diff --git a/AconfigFlags.bp b/AconfigFlags.bp
index 16907b3..b753aab 100644
--- a/AconfigFlags.bp
+++ b/AconfigFlags.bp
@@ -19,6 +19,7 @@
     // Add java_aconfig_libraries to here to add them to the core framework
     srcs: [
         ":com.android.hardware.camera2-aconfig-java{.generated_srcjars}",
+        ":com.android.window.flags.window-aconfig-java{.generated_srcjars}",
     ],
 }
 
@@ -30,6 +31,7 @@
     libs: ["fake_device_config"],
 }
 
+// Camera
 aconfig_declarations {
     name: "com.android.hardware.camera2-aconfig",
     package: "com.android.hardware.camera2",
@@ -41,3 +43,16 @@
     aconfig_declarations: "com.android.hardware.camera2-aconfig",
     defaults: ["framework-minus-apex-aconfig-java-defaults"],
 }
+
+// Window
+aconfig_declarations {
+    name: "com.android.window.flags.window-aconfig",
+    package: "com.android.window.flags",
+    srcs: ["core/java/android/window/flags/*.aconfig"],
+}
+
+java_aconfig_library {
+    name: "com.android.window.flags.window-aconfig-java",
+    aconfig_declarations: "com.android.window.flags.window-aconfig",
+    defaults: ["framework-minus-apex-aconfig-java-defaults"],
+}
diff --git a/apct-tests/perftests/autofill/src/android/view/autofill/LoginTest.java b/apct-tests/perftests/autofill/src/android/view/autofill/LoginTest.java
index a5d1e00..59f08f6 100644
--- a/apct-tests/perftests/autofill/src/android/view/autofill/LoginTest.java
+++ b/apct-tests/perftests/autofill/src/android/view/autofill/LoginTest.java
@@ -140,7 +140,7 @@
                 state.resumeTiming();
             }
 
-            // Sanity check
+            // Check for no errors
             callback.assertNoAsyncErrors();
         } finally {
             mAfm.unregisterCallback(callback);
@@ -190,7 +190,7 @@
                 state.resumeTiming();
             }
 
-            // Sanity check
+            // Check for no errors
             callback.assertNoAsyncErrors();
         } finally {
             mAfm.unregisterCallback(callback);
@@ -303,7 +303,7 @@
                 callback.expectEvent(mPassword, EVENT_INPUT_SHOWN);
             }
 
-            // Sanity check
+            // Check for no errors
             callback.assertNoAsyncErrors();
         } finally {
             mAfm.unregisterCallback(callback);
diff --git a/apct-tests/perftests/multiuser/src/android/multiuser/UserLifecycleTests.java b/apct-tests/perftests/multiuser/src/android/multiuser/UserLifecycleTests.java
index a44d939..4d24c8c 100644
--- a/apct-tests/perftests/multiuser/src/android/multiuser/UserLifecycleTests.java
+++ b/apct-tests/perftests/multiuser/src/android/multiuser/UserLifecycleTests.java
@@ -97,16 +97,16 @@
     /** Name of users/profiles in the test. Users with this name may be freely removed. */
     private static final String TEST_USER_NAME = "UserLifecycleTests_test_user";
 
-    /** Name of dummy package used when timing how long app launches take. */
+    /** Name of placeholder package used when timing how long app launches take. */
     private static final String DUMMY_PACKAGE_NAME = "perftests.multiuser.apps.dummyapp";
 
-    // Copy of UserSystemPackageInstaller whitelist mode constants.
-    private static final String PACKAGE_WHITELIST_MODE_PROP =
+    // Copy of UserSystemPackageInstaller allowlist mode constants.
+    private static final String PACKAGE_ALLOWLIST_MODE_PROP =
             "persist.debug.user.package_whitelist_mode";
-    private static final int USER_TYPE_PACKAGE_WHITELIST_MODE_DISABLE = 0;
-    private static final int USER_TYPE_PACKAGE_WHITELIST_MODE_ENFORCE = 0b001;
-    private static final int USER_TYPE_PACKAGE_WHITELIST_MODE_IMPLICIT_WHITELIST = 0b100;
-    private static final int USER_TYPE_PACKAGE_WHITELIST_MODE_DEVICE_DEFAULT = -1;
+    private static final int USER_TYPE_PACKAGE_ALLOWLIST_MODE_DISABLE = 0;
+    private static final int USER_TYPE_PACKAGE_ALLOWLIST_MODE_ENFORCE = 0b001;
+    private static final int USER_TYPE_PACKAGE_ALLOWLIST_MODE_IMPLICIT_ALLOWLIST = 0b100;
+    private static final int USER_TYPE_PACKAGE_ALLOWLIST_MODE_DEVICE_DEFAULT = -1;
 
     private UserManager mUm;
     private ActivityManager mAm;
@@ -563,13 +563,13 @@
     }
 
     // TODO: This is just a POC. Do this properly and add more.
-    /** Tests starting (unlocking) a newly-created profile using the user-type-pkg-whitelist. */
+    /** Tests starting (unlocking) a newly-created profile using the user-type-pkg-allowlist. */
     @Test(timeout = TIMEOUT_MAX_TEST_TIME_MS)
     public void managedProfileUnlock_usingWhitelist() {
         assumeTrue(mHasManagedUserFeature);
-        final int origMode = getUserTypePackageWhitelistMode();
-        setUserTypePackageWhitelistMode(USER_TYPE_PACKAGE_WHITELIST_MODE_ENFORCE
-                | USER_TYPE_PACKAGE_WHITELIST_MODE_IMPLICIT_WHITELIST);
+        final int origMode = getUserTypePackageAllowlistMode();
+        setUserTypePackageAllowlistMode(USER_TYPE_PACKAGE_ALLOWLIST_MODE_ENFORCE
+                | USER_TYPE_PACKAGE_ALLOWLIST_MODE_IMPLICIT_ALLOWLIST);
 
         try {
             while (mRunner.keepRunning()) {
@@ -586,15 +586,15 @@
                 mRunner.resumeTimingForNextIteration();
             }
         } finally {
-            setUserTypePackageWhitelistMode(origMode);
+            setUserTypePackageAllowlistMode(origMode);
         }
     }
-    /** Tests starting (unlocking) a newly-created profile NOT using the user-type-pkg-whitelist. */
+    /** Tests starting (unlocking) a newly-created profile NOT using the user-type-pkg-allowlist. */
     @Test(timeout = TIMEOUT_MAX_TEST_TIME_MS)
     public void managedProfileUnlock_notUsingWhitelist() {
         assumeTrue(mHasManagedUserFeature);
-        final int origMode = getUserTypePackageWhitelistMode();
-        setUserTypePackageWhitelistMode(USER_TYPE_PACKAGE_WHITELIST_MODE_DISABLE);
+        final int origMode = getUserTypePackageAllowlistMode();
+        setUserTypePackageAllowlistMode(USER_TYPE_PACKAGE_ALLOWLIST_MODE_DISABLE);
 
         try {
             while (mRunner.keepRunning()) {
@@ -611,7 +611,7 @@
                 mRunner.resumeTimingForNextIteration();
             }
         } finally {
-            setUserTypePackageWhitelistMode(origMode);
+            setUserTypePackageAllowlistMode(origMode);
         }
     }
 
@@ -822,17 +822,17 @@
         attestTrue(errMsg, success);
     }
 
-    /** Gets the PACKAGE_WHITELIST_MODE_PROP System Property. */
-    private int getUserTypePackageWhitelistMode() {
-        return SystemProperties.getInt(PACKAGE_WHITELIST_MODE_PROP,
-                USER_TYPE_PACKAGE_WHITELIST_MODE_DEVICE_DEFAULT);
+    /** Gets the PACKAGE_ALLOWLIST_MODE_PROP System Property. */
+    private int getUserTypePackageAllowlistMode() {
+        return SystemProperties.getInt(PACKAGE_ALLOWLIST_MODE_PROP,
+                USER_TYPE_PACKAGE_ALLOWLIST_MODE_DEVICE_DEFAULT);
     }
 
-    /** Sets the PACKAGE_WHITELIST_MODE_PROP System Property to the given value. */
-    private void setUserTypePackageWhitelistMode(int mode) {
+    /** Sets the PACKAGE_ALLOWLIST_MODE_PROP System Property to the given value. */
+    private void setUserTypePackageAllowlistMode(int mode) {
         String result = ShellHelper.runShellCommand(
-                String.format("setprop %s %d", PACKAGE_WHITELIST_MODE_PROP, mode));
-        attestFalse("Failed to set sysprop " + PACKAGE_WHITELIST_MODE_PROP + ": " + result,
+                String.format("setprop %s %d", PACKAGE_ALLOWLIST_MODE_PROP, mode));
+        attestFalse("Failed to set sysprop " + PACKAGE_ALLOWLIST_MODE_PROP + ": " + result,
                 result != null && result.contains("Failed"));
     }
 
diff --git a/apct-tests/perftests/windowmanager/src/android/wm/RelayoutPerfTest.java b/apct-tests/perftests/windowmanager/src/android/wm/RelayoutPerfTest.java
index fb62920..9e29820 100644
--- a/apct-tests/perftests/windowmanager/src/android/wm/RelayoutPerfTest.java
+++ b/apct-tests/perftests/windowmanager/src/android/wm/RelayoutPerfTest.java
@@ -111,7 +111,7 @@
         stopProfiling();
     }
 
-    /** A dummy view to get IWindow. */
+    /** A placeholder view to get IWindow. */
     private static class ContentView extends LinearLayout {
         ContentView(Context context) {
             super(context);
diff --git a/apex/jobscheduler/framework/java/android/app/job/JobInfo.java b/apex/jobscheduler/framework/java/android/app/job/JobInfo.java
index f49cdbf..92320d3 100644
--- a/apex/jobscheduler/framework/java/android/app/job/JobInfo.java
+++ b/apex/jobscheduler/framework/java/android/app/job/JobInfo.java
@@ -360,7 +360,7 @@
 
     /**
      * Allows this job to run despite doze restrictions as long as the app is in the foreground
-     * or on the temporary whitelist
+     * or on the temporary allowlist
      * @hide
      */
     public static final int FLAG_IMPORTANT_WHILE_FOREGROUND = 1 << 1;
@@ -1803,13 +1803,13 @@
 
         /**
          * Setting this to true indicates that this job is important while the scheduling app
-         * is in the foreground or on the temporary whitelist for background restrictions.
+         * is in the foreground or on the temporary allowlist for background restrictions.
          * This means that the system will relax doze restrictions on this job during this time.
          *
          * Apps should use this flag only for short jobs that are essential for the app to function
          * properly in the foreground.
          *
-         * Note that once the scheduling app is no longer whitelisted from background restrictions
+         * Note that once the scheduling app is no longer allowlisted from background restrictions
          * and in the background, or the job failed due to unsatisfied constraints,
          * this job should be expected to behave like other jobs without this flag.
          *
diff --git a/apex/jobscheduler/framework/java/android/os/PowerWhitelistManager.java b/apex/jobscheduler/framework/java/android/os/PowerWhitelistManager.java
index 4ce31e9..20da171 100644
--- a/apex/jobscheduler/framework/java/android/os/PowerWhitelistManager.java
+++ b/apex/jobscheduler/framework/java/android/os/PowerWhitelistManager.java
@@ -29,10 +29,10 @@
 import java.util.List;
 
 /**
- * Interface to access and modify the permanent and temporary power save whitelist. The two lists
- * are kept separately. Apps placed on the permanent whitelist are only removed via an explicit
- * removeFromWhitelist call. Apps whitelisted by default by the system cannot be removed. Apps
- * placed on the temporary whitelist are removed from that whitelist after a predetermined amount of
+ * Interface to access and modify the permanent and temporary power save allowlist. The two lists
+ * are kept separately. Apps placed on the permanent allowlist are only removed via an explicit
+ * removeFromAllowlist call. Apps whitelisted by default by the system cannot be removed. Apps
+ * placed on the temporary allowlist are removed from that allowlist after a predetermined amount of
  * time.
  *
  * @deprecated Use {@link PowerExemptionManager} instead
@@ -50,18 +50,18 @@
     private final PowerExemptionManager mPowerExemptionManager;
 
     /**
-     * Indicates that an unforeseen event has occurred and the app should be whitelisted to handle
+     * Indicates that an unforeseen event has occurred and the app should be allowlisted to handle
      * it.
      */
     public static final int EVENT_UNSPECIFIED = PowerExemptionManager.EVENT_UNSPECIFIED;
 
     /**
-     * Indicates that an SMS event has occurred and the app should be whitelisted to handle it.
+     * Indicates that an SMS event has occurred and the app should be allowlisted to handle it.
      */
     public static final int EVENT_SMS = PowerExemptionManager.EVENT_SMS;
 
     /**
-     * Indicates that an MMS event has occurred and the app should be whitelisted to handle it.
+     * Indicates that an MMS event has occurred and the app should be allowlisted to handle it.
      */
     public static final int EVENT_MMS = PowerExemptionManager.EVENT_MMS;
 
@@ -381,7 +381,7 @@
     }
 
     /**
-     * Add the specified package to the permanent power save whitelist.
+     * Add the specified package to the permanent power save allowlist.
      *
      * @deprecated Use {@link PowerExemptionManager#addToPermanentAllowList(String)} instead
      */
@@ -392,7 +392,7 @@
     }
 
     /**
-     * Add the specified packages to the permanent power save whitelist.
+     * Add the specified packages to the permanent power save allowlist.
      *
      * @deprecated Use {@link PowerExemptionManager#addToPermanentAllowList(List)} instead
      */
@@ -403,10 +403,10 @@
     }
 
     /**
-     * Get a list of app IDs of app that are whitelisted. This does not include temporarily
-     * whitelisted apps.
+     * Get a list of app IDs of app that are allowlisted. This does not include temporarily
+     * allowlisted apps.
      *
-     * @param includingIdle Set to true if the app should be whitelisted from device idle as well
+     * @param includingIdle Set to true if the app should be allowlisted from device idle as well
      *                      as other power save restrictions
      * @deprecated Use {@link PowerExemptionManager#getAllowListedAppIds(boolean)} instead
      * @hide
@@ -418,10 +418,10 @@
     }
 
     /**
-     * Returns true if the app is whitelisted from power save restrictions. This does not include
-     * temporarily whitelisted apps.
+     * Returns true if the app is allowlisted from power save restrictions. This does not include
+     * temporarily allowlisted apps.
      *
-     * @param includingIdle Set to true if the app should be whitelisted from device
+     * @param includingIdle Set to true if the app should be allowlisted from device
      *                      idle as well as other power save restrictions
      * @deprecated Use {@link PowerExemptionManager#isAllowListed(String, boolean)} instead
      * @hide
@@ -432,11 +432,11 @@
     }
 
     /**
-     * Remove an app from the permanent power save whitelist. Only apps that were added via
+     * Remove an app from the permanent power save allowlist. Only apps that were added via
      * {@link #addToWhitelist(String)} or {@link #addToWhitelist(List)} will be removed. Apps
-     * whitelisted by default by the system cannot be removed.
+     * allowlisted by default by the system cannot be removed.
      *
-     * @param packageName The app to remove from the whitelist
+     * @param packageName The app to remove from the allowlist
      * @deprecated Use {@link PowerExemptionManager#removeFromPermanentAllowList(String)} instead
      */
     @Deprecated
@@ -446,10 +446,10 @@
     }
 
     /**
-     * Add an app to the temporary whitelist for a short amount of time.
+     * Add an app to the temporary allowlist for a short amount of time.
      *
-     * @param packageName The package to add to the temp whitelist
-     * @param durationMs  How long to keep the app on the temp whitelist for (in milliseconds)
+     * @param packageName The package to add to the temp allowlist
+     * @param durationMs  How long to keep the app on the temp allowlist for (in milliseconds)
      * @param reasonCode one of {@link ReasonCode}, use {@link #REASON_UNKNOWN} if not sure.
      * @param reason a optional human readable reason string, could be null or empty string.
      * @deprecated Use {@link PowerExemptionManager#addToTemporaryAllowList(
@@ -463,10 +463,10 @@
     }
 
