Merge "Restrict use of framework-annotations" into main
diff --git a/ADPF_OWNERS b/ADPF_OWNERS
index e6ca8f4..bcdc338 100644
--- a/ADPF_OWNERS
+++ b/ADPF_OWNERS
@@ -1,3 +1,4 @@
-lpy@google.com
-mattbuckley@google.com
+sumir@google.com
+chingtangyu@google.com
 xwxw@google.com
+mattbuckley@google.com
diff --git a/GAME_MANAGER_OWNERS b/GAME_MANAGER_OWNERS
index b65c43a..bcdc338 100644
--- a/GAME_MANAGER_OWNERS
+++ b/GAME_MANAGER_OWNERS
@@ -1,3 +1,4 @@
-lpy@google.com
+sumir@google.com
 chingtangyu@google.com
 xwxw@google.com
+mattbuckley@google.com
diff --git a/OWNERS b/OWNERS
index 096da29..afa60be 100644
--- a/OWNERS
+++ b/OWNERS
@@ -45,3 +45,7 @@
 per-file PACKAGE_MANAGER_OWNERS = file:/PACKAGE_MANAGER_OWNERS
 
 per-file WEAR_OWNERS = file:/WEAR_OWNERS
+
+per-file ADPF_OWNERS = file:/ADPF_OWNERS
+
+per-file GAME_MANAGER_OWNERS = file:/GAME_MANAGER_OWNERS
diff --git a/core/java/Android.bp b/core/java/Android.bp
index fae411d..ce9dedc 100644
--- a/core/java/Android.bp
+++ b/core/java/Android.bp
@@ -20,10 +20,50 @@
         "**/*.java",
         "**/*.aidl",
         ":framework-nfc-non-updatable-sources",
+        ":ranging_stack_mock_initializer",
+    ],
+    exclude_srcs: [
+        "android/ranging/**/*.java",
     ],
     visibility: ["//frameworks/base"],
 }
 
+//Mock to allow service registry for ranging stack.
+//TODO(b/331206299): Remove this after RELEASE_RANGING_STACK is ramped up to next.
+soong_config_module_type {
+    name: "ranging_stack_framework_mock_init",
+    module_type: "genrule",
+    config_namespace: "bootclasspath",
+    bool_variables: [
+        "release_ranging_stack",
+    ],
+    properties: [
+        "srcs",
+        "cmd",
+        "out",
+    ],
+}
+
+// The actual RangingFrameworkInitializer is present in packages/modules/Uwb/ranging/framework.
+// Mock RangingFrameworkInitializer does nothing and allows to successfully build
+// SystemServiceRegistry after registering for system service in SystemServiceRegistry both with
+// and without build flag RELEASE_RANGING_STACK enabled.
+ranging_stack_framework_mock_init {
+    name: "ranging_stack_mock_initializer",
+    soong_config_variables: {
+        release_ranging_stack: {
+            cmd: "touch $(out)",
+            // Adding an empty file as out is mandatory.
+            out: ["android/ranging/empty_ranging_fw.txt"],
+            conditions_default: {
+                srcs: ["android/ranging/mock/RangingFrameworkInitializer.java"],
+                cmd: "mkdir -p android/ranging/; cp $(in) $(out);",
+                out: ["android/ranging/RangingFrameworkInitializer.java"],
+            },
+        },
+    },
+}
+
 aidl_library {
     name: "IDropBoxManagerService_aidl",
     srcs: [
diff --git a/core/java/android/app/SystemServiceRegistry.java b/core/java/android/app/SystemServiceRegistry.java
index 9437c74..8f298db 100644
--- a/core/java/android/app/SystemServiceRegistry.java
+++ b/core/java/android/app/SystemServiceRegistry.java
@@ -220,6 +220,7 @@
 import android.print.PrintManager;
 import android.provider.E2eeContactKeysManager;
 import android.provider.ProviderFrameworkInitializer;
+import android.ranging.RangingFrameworkInitializer;
 import android.safetycenter.SafetyCenterFrameworkInitializer;
 import android.scheduling.SchedulingFrameworkInitializer;
 import android.security.FileIntegrityManager;
@@ -1734,6 +1735,12 @@
             if (android.webkit.Flags.updateServiceIpcWrapper()) {
                 WebViewBootstrapFrameworkInitializer.registerServiceWrappers();
             }
+            // This is guarded by aconfig flag "com.android.ranging.flags.ranging_stack_enabled"
+            // when the build flag RELEASE_RANGING_STACK is enabled. When disabled, this calls the
+            // mock RangingFrameworkInitializer#registerServiceWrappers which is no-op. As the
+            // aconfig lib for ranging module is built only if  RELEASE_RANGING_STACK is enabled,
+            // flagcannot be added here.
+            RangingFrameworkInitializer.registerServiceWrappers();
         } finally {
             // If any of the above code throws, we're in a pretty bad shape and the process
             // will likely crash, but we'll reset it just in case there's an exception handler...
diff --git a/core/java/android/os/Binder.java b/core/java/android/os/Binder.java
index 97e9f34..ed75491 100644
--- a/core/java/android/os/Binder.java
+++ b/core/java/android/os/Binder.java
@@ -1111,6 +1111,21 @@
     }
 
