Merge "Replace incomplete path-based check with statx"
diff --git a/core/api/current.txt b/core/api/current.txt
index cf3938a..77a6fec 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -31081,6 +31081,7 @@
     field public static final int S_V2 = 32; // 0x20
     field public static final int TIRAMISU = 33; // 0x21
     field public static final int UPSIDE_DOWN_CAKE = 10000; // 0x2710
+    field public static final int VANILLA_ICE_CREAM = 10000; // 0x2710
   }
 
   public final class Bundle extends android.os.BaseBundle implements java.lang.Cloneable android.os.Parcelable {
diff --git a/core/api/module-lib-current.txt b/core/api/module-lib-current.txt
index c6c4daf..13a4899 100644
--- a/core/api/module-lib-current.txt
+++ b/core/api/module-lib-current.txt
@@ -17,10 +17,19 @@
 
   public class ActivityManager {
     method @RequiresPermission(android.Manifest.permission.SET_ACTIVITY_WATCHER) public void addHomeVisibilityListener(@NonNull java.util.concurrent.Executor, @NonNull android.app.HomeVisibilityListener);
+    method @NonNull @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public int[] getUidFrozenState(@NonNull int[]);
+    method @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public void registerUidFrozenStateChangedCallback(@NonNull java.util.concurrent.Executor, @NonNull android.app.ActivityManager.UidFrozenStateChangedCallback);
     method @RequiresPermission(android.Manifest.permission.SET_ACTIVITY_WATCHER) public void removeHomeVisibilityListener(@NonNull android.app.HomeVisibilityListener);
+    method @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public void unregisterUidFrozenStateChangedCallback(@NonNull android.app.ActivityManager.UidFrozenStateChangedCallback);
     method @RequiresPermission(android.Manifest.permission.CHANGE_CONFIGURATION) public boolean updateMccMncConfiguration(@NonNull String, @NonNull String);
   }
 
+  public static interface ActivityManager.UidFrozenStateChangedCallback {
+    method public void onUidFrozenStateChanged(@NonNull int[], @NonNull int[]);
+    field public static final int UID_FROZEN_STATE_FROZEN = 1; // 0x1
+    field public static final int UID_FROZEN_STATE_UNFROZEN = 2; // 0x2
+  }
+
   public class AppOpsManager {
     field public static final String OPSTR_NO_ISOLATED_STORAGE = "android:no_isolated_storage";
   }
diff --git a/core/api/test-current.txt b/core/api/test-current.txt
index 6a5ef3a..08ff534 100644
--- a/core/api/test-current.txt
+++ b/core/api/test-current.txt
@@ -122,16 +122,19 @@
     method @RequiresPermission(android.Manifest.permission.SET_ACTIVITY_WATCHER) public void addHomeVisibilityListener(@NonNull java.util.concurrent.Executor, @NonNull android.app.HomeVisibilityListener);
     method public void alwaysShowUnsupportedCompileSdkWarning(android.content.ComponentName);
     method public long getTotalRam();
+    method @NonNull @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public int[] getUidFrozenState(@NonNull int[]);
     method @RequiresPermission(allOf={android.Manifest.permission.PACKAGE_USAGE_STATS, android.Manifest.permission.INTERACT_ACROSS_USERS_FULL}, conditional=true) public int getUidProcessCapabilities(int);
     method @RequiresPermission(allOf={android.Manifest.permission.PACKAGE_USAGE_STATS, android.Manifest.permission.INTERACT_ACROSS_USERS_FULL}, conditional=true) public int getUidProcessState(int);
     method public void holdLock(android.os.IBinder, int);
     method public static boolean isHighEndGfx();
+    method @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public void registerUidFrozenStateChangedCallback(@NonNull java.util.concurrent.Executor, @NonNull android.app.ActivityManager.UidFrozenStateChangedCallback);
     method @RequiresPermission(android.Manifest.permission.SET_ACTIVITY_WATCHER) public void removeHomeVisibilityListener(@NonNull android.app.HomeVisibilityListener);
     method @RequiresPermission(android.Manifest.permission.RESET_APP_ERRORS) public void resetAppErrors();
     method public static void resumeAppSwitches() throws android.os.RemoteException;
     method @RequiresPermission(android.Manifest.permission.CHANGE_CONFIGURATION) public void scheduleApplicationInfoChanged(java.util.List<java.lang.String>, int);
     method @RequiresPermission(anyOf={android.Manifest.permission.MANAGE_USERS, android.Manifest.permission.INTERACT_ACROSS_USERS}) public void setStopUserOnSwitch(int);
     method @RequiresPermission(android.Manifest.permission.INTERACT_ACROSS_USERS_FULL) public boolean stopUser(int, boolean);
+    method @RequiresPermission(android.Manifest.permission.PACKAGE_USAGE_STATS) public void unregisterUidFrozenStateChangedCallback(@NonNull android.app.ActivityManager.UidFrozenStateChangedCallback);
     method @RequiresPermission(android.Manifest.permission.CHANGE_CONFIGURATION) public boolean updateMccMncConfiguration(@NonNull String, @NonNull String);
     method @RequiresPermission(android.Manifest.permission.DUMP) public void waitForBroadcastIdle();
     field public static final long LOCK_DOWN_CLOSE_SYSTEM_DIALOGS = 174664365L; // 0xa692aadL
@@ -161,6 +164,12 @@
     method @Nullable public String getIconResourcePackage();
   }
 
+  public static interface ActivityManager.UidFrozenStateChangedCallback {
+    method public void onUidFrozenStateChanged(@NonNull int[], @NonNull int[]);
+    field public static final int UID_FROZEN_STATE_FROZEN = 1; // 0x1
+    field public static final int UID_FROZEN_STATE_UNFROZEN = 2; // 0x2
+  }
+
   public class ActivityOptions {
     method public boolean isEligibleForLegacyPermissionPrompt();
     method @NonNull public static android.app.ActivityOptions makeCustomAnimation(@NonNull android.content.Context, int, int, int, @Nullable android.os.Handler, @Nullable android.app.ActivityOptions.OnAnimationStartedListener, @Nullable android.app.ActivityOptions.OnAnimationFinishedListener);
diff --git a/core/java/android/app/ActivityManager.java b/core/java/android/app/ActivityManager.java
index d328b34..9328664 100644
--- a/core/java/android/app/ActivityManager.java
+++ b/core/java/android/app/ActivityManager.java
@@ -231,6 +231,114 @@
     final ArrayMap<OnUidImportanceListener, UidObserver> mImportanceListeners = new ArrayMap<>();
 
