetoothAdapter btAdapter = BluetoothAdapter.getDefaultAdapter();
-        assumeNotNull(btAdapter);
+        try {
+            // Initialize UiDevice instance
+            mDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            mContext = InstrumentationRegistry.getInstrumentation().getContext();
+            mBtAdapter = BluetoothAdapter.getDefaultAdapter();
 
-        // Save the state of bluetooth adapter to reset after the test
-        boolean btState = btAdapter.isEnabled();
-        if (!btState) {
-            // If bluetooth is disabled, enable it and wait for adapter startup to complete
-            assumeTrue(btAdapter.enable());
-            try {
-                Thread.sleep(TIMEOUT);
-            } catch (Exception e) {
-                assumeNoException(e);
-            }
+            // Save the state of bluetooth adapter to reset after the test
+            mBtState = mBtAdapter.isEnabled();
+
+            // If bluetooth is disabled, enable it and wait for start activity to complete
+            Intent intent = new Intent(mContext, PocActivity.class);
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            intent.putExtra(mContext.getString(R.string.btAction),
+                    BluetoothAdapter.ACTION_REQUEST_ENABLE);
+            mContext.startActivity(intent);
+            mResources = mContext.getResources();
+
+            mSharedPrefs = mContext.getSharedPreferences(
+                    mResources.getString(R.string.sharedPreferences), Context.MODE_APPEND);
+            mPreferenceChanged = new Semaphore(0);
+            mListener = new OnSharedPreferenceChangeListener() {
+                @Override
+                public void onSharedPreferenceChanged(SharedPreferences sharedPreferences,
+                        String key) {
+                    if (key.equals(mResources.getString(R.string.resultKey))) {
+                        mPreferenceChanged.release();
+                    }
+                }
+            };
+            mSharedPrefs.registerOnSharedPreferenceChangeListener(mListener);
+            mPreferenceChanged.tryAcquire(TIMEOUT, TimeUnit.MILLISECONDS);
+
+            int result = mSharedPrefs.getInt(mResources.getString(R.string.resultKey),
+                    mResources.getInteger(R.integer.assumptionFailure));
+            String message = mSharedPrefs.getString(mResources.getString(R.string.messageKey),
+                    mResources.getString(R.string.defaultSemaphoreMsg));
+            assumeTrue(message, result != mResources.getInteger(R.integer.assumptionFailure));
+
+            // Checking if bluetooth is enabled. The test requires bluetooth to be enabled,
+            // assumption failing the test if it's not enabled
+            assumeTrue(mBtAdapter.isEnabled());
+
+            // Launch bluetooth settings which is supposed to set scan mode to
+            // SCAN_MODE_CONNECTABLE_DISCOVERABLE if vulnerability is active
+            intent = new Intent();
+            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            String settingsPkg = getSettingsPkgName();
+            intent.setClassName(settingsPkg, settingsPkg + mContext.getString(R.string.className));
+            mContext.startActivity(intent);
+
+            assumeTrue(mDevice.wait(Until.hasObject(By.pkg(settingsPkg)), TIMEOUT));
+
+            boolean isBtDiscoverable = false;
+            isBtDiscoverable =
+                    (mBtAdapter.getScanMode() == mBtAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);
+
+            // The test fails if bluetooth is made discoverable through PoC
+            assertFalse(mContext.getString(R.string.failMessage), isBtDiscoverable);
+        } catch (Exception e) {
+            assumeNoException(e);
         }
-        assumeTrue(btAdapter.isEnabled());
-
-        // Launch the PoC application and ensure that it launches bluetooth settings
-        openApplication(context.getPackageName());
-        assumeTrue(device.wait(Until.hasObject(By.pkg(getSettingsPkgName())), TIMEOUT));
-
-        boolean isBtDiscoverable =
-                (btAdapter.getScanMode() == btAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);
-
-        // Disable bluetooth if it was OFF before the test
-        if (!btState) {
-            btAdapter.disable();
-        }
-
-        // The test fails if bluetooth is made discoverable through PoC
-        assertFalse("Vulnerable to b/194695497 !!", isBtDiscoverable);
     }
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/PocActivity.java
index d4425ff..9a43cd1 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/PocActivity.java
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-39626/src/android/security/cts/CVE_2021_39626/PocActivity.java
@@ -16,24 +16,88 @@
 
 package android.security.cts.CVE_2021_39626;
 