     /**
+     * Called whenever the stub implementation throws an exception which isn't propagated to the
+     * remote caller by the binder. If this method isn't overridden, this exception is swallowed,
+     * and some default return values are propagated to the caller.
+     *
+     * <br> <b> This should not throw. </b> Doing so would defeat the purpose of this handler, and
+     * suppress the exception it is handling.
+     *
+     * @param code The transaction code being handled
+     * @param e The exception which was thrown.
+     * @hide
+     */
+    protected void onUnhandledException(int code, int flags, Exception e) {
+    }
+
+    /**
      * @param in The raw file descriptor that an input data stream can be read from.
      * @param out The raw file descriptor that normal command messages should be written to.
      * @param err The raw file descriptor that command error messages should be written to.
@@ -1408,10 +1423,15 @@
                 } else {
                     Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e);
                 }
+                onUnhandledException(code, flags, e);
             } else {
                 // Clear the parcel before writing the exception.
                 reply.setDataSize(0);
                 reply.setDataPosition(0);
+                // The writeException below won't do anything useful if this is the case.
+                if (Parcel.getExceptionCode(e) == 0) {
+                    onUnhandledException(code, flags, e);
+                }
                 reply.writeException(e);
             }
             res = true;
diff --git a/core/java/android/ranging/mock/RangingFrameworkInitializer.java b/core/java/android/ranging/mock/RangingFrameworkInitializer.java
new file mode 100644
index 0000000..540f519
--- /dev/null
+++ b/core/java/android/ranging/mock/RangingFrameworkInitializer.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.ranging;
+
+/**
+* Mock RangingFrameworkInitializer.
+*
+* @hide
+*/
+
+// TODO(b/331206299): Remove this after RANGING_STACK_ENABLED is ramped up to next.
+public final class RangingFrameworkInitializer {
+    private RangingFrameworkInitializer() {}
+    /**
+     * @hide
+     */
+    public static void registerServiceWrappers() {
+        // No-op.
+    }
+}
diff --git a/core/tests/coretests/Android.bp b/core/tests/coretests/Android.bp
index 23203f0..a9ac67d 100644
--- a/core/tests/coretests/Android.bp
+++ b/core/tests/coretests/Android.bp
@@ -25,6 +25,7 @@
         "BinderProxyCountingTestApp/src/**/*.java",
         "BinderProxyCountingTestService/src/**/*.java",
         "BinderDeathRecipientHelperApp/src/**/*.java",
+        "AppThatCallsBinderMethods/src/**/*.kt",
     ],
     visibility: ["//visibility:private"],
 }
@@ -141,6 +142,7 @@
         ":BinderFrozenStateChangeCallbackTestApp",
         ":BinderProxyCountingTestApp",
         ":BinderProxyCountingTestService",
+        ":AppThatCallsBinderMethods",
     ],
 }
 
diff --git a/core/tests/coretests/AndroidTest.xml b/core/tests/coretests/AndroidTest.xml
index 3fdd729..dbe0b49 100644
--- a/core/tests/coretests/AndroidTest.xml
+++ b/core/tests/coretests/AndroidTest.xml
@@ -25,6 +25,7 @@
         <option name="test-file-name" value="BinderFrozenStateChangeCallbackTestApp.apk" />
         <option name="test-file-name" value="BinderProxyCountingTestApp.apk" />
         <option name="test-file-name" value="BinderProxyCountingTestService.apk" />
+        <option name="test-file-name" value="AppThatCallsBinderMethods.apk" />
     </target_preparer>
 
