InputVerifier: verify button events and states (attempt 2)

Check the following things:

* BUTTON_PRESS and _RELEASE actions have a single, valid action button
* No redundant BUTTON_PRESS or _RELEASE actions (i.e. for buttons that
  are already pressed or released)
* Button state remains consistent throughout the stream, i.e.:
  * Buttons are only added to the state by BUTTON_PRESS (though DOWN
    events can have "pending" buttons on them)
  * Buttons are only removed from the state by BUTTON_RELEASE
  * When a DOWN event has pending buttons in its state, it is
    immediately followed by a BUTTON_PRESS for each one

We could also verify that press and release events for primary,
secondary, and tertiary buttons are accompanied by down and up events.
However, I couldn't find any documentation that states which buttons
should result in down or up events, so I haven't implemented this for
now.

This is the second attempt to land this change, due to the original
causing test failures. Change I5c259c13d433d3010d2cf9c6fe01e08ba5990ef7
fixes the failures. v2 also adds a separate flag for button state
verification, as it is actually used in production to check events
injected by assistive technologies, whether or not the flag that I
previously thought was guarding it is enabled.

Test: connect a mouse and a touchpad, enable the verifier, play around
      with the buttons, and check that any issues found by the verifier
      appear to be legitimate. (I found b/391298464 , and checked that
      the verifier caught a button problem with a partial fix to
      b/372571823 .)
Test: atest --host libinput_rust_tests
Test: atest --host frameworks/native/libs/input/tests/InputVerifier_test.cpp
Test: atest --host \
      frameworks/native/services/inputflinger/tests/InputDispatcher_test.cpp
Bug: 392870542
Flag: com.android.input.flags.enable_button_state_verification
Change-Id: I46f489b26df8785563e41e58135b6b5de4ff62a2

Author: HarryCutts

include/android/input.h

@@ -849,6 +849,7 @@ enum {
  * Refer to the documentation on the MotionEvent class for descriptions of each button.
  */
 enum {
+    // LINT.IfChange(AMOTION_EVENT_BUTTON)
     /** primary */
     AMOTION_EVENT_BUTTON_PRIMARY = 1 << 0,
     /** secondary */
@@ -861,6 +862,7 @@ enum {
     AMOTION_EVENT_BUTTON_FORWARD = 1 << 4,
     AMOTION_EVENT_BUTTON_STYLUS_PRIMARY = 1 << 5,
     AMOTION_EVENT_BUTTON_STYLUS_SECONDARY = 1 << 6,
+    // LINT.ThenChange(/frameworks/native/libs/input/rust/input.rs)
 };
 
 /**

include/input/InputVerifier.h

@@ -47,9 +47,10 @@ class InputVerifier {
     InputVerifier(const std::string& name);
 
     android::base::Result<void> processMovement(int32_t deviceId, int32_t source, int32_t action,
-                                                uint32_t pointerCount,
+                                                int32_t actionButton, uint32_t pointerCount,
                                                 const PointerProperties* pointerProperties,
-                                                const PointerCoords* pointerCoords, int32_t flags);
+                                                const PointerCoords* pointerCoords, int32_t flags,
+                                                int32_t buttonState);
 
     void resetDevice(int32_t deviceId);
 

libs/input/Android.bp

@@ -133,6 +133,13 @@ rust_bindgen {
         "--allowlist-var=AMOTION_EVENT_ACTION_POINTER_DOWN",
         "--allowlist-var=AMOTION_EVENT_ACTION_POINTER_INDEX_SHIFT",
         "--allowlist-var=AMOTION_EVENT_ACTION_UP",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_BACK",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_FORWARD",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_PRIMARY",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_SECONDARY",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_STYLUS_PRIMARY",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_STYLUS_SECONDARY",
+        "--allowlist-var=AMOTION_EVENT_BUTTON_TERTIARY",
         "--allowlist-var=MAX_POINTER_ID",
         "--verbose",
     ],

libs/input/InputTransport.cpp

@@ -651,9 +651,9 @@ status_t InputPublisher::publishMotionEvent(
     const status_t status = mChannel->sendMessage(&msg);
 
     if (status == OK && verifyEvents()) {
-        Result<void> result =
-                mInputVerifier.processMovement(deviceId, source, action, pointerCount,
-                                               pointerProperties, pointerCoords, flags);
+        Result<void> result = mInputVerifier.processMovement(deviceId, source, action, actionButton,
+                                                             pointerCount, pointerProperties,
+                                                             pointerCoords, flags, buttonState);
         if (!result.ok()) {
             LOG(ERROR) << "Bad stream: " << result.error();
             return BAD_VALUE;

libs/input/InputVerifier.cpp

@@ -17,6 +17,7 @@
 #define LOG_TAG "InputVerifier"
 
