diff --git a/core/api/current.txt b/core/api/current.txt
index cc425f0..2a16084 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -978,7 +978,7 @@
     field public static final int multiArch = 16843918; // 0x101048e
     field public static final int multiprocess = 16842771; // 0x1010013
     field public static final int name = 16842755; // 0x1010003
-    field public static final int nativeHeapZeroInit = 16844314; // 0x101061a
+    field public static final int nativeHeapZeroInitialized = 16844314; // 0x101061a
     field public static final int navigationBarColor = 16843858; // 0x1010452
     field public static final int navigationBarDividerColor = 16844141; // 0x101056d
     field public static final int navigationContentDescription = 16843969; // 0x10104c1
@@ -11466,7 +11466,7 @@
     method public static CharSequence getCategoryTitle(android.content.Context, int);
     method public int getGwpAsanMode();
     method public int getMemtagMode();
-    method @Nullable public Boolean isNativeHeapZeroInit();
+    method public int getNativeHeapZeroInitialized();
     method public boolean isProfileableByShell();
     method public boolean isResourceOverlay();
     method public boolean isVirtualPreload();
@@ -11520,6 +11520,9 @@
     field public static final int MEMTAG_DEFAULT = -1; // 0xffffffff
     field public static final int MEMTAG_OFF = 0; // 0x0
     field public static final int MEMTAG_SYNC = 2; // 0x2
+    field public static final int ZEROINIT_DEFAULT = -1; // 0xffffffff
+    field public static final int ZEROINIT_DISABLED = 0; // 0x0
+    field public static final int ZEROINIT_ENABLED = 1; // 0x1
     field public String appComponentFactory;
     field public String backupAgentName;
     field public int category;
diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index 9e82cfb..e376fb8 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -9461,10 +9461,6 @@
     field public static final String KEY_SUPPORT_CDMA_1X_VOICE_CALLS_BOOL = "support_cdma_1x_voice_calls_bool";
   }
 
-  public static final class CarrierConfigManager.Ims {
-    field public static final String KEY_PUBLISH_SERVICE_DESC_FEATURE_TAG_MAP_OVERRIDE_STRING_ARRAY = "ims.publish_service_desc_feature_tag_map_override_string_array";
-  }
-
   public static final class CarrierConfigManager.Wifi {
     field public static final String KEY_HOTSPOT_MAX_CLIENT_COUNT = "wifi.hotspot_maximum_client_count";
     field public static final String KEY_PREFIX = "wifi.";
diff --git a/core/java/android/content/pm/ApplicationInfo.java b/core/java/android/content/pm/ApplicationInfo.java
index ad9e31b..fc5ca61 100644
--- a/core/java/android/content/pm/ApplicationInfo.java
+++ b/core/java/android/content/pm/ApplicationInfo.java
@@ -1337,7 +1337,7 @@
      * Indicates if the application has requested GWP-ASan to be enabled, disabled, or left
      * unspecified. Processes can override this setting.
      */
-    private @GwpAsanMode int gwpAsanMode;
+    private @GwpAsanMode int gwpAsanMode = GWP_ASAN_DEFAULT;
 
     /**
      * Default (unspecified) setting of Memtag.
@@ -1376,13 +1376,38 @@
      * Indicates if the application has requested Memtag to be enabled, disabled, or left
      * unspecified. Processes can override this setting.
      */
-    private @MemtagMode int memtagMode;
+    private @MemtagMode int memtagMode = MEMTAG_DEFAULT;
+
+    /**
+     * Default (unspecified) setting of nativeHeapZeroInitialized.
+     */
+    public static final int ZEROINIT_DEFAULT = -1;
+
+    /**
+     * Disable zero-initialization of the native heap in this application or process.
+     */
+    public static final int ZEROINIT_DISABLED = 0;
+
+    /**
+     * Enable zero-initialization of the native heap in this application or process.
+     */
+    public static final int ZEROINIT_ENABLED = 1;
+
+    /**
+     * @hide
+     */
+    @IntDef(prefix = {"ZEROINIT_"}, value = {
+            ZEROINIT_DEFAULT,
+            ZEROINIT_DISABLED,
+            ZEROINIT_ENABLED,
+    })
+    @Retention(RetentionPolicy.SOURCE)
+    public @interface NativeHeapZeroInitialized {}
 
     /**
      * Enable automatic zero-initialization of native heap memory allocations.
      */
-    @Nullable
-    private Boolean nativeHeapZeroInit;
+    private @NativeHeapZeroInitialized int nativeHeapZeroInitialized = ZEROINIT_DEFAULT;
 
     /**
      * Represents the default policy. The actual policy used will depend on other properties of
@@ -1531,8 +1556,8 @@
             if (memtagMode != MEMTAG_DEFAULT) {
                 pw.println(prefix + "memtagMode=" + memtagMode);
             }
-            if (nativeHeapZeroInit != null) {
-                pw.println(prefix + "nativeHeapZeroInit=" + nativeHeapZeroInit);
+            if (nativeHeapZeroInitialized != ZEROINIT_DEFAULT) {
+                pw.println(prefix + "nativeHeapZeroInitialized=" + nativeHeapZeroInitialized);
             }
         }
         super.dumpBack(pw, prefix);
@@ -1638,8 +1663,9 @@
             if (memtagMode != MEMTAG_DEFAULT) {
                 proto.write(ApplicationInfoProto.Detail.ENABLE_MEMTAG, memtagMode);
             }
-            if (nativeHeapZeroInit != null) {
-                proto.write(ApplicationInfoProto.Detail.NATIVE_HEAP_ZERO_INIT, nativeHeapZeroInit);
+            if (nativeHeapZeroInitialized != ZEROINIT_DEFAULT) {
+                proto.write(ApplicationInfoProto.Detail.NATIVE_HEAP_ZERO_INIT,
+                        nativeHeapZeroInitialized);
             }
             proto.end(detailToken);
         }
@@ -1752,7 +1778,7 @@
         zygotePreloadName = orig.zygotePreloadName;
         gwpAsanMode = orig.gwpAsanMode;
         memtagMode = orig.memtagMode;
-        nativeHeapZeroInit = orig.nativeHeapZeroInit;
+        nativeHeapZeroInitialized = orig.nativeHeapZeroInitialized;
     }
 
     public String toString() {
@@ -1838,7 +1864,7 @@
         dest.writeString8(zygotePreloadName);
         dest.writeInt(gwpAsanMode);
         dest.writeInt(memtagMode);
-        sForBoolean.parcel(nativeHeapZeroInit, dest, parcelableFlags);
+        dest.writeInt(nativeHeapZeroInitialized);
     }
 
     public static final @android.annotation.NonNull Parcelable.Creator<ApplicationInfo> CREATOR
@@ -1921,7 +1947,7 @@
         zygotePreloadName = source.readString8();
         gwpAsanMode = source.readInt();
         memtagMode = source.readInt();
-        nativeHeapZeroInit = sForBoolean.unparcel(source);
+        nativeHeapZeroInitialized = source.readInt();
     }
 
     /**
@@ -2314,7 +2340,9 @@
     /** {@hide} */ public void setSplitResourcePaths(String[] splitResourcePaths) { splitPublicSourceDirs = splitResourcePaths; }
     /** {@hide} */ public void setGwpAsanMode(@GwpAsanMode int value) { gwpAsanMode = value; }
     /** {@hide} */ public void setMemtagMode(@MemtagMode int value) { memtagMode = value; }
-    /** {@hide} */ public void setNativeHeapZeroInit(@Nullable Boolean value) { nativeHeapZeroInit = value; }
+    /** {@hide} */ public void setNativeHeapZeroInitialized(@NativeHeapZeroInitialized int value) {
+        nativeHeapZeroInitialized = value;
+    }
 
     /** {@hide} */
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
@@ -2328,8 +2356,22 @@
     /** {@hide} */ public String[] getSplitResourcePaths() { return splitPublicSourceDirs; }
     @GwpAsanMode
     public int getGwpAsanMode() { return gwpAsanMode; }
+
+    /**
+     * Returns whether the application has requested Memtag to be enabled, disabled, or left
+     * unspecified. Processes can override this setting.
+     */
     @MemtagMode
-    public int getMemtagMode() { return memtagMode; }
-    @Nullable
-    public Boolean isNativeHeapZeroInit() { return nativeHeapZeroInit; }
+    public int getMemtagMode() {
+        return memtagMode;
+    }
+
+    /**
+     * Returns whether the application has requested automatic zero-initialization of native heap
+     * memory allocations to be enabled or disabled.
+     */
+    @NativeHeapZeroInitialized
+    public int getNativeHeapZeroInitialized() {
+        return nativeHeapZeroInitialized;
+    }
 }
diff --git a/core/java/android/content/pm/ProcessInfo.java b/core/java/android/content/pm/ProcessInfo.java
index 3dd5ee1..632c0f5 100644
--- a/core/java/android/content/pm/ProcessInfo.java
+++ b/core/java/android/content/pm/ProcessInfo.java
@@ -62,8 +62,7 @@
     /**
      * Enable automatic zero-initialization of native heap memory allocations.
      */
-    @Nullable
-    public Boolean nativeHeapZeroInit;
+    public @ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized;
 
     @Deprecated
     public ProcessInfo(@NonNull ProcessInfo orig) {
@@ -71,7 +70,7 @@
         this.deniedPermissions = orig.deniedPermissions;
         this.gwpAsanMode = orig.gwpAsanMode;
         this.memtagMode = orig.memtagMode;
-        this.nativeHeapZeroInit = orig.nativeHeapZeroInit;
+        this.nativeHeapZeroInitialized = orig.nativeHeapZeroInitialized;
     }
 