-import static org.junit.Assume.assumeNoException;
-
 import android.app.Activity;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothManager;
+import android.content.Context;
 import android.content.Intent;
+import android.content.SharedPreferences;
 import android.os.Bundle;
-import android.provider.Settings;
+
+import androidx.annotation.IntegerRes;
+import androidx.test.InstrumentationRegistry;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
 
 public class PocActivity extends Activity {
+    private static final int TIMEOUT = 5000;
+    private static final int REQUEST_ENABLE_BT = 1;
+    private static final int REQUEST_DISABLE_BT = 2;
+
+    int getInteger(@IntegerRes int resId) {
+        return getResources().getInteger(resId);
+    }
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        Intent intent = new Intent();
-        intent.setAction(Settings.ACTION_BLUETOOTH_SETTINGS);
         try {
-            startActivity(intent);
+            String action = getIntent().getStringExtra(getString(R.string.btAction));
+            UiDevice device = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            BluetoothManager bluetoothManager = getSystemService(BluetoothManager.class);
+            BluetoothAdapter bluetoothAdapter = bluetoothManager.getAdapter();
+            int code = REQUEST_ENABLE_BT;
+            if (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)) {
+                code = REQUEST_DISABLE_BT;
+            }
+
+            if ((action.equals(BluetoothAdapter.ACTION_REQUEST_ENABLE)
+                    && !bluetoothAdapter.isEnabled())
+                    || (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)
+                            && bluetoothAdapter.isEnabled())) {
+                Intent enableBtIntent = new Intent(action);
+                startActivityForResult(enableBtIntent, code);
+
+                // Wait for the activity to appear and the allow button
+                device.wait(Until.hasObject(By.res(getString(R.string.allowButtonResName))),
+                        TIMEOUT);
+
+                // Click on the allow button
+                UiObject2 object =
+                        device.findObject(By.res(getString(R.string.allowButtonResName)));
+                object.click();
+            } else {
+                sendTestResult(getInteger(R.integer.pass), "");
+                finish();
+                return;
+            }
         } catch (Exception e) {
-            assumeNoException(e);
+            sendTestResult(getInteger(R.integer.assumptionFailure), e.getMessage());
+            return;
+        }
+    }
+
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        if (requestCode == REQUEST_ENABLE_BT && resultCode == Activity.RESULT_OK) {
+            finish();
+            sendTestResult(getInteger(R.integer.enabled), "");
+        } else if (requestCode == REQUEST_DISABLE_BT && resultCode == Activity.RESULT_OK) {
+            finish();
+            sendTestResult(getInteger(R.integer.disabled), "");
+        }
+    }
+
+    private void sendTestResult(int result, String message) {
+        SharedPreferences sh =
+                getSharedPreferences(getString(R.string.sharedPreferences), Context.MODE_PRIVATE);
+        if (sh != null) {
+            SharedPreferences.Editor edit = sh.edit();
+            edit.putInt(getString(R.string.resultKey), result);
+            edit.putString(getString(R.string.messageKey), message);
+            edit.commit();
         }
     }
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/Android.bp
new file mode 100644
index 0000000..b07e9f2
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/Android.bp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2022-20348",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/AndroidManifest.xml
new file mode 100644
index 0000000..ec6a775
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2022_20348"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application>
+        <receiver android:name=".PocDeviceAdminReceiver"
+            android:permission="android.permission.BIND_DEVICE_ADMIN"
+            android:exported="true">
+            <meta-data android:name="android.app.device_admin"
+                android:resource="@xml/device_policies" />
+            <intent-filter>
+                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
+            </intent-filter>
+        </receiver>
+    </application>
+
+   <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2022_20348" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/values/strings.xml
new file mode 100644
index 0000000..e79968d
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/values/strings.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<resources>
+    <string name="wifiScanningPattern">.*wi.fi scanning.*</string>
+    <string name="wifiScanningTimedOut">Timed out waiting on the text \'Wi-fi scanning\' to appear
+    </string>