     <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
diff --git a/core/tests/coretests/AppThatCallsBinderMethods/Android.bp b/core/tests/coretests/AppThatCallsBinderMethods/Android.bp
new file mode 100644
index 0000000..dcc0d4f
--- /dev/null
+++ b/core/tests/coretests/AppThatCallsBinderMethods/Android.bp
@@ -0,0 +1,20 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+android_test_helper_app {
+    name: "AppThatCallsBinderMethods",
+    srcs: ["src/**/*.kt"],
+    platform_apis: true,
+    static_libs: ["coretests-aidl"],
+}
diff --git a/core/tests/coretests/AppThatCallsBinderMethods/AndroidManifest.xml b/core/tests/coretests/AppThatCallsBinderMethods/AndroidManifest.xml
new file mode 100644
index 0000000..b2f6d78
--- /dev/null
+++ b/core/tests/coretests/AppThatCallsBinderMethods/AndroidManifest.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!--
+  ~ Copyright (C) 2024 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+        package="com.android.frameworks.coretests.methodcallerhelperapp">
+    <application>
+        <receiver android:name="com.android.frameworks.coretests.methodcallerhelperapp.CallMethodsReceiver"
+                  android:exported="true"/>
+    </application>
+
+</manifest>
diff --git a/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/CallMethodsReceiver.kt b/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/CallMethodsReceiver.kt
new file mode 100644
index 0000000..638cc3b
--- /dev/null
+++ b/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/CallMethodsReceiver.kt
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.frameworks.coretests.methodcallerhelperapp
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.util.Log
+
+import com.android.frameworks.coretests.aidl.ITestInterface
+
+/**
+ * Receiver used to call methods when a binder is received
+ * {@link android.os.BinderUncaughtExceptionHandlerTest}.
+ */
+class CallMethodsReceiver : BroadcastReceiver() {
+    private val TAG = "CallMethodsReceiver"
+
+    override fun onReceive(context: Context, intent: Intent) {
+        try {
+            when (intent.getAction()) {
+                ACTION_CALL_METHOD -> intent.getExtras()!!.let {
+                    Log.i(TAG, "Received ACTION_CALL_METHOD with extras: $it")
+                    val iface = it.getBinder(EXTRA_BINDER)!!.let(ITestInterface.Stub::asInterface)!!
+                    val name = it.getString(EXTRA_METHOD_NAME)!!
+                    try {
+                        when (name) {
+                            "foo" -> iface.foo(5)
+                            "onewayFoo" -> iface.onewayFoo(5)
+                            "bar" -> iface.bar(5)
+                            else -> Log.e(TAG, "Unknown method name")
+                        }
+                    } catch (e: Exception) {
+                        // Exceptions expected
+                    }
+                }
+                else -> Log.e(TAG, "Unknown action " + intent.getAction())
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "Exception: ", e)
+        }
+    }
+}
diff --git a/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/Constants.kt b/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/Constants.kt
new file mode 100644
index 0000000..37c6268
--- /dev/null
+++ b/core/tests/coretests/AppThatCallsBinderMethods/src/com/android/frameworks/coretests/methodcallerhelperapp/Constants.kt
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.frameworks.coretests.methodcallerhelperapp
+
+const val PACKAGE_NAME = "com.android.frameworks.coretests.methodcallerhelperapp"
+const val RECEIVER_NAME = "CallMethodsReceiver"
+const val ACTION_CALL_METHOD = PACKAGE_NAME + ".ACTION_CALL_METHOD"
+const val EXTRA_METHOD_NAME = PACKAGE_NAME + ".EXTRA_METHOD_NAME"
+const val EXTRA_BINDER = PACKAGE_NAME + ".EXTRA_BINDER"
diff --git a/core/tests/coretests/aidl/com/android/frameworks/coretests/aidl/ITestInterface.aidl b/core/tests/coretests/aidl/com/android/frameworks/coretests/aidl/ITestInterface.aidl
new file mode 100644
index 0000000..ffcf178
--- /dev/null
+++ b/core/tests/coretests/aidl/com/android/frameworks/coretests/aidl/ITestInterface.aidl
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.frameworks.coretests.aidl;
+
+/**
+ * Just an interface with a oneway, void and non-oneway method.
+ */
+interface ITestInterface {
+    // Method order matters, since we verify transaction codes
+    int foo(int a);
+    oneway void onewayFoo(int a);
+    void bar(int a);
+}
diff --git a/core/tests/coretests/src/android/os/BinderUncaughtExceptionHandlerTest.kt b/core/tests/coretests/src/android/os/BinderUncaughtExceptionHandlerTest.kt
new file mode 100644
index 0000000..791c209
--- /dev/null
+++ b/core/tests/coretests/src/android/os/BinderUncaughtExceptionHandlerTest.kt
@@ -0,0 +1,247 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.os
+
+import android.content.Intent
+import android.platform.test.annotations.DisabledOnRavenwood
+import android.platform.test.annotations.Presubmit
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+
+import com.android.frameworks.coretests.aidl.ITestInterface
+import com.android.frameworks.coretests.methodcallerhelperapp.*
+
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+import org.mockito.ArgumentMatcher
+import org.mockito.ArgumentMatchers.any
+import org.mockito.ArgumentMatchers.anyInt
+import org.mockito.ArgumentMatchers.eq
+import org.mockito.ArgumentMatchers.intThat
+import org.mockito.Mockito.after
+import org.mockito.Mockito.doThrow
+import org.mockito.Mockito.never
+import org.mockito.Mockito.timeout
+import org.mockito.Mockito.verify
+import org.mockito.Mockito.`when`
+import org.mockito.Spy
+import org.mockito.junit.MockitoJUnit
+import org.mockito.quality.Strictness.STRICT_STUBS
+
+private const val TIMEOUT_DURATION_MS = 2000L
+private const val FALSE_NEG_DURATION_MS = 500L
+private const val FLAG_ONEWAY = 1
+// From ITestInterface.Stub class, these values are package private
+private const val TRANSACTION_foo = 1
+private const val TRANSACTION_onewayFoo = 2
+private const val TRANSACTION_bar = 3
+
+/** Tests functionality of {@link android.os.Binder.onUnhandledException}. */
+@DisabledOnRavenwood(reason = "multi-app")
+@Presubmit
+@RunWith(AndroidJUnit4::class)
+class BinderUncaughtExceptionHandlerTest {
+
+    val mContext = InstrumentationRegistry.getInstrumentation().getTargetContext()
+
+    @Rule @JvmField val rule = MockitoJUnit.rule().strictness(STRICT_STUBS)
+
+    @Spy var mInterfaceImpl: ITestImpl = ITestImpl()
+
+    // This subclass is needed for visibility issues (via protected), since the method we are
+    // verifying lives on the boot classpath, it is not enough to be in the same package.
+    open class ITestImpl : ITestInterface.Stub() {
+        override fun onUnhandledException(code: Int, flags: Int, e: Exception?) =
+            onUnhandledExceptionVisible(code, flags, e)
+
+        public open fun onUnhandledExceptionVisible(code: Int, flags: Int, e: Exception?) {}
+
+        @Throws(RemoteException::class)
+        override open fun foo(x: Int): Int = throw UnsupportedOperationException()
+
+        @Throws(RemoteException::class)
+        override open fun onewayFoo(x: Int): Unit = throw UnsupportedOperationException()
+
+        @Throws(RemoteException::class)
+        override open fun bar(x: Int): Unit = throw UnsupportedOperationException()
+    }
+
+    class OnewayMatcher(private val isOneway: Boolean) : ArgumentMatcher<Int> {
+        override fun matches(argument: Int?) =
+            (argument!! and FLAG_ONEWAY) == if (isOneway) 1 else 0
+
+        override fun toString() = "Expected oneway: $isOneway"
+    }
+
+    @Test
+    fun testRegularMethod_ifThrowsRuntimeException_HandlerCalled() {
+        val myException = RuntimeException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).foo(anyInt())
+
+        dispatchActionCall("foo")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_foo),
+                /* flags= */ intThat(OnewayMatcher(false)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testRegularMethod_ifThrowsRemoteException_HandlerCalled() {
+        val myException = RemoteException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).foo(anyInt())
+
+        dispatchActionCall("foo")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_foo),
+                /* flags= */ intThat(OnewayMatcher(false)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testRegularMethod_ifThrowsSecurityException_HandlerNotCalled() {
+        val myException = SecurityException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).foo(anyInt())
+
+        dispatchActionCall("foo")
+
+        // No unexpected calls
+        verify(mInterfaceImpl, after(FALSE_NEG_DURATION_MS).never())
+            .onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testVoidMethod_ifThrowsRuntimeException_HandlerCalled() {
+        val myException = RuntimeException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).bar(anyInt())
+
+        dispatchActionCall("bar")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_bar),
+                /* flags= */ intThat(OnewayMatcher(false)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testVoidMethod_ifThrowsRemoteException_HandlerCalled() {
+        val myException = RemoteException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).bar(anyInt())
+
+        dispatchActionCall("bar")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_bar),
+                /* flags= */ intThat(OnewayMatcher(false)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testVoidMethod_ifThrowsSecurityException_HandlerNotCalled() {
+        val myException = SecurityException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).bar(anyInt())
+
+        dispatchActionCall("bar")
+
+        // No unexpected calls
+        verify(mInterfaceImpl, after(FALSE_NEG_DURATION_MS).never())
+            .onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testOnewayMethod_ifThrowsRuntimeException_HandlerCalled() {
+        val myException = RuntimeException("Test exception")
+        doThrow(myException).doNothing().`when`(mInterfaceImpl).onewayFoo(anyInt())
+
+        dispatchActionCall("onewayFoo")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_onewayFoo),
+                /* flags= */ intThat(OnewayMatcher(true)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    @Test
+    fun testOnewayMethod_ifThrowsRemoteException_HandlerCalled() {
+        val myException = RemoteException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).onewayFoo(anyInt())
+
+        dispatchActionCall("onewayFoo")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_onewayFoo),
+                /* flags= */ intThat(OnewayMatcher(true)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    // All exceptions are uncaught for oneway
+    @Test
+    fun testOnewayMethod_ifThrowsSecurityException_HandlerCalled() {
+        val myException = SecurityException("Test exception")
+        doThrow(myException).`when`(mInterfaceImpl).onewayFoo(anyInt())
+
+        dispatchActionCall("onewayFoo")
+
+        verify(mInterfaceImpl, timeout(TIMEOUT_DURATION_MS))
+            .onUnhandledExceptionVisible(
+                /* transactionCode = */ eq(TRANSACTION_onewayFoo),
+                /* flags= */ intThat(OnewayMatcher(true)),
+                /* exception= */ eq(myException),
+            )
+        // No unexpected calls
+        verify(mInterfaceImpl).onUnhandledExceptionVisible(anyInt(), anyInt(), any())
+    }
+
+    private fun dispatchActionCall(methodName: String) =
+        Intent(ACTION_CALL_METHOD).apply {
+            putExtras(
+                Bundle().apply {
+                    putBinder(EXTRA_BINDER, mInterfaceImpl as IBinder)
+                    putString(EXTRA_METHOD_NAME, methodName)
+                }
+            )
+            setClassName(PACKAGE_NAME, CallMethodsReceiver::class.java.getName())
+        }.let { mContext.sendBroadcast(it) }
+}
diff --git a/libs/androidfw/CursorWindow.cpp b/libs/androidfw/CursorWindow.cpp
index 5e645cc..cbb1e8f 100644
--- a/libs/androidfw/CursorWindow.cpp
+++ b/libs/androidfw/CursorWindow.cpp
@@ -18,11 +18,12 @@
 
 #include <androidfw/CursorWindow.h>
 
-#include <sys/mman.h>
-
 #include "android-base/logging.h"
+#include "android-base/mapped_file.h"
 #include "cutils/ashmem.h"
 
+using android::base::MappedFile;
+
 namespace android {
 
 /**
@@ -39,7 +40,7 @@
 
 CursorWindow::~CursorWindow() {
     if (mAshmemFd != -1) {
-        ::munmap(mData, mSize);
+        mMappedFile.reset();
         ::close(mAshmemFd);
     } else {
         free(mData);
@@ -75,6 +76,7 @@
 status_t CursorWindow::maybeInflate() {
     int ashmemFd = 0;
     void* newData = nullptr;
+    std::unique_ptr<MappedFile> mappedFile;
 
     // Bail early when we can't expand any further
     if (mReadOnly || mSize == mInflatedSize) {
@@ -95,11 +97,12 @@
         goto fail_silent;
     }
 
-    newData = ::mmap(nullptr, mInflatedSize, PROT_READ | PROT_WRITE, MAP_SHARED, ashmemFd, 0);
-    if (newData == MAP_FAILED) {
+    mappedFile = MappedFile::FromFd(ashmemFd, 0, mInflatedSize, PROT_READ | PROT_WRITE);
+    if (mappedFile == nullptr) {
         PLOG(ERROR) << "Failed mmap";
         goto fail_silent;
     }
+    newData = mappedFile->data();
 
     if (ashmem_set_prot_region(ashmemFd, PROT_READ) < 0) {
         PLOG(ERROR) << "Failed ashmem_set_prot_region";
@@ -120,6 +123,7 @@
         mData = newData;
         mSize = mInflatedSize;
         mSlotsOffset = newSlotsOffset;
+        mMappedFile = std::move(mappedFile);
 
         updateSlotsData();
     }
@@ -130,7 +134,7 @@
 fail:
     LOG(ERROR) << "Failed maybeInflate";
 fail_silent:
-    ::munmap(newData, mInflatedSize);
+    mappedFile.reset();
     ::close(ashmemFd);
     return UNKNOWN_ERROR;
 }
@@ -167,11 +171,12 @@
             goto fail_silent;
         }
 
-        window->mData = ::mmap(nullptr, window->mSize, PROT_READ, MAP_SHARED, window->mAshmemFd, 0);
-        if (window->mData == MAP_FAILED) {
+        window->mMappedFile = MappedFile::FromFd(window->mAshmemFd, 0, window->mSize, PROT_READ);
+        if (window->mMappedFile == nullptr) {
             PLOG(ERROR) << "Failed mmap";
             goto fail_silent;
         }
+        window->mData = window->mMappedFile->data();
     } else {
         window->mAshmemFd = -1;
 
diff --git a/libs/androidfw/include/androidfw/CursorWindow.h b/libs/androidfw/include/androidfw/CursorWindow.h
index 9ec026a..c2eac12 100644
--- a/libs/androidfw/include/androidfw/CursorWindow.h
+++ b/libs/androidfw/include/androidfw/CursorWindow.h
@@ -26,6 +26,8 @@
 #include "binder/Parcel.h"
 #include "utils/String8.h"
 