 
@@ -101,7 +100,7 @@
      * @param memtagMode
      *   Indicates if the process has requested Memtag to be enabled (in sync or async mode),
      *   disabled, or left unspecified.
-     * @param nativeHeapZeroInit
+     * @param nativeHeapZeroInitialized
      *   Enable automatic zero-initialization of native heap memory allocations.
      */
     @DataClass.Generated.Member
@@ -110,7 +109,7 @@
             @Nullable ArraySet<String> deniedPermissions,
             @ApplicationInfo.GwpAsanMode int gwpAsanMode,
             @ApplicationInfo.MemtagMode int memtagMode,
-            @Nullable Boolean nativeHeapZeroInit) {
+            @ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized) {
         this.name = name;
         com.android.internal.util.AnnotationValidations.validate(
                 NonNull.class, null, name);
@@ -121,7 +120,9 @@
         this.memtagMode = memtagMode;
         com.android.internal.util.AnnotationValidations.validate(
                 ApplicationInfo.MemtagMode.class, null, memtagMode);
-        this.nativeHeapZeroInit = nativeHeapZeroInit;
+        this.nativeHeapZeroInitialized = nativeHeapZeroInitialized;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.NativeHeapZeroInitialized.class, null, nativeHeapZeroInitialized);
 
         // onConstructed(); // You can define this method to get a callback
     }
@@ -145,13 +146,12 @@
 
         byte flg = 0;
         if (deniedPermissions != null) flg |= 0x2;
-        if (nativeHeapZeroInit != null) flg |= 0x10;
         dest.writeByte(flg);
         dest.writeString(name);
         sParcellingForDeniedPermissions.parcel(deniedPermissions, dest, flags);
         dest.writeInt(gwpAsanMode);
         dest.writeInt(memtagMode);
-        if (nativeHeapZeroInit != null) dest.writeBoolean(nativeHeapZeroInit);
+        dest.writeInt(nativeHeapZeroInitialized);
     }
 
     @Override
@@ -170,7 +170,7 @@
         ArraySet<String> _deniedPermissions = sParcellingForDeniedPermissions.unparcel(in);
         int _gwpAsanMode = in.readInt();
         int _memtagMode = in.readInt();
-        Boolean _nativeHeapZeroInit = (flg & 0x10) == 0 ? null : (Boolean) in.readBoolean();
+        int _nativeHeapZeroInitialized = in.readInt();
 
         this.name = _name;
         com.android.internal.util.AnnotationValidations.validate(
@@ -182,7 +182,9 @@
         this.memtagMode = _memtagMode;
         com.android.internal.util.AnnotationValidations.validate(
                 ApplicationInfo.MemtagMode.class, null, memtagMode);
-        this.nativeHeapZeroInit = _nativeHeapZeroInit;
+        this.nativeHeapZeroInitialized = _nativeHeapZeroInitialized;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.NativeHeapZeroInitialized.class, null, nativeHeapZeroInitialized);
 
         // onConstructed(); // You can define this method to get a callback
     }
@@ -202,10 +204,10 @@
     };
 
     @DataClass.Generated(
-            time = 1611614699049L,
+            time = 1615850184524L,
             codegenVersion = "1.0.22",
             sourceFile = "frameworks/base/core/java/android/content/pm/ProcessInfo.java",
-            inputSignatures = "public @android.annotation.NonNull java.lang.String name\npublic @android.annotation.Nullable @com.android.internal.util.DataClass.ParcelWith(com.android.internal.util.Parcelling.BuiltIn.ForInternedStringArraySet.class) android.util.ArraySet<java.lang.String> deniedPermissions\npublic @android.content.pm.ApplicationInfo.GwpAsanMode int gwpAsanMode\npublic @android.content.pm.ApplicationInfo.MemtagMode int memtagMode\npublic @android.annotation.Nullable java.lang.Boolean nativeHeapZeroInit\nclass ProcessInfo extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genGetters=true, genSetters=false, genParcelable=true, genAidl=false, genBuilder=false)")
+            inputSignatures = "public @android.annotation.NonNull java.lang.String name\npublic @android.annotation.Nullable @com.android.internal.util.DataClass.ParcelWith(com.android.internal.util.Parcelling.BuiltIn.ForInternedStringArraySet.class) android.util.ArraySet<java.lang.String> deniedPermissions\npublic @android.content.pm.ApplicationInfo.GwpAsanMode int gwpAsanMode\npublic @android.content.pm.ApplicationInfo.MemtagMode int memtagMode\npublic @android.content.pm.ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized\nclass ProcessInfo extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genGetters=true, genSetters=false, genParcelable=true, genAidl=false, genBuilder=false)")
     @Deprecated
     private void __metadata() {}
 
diff --git a/core/java/android/content/pm/parsing/ParsingPackage.java b/core/java/android/content/pm/parsing/ParsingPackage.java
index 983a02c..61b5b72 100644
--- a/core/java/android/content/pm/parsing/ParsingPackage.java
+++ b/core/java/android/content/pm/parsing/ParsingPackage.java
@@ -19,6 +19,7 @@
 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.content.Intent;
+import android.content.pm.ApplicationInfo;
 import android.content.pm.ConfigurationInfo;
 import android.content.pm.FeatureGroupInfo;
 import android.content.pm.FeatureInfo;
@@ -239,11 +240,12 @@
 
     ParsingPackage setEnabled(boolean enabled);
 
-    ParsingPackage setGwpAsanMode(int gwpAsanMode);
+    ParsingPackage setGwpAsanMode(@ApplicationInfo.GwpAsanMode int gwpAsanMode);
 
-    ParsingPackage setMemtagMode(int memtagMode);
+    ParsingPackage setMemtagMode(@ApplicationInfo.MemtagMode int memtagMode);
 
-    ParsingPackage setNativeHeapZeroInit(@Nullable Boolean nativeHeapZeroInit);
+    ParsingPackage setNativeHeapZeroInitialized(
+            @ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized);
 
     ParsingPackage setCrossProfile(boolean crossProfile);
 
diff --git a/core/java/android/content/pm/parsing/ParsingPackageImpl.java b/core/java/android/content/pm/parsing/ParsingPackageImpl.java
index bb4480e..c9a03c1 100644
--- a/core/java/android/content/pm/parsing/ParsingPackageImpl.java
+++ b/core/java/android/content/pm/parsing/ParsingPackageImpl.java
@@ -417,12 +417,14 @@
     private int autoRevokePermissions;
     private boolean preserveLegacyExternalStorage;
 
-    protected int gwpAsanMode;
-    protected int memtagMode;
+    @ApplicationInfo.GwpAsanMode
+    private int gwpAsanMode;
 
-    @Nullable
-    @DataClass.ParcelWith(ForBoolean.class)
-    private Boolean nativeHeapZeroInit;
+    @ApplicationInfo.MemtagMode
+    private int memtagMode;
+
+    @ApplicationInfo.NativeHeapZeroInitialized
+    private int nativeHeapZeroInitialized;
 
     // TODO(chiuwinson): Non-null
     @Nullable
@@ -934,7 +936,7 @@
         appInfo.crossProfile = isCrossProfile();
         appInfo.setGwpAsanMode(gwpAsanMode);
         appInfo.setMemtagMode(memtagMode);
-        appInfo.setNativeHeapZeroInit(nativeHeapZeroInit);
+        appInfo.setNativeHeapZeroInitialized(nativeHeapZeroInitialized);
         appInfo.setBaseCodePath(baseCodePath);
         appInfo.setBaseResourcePath(baseCodePath);
         appInfo.setCodePath(codePath);
@@ -1121,7 +1123,7 @@
         dest.writeInt(this.gwpAsanMode);
         dest.writeSparseIntArray(this.minExtensionVersions);
         dest.writeInt(this.memtagMode);
-        sForBoolean.parcel(this.nativeHeapZeroInit, dest, flags);
+        dest.writeInt(this.nativeHeapZeroInitialized);
     }
 
     public ParsingPackageImpl(Parcel in) {
@@ -1284,7 +1286,7 @@
         this.gwpAsanMode = in.readInt();
         this.minExtensionVersions = in.readSparseIntArray();
         this.memtagMode = in.readInt();
-        this.nativeHeapZeroInit = sForBoolean.unparcel(in);
+        this.nativeHeapZeroInitialized = in.readInt();
     }
 
     public static final Parcelable.Creator<ParsingPackageImpl> CREATOR =
@@ -2012,20 +2014,22 @@
         return directBootAware;
     }
 
+    @ApplicationInfo.GwpAsanMode
     @Override
     public int getGwpAsanMode() {
         return gwpAsanMode;
     }
 
+    @ApplicationInfo.MemtagMode
     @Override
     public int getMemtagMode() {
         return memtagMode;
     }
 
-    @Nullable
+    @ApplicationInfo.NativeHeapZeroInitialized
     @Override
-    public Boolean isNativeHeapZeroInit() {
-        return nativeHeapZeroInit;
+    public int getNativeHeapZeroInitialized() {
+        return nativeHeapZeroInitialized;
     }
 
     @Override
@@ -2495,20 +2499,21 @@
     }
 
     @Override
-    public ParsingPackageImpl setGwpAsanMode(int value) {
+    public ParsingPackageImpl setGwpAsanMode(@ApplicationInfo.GwpAsanMode int value) {
         gwpAsanMode = value;
         return this;
     }
 
     @Override
-    public ParsingPackageImpl setMemtagMode(int value) {
+    public ParsingPackageImpl setMemtagMode(@ApplicationInfo.MemtagMode int value) {
         memtagMode = value;
         return this;
     }
 
     @Override
-    public ParsingPackageImpl setNativeHeapZeroInit(@Nullable Boolean value) {
-        nativeHeapZeroInit = value;
+    public ParsingPackageImpl setNativeHeapZeroInitialized(
+            @ApplicationInfo.NativeHeapZeroInitialized int value) {
+        nativeHeapZeroInitialized = value;
         return this;
     }
 
diff --git a/core/java/android/content/pm/parsing/ParsingPackageRead.java b/core/java/android/content/pm/parsing/ParsingPackageRead.java
index cd91e28..0311774 100644
--- a/core/java/android/content/pm/parsing/ParsingPackageRead.java
+++ b/core/java/android/content/pm/parsing/ParsingPackageRead.java
@@ -854,20 +854,22 @@
      * @see ApplicationInfo#gwpAsanMode
      * @see R.styleable#AndroidManifest_gwpAsanMode
      */
-    public int getGwpAsanMode();
+    @ApplicationInfo.GwpAsanMode
+    int getGwpAsanMode();
 
     /**
      * @see ApplicationInfo#memtagMode
      * @see R.styleable#AndroidManifest_memtagMode
      */
+    @ApplicationInfo.MemtagMode
     int getMemtagMode();
 
-      /**
-     * @see ApplicationInfo#nativeHeapZeroInit
-     * @see R.styleable#AndroidManifest_nativeHeapZeroInit
+    /**
+     * @see ApplicationInfo#nativeHeapZeroInitialized
+     * @see R.styleable#AndroidManifest_nativeHeapZeroInitialized
      */
-    @Nullable
-    Boolean isNativeHeapZeroInit();
+    @ApplicationInfo.NativeHeapZeroInitialized
+    int getNativeHeapZeroInitialized();
 
     // TODO(b/135203078): Hide and enforce going through PackageInfoUtils
     ApplicationInfo toAppInfoWithoutState();
diff --git a/core/java/android/content/pm/parsing/ParsingPackageUtils.java b/core/java/android/content/pm/parsing/ParsingPackageUtils.java
index 890ba8a..c6a335a 100644
--- a/core/java/android/content/pm/parsing/ParsingPackageUtils.java
+++ b/core/java/android/content/pm/parsing/ParsingPackageUtils.java
@@ -1800,9 +1800,11 @@
 
             pkg.setGwpAsanMode(sa.getInt(R.styleable.AndroidManifestApplication_gwpAsanMode, -1));
             pkg.setMemtagMode(sa.getInt(R.styleable.AndroidManifestApplication_memtagMode, -1));
-            if (sa.hasValue(R.styleable.AndroidManifestApplication_nativeHeapZeroInit)) {
-                pkg.setNativeHeapZeroInit(sa.getBoolean(
-                        R.styleable.AndroidManifestApplication_nativeHeapZeroInit, false));
+            if (sa.hasValue(R.styleable.AndroidManifestApplication_nativeHeapZeroInitialized)) {
+                Boolean v = sa.getBoolean(
+                        R.styleable.AndroidManifestApplication_nativeHeapZeroInitialized, false);
+                pkg.setNativeHeapZeroInitialized(
+                        v ? ApplicationInfo.ZEROINIT_ENABLED : ApplicationInfo.ZEROINIT_DISABLED);
             }
         } finally {
             sa.recycle();
diff --git a/core/java/android/content/pm/parsing/component/ParsedProcess.java b/core/java/android/content/pm/parsing/component/ParsedProcess.java
index 89fef9d..54a60d3 100644
--- a/core/java/android/content/pm/parsing/component/ParsedProcess.java
+++ b/core/java/android/content/pm/parsing/component/ParsedProcess.java
@@ -42,10 +42,12 @@
     @DataClass.ParcelWith(Parcelling.BuiltIn.ForInternedStringSet.class)
     protected Set<String> deniedPermissions = emptySet();
 
+    @ApplicationInfo.GwpAsanMode
     protected int gwpAsanMode = ApplicationInfo.GWP_ASAN_DEFAULT;
+    @ApplicationInfo.MemtagMode
     protected int memtagMode = ApplicationInfo.MEMTAG_DEFAULT;
-    @Nullable
-    protected Boolean nativeHeapZeroInit = null;
+    @ApplicationInfo.NativeHeapZeroInitialized
+    protected int nativeHeapZeroInitialized = ApplicationInfo.ZEROINIT_DEFAULT;
 
     public ParsedProcess() {
     }
@@ -78,9 +80,9 @@
     public ParsedProcess(
             @NonNull String name,
             @NonNull Set<String> deniedPermissions,
-            int gwpAsanMode,
-            int memtagMode,
-            @Nullable Boolean nativeHeapZeroInit) {
+            @ApplicationInfo.GwpAsanMode int gwpAsanMode,
+            @ApplicationInfo.MemtagMode int memtagMode,
+            @ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized) {
         this.name = name;
         com.android.internal.util.AnnotationValidations.validate(
                 NonNull.class, null, name);
@@ -88,8 +90,14 @@
         com.android.internal.util.AnnotationValidations.validate(
                 NonNull.class, null, deniedPermissions);
         this.gwpAsanMode = gwpAsanMode;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.GwpAsanMode.class, null, gwpAsanMode);
         this.memtagMode = memtagMode;
-        this.nativeHeapZeroInit = nativeHeapZeroInit;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.MemtagMode.class, null, memtagMode);
+        this.nativeHeapZeroInitialized = nativeHeapZeroInitialized;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.NativeHeapZeroInitialized.class, null, nativeHeapZeroInitialized);
 
         // onConstructed(); // You can define this method to get a callback
     }
@@ -105,18 +113,18 @@
     }
 
     @DataClass.Generated.Member
-    public int getGwpAsanMode() {
+    public @ApplicationInfo.GwpAsanMode int getGwpAsanMode() {
         return gwpAsanMode;
     }
 
     @DataClass.Generated.Member
-    public int getMemtagMode() {
+    public @ApplicationInfo.MemtagMode int getMemtagMode() {
         return memtagMode;
     }
 
     @DataClass.Generated.Member
-    public @Nullable Boolean getNativeHeapZeroInit() {
-        return nativeHeapZeroInit;
+    public @ApplicationInfo.NativeHeapZeroInitialized int getNativeHeapZeroInitialized() {
+        return nativeHeapZeroInitialized;
     }
 
     @DataClass.Generated.Member
@@ -136,14 +144,11 @@
         // You can override field parcelling by defining methods like:
         // void parcelFieldName(Parcel dest, int flags) { ... }
 
-        byte flg = 0;
-        if (nativeHeapZeroInit != null) flg |= 0x10;
-        dest.writeByte(flg);
         dest.writeString(name);
         sParcellingForDeniedPermissions.parcel(deniedPermissions, dest, flags);
         dest.writeInt(gwpAsanMode);
         dest.writeInt(memtagMode);
-        if (nativeHeapZeroInit != null) dest.writeBoolean(nativeHeapZeroInit);
+        dest.writeInt(nativeHeapZeroInitialized);
     }
 
     @Override
@@ -157,12 +162,11 @@
         // You can override field unparcelling by defining methods like:
         // static FieldType unparcelFieldName(Parcel in) { ... }
 
-        byte flg = in.readByte();
         String _name = in.readString();
         Set<String> _deniedPermissions = sParcellingForDeniedPermissions.unparcel(in);
         int _gwpAsanMode = in.readInt();
         int _memtagMode = in.readInt();
-        Boolean _nativeHeapZeroInit = (flg & 0x10) == 0 ? null : (Boolean) in.readBoolean();
+        int _nativeHeapZeroInitialized = in.readInt();
 
         this.name = _name;
         com.android.internal.util.AnnotationValidations.validate(
@@ -171,8 +175,14 @@
         com.android.internal.util.AnnotationValidations.validate(
                 NonNull.class, null, deniedPermissions);
         this.gwpAsanMode = _gwpAsanMode;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.GwpAsanMode.class, null, gwpAsanMode);
         this.memtagMode = _memtagMode;
-        this.nativeHeapZeroInit = _nativeHeapZeroInit;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.MemtagMode.class, null, memtagMode);
+        this.nativeHeapZeroInitialized = _nativeHeapZeroInitialized;
+        com.android.internal.util.AnnotationValidations.validate(
+                ApplicationInfo.NativeHeapZeroInitialized.class, null, nativeHeapZeroInitialized);
 
         // onConstructed(); // You can define this method to get a callback
     }
@@ -192,10 +202,10 @@
     };
 
     @DataClass.Generated(
-            time = 1611615591258L,
+            time = 1615850515058L,
             codegenVersion = "1.0.22",
             sourceFile = "frameworks/base/core/java/android/content/pm/parsing/component/ParsedProcess.java",
-            inputSignatures = "protected @android.annotation.NonNull java.lang.String name\nprotected @android.annotation.NonNull @com.android.internal.util.DataClass.ParcelWith(com.android.internal.util.Parcelling.BuiltIn.ForInternedStringSet.class) java.util.Set<java.lang.String> deniedPermissions\nprotected  int gwpAsanMode\nprotected  int memtagMode\nprotected @android.annotation.Nullable java.lang.Boolean nativeHeapZeroInit\npublic  void addStateFrom(android.content.pm.parsing.component.ParsedProcess)\nclass ParsedProcess extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genGetters=true, genSetters=false, genParcelable=true, genAidl=false, genBuilder=false)")
+            inputSignatures = "protected @android.annotation.NonNull java.lang.String name\nprotected @android.annotation.NonNull @com.android.internal.util.DataClass.ParcelWith(com.android.internal.util.Parcelling.BuiltIn.ForInternedStringSet.class) java.util.Set<java.lang.String> deniedPermissions\nprotected @android.content.pm.ApplicationInfo.GwpAsanMode int gwpAsanMode\nprotected @android.content.pm.ApplicationInfo.MemtagMode int memtagMode\nprotected @android.content.pm.ApplicationInfo.NativeHeapZeroInitialized int nativeHeapZeroInitialized\npublic  void addStateFrom(android.content.pm.parsing.component.ParsedProcess)\nclass ParsedProcess extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genGetters=true, genSetters=false, genParcelable=true, genAidl=false, genBuilder=false)")
     @Deprecated
     private void __metadata() {}
 
diff --git a/core/java/android/content/pm/parsing/component/ParsedProcessUtils.java b/core/java/android/content/pm/parsing/component/ParsedProcessUtils.java
index 082593e..c81d942 100644
--- a/core/java/android/content/pm/parsing/component/ParsedProcessUtils.java
+++ b/core/java/android/content/pm/parsing/component/ParsedProcessUtils.java
@@ -17,6 +17,7 @@
 package android.content.pm.parsing.component;
 
 import android.annotation.NonNull;
+import android.content.pm.ApplicationInfo;
 import android.content.pm.parsing.ParsingPackage;
 import android.content.pm.parsing.ParsingUtils;
 import android.content.pm.parsing.result.ParseInput;
@@ -106,9 +107,11 @@
 
             proc.gwpAsanMode = sa.getInt(R.styleable.AndroidManifestProcess_gwpAsanMode, -1);
             proc.memtagMode = sa.getInt(R.styleable.AndroidManifestProcess_memtagMode, -1);
-            if (sa.hasValue(R.styleable.AndroidManifestProcess_nativeHeapZeroInit)) {
-                proc.nativeHeapZeroInit =
-                        sa.getBoolean(R.styleable.AndroidManifestProcess_nativeHeapZeroInit, false);
+            if (sa.hasValue(R.styleable.AndroidManifestProcess_nativeHeapZeroInitialized)) {
+                Boolean v = sa.getBoolean(
+                        R.styleable.AndroidManifestProcess_nativeHeapZeroInitialized, false);
+                proc.nativeHeapZeroInitialized =
+                        v ? ApplicationInfo.ZEROINIT_ENABLED : ApplicationInfo.ZEROINIT_DISABLED;
             }
         } finally {
             sa.recycle();
diff --git a/core/java/android/hardware/biometrics/CryptoObject.java b/core/java/android/hardware/biometrics/CryptoObject.java
index 0af18df..7648cf2 100644
--- a/core/java/android/hardware/biometrics/CryptoObject.java
+++ b/core/java/android/hardware/biometrics/CryptoObject.java
@@ -18,7 +18,7 @@
 
 import android.annotation.NonNull;
 import android.security.identity.IdentityCredential;
-import android.security.keystore.AndroidKeyStoreProvider;
+import android.security.keystore2.AndroidKeyStoreProvider;
 
 import java.security.Signature;
 
diff --git a/core/java/android/hardware/hdmi/HdmiAudioSystemClient.java b/core/java/android/hardware/hdmi/HdmiAudioSystemClient.java
index bdd5ab6..e7d76f6 100644
--- a/core/java/android/hardware/hdmi/HdmiAudioSystemClient.java
+++ b/core/java/android/hardware/hdmi/HdmiAudioSystemClient.java
@@ -63,7 +63,6 @@
      *
      * @hide
      */
-    // TODO(b/110094868): unhide and add @SystemApi for Q
     public interface SetSystemAudioModeCallback {
         /**
          * Called when the input was changed.
@@ -74,7 +73,6 @@
     }
 
     /** @hide */
-    // TODO(b/110094868): unhide and add @SystemApi for Q
     @Override
     public int getDeviceType() {
         return HdmiDeviceInfo.DEVICE_AUDIO_SYSTEM;
@@ -143,7 +141,6 @@
      *
      * @hide
      */
-    // TODO(b/110094868): unhide and add @SystemApi for Q
     public void setSystemAudioMode(boolean state, @NonNull SetSystemAudioModeCallback callback) {
         // TODO(amyjojo): implement this when needed.
     }
@@ -156,7 +153,6 @@
      *
      * @hide
      */
-    // TODO(b/110094868): unhide and add @SystemApi for Q
     public void setSystemAudioModeOnForAudioOnlySource() {
         try {
             mService.setSystemAudioModeOnForAudioOnlySource();
diff --git a/core/java/android/hardware/hdmi/HdmiClient.java b/core/java/android/hardware/hdmi/HdmiClient.java
index a921215..0c21746 100644
--- a/core/java/android/hardware/hdmi/HdmiClient.java
+++ b/core/java/android/hardware/hdmi/HdmiClient.java
@@ -65,7 +65,6 @@
      * @param isPressed true if this is key press event
      *
      * @hide
-     * TODO(b/110094868): unhide for Q
      */
     public void sendVolumeKeyEvent(int keyCode, boolean isPressed) {
         try {
diff --git a/core/java/android/hardware/hdmi/HdmiControlManager.java b/core/java/android/hardware/hdmi/HdmiControlManager.java
index f25b06b..980c11a 100644
--- a/core/java/android/hardware/hdmi/HdmiControlManager.java
+++ b/core/java/android/hardware/hdmi/HdmiControlManager.java
@@ -472,7 +472,6 @@
      *
      * @return {@link HdmiAudioSystemClient} instance. {@code null} on failure.
      *
-     * TODO(b/110094868): unhide for Q
      * @hide
      */
     @Nullable
diff --git a/core/java/android/hardware/hdmi/HdmiUtils.java b/core/java/android/hardware/hdmi/HdmiUtils.java
index 8c94b78..2f4378e 100644
--- a/core/java/android/hardware/hdmi/HdmiUtils.java
+++ b/core/java/android/hardware/hdmi/HdmiUtils.java
@@ -24,7 +24,6 @@
 /**
  * Various utilities related to HDMI CEC.
  *
- * TODO(b/110094868): unhide for Q
  * @hide
  */
 public final class HdmiUtils {
@@ -84,7 +83,6 @@
     }
 
     /**
-     * TODO(b/110094868): unhide for Q
      * @hide
      */
     @Retention(RetentionPolicy.SOURCE)
@@ -95,49 +93,49 @@
     public @interface HdmiAddressRelativePosition {}
     /**
      * HDMI relative position is not determined.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_UNKNOWN = 0;
     /**
      * HDMI relative position: directly blow the device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_DIRECTLY_BELOW = 1;
     /**
      * HDMI relative position: indirectly below the device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_BELOW = 2;
     /**
      * HDMI relative position: the same device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_SAME = 3;
     /**
      * HDMI relative position: directly above the device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_DIRECTLY_ABOVE = 4;
     /**
      * HDMI relative position: indirectly above the device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_ABOVE = 5;
     /**
      * HDMI relative position: directly below a same device.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_SIBLING = 6;
     /**
      * HDMI relative position: different branch.
-     * TODO(b/110094868): unhide for Q
+     *
      * @hide
      */
     public static final int HDMI_RELATIVE_POSITION_DIFFERENT_BRANCH = 7;
diff --git a/core/java/android/net/vcn/persistablebundleutils/IkeSessionParamsUtils.java b/core/java/android/net/vcn/persistablebundleutils/IkeSessionParamsUtils.java
index 9d3462c..8950c4b 100644
--- a/core/java/android/net/vcn/persistablebundleutils/IkeSessionParamsUtils.java
+++ b/core/java/android/net/vcn/persistablebundleutils/IkeSessionParamsUtils.java
@@ -83,7 +83,7 @@
     /** Serializes an IkeSessionParams to a PersistableBundle. */
     @NonNull
     public static PersistableBundle toPersistableBundle(@NonNull IkeSessionParams params) {
-        if (params.getConfiguredNetwork() != null || params.getIke3gppExtension() != null) {
+        if (params.getNetwork() != null || params.getIke3gppExtension() != null) {
             throw new IllegalStateException(
                     "Cannot convert a IkeSessionParams with a caller configured network or with"
                             + " 3GPP extension enabled");
diff --git a/core/java/android/os/CountDownTimer.java b/core/java/android/os/CountDownTimer.java
index c7bf0fd..51faa85 100644
--- a/core/java/android/os/CountDownTimer.java
+++ b/core/java/android/os/CountDownTimer.java
@@ -22,7 +22,22 @@
  *
  * Example of showing a 30 second countdown in a text field:
  *
- * <pre class="prettyprint">
+ * <div>
+ * <div class="ds-selector-tabs"><section><h3 id="kotlin">Kotlin</h3>
+ * <pre class="prettyprint lang-kotlin">
+ * object : CountDownTimer(30000, 1000) {
+ *
+ *     override fun onTick(millisUntilFinished: Long) {
+ *         mTextField.setText("seconds remaining: " + millisUntilFinished / 1000)
+ *     }
+ *
+ *     override fun onFinish() {
+ *         mTextField.setText("done!")
+ *     }
+ * }.start()
+ * </pre>
+ * </section><section><h3 id="java">Java</h3>
+ * <pre class="prettyprint lang-java">
  * new CountDownTimer(30000, 1000) {
  *
  *     public void onTick(long millisUntilFinished) {
@@ -32,8 +47,8 @@
  *     public void onFinish() {
  *         mTextField.setText("done!");
  *     }
- *  }.start();
- * </pre>
+ * }.start();
+ * </pre></section></div></div>
  *
  * The calls to {@link #onTick(long)} are synchronized to this object so that
  * one call to {@link #onTick(long)} won't ever occur before the previous
diff --git a/core/java/android/os/Debug.java b/core/java/android/os/Debug.java
index 903bea3..1e60f74 100644
--- a/core/java/android/os/Debug.java
+++ b/core/java/android/os/Debug.java
@@ -623,7 +623,7 @@
        *         </tr>
        *         <tr>
        *             <td>summary.total-pss</td>
-       *             <td>Total PPS memory usage in kB.</td>
+       *             <td>Total PSS memory usage in kB.</td>
        *             <td>{@code 1442}</td>
        *             <td>23</td>
        *         </tr>
diff --git a/core/java/android/os/Parcelable.java b/core/java/android/os/Parcelable.java
index 7a624e1..a537c98 100644
--- a/core/java/android/os/Parcelable.java
+++ b/core/java/android/os/Parcelable.java
@@ -27,10 +27,39 @@
  * and restored from a {@link Parcel}.  Classes implementing the Parcelable
  * interface must also have a non-null static field called <code>CREATOR</code>
  * of a type that implements the {@link Parcelable.Creator} interface.
- * 
+ *
  * <p>A typical implementation of Parcelable is:</p>
- * 
- * <pre>
+ *
+ * <div>
+ * <div class="ds-selector-tabs"><section><h3 id="kotlin">Kotlin</h3>
+ * <pre class="prettyprint lang-kotlin">
+ * class MyParcelable private constructor(`in`: Parcel) : Parcelable {
+ *     private val mData: Int = `in`.readInt()
+ *
+ *     override fun describeContents(): Int {
+ *         return 0
+ *     }
+ *
+ *     override fun writeToParcel(out: Parcel, flags: Int) {
+ *         out.writeInt(mData)
+ *     }
+ *
+ *     companion object {
+ *         val CREATOR: Parcelable.Creator&lt;MyParcelable?&gt;
+ *                 = object : Parcelable.Creator&lt;MyParcelable?&gt; {
+ *             override fun createFromParcel(`in`: Parcel): MyParcelable? {
+ *                 return MyParcelable(`in`)
+ *             }
+ *
+ *             override fun newArray(size: Int): Array&lt;MyParcelable?&gt; {
+ *                 return arrayOfNulls(size)
+ *             }
+ *         }
+ *     }
+ * }
+ * </pre>
+ * </section><section><h3 id="java">Java</h3>
+ * <pre class="prettyprint lang-java">
  * public class MyParcelable implements Parcelable {
  *     private int mData;
  *
@@ -52,11 +81,11 @@
  *             return new MyParcelable[size];
  *         }
  *     };
- *     
+ *
  *     private MyParcelable(Parcel in) {
  *         mData = in.readInt();
  *     }
- * }</pre>
+ * }</pre></section></div></div>
  */
 public interface Parcelable {
     /** @hide */
diff --git a/core/java/android/service/resumeonreboot/OWNERS b/core/java/android/service/resumeonreboot/OWNERS
new file mode 100644
index 0000000..3a127d5
--- /dev/null
+++ b/core/java/android/service/resumeonreboot/OWNERS
@@ -0,0 +1,2 @@
+xunchang@google.com
+zhaojiac@google.com
diff --git a/core/java/android/service/resumeonreboot/ResumeOnRebootService.java b/core/java/android/service/resumeonreboot/ResumeOnRebootService.java
index ad49ffd..247d9c4 100644
--- a/core/java/android/service/resumeonreboot/ResumeOnRebootService.java
+++ b/core/java/android/service/resumeonreboot/ResumeOnRebootService.java
@@ -59,11 +59,9 @@
  *     &lt;/service&gt;
  * </pre>
  *
- * //TODO: Replace this with public link when available.
- *
  * @hide
  * @see
- * <a href="https://goto.google.com/server-based-ror">https://goto.google.com/server-based-ror</a>
+ * <a href="https://source.android.com/devices/tech/ota/resume-on-reboot">https://source.android.com/devices/tech/ota/resume-on-reboot</a>
  */
 @SystemApi
 public abstract class ResumeOnRebootService extends Service {
diff --git a/core/java/com/android/internal/app/IAppOpsCallback.aidl b/core/java/com/android/internal/app/IAppOpsCallback.aidl
index 15221b1..024ff66 100644
--- a/core/java/com/android/internal/app/IAppOpsCallback.aidl
+++ b/core/java/com/android/internal/app/IAppOpsCallback.aidl
@@ -17,7 +17,7 @@
 package com.android.internal.app;
 
 // This interface is also used by native code, so must
-// be kept in sync with frameworks/native/libs/binder/include/binder/IAppOpsCallback.h
+// be kept in sync with frameworks/native/libs/permission/include/binder/IAppOpsCallback.h
 oneway interface IAppOpsCallback {
     void opChanged(int op, int uid, String packageName);
 }
diff --git a/core/java/com/android/internal/app/IAppOpsService.aidl b/core/java/com/android/internal/app/IAppOpsService.aidl
index aca5926..eae650f 100644
--- a/core/java/com/android/internal/app/IAppOpsService.aidl
+++ b/core/java/com/android/internal/app/IAppOpsService.aidl
@@ -32,7 +32,7 @@
 
 interface IAppOpsService {
     // These methods are also called by native code, so must
-    // be kept in sync with frameworks/native/libs/binder/include/binder/IAppOpsService.h
+    // be kept in sync with frameworks/native/libs/permission/include/binder/IAppOpsService.h
     // and not be reordered
     int checkOperation(int code, int uid, String packageName);
     int noteOperation(int code, int uid, String packageName, @nullable String attributionTag,
diff --git a/core/java/com/android/internal/os/ZygoteConnection.java b/core/java/com/android/internal/os/ZygoteConnection.java
index 1673362..993e4e7 100644
--- a/core/java/com/android/internal/os/ZygoteConnection.java
+++ b/core/java/com/android/internal/os/ZygoteConnection.java
@@ -149,8 +149,11 @@
                     return null;
                 }
 
-                if (parsedArgs.mUsapPoolStatusSpecified) {
-                    // Handle this once we've released the argBuffer, to avoid opening a second one.
+                if (parsedArgs.mUsapPoolStatusSpecified
+                        || parsedArgs.mApiDenylistExemptions != null
+                        || parsedArgs.mHiddenApiAccessLogSampleRate != -1
+                        || parsedArgs.mHiddenApiAccessStatslogSampleRate != -1) {
+                    // Handle these once we've released argBuffer, to avoid opening a second one.
                     break;
                 }
 
@@ -183,18 +186,6 @@
                     return null;
                 }
 
-                if (parsedArgs.mApiDenylistExemptions != null) {
-                    return handleApiDenylistExemptions(zygoteServer,
-                            parsedArgs.mApiDenylistExemptions);
-                }
-
-                if (parsedArgs.mHiddenApiAccessLogSampleRate != -1
-                        || parsedArgs.mHiddenApiAccessStatslogSampleRate != -1) {
-                    return handleHiddenApiAccessLogSampleRate(zygoteServer,
-                            parsedArgs.mHiddenApiAccessLogSampleRate,
-                            parsedArgs.mHiddenApiAccessStatslogSampleRate);
-                }
-
                 if (parsedArgs.mPermittedCapabilities != 0
                         || parsedArgs.mEffectiveCapabilities != 0) {
                     throw new ZygoteSecurityException("Client may not specify capabilities: "
@@ -311,10 +302,20 @@
                 }
             }
         }
+        // Handle anything that may need a ZygoteCommandBuffer after we've released ours.
         if (parsedArgs.mUsapPoolStatusSpecified) {
-            // Now that we've released argBuffer:
             return handleUsapPoolStatusChange(zygoteServer, parsedArgs.mUsapPoolEnabled);
         }
+        if (parsedArgs.mApiDenylistExemptions != null) {
+            return handleApiDenylistExemptions(zygoteServer,
+                    parsedArgs.mApiDenylistExemptions);
+        }
+        if (parsedArgs.mHiddenApiAccessLogSampleRate != -1
+                || parsedArgs.mHiddenApiAccessStatslogSampleRate != -1) {
+            return handleHiddenApiAccessLogSampleRate(zygoteServer,
+                    parsedArgs.mHiddenApiAccessLogSampleRate,
+                    parsedArgs.mHiddenApiAccessStatslogSampleRate);
+        }
         throw new AssertionError("Shouldn't get here");
     }
 
diff --git a/core/res/res/values/attrs_manifest.xml b/core/res/res/values/attrs_manifest.xml
index 47dbd64..41cd371 100644
--- a/core/res/res/values/attrs_manifest.xml
+++ b/core/res/res/values/attrs_manifest.xml
@@ -1560,6 +1560,20 @@
        <enum name="always" value="1" />
     </attr>
 
+    <!-- Enable hardware memory tagging (ARM MTE) in this process.
+         When enabled, heap memory bugs like use-after-free and buffer overlow
+         are detected and result in an immediate ("sync" mode) or delayed ("async"
+         mode) crash instead of a silent memory corruption. Sync mode, while slower,
+         provides enhanced bug reports including stack traces at the time of allocation
+         and deallocation of memory, similar to AddressSanitizer.
+
+         See the <a href="https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety">ARM announcement</a>
+         for more details.
+
+         <p>This attribute can be applied to a
+         {@link android.R.styleable#AndroidManifestProcess process} tag, or to an
+         {@link android.R.styleable#AndroidManifestApplication application} tag (to supply
+         a default setting for all application components). -->
     <attr name="memtagMode">
        <enum name="default" value="-1" />
        <enum name="off" value="0" />
@@ -1836,7 +1850,9 @@
 
         <attr name="memtagMode" />
 
-        <attr name="nativeHeapZeroInit" format="boolean" />
+        <!-- If {@code true} enables automatic zero initialization of all native heap
+             allocations. -->
+        <attr name="nativeHeapZeroInitialized" format="boolean" />
 
         <!-- @hide no longer used, kept to preserve padding -->
         <attr name="allowAutoRevokePermissionsExemption" format="boolean" />
@@ -2362,7 +2378,7 @@
         <attr name="process" />
         <attr name="gwpAsanMode" />
         <attr name="memtagMode" />
-        <attr name="nativeHeapZeroInit" />
+        <attr name="nativeHeapZeroInitialized" />
     </declare-styleable>
 
     <!-- The <code>deny-permission</code> tag specifies that a permission is to be denied
diff --git a/core/res/res/values/public.xml b/core/res/res/values/public.xml
index 0f846d3..6a4702b 100644
--- a/core/res/res/values/public.xml
+++ b/core/res/res/values/public.xml
@@ -3047,7 +3047,7 @@
     <!-- attribute definitions go here -->
     <public name="requireDeviceScreenOn" />
     <public name="memtagMode" />
-    <public name="nativeHeapZeroInit" />
+    <public name="nativeHeapZeroInitialized" />
   </public-group>
 
   <public-group type="drawable" first-id="0x010800b5">
diff --git a/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java b/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java
index ecb082e..62fe54f 100644
--- a/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java
+++ b/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java
@@ -62,10 +62,8 @@
      */
     @UnsupportedAppUsage
     public static long getKeyStoreOperationHandle(Object cryptoPrimitive) {
-        if (cryptoPrimitive == null) {
-            throw new NullPointerException();
-        }
-        return 0;
+        return android.security.keystore2.AndroidKeyStoreProvider
+                .getKeyStoreOperationHandle(cryptoPrimitive);
     }
 
     /**
diff --git a/packages/Shell/TEST_MAPPING b/packages/Shell/TEST_MAPPING
index a149b5c..9bb1b4b 100644
--- a/packages/Shell/TEST_MAPPING
+++ b/packages/Shell/TEST_MAPPING
@@ -18,6 +18,20 @@
           "exclude-annotation": "androidx.test.filters.FlakyTest"
         }
       ]
+    },
+    {
+      "name": "CtsUiAutomationTestCases",
+      "options": [
+        {
+          "include-filter": "android.app.uiautomation.cts.UiAutomationTest#testAdoptAllShellPermissions"
+        },
+        {
+          "include-filter": "android.app.uiautomation.cts.UiAutomationTest#testAdoptSomeShellPermissions"
+        },
+        {
+          "exclude-annotation": "androidx.test.filters.FlakyTest"
+        }
+      ]
     }
   ],
   "postsubmit": [
diff --git a/services/autofill/java/com/android/server/autofill/Session.java b/services/autofill/java/com/android/server/autofill/Session.java
index 1970b57..f5497f9 100644
--- a/services/autofill/java/com/android/server/autofill/Session.java
+++ b/services/autofill/java/com/android/server/autofill/Session.java
@@ -1204,7 +1204,9 @@
     @Override
     public void onServiceDied(@NonNull RemoteFillService service) {
         Slog.w(TAG, "removing session because service died");
-        forceRemoveSelfLocked();
+        synchronized (mLock) {
+            forceRemoveSelfLocked();
+        }
     }
 
     // AutoFillUiCallback
diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index a39f8f6..2216e89 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -2791,6 +2791,8 @@
     @Override
     protected void dump(@NonNull FileDescriptor fd, @NonNull PrintWriter writer,
             @Nullable String[] args) {
+        if (!checkDumpPermission(mContext, TAG, writer)) return;
+
         mPriorityDumper.dump(fd, writer, args);
     }
 
@@ -2808,7 +2810,6 @@
 
     private void doDump(FileDescriptor fd, PrintWriter writer, String[] args) {
         final IndentingPrintWriter pw = new IndentingPrintWriter(writer, "  ");
-        if (!checkDumpPermission(mContext, TAG, pw)) return;
 
         if (CollectionUtils.contains(args, DIAG_ARG)) {
             dumpNetworkDiagnostics(pw);
diff --git a/services/core/java/com/android/server/am/ProcessList.java b/services/core/java/com/android/server/am/ProcessList.java
index 1667901..444418c 100644
--- a/services/core/java/com/android/server/am/ProcessList.java
+++ b/services/core/java/com/android/server/am/ProcessList.java
@@ -1722,12 +1722,13 @@
 
     private boolean enableNativeHeapZeroInit(ProcessRecord app) {
         // Look at the process attribute first.
-        if (app.processInfo != null && app.processInfo.nativeHeapZeroInit != null) {
-            return app.processInfo.nativeHeapZeroInit;
+        if (app.processInfo != null
+                && app.processInfo.nativeHeapZeroInitialized != ApplicationInfo.ZEROINIT_DEFAULT) {
+            return app.processInfo.nativeHeapZeroInitialized == ApplicationInfo.ZEROINIT_ENABLED;
         }
         // Then at the application attribute.
-        if (app.info.isNativeHeapZeroInit() != null) {
-            return app.info.isNativeHeapZeroInit();
+        if (app.info.getNativeHeapZeroInitialized() != ApplicationInfo.ZEROINIT_DEFAULT) {
+            return app.info.getNativeHeapZeroInitialized() == ApplicationInfo.ZEROINIT_ENABLED;
         }
         // Compat feature last.
         if (mPlatformCompat.isChangeEnabled(NATIVE_HEAP_ZERO_INIT, app.info)) {
diff --git a/services/core/java/com/android/server/am/ProcessRecord.java b/services/core/java/com/android/server/am/ProcessRecord.java
index 4775541..5ebf603 100644
--- a/services/core/java/com/android/server/am/ProcessRecord.java
+++ b/services/core/java/com/android/server/am/ProcessRecord.java
@@ -650,7 +650,7 @@
                 if (procInfo != null && procInfo.deniedPermissions == null
                         && procInfo.gwpAsanMode == ApplicationInfo.GWP_ASAN_DEFAULT
                         && procInfo.memtagMode == ApplicationInfo.MEMTAG_DEFAULT
-                        && procInfo.nativeHeapZeroInit == null) {
+                        && procInfo.nativeHeapZeroInitialized == ApplicationInfo.ZEROINIT_DEFAULT) {
                     // If this process hasn't asked for permissions to be denied, or for a
                     // non-default GwpAsan mode, or any other non-default setting, then we don't
                     // care about it.
diff --git a/services/core/java/com/android/server/hdmi/HdmiCecLocalDeviceAudioSystem.java b/services/core/java/com/android/server/hdmi/HdmiCecLocalDeviceAudioSystem.java
index 39a9119..afaae8a 100644
--- a/services/core/java/com/android/server/hdmi/HdmiCecLocalDeviceAudioSystem.java
+++ b/services/core/java/com/android/server/hdmi/HdmiCecLocalDeviceAudioSystem.java
@@ -353,7 +353,6 @@
         super.disableDevice(initiatedByCec, callback);
         assertRunOnServiceThread();
         mService.unregisterTvInputCallback(mTvInputCallback);
-        // TODO(b/129088603): check disableDevice and onStandby behaviors per spec
     }
 
     @Override
@@ -1046,7 +1045,6 @@
     }
 
     protected void switchToAudioInput() {
-        // TODO(b/111396634): switch input according to PROPERTY_SYSTEM_AUDIO_MODE_AUDIO_PORT
     }
 
     protected boolean isDirectConnectToTv() {
diff --git a/services/core/java/com/android/server/locksettings/RebootEscrowManager.java b/services/core/java/com/android/server/locksettings/RebootEscrowManager.java
index c01523a..90694d0 100644
--- a/services/core/java/com/android/server/locksettings/RebootEscrowManager.java
+++ b/services/core/java/com/android/server/locksettings/RebootEscrowManager.java
@@ -205,6 +205,7 @@
                 Slog.i(TAG, "Using server based resume on reboot");
                 rebootEscrowProvider = new RebootEscrowProviderServerBasedImpl(mContext, mStorage);
             } else {
+                Slog.i(TAG, "Using HAL based resume on reboot");
                 rebootEscrowProvider = new RebootEscrowProviderHalImpl();
             }
 
@@ -239,7 +240,7 @@
             return mKeyStoreManager;
         }
 
-        public RebootEscrowProviderInterface getRebootEscrowProvider() {
+        public RebootEscrowProviderInterface createRebootEscrowProviderIfNeeded() {
             // Initialize for the provider lazily. Because the device_config and service
             // implementation apps may change when system server is running.
             if (mRebootEscrowProvider == null) {
@@ -249,6 +250,14 @@
             return mRebootEscrowProvider;
         }
 
+        public RebootEscrowProviderInterface getRebootEscrowProvider() {
+            return mRebootEscrowProvider;
+        }
+
+        public void clearRebootEscrowProvider() {
+            mRebootEscrowProvider = null;
+        }
+
         public int getBootCount() {
             return Settings.Global.getInt(mContext.getContentResolver(), Settings.Global.BOOT_COUNT,
                     0);
@@ -308,8 +317,6 @@
             mStorage.removeRebootEscrow(user.id);
         }
 
-        // Clear the old key in keystore.
-        mKeyStoreManager.clearKeyStoreEncryptionKey();
         onEscrowRestoreComplete(false, attemptCount);
     }
 
@@ -395,9 +402,6 @@
             allUsersUnlocked &= restoreRebootEscrowForUser(user.id, escrowKey, kk);
         }
 
-        // Clear the old key in keystore. A new key will be generated by new RoR requests.
-        mKeyStoreManager.clearKeyStoreEncryptionKey();
-
         if (!allUsersUnlocked && mLoadEscrowDataErrorCode == ERROR_NONE) {
             mLoadEscrowDataErrorCode = ERROR_UNLOCK_ALL_USERS;
         }
@@ -473,11 +477,17 @@
         if (success || (previousBootCount != -1 && bootCountDelta <= BOOT_COUNT_TOLERANCE)) {
             reportMetricOnRestoreComplete(success, attemptCount);
         }
+
+        // Clear the old key in keystore. A new key will be generated by new RoR requests.
+        mKeyStoreManager.clearKeyStoreEncryptionKey();
+        // Clear the saved reboot escrow provider
+        mInjector.clearRebootEscrowProvider();
         clearMetricsStorage();
     }
 
     private RebootEscrowKey getAndClearRebootEscrowKey(SecretKey kk) throws IOException {
-        RebootEscrowProviderInterface rebootEscrowProvider = mInjector.getRebootEscrowProvider();
+        RebootEscrowProviderInterface rebootEscrowProvider =
+                mInjector.createRebootEscrowProviderIfNeeded();
         if (rebootEscrowProvider == null) {
             Slog.w(TAG,
                     "Had reboot escrow data for users, but RebootEscrowProvider is unavailable");
@@ -529,9 +539,8 @@
             return;
         }
 
-        if (mInjector.getRebootEscrowProvider() == null) {
-            Slog.w(TAG,
-                    "Had reboot escrow data for users, but RebootEscrowProvider is unavailable");
+        if (mInjector.createRebootEscrowProviderIfNeeded() == null) {
+            Slog.w(TAG, "Not storing escrow data, RebootEscrowProvider is unavailable");
             return;
         }
 
@@ -586,13 +595,17 @@
         mRebootEscrowWanted = false;
         setRebootEscrowReady(false);
 
-        RebootEscrowProviderInterface rebootEscrowProvider = mInjector.getRebootEscrowProvider();
+        // We want to clear the internal data inside the provider, so always try to create the
+        // provider.
+        RebootEscrowProviderInterface rebootEscrowProvider =
+                mInjector.createRebootEscrowProviderIfNeeded();
         if (rebootEscrowProvider == null) {
             Slog.w(TAG, "RebootEscrowProvider is unavailable for clear request");
         } else {
             rebootEscrowProvider.clearRebootEscrowKey();
         }
 
+        mInjector.clearRebootEscrowProvider();
         clearMetricsStorage();
 
