* changes:
Upgrade AndroidFrameworkBinderIdentity to fatal.
Tighten up Binder.clearCallingIdentity() usage.
Tighten up Binder.clearCallingIdentity() usage.
Tighten up Binder.clearCallingIdentity() usage.
This is a third CL in a chain that adjusts existing malformed code
to follow AndroidFrameworkBinderIdentity best-practices.
Specifically, if a thread clears an identity they need to restore it
to avoid obscure security vulnerabilities. In addition, the relevant
"try" block must start immediately after the identity is cleared to
ensure that its restored if/when any exceptions are thrown.
Bug: 155703208
Test: make
Exempt-From-Owner-Approval: trivial refactoring
Change-Id: I74cb958b68d55a647547aae21baff6ddc364859b
Since injection-related constants are now enum class, use the new
versions here.
Bug: 161009325
Test: presubmit
Change-Id: Icae277f73d693cdc502b70b8299a9763cc276471
The feature is disabled by default and can be in one of 3 modes:
disabled, permissive and block. In permissive we only log but
don't block the touch. This knob is implemented in a global setting
block_untrusted_touches. It can also be disabled per occluding app using
app-compat infrastructure, so if you disable for a certain app, overlays
of that app won't have the chance of blocking touches. More details
on these on go/try-cross-uid-touches.
Each window has 3 modes related to touch occlusion: ALLOW, USE_OPACITY
or BLOCK_UNTRUSTRED. Check code comments for the meaning of each. If the
feature is turned off for the app, then the mode is ALLOW. Else if it's
a SAW, then it's USE_OPACITY. Else it's BLOCK_UNTRUSTED. These states
are passed to InputDispatcher, who then perform the proper checks and
blocks or not the touch.
If input dispatcher deems the touch unsafe, depending on the feature
mode, we filter out such touches and log a message to logcat.
I also introduce a global (secure) setting
MAXIMUM_OBSCURING_OPACITY_FOR_TOUCH which represents the maximum
opacity allowed per UID that's obscuring the touch-consuming window
according to some rules, which are discussed in topic CL for
InputDispatcher code. This maximum is initially set to 0.8, but we'll
be conducting local experiments to determine the final value.
Test: atest WindowUntrustedTouchTest
Test: atest inputflinger_tests inputflinger_benchmarks libinput_tests
Test: go/try-cross-uid-touches for manual testing
Bug: 158002302
Change-Id: I462858ad5f0d11b1261748489385e6409e38e4b1
Removing the deprecated AudioAttributes field from VibrationAttributes
in favor of a usage mapping to be used with AppOpsManager.checkAudioOp.
The mapping ensures the heuristic applied in VibrationAttributes.Builder
is taken into account by the VibratorManager.
This also adds a hidden method to Vibrator to allow forwarding a
VibrationAttributes to input device vibrators instead of relying on the
original AudioAttributes.
Bug: 163119475
Test: atest FrameworksServicesTests:VibratorServiceTest
atest FrameworksCoreTests:VibratorTest
Change-Id: I83dbe079865b453c4cf42a6fd7e71f822acc39ea
Parcelables cannot easily become TestApi, since CREATOR, etc
all come as extra baggage. So, rename internal usage to
*SensorPropertiesInternal, and add a new class that exposes
only specific parts of the properties for future TestApi
Bug: 169459906
Test: Enroll, Auth on existing devices
Test: atest com.android.systemui.biometrics
Test: atest com.android.server.biometrics
Change-Id: I59ae6bd30bef0eccbbcb58ddd7fa443be8a42ccf
This extracts the notifyLidSwitchChanged() method from
WindowManagerCallbacks to allow services other than window manager to
receive lid switch notifications
Test: Manual, register callback and trigger lid switch
Bug: 159401801
Change-Id: I8967d4f2f5a9c56c2b7e0822224d1c0ea0f1bc06
This interface should allow easy support for multiple HAL interfaces.
For example,
for (ServiceProvider p : providers) {
if (p.containsSensor(sensorId)) {
p.authenticate(sensorId, ...)
}
}
or,
ServiceProvider provider = getProviderFor(sensorId)
if (provider != null) provider.authenticate(sensorId, ...)
This should reduce lots of repeated null checks, sensorId checks,
etc. and give FingerprintService a easy way to perform operations
on providers, given a sensorId.
Some of the FingerprintManager code is not sensorId-specific,
but we can update those in the future. Otherwise we have to
touch multiple projects (settings, etc). For now, all client-side
code assumes only a single sensor, so that's what we'll support
from FingerprintService.
Bug: 168843828
Test: No effect on existing devices
Test: atest com.android.server.biometrics
Test: atest com.android.systemui.biometrics
Change-Id: Icca5bc1e128afa1bb7b2c05227e87567e564e4cf
When there's an capture error reported for a frame, remove its nodes in
mPartialResults map node, since they'll not be used by clients of
FrameTracker. This should also reduce slow memory pressure build up
because of mPartialResult growth as and when there are error frames
which have some partial results as well.
Bug: 167944895
Test: GCA on Pixel2, constant mode changes don't show steady state increase in
mPartialResults map size (Basic validity)
Change-Id: I6de585deb24039321310ddbd5dccd9119b25b23d
Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
This should be enough to get started. We can plumb the remaining
AIDL properties through when we need them.
This is also fundamental to future TestApis
Test: No effect on existing fingerprint/face devices
Test: atest com.android.server.biometrics
Test: atest com.android.systemui.biometrics
Fixes: 169195610
Change-Id: I376567b4a59672b68d83c04738866b58334f8011
This moves the android.media.audio.common, android.media.permission and
android.media.soundtrigger_middleware AIDL files to a their own
separate aidl_interface module for Java.
Previously, because of how the framework JAR is configured, those
files were automatically compiled into it and we had to disable Java
for this target, creating a discrepancy between C++ and Java, which
would require us to similarly diverge any dependent targets if we want
cross-language support.
As part of this change, we also had to switch from using the
FileDescriptor type to ParcelFileDescriptor, as this is the only type
supported outside of the framework JAR and is also the recommended
practice.
Test: Manual verification of basic soundtrigger functionality.
Change-Id: Ib65c19dd7c7f5433cfa527fa74bb61ac677f5cf5
* changes:
Demote AlwaysOnHotwordDetector to SystemApi
Sessionize VoiceInteractionManagerService
Sessionize the SoundTriggerService layer.
Use standard API in SoundTriggerTestApp
Fix bug in dumpsys
Require identity information in SoundTrigger.java
Associate an originator identity to sessions
Extract permission checking as a separate aspect
Correctly handle HAL death
The added test API is used to ignore all votes in
DisplayModeDirector app votes. This way only the app
requested display mode will be picked. The API will be
used for testing app mode switch requests.
Bug: 159113268
Bug: 158316271
Test: m
Change-Id: I257636ae2a6ed74044e71e49a99024682c3a92c5
1. Document same SCALER_CROP_REGION may map to different aspect
ratio/output size for different sessions.
2. Remove the text in ZOOM_RATIO about using SCALER_CROP to change
aspect ratio.
Test: Build and read docs
Bug: 168493526
Change-Id: I405fe52d0e0a14e6a1cfbec169d33f20715fa4fb
Add support for 10bit opaque and private RAW_DEPTH10 image format
which is similar to RAW_DEPTH.
Bug: 167250258
Test: Manual using camera application.
Change-Id: Ib2ee11570429d7a9a53e9dd6bc2042a1f5eaa760