     /**
-     * Add an app to the temporary whitelist for a short amount of time.
+     * Add an app to the temporary allowlist for a short amount of time.
      *
-     * @param packageName The package to add to the temp whitelist
-     * @param durationMs  How long to keep the app on the temp whitelist for (in milliseconds)
+     * @param packageName The package to add to the temp allowlist
+     * @param durationMs  How long to keep the app on the temp allowlist for (in milliseconds)
      * @deprecated Use {@link PowerExemptionManager#addToTemporaryAllowList(
      *             String, int, String, long)} instead
      */
@@ -478,15 +478,15 @@
     }
 
     /**
-     * Add an app to the temporary whitelist for a short amount of time for a specific reason. The
-     * temporary whitelist is kept separately from the permanent whitelist and apps are
-     * automatically removed from the temporary whitelist after a predetermined amount of time.
+     * Add an app to the temporary allowlist for a short amount of time for a specific reason. The
+     * temporary allowlist is kept separately from the permanent allowlist and apps are
+     * automatically removed from the temporary allowlist after a predetermined amount of time.
      *
-     * @param packageName The package to add to the temp whitelist
-     * @param event       The reason to add the app to the temp whitelist
-     * @param reason      A human-readable reason explaining why the app is temp whitelisted. Only
+     * @param packageName The package to add to the temp allowlist
+     * @param event       The reason to add the app to the temp allowlist
+     * @param reason      A human-readable reason explaining why the app is temp allowlisted. Only
      *                    used for logging purposes. Could be null or empty string.
-     * @return The duration (in milliseconds) that the app is whitelisted for
+     * @return The duration (in milliseconds) that the app is allowlisted for
      * @deprecated Use {@link PowerExemptionManager#addToTemporaryAllowListForEvent(
      *             String, int, String, int)} instead
      */
@@ -499,16 +499,16 @@
     }
 
     /**
-     * Add an app to the temporary whitelist for a short amount of time for a specific reason. The
-     * temporary whitelist is kept separately from the permanent whitelist and apps are
-     * automatically removed from the temporary whitelist after a predetermined amount of time.
+     * Add an app to the temporary allowlist for a short amount of time for a specific reason. The
+     * temporary allowlist is kept separately from the permanent allowlist and apps are
+     * automatically removed from the temporary allowlist after a predetermined amount of time.
      *
-     * @param packageName The package to add to the temp whitelist
-     * @param event       The reason to add the app to the temp whitelist
+     * @param packageName The package to add to the temp allowlist
+     * @param event       The reason to add the app to the temp allowlist
      * @param reasonCode  one of {@link ReasonCode}, use {@link #REASON_UNKNOWN} if not sure.
-     * @param reason      A human-readable reason explaining why the app is temp whitelisted. Only
+     * @param reason      A human-readable reason explaining why the app is temp allowlisted. Only
      *                    used for logging purposes. Could be null or empty string.
-     * @return The duration (in milliseconds) that the app is whitelisted for
+     * @return The duration (in milliseconds) that the app is allowlisted for
      * @deprecated Use {@link PowerExemptionManager#addToTemporaryAllowListForEvent(
      *             String, int, String, int)} instead
      */
diff --git a/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java b/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java
index 58953c4..2994cf2 100644
--- a/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java
+++ b/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java
@@ -331,6 +331,7 @@
                 if (DEBUG) {
                     Slog.d(TAG, job.getServiceComponent().getShortClassName() + " unavailable.");
                 }
+                mContext.unbindService(this);
                 mRunningJob = null;
                 mRunningJobWorkType = WORK_TYPE_NONE;
                 mRunningCallback = null;
diff --git a/apex/jobscheduler/service/java/com/android/server/usage/AppIdleHistory.java b/apex/jobscheduler/service/java/com/android/server/usage/AppIdleHistory.java
index fb342b9..913a76a 100644
--- a/apex/jobscheduler/service/java/com/android/server/usage/AppIdleHistory.java
+++ b/apex/jobscheduler/service/java/com/android/server/usage/AppIdleHistory.java
@@ -61,6 +61,7 @@
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileNotFoundException;
 import java.io.FileOutputStream;
 import java.io.FileReader;
 import java.io.IOException;
@@ -802,6 +803,9 @@
                     }
                 }
             }
+        } catch (FileNotFoundException e) {
+            // Expected on first boot
+            Slog.d(TAG, "App idle file for user " + userId + " does not exist");
         } catch (IOException | XmlPullParserException e) {
             Slog.e(TAG, "Unable to read app idle file for user " + userId, e);
         } finally {
diff --git a/cmds/bmgr/src/com/android/commands/bmgr/Bmgr.java b/cmds/bmgr/src/com/android/commands/bmgr/Bmgr.java
index ed717c4..81be44a 100644
--- a/cmds/bmgr/src/com/android/commands/bmgr/Bmgr.java
+++ b/cmds/bmgr/src/com/android/commands/bmgr/Bmgr.java
@@ -191,7 +191,7 @@
         }
 
         if ("whitelist".equals(op)) {
-            doPrintWhitelist();
+            doPrintAllowlist();
             return;
         }
 
@@ -873,7 +873,7 @@
         }
     }
 
-    private void doPrintWhitelist() {
+    private void doPrintAllowlist() {
         try {
             final String[] whitelist = mBmgr.getTransportWhitelist();
             if (whitelist != null) {
diff --git a/cmds/bootanimation/Android.bp b/cmds/bootanimation/Android.bp
index 3534624..98767ee 100644
--- a/cmds/bootanimation/Android.bp
+++ b/cmds/bootanimation/Android.bp
@@ -74,4 +74,7 @@
         "libGLESv2",
         "libgui",
     ],
+    whole_static_libs: [
+        "libc++fs",
+    ],
 }
diff --git a/cmds/bootanimation/BootAnimation.cpp b/cmds/bootanimation/BootAnimation.cpp
index 5b9d989..8ceb9ec 100644
--- a/cmds/bootanimation/BootAnimation.cpp
+++ b/cmds/bootanimation/BootAnimation.cpp
@@ -17,6 +17,7 @@
 #define LOG_NDEBUG 0
 #define LOG_TAG "BootAnimation"
 
+#include <filesystem>
 #include <vector>
 
 #include <stdint.h>
@@ -1271,10 +1272,10 @@
             continue;
         }
 
-        const String8 entryName(name);
-        const String8 path(entryName.getPathDir());
-        const String8 leaf(entryName.getPathLeaf());
-        if (leaf.size() > 0) {
+        const std::filesystem::path entryName(name);
+        const std::filesystem::path path(entryName.parent_path());
+        const std::filesystem::path leaf(entryName.filename());
+        if (!leaf.empty()) {
             if (entryName == CLOCK_FONT_ZIP_NAME) {
                 FileMap* map = zip->createEntryFileMap(entry);
                 if (map) {
@@ -1292,7 +1293,7 @@
             }
 
             for (size_t j = 0; j < pcount; j++) {
-                if (path == animation.parts[j].path) {
+                if (path.string() == animation.parts[j].path.c_str()) {
                     uint16_t method;
                     // supports only stored png files
                     if (zip->getEntryInfo(entry, &method, nullptr, nullptr, nullptr, nullptr, nullptr)) {
@@ -1309,7 +1310,7 @@
                                                         map->getDataLength());
                                 } else {
                                     Animation::Frame frame;
-                                    frame.name = leaf;
+                                    frame.name = leaf.c_str();
                                     frame.map = map;
                                     frame.trimWidth = animation.width;
                                     frame.trimHeight = animation.height;
diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index c893b54..26c72f0 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -276,6 +276,7 @@
     field public static final String RECOVER_KEYSTORE = "android.permission.RECOVER_KEYSTORE";
     field public static final String REGISTER_CALL_PROVIDER = "android.permission.REGISTER_CALL_PROVIDER";
     field public static final String REGISTER_CONNECTION_MANAGER = "android.permission.REGISTER_CONNECTION_MANAGER";
+    field public static final String REGISTER_NSD_OFFLOAD_ENGINE = "android.permission.REGISTER_NSD_OFFLOAD_ENGINE";
     field public static final String REGISTER_SIM_SUBSCRIPTION = "android.permission.REGISTER_SIM_SUBSCRIPTION";
     field public static final String REGISTER_STATS_PULL_ATOM = "android.permission.REGISTER_STATS_PULL_ATOM";
     field public static final String REMOTE_DISPLAY_PROVIDER = "android.permission.REMOTE_DISPLAY_PROVIDER";
diff --git a/core/java/android/app/search/SearchSession.java b/core/java/android/app/search/SearchSession.java
index 10db337..f7a26dc 100644
--- a/core/java/android/app/search/SearchSession.java
+++ b/core/java/android/app/search/SearchSession.java
@@ -99,7 +99,7 @@
         mInterface = android.app.search.ISearchUiManager.Stub.asInterface(b);
         mSessionId = new SearchSessionId(
                 context.getPackageName() + ":" + UUID.randomUUID().toString(), context.getUserId());
-        // b/175527717 whitelist possible clients of this API
+        // b/175527717 allowlist possible clients of this API
         searchContext.setPackageName(context.getPackageName());
         try {
             mInterface.createSearchSession(searchContext, mSessionId, mToken);
diff --git a/core/java/android/content/Context.java b/core/java/android/content/Context.java
index 21d4b64..d04d8be 100644
--- a/core/java/android/content/Context.java
+++ b/core/java/android/content/Context.java
@@ -473,7 +473,7 @@
     public static final int BIND_IMPORTANT_BACKGROUND = 0x00800000;
 
     /**
-     * @hide Flag for {@link #bindService}: allows application hosting service to manage whitelists
+     * @hide Flag for {@link #bindService}: allows application hosting service to manage allowlists
      * such as temporary allowing a {@code PendingIntent} to bypass Power Save mode.
      */
     public static final int BIND_ALLOW_WHITELIST_MANAGEMENT = 0x01000000;
diff --git a/core/java/android/content/IntentSender.java b/core/java/android/content/IntentSender.java
index 49d3cac..d4d9e47 100644
--- a/core/java/android/content/IntentSender.java
+++ b/core/java/android/content/IntentSender.java
@@ -392,9 +392,9 @@
     }
 
     /** @hide */
-    public IntentSender(IIntentSender target, IBinder whitelistToken) {
+    public IntentSender(IIntentSender target, IBinder allowlistToken) {
         mTarget = target;
-        mWhitelistToken = whitelistToken;
+        mWhitelistToken = allowlistToken;
     }
 
     /** @hide */
diff --git a/core/java/android/hardware/Camera.java b/core/java/android/hardware/Camera.java
index ccc39b6..0396443 100644
--- a/core/java/android/hardware/Camera.java
+++ b/core/java/android/hardware/Camera.java
@@ -41,11 +41,6 @@
 import android.os.Process;
 import android.os.RemoteException;
 import android.os.ServiceManager;
-import android.renderscript.Allocation;
-import android.renderscript.Element;
-import android.renderscript.RSIllegalArgumentException;
-import android.renderscript.RenderScript;
-import android.renderscript.Type;
 import android.text.TextUtils;
 import android.util.Log;
 import android.view.Surface;
@@ -1007,132 +1002,6 @@
     private native final void _addCallbackBuffer(
                                 byte[] callbackBuffer, int msgType);
 
-    /**
-     * <p>Create a {@link android.renderscript RenderScript}
-     * {@link android.renderscript.Allocation Allocation} to use as a
-     * destination of preview callback frames. Use
-     * {@link #setPreviewCallbackAllocation setPreviewCallbackAllocation} to use
-     * the created Allocation as a destination for camera preview frames.</p>
-     *
-     * <p>The Allocation will be created with a YUV type, and its contents must
-     * be accessed within Renderscript with the {@code rsGetElementAtYuv_*}
-     * accessor methods. Its size will be based on the current
-     * {@link Parameters#getPreviewSize preview size} configured for this
-     * camera.</p>
-     *
-     * @param rs the RenderScript context for this Allocation.
-     * @param usage additional usage flags to set for the Allocation. The usage
-     *   flag {@link android.renderscript.Allocation#USAGE_IO_INPUT} will always
-     *   be set on the created Allocation, but additional flags may be provided
-     *   here.
-     * @return a new YUV-type Allocation with dimensions equal to the current
-     *   preview size.
-     * @throws RSIllegalArgumentException if the usage flags are not compatible
-     *   with an YUV Allocation.
-     * @see #setPreviewCallbackAllocation
-     * @hide
-     */
-    public final Allocation createPreviewAllocation(RenderScript rs, int usage)
-            throws RSIllegalArgumentException {
-        Parameters p = getParameters();
-        Size previewSize = p.getPreviewSize();
-        Type.Builder yuvBuilder = new Type.Builder(rs,
-                Element.createPixel(rs,
-                        Element.DataType.UNSIGNED_8,
-                        Element.DataKind.PIXEL_YUV));
-        // Use YV12 for wide compatibility. Changing this requires also
-        // adjusting camera service's format selection.
-        yuvBuilder.setYuvFormat(ImageFormat.YV12);
-        yuvBuilder.setX(previewSize.width);
-        yuvBuilder.setY(previewSize.height);
-
-        Allocation a = Allocation.createTyped(rs, yuvBuilder.create(),
-                usage | Allocation.USAGE_IO_INPUT);
-
-        return a;
-    }
-
-    /**
-     * <p>Set an {@link android.renderscript.Allocation Allocation} as the
-     * target of preview callback data. Use this method for efficient processing
-     * of camera preview data with RenderScript. The Allocation must be created
-     * with the {@link #createPreviewAllocation createPreviewAllocation }
-     * method.</p>
-     *
-     * <p>Setting a preview allocation will disable any active preview callbacks
-     * set by {@link #setPreviewCallback setPreviewCallback} or
-     * {@link #setPreviewCallbackWithBuffer setPreviewCallbackWithBuffer}, and
-     * vice versa. Using a preview allocation still requires an active standard
-     * preview target to be set, either with
-     * {@link #setPreviewTexture setPreviewTexture} or
-     * {@link #setPreviewDisplay setPreviewDisplay}.</p>
-     *
-     * <p>To be notified when new frames are available to the Allocation, use
-     * {@link android.renderscript.Allocation#setIoInputNotificationHandler Allocation.setIoInputNotificationHandler}. To
-     * update the frame currently accessible from the Allocation to the latest
-     * preview frame, call
-     * {@link android.renderscript.Allocation#ioReceive Allocation.ioReceive}.</p>
-     *
-     * <p>To disable preview into the Allocation, call this method with a
-     * {@code null} parameter.</p>
-     *
-     * <p>Once a preview allocation is set, the preview size set by
-     * {@link Parameters#setPreviewSize setPreviewSize} cannot be changed. If
-     * you wish to change the preview size, first remove the preview allocation
-     * by calling {@code setPreviewCallbackAllocation(null)}, then change the
-     * preview size, create a new preview Allocation with
-     * {@link #createPreviewAllocation createPreviewAllocation}, and set it as
-     * the new preview callback allocation target.</p>
-     *
-     * <p>If you are using the preview data to create video or still images,
-     * strongly consider using {@link android.media.MediaActionSound} to
-     * properly indicate image capture or recording start/stop to the user.</p>
-     *
-     * @param previewAllocation the allocation to use as destination for preview
-     * @throws IOException if configuring the camera to use the Allocation for
-     *   preview fails.
-     * @throws IllegalArgumentException if the Allocation's dimensions or other
-     *   parameters don't meet the requirements.
-     * @see #createPreviewAllocation
-     * @see #setPreviewCallback
-     * @see #setPreviewCallbackWithBuffer
-     * @hide
-     */
-    public final void setPreviewCallbackAllocation(Allocation previewAllocation)
-            throws IOException {
-        Surface previewSurface = null;
-        if (previewAllocation != null) {
-             Parameters p = getParameters();
-             Size previewSize = p.getPreviewSize();
-             if (previewSize.width != previewAllocation.getType().getX() ||
-                     previewSize.height != previewAllocation.getType().getY()) {
-                 throw new IllegalArgumentException(
-                     "Allocation dimensions don't match preview dimensions: " +
-                     "Allocation is " +
-                     previewAllocation.getType().getX() +
-                     ", " +
-                     previewAllocation.getType().getY() +
-                     ". Preview is " + previewSize.width + ", " +
-                     previewSize.height);
-             }
-             if ((previewAllocation.getUsage() &
-                             Allocation.USAGE_IO_INPUT) == 0) {
-                 throw new IllegalArgumentException(
-                     "Allocation usage does not include USAGE_IO_INPUT");
-             }
-             if (previewAllocation.getType().getElement().getDataKind() !=
-                     Element.DataKind.PIXEL_YUV) {
-                 throw new IllegalArgumentException(
-                     "Allocation is not of a YUV type");
-             }
-             previewSurface = previewAllocation.getSurface();
-             mUsingPreviewAllocation = true;
-         } else {
-             mUsingPreviewAllocation = false;
-         }
-         setPreviewCallbackSurface(previewSurface);
-    }
-
     private native final void setPreviewCallbackSurface(Surface s);
 