     /**
+     * Callback object for {@link #registerUidFrozenStateChangedCallback}
+     *
+     * @hide
+     */
+    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+    @TestApi
+    public interface UidFrozenStateChangedCallback {
+        /**
+         * Indicates that the UID was frozen.
+         *
+         * @hide
+         */
+        @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+        @TestApi
+        int UID_FROZEN_STATE_FROZEN = 1;
+
+        /**
+         * Indicates that the UID was unfrozen.
+         *
+         * @hide
+         */
+        @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+        @TestApi
+        int UID_FROZEN_STATE_UNFROZEN = 2;
+
+        /**
+         * @hide
+         */
+        @Retention(RetentionPolicy.SOURCE)
+        @IntDef(flag = false, prefix = {"UID_FROZEN_STATE_"}, value = {
+                UID_FROZEN_STATE_FROZEN,
+                UID_FROZEN_STATE_UNFROZEN,
+        })
+        public @interface UidFrozenState {}
+
+        /**
+         * Notify the client that the frozen states of an array of UIDs have changed.
+         *
+         * @param uids The UIDs for which the frozen state has changed
+         * @param frozenStates Frozen state for each UID index, Will be set to
+         *               {@link UidFrozenStateChangedCallback#UID_FROZEN_STATE_FROZEN}
+         *               when the UID is frozen. When the UID is unfrozen,
+         *               {@link UidFrozenStateChangedCallback#UID_FROZEN_STATE_UNFROZEN}
+         *               will be set.
+         *
+         * @hide
+         */
+        @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+        @TestApi
+        void onUidFrozenStateChanged(@NonNull int[] uids,
+                @NonNull @UidFrozenState int[] frozenStates);
+    }
+
+    /**
+     * Register a {@link UidFrozenStateChangedCallback} object to receive notification
+     * when a UID is frozen or unfrozen. Will throw an exception if the same
+     * callback object is registered more than once.
+     *
+     * @param executor The executor that the callback will be run from.
+     * @param callback The callback to be registered. Callbacks for previous frozen/unfrozen
+     *                 UID changes will not be delivered. Only changes in state from the point of
+     *                 registration onward will be reported.
+     * @throws IllegalStateException if the {@code callback} is already registered.
+     *
+     * @hide
+     */
+    @RequiresPermission(Manifest.permission.PACKAGE_USAGE_STATS)
+    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+    @TestApi
+    public void registerUidFrozenStateChangedCallback(
+            @NonNull Executor executor,
+            @NonNull UidFrozenStateChangedCallback callback) {
+    }
+
+    /**
+     * Unregister a {@link UidFrozenStateChangedCallback} callback.
+     * @param callback The callback to be unregistered.
+     *
+     * @hide
+     */
+    @RequiresPermission(Manifest.permission.PACKAGE_USAGE_STATS)
+    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+    @TestApi
+    public void unregisterUidFrozenStateChangedCallback(
+            @NonNull UidFrozenStateChangedCallback callback) {
+    }
+
+    /**
+     * Query the frozen state of a list of UIDs.
+     *
+     * @param uids the array of UIDs which the client would like to know the frozen state of.
+     * @return An array containing the frozen state for each requested UID, by index. Will be set
+     *               to {@link UidFrozenStateChangedCallback#UID_FROZEN_STATE_FROZEN}
+     *               if the UID is frozen. If the UID is not frozen or not found,
+     *               {@link UidFrozenStateChangedCallback#UID_FROZEN_STATE_UNFROZEN}
+     *               will be set.
+     *
+     * @hide
+     */
+    @RequiresPermission(Manifest.permission.PACKAGE_USAGE_STATS)
+    @SystemApi(client = SystemApi.Client.MODULE_LIBRARIES)
+    @TestApi
+    public @NonNull @UidFrozenStateChangedCallback.UidFrozenState
+            int[] getUidFrozenState(@NonNull int[] uids) {
+        return new int[uids.length];
+    }
+
+    /**
      * <a href="{@docRoot}guide/topics/manifest/meta-data-element.html">{@code
      * <meta-data>}</a> name for a 'home' Activity that declares a package that is to be
      * uninstalled in lieu of the declaring one.  The package named here must be
diff --git a/core/java/android/net/metrics/WakeupStats.java b/core/java/android/net/metrics/WakeupStats.java
index bb36536..fac747c 100644
--- a/core/java/android/net/metrics/WakeupStats.java
+++ b/core/java/android/net/metrics/WakeupStats.java
@@ -80,18 +80,20 @@
                 break;
         }
 
-        switch (ev.dstHwAddr.getAddressType()) {
-            case MacAddress.TYPE_UNICAST:
-                l2UnicastCount++;
-                break;
-            case MacAddress.TYPE_MULTICAST:
-                l2MulticastCount++;
-                break;
-            case MacAddress.TYPE_BROADCAST:
-                l2BroadcastCount++;
-                break;
-            default:
-                break;
+        if (ev.dstHwAddr != null) {
+            switch (ev.dstHwAddr.getAddressType()) {
+                case MacAddress.TYPE_UNICAST:
+                    l2UnicastCount++;
+                    break;
+                case MacAddress.TYPE_MULTICAST:
+                    l2MulticastCount++;
+                    break;
+                case MacAddress.TYPE_BROADCAST:
+                    l2BroadcastCount++;
+                    break;
+                default:
+                    break;
+            }
         }
 
         increment(ethertypes, ev.ethertype);
diff --git a/core/java/android/os/Build.java b/core/java/android/os/Build.java
index 244632a..2e05b8d 100755
--- a/core/java/android/os/Build.java
+++ b/core/java/android/os/Build.java
@@ -1223,6 +1223,11 @@
          * Upside Down Cake.
          */
         public static final int UPSIDE_DOWN_CAKE = CUR_DEVELOPMENT;
+
+        /**
+         * Vanilla Ice Cream.
+         */
+        public static final int VANILLA_ICE_CREAM = CUR_DEVELOPMENT;
     }
 
     /** The type of build, like "user" or "eng". */
diff --git a/core/xsd/vts/OWNERS b/core/xsd/vts/OWNERS
new file mode 100644
index 0000000..9af2eba
--- /dev/null
+++ b/core/xsd/vts/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 151862
+sundongahn@google.com
diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java b/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java
index 7571e44..d129891 100644
--- a/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java
+++ b/keystore/java/android/security/keystore2/AndroidKeyStoreCipherSpiBase.java
@@ -24,6 +24,7 @@
 import android.security.KeyStoreOperation;
 import android.security.keymaster.KeymasterDefs;
 import android.security.keystore.KeyStoreCryptoOperation;
+import android.system.keystore2.Authorization;
 
 import libcore.util.EmptyArray;
 
@@ -119,6 +120,14 @@
         mCipher = null;
     }
 
+    private Authorization[] getKeyCharacteristics(Key key) {
+        if (!(key instanceof AndroidKeyStoreKey)) {
+            return new Authorization[] {};
+        }
+
+        return ((AndroidKeyStoreKey) key).getAuthorizations();
+    }
+
     @Override
     protected final void engineInit(int opmode, Key key, SecureRandom random)
             throws InvalidKeyException {
@@ -173,7 +182,7 @@
             init(opmode, key, random);
             initAlgorithmSpecificParameters();
             try {
-                ensureKeystoreOperationInitialized();
+                ensureKeystoreOperationInitialized(getKeyCharacteristics(key));
             } catch (InvalidAlgorithmParameterException e) {
                 throw new InvalidKeyException(e);
             }
@@ -206,7 +215,7 @@
         try {
             init(opmode, key, random);
             initAlgorithmSpecificParameters(params);
-            ensureKeystoreOperationInitialized();
+            ensureKeystoreOperationInitialized(getKeyCharacteristics(key));
             success = true;
         } finally {
             if (!success) {
@@ -236,7 +245,7 @@
         try {
             init(opmode, key, random);
             initAlgorithmSpecificParameters(params);
-            ensureKeystoreOperationInitialized();
+            ensureKeystoreOperationInitialized(getKeyCharacteristics(key));
             success = true;
         } finally {
             if (!success) {
@@ -310,7 +319,8 @@
         mCachedException = null;
     }
 
-    private void ensureKeystoreOperationInitialized() throws InvalidKeyException,
+    private void ensureKeystoreOperationInitialized(Authorization[] keyCharacteristics)
+            throws InvalidKeyException,
             InvalidAlgorithmParameterException {
         if (mMainDataStreamer != null) {
             return;
@@ -323,7 +333,7 @@
         }
 
