GSI disables AVB by overriding vbmeta partition.
When a device can run runtime vintf checking, it should already
pass AVB, so we don't need to check AVB in runtime vintf.
We cannot change the original VintfObject.verify() because AVB check is
still needed for android.os.RecoverySystem to verify a newly downloaded
OTA package.
Bug: 68016134
Test: Boot with GSI and there is no Android System dialog
Change-Id: Ie1efa6f1abd8fa8f495aededd145c0ab2c0c1fae
Merged-In: Ie1efa6f1abd8fa8f495aededd145c0ab2c0c1fae
This fails when trying to run the AOSP mailer with CRASH_AT_SIZE = 500,
when the check interval is reduced sufficiently so that the test is
actually executed. System server has been observed to use more than
1000 BinderProxies. Thus 5000 seems like roughly the lowest safe limit.
Note that the test is executed somewhat rarely, so we may exceed
this number by quite a few before we actually crash.
Bug: 65760710
Test: Builds, AOSP boots & works for a few tasks. Fails as expected
with reduced limit.
Change-Id: I1c999b85e1ba1bd1d166a9ffba4f0b3992ffee45
Added note within getSerial() in android.os.Build class. Device
identifiers, such as hardware serial numbers, can be modified if a
device is rooted. Others can use key attestation to discover these
changes. Added a note to this effect within this method.
Test: make ds-docs -j8
Bug: 38312326
Change-Id: I76e3f6a15b9a8673ca3304218653e8cd26da38d7
Original-Change-Id: Ibd2dab621c14683e12a213957b567ee49b8d00fd
... that returns PID of the process for debuggable builds.
This calls into the C++ equivalent of the function.
Test: lshal
Bug: 68992575
Change-Id: Ia177c709c6930510035cff33dc2389441a76351d
For fresh installs the PM does not set the app uid before invoking
dexopt; so we would always get a bogus GID.
This is a temporary workaround which fixes the GID of newly
installed apps to an arbitrary UNKNOWN gid.
Test: adb install
Bug: 64548938
Bug: 69331247
(cherry picked from commit a73e165c2e)
Change-Id: I6438ec8cfca88df813e166f9ef5821e62faf524a
Bluetooth service needs to natively access id of parent profile. Add
method exposing it.
Test: cts-tradefed run cts-dev -m DevicePolicyManager --test
com.android.cts.devicepolicy.ManagedProfileTest#testBluetooth
Bug: 69284968
Change-Id: I697906f2959b0736c1d3cc6af7560c27d77ce11b
AID_SHARED_GID is a GID shared by a specific app across all users on
the same device. Bring the UserHandle and multiuser.c implementations
into agreement, and copy/paste the unit tests that verify that both
behave identically.
Since we might now return "-1" when a GID is invalid, have
ActivityManager handle these cases by quickly swapping in the
always-valid getUserGid().
Test: bit FrameworksCoreTests:android.os.UserHandleTest
Bug: 34151068, 64548938
Change-Id: I0463aba923ae5ce1942666359a394ae6cdb7c1f8
Symptom:
Global reference table overflow happens on system_server.
Root cause:
If a process repeatedly create a context and get AutofillManager
from the context, each BinderProxy of AutofillManagerClient are
registered to AutofillManagerServiceImpl. They aren't removed until
the process is died. BinderProxy consumes global reference and finally
causes crash on system_server.
Solution:
Remove AutofillManagerClient from AutofillManagerServiceImpl after
AutofillManager is finalized.
Test: cts-tradefed run commandAndExit cts-dev -m CtsAutoFillServiceTestCases
Bug: 68747744
Change-Id: I8b76c5368b54317b8696cac470cc390b36e910e7
IFoo.Proxy.equals() -> HidlSupport.equals() ->
IHwInterface.asBinder().equals() -> HwRemoteBinder.equals().
IFoo.Stub.equals() -> default Object.equals()
Notice that IHwInterface.asBinder() returns mRemote(of type
HwRemoteBinder) for proxies and itself (of type HwBinder) for stubs.
