Merge "Revert "Add jobscheduler-service.jar to system server class path""
diff --git a/core/main.mk b/core/main.mk
index d23f45d..6b2db59 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1246,6 +1246,7 @@
   libnativebridge.so \
   libnativehelper.so \
   libnativeloader.so \
+  libneuralnetworks.so \
   libnpt.so \
   libopenjdk.so \
   libopenjdkjvm.so \
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index fbc9add..49df60b 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -19,6 +19,9 @@
     abb \
     adbd \
     am \
+    android.hardware.neuralnetworks@1.0 \
+    android.hardware.neuralnetworks@1.1 \
+    android.hardware.neuralnetworks@1.2 \
     android.hidl.allocator@1.0-service \
     android.hidl.base-V1.0-java \
     android.hidl.manager-V1.0-java \
@@ -55,6 +58,7 @@
     com.android.media \
     com.android.media.swcodec \
     com.android.resolv \
+    com.android.neuralnetworks \
     com.android.tzdata \
     ContactsProvider \
     content \
@@ -156,7 +160,6 @@
     libnetd_client \
     libnetlink \
     libnetutils \
-    libneuralnetworks \
     libOpenMAXAL \
     libOpenSLES \
     libpdfium \
@@ -229,6 +232,7 @@
     resize2fs \
     rss_hwm_reset \
     run-as \
+    sanitizer.libraries.txt \
     schedtest \
     screencap \
     sdcard \
@@ -265,6 +269,8 @@
     viewcompiler \
     voip-common \
     vold \
+    vndkcore.libraries.txt \
+    vndkprivate.libraries.txt \
     WallpaperBackup \
     watchdogd \
     wificond \
diff --git a/target/product/gsi/Android.mk b/target/product/gsi/Android.mk
index 5693234..1ef124b 100644
--- a/target/product/gsi/Android.mk
+++ b/target/product/gsi/Android.mk
@@ -38,6 +38,7 @@
 droidcore: check-vndk-list
 
 check-vndk-list-timestamp := $(call intermediates-dir-for,PACKAGING,vndk)/check-list-timestamp
+check-vndk-abi-dump-list-timestamp := $(call intermediates-dir-for,PACKAGING,vndk)/check-abi-dump-list-timestamp
 
 ifeq ($(TARGET_IS_64_BIT)|$(TARGET_2ND_ARCH),true|)
 # TODO(b/110429754) remove this condition when we support 64-bit-only device
@@ -50,6 +51,9 @@
 check-vndk-list: ;
 else
 check-vndk-list: $(check-vndk-list-timestamp)
+ifneq ($(SKIP_ABI_CHECKS),true)
+check-vndk-list: $(check-vndk-abi-dump-list-timestamp)
+endif
 endif
 
 _vndk_check_failure_message := " error: VNDK library list has been changed.\n"
@@ -97,12 +101,51 @@
 endif
 	@chmod a+x $@
 