         List<KeyParameter> parameters = new ArrayList<>();
-        addAlgorithmSpecificParametersToBegin(parameters);
+        addAlgorithmSpecificParametersToBegin(parameters, keyCharacteristics);
 
         int purpose;
         if (mKeymasterPurposeOverride != -1) {
@@ -404,7 +414,7 @@
             return null;
         }
         try {
-            ensureKeystoreOperationInitialized();
+            ensureKeystoreOperationInitialized(getKeyCharacteristics(mKey));
         } catch (InvalidKeyException | InvalidAlgorithmParameterException e) {
             mCachedException = e;
             return null;
@@ -520,7 +530,7 @@
         }
 
         try {
-            ensureKeystoreOperationInitialized();
+            ensureKeystoreOperationInitialized(getKeyCharacteristics(mKey));
         } catch (InvalidKeyException | InvalidAlgorithmParameterException e) {
             mCachedException = e;
             return;
@@ -597,7 +607,7 @@
         }
 
         try {
-            ensureKeystoreOperationInitialized();
+            ensureKeystoreOperationInitialized(getKeyCharacteristics(mKey));
         } catch (InvalidKeyException | InvalidAlgorithmParameterException e) {
             throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
         }
@@ -1012,6 +1022,22 @@
             @NonNull List<KeyParameter> parameters);
 
     /**
+     * Invoked to add algorithm-specific parameters for the KeyStore's {@code begin} operation,
+     * including the key characteristics. This is useful in case the parameters to {@code begin}
+     * depend on how the key was generated.
+     * The default implementation provided here simply ignores these key characteristics because
+     * they are not be needed for most engines.
+     *
+     * @param parameters keystore/keymaster arguments to be populated with algorithm-specific
+     *                   parameters.
+     * @param keyCharacteristics The key's characteristics.
+     */
+    protected void addAlgorithmSpecificParametersToBegin(
+            @NonNull List<KeyParameter> parameters, Authorization[] keyCharacteristics) {
+        addAlgorithmSpecificParametersToBegin(parameters);
+    }
+
+    /**
      * Invoked to obtain algorithm-specific parameters from the result of the KeyStore's
      * {@code begin} operation.
      *
diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java
index e9b66aa..3bb2564 100644
--- a/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java
+++ b/keystore/java/android/security/keystore2/AndroidKeyStoreRSACipherSpi.java
@@ -288,16 +288,34 @@
             }
         }
 
+        private static boolean isMgfDigestTagPresentInKeyProperties(
+                Authorization[] keyCharacteristics) {
+            for (Authorization authorization : keyCharacteristics) {
+                if (authorization.keyParameter.tag == KeymasterDefs.KM_TAG_RSA_OAEP_MGF_DIGEST) {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
         @Override
         protected final void addAlgorithmSpecificParametersToBegin(
-                @NonNull List<KeyParameter> parameters) {
-            super.addAlgorithmSpecificParametersToBegin(parameters);
+                @NonNull List<KeyParameter> parameters, Authorization[] keyCharacteristics) {
+            super.addAlgorithmSpecificParametersToBegin(parameters, keyCharacteristics);
             parameters.add(KeyStore2ParameterUtils.makeEnum(
                     KeymasterDefs.KM_TAG_DIGEST, mKeymasterDigest
             ));
-            parameters.add(KeyStore2ParameterUtils.makeEnum(
-                    KeymasterDefs.KM_TAG_RSA_OAEP_MGF_DIGEST, mKeymasterMgf1Digest
-            ));
+            // Only add the KM_TAG_RSA_OAEP_MGF_DIGEST tag to begin() if the MGF Digest is
+            // present in the key properties. Keys generated prior to Android 14 did not have
+            // this tag (Keystore didn't add it) so specifying any MGF digest tag would cause
+            // a begin() operation (on an Android 14 device) to fail (with a key that was generated
+            // on Android 13 or below).
+            if (isMgfDigestTagPresentInKeyProperties(keyCharacteristics)) {
+                parameters.add(KeyStore2ParameterUtils.makeEnum(
+                        KeymasterDefs.KM_TAG_RSA_OAEP_MGF_DIGEST, mKeymasterMgf1Digest
+                ));
+            }
         }
 
         @Override
diff --git a/libs/hwui/AndroidTest.xml b/libs/hwui/AndroidTest.xml
index 911315f..75f61f5 100644
--- a/libs/hwui/AndroidTest.xml
+++ b/libs/hwui/AndroidTest.xml
@@ -21,6 +21,7 @@
         <option name="push" value="hwuimacro->/data/local/tmp/benchmarktest/hwuimacro" />
     </target_preparer>
     <option name="test-suite-tag" value="apct" />
+    <option name="not-shardable" value="true" />
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp/nativetest" />
         <option name="module-name" value="hwui_unit_tests" />
diff --git a/libs/hwui/pipeline/skia/SkiaOpenGLPipeline.cpp b/libs/hwui/pipeline/skia/SkiaOpenGLPipeline.cpp
index 63c36f8..b5c1b49 100644
--- a/libs/hwui/pipeline/skia/SkiaOpenGLPipeline.cpp
+++ b/libs/hwui/pipeline/skia/SkiaOpenGLPipeline.cpp
@@ -66,12 +66,15 @@
         return MakeCurrentResult::AlreadyCurrent;
     }
 
-    // Make sure read/draw buffer state of default framebuffer is GL_BACK. Vendor implementations
+    EGLint majorVersion = 0;
+    eglQueryContext(eglGetCurrentDisplay(), eglGetCurrentContext(), EGL_CONTEXT_CLIENT_VERSION, &majorVersion);
+
+    // Make sure read/draw buffer state of default framebuffer is GL_BACK for ES 3.X. Vendor implementations
     // disagree on the draw/read buffer state if the default framebuffer transitions from a surface
     // to EGL_NO_SURFACE and vice-versa. There was a related discussion within Khronos on this topic.
     // See https://cvs.khronos.org/bugzilla/show_bug.cgi?id=13534.
     // The discussion was not resolved with a clear consensus
-    if (error == 0 && wasSurfaceless && mEglSurface != EGL_NO_SURFACE) {
+    if (error == 0 && (majorVersion > 2) && wasSurfaceless && mEglSurface != EGL_NO_SURFACE) {
         GLint curReadFB = 0;
         GLint curDrawFB = 0;
         glGetIntegerv(GL_READ_FRAMEBUFFER_BINDING, &curReadFB);
diff --git a/media/java/android/media/audiopolicy/AudioMix.java b/media/java/android/media/audiopolicy/AudioMix.java
index f85bdee..094a33f 100644
--- a/media/java/android/media/audiopolicy/AudioMix.java
+++ b/media/java/android/media/audiopolicy/AudioMix.java
@@ -25,6 +25,8 @@
 import android.media.AudioSystem;
 import android.os.Build;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Objects;
@@ -252,10 +254,10 @@
         if (o == null || getClass() != o.getClass()) return false;
 
         final AudioMix that = (AudioMix) o;
-        return (this.mRouteFlags == that.mRouteFlags)
-                && (this.mRule == that.mRule)
-                && (this.mMixType == that.mMixType)
-                && (this.mFormat == that.mFormat);
+        return Objects.equals(this.mRouteFlags, that.mRouteFlags)
+            && Objects.equals(this.mRule, that.mRule)
+            && Objects.equals(this.mMixType, that.mMixType)
+            && Objects.equals(this.mFormat, that.mFormat);
     }
 