+    <string name="failMsg">Device is vulnerable to b/228315529 !!</string>
+    <string name="locationIntentAction">android.settings.LOCATION_SCANNING_SETTINGS</string>
+    <string name="resWifiScanning">android:id/title</string>
+    <string name="setUserRestrictionFailed">Failed to set user restriction
+    UserManager.DISALLOW_CONFIG_LOCATION</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/xml/device_policies.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/xml/device_policies.xml
new file mode 100644
index 0000000..65ce601
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/res/xml/device_policies.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<device-admin xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-policies>
+    </uses-policies>
+</device-admin>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/DeviceTest.java
new file mode 100644
index 0000000..9cdb35d
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/DeviceTest.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20348;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.app.admin.DevicePolicyManager;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.os.UserManager;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.regex.Pattern;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    Context mContext;
+    UiDevice mDevice;
+    DevicePolicyManager mDevicePolicyManager;
+    ComponentName mComponentName;
+    static final String USER_RESTRICTION = UserManager.DISALLOW_CONFIG_LOCATION;
+    static final int UI_TIMEOUT_MS = 5000;
+
+    String getStringRes(int key) {
+        return mContext.getResources().getString(key);
+    }
+
+    int getIntegerRes(int key) {
+        return mContext.getResources().getInteger(key);
+    }
+
+    @After
+    public void tearDown() {
+        try {
+            /* Return to home screen after test */
+            mDevice.pressHome();
+
+            /*
+             * Clear user restriction "DISALLOW_CONFIG_LOCATION" set by the test and also clear the
+             * app as device owner.
+             */
+            mDevicePolicyManager.clearUserRestriction(mComponentName, USER_RESTRICTION);
+            mDevicePolicyManager.clearDeviceOwnerApp(mContext.getPackageName());
+        } catch (Exception e) {
+            // ignore the exception as the test is already complete
+        }
+    }
+
+    @Test
+    public void testWifiScanningDisallowed() {
+        try {
+            mDevice = UiDevice.getInstance(getInstrumentation());
+            mContext = getApplicationContext();
+            mDevicePolicyManager = mContext.getSystemService(DevicePolicyManager.class);
+            mComponentName = new ComponentName(PocDeviceAdminReceiver.class.getPackage().getName(),
+                    PocDeviceAdminReceiver.class.getName());
+            mDevicePolicyManager.addUserRestriction(mComponentName, USER_RESTRICTION);
+            UserManager userManager = mContext.getSystemService(UserManager.class);
+            assumeTrue(getStringRes(R.string.setUserRestrictionFailed),
+                    userManager.getUserRestrictions().getBoolean(USER_RESTRICTION));
+
+            /* Start the window that contains option to toggle "Wi-Fi scanning" on/off */
+            Intent intent = new Intent(getStringRes(R.string.locationIntentAction));
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            mContext.startActivity(intent);
+
+            /* Wait for the window that contains option to toggle "Wi-Fi scanning" */
+            Pattern wifiScanningPattern = Pattern
+                    .compile(getStringRes(R.string.wifiScanningPattern), Pattern.CASE_INSENSITIVE);
+            boolean wifiScanningFound = mDevice.wait(Until.hasObject(
+                    By.text(wifiScanningPattern).res(getStringRes(R.string.resWifiScanning))),
+                    UI_TIMEOUT_MS);
+            assumeTrue(getStringRes(R.string.wifiScanningTimedOut), wifiScanningFound);
+
+            /*
+             * Check if the toggle "Wi-Fi scanning" is enabled, it is supposed to be disabled by
+             * the Device Admin in presence of fix
+             */
+            UiObject2 wifiScanningToggle = mDevice.findObject(
+                    By.text(wifiScanningPattern).res(getStringRes(R.string.resWifiScanning)));
+            assertFalse(getStringRes(R.string.failMsg), wifiScanningToggle.isEnabled());
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/PocDeviceAdminReceiver.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/PocDeviceAdminReceiver.java
new file mode 100644
index 0000000..129a6b5
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20348/src/android/security/cts/CVE_2022_20348/PocDeviceAdminReceiver.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20348;
+
+import android.app.admin.DeviceAdminReceiver;
+
+public class PocDeviceAdminReceiver extends DeviceAdminReceiver {
+}
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
index 33422c1..42b9b5c 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
@@ -598,30 +598,25 @@
 