+#####################################################################
+# Check that all ABI reference dumps have corresponding NDK/VNDK
+# libraries.
+
+# $(1): The directory containing ABI dumps.
+# Return a list of ABI dump paths ending with .so.lsdump.
+define find-abi-dump-paths
+$(if $(wildcard $(1)), \
+  $(addprefix $(1)/, \
+    $(call find-files-in-subdirs,$(1),"*.so.lsdump" -and -type f,.)))
+endef
+
+VNDK_ABI_DUMP_DIR := prebuilts/abi-dumps/vndk/$(PLATFORM_VNDK_VERSION)
+NDK_ABI_DUMP_DIR := prebuilts/abi-dumps/ndk/$(PLATFORM_VNDK_VERSION)
+VNDK_ABI_DUMPS := $(call find-abi-dump-paths,$(VNDK_ABI_DUMP_DIR))
+NDK_ABI_DUMPS := $(call find-abi-dump-paths,$(NDK_ABI_DUMP_DIR))
+
+$(check-vndk-abi-dump-list-timestamp): $(VNDK_ABI_DUMPS) $(NDK_ABI_DUMPS)
+	$(eval added_vndk_abi_dumps := $(strip $(sort $(filter-out \
+	  $(addsuffix .so.lsdump,$(VNDK_SAMEPROCESS_LIBRARIES) $(VNDK_CORE_LIBRARIES)), \
+	  $(notdir $(VNDK_ABI_DUMPS))))))
+	$(if $(added_vndk_abi_dumps), \
+	  echo -e "Found ABI reference dumps for non-VNDK libraries. Run \`find \$${ANDROID_BUILD_TOP}/$(VNDK_ABI_DUMP_DIR) '(' -name $(subst $(space), -or -name ,$(added_vndk_abi_dumps)) ')' -delete\` to delete the dumps.")
+
+	$(eval added_ndk_abi_dumps := $(strip $(sort $(filter-out \
+	  $(addsuffix .so.lsdump,$(NDK_MIGRATED_LIBS) $(LLNDK_LIBRARIES)), \
+	  $(notdir $(NDK_ABI_DUMPS))))))
+	$(if $(added_ndk_abi_dumps), \
+	  echo -e "Found ABI reference dumps for non-NDK libraries. Run \`find \$${ANDROID_BUILD_TOP}/$(NDK_ABI_DUMP_DIR) '(' -name $(subst $(space), -or -name ,$(added_ndk_abi_dumps)) ')' -delete\` to delete the dumps.")
+
+	$(if $(added_vndk_abi_dumps)$(added_ndk_abi_dumps),exit 1)
+	$(hide) mkdir -p $(dir $@)
+	$(hide) touch $@
+
+#####################################################################
+# VNDK package and snapshot.
+
 ifneq ($(BOARD_VNDK_VERSION),)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := vndk_package
+# Filter LLNDK libs moved to APEX to avoid pulling them into /system/LIB
 LOCAL_REQUIRED_MODULES := \
-    $(LLNDK_LIBRARIES)
+    $(filter-out $(LLNDK_MOVED_TO_APEX_LIBRARIES),$(LLNDK_LIBRARIES)))
+
 ifneq ($(TARGET_SKIP_CURRENT_VNDK),true)
 LOCAL_REQUIRED_MODULES += \
     llndk.libraries.txt \
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 4802fc6..321148b 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -111,6 +111,7 @@
 import copy
 import errno
 import gzip
+import io
 import itertools
 import logging
 import os
@@ -746,12 +747,7 @@
     filename: The archive name in the output zip.
     keys: A list of public keys to use during OTA package verification.
   """
-
-  try:
-    from StringIO import StringIO
-  except ImportError:
-    from io import StringIO
-  temp_file = StringIO()
+  temp_file = io.BytesIO()
   certs_zip = zipfile.ZipFile(temp_file, "w")
   for k in keys:
     common.ZipWrite(certs_zip, k)
diff --git a/tools/releasetools/test_sign_target_files_apks.py b/tools/releasetools/test_sign_target_files_apks.py
index 0ffd61a..e0a635a 100644
--- a/tools/releasetools/test_sign_target_files_apks.py
+++ b/tools/releasetools/test_sign_target_files_apks.py
@@ -15,6 +15,7 @@
 #
 
 import base64
+import io
 import os.path
 import zipfile
 
@@ -22,7 +23,7 @@
 import test_utils
 from sign_target_files_apks import (
     CheckApkAndApexKeysAvailable, EditTags, GetApkFileInfo, ReadApexKeysInfo,
-    ReplaceCerts, ReplaceVerityKeyId, RewriteProps)
+    ReplaceCerts, ReplaceVerityKeyId, RewriteProps, WriteOtacerts)
 
 
 class SignTargetFilesApksTest(test_utils.ReleaseToolsTestCase):
@@ -236,6 +237,22 @@
     }
     self.assertEqual(output_xml, ReplaceCerts(input_xml))
 
+  def test_WriteOtacerts(self):
+    certs = [
+        os.path.join(self.testdata_dir, 'platform.x509.pem'),
+        os.path.join(self.testdata_dir, 'media.x509.pem'),
+        os.path.join(self.testdata_dir, 'testkey.x509.pem'),
+    ]
+    entry_name = 'SYSTEM/etc/security/otacerts.zip'
+    output_file = common.MakeTempFile(suffix='.zip')
+    with zipfile.ZipFile(output_file, 'w') as output_zip:
+      WriteOtacerts(output_zip, entry_name, certs)
+    with zipfile.ZipFile(output_file) as input_zip:
+      self.assertIn(entry_name, input_zip.namelist())
+      otacerts_file = io.BytesIO(input_zip.read(entry_name))
+      with zipfile.ZipFile(otacerts_file) as otacerts_zip:
+        self.assertEqual(3, len(otacerts_zip.namelist()))
+
   def test_CheckApkAndApexKeysAvailable(self):
     input_file = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(input_file, 'w') as input_zip: