CarrierPrivilegesTracker: support HSUM

This CL supports carrier privileges APIs for secondary users in HSUM. In
specific, the following APIs calls are replaced with the corresponding
*AsUser version with with current user:
- Context.registerReceiver
- PackageManager.getPackageInfo
- PackageManager.getInstalledPackages
- PackageManager.getPackageUid
- PackageManager.queryBroadcastReceivers
- PackageManager.queryIntentActivities
- PackageManager.queryIntentServices
- PackageManager.queryIntentContentProviders

The final effect is as below:
- On non-HSUM (e.g. phone devices), the behaior is unchanged, as Phone
  process runs in system user context which is the current user.
- On HSUM, secondary users (including Main) are able to get info exposed
  to them, as the usage of current user.

Bug: 328251947
Test: atest FrameworksTelephonyTests with feature both on and off
Test: Carrier Apps regression test on both phone (with HSUM/flag off) and
tablet (with HSUM/flag on)
Test: Telephony manual test on functions (Registration, activation,
call, message, data connection...) on both phone and tablet
Flag: com.android.internal.telephony.flags.support_carrier_services_for_hsum
Change-Id: I039d322cbf546460b35993da67022cbaaa26aaa3

Change-Id: Ieaa02ef560134c6335229a0084e948e7c59da9c7
diff --git a/flags/misc.aconfig b/flags/misc.aconfig
index a750331..0ebaeba 100644
--- a/flags/misc.aconfig
+++ b/flags/misc.aconfig
@@ -206,3 +206,14 @@
         purpose: PURPOSE_BUGFIX
     }
 }
+
+# OWNER=rambowang TARGET=25Q2
+flag {
+    name: "support_carrier_services_for_hsum"
+    namespace: "telephony"
+    description: "Support Carrier Services (APIs) for HSUM."
+    bug:"345522246"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}
diff --git a/src/java/com/android/internal/telephony/CarrierPrivilegesTracker.java b/src/java/com/android/internal/telephony/CarrierPrivilegesTracker.java
index 98d0536..522cf77 100644
--- a/src/java/com/android/internal/telephony/CarrierPrivilegesTracker.java
+++ b/src/java/com/android/internal/telephony/CarrierPrivilegesTracker.java
@@ -31,6 +31,7 @@
 import android.annotation.ElapsedRealtimeLong;
 import android.annotation.NonNull;
 import android.annotation.Nullable;
+import android.annotation.SuppressLint;
 import android.app.ActivityManager;
 import android.content.BroadcastReceiver;
 import android.content.Context;
@@ -66,6 +67,7 @@
 import android.util.Pair;
 
 import com.android.internal.annotations.GuardedBy;
+import com.android.internal.telephony.flags.FeatureFlags;
 import com.android.internal.telephony.uicc.IccUtils;
 import com.android.internal.telephony.uicc.UiccPort;
 import com.android.internal.telephony.uicc.UiccProfile;
@@ -93,6 +95,7 @@
  * Registered Telephony entities will receive notifications when the UIDs with these privileges
  * change.
  */
+@SuppressLint("MissingPermission")
 public class CarrierPrivilegesTracker extends Handler {
     private static final String TAG = CarrierPrivilegesTracker.class.getSimpleName();
 
@@ -223,6 +226,9 @@
             "mPrivilegedPackageInfoLock.writeLock()"})
     private boolean mSimIsReadyButNotLoaded = false;
 
+    @NonNull
+    private final FeatureFlags mFeatureFlags;
+
     /** Small snapshot to hold package names and UIDs of privileged packages. */
     private static final class PrivilegedPackageInfo {
         @NonNull final Set<String> mPackageNames;
@@ -316,7 +322,7 @@
                             boolean notExist = false;
                             try {
                                 disabledByUser = action.equals(Intent.ACTION_PACKAGE_CHANGED)
-                                        && mPackageManager.getApplicationEnabledSetting(pkgName)
+                                        && getApplicationEnabledSetting(pkgName)
                                         == PackageManager.COMPONENT_ENABLED_STATE_DISABLED_USER;
                             } catch (IllegalArgumentException iae) {
                                 // Very rare case when package changed race with package removed
@@ -336,10 +342,11 @@
                 }
             };
 
-    public CarrierPrivilegesTracker(
-            @NonNull Looper looper, @NonNull Phone phone, @NonNull Context context) {
+    public CarrierPrivilegesTracker(@NonNull Looper looper, @NonNull Phone phone,
+            @NonNull Context context, @NonNull FeatureFlags flags) {
         super(looper);
         mContext = context;
+        mFeatureFlags = flags;
         mPhone = phone;
         mPackageManager = mContext.getPackageManager();
         mUserManager = (UserManager) mContext.getSystemService(Context.USER_SERVICE);
@@ -359,7 +366,13 @@
         IntentFilter certFilter = new IntentFilter();
         certFilter.addAction(TelephonyManager.ACTION_SIM_CARD_STATE_CHANGED);
         certFilter.addAction(TelephonyManager.ACTION_SIM_APPLICATION_STATE_CHANGED);
-        mContext.registerReceiver(mIntentReceiver, certFilter);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            mContext.registerReceiverAsUser(
+                    mIntentReceiver, UserHandle.of(ActivityManager.getCurrentUser()), certFilter,
+                    /* broadcastPermission= */ null, /* scheduler= */ null);
+        } else {
+            mContext.registerReceiver(mIntentReceiver, certFilter);
+        }
 
         IntentFilter packageFilter = new IntentFilter();
         packageFilter.addAction(Intent.ACTION_PACKAGE_ADDED);
@@ -370,7 +383,13 @@
         // For package-related broadcasts, specify the data scheme for "package" to receive the
         // package name along with the broadcast
         packageFilter.addDataScheme("package");
-        mContext.registerReceiver(mIntentReceiver, packageFilter);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            mContext.registerReceiverAsUser(
+                    mIntentReceiver, UserHandle.of(ActivityManager.getCurrentUser()), packageFilter,
+                    /* broadcastPermission= */ null, /* scheduler= */ null);
+        } else {
+            mContext.registerReceiver(mIntentReceiver, packageFilter);
+        }
 
         sendMessage(obtainMessage(ACTION_INITIALIZE_TRACKER));
     }
@@ -542,7 +561,14 @@
 
         PackageInfo pkg;
         try {
-            pkg = mPackageManager.getPackageInfo(pkgName, INSTALLED_PACKAGES_QUERY_FLAGS);
+            pkg =
+                    mFeatureFlags.supportCarrierServicesForHsum()
+                            ? mPackageManager.getPackageInfoAsUser(
+                                    pkgName,
+                                    INSTALLED_PACKAGES_QUERY_FLAGS,
+                                    ActivityManager.getCurrentUser())
+                            : mPackageManager.getPackageInfo(
+                                    pkgName, INSTALLED_PACKAGES_QUERY_FLAGS);
         } catch (NameNotFoundException e) {
             Rlog.e(TAG, "Error getting installed package: " + pkgName, e);
             return;
@@ -620,7 +646,10 @@
     private void refreshInstalledPackageCache() {
         List<PackageInfo> installedPackages =
                 mPackageManager.getInstalledPackagesAsUser(
-                        INSTALLED_PACKAGES_QUERY_FLAGS, UserHandle.SYSTEM.getIdentifier());
+                        INSTALLED_PACKAGES_QUERY_FLAGS,
+                        mFeatureFlags.supportCarrierServicesForHsum()
+                                ? ActivityManager.getCurrentUser()
+                                : UserHandle.SYSTEM.getIdentifier());
         for (PackageInfo pkg : installedPackages) {
             updateCertsForPackage(pkg);
             // This may be unnecessary before initialization, but invalidate the cache all the time
@@ -794,7 +823,9 @@
     private int getPackageUid(@Nullable String pkgName) {
         int uid = Process.INVALID_UID;
         try {
-            uid = mPackageManager.getPackageUid(pkgName, /* flags= */0);
+            uid = mFeatureFlags.supportCarrierServicesForHsum()
+                    ? mPackageManager.getPackageUidAsUser(pkgName, ActivityManager.getCurrentUser())
+                    : mPackageManager.getPackageUid(pkgName, /* flags= */0);
         } catch (NameNotFoundException e) {
             Rlog.e(TAG, "Unable to find uid for package " + pkgName);
         }
@@ -994,10 +1025,25 @@
         // Do the PackageManager queries before we take the lock, as these are the longest-running
         // pieces of this method and don't depend on the set of carrier apps.
         List<ResolveInfo> resolveInfos = new ArrayList<>();
-        resolveInfos.addAll(mPackageManager.queryBroadcastReceivers(intent, 0));
-        resolveInfos.addAll(mPackageManager.queryIntentActivities(intent, 0));
-        resolveInfos.addAll(mPackageManager.queryIntentServices(intent, 0));
-        resolveInfos.addAll(mPackageManager.queryIntentContentProviders(intent, 0));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            resolveInfos.addAll(
+                    mPackageManager.queryBroadcastReceiversAsUser(
+                            intent, /* flags= */ 0, ActivityManager.getCurrentUser()));
+            resolveInfos.addAll(
+                    mPackageManager.queryIntentActivitiesAsUser(
+                            intent, /* flags= */ 0, ActivityManager.getCurrentUser()));
+            resolveInfos.addAll(
+                    mPackageManager.queryIntentServicesAsUser(
+                            intent, /* flags= */ 0, ActivityManager.getCurrentUser()));
+            resolveInfos.addAll(
+                    mPackageManager.queryIntentContentProvidersAsUser(
+                            intent, /* flags= */ 0, ActivityManager.getCurrentUser()));
+        } else {
+            resolveInfos.addAll(mPackageManager.queryBroadcastReceivers(intent, 0));
+            resolveInfos.addAll(mPackageManager.queryIntentActivities(intent, 0));
+            resolveInfos.addAll(mPackageManager.queryIntentServices(intent, 0));
+            resolveInfos.addAll(mPackageManager.queryIntentContentProviders(intent, 0));
+        }
 
         // Now actually check which of the resolved packages have carrier privileges.
         mPrivilegedPackageInfoLock.readLock().lock();
@@ -1031,8 +1077,15 @@
 
     @NonNull
     private Pair<String, Integer> getCarrierService(@NonNull Set<String> simPrivilegedPackages) {
-        List<ResolveInfo> carrierServiceResolveInfos = mPackageManager.queryIntentServices(
-                new Intent(CarrierService.CARRIER_SERVICE_INTERFACE), /* flags= */ 0);
+        List<ResolveInfo> carrierServiceResolveInfos =
+                mFeatureFlags.supportCarrierServicesForHsum()
+                        ? mPackageManager.queryIntentServicesAsUser(
+                                new Intent(CarrierService.CARRIER_SERVICE_INTERFACE),
+                                /* flags= */ 0,
+                                ActivityManager.getCurrentUser())
+                        : mPackageManager.queryIntentServices(
+                                new Intent(CarrierService.CARRIER_SERVICE_INTERFACE),
+                                /* flags= */ 0);
         String carrierServicePackageName = null;
         for (ResolveInfo resolveInfo : carrierServiceResolveInfos) {
             String packageName = getPackageName(resolveInfo);
@@ -1050,4 +1103,16 @@
                 ? new Pair<>(null, Process.INVALID_UID)
                 : new Pair<>(carrierServicePackageName, getPackageUid(carrierServicePackageName));
     }
+
+    private @PackageManager.EnabledState int getApplicationEnabledSetting(
+            @NonNull String packageName) {
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            return mContext.createContextAsUser(
+                            UserHandle.of(ActivityManager.getCurrentUser()), /* flags= */ 0)
+                    .getPackageManager()
+                    .getApplicationEnabledSetting(packageName);
+        } else {
+            return mPackageManager.getApplicationEnabledSetting(packageName);
+        }
+    }
 }
diff --git a/src/java/com/android/internal/telephony/GsmCdmaPhone.java b/src/java/com/android/internal/telephony/GsmCdmaPhone.java
index 94a0a94..5d59327 100644
--- a/src/java/com/android/internal/telephony/GsmCdmaPhone.java
+++ b/src/java/com/android/internal/telephony/GsmCdmaPhone.java
@@ -391,7 +391,8 @@
 
         mCarrierResolver = mTelephonyComponentFactory.inject(CarrierResolver.class.getName())
                 .makeCarrierResolver(this, featureFlags);
-        mCarrierPrivilegesTracker = new CarrierPrivilegesTracker(Looper.myLooper(), this, context);
+        mCarrierPrivilegesTracker = new CarrierPrivilegesTracker(Looper.myLooper(), this, context,
+                featureFlags);
 
         getCarrierActionAgent().registerForCarrierAction(
                 CarrierActionAgent.CARRIER_ACTION_SET_METERED_APNS_ENABLED, this,
diff --git a/tests/telephonytests/src/com/android/internal/telephony/CarrierPrivilegesTrackerTest.java b/tests/telephonytests/src/com/android/internal/telephony/CarrierPrivilegesTrackerTest.java
index 06b63a2..a860dff 100644
--- a/tests/telephonytests/src/com/android/internal/telephony/CarrierPrivilegesTrackerTest.java
+++ b/tests/telephonytests/src/com/android/internal/telephony/CarrierPrivilegesTrackerTest.java
@@ -52,6 +52,7 @@
 import android.net.Uri;
 import android.os.PersistableBundle;
 import android.os.Process;
+import android.os.UserHandle;
 import android.service.carrier.CarrierService;
 import android.telephony.CarrierConfigManager;
 import android.telephony.TelephonyManager;
@@ -187,9 +188,15 @@
             pkg.packageName = pkgCertInfo.pkgName;
             pkg.signatures = new Signature[] {new Signature(pkgCertInfo.cert)};
 
-            when(mPackageManager.getPackageInfo(
-                    eq(pkgCertInfo.pkgName), eq(PM_FLAGS)))
-                    .thenReturn(pkg);
+            if (mFeatureFlags.supportCarrierServicesForHsum()) {
+                when(mPackageManager.getPackageInfoAsUser(
+                        eq(pkgCertInfo.pkgName), eq(PM_FLAGS), anyInt()))
+                        .thenReturn(pkg);
+            } else {
+                when(mPackageManager.getPackageInfo(
+                        eq(pkgCertInfo.pkgName), eq(PM_FLAGS)))
+                        .thenReturn(pkg);
+            }
             when(mPackageManager.getPackageUidAsUser(
                     eq(pkgCertInfo.pkgName), eq(pkgCertInfo.userInfo.id)))
                     .thenReturn(pkgCertInfo.uid);
@@ -213,8 +220,8 @@
         // Capture CarrierConfigChangeListener to emulate the carrier config change notification
         ArgumentCaptor<CarrierConfigManager.CarrierConfigChangeListener> listenerArgumentCaptor =
                 ArgumentCaptor.forClass(CarrierConfigManager.CarrierConfigChangeListener.class);
-        CarrierPrivilegesTracker cpt =
-                new CarrierPrivilegesTracker(mTestableLooper.getLooper(), mPhone, mContext);
+        CarrierPrivilegesTracker cpt = new CarrierPrivilegesTracker(mTestableLooper.getLooper(),
+                mPhone, mContext, mFeatureFlags);
         verify(mCarrierConfigManager).registerCarrierConfigChangeListener(any(),
                 listenerArgumentCaptor.capture());
         mCarrierConfigChangeListener = listenerArgumentCaptor.getAllValues().get(0);
@@ -579,8 +586,14 @@
 
         ResolveInfo pkg1ResolveInfo = new ResolveInfoBuilder().setActivity(PACKAGE_1).build();
         ResolveInfo pkg2ResolveInfo = new ResolveInfoBuilder().setActivity(PACKAGE_2).build();
-        when(mPackageManager.queryBroadcastReceivers(any(), anyInt())).thenReturn(
-                List.of(pkg1ResolveInfo, pkg2ResolveInfo));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.queryBroadcastReceiversAsUser(any(), anyInt(),
+                    anyInt())).thenReturn(
+                    List.of(pkg1ResolveInfo, pkg2ResolveInfo));
+        } else {
+            when(mPackageManager.queryBroadcastReceivers(any(), anyInt())).thenReturn(
+                    List.of(pkg1ResolveInfo, pkg2ResolveInfo));
+        }
 
         // SIM is READY
         sendSimCardStateChangedIntent(PHONE_ID, SIM_STATE_READY);
@@ -712,8 +725,13 @@
         // Update PACKAGE_1 to have no signatures
         PackageInfo pkg = new PackageInfo();
         pkg.packageName = PACKAGE_1;
-        when(mPackageManager.getPackageInfo(eq(PACKAGE_1), eq(PM_FLAGS)))
-                .thenReturn(pkg);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.getPackageInfoAsUser(eq(PACKAGE_1), eq(PM_FLAGS), anyInt()))
+                    .thenReturn(pkg);
+        } else {
+            when(mPackageManager.getPackageInfo(eq(PACKAGE_1), eq(PM_FLAGS)))
+                    .thenReturn(pkg);
+        }
 
         sendPackageChangedIntent(Intent.ACTION_PACKAGE_ADDED, PACKAGE_1);
         mTestableLooper.processAllMessages();
@@ -784,19 +802,35 @@
         setupInstalledPackages(
                 new PackageCertInfo(PACKAGE_1, CERT_1, USER_1, UID_1),
                 new PackageCertInfo(PACKAGE_2, CERT_2, USER_1, UID_2));
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        } else {
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        }
         ResolveInfo resolveInfoPkg1 = new ResolveInfoBuilder().setService(PACKAGE_1).build();
-        doReturn(List.of(resolveInfoPkg1))
-                .when(mPackageManager)
-                .queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(resolveInfoPkg1))
+                    .when(mPackageManager)
+                    .queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            doReturn(List.of(resolveInfoPkg1))
+                    .when(mPackageManager)
+                    .queryIntentServices(any(), anyInt());
+        }
         mCarrierPrivilegesTracker = createCarrierPrivilegesTracker();
 
         // Package_1 is disabled
         when(mPackageManager.getApplicationEnabledSetting(eq(PACKAGE_1))).thenReturn(
                 PackageManager.COMPONENT_ENABLED_STATE_DISABLED_USER);
-        doReturn(List.of()).when(
-                mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of()).when(
+                    mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            doReturn(List.of()).when(
+                    mPackageManager).queryIntentServices(any(), anyInt());
+        }
         sendPackageChangedIntent(Intent.ACTION_PACKAGE_CHANGED, PACKAGE_1);
         mTestableLooper.processAllMessages();
 
@@ -807,8 +841,13 @@
         // Package_1 is re-enabled
         when(mPackageManager.getApplicationEnabledSetting(eq(PACKAGE_1))).thenReturn(
                 PackageManager.COMPONENT_ENABLED_STATE_ENABLED);
-        doReturn(List.of(resolveInfoPkg1)).when(
-                mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(resolveInfoPkg1)).when(
+                    mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            doReturn(List.of(resolveInfoPkg1)).when(
+                    mPackageManager).queryIntentServices(any(), anyInt());
+        }
         sendPackageChangedIntent(Intent.ACTION_PACKAGE_CHANGED, PACKAGE_1);
         mTestableLooper.processAllMessages();
 
@@ -888,24 +927,45 @@
 
         ResolveInfo privilegeBroadcast = new ResolveInfoBuilder().setActivity(PACKAGE_1).build();
         ResolveInfo noPrivilegeBroadcast = new ResolveInfoBuilder().setActivity(PACKAGE_2).build();
-        when(mPackageManager.queryBroadcastReceivers(any(), anyInt())).thenReturn(
-                List.of(privilegeBroadcast, noPrivilegeBroadcast));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.queryBroadcastReceiversAsUser(any(), anyInt(),
+                    anyInt())).thenReturn(
+                    List.of(privilegeBroadcast, noPrivilegeBroadcast));
+        } else {
+            when(mPackageManager.queryBroadcastReceivers(any(), anyInt())).thenReturn(
+                    List.of(privilegeBroadcast, noPrivilegeBroadcast));
+        }
 
         ResolveInfo privilegeActivity = new ResolveInfoBuilder().setActivity(PACKAGE_3).build();
         ResolveInfo noPrivilegeActivity = new ResolveInfoBuilder().setActivity(PACKAGE_4).build();
-        when(mPackageManager.queryIntentActivities(any(), anyInt())).thenReturn(
-                List.of(privilegeActivity, noPrivilegeActivity));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.queryIntentActivitiesAsUser(any(), anyInt(), anyInt())).thenReturn(
+                    List.of(privilegeActivity, noPrivilegeActivity));
+        } else {
+            when(mPackageManager.queryIntentActivities(any(), anyInt())).thenReturn(
+                    List.of(privilegeActivity, noPrivilegeActivity));
+        }
 
         ResolveInfo privilegeService = new ResolveInfoBuilder().setService(PACKAGE_5).build();
         ResolveInfo noPrivilegeService = new ResolveInfoBuilder().setService(PACKAGE_6).build();
         // Use doReturn instead of when/thenReturn which has NPE with unknown reason
-        doReturn(List.of(privilegeService, noPrivilegeService)).when(
-                mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(privilegeService, noPrivilegeService)).when(
+                    mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            doReturn(List.of(privilegeService, noPrivilegeService)).when(
+                    mPackageManager).queryIntentServices(any(), anyInt());
+        }
 