         List<UserInfo> users = mUserManager.getUsers();
@@ -610,8 +623,7 @@
 
         RebootEscrowProviderInterface rebootEscrowProvider = mInjector.getRebootEscrowProvider();
         if (rebootEscrowProvider == null) {
-            Slog.w(TAG,
-                    "Had reboot escrow data for users, but RebootEscrowProvider is unavailable");
+            Slog.w(TAG, "Not storing escrow key, RebootEscrowProvider is unavailable");
             clearRebootEscrowIfNeeded();
             return ARM_REBOOT_ERROR_NO_PROVIDER;
         }
@@ -677,11 +689,12 @@
     }
 
     boolean prepareRebootEscrow() {
-        if (mInjector.getRebootEscrowProvider() == null) {
+        clearRebootEscrowIfNeeded();
+        if (mInjector.createRebootEscrowProviderIfNeeded() == null) {
+            Slog.w(TAG, "No reboot escrow provider, skipping resume on reboot preparation.");
             return false;
         }
 
-        clearRebootEscrowIfNeeded();
         mRebootEscrowWanted = true;
         mEventLog.addEntry(RebootEscrowEvent.REQUESTED_LSKF);
         return true;
@@ -807,6 +820,10 @@
         pw.print("mPendingRebootEscrowKey is ");
         pw.println(keySet ? "set" : "not set");
 
+        RebootEscrowProviderInterface provider = mInjector.getRebootEscrowProvider();
+        String providerType = provider == null ? "null" : String.valueOf(provider.getType());
+        pw.print("RebootEscrowProvider type is " + providerType);
+
         pw.println();
         pw.println("Event log:");
         pw.increaseIndent();
diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
index 319800d..1f44d25 100644
--- a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
+++ b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java
@@ -3201,23 +3201,19 @@
         // Verify they're not lying about package name
         mAppOps.checkPackage(callingUid, callingPackage);
 
-        final SubscriptionManager sm;
-        final SubscriptionInfo si;
         final PersistableBundle config;
+        final TelephonyManager tm;
         final long token = Binder.clearCallingIdentity();
         try {
-            sm = mContext.getSystemService(SubscriptionManager.class);
-            si = sm.getActiveSubscriptionInfo(subId);
             config = mCarrierConfigManager.getConfigForSubId(subId);
+            tm = mContext.getSystemService(TelephonyManager.class);
         } finally {
             Binder.restoreCallingIdentity(token);
         }
 
-        // First check: is caller the CarrierService?
-        if (si != null) {
-            if (si.isEmbedded() && sm.canManageSubscription(si, callingPackage)) {
-                return;
-            }
+        // First check: does caller have carrier privilege?
+        if (tm != null && tm.hasCarrierPrivileges(subId)) {
+            return;
         }
 
         // Second check: has the CarrierService delegated access?
diff --git a/services/core/java/com/android/server/net/TEST_MAPPING b/services/core/java/com/android/server/net/TEST_MAPPING
index 9f04260..571957b 100644
--- a/services/core/java/com/android/server/net/TEST_MAPPING
+++ b/services/core/java/com/android/server/net/TEST_MAPPING
@@ -1,5 +1,5 @@
 {
-  "presubmit": [
+  "presubmit-large": [
     {
       "name": "CtsHostsideNetworkTests",
       "file_patterns": ["(/|^)NetworkPolicy[^/]*\\.java"],
@@ -11,7 +11,9 @@
           "exclude-annotation": "androidx.test.filters.FlakyTest"
         }
       ]
-    },
+    }
+  ],
+  "presubmit": [
     {
       "name": "FrameworksServicesTests",
       "file_patterns": ["(/|^)NetworkPolicy[^/]*\\.java"],
diff --git a/services/core/java/com/android/server/pm/parsing/PackageInfoUtils.java b/services/core/java/com/android/server/pm/parsing/PackageInfoUtils.java
index 64fa708..1fd2a05 100644
--- a/services/core/java/com/android/server/pm/parsing/PackageInfoUtils.java
+++ b/services/core/java/com/android/server/pm/parsing/PackageInfoUtils.java
@@ -400,7 +400,7 @@
             retProcs.put(proc.getName(),
                     new ProcessInfo(proc.getName(), new ArraySet<>(proc.getDeniedPermissions()),
                             proc.getGwpAsanMode(), proc.getMemtagMode(),
-                            proc.getNativeHeapZeroInit()));
+                            proc.getNativeHeapZeroInitialized()));
         }
         return retProcs;
     }
diff --git a/services/core/java/com/android/server/vcn/VcnGatewayConnection.java b/services/core/java/com/android/server/vcn/VcnGatewayConnection.java
index 1d55ba4..df31221 100644
--- a/services/core/java/com/android/server/vcn/VcnGatewayConnection.java
+++ b/services/core/java/com/android/server/vcn/VcnGatewayConnection.java
@@ -2106,7 +2106,7 @@
                 (VcnControlPlaneIkeConfig) mConnectionConfig.getControlPlaneConfig();
         final IkeSessionParams.Builder builder =
                 new IkeSessionParams.Builder(controlPlaneConfig.getIkeSessionParams());
-        builder.setConfiguredNetwork(network);
+        builder.setNetwork(network);
 
         return builder.build();
     }
diff --git a/services/incremental/Android.bp b/services/incremental/Android.bp
index 7e1e99f..1a96048 100644
--- a/services/incremental/Android.bp
+++ b/services/incremental/Android.bp
@@ -76,6 +76,7 @@
         "libcutils",
         "libincfs",
         "liblog",
+        "libpermission",
         "libz",
         "libziparchive",
     ],
diff --git a/services/tests/servicestests/src/com/android/server/locksettings/RebootEscrowManagerTests.java b/services/tests/servicestests/src/com/android/server/locksettings/RebootEscrowManagerTests.java
index 49a54ec..aecc794 100644
--- a/services/tests/servicestests/src/com/android/server/locksettings/RebootEscrowManagerTests.java
+++ b/services/tests/servicestests/src/com/android/server/locksettings/RebootEscrowManagerTests.java
@@ -112,14 +112,13 @@
     private MockableRebootEscrowInjected mInjected;
     private RebootEscrowManager mService;
     private SecretKey mAesKey;
+    private MockInjector mMockInjector;
 
     public interface MockableRebootEscrowInjected {
         int getBootCount();
 
         long getCurrentTimeMillis();
 
-        boolean forceServerBased();
-
         void reportMetric(boolean success, int errorCode, int serviceType, int attemptCount,
                 int escrowDurationInSeconds, int vbmetaDigestStatus, int durationSinceBootComplete);
     }
@@ -127,11 +126,12 @@
     static class MockInjector extends RebootEscrowManager.Injector {
         private final IRebootEscrow mRebootEscrow;
         private final ResumeOnRebootServiceConnection mServiceConnection;
-        private final RebootEscrowProviderInterface mRebootEscrowProvider;
+        private final RebootEscrowProviderInterface mDefaultRebootEscrowProvider;
         private final UserManager mUserManager;
         private final MockableRebootEscrowInjected mInjected;
         private final RebootEscrowKeyStoreManager mKeyStoreManager;
-        private final boolean mServerBased;
+        private boolean mServerBased;
+        private RebootEscrowProviderInterface mRebootEscrowProviderInUse;
 
         MockInjector(Context context, UserManager userManager,
                 IRebootEscrow rebootEscrow,
@@ -149,7 +149,7 @@
                             return mRebootEscrow;
                         }
                     };
-            mRebootEscrowProvider = new RebootEscrowProviderHalImpl(halInjector);
+            mDefaultRebootEscrowProvider = new RebootEscrowProviderHalImpl(halInjector);
             mUserManager = userManager;
             mKeyStoreManager = keyStoreManager;
             mInjected = injected;
@@ -166,7 +166,8 @@
             mServerBased = true;
             RebootEscrowProviderServerBasedImpl.Injector injector =
                     new RebootEscrowProviderServerBasedImpl.Injector(serviceConnection);
-            mRebootEscrowProvider = new RebootEscrowProviderServerBasedImpl(storage, injector);
+            mDefaultRebootEscrowProvider = new RebootEscrowProviderServerBasedImpl(
+                    storage, injector);
             mUserManager = userManager;
             mKeyStoreManager = keyStoreManager;
             mInjected = injected;
@@ -184,15 +185,23 @@
 
         @Override
         public boolean serverBasedResumeOnReboot() {
-            if (mInjected.forceServerBased()) {
-                return true;
-            }
             return mServerBased;
         }
 
         @Override
+        public RebootEscrowProviderInterface createRebootEscrowProviderIfNeeded() {
+            mRebootEscrowProviderInUse = mDefaultRebootEscrowProvider;
+            return mRebootEscrowProviderInUse;
+        }
+
+        @Override
         public RebootEscrowProviderInterface getRebootEscrowProvider() {
-            return mRebootEscrowProvider;
+            return mRebootEscrowProviderInUse;
+        }
+
+        @Override
+        public void clearRebootEscrowProvider() {
+            mRebootEscrowProviderInUse = null;
         }
 
         @Override
@@ -264,13 +273,15 @@
         when(mCallbacks.isUserSecure(NONSECURE_SECONDARY_USER_ID)).thenReturn(false);
         when(mCallbacks.isUserSecure(SECURE_SECONDARY_USER_ID)).thenReturn(true);
         mInjected = mock(MockableRebootEscrowInjected.class);
-        mService = new RebootEscrowManager(new MockInjector(mContext, mUserManager, mRebootEscrow,
-                mKeyStoreManager, mStorage, mInjected), mCallbacks, mStorage);
+        mMockInjector = new MockInjector(mContext, mUserManager, mRebootEscrow,
+                mKeyStoreManager, mStorage, mInjected);
+        mService = new RebootEscrowManager(mMockInjector, mCallbacks, mStorage);
     }
 
     private void setServerBasedRebootEscrowProvider() throws Exception {
-        mService = new RebootEscrowManager(new MockInjector(mContext, mUserManager,
-                mServiceConnection, mKeyStoreManager, mStorage, mInjected), mCallbacks, mStorage);
+        mMockInjector = new MockInjector(mContext, mUserManager, mServiceConnection,
+                mKeyStoreManager, mStorage, mInjected);
+        mService = new RebootEscrowManager(mMockInjector, mCallbacks, mStorage);
     }
 