     private class EventHandler extends Handler
diff --git a/core/java/android/hardware/camera2/CameraDevice.java b/core/java/android/hardware/camera2/CameraDevice.java
index 2f81e0c..106b7d4 100644
--- a/core/java/android/hardware/camera2/CameraDevice.java
+++ b/core/java/android/hardware/camera2/CameraDevice.java
@@ -540,14 +540,6 @@
      *   or configuring it to use one of the supported
      *   {@link android.media.CamcorderProfile CamcorderProfiles}.</li>
      *
-     * <li>For efficient YUV processing with {@link android.renderscript}:
-     *   Create a RenderScript
-     *   {@link android.renderscript.Allocation Allocation} with a supported YUV
-     *   type, the IO_INPUT flag, and one of the sizes returned by
-     *   {@link StreamConfigurationMap#getOutputSizes(Class) getOutputSizes(Allocation.class)},
-     *   Then obtain the Surface with
-     *   {@link android.renderscript.Allocation#getSurface}.</li>
-     *
      * <li>For access to RAW, uncompressed YUV, or compressed JPEG data in the application: Create an
      *   {@link android.media.ImageReader} object with one of the supported output formats given by
      *   {@link StreamConfigurationMap#getOutputFormats()}, setting its size to one of the
diff --git a/core/java/android/hardware/camera2/params/StreamConfigurationMap.java b/core/java/android/hardware/camera2/params/StreamConfigurationMap.java
index 5981d27..a89fed2 100644
--- a/core/java/android/hardware/camera2/params/StreamConfigurationMap.java
+++ b/core/java/android/hardware/camera2/params/StreamConfigurationMap.java
@@ -465,8 +465,6 @@
      * Recommended for recording video (simple to use)
      * <li>{@link android.media.MediaCodec} -
      * Recommended for recording video (more complicated to use, with more flexibility)
-     * <li>{@link android.renderscript.Allocation} -
-     * Recommended for image processing with {@link android.renderscript RenderScript}
      * <li>{@link android.view.SurfaceHolder} -
      * Recommended for low-power camera preview with {@link android.view.SurfaceView}
      * <li>{@link android.graphics.SurfaceTexture} -
diff --git a/core/java/android/nfc/NfcAdapter.java b/core/java/android/nfc/NfcAdapter.java
index 7d0cf9c..36199e5 100644
--- a/core/java/android/nfc/NfcAdapter.java
+++ b/core/java/android/nfc/NfcAdapter.java
@@ -712,6 +712,7 @@
                 /* Stale sService pointer */
                 if (sIsInitialized) sIsInitialized = false;
             }
+            return null;
         }
         /* Try to initialize the service */
         NfcManager manager = (NfcManager) context.getSystemService(Context.NFC_SERVICE);
diff --git a/core/java/android/os/DropBoxManager.java b/core/java/android/os/DropBoxManager.java
index 403f55c..cf35460 100644
--- a/core/java/android/os/DropBoxManager.java
+++ b/core/java/android/os/DropBoxManager.java
@@ -364,7 +364,7 @@
     }
 
     /**
-     * Checks any blacklists (set in system settings) to see whether a certain
+     * Checks any denylists (set in system settings) to see whether a certain
      * tag is allowed.  Entries with disabled tags will be dropped immediately,
      * so you can save the work of actually constructing and sending the data.
      *
diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
index 7a75769..507f1bb 100644
--- a/core/java/android/provider/Settings.java
+++ b/core/java/android/provider/Settings.java
@@ -1322,7 +1322,7 @@
 
     /**
      * Activity Action: Ask the user to allow an app to ignore battery optimizations (that is,
-     * put them on the whitelist of apps shown by
+     * put them on the allowlist of apps shown by
      * {@link #ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS}).  For an app to use this, it also
      * must hold the {@link android.Manifest.permission#REQUEST_IGNORE_BATTERY_OPTIMIZATIONS}
      * permission.
@@ -11543,7 +11543,7 @@
         public static final String BUGREPORT_IN_POWER_MENU = "bugreport_in_power_menu";
 
         /**
-         * The package name for the custom bugreport handler app. This app must be whitelisted.
+         * The package name for the custom bugreport handler app. This app must be allowlisted.
          * This is currently used only by Power Menu short press.
          *
          * @hide
@@ -11924,7 +11924,7 @@
                 "location_background_throttle_proximity_alert_interval_ms";
 
         /**
-         * Packages that are whitelisted for background throttling (throttling will not be applied).
+         * Packages that are allowlisted for background throttling (throttling will not be applied).
          * @hide
          */
         @Readable
@@ -11932,7 +11932,7 @@
             "location_background_throttle_package_whitelist";
 
         /**
-         * Packages that are whitelisted for ignoring location settings (may retrieve location even
+         * Packages that are allowlisted for ignoring location settings (may retrieve location even
          * when user location settings are off), for emergency purposes.
          * @deprecated No longer used from Android 12+
          * @hide
@@ -12465,7 +12465,7 @@
 
         /**
          * List of certificate (hex string representation of the application's certificate - SHA-1
-         * or SHA-256) and carrier app package pairs which are whitelisted to prompt the user for
+         * or SHA-256) and carrier app package pairs which are allowlisted to prompt the user for
          * install when a sim card with matching UICC carrier privilege rules is inserted.  The
          * certificate is used as a key, so the certificate encoding here must be the same as the
          * certificate encoding used on the SIM.
@@ -15841,7 +15841,7 @@
                 "enable_adb_incremental_install_default";
 
         /**
-         * The packages whitelisted to be run in autofill compatibility mode. The list
+         * The packages allowlisted to be run in autofill compatibility mode. The list
          * of packages is {@code ":"} colon delimited, and each entry has the name of the
          * package and an optional list of url bar resource ids (the list is delimited by
          * brackets&mdash{@code [} and {@code ]}&mdash and is also comma delimited).
@@ -15912,7 +15912,7 @@
         public static final String STYLUS_EVER_USED = "stylus_ever_used";
 
         /**
-         * Exemptions to the hidden API blacklist.
+         * Exemptions to the hidden API denylist.
          *
          * @hide
          */
diff --git a/core/java/android/security/OWNERS b/core/java/android/security/OWNERS
index dd17788..22b1f02 100644
--- a/core/java/android/security/OWNERS
+++ b/core/java/android/security/OWNERS
@@ -1,10 +1,9 @@
 # Bug component: 36824
 
-cbrubaker@google.com
-vishwath@google.com
+brambonne@google.com
+brufino@google.com
+jeffv@google.com
 
-per-file NetworkSecurityPolicy.java = cbrubaker@google.com
-per-file NetworkSecurityPolicy.java = klyubin@google.com
-per-file FrameworkNetworkSecurityPolicy.java = cbrubaker@google.com
-per-file FrameworkNetworkSecurityPolicy.java = klyubin@google.com
+per-file *NetworkSecurityPolicy.java = file:net/OWNERS
 per-file Confirmation*.java = file:/keystore/OWNERS
+per-file FileIntegrityManager.java = victorhsieh@google.com
diff --git a/core/java/android/security/net/OWNERS b/core/java/android/security/net/OWNERS
index d828164..1d52eed 100644
--- a/core/java/android/security/net/OWNERS
+++ b/core/java/android/security/net/OWNERS
@@ -1,4 +1,4 @@
 # Bug component: 36824
 
-cbrubaker@google.com
 brambonne@google.com
+jeffv@google.com
diff --git a/core/java/android/window/flags/windowing_sdk.aconfig b/core/java/android/window/flags/windowing_sdk.aconfig
new file mode 100644
index 0000000..560e41b
--- /dev/null
+++ b/core/java/android/window/flags/windowing_sdk.aconfig
@@ -0,0 +1,10 @@
+package: "com.android.window.flags"
+
+# Project link: https://gantry.corp.google.com/projects/android_platform_windowing_sdk/changes
+
+flag {
+    namespace: "windowing_sdk"
+    name: "sync_window_config_update_flag"
+    description: "Whether the feature to sync different window-related config updates is enabled"
+    bug: "260873529"
+}
diff --git a/core/jni/android_hardware_Camera.cpp b/core/jni/android_hardware_Camera.cpp
index 2a670e8..1c59742 100644
--- a/core/jni/android_hardware_Camera.cpp
+++ b/core/jni/android_hardware_Camera.cpp
@@ -17,22 +17,21 @@
 
 //#define LOG_NDEBUG 0
 #define LOG_TAG "Camera-JNI"
-#include <utils/Log.h>
-
-#include "jni.h"
-#include <nativehelper/JNIHelp.h>
-#include "core_jni_helpers.h"
 #include <android_runtime/android_graphics_SurfaceTexture.h>
 #include <android_runtime/android_view_Surface.h>
-
+#include <binder/IMemory.h>
+#include <camera/Camera.h>
+#include <camera/StringUtils.h>
 #include <cutils/properties.h>
-#include <utils/Vector.h>
-#include <utils/Errors.h>
-
 #include <gui/GLConsumer.h>
 #include <gui/Surface.h>
-#include <camera/Camera.h>
-#include <binder/IMemory.h>
+#include <nativehelper/JNIHelp.h>
+#include <utils/Errors.h>
+#include <utils/Log.h>
+#include <utils/Vector.h>
+
+#include "core_jni_helpers.h"
+#include "jni.h"
 
 using namespace android;
 
@@ -562,7 +561,7 @@
     const char16_t *rawClientName = reinterpret_cast<const char16_t*>(
         env->GetStringChars(clientPackageName, NULL));
     jsize rawClientNameLen = env->GetStringLength(clientPackageName);
-    String16 clientName(rawClientName, rawClientNameLen);
+    std::string clientName = toStdString(rawClientName, rawClientNameLen);
     env->ReleaseStringChars(clientPackageName,
                             reinterpret_cast<const jchar*>(rawClientName));
 
diff --git a/core/jni/android_hardware_SensorManager.cpp b/core/jni/android_hardware_SensorManager.cpp
index cb97698..b482897 100644
--- a/core/jni/android_hardware_SensorManager.cpp
+++ b/core/jni/android_hardware_SensorManager.cpp
@@ -150,7 +150,7 @@
         return gStringOffsets.emptyString;
     }
 
-    ScopedLocalRef<jstring> javaString(env, env->NewStringUTF(string.string()));
+    ScopedLocalRef<jstring> javaString(env, env->NewStringUTF(string.c_str()));
     jstring internedString = (jstring)
             env->CallObjectMethod(javaString.get(), gStringOffsets.intern);
     return internedString;
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index c226112..c369a10 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -2225,6 +2225,14 @@
     <permission android:name="android.permission.MANAGE_ETHERNET_NETWORKS"
         android:protectionLevel="signature" />
 
+    <!-- Allows system apps to call methods to register itself as a mDNS offload engine.
+        <p>Not for use by third-party or privileged applications.
+        @SystemApi
+        @hide This should only be used by system apps.
+    -->
+    <permission android:name="android.permission.REGISTER_NSD_OFFLOAD_ENGINE"
+        android:protectionLevel="signature" />
+
     <!-- ======================================= -->
     <!-- Permissions for short range, peripheral networks -->
     <!-- ======================================= -->
diff --git a/core/tests/coretests/res/values-id/strings.xml b/core/tests/coretests/res/values-id/strings.xml
new file mode 100644
index 0000000..6d71c90
--- /dev/null
+++ b/core/tests/coretests/res/values-id/strings.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Used in ResourcesLocaleTest. -->
+    <string name="locale_test_res_1">Pengujian ID</string>
+</resources>
diff --git a/core/tests/coretests/res/values-in/strings.xml b/core/tests/coretests/res/values-in/strings.xml
new file mode 100644
index 0000000..6384660
--- /dev/null
+++ b/core/tests/coretests/res/values-in/strings.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Used in ResourcesLocaleTest. -->
+    <string name="locale_test_res_2">Pengujian IN</string>
+</resources>
diff --git a/core/tests/coretests/res/values/strings.xml b/core/tests/coretests/res/values/strings.xml
index e51eab6..09e1c69 100644
--- a/core/tests/coretests/res/values/strings.xml
+++ b/core/tests/coretests/res/values/strings.xml
@@ -131,6 +131,13 @@
 
     <string name="textview_hebrew_text">&#x05DD;&#x05DE;ab?!</string>
 
+    <!-- Used in ResourcesLocaleTest. Also defined in values-id. "id" is the new ISO code for Indonesian. -->
+    <string name="locale_test_res_1">Testing ID</string>
+    <!-- Used in ResourcesLocaleTest. Also defined in values-in. "in" is the deprecated ISO code for Indonesian. -->
+    <string name="locale_test_res_2">Testing IN</string>
+    <!-- Used in ResourcesLocaleTest. -->
+    <string name="locale_test_res_3">Testing EN</string>
+
     <!-- SizeAdaptiveLayout -->
     <string name="first">Four score and seven years ago our fathers brought forth on this continent, a new nation, conceived in Liberty, and dedicated to the proposition that all men are created equal.</string>
     <string name="actor">Abe Lincoln</string>
diff --git a/core/tests/coretests/src/android/content/res/ResourcesLocaleTest.java b/core/tests/coretests/src/android/content/res/ResourcesLocaleTest.java
index 25c3db5..26e4349 100644
--- a/core/tests/coretests/src/android/content/res/ResourcesLocaleTest.java
+++ b/core/tests/coretests/src/android/content/res/ResourcesLocaleTest.java
@@ -16,6 +16,7 @@
 
 package android.content.res;
 
+import android.content.Context;
 import android.os.FileUtils;
 import android.os.LocaleList;
 import android.platform.test.annotations.Presubmit;
@@ -97,4 +98,24 @@
         assertEquals(Locale.forLanguageTag("pl-PL"),
                 resources.getConfiguration().getLocales().get(0));
     }
+
+    @SmallTest
+    public void testDeprecatedISOLanguageCode() {
+        assertResGetString(Locale.US, R.string.locale_test_res_1, "Testing ID");
+        assertResGetString(Locale.forLanguageTag("id"), R.string.locale_test_res_2, "Pengujian IN");
+        assertResGetString(Locale.forLanguageTag("id"), R.string.locale_test_res_3, "Testing EN");
+        assertResGetString(new Locale("id"), R.string.locale_test_res_2, "Pengujian IN");
+        assertResGetString(new Locale("id"), R.string.locale_test_res_3, "Testing EN");
+        // The new ISO code "id" isn't supported yet, and thus the values-id are ignored.
+        assertResGetString(new Locale("id"), R.string.locale_test_res_1, "Testing ID");
+        assertResGetString(Locale.forLanguageTag("id"), R.string.locale_test_res_1, "Testing ID");
+    }
+
+    private void assertResGetString(Locale locale, int resId, String expectedString) {
+        LocaleList locales = new LocaleList(locale);
+        final Configuration config = new Configuration();
+        config.setLocales(locales);
+        Context newContext = getContext().createConfigurationContext(config);
+        assertEquals(expectedString, newContext.getResources().getString(resId));
+    }
 }
diff --git a/core/tests/coretests/src/android/service/euicc/OWNERS b/core/tests/coretests/src/android/service/euicc/OWNERS
new file mode 100644
index 0000000..41fc56b4
--- /dev/null
+++ b/core/tests/coretests/src/android/service/euicc/OWNERS
@@ -0,0 +1 @@
+include platform/frameworks/base:/telephony/java/android/service/euicc/OWNERS
diff --git a/core/tests/coretests/src/android/window/flags/WindowFlagsTest.java b/core/tests/coretests/src/android/window/flags/WindowFlagsTest.java
new file mode 100644
index 0000000..a8b4032
--- /dev/null
+++ b/core/tests/coretests/src/android/window/flags/WindowFlagsTest.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.window.flags;
+
+import static com.android.window.flags.Flags.syncWindowConfigUpdateFlag;
+
+import android.platform.test.annotations.Presubmit;
+
+import androidx.test.filters.SmallTest;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * Tests for {@link com.android.window.flags.Flags}
+ *
+ * Build/Install/Run:
+ *  atest FrameworksCoreTests:WindowFlagsTest
+ */
+@RunWith(AndroidJUnit4.class)
+@SmallTest
+@Presubmit
+public class WindowFlagsTest {
+
+    @Test
+    public void testSyncWindowConfigUpdateFlag() {
+        // No crash when accessing the flag.
+        syncWindowConfigUpdateFlag();
+    }
+}
diff --git a/libs/hwui/utils/LinearAllocator.cpp b/libs/hwui/utils/LinearAllocator.cpp
index 8baa4b77..eab888e 100644
--- a/libs/hwui/utils/LinearAllocator.cpp
+++ b/libs/hwui/utils/LinearAllocator.cpp
@@ -31,15 +31,11 @@
 #include <utils/Log.h>
 #include <utils/Macros.h>
 