         final int atomTag = Atom.SCREEN_BRIGHTNESS_CHANGED_FIELD_NUMBER;
 
-        Set<Integer> screenMin = new HashSet<>(Arrays.asList(47));
-        Set<Integer> screen100 = new HashSet<>(Arrays.asList(100));
-
-        // Add state sets to the list in order.
-        List<Set<Integer>> stateSet = Arrays.asList(screenMin, screen100);
-
         ConfigUtils.uploadConfigForPushedAtom(getDevice(), DeviceUtils.STATSD_ATOM_TEST_PKG,
                 atomTag);
         DeviceUtils.runDeviceTestsOnStatsdApp(getDevice(), ".AtomTests", "testScreenBrightness");
 
-        // Sorted list of events in order in which they occurred.
-        List<EventMetricData> data = ReportUtils.getEventMetricDataList(getDevice());
+        List<Integer> expectedValues = Arrays.asList(47, 100);
+
+        // Sorted list of brightness values in order in which they occurred, filtered to only
+        // contain expectedValues if they are present.
+        List<Integer> data = ReportUtils.getEventMetricDataList(getDevice())
+                                     .stream()
+                                     .map(e -> e.getAtom().getScreenBrightnessChanged().getLevel())
+                                     .filter(expectedValues::contains)
+                                     .collect(Collectors.toList());
 
         // Restore initial screen brightness
         setScreenBrightness(initialBrightness);
         setScreenBrightnessMode(isInitialManual);
 
-        AtomTestUtils.popUntilFind(data, screenMin,
-                atom -> atom.getScreenBrightnessChanged().getLevel());
-        AtomTestUtils.popUntilFindFromEnd(data, screen100,
-                atom -> atom.getScreenBrightnessChanged().getLevel());
-        // Assert that the events happened in the expected order.
-        AtomTestUtils.assertStatesOccurredInOrder(stateSet, data, AtomTestUtils.WAIT_TIME_SHORT,
-                atom -> atom.getScreenBrightnessChanged().getLevel());
+        assertThat(data).containsExactlyElementsIn(expectedValues).inOrder();
     }
 
     public void testSyncState() throws Exception {
diff --git a/hostsidetests/theme/app/src/android/theme/app/AssetBucketVerifier.java b/hostsidetests/theme/app/src/android/theme/app/AssetBucketVerifier.java
new file mode 100644
index 0000000..09875b1
--- /dev/null
+++ b/hostsidetests/theme/app/src/android/theme/app/AssetBucketVerifier.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package android.theme.app;
+
+import android.content.Context;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+class AssetBucketVerifier {
+    /** Asset file to verify. */
+    private static final String ASSET_NAME = "ic_star_black_16dp.png";
+
+    /** Densities at which {@link #ASSET_NAME} may be defined. */
+    private static final int[] DENSITIES_DPI = new int[] {
+            160, // mdpi
+            240, // hdpi
+            320, // xhdpi
+            480, // xxhdpi
+            640, // xxxhdpi
+    };
+
+    /** Bucket names corresponding to {@link #DENSITIES_DPI} entries. */
+    private static final String[] DENSITIES_NAME = new String[] {
+            "mdpi",
+            "hdpi",
+            "xhdpi",
+            "xxhdpi",
+            "xxxhdpi"
+    };
+
+    static class Result {
+        String expectedAtDensity;
+        List<String> foundAtDensity;
+    }
+
+    static Result verifyAssetBucket(Context context) {
+        List<String> foundAtDensity = new ArrayList<>();
+        String expectedAtDensity = null;
+
+        int deviceDensityDpi = context.getResources().getConfiguration().densityDpi;
+        for (int i = 0; i < DENSITIES_DPI.length; i++) {
+            // Find the matching or next-highest density bucket.
+            if (expectedAtDensity == null && DENSITIES_DPI[i] >= deviceDensityDpi) {
+                expectedAtDensity = DENSITIES_NAME[i];
+            }
+
+            // Try to load and close the asset from the current density.
+            try {
+                context.getAssets().openNonAssetFd(1,
+                        "res/drawable-" + DENSITIES_NAME[i] + "-v4/" + ASSET_NAME).close();
+                foundAtDensity.add(DENSITIES_NAME[i]);
+            } catch (IOException e) {
+                e.printStackTrace();
+            }
+        }
+
+        if (expectedAtDensity == null) {
+            expectedAtDensity = DENSITIES_NAME[DENSITIES_NAME.length - 1];
+        }
+
+        Result result = new Result();
+        result.expectedAtDensity = expectedAtDensity;
+        result.foundAtDensity = foundAtDensity;
+        return result;
+    }
+}
diff --git a/hostsidetests/theme/app/src/android/theme/app/GenerateImagesActivity.java b/hostsidetests/theme/app/src/android/theme/app/GenerateImagesActivity.java
index b764752..6be679b 100644
--- a/hostsidetests/theme/app/src/android/theme/app/GenerateImagesActivity.java
+++ b/hostsidetests/theme/app/src/android/theme/app/GenerateImagesActivity.java
@@ -65,14 +65,41 @@
         // Useful for local testing. Not required for CTS harness.
         getWindow().addFlags(LayoutParams.FLAG_KEEP_SCREEN_ON);
 