If IFoo.Stub.asBinder() had not return "this", its equals()
should also be overridden.
Bug: 68727931
Test: hidl_test_java
Change-Id: I916983d7bc739747145e2ebb6830226310fd4980
Support for instruction counting has been removed from ART
and the VMDebug APIs in question throw UnsupportedOperationException
unconditionally.
Test: make
Change-Id: Ibcaa160f755a5708bc6fbef3a783acfc26f0ba90
The javadoc of TokenWatcher promised to implement repeated calls to
acquire() with the same token as a no-op, but this wasn't the case.
When acquire() is called repeatedly with the same token, its associated
DeathRecipient object is replaced by a new one. The old DeathRecipient
can therefore be destroyed. This is problematic because the finalizer of
this DeathRecipient implementation calls release() on the same token,
resulting in the token being released unexpectedly.
In this CL we properly implement the documented no-op behavior.
Bug: 68368071
Test: (First, cherry-pick to internal master)
Test: cts-tradefed run cts-dev -m OsTest -t android.os.cts.TokenWatcherTest
Test: CTS verifier > Managed provisioning > Device owner tests
> LockTask UI
Change-Id: Idfad7c88075a510ea1f8527b5a8620121a5dd7bb
This removes all GlobalRef allocation as part of building BinderProxys.
Previously these were used to map IBinders to the corresponding
Java object, so the Java objects could be reused. We now keep
that mapping at the Java level.
This means we often need to call into Java to look up or allocate
a BinderProxy. But this replaces a prior call to Java to dereference
a WeakReference. The Java custom Java map-to-WeakReference data
structure is probably not terribly efficient, but the original
attachement mechanism did not seem to be either. And this
avoids potentially even more catastrophic issues when the number
of GlobalRefs approaches its limit.
We decrease GC triggering frequency from 200 to 1000 allocated
references. This now only applies to other kinds of JNI References
allocated by Binder.
I saw a maximum bucket size of 16 for the ProxyMap data structure
while briefly exercising a freshly booted device. That occurred
in system_server.
Bug: 65760710
Test: Built and booted master with some debugging output. Looks sane.
Change-Id: I322c4d8e9c8e198586d591580c2cdbb094906677
Change the Java BinderProxy to only contain a single native pointer,
so that we can get by with a single NativeAllocationRegistry
registration. This adds some indirections and a new allocation. But it
marginally reduces the number of (expensive) JNI field lookups from
native code, and the extra allocation involves significantly less
overhead than registering each object twice. This also cleans up the
code a little by avoiding some explicit reference count adjustments.
Change BinderProxy Binder to use NativeAllocationRegistry instead of
finalize().
Change the mObject field in Binder to hold a non-reference-counted
but owning pointer to JavaBBinderHolder. Have JavaBBinderHolder no
longer inherit from RefBase.
Make it clear that neither Binder.mObject, not BinderProxy.mNativeData
can be null. Remove null checks.
Avoid checking for null returns from C++ new. It would throw
anyway, which would cause the process to abort.
Test: Booted master.
Bug: 65760710
Change-Id: I323d4bdc7e25f8c27b847b6fe2c073eac3f2efe5
Also add appropriate @NonNull and @Nullable annotations.
Test: built
Change-Id: I22de48105ef685baf594cfc004dd3e27e2ba09e9
Merged-In: I22de48105ef685baf594cfc004dd3e27e2ba09e9
(cherry picked from commit 4cd650c008)
getService: wait for service if it is declared in the manifest
tryGetService: only return if the service is immediately available
Bug: 67981006
Test: hidl_test_java
Change-Id: I4485b84f0fde98851cf5f64d198a8c5410795c8c
We now disallow non-UTF8 property values directly in property_service,
so there is no need for this warning.
This partially reverts 33aea8d40e.
Bug: 63177684
Test: make
Change-Id: I61f49f635c6095013f55b906e00925a8cbd1ea8c