-// The ideal size of a page allocation (these need to be multiples of 8)
-#define INITIAL_PAGE_SIZE ((size_t)512)  // 512b
-#define MAX_PAGE_SIZE ((size_t)131072)   // 128kb
-
 // The maximum amount of wasted space we can have per page
 // Allocations exceeding this will have their own dedicated page
 // If this is too low, we will malloc too much
 // Too high, and we may waste too much space
-// Must be smaller than INITIAL_PAGE_SIZE
+// Must be smaller than kInitialPageSize
 #define MAX_WASTE_RATIO (0.5f)
 
 #if LOG_NDEBUG
@@ -75,6 +71,10 @@
 namespace android {
 namespace uirenderer {
 
+// The ideal size of a page allocation (these need to be multiples of 8)
+static constexpr size_t kInitialPageSize = 512;  // 512b
+static constexpr size_t kMaxPageSize = 131072;   // 128kb
+
 class LinearAllocator::Page {
 public:
     Page* next() { return mNextPage; }
@@ -94,8 +94,8 @@
 };
 
 LinearAllocator::LinearAllocator()
-        : mPageSize(INITIAL_PAGE_SIZE)
-        , mMaxAllocSize(INITIAL_PAGE_SIZE * MAX_WASTE_RATIO)
+        : mPageSize(kInitialPageSize)
+        , mMaxAllocSize(kInitialPageSize * MAX_WASTE_RATIO)
         , mNext(0)
         , mCurrentPage(0)
         , mPages(0)
@@ -135,8 +135,8 @@
 void LinearAllocator::ensureNext(size_t size) {
     if (fitsInCurrentPage(size)) return;
 
-    if (mCurrentPage && mPageSize < MAX_PAGE_SIZE) {
-        mPageSize = min(MAX_PAGE_SIZE, mPageSize * 2);
+    if (mCurrentPage && mPageSize < kMaxPageSize) {
+        mPageSize = min(kMaxPageSize, mPageSize * 2);
         mMaxAllocSize = mPageSize * MAX_WASTE_RATIO;
         mPageSize = ALIGN(mPageSize);
     }
diff --git a/location/java/android/location/GnssRequest.java b/location/java/android/location/GnssRequest.java
index 9c9766f..f3a40cc 100644
--- a/location/java/android/location/GnssRequest.java
+++ b/location/java/android/location/GnssRequest.java
@@ -41,7 +41,7 @@
      *
      * <p>If true, GNSS chipset switches off duty cycling. In such a mode, no clock
      * discontinuities are expected, and when supported, carrier phase should be continuous in
-     * good signal conditions. All non-blacklisted, healthy constellations, satellites and
+     * good signal conditions. All non-denylisted, healthy constellations, satellites and
      * frequency bands that the chipset supports must be reported in this mode. The GNSS chipset
      * is allowed to consume more power in this mode. If false, GNSS chipset optimizes power via
      * duty cycling, constellations and frequency limits, etc.
@@ -138,7 +138,7 @@
          *
          * <p>If true, GNSS chipset switches off duty cycling. In such a mode, no clock
          * discontinuities are expected, and when supported, carrier phase should be continuous in
-         * good signal conditions. All non-blacklisted, healthy constellations, satellites and
+         * good signal conditions. All non-denylisted, healthy constellations, satellites and
          * frequency bands that the chipset supports must be reported in this mode. The GNSS chipset
          * is allowed to consume more power in this mode. If false, GNSS chipset optimizes power via
          * duty cycling, constellations and frequency limits, etc.
diff --git a/media/java/android/media/Cea708CaptionRenderer.java b/media/java/android/media/Cea708CaptionRenderer.java
index 88912fe..efaf3d2 100644
--- a/media/java/android/media/Cea708CaptionRenderer.java
+++ b/media/java/android/media/Cea708CaptionRenderer.java
@@ -194,7 +194,7 @@
     private final StringBuffer mBuffer = new StringBuffer();
     private int mCommand = 0;
 
-    // Assign a dummy listener in order to avoid null checks.
+    // Assign a placeholder listener in order to avoid null checks.
     private DisplayListener mListener = new DisplayListener() {
         @Override
         public void emitEvent(CaptionEvent event) {
diff --git a/media/java/android/media/voice/KeyphraseModelManager.java b/media/java/android/media/voice/KeyphraseModelManager.java
index 8ec8967..290f1ac 100644
--- a/media/java/android/media/voice/KeyphraseModelManager.java
+++ b/media/java/android/media/voice/KeyphraseModelManager.java
@@ -35,7 +35,7 @@
  * This class provides management of voice based sound recognition models. Usage of this class is
  * restricted to system or signature applications only. This allows OEMs to write apps that can
  * manage voice based sound trigger models.
- * Callers of this class are expected to have whitelist manifest permission MANAGE_VOICE_KEYPHRASES.
+ * Callers of this class are expected to have allowlist manifest permission MANAGE_VOICE_KEYPHRASES.
  * Callers of this class are expected to be the designated voice interaction service via
  * {@link Settings.Secure.VOICE_INTERACTION_SERVICE} or a bundled voice model enrollment application
  * detected by {@link android.hardware.soundtrigger.KeyphraseEnrollmentInfo}.
diff --git a/media/tests/MediaRouter/src/com/android/mediaroutertest/MediaRouter2ManagerTest.java b/media/tests/MediaRouter/src/com/android/mediaroutertest/MediaRouter2ManagerTest.java
index 4086dec..7f4a4fe 100644
--- a/media/tests/MediaRouter/src/com/android/mediaroutertest/MediaRouter2ManagerTest.java
+++ b/media/tests/MediaRouter/src/com/android/mediaroutertest/MediaRouter2ManagerTest.java
@@ -872,7 +872,7 @@
         CountDownLatch addedLatch = new CountDownLatch(1);
         CountDownLatch preferenceLatch = new CountDownLatch(1);
 
-        // A dummy callback is required to send route feature info.
+        // A placeholder callback is required to send route feature info.
         RouteCallback routeCallback = new RouteCallback() {};
         MediaRouter2Manager.Callback managerCallback = new MediaRouter2Manager.Callback() {
             @Override
diff --git a/packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java b/packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java
index 9c6113c..3de6cfd 100644
--- a/packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java
+++ b/packages/PackageInstaller/src/com/android/packageinstaller/PackageInstallerActivity.java
@@ -371,7 +371,7 @@
         if (mLocalLOGV) Log.i(TAG, "onResume(): mAppSnippet=" + mAppSnippet);
 
         if (mAppSnippet != null) {
-            // load dummy layout with OK button disabled until we override this layout in
+            // load placeholder layout with OK button disabled until we override this layout in
             // startInstallConfirm
             bindUi();
             checkIfAllowedAndInitiateInstall();
diff --git a/packages/SettingsLib/src/com/android/settingslib/bluetooth/BluetoothUtils.java b/packages/SettingsLib/src/com/android/settingslib/bluetooth/BluetoothUtils.java
index 2d958a9..1ab787e 100644
--- a/packages/SettingsLib/src/com/android/settingslib/bluetooth/BluetoothUtils.java
+++ b/packages/SettingsLib/src/com/android/settingslib/bluetooth/BluetoothUtils.java
@@ -294,8 +294,8 @@
      */
     public static boolean isDeviceClassMatched(@NonNull BluetoothDevice bluetoothDevice,
             int device) {
-        return bluetoothDevice.getBluetoothClass() != null
-                && bluetoothDevice.getBluetoothClass().getDeviceClass() == device;
+        final BluetoothClass bluetoothClass = bluetoothDevice.getBluetoothClass();
+        return bluetoothClass != null && bluetoothClass.getDeviceClass() == device;
     }
 
     private static boolean isAdvancedHeaderEnabled() {
diff --git a/packages/SystemUI/docs/qs-tiles.md b/packages/SystemUI/docs/qs-tiles.md
index 488f8c7..bd0b4ab 100644
--- a/packages/SystemUI/docs/qs-tiles.md
+++ b/packages/SystemUI/docs/qs-tiles.md
@@ -123,7 +123,7 @@
 
 ### API classes
 
-The classes that define the public API are in [core/java/android/service/quicksettings](core/java/android/service/quicksettings).
+The classes that define the public API are in [core/java/android/service/quicksettings](/core/java/android/service/quicksettings).
 
 #### Tile
 
diff --git a/packages/SystemUI/tests/src/com/android/AAAPlusPlusVerifySysuiRequiredTestPropertiesTest.java b/packages/SystemUI/tests/src/com/android/AAAPlusPlusVerifySysuiRequiredTestPropertiesTest.java
index 0369d5b..ddc4e32 100644
--- a/packages/SystemUI/tests/src/com/android/AAAPlusPlusVerifySysuiRequiredTestPropertiesTest.java
+++ b/packages/SystemUI/tests/src/com/android/AAAPlusPlusVerifySysuiRequiredTestPropertiesTest.java
@@ -131,7 +131,7 @@
         // with the main process dependency graph because it will not exist
         // at runtime and could lead to incorrect tests which assume
         // the main SystemUI process. Therefore, exclude this package
-        // from the base class whitelist.
+        // from the base class allowlist.
         filter.add(s -> !s.startsWith("com.android.systemui.screenshot"));
         return filter;
     }
diff --git a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java
index 5e2fa98..1b75909 100644
--- a/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java
+++ b/packages/SystemUI/tests/src/com/android/systemui/statusbar/policy/InflatedSmartRepliesTest.java
@@ -64,7 +64,7 @@
 public class InflatedSmartRepliesTest extends SysuiTestCase {
 
     private static final Intent TEST_INTENT = new Intent("com.android.SMART_REPLY_VIEW_ACTION");
-    private static final Intent WHITELISTED_TEST_INTENT =
+    private static final Intent ALLOWLISTED_TEST_INTENT =
             new Intent("com.android.WHITELISTED_TEST_ACTION");
 
     @Mock private SmartReplyConstants mSmartReplyConstants;
@@ -343,7 +343,7 @@
 
         assertThat(smartReplyState.getSmartReplies().choices)
                 .containsExactlyElementsIn(mEntry.getSmartReplies()).inOrder();
-        // Since no apps are whitelisted no actions should be shown.
+        // Since no apps are allowlisted no actions should be shown.
         assertThat(smartReplyState.getSmartActions().actions).isEmpty();
         assertThat(smartReplyState.getSuppressedActions()).isNull();
         assertThat(smartReplyState.getHasPhishingAction()).isFalse();
@@ -358,7 +358,7 @@
         allowedResolveInfo.activityInfo.packageName = allowedPackage;
         when(mPackageManagerWrapper
                 .resolveActivity(
-                        argThat(intent -> WHITELISTED_TEST_INTENT.getAction().equals(
+                        argThat(intent -> ALLOWLISTED_TEST_INTENT.getAction().equals(
                                 intent.getAction())),
                         anyInt() /* flags */))
                 .thenReturn(allowedResolveInfo);
@@ -368,7 +368,7 @@
         // suggestions.
         setupAppGeneratedReplies(null /* smartReplies */);
         ArrayList<Notification.Action> actions = new ArrayList<>();
-        actions.add(createAction("allowed action", WHITELISTED_TEST_INTENT));
+        actions.add(createAction("allowed action", ALLOWLISTED_TEST_INTENT));
         actions.add(createAction("non-allowed action", TEST_INTENT));
 
         modifyRanking(mEntry)
@@ -379,7 +379,7 @@
         InflatedSmartReplyState smartReplyState =
                 mSmartReplyStateInflater.chooseSmartRepliesAndActions(mEntry);
 
-        // Only the action for the whitelisted package should be allowed.
+        // Only the action for the allowlisted package should be allowed.
         assertThat(smartReplyState.getSmartActions().actions)
                 .containsExactly(mEntry.getSmartActions().get(0));
         assertThat(smartReplyState.getSuppressedActions()).isNull();
diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
index 9d91b97..3714bed 100644
--- a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
+++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
@@ -3960,14 +3960,14 @@
                 mContext.enforceCallingOrSelfPermission(
                         android.Manifest.permission.BIND_APPWIDGET, null);
             } catch (SecurityException se) {
-                if (!isCallerBindAppWidgetWhiteListedLocked(packageName)) {
+                if (!isCallerBindAppWidgetAllowListedLocked(packageName)) {
                     return false;
                 }
             }
             return true;
         }
 
-        private boolean isCallerBindAppWidgetWhiteListedLocked(String packageName) {
+        private boolean isCallerBindAppWidgetAllowListedLocked(String packageName) {
             final int userId = UserHandle.getCallingUserId();
             final int packageUid = getUidForPackage(packageName, userId);
             if (packageUid < 0) {
diff --git a/services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java b/services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java
index 20b2a74..7b3c330 100644
--- a/services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java
+++ b/services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java
@@ -1351,7 +1351,7 @@
             Slog.v(TAG, "setAugmentedAutofillWhitelistLocked(packages=" + packages + ", activities="
                     + activities + ")");
         }
-        whitelistForAugmentedAutofillPackages(packages, activities);
+        allowlistForAugmentedAutofillPackages(packages, activities);
         final String serviceName;
         if (mRemoteAugmentedAutofillServiceInfo != null) {
             serviceName = mRemoteAugmentedAutofillServiceInfo.getComponentName()
@@ -1415,7 +1415,7 @@
     /**
      * @throws IllegalArgumentException if packages or components are empty.
      */
-    private void whitelistForAugmentedAutofillPackages(@Nullable List<String> packages,
+    private void allowlistForAugmentedAutofillPackages(@Nullable List<String> packages,
             @Nullable List<ComponentName> components) {
         // TODO(b/123100824): add CTS test for when it's null
         synchronized (mLock) {
diff --git a/services/core/java/com/android/server/CertBlacklister.java b/services/core/java/com/android/server/CertBlacklister.java
index c16378b..e726c6a 100644
--- a/services/core/java/com/android/server/CertBlacklister.java
+++ b/services/core/java/com/android/server/CertBlacklister.java
@@ -31,17 +31,17 @@
 import libcore.io.IoUtils;
 
 /**
- * <p>CertBlacklister provides a simple mechanism for updating the platform blacklists for SSL
+ * <p>CertBlacklister provides a simple mechanism for updating the platform denylists for SSL
  * certificate public keys and serial numbers.
  */
 public class CertBlacklister extends Binder {
 
     private static final String TAG = "CertBlacklister";
 
-    private static final String BLACKLIST_ROOT = System.getenv("ANDROID_DATA") + "/misc/keychain/";
+    private static final String DENYLIST_ROOT = System.getenv("ANDROID_DATA") + "/misc/keychain/";
 
-    public static final String PUBKEY_PATH = BLACKLIST_ROOT + "pubkey_blacklist.txt";
-    public static final String SERIAL_PATH = BLACKLIST_ROOT + "serial_blacklist.txt";
+    public static final String PUBKEY_PATH = DENYLIST_ROOT + "pubkey_blacklist.txt";
+    public static final String SERIAL_PATH = DENYLIST_ROOT + "serial_blacklist.txt";
 
     public static final String PUBKEY_BLACKLIST_KEY = "pubkey_blacklist";
     public static final String SERIAL_BLACKLIST_KEY = "serial_blacklist";
@@ -66,14 +66,14 @@
         @Override
         public void onChange(boolean selfChange) {
             super.onChange(selfChange);
-            writeBlacklist();
+            writeDenylist();
         }
 
         public String getValue() {
             return Settings.Secure.getString(mContentResolver, mKey);
         }
 