-        mOutputDir = setupOutputDirectory();
-        if (mOutputDir == null) {
-            finish("Failed to create output directory " + mOutputDir.getAbsolutePath(), false);
+        // Make sure the device has reasonable assets.
+        String assetDensityFailureMsg = checkAssetDensity();
+        if (assetDensityFailureMsg != null) {
+            finish("Failed to verify device assets: "+ assetDensityFailureMsg, false);
         } else {
-            generateNextImage();
+            mOutputDir = setupOutputDirectory();
+            if (mOutputDir == null) {
+                finish("Failed to create output directory: " + OUT_DIR, false);
+            } else {
+                generateNextImage();
+            }
         }
     }
 
+    private String checkAssetDensity() {
+        AssetBucketVerifier.Result result = AssetBucketVerifier.verifyAssetBucket(this);
+
+        String message;
+        if (result.foundAtDensity.contains(result.expectedAtDensity)) {
+            message = null;
+        } else if (result.foundAtDensity.isEmpty()) {
+            message = "Failed to find expected device assets at any density";
+        } else {
+            StringBuilder foundAtDensityStr = new StringBuilder(result.foundAtDensity.get(0));
+            for (int i = 1; i < result.foundAtDensity.size(); i++) {
+                foundAtDensityStr.append(", ");
+                foundAtDensityStr.append(result.foundAtDensity.get(i));
+            }
+            message = "Failed to find device assets at expected density ("
+                    + result.expectedAtDensity + "), but found at " + foundAtDensityStr;
+        }
+
+        return message;
+    }
+
     private File setupOutputDirectory() {
         mOutputDir = new File(Environment.getExternalStorageDirectory(), OUT_DIR);
         ThemeTestUtils.deleteDirectory(mOutputDir);
@@ -105,8 +132,9 @@
     private void generateNextImage() {
         // Keep trying themes until one works.
         boolean success = false;
-        while (++mCurrentTheme < THEMES.length && !success) {
+        while (mCurrentTheme < THEMES.length && !success) {
             success = launchThemeDeviceActivity();
+            mCurrentTheme++;
         }
 
         // If we ran out of themes, we're done.
diff --git a/tests/framework/base/localeconfig/Android.bp b/tests/framework/base/localeconfig/Android.bp
index 80b00f3..a0485a4 100644
--- a/tests/framework/base/localeconfig/Android.bp
+++ b/tests/framework/base/localeconfig/Android.bp
@@ -43,6 +43,7 @@
 
     sdk_version: "test_current",
     data: [
+        ":CtsMalformedInputTests",
         ":CtsNoLocaleConfigTagTests",
     ],
     per_testcase_directory: true,
diff --git a/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/utils/ActivityEmbeddingUtil.java b/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/utils/ActivityEmbeddingUtil.java
index 5dad582..d12b7c1d 100644
--- a/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/utils/ActivityEmbeddingUtil.java
+++ b/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/utils/ActivityEmbeddingUtil.java
@@ -216,19 +216,13 @@
 
     /**
      * Attempts to start an activity from a different UID into a split, verifies that activity
-     * start did not succeed and no new split is active.
+     * did not start on splitContainer successfully and no new split is active.
      */
     public static void startActivityCrossUidInSplit_expectFail(@NonNull Activity primaryActivity,
             @NonNull ComponentName secondActivityComponent,
             @NonNull TestValueCountConsumer<List<SplitInfo>> splitInfoConsumer) {
-        boolean startExceptionObserved = false;
-        try {
-            startActivityFromActivity(primaryActivity, secondActivityComponent, "secondActivityId",
+        startActivityFromActivity(primaryActivity, secondActivityComponent, "secondActivityId",
                     Bundle.EMPTY);
-        } catch (SecurityException e) {
-            startExceptionObserved = true;
-        }
-        assertTrue(startExceptionObserved);
 