     /** @hide */
@@ -340,7 +342,8 @@
          * @param address
          * @return the same Builder instance.
          */
-        Builder setDevice(int deviceType, String address) {
+        @VisibleForTesting
+        public Builder setDevice(int deviceType, String address) {
             mDeviceSystemType = deviceType;
             mDeviceAddress = address;
             return this;
diff --git a/media/java/android/media/musicrecognition/OWNERS b/media/java/android/media/musicrecognition/OWNERS
index 58f5d40..037b048 100644
--- a/media/java/android/media/musicrecognition/OWNERS
+++ b/media/java/android/media/musicrecognition/OWNERS
@@ -1,6 +1,5 @@
 # Bug component: 830636
 
-joannechung@google.com
 oni@google.com
 volnov@google.com
 
diff --git a/packages/SettingsLib/src/com/android/settingslib/bluetooth/CachedBluetoothDevice.java b/packages/SettingsLib/src/com/android/settingslib/bluetooth/CachedBluetoothDevice.java
index fe448fc..6748e9c 100644
--- a/packages/SettingsLib/src/com/android/settingslib/bluetooth/CachedBluetoothDevice.java
+++ b/packages/SettingsLib/src/com/android/settingslib/bluetooth/CachedBluetoothDevice.java
@@ -576,9 +576,14 @@
      */
     public void setName(String name) {
         // Prevent getName() to be set to null if setName(null) is called
-        if (name != null && !TextUtils.equals(name, getName())) {
-            mDevice.setAlias(name);
-            dispatchAttributesChanged();
+        if (name == null || TextUtils.equals(name, getName())) {
+            return;
+        }
+        mDevice.setAlias(name);
+        dispatchAttributesChanged();
+
+        for (CachedBluetoothDevice cbd : mMemberDevices) {
+            cbd.setName(name);
         }
     }
 
diff --git a/packages/SettingsLib/src/com/android/settingslib/license/LicenseHtmlGeneratorFromXml.java b/packages/SettingsLib/src/com/android/settingslib/license/LicenseHtmlGeneratorFromXml.java
index fb3f382..e91d697 100644
--- a/packages/SettingsLib/src/com/android/settingslib/license/LicenseHtmlGeneratorFromXml.java
+++ b/packages/SettingsLib/src/com/android/settingslib/license/LicenseHtmlGeneratorFromXml.java
@@ -324,6 +324,7 @@
 
         if (!TextUtils.isEmpty(noticeHeader)) {
             writer.println(noticeHeader);
+            writer.println("<br/>");
         }
 
         int count = 0;
diff --git a/services/core/java/com/android/server/TelephonyRegistry.java b/services/core/java/com/android/server/TelephonyRegistry.java
index 77a54a5..1afda65 100644
--- a/services/core/java/com/android/server/TelephonyRegistry.java
+++ b/services/core/java/com/android/server/TelephonyRegistry.java
@@ -1578,57 +1578,62 @@
             return;
         }
 
-        synchronized (mRecords) {
-            String str = "notifyServiceStateForSubscriber: subId=" + subId + " phoneId=" + phoneId
-                    + " state=" + state;
-            if (VDBG) {
-                log(str);
-            }
-            mLocalLog.log(str);
-            // for service state updates, don't notify clients when subId is invalid. This prevents
-            // us from sending incorrect notifications like b/133140128
-            // In the future, we can remove this logic for every notification here and add a
-            // callback so listeners know when their PhoneStateListener's subId becomes invalid, but
-            // for now we use the simplest fix.
-            if (validatePhoneId(phoneId) && SubscriptionManager.isValidSubscriptionId(subId)) {
-                mServiceState[phoneId] = state;
+        final long callingIdentity = Binder.clearCallingIdentity();
+        try {
+            synchronized (mRecords) {
+                String str = "notifyServiceStateForSubscriber: subId=" + subId + " phoneId="
+                        + phoneId + " state=" + state;
+                if (VDBG) {
+                    log(str);
+                }
+                mLocalLog.log(str);
+                // for service state updates, don't notify clients when subId is invalid. This
+                // prevents us from sending incorrect notifications like b/133140128
+                // In the future, we can remove this logic for every notification here and add a
+                // callback so listeners know when their PhoneStateListener's subId becomes invalid,
+                // but for now we use the simplest fix.
+                if (validatePhoneId(phoneId) && SubscriptionManager.isValidSubscriptionId(subId)) {
+                    mServiceState[phoneId] = state;
 
-                for (Record r : mRecords) {
-                    if (VDBG) {
-                        log("notifyServiceStateForSubscriber: r=" + r + " subId=" + subId
-                                + " phoneId=" + phoneId + " state=" + state);
-                    }
-                    if (r.matchTelephonyCallbackEvent(
-                            TelephonyCallback.EVENT_SERVICE_STATE_CHANGED)
-                            && idMatch(r, subId, phoneId)) {
+                    for (Record r : mRecords) {
+                        if (VDBG) {
+                            log("notifyServiceStateForSubscriber: r=" + r + " subId=" + subId
+                                    + " phoneId=" + phoneId + " state=" + state);
+                        }
+                        if (r.matchTelephonyCallbackEvent(
+                                TelephonyCallback.EVENT_SERVICE_STATE_CHANGED)
+                                && idMatch(r, subId, phoneId)) {
 
-                        try {
-                            ServiceState stateToSend;
-                            if (checkFineLocationAccess(r, Build.VERSION_CODES.Q)) {
-                                stateToSend = new ServiceState(state);
-                            } else if (checkCoarseLocationAccess(r, Build.VERSION_CODES.Q)) {
-                                stateToSend = state.createLocationInfoSanitizedCopy(false);
-                            } else {
-                                stateToSend = state.createLocationInfoSanitizedCopy(true);
+                            try {
+                                ServiceState stateToSend;
+                                if (checkFineLocationAccess(r, Build.VERSION_CODES.Q)) {
+                                    stateToSend = new ServiceState(state);
+                                } else if (checkCoarseLocationAccess(r, Build.VERSION_CODES.Q)) {
+                                    stateToSend = state.createLocationInfoSanitizedCopy(false);
+                                } else {
+                                    stateToSend = state.createLocationInfoSanitizedCopy(true);
+                                }
+                                if (DBG) {
+                                    log("notifyServiceStateForSubscriber: callback.onSSC r=" + r
+                                            + " subId=" + subId + " phoneId=" + phoneId
+                                            + " state=" + stateToSend);
+                                }
+                                r.callback.onServiceStateChanged(stateToSend);
+                            } catch (RemoteException ex) {
+                                mRemoveList.add(r.binder);
                             }
-                            if (DBG) {
-                                log("notifyServiceStateForSubscriber: callback.onSSC r=" + r
-                                        + " subId=" + subId + " phoneId=" + phoneId
-                                        + " state=" + state);
-                            }
-                            r.callback.onServiceStateChanged(stateToSend);
-                        } catch (RemoteException ex) {
-                            mRemoveList.add(r.binder);
                         }
                     }
+                } else {
+                    log("notifyServiceStateForSubscriber: INVALID phoneId=" + phoneId
+                            + " or subId=" + subId);
                 }
-            } else {
-                log("notifyServiceStateForSubscriber: INVALID phoneId=" + phoneId
-                        + " or subId=" + subId);
+                handleRemoveListLocked();
             }
-            handleRemoveListLocked();
+            broadcastServiceStateChanged(state, phoneId, subId);
+        } finally {
+            Binder.restoreCallingIdentity(callingIdentity);
         }
-        broadcastServiceStateChanged(state, phoneId, subId);
     }
 
     public void notifySimActivationStateChangedForPhoneId(int phoneId, int subId,
@@ -3161,13 +3166,10 @@
     public static final String ACTION_SIGNAL_STRENGTH_CHANGED = "android.intent.action.SIG_STR";
 
     private void broadcastServiceStateChanged(ServiceState state, int phoneId, int subId) {
-        final long ident = Binder.clearCallingIdentity();
         try {
             mBatteryStats.notePhoneState(state.getState());
         } catch (RemoteException re) {
             // Can't do much
-        } finally {
-            Binder.restoreCallingIdentity(ident);
         }
 