-        private void writeBlacklist() {
+        private void writeDenylist() {
             new Thread("BlacklistUpdater") {
                 public void run() {
                     synchronized(mTmpDir) {
diff --git a/services/core/java/com/android/server/VcnManagementService.java b/services/core/java/com/android/server/VcnManagementService.java
index c6e9a7d..7acca19 100644
--- a/services/core/java/com/android/server/VcnManagementService.java
+++ b/services/core/java/com/android/server/VcnManagementService.java
@@ -456,7 +456,13 @@
         final List<SubscriptionInfo> subscriptionInfos = new ArrayList<>();
         Binder.withCleanCallingIdentity(
                 () -> {
-                    subscriptionInfos.addAll(subMgr.getSubscriptionsInGroup(subscriptionGroup));
+                    List<SubscriptionInfo> subsInGroup =
+                            subMgr.getSubscriptionsInGroup(subscriptionGroup);
+                    if (subsInGroup == null) {
+                        logWtf("Received null from getSubscriptionsInGroup");
+                        subsInGroup = Collections.emptyList();
+                    }
+                    subscriptionInfos.addAll(subsInGroup);
                 });
 
         for (SubscriptionInfo info : subscriptionInfos) {
diff --git a/services/core/java/com/android/server/audio/AudioDeviceBroker.java b/services/core/java/com/android/server/audio/AudioDeviceBroker.java
index c17d2c8..1ad2420 100644
--- a/services/core/java/com/android/server/audio/AudioDeviceBroker.java
+++ b/services/core/java/com/android/server/audio/AudioDeviceBroker.java
@@ -1941,7 +1941,7 @@
         if (btSCoOn) {
             // Use the SCO device known to BtHelper so that it matches exactly
             // what has been communicated to audio policy manager. The device
-            // returned by requestedCommunicationDevice() can be a dummy SCO device if legacy
+            // returned by requestedCommunicationDevice() can be a placeholder SCO device if legacy
             // APIs are used to start SCO audio.
             AudioDeviceAttributes device = mBtHelper.getHeadsetAudioDevice();
             if (device != null) {
diff --git a/services/core/java/com/android/server/content/SyncManager.java b/services/core/java/com/android/server/content/SyncManager.java
index eb81e70..7df66e6 100644
--- a/services/core/java/com/android/server/content/SyncManager.java
+++ b/services/core/java/com/android/server/content/SyncManager.java
@@ -714,7 +714,7 @@
         // This can be noisy, therefore we will allowlist sync adapters installed
         // before we started checking for account access because they already know
         // the account (they run before) which is the genie is out of the bottle.
-        whiteListExistingSyncAdaptersIfNeeded();
+        allowListExistingSyncAdaptersIfNeeded();
 
         mLogger.log("Sync manager initialized: " + Build.FINGERPRINT);
     }
@@ -755,7 +755,7 @@
         }
     }
 
-    private void whiteListExistingSyncAdaptersIfNeeded() {
+    private void allowListExistingSyncAdaptersIfNeeded() {
         if (!mSyncStorageEngine.shouldGrantSyncAdaptersAccountAccess()) {
             return;
         }
diff --git a/services/core/java/com/android/server/content/SyncManagerConstants.java b/services/core/java/com/android/server/content/SyncManagerConstants.java
index 2a5858c..409b469 100644
--- a/services/core/java/com/android/server/content/SyncManagerConstants.java
+++ b/services/core/java/com/android/server/content/SyncManagerConstants.java
@@ -52,11 +52,11 @@
     private static final int DEF_MAX_RETRIES_WITH_APP_STANDBY_EXEMPTION = 5;
     private int mMaxRetriesWithAppStandbyExemption = DEF_MAX_RETRIES_WITH_APP_STANDBY_EXEMPTION;
 
-    private static final String KEY_EXEMPTION_TEMP_WHITELIST_DURATION_IN_SECONDS =
+    private static final String KEY_EXEMPTION_TEMP_ALLOWLIST_DURATION_IN_SECONDS =
             "exemption_temp_whitelist_duration_in_seconds";
-    private static final int DEF_EXEMPTION_TEMP_WHITELIST_DURATION_IN_SECONDS = 10 * 60;
+    private static final int DEF_EXEMPTION_TEMP_ALLOWLIST_DURATION_IN_SECONDS = 10 * 60;
     private int mKeyExemptionTempWhitelistDurationInSeconds
-            = DEF_EXEMPTION_TEMP_WHITELIST_DURATION_IN_SECONDS;
+            = DEF_EXEMPTION_TEMP_ALLOWLIST_DURATION_IN_SECONDS;
 
     protected SyncManagerConstants(Context context) {
         super(null);
@@ -105,8 +105,8 @@
                     DEF_MAX_RETRIES_WITH_APP_STANDBY_EXEMPTION);
 
             mKeyExemptionTempWhitelistDurationInSeconds = parser.getInt(
-                    KEY_EXEMPTION_TEMP_WHITELIST_DURATION_IN_SECONDS,
-                    DEF_EXEMPTION_TEMP_WHITELIST_DURATION_IN_SECONDS);
+                    KEY_EXEMPTION_TEMP_ALLOWLIST_DURATION_IN_SECONDS,
+                    DEF_EXEMPTION_TEMP_ALLOWLIST_DURATION_IN_SECONDS);
 
         }
     }
diff --git a/services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java b/services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java
index 025ccd1..8d4eff9 100644
--- a/services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java
+++ b/services/core/java/com/android/server/integrity/AppIntegrityManagerServiceImpl.java
@@ -725,7 +725,7 @@
     }
 
     private String getCallingRulePusherPackageName(int callingUid) {
-        // Obtain the system apps that are whitelisted in config_integrityRuleProviderPackages.
+        // Obtain the system apps that are allowlisted in config_integrityRuleProviderPackages.
         List<String> allowedRuleProviders = getAllowedRuleProviderSystemApps();
         if (DEBUG_INTEGRITY_COMPONENT) {
             Slog.i(
diff --git a/services/core/java/com/android/server/net/NetworkPolicyLogger.java b/services/core/java/com/android/server/net/NetworkPolicyLogger.java
index dc8fcb0..85731651 100644
--- a/services/core/java/com/android/server/net/NetworkPolicyLogger.java
+++ b/services/core/java/com/android/server/net/NetworkPolicyLogger.java
@@ -338,8 +338,8 @@
         return "App idle state of uid " + uid + ": " + idle;
     }
 
-    private static String getAppIdleWlChangedLog(int uid, boolean isWhitelisted) {
-        return "App idle whitelist state of uid " + uid + ": " + isWhitelisted;
+    private static String getAppIdleWlChangedLog(int uid, boolean isAllowlisted) {
+        return "App idle whitelist state of uid " + uid + ": " + isAllowlisted;
     }
 
     private static String getParoleStateChanged(boolean paroleOn) {
@@ -519,14 +519,14 @@
             data.timeStamp = System.currentTimeMillis();
         }
 
-        public void appIdleWlChanged(int uid, boolean isWhitelisted) {
+        public void appIdleWlChanged(int uid, boolean isAllowlisted) {
             final Data data = getNextSlot();
             if (data == null) return;
 
             data.reset();
             data.type = EVENT_APP_IDLE_WL_CHANGED;
             data.ifield1 = uid;
-            data.bfield1 = isWhitelisted;
+            data.bfield1 = isAllowlisted;
             data.timeStamp = System.currentTimeMillis();
         }
 
diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
index d285337..6eaf24a 100644
--- a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
+++ b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
@@ -362,7 +362,7 @@
     private static final String TAG_NETWORK_POLICY = "network-policy";
     private static final String TAG_UID_POLICY = "uid-policy";
     private static final String TAG_APP_POLICY = "app-policy";
-    private static final String TAG_WHITELIST = "whitelist";
+    private static final String TAG_ALLOWLIST = "whitelist";
     private static final String TAG_RESTRICT_BACKGROUND = "restrict-background";
     private static final String TAG_REVOKED_RESTRICT_BACKGROUND = "revoked-restrict-background";
     private static final String TAG_XML_UTILS_INT_ARRAY = "int-array";
@@ -856,7 +856,7 @@
     }
 
     @GuardedBy("mUidRulesFirstLock")
-    private void updatePowerSaveWhitelistUL() {
+    private void updatePowerSaveAllowlistUL() {
         int[] whitelist = mPowerWhitelistManager.getWhitelistedAppIds(/* includingIdle */ false);
         mPowerSaveWhitelistExceptIdleAppIds.clear();
         for (int uid : whitelist) {
@@ -947,7 +947,7 @@
 
             synchronized (mUidRulesFirstLock) {
                 synchronized (mNetworkPoliciesSecondLock) {
-                    updatePowerSaveWhitelistUL();
+                    updatePowerSaveAllowlistUL();
                     mPowerManagerInternal = LocalServices.getService(PowerManagerInternal.class);
                     mPowerManagerInternal.registerLowPowerModeObserver(
                             new PowerManagerInternal.LowPowerModeListener() {
@@ -1189,7 +1189,7 @@
         public void onReceive(Context context, Intent intent) {
             // on background handler thread, and POWER_SAVE_WHITELIST_CHANGED is protected
             synchronized (mUidRulesFirstLock) {
-                updatePowerSaveWhitelistUL();
+                updatePowerSaveAllowlistUL();
                 updateRulesForRestrictPowerUL();
                 updateRulesForAppIdleUL();
             }
@@ -2679,7 +2679,7 @@
                         } else {
                             Slog.w(TAG, "unable to apply policy to UID " + uid + "; ignoring");
                         }
-                    } else if (TAG_WHITELIST.equals(tag)) {
+                    } else if (TAG_ALLOWLIST.equals(tag)) {
                         insideAllowlist = true;
                     } else if (TAG_RESTRICT_BACKGROUND.equals(tag) && insideAllowlist) {
                         final int uid = readIntAttribute(in, ATTR_UID);
@@ -2689,7 +2689,7 @@
                         mRestrictBackgroundAllowlistRevokedUids.put(uid, true);
                     }
                 } else if (type == END_TAG) {
-                    if (TAG_WHITELIST.equals(tag)) {
+                    if (TAG_ALLOWLIST.equals(tag)) {
                         insideAllowlist = false;
                     }
 
@@ -2865,7 +2865,7 @@
             out.endTag(null, TAG_POLICY_LIST);
 
             // write all allowlists
-            out.startTag(null, TAG_WHITELIST);
+            out.startTag(null, TAG_ALLOWLIST);
 
             // revoked restrict background allowlist
             int size = mRestrictBackgroundAllowlistRevokedUids.size();
@@ -2876,7 +2876,7 @@
                 out.endTag(null, TAG_REVOKED_RESTRICT_BACKGROUND);
             }
 
-            out.endTag(null, TAG_WHITELIST);
+            out.endTag(null, TAG_ALLOWLIST);
 
             out.endDocument();
 
@@ -4356,7 +4356,7 @@
     void updateRulesForPowerSaveUL() {
         Trace.traceBegin(Trace.TRACE_TAG_NETWORK, "updateRulesForPowerSaveUL");
         try {
-            updateRulesForWhitelistedPowerSaveUL(mRestrictPower, FIREWALL_CHAIN_POWERSAVE,
+            updateRulesForAllowlistedPowerSaveUL(mRestrictPower, FIREWALL_CHAIN_POWERSAVE,
                     mUidFirewallPowerSaveRules);
         } finally {
             Trace.traceEnd(Trace.TRACE_TAG_NETWORK);
@@ -4365,14 +4365,14 @@
 
     @GuardedBy("mUidRulesFirstLock")
     void updateRuleForRestrictPowerUL(int uid) {
-        updateRulesForWhitelistedPowerSaveUL(uid, mRestrictPower, FIREWALL_CHAIN_POWERSAVE);
+        updateRulesForAllowlistedPowerSaveUL(uid, mRestrictPower, FIREWALL_CHAIN_POWERSAVE);
     }
 
     @GuardedBy("mUidRulesFirstLock")
     void updateRulesForDeviceIdleUL() {
         Trace.traceBegin(Trace.TRACE_TAG_NETWORK, "updateRulesForDeviceIdleUL");
         try {
-            updateRulesForWhitelistedPowerSaveUL(mDeviceIdleMode, FIREWALL_CHAIN_DOZABLE,
+            updateRulesForAllowlistedPowerSaveUL(mDeviceIdleMode, FIREWALL_CHAIN_DOZABLE,
                     mUidFirewallDozableRules);
         } finally {
             Trace.traceEnd(Trace.TRACE_TAG_NETWORK);
@@ -4381,26 +4381,26 @@
 
     @GuardedBy("mUidRulesFirstLock")
     void updateRuleForDeviceIdleUL(int uid) {
-        updateRulesForWhitelistedPowerSaveUL(uid, mDeviceIdleMode, FIREWALL_CHAIN_DOZABLE);
+        updateRulesForAllowlistedPowerSaveUL(uid, mDeviceIdleMode, FIREWALL_CHAIN_DOZABLE);
     }
 
     // NOTE: since both fw_dozable and fw_powersave uses the same map
     // (mPowerSaveTempWhitelistAppIds) for allowlisting, we can reuse their logic in this method.
     @GuardedBy("mUidRulesFirstLock")
-    private void updateRulesForWhitelistedPowerSaveUL(boolean enabled, int chain,
+    private void updateRulesForAllowlistedPowerSaveUL(boolean enabled, int chain,
             SparseIntArray rules) {
         if (enabled) {
-            // Sync the whitelists before enabling the chain.  We don't care about the rules if
+            // Sync the allowlists before enabling the chain.  We don't care about the rules if
             // we are disabling the chain.
             final SparseIntArray uidRules = rules;
             uidRules.clear();
             final List<UserInfo> users = mUserManager.getUsers();
             for (int ui = users.size() - 1; ui >= 0; ui--) {
                 UserInfo user = users.get(ui);
-                updateRulesForWhitelistedAppIds(uidRules, mPowerSaveTempWhitelistAppIds, user.id);
-                updateRulesForWhitelistedAppIds(uidRules, mPowerSaveWhitelistAppIds, user.id);
+                updateRulesForAllowlistedAppIds(uidRules, mPowerSaveTempWhitelistAppIds, user.id);
+                updateRulesForAllowlistedAppIds(uidRules, mPowerSaveWhitelistAppIds, user.id);
                 if (chain == FIREWALL_CHAIN_POWERSAVE) {
-                    updateRulesForWhitelistedAppIds(uidRules,
+                    updateRulesForAllowlistedAppIds(uidRules,
                             mPowerSaveWhitelistExceptIdleAppIds, user.id);
                 }
             }
@@ -4415,7 +4415,7 @@
         }
     }
 
-    private void updateRulesForWhitelistedAppIds(final SparseIntArray uidRules,
+    private void updateRulesForAllowlistedAppIds(final SparseIntArray uidRules,
             final SparseBooleanArray whitelistedAppIds, int userId) {
         for (int i = whitelistedAppIds.size() - 1; i >= 0; --i) {
             if (whitelistedAppIds.valueAt(i)) {
@@ -4476,12 +4476,12 @@
      *        allowlisted.
      */
     @GuardedBy("mUidRulesFirstLock")
-    private boolean isWhitelistedFromPowerSaveUL(int uid, boolean deviceIdleMode) {
+    private boolean isAllowlistedFromPowerSaveUL(int uid, boolean deviceIdleMode) {
         final int appId = UserHandle.getAppId(uid);
         boolean isWhitelisted = mPowerSaveTempWhitelistAppIds.get(appId)
                 || mPowerSaveWhitelistAppIds.get(appId);
         if (!deviceIdleMode) {
-            isWhitelisted = isWhitelisted || isWhitelistedFromPowerSaveExceptIdleUL(uid);
+            isWhitelisted = isWhitelisted || isAllowlistedFromPowerSaveExceptIdleUL(uid);
         }
         return isWhitelisted;
     }
@@ -4491,7 +4491,7 @@
      * (eg: Battery Saver and app idle).
      */
     @GuardedBy("mUidRulesFirstLock")
-    private boolean isWhitelistedFromPowerSaveExceptIdleUL(int uid) {
+    private boolean isAllowlistedFromPowerSaveExceptIdleUL(int uid) {
         final int appId = UserHandle.getAppId(uid);
         return mPowerSaveWhitelistExceptIdleAppIds.get(appId);
     }
@@ -4507,9 +4507,9 @@
     // NOTE: since both fw_dozable and fw_powersave uses the same map
     // (mPowerSaveTempWhitelistAppIds) for allowlisting, we can reuse their logic in this method.
     @GuardedBy("mUidRulesFirstLock")
-    private void updateRulesForWhitelistedPowerSaveUL(int uid, boolean enabled, int chain) {
+    private void updateRulesForAllowlistedPowerSaveUL(int uid, boolean enabled, int chain) {
         if (enabled) {
-            final boolean isWhitelisted = isWhitelistedFromPowerSaveUL(uid,
+            final boolean isWhitelisted = isAllowlistedFromPowerSaveUL(uid,
                     chain == FIREWALL_CHAIN_DOZABLE);
             if (isWhitelisted || isUidForegroundOnRestrictPowerUL(uid)) {
                 setUidFirewallRuleUL(chain, uid, FIREWALL_RULE_ALLOW);
@@ -4767,7 +4767,7 @@
     }
 