         // No split should be active, primary activity should be covered by the new one.
         assertNoSplit(primaryActivity, splitInfoConsumer);
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/TaskFragmentOrganizerPolicyTest.java b/tests/framework/base/windowmanager/src/android/server/wm/TaskFragmentOrganizerPolicyTest.java
index 318e6f7..d49948f 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/TaskFragmentOrganizerPolicyTest.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/TaskFragmentOrganizerPolicyTest.java
@@ -27,11 +27,13 @@
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 
 import static com.google.common.truth.Truth.assertThat;
+import static com.google.common.truth.Truth.assertWithMessage;
 
 import static org.junit.Assert.assertEquals;
 
 import android.app.Activity;
 import android.app.Instrumentation;
+import android.content.ComponentName;
 import android.content.Intent;
 import android.graphics.Rect;
 import android.os.Binder;
@@ -39,6 +41,7 @@
 import android.platform.test.annotations.Presubmit;
 import android.server.wm.TaskFragmentOrganizerTestBase.BasicTaskFragmentOrganizer;
 import android.server.wm.WindowContextTests.TestActivity;
+import android.server.wm.WindowManagerState.Task;
 import android.window.TaskAppearedInfo;
 import android.window.TaskFragmentCreationParams;
 import android.window.TaskFragmentInfo;
@@ -196,18 +199,13 @@
                         null /* activityOptions */);
 
         mTaskFragmentOrganizer.applyTransaction(wct);
-
-        mTaskFragmentOrganizer.waitForTaskFragmentCreated();
-
-        TaskFragmentInfo info = mTaskFragmentOrganizer.getTaskFragmentInfo(taskFragToken);
-
-        // TaskFragment must remain empty because embedding activities in a new task is not allowed.
-        assertEmptyTaskFragment(info, taskFragToken);
-
         mTaskFragmentOrganizer.waitForTaskFragmentError();
 
         assertThat(mTaskFragmentOrganizer.getThrowable()).isInstanceOf(SecurityException.class);
         assertThat(mTaskFragmentOrganizer.getErrorCallbackToken()).isEqualTo(errorCallbackToken);
+
+        // Activity must be launched on a new task instead.
+        waitAndAssertActivityLaunchOnTask(LAUNCHING_ACTIVITY);
     }
 
     /**
@@ -233,9 +231,20 @@
         mTaskFragmentOrganizer.waitForTaskFragmentError();
         assertThat(mTaskFragmentOrganizer.getThrowable()).isInstanceOf(SecurityException.class);
 
-        // Making sure no activity launched
+        // Making sure activity is not launched on the TaskFragment
         TaskFragmentInfo info = mTaskFragmentOrganizer.getTaskFragmentInfo(taskFragToken);
         assertEmptyTaskFragment(info, taskFragToken);
+
+        // Activity must be launched on a new task instead.
+        waitAndAssertActivityLaunchOnTask(SDK_30_TEST_ACTIVITY);
+    }
+
+    private void waitAndAssertActivityLaunchOnTask(ComponentName activityName) {
+        waitAndAssertResumedActivity(activityName, "Activity must be resumed.");
+
+        Task task = mWmState.getTaskByActivity(activityName);
+        assertWithMessage("Launching activity must be started on Task")
+                .that(task.getActivities()).contains(mWmState.getActivity(activityName));
     }
 
     /**
diff --git a/tests/media/src/android/mediav2/cts/EncodeDecodeAccuracyTest.java b/tests/media/src/android/mediav2/cts/EncodeDecodeAccuracyTest.java
index b11343c..ebed139 100644
--- a/tests/media/src/android/mediav2/cts/EncodeDecodeAccuracyTest.java
+++ b/tests/media/src/android/mediav2/cts/EncodeDecodeAccuracyTest.java
@@ -55,9 +55,10 @@
     // qp of the encoded clips shall drop down to < 10. Further the color bands are aligned to 2,
     // so from downsampling rgb24 to yuv420p, even if bilinear filters are used as opposed to
     // skipping samples, we may not see large color loss. Hence allowable tolerance is kept to 5.
-    // until QP stabilizes, the tolerance is set at 7.
-    private final int TRANSIENT_STATE_COLOR_DELTA = 7;
-    private final int STEADY_STATE_COLOR_DELTA = 5;
+    // until QP stabilizes, the tolerance is set at 7. For devices upgrading to T, thresholds are
+    // relaxed to 8 and 10.
+    private final int TRANSIENT_STATE_COLOR_DELTA = FIRST_SDK_IS_AT_LEAST_T ? 7: 10;
+    private final int STEADY_STATE_COLOR_DELTA = FIRST_SDK_IS_AT_LEAST_T ? 5: 8;
     private final int[][] mColorBars = new int[][]{
             {66, 133, 244},
             {219, 68, 55},
diff --git a/tests/tests/security/src/android/security/cts/BitmapTest.java b/tests/tests/security/src/android/security/cts/BitmapTest.java
index 5ce81fd..e824deb 100644
--- a/tests/tests/security/src/android/security/cts/BitmapTest.java
+++ b/tests/tests/security/src/android/security/cts/BitmapTest.java
@@ -48,6 +48,7 @@
     private Instrumentation mInstrumentation;
     private PeerConnection mRemoteConnection;
     private IBitmapService mRemote;
+    private Intent mIntent;
 