         // Send the broadcast exactly once to all possible disjoint sets of apps.
@@ -3184,8 +3186,7 @@
         // - Sanitized ServiceState sent to all other apps with READ_PHONE_STATE
         // - Sanitized ServiceState sent to all other apps with READ_PRIVILEGED_PHONE_STATE but not
         //   READ_PHONE_STATE
-        if (Binder.withCleanCallingIdentity(() ->
-                LocationAccessPolicy.isLocationModeEnabled(mContext, mContext.getUserId()))) {
+        if (LocationAccessPolicy.isLocationModeEnabled(mContext, mContext.getUserId())) {
             Intent fullIntent = createServiceStateIntent(state, subId, phoneId, false);
             mContext.createContextAsUser(UserHandle.ALL, 0).sendBroadcastMultiplePermissions(
                     fullIntent,
diff --git a/services/core/java/com/android/server/connectivity/NetdEventListenerService.java b/services/core/java/com/android/server/connectivity/NetdEventListenerService.java
index 1f82961..6d43061 100644
--- a/services/core/java/com/android/server/connectivity/NetdEventListenerService.java
+++ b/services/core/java/com/android/server/connectivity/NetdEventListenerService.java
@@ -41,6 +41,7 @@
 
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.annotations.VisibleForTesting;
+import com.android.internal.util.ArrayUtils;
 import com.android.internal.util.BitUtils;
 import com.android.internal.util.FrameworkStatsLog;
 import com.android.internal.util.RingBuffer;
@@ -278,6 +279,11 @@
         }
     }
 
+    private boolean hasWifiTransport(Network network) {
+        final NetworkCapabilities nc = mCm.getNetworkCapabilities(network);
+        return nc.hasTransport(NetworkCapabilities.TRANSPORT_WIFI);
+    }
+
     @Override
     public synchronized void onWakeupEvent(String prefix, int uid, int ethertype, int ipNextHeader,
             byte[] dstHw, String srcIp, String dstIp, int srcPort, int dstPort, long timestampNs) {
@@ -286,12 +292,21 @@
             throw new IllegalArgumentException("Prefix " + prefix
                     + " required in format <nethandle>:<interface>");
         }
+        final long netHandle = Long.parseLong(prefixParts[0]);
+        final Network network = Network.fromNetworkHandle(netHandle);
 
         final WakeupEvent event = new WakeupEvent();
         event.iface = prefixParts[1];
         event.uid = uid;
         event.ethertype = ethertype;
-        event.dstHwAddr = MacAddress.fromBytes(dstHw);
+        if (ArrayUtils.isEmpty(dstHw)) {
+            if (hasWifiTransport(network)) {
+                Log.e(TAG, "Empty mac address on WiFi transport, network: " + network);
+            }
+            event.dstHwAddr = null;
+        } else {
+            event.dstHwAddr = MacAddress.fromBytes(dstHw);
+        }
         event.srcIp = srcIp;
         event.dstIp = dstIp;
         event.ipNextHeader = ipNextHeader;
@@ -306,14 +321,12 @@
 
         final BatteryStatsInternal bsi = LocalServices.getService(BatteryStatsInternal.class);
         if (bsi != null) {
-            final long netHandle = Long.parseLong(prefixParts[0]);
             final long elapsedMs = SystemClock.elapsedRealtime() + event.timestampMs
                     - System.currentTimeMillis();
-            bsi.noteCpuWakingNetworkPacket(Network.fromNetworkHandle(netHandle), elapsedMs,
-                    event.uid);
+            bsi.noteCpuWakingNetworkPacket(network, elapsedMs, event.uid);
         }
 
-        final String dstMac = event.dstHwAddr.toString();
+        final String dstMac = String.valueOf(event.dstHwAddr);
         FrameworkStatsLog.write(FrameworkStatsLog.PACKET_WAKEUP_OCCURRED,
                 uid, event.iface, ethertype, dstMac, srcIp, dstIp, ipNextHeader, srcPort, dstPort);
     }
diff --git a/services/core/java/com/android/server/connectivity/Vpn.java b/services/core/java/com/android/server/connectivity/Vpn.java
index 1dc2725..d2341448 100644
--- a/services/core/java/com/android/server/connectivity/Vpn.java
+++ b/services/core/java/com/android/server/connectivity/Vpn.java
@@ -85,6 +85,7 @@
 import android.net.NetworkSpecifier;
 import android.net.RouteInfo;
 import android.net.TelephonyNetworkSpecifier;
+import android.net.TransportInfo;
 import android.net.UidRangeParcel;
 import android.net.UnderlyingNetworkInfo;
 import android.net.Uri;
@@ -107,6 +108,8 @@
 import android.net.ipsec.ike.exceptions.IkeNonProtocolException;
 import android.net.ipsec.ike.exceptions.IkeProtocolException;
 import android.net.ipsec.ike.exceptions.IkeTimeoutException;
+import android.net.vcn.VcnGatewayConnectionConfig;
+import android.net.vcn.VcnTransportInfo;
 import android.os.Binder;
 import android.os.Build.VERSION_CODES;
 import android.os.Bundle;
@@ -3556,39 +3559,63 @@
         }
 
         private int guessEspIpVersionForNetwork() {
-            final CarrierConfigInfo carrierconfig = getCarrierConfig();
+            if (mUnderlyingNetworkCapabilities.getTransportInfo() instanceof VcnTransportInfo) {
+                Log.d(TAG, "Running over VCN, esp IP version is auto");
+                return ESP_IP_VERSION_AUTO;
+            }
+            final CarrierConfigInfo carrierconfig = getCarrierConfigForUnderlyingNetwork();
             final int ipVersion = (carrierconfig != null)
                     ? carrierconfig.ipVersion : ESP_IP_VERSION_AUTO;
             if (carrierconfig != null) {
-                Log.d(TAG, "Get customized IP version(" + ipVersion + ") on SIM("
+                Log.d(TAG, "Get customized IP version (" + ipVersion + ") on SIM (mccmnc="
                         + carrierconfig.mccMnc + ")");
             }
             return ipVersion;
         }
 
         private int guessEspEncapTypeForNetwork() {
-            final CarrierConfigInfo carrierconfig = getCarrierConfig();
+            if (mUnderlyingNetworkCapabilities.getTransportInfo() instanceof VcnTransportInfo) {
+                Log.d(TAG, "Running over VCN, encap type is auto");
+                return ESP_ENCAP_TYPE_AUTO;
+            }
+            final CarrierConfigInfo carrierconfig = getCarrierConfigForUnderlyingNetwork();
             final int encapType = (carrierconfig != null)
                     ? carrierconfig.encapType : ESP_ENCAP_TYPE_AUTO;
             if (carrierconfig != null) {
-                Log.d(TAG, "Get customized encap type(" + encapType + ") on SIM("
+                Log.d(TAG, "Get customized encap type (" + encapType + ") on SIM (mccmnc="
                         + carrierconfig.mccMnc + ")");
             }
             return encapType;
         }
 