+#include "android-base/mapped_file.h"
+
 #define LOG_WINDOW(...)
 
 namespace android {
@@ -149,6 +151,8 @@
     String8 mName;
     int mAshmemFd = -1;
     void* mData = nullptr;
+    std::unique_ptr<android::base::MappedFile> mMappedFile;
+
     /**
      * Pointer to the first FieldSlot, used to optimize the extremely
      * hot code path of getFieldSlot().
diff --git a/media/jni/android_media_ImageWriter.cpp b/media/jni/android_media_ImageWriter.cpp
index f64233f..1273410 100644
--- a/media/jni/android_media_ImageWriter.cpp
+++ b/media/jni/android_media_ImageWriter.cpp
@@ -1023,16 +1023,19 @@
         return;
     }
 
+    // Maintain a StrongPointer so that the GraphicBuffer isn't destroyed when the
+    // StrongPointer in lockImageFromBuffer goes out of scope.
+    sp<GraphicBuffer> bufferSp(buffer);
     // ImageWriter doesn't use crop by itself, app sets it, use the no crop version.
-    const Rect noCrop(buffer->width, buffer->height);
+    const Rect noCrop(bufferSp->width, bufferSp->height);
     status_t res = lockImageFromBuffer(
-            buffer, GRALLOC_USAGE_SW_WRITE_OFTEN, noCrop, fenceFd, image);
+            bufferSp, GRALLOC_USAGE_SW_WRITE_OFTEN, noCrop, fenceFd, image);
     // Clear the fenceFd as it is already consumed by lock call.
     env->SetIntField(thiz, gSurfaceImageClassInfo.mNativeFenceFd, -1);
     if (res != OK) {
         jniThrowExceptionFmt(env, "java/lang/RuntimeException",
                 "lock buffer failed for format 0x%x",
-                buffer->getPixelFormat());
+                bufferSp->getPixelFormat());
         return;
     }
 
diff --git a/nfc/api/system-current.txt b/nfc/api/system-current.txt
index d17a9b6..94231b0 100644
--- a/nfc/api/system-current.txt
+++ b/nfc/api/system-current.txt
@@ -58,10 +58,15 @@
   @FlaggedApi("android.nfc.nfc_oem_extension") public final class NfcOemExtension {
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void clearPreference();
     method @FlaggedApi("android.nfc.nfc_oem_extension") @NonNull public java.util.List<java.lang.String> getActiveNfceeList();
+    method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public boolean hasUserEnabledNfc();
+    method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public boolean isTagPresent();
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void maybeTriggerFirmwareUpdate();
+    method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void pausePolling(int);
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void registerCallback(@NonNull java.util.concurrent.Executor, @NonNull android.nfc.NfcOemExtension.Callback);
+    method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void resumePolling();
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.NFC_SET_CONTROLLER_ALWAYS_ON) public void setControllerAlwaysOnMode(int);
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void synchronizeScreenState();
+    method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void triggerInitialization();
     method @FlaggedApi("android.nfc.nfc_oem_extension") @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS) public void unregisterCallback(@NonNull android.nfc.NfcOemExtension.Callback);
     field @FlaggedApi("android.nfc.nfc_oem_extension") public static final int DISABLE = 0; // 0x0
     field @FlaggedApi("android.nfc.nfc_oem_extension") public static final int ENABLE_DEFAULT = 1; // 0x1
diff --git a/nfc/java/android/nfc/INfcAdapter.aidl b/nfc/java/android/nfc/INfcAdapter.aidl
index 246efc7..a166b28 100644
--- a/nfc/java/android/nfc/INfcAdapter.aidl
+++ b/nfc/java/android/nfc/INfcAdapter.aidl
@@ -114,4 +114,7 @@
     void setScreenState();
     void checkFirmware();
     List<String> fetchActiveNfceeList();
+    void triggerInitialization();
+    boolean getSettingStatus();
+    boolean isTagPresent();
 }
diff --git a/nfc/java/android/nfc/NfcOemExtension.java b/nfc/java/android/nfc/NfcOemExtension.java
index 011c60b..6d5c069 100644
--- a/nfc/java/android/nfc/NfcOemExtension.java
+++ b/nfc/java/android/nfc/NfcOemExtension.java
@@ -471,6 +471,58 @@
         NfcAdapter.callService(() -> NfcAdapter.sService.setControllerAlwaysOn(mode));
     }
 