     public static class PeerConnection extends AbstractFuture<IBitmapService>
             implements ServiceConnection {
@@ -79,6 +80,7 @@
     public void tearDown() {
         if (mRemoteConnection != null) {
             final Context context = mInstrumentation.getContext();
+            context.stopService(mIntent);
             context.unbindService(mRemoteConnection);
             mRemote = null;
             mRemoteConnection = null;
@@ -88,11 +90,11 @@
     IBitmapService getRemoteService() throws ExecutionException, InterruptedException {
         if (mRemote == null) {
             final Context context = mInstrumentation.getContext();
-            Intent intent = new Intent();
-            intent.setComponent(new ComponentName(
+            mIntent = new Intent();
+            mIntent.setComponent(new ComponentName(
                     "android.security.cts", "android.security.cts.BitmapService"));
             mRemoteConnection = new PeerConnection();
-            context.bindService(intent, mRemoteConnection,
+            context.bindService(mIntent, mRemoteConnection,
                     Context.BIND_AUTO_CREATE | Context.BIND_IMPORTANT);
             mRemote = mRemoteConnection.get();
         }
diff --git a/tests/tests/security/src/android/security/cts/CVE_2019_9376.java b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
index b5896f1..5c0f342 100644
--- a/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
+++ b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
@@ -25,12 +25,13 @@
 import android.platform.test.annotations.AsbSecurityTest;
 import android.os.Parcel;
 import androidx.test.runner.AndroidJUnit4;
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
 @RunWith(AndroidJUnit4.class)
-public class CVE_2019_9376 {
+public class CVE_2019_9376 extends StsExtraBusinessLogicTestCase {
 
     @AppModeFull
     @AsbSecurityTest(cveBugId = 129287265)
diff --git a/tests/tests/security/src/android/security/cts/PackageInstallerTest.java b/tests/tests/security/src/android/security/cts/PackageInstallerTest.java
index 887538b..ddea213 100644
--- a/tests/tests/security/src/android/security/cts/PackageInstallerTest.java
+++ b/tests/tests/security/src/android/security/cts/PackageInstallerTest.java
@@ -21,23 +21,24 @@
 import android.platform.test.annotations.AsbSecurityTest;
 
 import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
 
 import com.android.cts.install.lib.Install;
 import com.android.cts.install.lib.TestApp;
 import com.android.cts.install.lib.Uninstall;
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
 
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
 
 import java.util.concurrent.TimeUnit;
 
-@RunWith(JUnit4.class)
+@RunWith(AndroidJUnit4.class)
 @AppModeFull
-public class PackageInstallerTest {
+public class PackageInstallerTest extends StsExtraBusinessLogicTestCase {
 
     private static final String TEST_APP_NAME = "android.security.cts.packageinstallertestapp";
 
diff --git a/tests/tests/security/src/android/security/cts/RunningAppProcessInfoTest.java b/tests/tests/security/src/android/security/cts/RunningAppProcessInfoTest.java
index 293200e..a46e142 100644
--- a/tests/tests/security/src/android/security/cts/RunningAppProcessInfoTest.java
+++ b/tests/tests/security/src/android/security/cts/RunningAppProcessInfoTest.java
@@ -16,17 +16,21 @@
 
 package android.security.cts;
 
+import static org.junit.Assert.*;
+
 import android.app.ActivityManager;
 import android.content.Context;
 import android.platform.test.annotations.AsbSecurityTest;
-import androidx.test.runner.AndroidJUnit4;
-import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
-import org.junit.runner.RunWith;
-import org.junit.Test;
 
-import static org.junit.Assert.*;
+import androidx.test.runner.AndroidJUnit4;
+
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
 
 import java.util.List;
+import java.util.stream.Collectors;
 