+
         private int guessNattKeepaliveTimerForNetwork() {
-            final CarrierConfigInfo carrierconfig = getCarrierConfig();
-            final int natKeepalive = (carrierconfig != null)
+            final TransportInfo transportInfo = mUnderlyingNetworkCapabilities.getTransportInfo();
+            if (transportInfo instanceof VcnTransportInfo) {
+                final int nattKeepaliveSec =
+                        ((VcnTransportInfo) transportInfo).getMinUdpPort4500NatTimeoutSeconds();
+                Log.d(TAG, "Running over VCN, keepalive timer : " + nattKeepaliveSec + "s");
+                if (VcnGatewayConnectionConfig.MIN_UDP_PORT_4500_NAT_TIMEOUT_UNSET
+                        != nattKeepaliveSec) {
+                    return nattKeepaliveSec;
+                }
+                // else fall back to carrier config, if any
+            }
+            final CarrierConfigInfo carrierconfig = getCarrierConfigForUnderlyingNetwork();
+            final int nattKeepaliveSec = (carrierconfig != null)
                     ? carrierconfig.keepaliveDelayMs : AUTOMATIC_KEEPALIVE_DELAY_SECONDS;
             if (carrierconfig != null) {
-                Log.d(TAG, "Get customized keepalive(" + natKeepalive + ") on SIM("
+                Log.d(TAG, "Get customized keepalive (" + nattKeepaliveSec + "s) on SIM (mccmnc="
                         + carrierconfig.mccMnc + ")");
             }
-            return natKeepalive;
+            return nattKeepaliveSec;
         }
 
-        private CarrierConfigInfo getCarrierConfig() {
+        /**
+         * Returns the carrier config for the underlying network, or null if not a cell network.
+         */
+        @Nullable
+        private CarrierConfigInfo getCarrierConfigForUnderlyingNetwork() {
             final int subId = getCellSubIdForNetworkCapabilities(mUnderlyingNetworkCapabilities);
             if (subId == SubscriptionManager.INVALID_SUBSCRIPTION_ID) {
                 Log.d(TAG, "Underlying network is not a cellular network");
diff --git a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
index 714be18..be719e3 100644
--- a/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
+++ b/services/core/java/com/android/server/pm/PackageManagerServiceUtils.java
@@ -38,7 +38,7 @@
 import android.annotation.UserIdInt;
 import android.app.ActivityManager;
 import android.compat.annotation.ChangeId;
-import android.compat.annotation.EnabledSince;
+import android.compat.annotation.Disabled;
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
@@ -155,7 +155,7 @@
      * allow 3P apps to trigger internal-only functionality.
      */
     @ChangeId
-    @EnabledSince(targetSdkVersion = Build.VERSION_CODES.TIRAMISU)
+    @Disabled  /* Revert enforcement: b/274147456 */
     private static final long ENFORCE_INTENTS_TO_MATCH_INTENT_FILTERS = 161252188;
 
     /**
diff --git a/services/core/java/com/android/server/security/rkp/RemoteProvisioningRegistration.java b/services/core/java/com/android/server/security/rkp/RemoteProvisioningRegistration.java
index f586126..7d148f6 100644
--- a/services/core/java/com/android/server/security/rkp/RemoteProvisioningRegistration.java
+++ b/services/core/java/com/android/server/security/rkp/RemoteProvisioningRegistration.java
@@ -17,6 +17,7 @@
 package com.android.server.security.rkp;
 
 import android.os.CancellationSignal;
+import android.os.IBinder;
 import android.os.OperationCanceledException;
 import android.os.OutcomeReceiver;
 import android.security.rkp.IGetKeyCallback;
@@ -39,23 +40,23 @@
  */
 final class RemoteProvisioningRegistration extends IRegistration.Stub {
     static final String TAG = RemoteProvisioningService.TAG;
-    private final ConcurrentHashMap<IGetKeyCallback, CancellationSignal> mGetKeyOperations =
+    private final ConcurrentHashMap<IBinder, CancellationSignal> mGetKeyOperations =
             new ConcurrentHashMap<>();
-    private final Set<IStoreUpgradedKeyCallback> mStoreUpgradedKeyOperations =
-            ConcurrentHashMap.newKeySet();
+    private final Set<IBinder> mStoreUpgradedKeyOperations = ConcurrentHashMap.newKeySet();
     private final RegistrationProxy mRegistration;
     private final Executor mExecutor;
 
     private class GetKeyReceiver implements OutcomeReceiver<RemotelyProvisionedKey, Exception> {
         IGetKeyCallback mCallback;
+
         GetKeyReceiver(IGetKeyCallback callback) {
             mCallback = callback;
         }
 
         @Override
         public void onResult(RemotelyProvisionedKey result) {
-            mGetKeyOperations.remove(mCallback);
-            Log.i(TAG, "Successfully fetched key for client " + mCallback.hashCode());
+            mGetKeyOperations.remove(mCallback.asBinder());
+            Log.i(TAG, "Successfully fetched key for client " + mCallback.asBinder().hashCode());
             android.security.rkp.RemotelyProvisionedKey parcelable =
                     new android.security.rkp.RemotelyProvisionedKey();
             parcelable.keyBlob = result.getKeyBlob();
@@ -65,19 +66,21 @@
 
         @Override
         public void onError(Exception e) {
-            mGetKeyOperations.remove(mCallback);
+            mGetKeyOperations.remove(mCallback.asBinder());
             if (e instanceof OperationCanceledException) {
-                Log.i(TAG, "Operation cancelled for client " + mCallback.hashCode());
+                Log.i(TAG, "Operation cancelled for client " + mCallback.asBinder().hashCode());
                 wrapCallback(mCallback::onCancel);
             } else if (e instanceof RkpProxyException) {
-                Log.e(TAG, "RKP error fetching key for client " + mCallback.hashCode() + ": "
+                Log.e(TAG, "RKP error fetching key for client " + mCallback.asBinder().hashCode()
+                        + ": "
                         + e.getMessage());
                 RkpProxyException rkpException = (RkpProxyException) e;
                 wrapCallback(() -> mCallback.onError(toGetKeyError(rkpException),
                         e.getMessage()));
             } else {
-                Log.e(TAG, "Unknown error fetching key for client " + mCallback.hashCode() + ": "
-                        + e.getMessage());
+                Log.e(TAG,
+                        "Unknown error fetching key for client " + mCallback.asBinder().hashCode()
+                                + ": " + e.getMessage());
                 wrapCallback(() -> mCallback.onError(IGetKeyCallback.ErrorCode.ERROR_UNKNOWN,
                         e.getMessage()));
             }
@@ -108,20 +111,23 @@
     @Override
     public void getKey(int keyId, IGetKeyCallback callback) {
         CancellationSignal cancellationSignal = new CancellationSignal();
-        if (mGetKeyOperations.putIfAbsent(callback, cancellationSignal) != null) {
-            Log.e(TAG, "Client can only request one call at a time " + callback.hashCode());
+        if (mGetKeyOperations.putIfAbsent(callback.asBinder(), cancellationSignal) != null) {
+            Log.e(TAG,
+                    "Client can only request one call at a time " + callback.asBinder().hashCode());
             throw new IllegalArgumentException(
                     "Callback is already associated with an existing operation: "
-                            + callback.hashCode());
+                            + callback.asBinder().hashCode());
         }
 
         try {
-            Log.i(TAG, "Fetching key " + keyId + " for client " + callback.hashCode());
+            Log.i(TAG, "Fetching key " + keyId + " for client " + callback.asBinder().hashCode());
             mRegistration.getKeyAsync(keyId, cancellationSignal, mExecutor,
                     new GetKeyReceiver(callback));
         } catch (Exception e) {
-            Log.e(TAG, "getKeyAsync threw an exception for client " + callback.hashCode(), e);
-            mGetKeyOperations.remove(callback);
+            Log.e(TAG,
+                    "getKeyAsync threw an exception for client " + callback.asBinder().hashCode(),
+                    e);
+            mGetKeyOperations.remove(callback.asBinder());
             wrapCallback(() -> callback.onError(IGetKeyCallback.ErrorCode.ERROR_UNKNOWN,
                     e.getMessage()));
         }
@@ -129,23 +135,23 @@
 