+    /**
+     * Triggers NFC initialization. If OEM extension is registered
+     * (indicated via `enable_oem_extension` NFC overlay), the NFC stack initialization at bootup
+     * is delayed until the OEM extension app triggers the initialization via this call.
+     */
+    @FlaggedApi(Flags.FLAG_NFC_OEM_EXTENSION)
+    @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS)
+    public void triggerInitialization() {
+        NfcAdapter.callService(() -> NfcAdapter.sService.triggerInitialization());
+    }
+
+    /**
+     * Gets the last user toggle status.
+     * @return true if NFC is set to ON, false otherwise
+     */
+    @FlaggedApi(Flags.FLAG_NFC_OEM_EXTENSION)
+    @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS)
+    public boolean hasUserEnabledNfc() {
+        return NfcAdapter.callServiceReturn(() -> NfcAdapter.sService.getSettingStatus(), false);
+    }
+
+    /**
+     * Checks if the tag is present or not.
+     * @return true if the tag is present, false otherwise
+     */
+    @FlaggedApi(Flags.FLAG_NFC_OEM_EXTENSION)
+    @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS)
+    public boolean isTagPresent() {
+        return NfcAdapter.callServiceReturn(() -> NfcAdapter.sService.isTagPresent(), false);
+    }
+
+    /**
+     * Pauses NFC tag reader mode polling for a {@code timeoutInMs} millisecond. If polling must be
+     * resumed before timeout, use {@link #resumePolling()}.
+     * @param timeoutInMs the pause polling duration in millisecond
+     */
+    @FlaggedApi(Flags.FLAG_NFC_OEM_EXTENSION)
+    @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS)
+    public void pausePolling(int timeoutInMs) {
+        NfcAdapter.callService(() -> NfcAdapter.sService.pausePolling(timeoutInMs));
+    }
+
+    /**
+     * Resumes default NFC tag reader mode polling for the current device state if polling is
+     * paused. Calling this while polling is not paused is a no-op.
+     */
+    @FlaggedApi(Flags.FLAG_NFC_OEM_EXTENSION)
+    @RequiresPermission(android.Manifest.permission.WRITE_SECURE_SETTINGS)
+    public void resumePolling() {
+        NfcAdapter.callService(() -> NfcAdapter.sService.resumePolling());
+    }
+
     private final class NfcOemExtensionCallback extends INfcOemExtensionCallback.Stub {
 
         @Override
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java b/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
index e77cf2f..2227943 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/DeviceConfigService.java
@@ -189,22 +189,13 @@
 
       public static HashMap<String, String> getAllFlags(IContentProvider provider) {
         HashMap<String, String> allFlags = new HashMap<String, String>();
-        try {
-            Bundle args = new Bundle();
-            args.putInt(Settings.CALL_METHOD_USER_KEY,
-                ActivityManager.getService().getCurrentUser().id);
-            Bundle b = provider.call(new AttributionSource(Process.myUid(),
-                    resolveCallingPackage(), null), Settings.AUTHORITY,
-                    Settings.CALL_METHOD_LIST_CONFIG, null, args);
-            if (b != null) {
-                Map<String, String> flagsToValues =
-                    (HashMap) b.getSerializable(Settings.NameValueTable.VALUE);
-                allFlags.putAll(flagsToValues);
+        for (DeviceConfig.Properties properties : DeviceConfig.getAllProperties()) {
+            List<String> keys = new ArrayList<>(properties.getKeyset());
+            for (String flagName : properties.getKeyset()) {
+                String fullName = properties.getNamespace() + "/" + flagName;
+                allFlags.put(fullName, properties.getString(flagName, null));
             }
-        } catch (RemoteException e) {
-            throw new RuntimeException("Failed in IPC", e);
         }
-
         return allFlags;
       }
 
diff --git a/ravenwood/junit-impl-src/android/platform/test/ravenwood/RavenwoodTestStats.java b/ravenwood/junit-impl-src/android/platform/test/ravenwood/RavenwoodTestStats.java
index 428eb57..b4b8715 100644
--- a/ravenwood/junit-impl-src/android/platform/test/ravenwood/RavenwoodTestStats.java
+++ b/ravenwood/junit-impl-src/android/platform/test/ravenwood/RavenwoodTestStats.java
@@ -84,10 +84,10 @@
         try {
             mOutputWriter = new PrintWriter(mOutputFile);
         } catch (IOException e) {
-            throw new RuntimeException("Failed to crete logfile. File=" + mOutputFile, e);
+            throw new RuntimeException("Failed to create logfile. File=" + mOutputFile, e);
         }
 