     @GuardedBy("mUidRulesFirstLock")
-    private void updateRulesForTempWhitelistChangeUL(int appId) {
+    private void updateRulesForTempAllowlistChangeUL(int appId) {
         final List<UserInfo> users = mUserManager.getUsers();
         final int numUsers = users.size();
         for (int i = 0; i < numUsers; i++) {
@@ -5158,7 +5158,7 @@
         final boolean isForeground = isUidForegroundOnRestrictPowerUL(uid);
         final boolean isTop = isUidTop(uid);
 
-        final boolean isWhitelisted = isWhitelistedFromPowerSaveUL(uid, mDeviceIdleMode);
+        final boolean isWhitelisted = isAllowlistedFromPowerSaveUL(uid, mDeviceIdleMode);
 
         final int oldEffectiveBlockedReasons;
         final int newEffectiveBlockedReasons;
@@ -5181,9 +5181,9 @@
             newAllowedReasons |= (isSystem(uid) ? ALLOWED_REASON_SYSTEM : 0);
             newAllowedReasons |= (isForeground ? ALLOWED_REASON_FOREGROUND : 0);
             newAllowedReasons |= (isTop ? ALLOWED_REASON_TOP : 0);
-            newAllowedReasons |= (isWhitelistedFromPowerSaveUL(uid, true)
+            newAllowedReasons |= (isAllowlistedFromPowerSaveUL(uid, true)
                     ? ALLOWED_REASON_POWER_SAVE_ALLOWLIST : 0);
-            newAllowedReasons |= (isWhitelistedFromPowerSaveExceptIdleUL(uid)
+            newAllowedReasons |= (isAllowlistedFromPowerSaveExceptIdleUL(uid)
                     ? ALLOWED_REASON_POWER_SAVE_EXCEPT_IDLE_ALLOWLIST : 0);
             newAllowedReasons |= (uidBlockedState.allowedReasons
                     & ALLOWED_REASON_RESTRICTED_MODE_PERMISSIONS);
@@ -6095,7 +6095,7 @@
                 } else {
                     mPowerSaveTempWhitelistAppIds.delete(appId);
                 }
-                updateRulesForTempWhitelistChangeUL(appId);
+                updateRulesForTempAllowlistChangeUL(appId);
             }
         }
 
diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerShellCommand.java b/services/core/java/com/android/server/net/NetworkPolicyManagerShellCommand.java
index 47bb8f0..34c8a0d 100644
--- a/services/core/java/com/android/server/net/NetworkPolicyManagerShellCommand.java
+++ b/services/core/java/com/android/server/net/NetworkPolicyManagerShellCommand.java
@@ -154,13 +154,13 @@
         }
         switch(type) {
             case "app-idle-whitelist":
-                return listAppIdleWhitelist();
+                return listAppIdleAllowlist();
             case "wifi-networks":
                 return listWifiNetworks();
             case "restrict-background-whitelist":
-                return listRestrictBackgroundWhitelist();
+                return listRestrictBackgroundAllowlist();
             case "restrict-background-blacklist":
-                return listRestrictBackgroundBlacklist();
+                return listRestrictBackgroundDenylist();
         }
         pw.println("Error: unknown list type '" + type + "'");
         return -1;
@@ -175,11 +175,11 @@
         }
         switch(type) {
             case "restrict-background-whitelist":
-                return addRestrictBackgroundWhitelist();
+                return addRestrictBackgroundAllowlist();
             case "restrict-background-blacklist":
-                return addRestrictBackgroundBlacklist();
+                return addRestrictBackgroundDenylist();
             case "app-idle-whitelist":
-                return addAppIdleWhitelist();
+                return addAppIdleAllowlist();
         }
         pw.println("Error: unknown add type '" + type + "'");
         return -1;
@@ -194,11 +194,11 @@
         }
         switch(type) {
             case "restrict-background-whitelist":
-                return removeRestrictBackgroundWhitelist();
+                return removeRestrictBackgroundAllowlist();
             case "restrict-background-blacklist":
-                return removeRestrictBackgroundBlacklist();
+                return removeRestrictBackgroundDenylist();
             case "app-idle-whitelist":
-                return removeAppIdleWhitelist();
+                return removeAppIdleAllowlist();
         }
         pw.println("Error: unknown remove type '" + type + "'");
         return -1;
@@ -241,17 +241,17 @@
         return 0;
     }
 
-    private int listRestrictBackgroundWhitelist() throws RemoteException {
+    private int listRestrictBackgroundAllowlist() throws RemoteException {
         return listUidPolicies("Restrict background whitelisted UIDs",
                 POLICY_ALLOW_METERED_BACKGROUND);
     }
 
-    private int listRestrictBackgroundBlacklist() throws RemoteException {
+    private int listRestrictBackgroundDenylist() throws RemoteException {
         return listUidPolicies("Restrict background blacklisted UIDs",
                 POLICY_REJECT_METERED_BACKGROUND);
     }
 
-    private int listAppIdleWhitelist() throws RemoteException {
+    private int listAppIdleAllowlist() throws RemoteException {
         final PrintWriter pw = getOutPrintWriter();
         final int[] uids = mInterface.getAppIdleWhitelist();
         return listUidList("App Idle whitelisted UIDs", uids);
@@ -311,23 +311,23 @@
         return 0;
     }
 
-    private int addRestrictBackgroundWhitelist() throws RemoteException {
+    private int addRestrictBackgroundAllowlist() throws RemoteException {
         return setUidPolicy(POLICY_ALLOW_METERED_BACKGROUND);
     }
 
-    private int removeRestrictBackgroundWhitelist() throws RemoteException {
+    private int removeRestrictBackgroundAllowlist() throws RemoteException {
         return resetUidPolicy("not whitelisted", POLICY_ALLOW_METERED_BACKGROUND);
     }
 
-    private int addRestrictBackgroundBlacklist() throws RemoteException {
+    private int addRestrictBackgroundDenylist() throws RemoteException {
         return setUidPolicy(POLICY_REJECT_METERED_BACKGROUND);
     }
 
-    private int removeRestrictBackgroundBlacklist() throws RemoteException {
+    private int removeRestrictBackgroundDenylist() throws RemoteException {
         return resetUidPolicy("not blacklisted", POLICY_REJECT_METERED_BACKGROUND);
     }
 
-    private int setAppIdleWhitelist(boolean isWhitelisted) {
+    private int setAppIdleAllowlist(boolean isWhitelisted) {
         final int uid = getUidFromNextArg();
         if (uid < 0) {
             return uid;
@@ -336,12 +336,12 @@
         return 0;
     }
 
-    private int addAppIdleWhitelist() throws RemoteException {
-        return setAppIdleWhitelist(true);
+    private int addAppIdleAllowlist() throws RemoteException {
+        return setAppIdleAllowlist(true);
     }
 
-    private int removeAppIdleWhitelist() throws RemoteException {
-        return setAppIdleWhitelist(false);
+    private int removeAppIdleAllowlist() throws RemoteException {
+        return setAppIdleAllowlist(false);
     }
 
     private int listWifiNetworks() {
diff --git a/services/core/java/com/android/server/policy/SoftRestrictedPermissionPolicy.java b/services/core/java/com/android/server/policy/SoftRestrictedPermissionPolicy.java
index ab71355..ed8cf4f 100644
--- a/services/core/java/com/android/server/policy/SoftRestrictedPermissionPolicy.java
+++ b/services/core/java/com/android/server/policy/SoftRestrictedPermissionPolicy.java
@@ -215,7 +215,7 @@
                             return true;
                         }
 
-                        // The package is now a part of the forced scoped storage whitelist
+                        // The package is now a part of the forced scoped storage allowlist
                         if (isForcedScopedStorage) {
                             return true;
                         }
diff --git a/services/core/java/com/android/server/security/KeyChainSystemService.java b/services/core/java/com/android/server/security/KeyChainSystemService.java
index edd4a3d..1eb2839 100644
--- a/services/core/java/com/android/server/security/KeyChainSystemService.java
+++ b/services/core/java/com/android/server/security/KeyChainSystemService.java
@@ -53,7 +53,7 @@
     /**
      * Maximum time limit for the KeyChain app to deal with packages being removed.
      */
-    private static final int KEYCHAIN_IDLE_WHITELIST_DURATION_MS = 30 * 1000;
+    private static final int KEYCHAIN_IDLE_ALLOWLIST_DURATION_MS = 30 * 1000;
 
     public KeyChainSystemService(final Context context) {
         super(context);
@@ -104,7 +104,7 @@
         final DeviceIdleInternal idleController =
                 LocalServices.getService(DeviceIdleInternal.class);
         idleController.addPowerSaveTempWhitelistApp(Process.myUid(), packageName,
-                KEYCHAIN_IDLE_WHITELIST_DURATION_MS, user.getIdentifier(), false,
+                KEYCHAIN_IDLE_ALLOWLIST_DURATION_MS, user.getIdentifier(), false,
                 REASON_KEY_CHAIN, "keychain");
 
         getContext().startServiceAsUser(intent, user);
diff --git a/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java b/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
index 2bd7383..1c5838c 100644
--- a/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
+++ b/services/core/java/com/android/server/security/rkp/RemoteProvisioningService.java
@@ -105,14 +105,27 @@
         @Override
         protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
             if (!DumpUtils.checkDumpPermission(getContext(), TAG, pw)) return;
-            new RemoteProvisioningShellCommand().dump(pw);
+            final int callerUid = Binder.getCallingUidOrThrow();
+            final long callingIdentity = Binder.clearCallingIdentity();
+            try {
+                new RemoteProvisioningShellCommand(getContext(), callerUid).dump(pw);
+            } finally {
+                Binder.restoreCallingIdentity(callingIdentity);
+            }
         }
 
         @Override
         public int handleShellCommand(ParcelFileDescriptor in, ParcelFileDescriptor out,
                 ParcelFileDescriptor err, String[] args) {
-            return new RemoteProvisioningShellCommand().exec(this, in.getFileDescriptor(),
-                    out.getFileDescriptor(), err.getFileDescriptor(), args);
+            final int callerUid = Binder.getCallingUidOrThrow();
+            final long callingIdentity = Binder.clearCallingIdentity();
+            try {
+                return new RemoteProvisioningShellCommand(getContext(), callerUid).exec(this,
+                        in.getFileDescriptor(), out.getFileDescriptor(), err.getFileDescriptor(),
+                        args);
+            } finally {
+                Binder.restoreCallingIdentity(callingIdentity);
+            }
         }
     }
 }
diff --git a/services/core/java/com/android/server/security/rkp/RemoteProvisioningShellCommand.java b/services/core/java/com/android/server/security/rkp/RemoteProvisioningShellCommand.java
index 187b939..4a6d746 100644
--- a/services/core/java/com/android/server/security/rkp/RemoteProvisioningShellCommand.java
+++ b/services/core/java/com/android/server/security/rkp/RemoteProvisioningShellCommand.java
@@ -16,22 +16,30 @@
 
 package com.android.server.security.rkp;
 
+import android.content.Context;
 import android.hardware.security.keymint.DeviceInfo;
 import android.hardware.security.keymint.IRemotelyProvisionedComponent;
 import android.hardware.security.keymint.MacedPublicKey;
 import android.hardware.security.keymint.ProtectedData;
 import android.hardware.security.keymint.RpcHardwareInfo;
+import android.os.CancellationSignal;
+import android.os.OutcomeReceiver;
 import android.os.RemoteException;
 import android.os.ServiceManager;
 import android.os.ShellCommand;
+import android.security.rkp.service.RegistrationProxy;
+import android.security.rkp.service.RemotelyProvisionedKey;
 import android.util.IndentingPrintWriter;
 
-import com.android.internal.annotations.VisibleForTesting;
-
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.PrintWriter;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.time.Duration;
 import java.util.Base64;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Executor;
 
 import co.nstant.in.cbor.CborDecoder;
 import co.nstant.in.cbor.CborEncoder;
@@ -54,16 +62,17 @@
             + "csr [--challenge CHALLENGE] NAME\n"
             + "  Generate and print a base64-encoded CSR from the named\n"
             + "  IRemotelyProvisionedComponent. A base64-encoded challenge can be provided,\n"
-            + "  or else it defaults to an empty challenge.\n";
+            + "  or else it defaults to an empty challenge.\n"
+            + "certify NAME\n"
+            + "  Output the PEM-encoded certificate chain provisioned for the named\n"
+            + "  IRemotelyProvisionedComponent.\n";
 
-    @VisibleForTesting
     static final String EEK_ED25519_BASE64 = "goRDoQEnoFgqpAEBAycgBiFYIJm57t1e5FL2hcZMYtw+YatXSH11N"
             + "ymtdoAy0rPLY1jZWEAeIghLpLekyNdOAw7+uK8UTKc7b6XN3Np5xitk/pk5r3bngPpmAIUNB5gqrJFcpyUUS"
             + "QY0dcqKJ3rZ41pJ6wIDhEOhASegWE6lAQECWCDQrsEVyirPc65rzMvRlh1l6LHd10oaN7lDOpfVmd+YCAM4G"
             + "CAEIVggvoXnRsSjQlpA2TY6phXQLFh+PdwzAjLS/F4ehyVfcmBYQJvPkOIuS6vRGLEOjl0gJ0uEWP78MpB+c"
             + "gWDvNeCvvpkeC1UEEvAMb9r6B414vAtzmwvT/L1T6XUg62WovGHWAQ=";
 
-    @VisibleForTesting
     static final String EEK_P256_BASE64 = "goRDoQEmoFhNpQECAyYgASFYIPcUituX9MxT79JkEcTjdR9mH6RxDGzP"
             + "+glGgHSHVPKtIlggXn9b9uzk9hnM/xM3/Q+hyJPbGAZ2xF3m12p3hsMtr49YQC+XjkL7vgctlUeFR5NAsB/U"
             + "m0ekxESp8qEHhxDHn8sR9L+f6Dvg5zRMFfx7w34zBfTRNDztAgRgehXgedOK/ySEQ6EBJqBYcaYBAgJYIDVz"
@@ -74,14 +83,20 @@
     private static final int ERROR = -1;
     private static final int SUCCESS = 0;
 
+    private static final Duration BIND_TIMEOUT = Duration.ofSeconds(10);
+    private static final int KEY_ID = 452436;
+
+    private final Context mContext;
+    private final int mCallerUid;
     private final Injector mInjector;
 
-    RemoteProvisioningShellCommand() {
-        this(new Injector());
+    RemoteProvisioningShellCommand(Context context, int callerUid) {
+        this(context, callerUid, new Injector());
     }
 
-    @VisibleForTesting
-    RemoteProvisioningShellCommand(Injector injector) {
+    RemoteProvisioningShellCommand(Context context, int callerUid, Injector injector) {
+        mContext = context;
+        mCallerUid = callerUid;
         mInjector = injector;
     }
 
@@ -102,6 +117,8 @@
                     return list();
                 case "csr":
                     return csr();
+                case "certify":
+                    return certify();
                 default:
                     return handleDefaultCommands(cmd);
             }
@@ -232,7 +249,45 @@
         return new CborDecoder(bais).decodeNext();
     }
 