     @Override
     public void cancelGetKey(IGetKeyCallback callback) {
-        CancellationSignal cancellationSignal = mGetKeyOperations.remove(callback);
+        CancellationSignal cancellationSignal = mGetKeyOperations.remove(callback.asBinder());
         if (cancellationSignal == null) {
             throw new IllegalArgumentException(
-                    "Invalid client in cancelGetKey: " + callback.hashCode());
+                    "Invalid client in cancelGetKey: " + callback.asBinder().hashCode());
         }
 
-        Log.i(TAG, "Requesting cancellation for client " + callback.hashCode());
+        Log.i(TAG, "Requesting cancellation for client " + callback.asBinder().hashCode());
         cancellationSignal.cancel();
     }
 
     @Override
     public void storeUpgradedKeyAsync(byte[] oldKeyBlob, byte[] newKeyBlob,
             IStoreUpgradedKeyCallback callback) {
-        if (!mStoreUpgradedKeyOperations.add(callback)) {
+        if (!mStoreUpgradedKeyOperations.add(callback.asBinder())) {
             throw new IllegalArgumentException(
                     "Callback is already associated with an existing operation: "
-                            + callback.hashCode());
+                            + callback.asBinder().hashCode());
         }
 
         try {
@@ -153,20 +159,20 @@
                     new OutcomeReceiver<>() {
                         @Override
                         public void onResult(Void result) {
-                            mStoreUpgradedKeyOperations.remove(callback);
+                            mStoreUpgradedKeyOperations.remove(callback.asBinder());
                             wrapCallback(callback::onSuccess);
                         }
 
                         @Override
                         public void onError(Exception e) {
-                            mStoreUpgradedKeyOperations.remove(callback);
+                            mStoreUpgradedKeyOperations.remove(callback.asBinder());
                             wrapCallback(() -> callback.onError(e.getMessage()));
                         }
                     });
         } catch (Exception e) {
             Log.e(TAG, "storeUpgradedKeyAsync threw an exception for client "
-                    + callback.hashCode(), e);
-            mStoreUpgradedKeyOperations.remove(callback);
+                    + callback.asBinder().hashCode(), e);
+            mStoreUpgradedKeyOperations.remove(callback.asBinder());
             wrapCallback(() -> callback.onError(e.getMessage()));
         }
     }
diff --git a/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java b/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
index 97e4636..2bd7383 100644
--- a/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
+++ b/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
@@ -61,7 +61,7 @@
             try {
                 mCallback.onSuccess(new RemoteProvisioningRegistration(registration, mExecutor));
             } catch (RemoteException e) {
-                Log.e(TAG, "Error calling success callback " + mCallback.hashCode(), e);
+                Log.e(TAG, "Error calling success callback " + mCallback.asBinder().hashCode(), e);
             }
         }
 
@@ -70,7 +70,7 @@
             try {
                 mCallback.onError(error.toString());
             } catch (RemoteException e) {
-                Log.e(TAG, "Error calling error callback " + mCallback.hashCode(), e);
+                Log.e(TAG, "Error calling error callback " + mCallback.asBinder().hashCode(), e);
             }
         }
     }
diff --git a/services/core/java/com/android/server/wm/RemoteDisplayChangeController.java b/services/core/java/com/android/server/wm/RemoteDisplayChangeController.java
index 43baebc..e646f14 100644
--- a/services/core/java/com/android/server/wm/RemoteDisplayChangeController.java
+++ b/services/core/java/com/android/server/wm/RemoteDisplayChangeController.java
@@ -114,9 +114,15 @@
         // timed-out, so run all continue callbacks and clear the list
         synchronized (mService.mGlobalLock) {
             for (int i = 0; i < mCallbacks.size(); ++i) {
-                mCallbacks.get(i).onContinueRemoteDisplayChange(null /* transaction */);
+                final ContinueRemoteDisplayChangeCallback callback = mCallbacks.get(i);
+                if (i == mCallbacks.size() - 1) {
+                    // Clear all callbacks before calling the last one, so that if the callback
+                    // itself calls {@link #isWaitingForRemoteDisplayChange()}, it will get
+                    // {@code false}. After all, there is nothing pending after this one.
+                    mCallbacks.clear();
+                }
+                callback.onContinueRemoteDisplayChange(null /* transaction */);
             }
-            mCallbacks.clear();
         }
     }
 
diff --git a/services/core/xsd/vts/OWNERS b/services/core/xsd/vts/OWNERS
new file mode 100644
index 0000000..9af2eba
--- /dev/null
+++ b/services/core/xsd/vts/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 151862
+sundongahn@google.com
diff --git a/services/musicrecognition/OWNERS b/services/musicrecognition/OWNERS
index 58f5d40..037b048 100644
--- a/services/musicrecognition/OWNERS
+++ b/services/musicrecognition/OWNERS
@@ -1,6 +1,5 @@
 # Bug component: 830636
 
-joannechung@google.com
 oni@google.com
 volnov@google.com
 
diff --git a/services/profcollect/src/com/android/server/profcollect/ProfcollectForwardingService.java b/services/profcollect/src/com/android/server/profcollect/ProfcollectForwardingService.java
index f05b1d4..475966e 100644
--- a/services/profcollect/src/com/android/server/profcollect/ProfcollectForwardingService.java
+++ b/services/profcollect/src/com/android/server/profcollect/ProfcollectForwardingService.java
@@ -20,9 +20,11 @@
 import android.app.job.JobParameters;
 import android.app.job.JobScheduler;
 import android.app.job.JobService;
+import android.content.BroadcastReceiver;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
+import android.content.IntentFilter;
 import android.os.Handler;
 import android.os.IBinder.DeathRecipient;
 import android.os.Looper;
@@ -53,7 +55,8 @@
     public static final String LOG_TAG = "ProfcollectForwardingService";
 
     private static final boolean DEBUG = Log.isLoggable(LOG_TAG, Log.DEBUG);
-
+    private static final String INTENT_UPLOAD_PROFILES =
+            "com.android.server.profcollect.UPLOAD_PROFILES";
     private static final long BG_PROCESS_PERIOD = TimeUnit.HOURS.toMillis(4); // every 4 hours.
 
     private IProfCollectd mIProfcollect;
@@ -66,6 +69,16 @@
         }
     };
 
+    private final BroadcastReceiver mBroadcastReceiver = new BroadcastReceiver() {
+        @Override
+        public void onReceive(Context context, Intent intent) {
+            if (intent.getAction() == INTENT_UPLOAD_PROFILES) {
+                Log.d(LOG_TAG, "Received broadcast to pack and upload reports");
+                packAndUploadReport();
+            }
+        }
+    };
+
     public ProfcollectForwardingService(Context context) {
         super(context);
 