 #include <android-base/logging.h>
+#include <com_android_input_flags.h>
 #include <input/InputVerifier.h>
 #include "input_cxx_bridge.rs.h"
 
@@ -26,25 +27,33 @@ using android::input::RustPointerProperties;
 
 using DeviceId = int32_t;
 
+namespace input_flags = com::android::input::flags;
+
 namespace android {
 
 // --- InputVerifier ---
 
 InputVerifier::InputVerifier(const std::string& name)
-      : mVerifier(android::input::verifier::create(rust::String::lossy(name))){};
+      : mVerifier(
+                android::input::verifier::create(rust::String::lossy(name),
+                                                 input_flags::enable_button_state_verification())) {
+}
 
 Result<void> InputVerifier::processMovement(DeviceId deviceId, int32_t source, int32_t action,
-                                            uint32_t pointerCount,
+                                            int32_t actionButton, uint32_t pointerCount,
                                             const PointerProperties* pointerProperties,
-                                            const PointerCoords* pointerCoords, int32_t flags) {
+                                            const PointerCoords* pointerCoords, int32_t flags,
+                                            int32_t buttonState) {
     std::vector<RustPointerProperties> rpp;
     for (size_t i = 0; i < pointerCount; i++) {
         rpp.emplace_back(RustPointerProperties{.id = pointerProperties[i].id});
     }
     rust::Slice<const RustPointerProperties> properties{rpp.data(), rpp.size()};
     rust::String errorMessage =
             android::input::verifier::process_movement(*mVerifier, deviceId, source, action,
-                                                       properties, static_cast<uint32_t>(flags));
+                                                       actionButton, properties,
+                                                       static_cast<uint32_t>(flags),
+                                                       static_cast<uint32_t>(buttonState));
     if (errorMessage.empty()) {
         return {};
     } else {

libs/input/input_flags.aconfig

@@ -15,6 +15,16 @@ flag {
   bug: "271455682"
 }
 
+flag {
+  name: "enable_button_state_verification"
+  namespace: "input"
+  description: "Set to true to enable crashing whenever bad inbound events are going into InputDispatcher"
+  bug: "392870542"
+  metadata {
+    purpose: PURPOSE_BUGFIX
+  }
+}
+
 flag {
   name: "remove_input_channel_from_windowstate"
   namespace: "input"

libs/input/rust/input.rs

@@ -101,6 +101,7 @@ bitflags! {
 
 /// A rust enum representation of a MotionEvent action.
 #[repr(u32)]
+#[derive(Eq, PartialEq)]
 pub enum MotionAction {
     /// ACTION_DOWN
     Down = input_bindgen::AMOTION_EVENT_ACTION_DOWN,
@@ -193,6 +194,27 @@ impl MotionAction {
     }
 }
 
+bitflags! {
+    /// MotionEvent buttons.
+    #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+    pub struct MotionButton: u32 {
+        /// Primary button (e.g. the left mouse button)
+        const Primary = input_bindgen::AMOTION_EVENT_BUTTON_PRIMARY;
+        /// Secondary button (e.g. the right mouse button)
+        const Secondary = input_bindgen::AMOTION_EVENT_BUTTON_SECONDARY;
+        /// Tertiary button (e.g. the middle mouse button)
+        const Tertiary = input_bindgen::AMOTION_EVENT_BUTTON_TERTIARY;
+        /// Back button
+        const Back = input_bindgen::AMOTION_EVENT_BUTTON_BACK;
+        /// Forward button
+        const Forward = input_bindgen::AMOTION_EVENT_BUTTON_FORWARD;
+        /// Primary stylus button
+        const StylusPrimary = input_bindgen::AMOTION_EVENT_BUTTON_STYLUS_PRIMARY;
+        /// Secondary stylus button
+        const StylusSecondary = input_bindgen::AMOTION_EVENT_BUTTON_STYLUS_SECONDARY;
+    }
+}
+
 bitflags! {
     /// MotionEvent flags.
     /// The source of truth for the flag definitions are the MotionEventFlag AIDL enum.