-    @VisibleForTesting
+    private int certify() throws Exception {
+        String name = getNextArgRequired();
+
+        Executor executor = mContext.getMainExecutor();
+        CancellationSignal cancellationSignal = new CancellationSignal();
+        OutcomeFuture<RemotelyProvisionedKey> key = new OutcomeFuture<>();
+        mInjector.getRegistrationProxy(mContext, mCallerUid, name, executor)
+                .getKeyAsync(KEY_ID, cancellationSignal, executor, key);
+        byte[] encodedCertChain = key.join().getEncodedCertChain();
+        ByteArrayInputStream is = new ByteArrayInputStream(encodedCertChain);
+        PrintWriter pw = getOutPrintWriter();
+        for (Certificate cert : CertificateFactory.getInstance("X.509").generateCertificates(is)) {
+            String encoded = Base64.getEncoder().encodeToString(cert.getEncoded());
+            pw.println("-----BEGIN CERTIFICATE-----");
+            pw.println(encoded.replaceAll("(.{64})", "$1\n").stripTrailing());
+            pw.println("-----END CERTIFICATE-----");
+        }
+        return SUCCESS;
+    }
+
+    /** Treat an OutcomeReceiver as a future for use in synchronous code. */
+    private static class OutcomeFuture<T> implements OutcomeReceiver<T, Exception> {
+        private CompletableFuture<T> mFuture = new CompletableFuture<>();
+
+        @Override
+          public void onResult(T result) {
+            mFuture.complete(result);
+        }
+
+        @Override
+        public void onError(Exception e) {
+            mFuture.completeExceptionally(e);
+        }
+
+        public T join() {
+            return mFuture.join();
+        }
+    }
+
     static class Injector {
         String[] getIrpcNames() {
             return ServiceManager.getDeclaredInstances(IRemotelyProvisionedComponent.DESCRIPTOR);
@@ -248,5 +303,14 @@
             }
             return binder;
         }
+
+        RegistrationProxy getRegistrationProxy(
+                Context context, int callerUid, String name, Executor executor) {
+            String irpc = IRemotelyProvisionedComponent.DESCRIPTOR + "/" + name;
+            OutcomeFuture<RegistrationProxy> registration = new OutcomeFuture<>();
+            RegistrationProxy.createAsync(
+                    context, callerUid, irpc, BIND_TIMEOUT, executor, registration);
+            return registration.join();
+        }
     }
 }
diff --git a/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningShellCommandTest.java b/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningShellCommandTest.java
index 2d93120..007c0db 100644
--- a/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningShellCommandTest.java
+++ b/services/tests/RemoteProvisioningServiceTests/src/com/android/server/security/rkp/RemoteProvisioningShellCommandTest.java
@@ -21,12 +21,14 @@
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import android.content.Context;
 import android.hardware.security.keymint.DeviceInfo;
 import android.hardware.security.keymint.IRemotelyProvisionedComponent;
 import android.hardware.security.keymint.MacedPublicKey;
@@ -34,28 +36,35 @@
 import android.hardware.security.keymint.RpcHardwareInfo;
 import android.os.Binder;
 import android.os.FileUtils;
+import android.os.OutcomeReceiver;
+import android.os.Process;
+import android.security.rkp.service.RegistrationProxy;
+import android.security.rkp.service.RemotelyProvisionedKey;
 
+import androidx.test.core.app.ApplicationProvider;
 import androidx.test.runner.AndroidJUnit4;
 
+import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
+import java.util.Arrays;
 import java.util.Base64;
 import java.util.Map;
+import java.util.concurrent.Executor;
 
 @RunWith(AndroidJUnit4.class)
 public class RemoteProvisioningShellCommandTest {
 
+    private Context mContext;
+
     private static class Injector extends RemoteProvisioningShellCommand.Injector {
 
-        private final Map<String, IRemotelyProvisionedComponent> mIrpcs;
-
-        Injector(Map irpcs) {
-            mIrpcs = irpcs;
-        }
+        Map<String, IRemotelyProvisionedComponent> mIrpcs;
+        Map<String, RegistrationProxy> mRegistrationProxies;
 
         @Override
         String[] getIrpcNames() {
@@ -70,6 +79,12 @@
             }
             return irpc;
         }
+
+        @Override
+        RegistrationProxy getRegistrationProxy(
+                Context context, int callerUid, String name, Executor executor) {
+            return mRegistrationProxies.get(name);
+        }
     }
 
     private static class CommandResult {
@@ -111,10 +126,17 @@
                 code, FileUtils.readTextFile(out, 0, null), FileUtils.readTextFile(err, 0, null));
     }
 
+    @Before
+    public void setUp() {
+        mContext = ApplicationProvider.getApplicationContext();
+    }
+
     @Test
     public void list_zeroInstances() throws Exception {
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of();
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of()));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {"list"});
         assertThat(res.getErr()).isEmpty();
         assertThat(res.getCode()).isEqualTo(0);
@@ -124,8 +146,10 @@
 
     @Test
     public void list_oneInstances() throws Exception {
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of("default", mock(IRemotelyProvisionedComponent.class));
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of("default", mock(IRemotelyProvisionedComponent.class))));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {"list"});
         assertThat(res.getErr()).isEmpty();
         assertThat(res.getCode()).isEqualTo(0);
@@ -134,10 +158,12 @@
 
     @Test
     public void list_twoInstances() throws Exception {
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of(
+                "default", mock(IRemotelyProvisionedComponent.class),
+                "strongbox", mock(IRemotelyProvisionedComponent.class));
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of(
-                       "default", mock(IRemotelyProvisionedComponent.class),
-                       "strongbox", mock(IRemotelyProvisionedComponent.class))));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {"list"});
         assertThat(res.getErr()).isEmpty();
         assertThat(res.getCode()).isEqualTo(0);
@@ -158,8 +184,10 @@
         }).when(defaultMock).generateCertificateRequest(
                 anyBoolean(), any(), any(), any(), any(), any());
 
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of("default", defaultMock);
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of("default", defaultMock)));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {
                 "csr", "--challenge", "dGVzdHRlc3R0ZXN0dGVzdA==", "default"});
         verify(defaultMock).generateCertificateRequest(
@@ -189,8 +217,10 @@
         }).when(defaultMock).generateCertificateRequest(
                 anyBoolean(), any(), any(), any(), any(), any());
 
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of("default", defaultMock);
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of("default", defaultMock)));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {
                 "csr", "--challenge", "dGVzdHRlc3R0ZXN0dGVzdA==", "default"});
         verify(defaultMock).generateCertificateRequest(
@@ -215,8 +245,10 @@
         when(defaultMock.generateCertificateRequestV2(any(), any()))
             .thenReturn(new byte[] {0x68, 0x65, 0x6c, 0x6c, 0x6f});
 
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of("default", defaultMock);
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of("default", defaultMock)));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {"csr", "default"});
         verify(defaultMock).generateCertificateRequestV2(new MacedPublicKey[0], new byte[0]);
         assertThat(res.getErr()).isEmpty();
@@ -233,8 +265,10 @@
         when(defaultMock.generateCertificateRequestV2(any(), any()))
             .thenReturn(new byte[] {0x68, 0x69});
 
+        Injector injector = new Injector();
+        injector.mIrpcs = Map.of("default", defaultMock);
         RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
-                new Injector(Map.of("default", defaultMock)));
+                mContext, Process.SHELL_UID, injector);
         CommandResult res = exec(cmd, new String[] {"csr", "--challenge", "dHJpYWw=", "default"});
         verify(defaultMock).generateCertificateRequestV2(
                 new MacedPublicKey[0], new byte[] {0x74, 0x72, 0x69, 0x61, 0x6c});
@@ -242,4 +276,82 @@
         assertThat(res.getCode()).isEqualTo(0);
         assertThat(res.getOut()).isEqualTo("aGk=\n");
     }
+
+    @Test
+    public void certify_sameOrderAsReceived() throws Exception {
+        String cert1 = "MIIBqDCCAU2gAwIBAgIUI3FFU7xZno/2Xf/wZzKKquP0ov0wCgYIKoZIzj0EAwIw\n"
+                + "KTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ0wCwYDVQQKDARUZXN0MB4XDTIz\n"
+                + "MDgyMjE5MzgxMFoXDTMzMDgxOTE5MzgxMFowKTELMAkGA1UEBhMCVVMxCzAJBgNV\n"
+                + "BAgMAkNBMQ0wCwYDVQQKDARUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n"
+                + "czOpG6NKOdDjV/yrKjuy0q0jEJvsVLGgTeY+vyKRBJS59OhyRWG6n3aza21bNg5d\n"
+                + "WE9ruz+bcT0IP4kDbiS0y6NTMFEwHQYDVR0OBBYEFHYfJxCUipNI7qRqvczcWsOb\n"
+                + "FIDPMB8GA1UdIwQYMBaAFHYfJxCUipNI7qRqvczcWsObFIDPMA8GA1UdEwEB/wQF\n"
+                + "MAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIhAKm/kpJwlnWkjoLCAddBiSnxbT4EfJIK\n"
+                + "H0j58tg5VazHAiEAnS/kRzU9AbstOZyD7el/ws3gLXkbUNey3pLFutBWsSU=\n";
+        String cert2 = "MIIBpjCCAU2gAwIBAgIUdSzfZzeGr+h70JPO7Sxwdkw99iMwCgYIKoZIzj0EAwIw\n"
+                + "KTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ0wCwYDVQQKDARUZXN0MB4XDTIz\n"
+                + "MDgyMjIwMTcyMFoXDTMzMDgxOTIwMTcyMFowKTELMAkGA1UEBhMCVVMxCzAJBgNV\n"
+                + "BAgMAkNBMQ0wCwYDVQQKDARUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE\n"
+                + "voGJi4DxuqH8rzPV6Eq0OVULc0xFzaM0500VBqiQEB7Qt0Ktk2d+3bUrFAb3SZV4\n"
+                + "6TIdb7SkynvaDtr0x45Ng6NTMFEwHQYDVR0OBBYEFMeGjvGV0ADPBJk5/FPoW9HQ\n"
+                + "uTc6MB8GA1UdIwQYMBaAFMeGjvGV0ADPBJk5/FPoW9HQuTc6MA8GA1UdEwEB/wQF\n"
+                + "MAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIgd1gu7iiNOQXaQUn5BT3WwWR0Yk78ndWt\n"
+                + "ew7tRiTOhFcCIFURi6WcNH0oWa6IbwBSMC9aZlo98Fbg+dTwhLAAw+PW\n";
+        byte[] cert1Bytes = Base64.getDecoder().decode(cert1.replaceAll("\\s+", ""));
+        byte[] cert2Bytes = Base64.getDecoder().decode(cert2.replaceAll("\\s+", ""));
+        byte[] certChain = Arrays.copyOf(cert1Bytes, cert1Bytes.length + cert2Bytes.length);
+        System.arraycopy(cert2Bytes, 0, certChain, cert1Bytes.length, cert2Bytes.length);
+        RemotelyProvisionedKey keyMock = mock(RemotelyProvisionedKey.class);
+        when(keyMock.getEncodedCertChain()).thenReturn(certChain);
+        RegistrationProxy defaultMock = mock(RegistrationProxy.class);
+        doAnswer(invocation -> {
+            ((OutcomeReceiver<RemotelyProvisionedKey, Exception>) invocation.getArgument(3))
+                    .onResult(keyMock);
+            return null;
+        }).when(defaultMock).getKeyAsync(anyInt(), any(), any(), any());
+
+        Injector injector = new Injector();
+        injector.mRegistrationProxies = Map.of("default", defaultMock);
+        RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
+                mContext, Process.SHELL_UID, injector);
+        CommandResult res = exec(cmd, new String[] {"certify", "default"});
+        assertThat(res.getErr()).isEmpty();
+        assertThat(res.getCode()).isEqualTo(0);
+        assertThat(res.getOut()).isEqualTo(
+                "-----BEGIN CERTIFICATE-----\n" + cert1 + "-----END CERTIFICATE-----\n"
+                + "-----BEGIN CERTIFICATE-----\n" + cert2 + "-----END CERTIFICATE-----\n");
+    }
+
+    @Test
+    public void certify_noBlankLineBeforeTrailer() throws Exception {
+        String cert = "MIIB2zCCAYGgAwIBAgIRAOpN7Em1k7gaqLAB2dzXUTYwCgYIKoZIzj0EAwIwKTET\n"
+                + "MBEGA1UEChMKR29vZ2xlIExMQzESMBAGA1UEAxMJRHJvaWQgQ0EzMB4XDTIzMDgx\n"
+                + "ODIzMzI1MloXDTIzMDkyMTIzMzI1MlowOTEMMAoGA1UEChMDVEVFMSkwJwYDVQQD\n"
+                + "EyBlYTRkZWM0OWI1OTNiODFhYThiMDAxZDlkY2Q3NTEzNjBZMBMGByqGSM49AgEG\n"
+                + "CCqGSM49AwEHA0IABHM/cKZblmlw8bdGbDXnX+ZiLiGjSjaLHXYOoHDrVArAMXUi\n"
+                + "L6brhcUPaqSGcVLcfFZbaFMOxXW6TsGdQiwJ0iyjejB4MB0GA1UdDgQWBBTYzft+\n"
+                + "X32TH/Hh+ngwQF6aPhnfXDAfBgNVHSMEGDAWgBQT4JObI9mzNNW2FRsHRcw4zVn2\n"
+                + "8jAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwICBDAVBgorBgEEAdZ5AgEe\n"
+                + "BAehARoABAAAMAoGCCqGSM49BAMCA0gAMEUCIDc0OR7CzIYw0myTr0y/Brl1nZyk\n"
+                + "eGSQp615WpTwYhwxAiEApM10gSIKBIo7Z4/FNzkuiz1zZwW9+Dcqisqxkfe6icQ=\n";
+        byte[] certBytes = Base64.getDecoder().decode(cert.replaceAll("\\s+", ""));
+        RemotelyProvisionedKey keyMock = mock(RemotelyProvisionedKey.class);
+        when(keyMock.getEncodedCertChain()).thenReturn(certBytes);
+        RegistrationProxy defaultMock = mock(RegistrationProxy.class);
+        doAnswer(invocation -> {
+            ((OutcomeReceiver<RemotelyProvisionedKey, Exception>) invocation.getArgument(3))
+                    .onResult(keyMock);
+            return null;
+        }).when(defaultMock).getKeyAsync(anyInt(), any(), any(), any());
+
+        Injector injector = new Injector();
+        injector.mRegistrationProxies = Map.of("strongbox", defaultMock);
+        RemoteProvisioningShellCommand cmd = new RemoteProvisioningShellCommand(
+                mContext, Process.SHELL_UID, injector);
+        CommandResult res = exec(cmd, new String[] {"certify", "strongbox"});
+        assertThat(res.getErr()).isEmpty();
+        assertThat(res.getCode()).isEqualTo(0);
+        assertThat(res.getOut()).isEqualTo(
+                "-----BEGIN CERTIFICATE-----\n" + cert + "-----END CERTIFICATE-----\n");
+    }
 }
diff --git a/services/tests/servicestests/utils/com/android/server/testutils/TestHandler.java b/services/tests/servicestests/utils/com/android/server/testutils/TestHandler.java
index 22d383a..fc5213c 100644
--- a/services/tests/servicestests/utils/com/android/server/testutils/TestHandler.java
+++ b/services/tests/servicestests/utils/com/android/server/testutils/TestHandler.java
@@ -82,7 +82,7 @@
             uptimeMillis = uptimeMillis - SystemClock.uptimeMillis() + mClock.getAsLong();
         }
 
-        // post a dummy queue entry to keep track of message removal
+        // post a sentinel queue entry to keep track of message removal
         return super.sendMessageAtTime(msg, Long.MAX_VALUE)
                 && mMessages.add(new MsgInfo(Message.obtain(msg), uptimeMillis, mMessageCount));
     }
diff --git a/telephony/common/com/android/internal/telephony/SmsApplication.java b/telephony/common/com/android/internal/telephony/SmsApplication.java
index 4230225..dc75fb5 100644
--- a/telephony/common/com/android/internal/telephony/SmsApplication.java
+++ b/telephony/common/com/android/internal/telephony/SmsApplication.java
@@ -783,7 +783,7 @@
                         AppOpsManager.MODE_ALLOWED);
             }
         } catch (NameNotFoundException e) {
-            // No whitelisted system app on this device
+            // No allowlisted system app on this device
             Log.e(LOG_TAG, "Package not found: " + packageName);
         }
 
diff --git a/telephony/java/android/telephony/SmsManager.java b/telephony/java/android/telephony/SmsManager.java
index 1cf2969..1a28ad8 100644
--- a/telephony/java/android/telephony/SmsManager.java
+++ b/telephony/java/android/telephony/SmsManager.java
@@ -340,7 +340,7 @@
     }
 