-        // Crete the "latest" symlink.
+        // Create the "latest" symlink.
         Path symlink = Paths.get(tmpdir, basename + "latest.csv");
         try {
             if (Files.exists(symlink)) {
@@ -96,7 +96,7 @@
             Files.createSymbolicLink(symlink, Paths.get(mOutputFile.getName()));
 
         } catch (IOException e) {
-            throw new RuntimeException("Failed to crete logfile. File=" + mOutputFile, e);
+            throw new RuntimeException("Failed to create logfile. File=" + mOutputFile, e);
         }
 
         Log.i(TAG, "Test result stats file: " + mOutputFile);
diff --git a/ravenwood/runtime-jni/ravenwood_sysprop.cpp b/ravenwood/runtime-jni/ravenwood_sysprop.cpp
index 4fb61b6..aafc426 100644
--- a/ravenwood/runtime-jni/ravenwood_sysprop.cpp
+++ b/ravenwood/runtime-jni/ravenwood_sysprop.cpp
@@ -56,7 +56,7 @@
     if (key == nullptr || *key == '\0') return false;
     if (value == nullptr) value = "";
     bool read_only = !strncmp(key, "ro.", 3);
-    if (!read_only && strlen(value) >= PROP_VALUE_MAX) return -1;
+    if (!read_only && strlen(value) >= PROP_VALUE_MAX) return false;
 
     std::lock_guard lock(g_properties_lock);
     auto [it, success] = g_properties.emplace(key, value);
diff --git a/services/core/java/com/android/server/biometrics/OWNERS b/services/core/java/com/android/server/biometrics/OWNERS
index 4703efb..13bba9d 100644
--- a/services/core/java/com/android/server/biometrics/OWNERS
+++ b/services/core/java/com/android/server/biometrics/OWNERS
@@ -1,14 +1,12 @@
 set noparent
 
 graciecheng@google.com
-ilyamaty@google.com
 jbolinger@google.com
 jeffpu@google.com
 joshmccloskey@google.com
 diyab@google.com
 austindelgado@google.com
 spdonghao@google.com
-wenhuiy@google.com
 
 firewall@google.com
 jasonsfchang@google.com
diff --git a/services/core/java/com/android/server/wm/Task.java b/services/core/java/com/android/server/wm/Task.java
index eee2821..49086af 100644
--- a/services/core/java/com/android/server/wm/Task.java
+++ b/services/core/java/com/android/server/wm/Task.java
@@ -1469,7 +1469,7 @@
             // The starting window should keep covering its task when a pure TaskFragment is added
             // because its bounds may not fill the task.
             final ActivityRecord top = getTopMostActivity();
-            if (top != null) {
+            if (top != null && !top.hasFixedRotationTransform()) {
                 top.associateStartingWindowWithTaskIfNeeded();
             }
         }
diff --git a/services/profcollect/src/com/android/server/profcollect/Utils.java b/services/profcollect/src/com/android/server/profcollect/Utils.java
index 8508802..b4e2544 100644
--- a/services/profcollect/src/com/android/server/profcollect/Utils.java
+++ b/services/profcollect/src/com/android/server/profcollect/Utils.java
@@ -19,6 +19,7 @@
 import static com.android.server.profcollect.ProfcollectForwardingService.LOG_TAG;
 
 import android.os.RemoteException;
+import android.os.ServiceSpecificException;
 import android.provider.DeviceConfig;
 import android.util.Log;
 
@@ -42,7 +43,7 @@
         BackgroundThread.get().getThreadHandler().post(() -> {
             try {
                 mIProfcollect.trace_system(eventName);
-            } catch (RemoteException e) {
+            } catch (RemoteException | ServiceSpecificException e) {
                 Log.e(LOG_TAG, "Failed to initiate trace: " + e.getMessage());
             }
         });
@@ -56,7 +57,7 @@
         BackgroundThread.get().getThreadHandler().postDelayed(() -> {
             try {
                 mIProfcollect.trace_system(eventName);
-            } catch (RemoteException e) {
+            } catch (RemoteException | ServiceSpecificException e) {
                 Log.e(LOG_TAG, "Failed to initiate trace: " + e.getMessage());
             }
         }, delayMs);
@@ -73,10 +74,10 @@
                 mIProfcollect.trace_process(eventName,
                         processName,
                         durationMs);
-            } catch (RemoteException e) {
+            } catch (RemoteException | ServiceSpecificException e) {
                 Log.e(LOG_TAG, "Failed to initiate trace: " + e.getMessage());
             }
         });
         return true;
     }
-}
\ No newline at end of file
+}