 @RunWith(AndroidJUnit4.class)
 public class RunningAppProcessInfoTest extends StsExtraBusinessLogicTestCase {
@@ -40,12 +44,23 @@
     @Test
     public void testRunningAppProcessInfo() {
         ActivityManager amActivityManager =
-                (ActivityManager) getInstrumentation().getContext().getSystemService(Context.ACTIVITY_SERVICE);
+                (ActivityManager)
+                        getInstrumentation()
+                                .getContext()
+                                .getSystemService(Context.ACTIVITY_SERVICE);
         List<ActivityManager.RunningAppProcessInfo> appList =
                 amActivityManager.getRunningAppProcesses();
+
+        // Assembles app list for logging
+        List<String> processNames =
+                appList.stream()
+                        .map((processInfo) -> processInfo.processName)
+                        .collect(Collectors.toList());
+
         // The test will pass if it is able to get only its process info
-        assertTrue("Device is vulnerable to CVE-2015-3833. For more information, see " +
-                "https://android.googlesource.com/platform/frameworks/base/+" +
-                "/aaa0fee0d7a8da347a0c47cef5249c70efee209e", (appList.size() == 1));
+        assertTrue(
+                "Device is vulnerable to CVE-2015-3833. Running app processes: "
+                        + processNames.toString(),
+                (appList.size() == 1));
     }
 }
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index d9c0039..cdb27a8 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -2437,6 +2437,11 @@
                 } catch (Exception e) {
                     // local exceptions ignored, not security issues
                 } finally {
+                    try {
+                        codec.stop();
+                    } catch (Exception e) {
+                        // local exceptions ignored, not security issues
+                    }
                     codec.release();
                     renderTarget.destroy();
                 }
diff --git a/tests/tests/wifi/src/android/net/wifi/rtt/cts/WifiRttTest.java b/tests/tests/wifi/src/android/net/wifi/rtt/cts/WifiRttTest.java
index 2a3f67a..6205ee8 100644
--- a/tests/tests/wifi/src/android/net/wifi/rtt/cts/WifiRttTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/rtt/cts/WifiRttTest.java
@@ -605,7 +605,7 @@
         builder.setRttBurstSize(RangingRequest.getMaxRttBurstSize());
         RangingRequest request = builder.build();
 
-        // Perform the rquest
+        // Perform the request
         rangeNon11mcApRequest(request, testAp, MAX_NON11MC_VARIATION_FROM_AVERAGE_DISTANCE_MM);
     }
 
@@ -639,7 +639,9 @@
         builder.setRttBurstSize(RangingRequest.getMaxRttBurstSize());
         RangingRequest request = builder.build();
 
-        // Perform the rquest
+
+
+        // Perform the request
         rangeNon11mcApRequest(request, testAp, MAX_NON11MC_VARIATION_FROM_AVERAGE_DISTANCE_MM);
     }
 
@@ -747,15 +749,13 @@
                 ResultType.NEUTRAL, ResultUnit.NONE);
         reportLog.submit();
 
-        // This bug below has been addressed by making the test parameters for Non-80211mc devices
-        // less stringent. Please update the bug if this does not solve the problem.
-        // TODO(b/192909380): enable the performance verification after device fix.
-
-        // Analyze results
+        /** TODO(b/237011062): enable the performance verification new API to check capabilities
+         // Analyze results
         assertTrue("Wi-Fi RTT failure rate exceeds threshold: FAIL=" + numFailures
                         + ", ITERATIONS="
                         + NUM_OF_RTT_ITERATIONS + ", AP=" + testAp,
                 numFailures <= NUM_OF_RTT_ITERATIONS * MAX_NON11MC_FAILURE_RATE_PERCENT / 100);
+         */
 
         if (numFailures != NUM_OF_RTT_ITERATIONS) {
             // Calculate an initial average using all measurements to determine distance outliers
diff --git a/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml b/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
index a6e59ac..bfbb35a 100644
--- a/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
+++ b/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
@@ -114,4 +114,7 @@
 
     <!-- b/234409652 Stable API does not exist to enforce this requirement on variable geometry devices -->
     <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.ExtendedCameraCharacteristicsTest#testCameraOrientationAlignedWithDevice"/>
+
+    <!-- b/235453601 -->
+    <option name="compatibility:exclude-filter" value="CtsMediaPerformanceClassTestCases android.mediapc.cts.MultiDecoderPerfTest" />
 </configuration>