     /**
-     * Get {@link Context#getOpPackageName()} if this manager has a context, otherwise a dummy
+     * Get {@link Context#getOpPackageName()} if this manager has a context, otherwise a placeholder
      * value.
      *
      * @return The package name to be used for app-ops checks
diff --git a/telephony/java/android/telephony/TelephonyManager.java b/telephony/java/android/telephony/TelephonyManager.java
index fa60031..692ac70 100644
--- a/telephony/java/android/telephony/TelephonyManager.java
+++ b/telephony/java/android/telephony/TelephonyManager.java
@@ -7713,7 +7713,7 @@
     }
 
     /**
-     * Rollback modem configurations to factory default except some config which are in whitelist.
+     * Rollback modem configurations to factory default except some config which are in allowlist.
      * Used for device configuration by some carriers.
      *
      * <p>Requires Permission:
@@ -14785,7 +14785,7 @@
      *
      *  1) User data is turned on, or
      *  2) APN is un-metered for this subscription, or
-     *  3) APN type is whitelisted. E.g. MMS is whitelisted if
+     *  3) APN type is allowlisted. E.g. MMS is allowlisted if
      *  {@link #MOBILE_DATA_POLICY_MMS_ALWAYS_ALLOWED} is enabled.
      *
      * @param apnType Value indicating the apn type. Apn types are defined in {@link ApnSetting}.
diff --git a/telephony/java/android/telephony/ims/ImsReasonInfo.java b/telephony/java/android/telephony/ims/ImsReasonInfo.java
index dda021e..67acda0 100644
--- a/telephony/java/android/telephony/ims/ImsReasonInfo.java
+++ b/telephony/java/android/telephony/ims/ImsReasonInfo.java
@@ -460,7 +460,7 @@
      */
     public static final int CODE_LOW_BATTERY = 505;
     /**
-     * Device declined a call due to a blacklisted caller ID.
+     * Device declined a call due to a denylisted caller ID.
      */
     public static final int CODE_BLACKLISTED_CALL_ID = 506;
     // IMS -> Telephony
diff --git a/tests/ApkVerityTest/ApkVerityTestApp/feature_split/src/com/android/apkverity/feature_x/DummyActivity.java b/tests/ApkVerityTest/ApkVerityTestApp/feature_split/src/com/android/apkverity/feature_x/DummyActivity.java
index 0f694c2..fe91260 100644
--- a/tests/ApkVerityTest/ApkVerityTestApp/feature_split/src/com/android/apkverity/feature_x/DummyActivity.java
+++ b/tests/ApkVerityTest/ApkVerityTestApp/feature_split/src/com/android/apkverity/feature_x/DummyActivity.java
@@ -18,5 +18,5 @@
 
 import android.app.Activity;
 
-/** Dummy class just to generate some dex */
+/** Placeholder class just to generate some dex */
 public class DummyActivity extends Activity {}
diff --git a/tests/ApkVerityTest/ApkVerityTestApp/src/com/android/apkverity/DummyActivity.java b/tests/ApkVerityTest/ApkVerityTestApp/src/com/android/apkverity/DummyActivity.java
index 837c7be..a7bd771 100644
--- a/tests/ApkVerityTest/ApkVerityTestApp/src/com/android/apkverity/DummyActivity.java
+++ b/tests/ApkVerityTest/ApkVerityTestApp/src/com/android/apkverity/DummyActivity.java
@@ -18,5 +18,5 @@
 
 import android.app.Activity;
 
-/** Dummy class just to generate some dex */
+/** Placeholder class just to generate some dex */
 public class DummyActivity extends Activity {}
diff --git a/tests/AppLaunch/src/com/android/tests/applaunch/AppLaunch.java b/tests/AppLaunch/src/com/android/tests/applaunch/AppLaunch.java
index 1a58f17..fa452dd 100644
--- a/tests/AppLaunch/src/com/android/tests/applaunch/AppLaunch.java
+++ b/tests/AppLaunch/src/com/android/tests/applaunch/AppLaunch.java
@@ -674,7 +674,7 @@
             return true;
         }
 
-        // iorap compiler filters specified: the compilerFilter must be in the whitelist.
+        // iorap compiler filters specified: the compilerFilter must be in the allowlist.
         if (mIorapCompilerFilters.indexOf(compilerFilter) != -1) {
             return true;
         }
diff --git a/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/GraphExporter.java b/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/GraphExporter.java
index 0013965..4b7ca53 100644
--- a/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/GraphExporter.java
+++ b/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/GraphExporter.java
@@ -113,7 +113,7 @@
                         getDotName(target.getFilter().getName()) + ":" +
                         getDotName(target.getName()) + "_IN;\n" );
                 } else {
-                    // Found a unconnected output port, add dummy node
+                    // Found a unconnected output port, add placeholder node
                     String color = filter.getSignature().getOutputPortInfo(portName).isRequired()
                         ? "red" : "blue";  // red for unconnected, required ports
                     dotFile.write("  " +
@@ -131,7 +131,7 @@
                 if(target != null) {
                     // Found a connection -- nothing to do, connections have been written out above
                 } else {
-                    // Found a unconnected input port, add dummy node
+                    // Found a unconnected input port, add placeholder node
                     String color = filter.getSignature().getInputPortInfo(portName).isRequired()
                         ? "red" : "blue";  // red for unconnected, required ports
                     dotFile.write("  " +
diff --git a/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/MffContext.java b/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/MffContext.java
index b7212f9..6bd6c18 100644
--- a/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/MffContext.java
+++ b/tests/Camera2Tests/SmartCamera/SimpleCamera/src/androidx/media/filterfw/MffContext.java
@@ -66,9 +66,9 @@
 
         /**
          * On older Android versions the Camera may need a SurfaceView to render into in order to
-         * function. You may specify a dummy SurfaceView here if you do not want the context to
+         * function. You may specify a placeholder SurfaceView here if you do not want the context to
          * create its own view. Note, that your view may or may not be used. You cannot rely on
-         * your dummy view to be used by the Camera. If you pass null, no dummy view will be used.
+         * your placeholder view to be used by the Camera. If you pass null, no placeholder view will be used.
          * In this case your application may not run correctly on older devices if you use the
          * camera. This flag has no effect if you do not require the camera.
          */
@@ -104,7 +104,7 @@
     /** The current context state. */
     private State mState = new State();
 
-    /** A dummy SurfaceView that is required for Camera operation on older devices. */
+    /** A placeholder SurfaceView that is required for Camera operation on older devices. */
     private SurfaceView mDummySurfaceView = null;
 
     /** Handler to execute code in the context's thread, such as issuing callbacks. */
@@ -126,7 +126,7 @@
      * multiple MffContexts, however data between them cannot be shared. The context must be
      * created in a thread with a Looper (such as the main/UI thread).
      *
-     * On older versions of Android, the MffContext may create a visible dummy view for the
+     * On older versions of Android, the MffContext may create a visible placeholder view for the
      * camera to render into. This is a 1x1 SurfaceView that is placed into the top-left corner.
      *
      * @param context The application context to attach the MffContext to.
@@ -142,7 +142,7 @@
      * multiple MffContexts, however data between them cannot be shared. The context must be
      * created in a thread with a Looper (such as the main/UI thread).
      *
-     * On older versions of Android, the MffContext may create a visible dummy view for the
+     * On older versions of Android, the MffContext may create a visible placeholder view for the
      * camera to render into. This is a 1x1 SurfaceView that is placed into the top-left corner.
      * You may alternatively specify your own SurfaceView in the configuration.
      *
diff --git a/tests/DynamicCodeLoggerIntegrationTests/src/com/android/dcl/Simple.java b/tests/DynamicCodeLoggerIntegrationTests/src/com/android/dcl/Simple.java
index e995a26..2ca91fb 100644
--- a/tests/DynamicCodeLoggerIntegrationTests/src/com/android/dcl/Simple.java
+++ b/tests/DynamicCodeLoggerIntegrationTests/src/com/android/dcl/Simple.java
@@ -16,7 +16,7 @@
 
 package com.android.dcl;
 
-/** Dummy class which is built into a jar purely so we can pass it to DexClassLoader. */
+/** Placeholder class which is built into a jar purely so we can pass it to DexClassLoader. */
 public final class Simple {
     public Simple() {}
 }
diff --git a/tests/Internal/src/stub/DummyWallpaperService.java b/tests/Internal/src/stub/DummyWallpaperService.java
index 084c036..db1b780 100644
--- a/tests/Internal/src/stub/DummyWallpaperService.java
+++ b/tests/Internal/src/stub/DummyWallpaperService.java
@@ -19,7 +19,7 @@
 import android.service.wallpaper.WallpaperService;
 
 /**
- * Dummy wallpaper service only for test purposes, won't draw anything.
+ * Placeholder wallpaper service only for test purposes, won't draw anything.
  */
 public class DummyWallpaperService extends WallpaperService {
     @Override
diff --git a/tests/PlatformCompatGating/src/com/android/compat/testing/DummyApi.java b/tests/PlatformCompatGating/src/com/android/compat/testing/DummyApi.java
index 731be8e..a77950f 100644
--- a/tests/PlatformCompatGating/src/com/android/compat/testing/DummyApi.java
+++ b/tests/PlatformCompatGating/src/com/android/compat/testing/DummyApi.java
@@ -24,7 +24,7 @@
 import com.android.internal.compat.IPlatformCompat;
 
 /**
- * This is a dummy API to test gating
+ * This is a placeholder API to test gating
  *
  * @hide
  */
@@ -36,7 +36,7 @@
     public static final long CHANGE_SYSTEM_SERVER = 666016;
 
     /**
-     * Dummy method
+     * Placeholder method
      * @return "A" if change is enabled, "B" otherwise.
      */
     public static String dummyFunc() {
@@ -47,7 +47,7 @@
     }
 
     /**
-     * Dummy combined method
+     * Placeholder combined method
      * @return "0" if {@link CHANGE_ID_1} is disabled and {@link CHANGE_ID_2} is disabled,
                "1" if {@link CHANGE_ID_1} is disabled and {@link CHANGE_ID_2} is enabled,
                "2" if {@link CHANGE_ID_1} is enabled and {@link CHANGE_ID_2} is disabled,
@@ -68,7 +68,7 @@
     }
 
     /**
-     * Dummy api using system server API.
+     * Placeholder api using system server API.
      */
     public static boolean dummySystemServer(Context context) {
         IPlatformCompat platformCompat = IPlatformCompat.Stub
diff --git a/tests/SoundTriggerTestApp/src/com/android/test/soundtrigger/SoundTriggerTestService.java b/tests/SoundTriggerTestApp/src/com/android/test/soundtrigger/SoundTriggerTestService.java
index 6d4ffcf..f9e9205 100644
--- a/tests/SoundTriggerTestApp/src/com/android/test/soundtrigger/SoundTriggerTestService.java
+++ b/tests/SoundTriggerTestApp/src/com/android/test/soundtrigger/SoundTriggerTestService.java
@@ -469,7 +469,7 @@
             }
         }
 
-        // Create a few dummy models if we didn't load anything.
+        // Create a few placeholder models if we didn't load anything.
         if (!loadedModel) {
             Properties dummyModelProperties = new Properties();
             for (String name : new String[]{"1", "2", "3"}) {
diff --git a/tests/libs-permissions/system_ext/java/com/android/test/libs/system_ext/LibsSystemExtTest.java b/tests/libs-permissions/system_ext/java/com/android/test/libs/system_ext/LibsSystemExtTest.java
index 9999aba..673c73a 100644
--- a/tests/libs-permissions/system_ext/java/com/android/test/libs/system_ext/LibsSystemExtTest.java
+++ b/tests/libs-permissions/system_ext/java/com/android/test/libs/system_ext/LibsSystemExtTest.java
@@ -22,7 +22,7 @@
 public class LibsSystemExtTest {
 
     /**
-     * Dummy method for testing.
+     * Placeholder method for testing.
      */
     public static void test() {
     }
diff --git a/tools/aapt/Android.bp b/tools/aapt/Android.bp
index cc10db9..cecd95a 100644
--- a/tools/aapt/Android.bp
+++ b/tools/aapt/Android.bp
@@ -97,6 +97,7 @@
         "ResourceTable.cpp",
         "SourcePos.cpp",
         "StringPool.cpp",
+        "Utils.cpp",
         "WorkQueue.cpp",
         "XMLNode.cpp",
         "ZipEntry.cpp",
diff --git a/tools/aapt/Package.cpp b/tools/aapt/Package.cpp
index 965655b..a7ff5fa 100644
--- a/tools/aapt/Package.cpp
+++ b/tools/aapt/Package.cpp
@@ -8,6 +8,7 @@
 #include "OutputSet.h"
 #include "ResourceTable.h"
 #include "ResourceFilter.h"
+#include "Utils.h"
 
 #include <androidfw/misc.h>
 
@@ -226,7 +227,7 @@
             fprintf(stderr, "warning: null file being processed.\n");
         } else {
             String8 storagePath(entry.getPath());
-            storagePath.convertToResPath();
+            convertToResPath(storagePath);
             if (!processFile(bundle, zip, storagePath, entry.getFile())) {
                 return UNKNOWN_ERROR;
             }
diff --git a/tools/aapt/Resource.cpp b/tools/aapt/Resource.cpp
index 4ca3a68..9c944e0 100644
--- a/tools/aapt/Resource.cpp
+++ b/tools/aapt/Resource.cpp
@@ -15,6 +15,7 @@
 #include "ResourceTable.h"
 #include "StringPool.h"
 #include "Symbol.h"
+#include "Utils.h"
 #include "WorkQueue.h"
 #include "XMLNode.h"
 
@@ -321,7 +322,7 @@
             str++;
         }
         String8 resPath = it.getPath();
-        resPath.convertToResPath();
+        convertToResPath(resPath);
         status_t result = table->addEntry(SourcePos(it.getPath(), 0),
                         String16(assets->getPackage()),
                         type16,
diff --git a/tools/aapt/ResourceTable.cpp b/tools/aapt/ResourceTable.cpp
index 3abb89a..b6a17eb 100644
--- a/tools/aapt/ResourceTable.cpp
+++ b/tools/aapt/ResourceTable.cpp
@@ -11,6 +11,7 @@
 #include "ResourceFilter.h"
 #include "ResourceIdCache.h"
 #include "SdkConstants.h"
+#include "Utils.h"
 
 #include <algorithm>
 #include <androidfw/ResourceTypes.h>
@@ -4803,7 +4804,7 @@
     String8 resPath = String8::format("res/%s/%s.xml",
             newFile->getGroupEntry().toDirName(target->getResourceType()).c_str(),
             String8(resourceName).c_str());
-    resPath.convertToResPath();
+    convertToResPath(resPath);
 
     // Add a resource table entry.
     addEntry(SourcePos(),
@@ -4927,7 +4928,7 @@
         String8 resPath = String8::format("res/%s/%s.xml",
                 newFile->getGroupEntry().toDirName(target->getResourceType()).c_str(),
                 String8(resourceName).c_str());
-        resPath.convertToResPath();
+        convertToResPath(resPath);
 
         // Add a resource table entry.
         if (bundle->getVerbose()) {
diff --git a/tools/aapt/Utils.cpp b/tools/aapt/Utils.cpp
new file mode 100644
index 0000000..36b018e
--- /dev/null
+++ b/tools/aapt/Utils.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2005 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Utils.h"
+
+#include <utils/Compat.h>
+
+// Separator used by resource paths. This is not platform dependent contrary
+// to OS_PATH_SEPARATOR.
+#define RES_PATH_SEPARATOR '/'
+
+using android::String8;
+
+void convertToResPath([[maybe_unused]] String8& s) {
+#if OS_PATH_SEPARATOR != RES_PATH_SEPARATOR
+    size_t len = s.length();
+    if (len > 0) {
+        char* buf = s.lockBuffer(len);
+        for (char* end = buf + len; buf < end; ++buf) {
+            if (*buf == OS_PATH_SEPARATOR) *buf = RES_PATH_SEPARATOR;
+        }
+        s.unlockBuffer(len);
+    }
+#endif
+}
diff --git a/tools/aapt/Utils.h b/tools/aapt/Utils.h
new file mode 100644
index 0000000..8eb5941
--- /dev/null
+++ b/tools/aapt/Utils.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2005 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+// This file contains cruft that used to be in libutils' String8, that's only
+// used for aapt.
+
+#include <utils/String8.h>
+
+// Converts all separators in this string to /, the default path
+// separator.
+// If the default OS separator is backslash, this converts all
+// backslashes to slashes, in-place. Otherwise it does nothing.
+void convertToResPath(android::String8&);