     @Test
@@ -317,6 +328,7 @@
         doThrow(ServiceSpecificException.class).when(mRebootEscrow).storeKey(any());
         mService.clearRebootEscrow();
         verify(mRebootEscrow).storeKey(eq(new byte[32]));
+        assertNull(mMockInjector.getRebootEscrowProvider());
     }
 
     @Test
@@ -785,7 +797,7 @@
         assertNull(
                 mStorage.getString(RebootEscrowManager.REBOOT_ESCROW_ARMED_KEY, null, USER_SYSTEM));
         // Change the provider to server based, expect the reboot to fail
-        when(mInjected.forceServerBased()).thenReturn(true);
+        mMockInjector.mServerBased = true;
         assertEquals(ARM_REBOOT_ERROR_PROVIDER_MISMATCH, mService.armRebootEscrowIfNeeded());
         assertNull(
                 mStorage.getString(RebootEscrowManager.REBOOT_ESCROW_ARMED_KEY, null, USER_SYSTEM));
diff --git a/telephony/java/android/telephony/CarrierConfigManager.java b/telephony/java/android/telephony/CarrierConfigManager.java
index 073f1e3..210e4a5 100644
--- a/telephony/java/android/telephony/CarrierConfigManager.java
+++ b/telephony/java/android/telephony/CarrierConfigManager.java
@@ -4043,7 +4043,6 @@
          * it will override the framework default.
          * @hide
          */
-        @SystemApi
         public static final String KEY_PUBLISH_SERVICE_DESC_FEATURE_TAG_MAP_OVERRIDE_STRING_ARRAY =
                 KEY_PREFIX + "publish_service_desc_feature_tag_map_override_string_array";
 
diff --git a/telephony/java/android/telephony/SubscriptionInfo.java b/telephony/java/android/telephony/SubscriptionInfo.java
index 8307c03..104cc75 100644
--- a/telephony/java/android/telephony/SubscriptionInfo.java
+++ b/telephony/java/android/telephony/SubscriptionInfo.java
@@ -149,13 +149,14 @@
 
     /**
      * The access rules for this subscription, if it is embedded and defines any.
+     * This does not include access rules for non-embedded subscriptions.
      */
     @Nullable
     private UiccAccessRule[] mNativeAccessRules;
 
     /**
      * The carrier certificates for this subscription that are saved in carrier configs.
-     * The other carrier certificates are embedded on Uicc and stored as part of mNativeAccessRules.
+     * This does not include access rules from the Uicc, whether embedded or non-embedded.
      */
     @Nullable
     private UiccAccessRule[] mCarrierConfigAccessRules;
@@ -662,7 +663,6 @@
      * is authorized to manage this subscription.
      * TODO and fix it properly in R / master: either deprecate this and have 3 APIs
      *  native + carrier + all, or have this return all by default.
-     * @throws UnsupportedOperationException if this subscription is not embedded.
      * @hide
      */
     @SystemApi
diff --git a/telephony/java/android/telephony/SubscriptionManager.java b/telephony/java/android/telephony/SubscriptionManager.java
index 47a802f..2908e94 100644
--- a/telephony/java/android/telephony/SubscriptionManager.java
+++ b/telephony/java/android/telephony/SubscriptionManager.java
@@ -2702,6 +2702,10 @@
      * Checks whether the app with the given context is authorized to manage the given subscription
      * according to its metadata.
      *
+     * Only supported for embedded subscriptions (if {@link SubscriptionInfo#isEmbedded} returns
+     * true). To check for permissions for non-embedded subscription as well,
+     * {@see android.telephony.TelephonyManager#hasCarrierPrivileges}.
+     *
      * @param info The subscription to check.
      * @return whether the app is authorized to manage this subscription per its metadata.
      */
@@ -2714,6 +2718,10 @@
      * be authorized if it is included in the {@link android.telephony.UiccAccessRule} of the
      * {@link android.telephony.SubscriptionInfo} with the access status.
      *
+     * Only supported for embedded subscriptions (if {@link SubscriptionInfo#isEmbedded} returns
+     * true). To check for permissions for non-embedded subscription as well,
+     * {@see android.telephony.TelephonyManager#hasCarrierPrivileges}.
+     *
      * @param info The subscription to check.
      * @param packageName Package name of the app to check.
      * @return whether the app is authorized to manage this subscription per its access rules.
diff --git a/telephony/java/android/telephony/TelephonyManager.java b/telephony/java/android/telephony/TelephonyManager.java
index a2467f2..1cfb1d4 100644
--- a/telephony/java/android/telephony/TelephonyManager.java
+++ b/telephony/java/android/telephony/TelephonyManager.java
@@ -8549,6 +8549,9 @@
      * call will return true. This access is granted by the owner of the UICC
      * card and does not depend on the registered carrier.
      *
+     * Note that this API applies to both physical and embedded subscriptions and
+     * is a superset of the checks done in SubscriptionManager#canManageSubscription.
+     *
      * @return true if the app has carrier privileges.
      */
     public boolean hasCarrierPrivileges() {
@@ -8562,6 +8565,9 @@
      * call will return true. This access is granted by the owner of the UICC
      * card and does not depend on the registered carrier.
      *
+     * Note that this API applies to both physical and embedded subscriptions and
+     * is a superset of the checks done in SubscriptionManager#canManageSubscription.
+     *
      * @param subId The subscription to use.
      * @return true if the app has carrier privileges.
      * @hide
diff --git a/telephony/java/android/telephony/ims/SipDelegateImsConfiguration.java b/telephony/java/android/telephony/ims/SipDelegateImsConfiguration.java
index 8762b6a..0d63f7b 100644
--- a/telephony/java/android/telephony/ims/SipDelegateImsConfiguration.java
+++ b/telephony/java/android/telephony/ims/SipDelegateImsConfiguration.java
@@ -501,6 +501,10 @@
      * {@link SipMessage} was using the latest configuration during creation and not a stale
      * configuration due to race conditions between the configuration being updated and the RCS
      * application not receiving the updated configuration before generating a new message.
+     * <p>
+     * The version number should be a positive number that starts at 0 and increments sequentially
+     * as new {@link SipDelegateImsConfiguration} instances are created to update the IMS
+     * configuration state.
      *
      * @return the version number associated with this {@link SipDelegateImsConfiguration}.
      */
diff --git a/tests/net/common/java/ParseExceptionTest.kt b/tests/net/common/java/ParseExceptionTest.kt
new file mode 100644
index 0000000..f17715a
--- /dev/null
+++ b/tests/net/common/java/ParseExceptionTest.kt
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import android.net.ParseException
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.filters.SmallTest
+import junit.framework.Assert.assertEquals
+import junit.framework.Assert.assertNull
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@SmallTest
+@RunWith(AndroidJUnit4::class)
+class ParseExceptionTest {
+    @Test
+    fun testConstructor_WithCause() {
+        val testMessage = "Test message"
+        val base = Exception("Test")
+        val exception = ParseException(testMessage, base)
+
+        assertEquals(testMessage, exception.response)
+        assertEquals(base, exception.cause)
+    }
+
+    @Test
+    fun testConstructor_NoCause() {
+        val testMessage = "Test message"
+        val exception = ParseException(testMessage)
+
+        assertEquals(testMessage, exception.response)
+        assertNull(exception.cause)
+    }
+}
\ No newline at end of file
diff --git a/tests/vcn/java/android/net/vcn/VcnControlPlaneIkeConfigTest.java b/tests/vcn/java/android/net/vcn/VcnControlPlaneIkeConfigTest.java
index 2333718..43b80e4 100644
--- a/tests/vcn/java/android/net/vcn/VcnControlPlaneIkeConfigTest.java
+++ b/tests/vcn/java/android/net/vcn/VcnControlPlaneIkeConfigTest.java
@@ -22,12 +22,7 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.fail;
-import static org.mockito.Mockito.doReturn;
-import static org.mockito.Mockito.mock;
 
-import android.content.Context;
-import android.net.ConnectivityManager;
-import android.net.Network;
 import android.net.ipsec.ike.ChildSaProposal;
 import android.net.ipsec.ike.IkeFqdnIdentification;
 import android.net.ipsec.ike.IkeSaProposal;
@@ -56,20 +51,13 @@
                         .addPseudorandomFunction(PSEUDORANDOM_FUNCTION_AES128_XCBC)
                         .build();
 
-        Context mockContext = mock(Context.class);
-        ConnectivityManager mockConnectManager = mock(ConnectivityManager.class);
-        doReturn(mockConnectManager)
-                .when(mockContext)
-                .getSystemService(Context.CONNECTIVITY_SERVICE);
-        doReturn(mock(Network.class)).when(mockConnectManager).getActiveNetwork();
-
         final String serverHostname = "192.0.2.100";
         final String testLocalId = "test.client.com";
         final String testRemoteId = "test.server.com";
         final byte[] psk = "psk".getBytes();
 
         IKE_PARAMS =
-                new IkeSessionParams.Builder(mockContext)
+                new IkeSessionParams.Builder()
                         .setServerHostname(serverHostname)
                         .addSaProposal(ikeProposal)
                         .setLocalIdentification(new IkeFqdnIdentification(testLocalId))
diff --git a/tests/vcn/java/com/android/server/vcn/VcnGatewayConnectionConnectingStateTest.java b/tests/vcn/java/com/android/server/vcn/VcnGatewayConnectionConnectingStateTest.java
index bfe8c73..acc8bf9 100644
--- a/tests/vcn/java/com/android/server/vcn/VcnGatewayConnectionConnectingStateTest.java
+++ b/tests/vcn/java/com/android/server/vcn/VcnGatewayConnectionConnectingStateTest.java
@@ -58,8 +58,7 @@
                 ArgumentCaptor.forClass(IkeSessionParams.class);
         verify(mDeps).newIkeSession(any(), paramsCaptor.capture(), any(), any(), any());
         assertEquals(
-                TEST_UNDERLYING_NETWORK_RECORD_1.network,
-                paramsCaptor.getValue().getConfiguredNetwork());
+                TEST_UNDERLYING_NETWORK_RECORD_1.network, paramsCaptor.getValue().getNetwork());
     }
 
     @Test