@@ -73,6 +86,10 @@
             throw new AssertionError("only one service instance allowed");
         }
         sSelfService = this;
+
+        final IntentFilter filter = new IntentFilter();
+        filter.addAction(INTENT_UPLOAD_PROFILES);
+        context.registerReceiver(mBroadcastReceiver, filter);
     }
 
     /**
@@ -296,7 +313,7 @@
                 }
 
                 if (status == UpdateEngine.UpdateStatusConstants.UPDATED_NEED_REBOOT) {
-                    packProfileReport();
+                    packAndUploadReport();
                 }
             }
 
@@ -307,7 +324,7 @@
         });
     }
 
-    private void packProfileReport() {
+    private void packAndUploadReport() {
         if (mIProfcollect == null) {
             return;
         }
diff --git a/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningRegistrationTest.java b/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningRegistrationTest.java
index 1dcd0b9..df7be51 100644
--- a/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningRegistrationTest.java
+++ b/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningRegistrationTest.java
@@ -23,8 +23,10 @@
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyInt;
 import static org.mockito.Mockito.argThat;
+import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.contains;
 import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.eq;
 import static org.mockito.Mockito.mock;
@@ -32,6 +34,7 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 
+import android.os.Binder;
 import android.os.CancellationSignal;
 import android.os.OperationCanceledException;
 import android.os.OutcomeReceiver;
@@ -101,8 +104,10 @@
                 .when(mRegistrationProxy).getKeyAsync(eq(42), any(), any(), any());
 
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.getKey(42, callback);
         verify(callback).onSuccess(matches(expectedKey));
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -114,8 +119,10 @@
                         executor.execute(() -> receiver.onError(expectedException))))
                 .when(mRegistrationProxy).getKeyAsync(eq(0), any(), any(), any());
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.getKey(0, callback);
         verify(callback).onError(eq(IGetKeyCallback.ErrorCode.ERROR_UNKNOWN), eq("oops!"));
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -140,18 +147,28 @@
                             executor.execute(() -> receiver.onError(expectedException))))
                     .when(mRegistrationProxy).getKeyAsync(eq(0), any(), any(), any());
             IGetKeyCallback callback = mock(IGetKeyCallback.class);
+            doReturn(new Binder()).when(callback).asBinder();
             mRegistration.getKey(0, callback);
             verify(callback).onError(eq(error), contains(errorField.getName()));
+            verify(callback, atLeastOnce()).asBinder();
             verifyNoMoreInteractions(callback);
         }
     }
 
     @Test
     public void getKeyCancelDuringProxyOperation() throws Exception {
+        final Binder theBinder = new Binder();
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(theBinder).when(callback).asBinder();
         doAnswer(
                 answerGetKeyAsync((keyId, cancelSignal, executor, receiver) -> {
-                    mRegistration.cancelGetKey(callback);
+                    // Use a different callback object to ensure that the callback equivalence
+                    // relies on the actual IBinder object.
+                    IGetKeyCallback differentCallback = mock(IGetKeyCallback.class);
+                    doReturn(theBinder).when(differentCallback).asBinder();
+                    mRegistration.cancelGetKey(differentCallback);
+                    verify(differentCallback, atLeastOnce()).asBinder();
+                    verifyNoMoreInteractions(differentCallback);
                     assertThat(cancelSignal.isCanceled()).isTrue();
                     executor.execute(() -> receiver.onError(new OperationCanceledException()));
                 }))
@@ -159,18 +176,21 @@
 
         mRegistration.getKey(Integer.MAX_VALUE, callback);
         verify(callback).onCancel();
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
     @Test
     public void cancelGetKeyWithInvalidCallback() throws Exception {
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         assertThrows(IllegalArgumentException.class, () -> mRegistration.cancelGetKey(callback));
     }
 
     @Test
     public void getKeyRejectsDuplicateCallback() throws Exception {
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         doAnswer(
                 answerGetKeyAsync((keyId, cancelSignal, executor, receiver) -> {
                     assertThrows(IllegalArgumentException.class, () ->
@@ -181,12 +201,14 @@
 
         mRegistration.getKey(0, callback);
         verify(callback, times(1)).onSuccess(any());
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
     @Test
     public void getKeyCancelAfterCompleteFails() throws Exception {
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         doAnswer(
                 answerGetKeyAsync((keyId, cancelSignal, executor, receiver) ->
                         executor.execute(() ->
@@ -197,6 +219,7 @@
         mRegistration.getKey(Integer.MIN_VALUE, callback);
         verify(callback).onSuccess(any());
         assertThrows(IllegalArgumentException.class, () -> mRegistration.cancelGetKey(callback));
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -208,10 +231,12 @@
                 .getKeyAsync(anyInt(), any(), any(), any());
 
         IGetKeyCallback callback = mock(IGetKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.getKey(0, callback);
         verify(callback).onError(eq(IGetKeyCallback.ErrorCode.ERROR_UNKNOWN),
                 eq(expectedException.getMessage()));
         assertThrows(IllegalArgumentException.class, () -> mRegistration.cancelGetKey(callback));
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -224,8 +249,10 @@
                 .storeUpgradedKeyAsync(any(), any(), any(), any());
 
         IStoreUpgradedKeyCallback callback = mock(IStoreUpgradedKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.storeUpgradedKeyAsync(new byte[0], new byte[0], callback);
         verify(callback).onSuccess();
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -239,8 +266,10 @@
                 .storeUpgradedKeyAsync(any(), any(), any(), any());
 
         IStoreUpgradedKeyCallback callback = mock(IStoreUpgradedKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.storeUpgradedKeyAsync(new byte[0], new byte[0], callback);
         verify(callback).onError(errorString);
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
@@ -252,14 +281,17 @@
                 .storeUpgradedKeyAsync(any(), any(), any(), any());
 
         IStoreUpgradedKeyCallback callback = mock(IStoreUpgradedKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
         mRegistration.storeUpgradedKeyAsync(new byte[0], new byte[0], callback);
         verify(callback).onError(errorString);
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
     @Test
     public void storeUpgradedKeyDuplicateCallback() throws Exception {
         IStoreUpgradedKeyCallback callback = mock(IStoreUpgradedKeyCallback.class);
+        doReturn(new Binder()).when(callback).asBinder();
 
         doAnswer(
                 answerStoreUpgradedKeyAsync((oldBlob, newBlob, executor, receiver) -> {
@@ -273,6 +305,7 @@
 
         mRegistration.storeUpgradedKeyAsync(new byte[0], new byte[0], callback);
         verify(callback).onSuccess();
+        verify(callback, atLeastOnce()).asBinder();
         verifyNoMoreInteractions(callback);
     }
 
diff --git a/tools/aapt2/SdkConstants.cpp b/tools/aapt2/SdkConstants.cpp
index 34e8edb..e7b3770 100644
--- a/tools/aapt2/SdkConstants.cpp
+++ b/tools/aapt2/SdkConstants.cpp
@@ -26,8 +26,8 @@
 namespace aapt {
 
 static ApiVersion sDevelopmentSdkLevel = 10000;
-static const auto sDevelopmentSdkCodeNames =
-    std::unordered_set<StringPiece>({"Q", "R", "S", "Sv2", "Tiramisu", "UpsideDownCake"});
+static const auto sDevelopmentSdkCodeNames = std::unordered_set<StringPiece>(
+    {"Q", "R", "S", "Sv2", "Tiramisu", "UpsideDownCake", "VanillaIceCream"});
 
 static const std::vector<std::pair<uint16_t, ApiVersion>> sAttrIdMap = {
     {0x021c, 1},