         ResolveInfo privilegeProvider = new ResolveInfoBuilder().setProvider(PACKAGE_7).build();
         ResolveInfo noPrivilegeProvider = new ResolveInfoBuilder().setProvider(PACKAGE_8).build();
-        when(mPackageManager.queryIntentContentProviders(any(), anyInt())).thenReturn(
-                List.of(privilegeProvider, noPrivilegeProvider));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            when(mPackageManager.queryIntentContentProvidersAsUser(any(), anyInt(), anyInt()))
+                    .thenReturn(List.of(privilegeProvider, noPrivilegeProvider));
+        } else {
+            when(mPackageManager.queryIntentContentProviders(any(), anyInt())).thenReturn(
+                    List.of(privilegeProvider, noPrivilegeProvider));
+        }
 
         mCarrierPrivilegesTracker = createCarrierPrivilegesTracker();
         Intent intent = new Intent(CarrierService.CARRIER_SERVICE_INTERFACE);
@@ -934,11 +994,19 @@
         ResolveInfo privilegeService = new ResolveInfoBuilder().setService(PACKAGE_1).build();
         ResolveInfo noPrivilegeService = new ResolveInfoBuilder().setService(PACKAGE_2).build();
         // Use doReturn instead of when/thenReturn which has NPE with unknown reason
-        doReturn(List.of(privilegeService, noPrivilegeService)).when(
-                mPackageManager).queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(privilegeService, noPrivilegeService)).when(
+                    mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        } else {
+            doReturn(List.of(privilegeService, noPrivilegeService)).when(
+                    mPackageManager).queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        }
 
         // Get CS package name for the first time
         mCarrierPrivilegesTracker = createCarrierPrivilegesTracker();
@@ -947,7 +1015,11 @@
         mTestableLooper.processAllMessages();
 
         // Package manager should be queried from
-        verify(mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            verify(mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            verify(mPackageManager).queryIntentServices(any(), anyInt());
+        }
         assertEquals(PACKAGE_1, carrierServicePackageName);
         assertEquals(UID_1, carrierServiceUid);
 
@@ -958,7 +1030,11 @@
         mTestableLooper.processAllMessages();
 
         // It should return the same result, but didn't query package manager
-        verify(mPackageManager, never()).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            verify(mPackageManager, never()).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            verify(mPackageManager, never()).queryIntentServices(any(), anyInt());
+        }
         assertEquals(PACKAGE_1, carrierServicePackageName);
         assertEquals(UID_1, carrierServiceUid);
     }
@@ -978,12 +1054,21 @@
         ResolveInfo service1 = new ResolveInfoBuilder().setService(PACKAGE_1).build();
         ResolveInfo service2 = new ResolveInfoBuilder().setService(PACKAGE_2).build();
         // Use doReturn instead of when/thenReturn which has NPE with unknown reason
-        doReturn(List.of(service1, service2))
-                .when(mPackageManager)
-                .queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(service1, service2))
+                    .when(mPackageManager)
+                    .queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        } else {
+            doReturn(List.of(service1, service2))
+                    .when(mPackageManager)
+                    .queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        }
 
         // Verify that neither carrier service (no privileges, or carrier-config based privileges)
         // are accepted.
@@ -992,7 +1077,11 @@
         int carrierServiceUid = mCarrierPrivilegesTracker.getCarrierServicePackageUid();
         mTestableLooper.processAllMessages();
 
-        verify(mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            verify(mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            verify(mPackageManager).queryIntentServices(any(), anyInt());
+        }
         assertNull(carrierServicePackageName);
         assertEquals(Process.INVALID_UID, carrierServiceUid);
     }
@@ -1008,11 +1097,19 @@
                 new PackageCertInfo(PACKAGE_3, CERT_1, USER_1, UID_1));
         // No CarrierService declared at all
         // Use doReturn instead of when/thenReturn which has NPE with unknown reason
-        doReturn(List.of()).when(
-                mPackageManager).queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of()).when(
+                    mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        } else {
+            doReturn(List.of()).when(
+                    mPackageManager).queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_3), anyInt())).thenReturn(UID_1);
+        }
 
         mCarrierPrivilegesTracker = createCarrierPrivilegesTracker();
         String carrierServicePackageName = mCarrierPrivilegesTracker.getCarrierServicePackageName();
@@ -1021,7 +1118,11 @@
 
         assertNull(carrierServicePackageName);
         assertEquals(Process.INVALID_UID, carrierServiceUid);
-        verify(mPackageManager).queryIntentServices(any(), anyInt());
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            verify(mPackageManager).queryIntentServicesAsUser(any(), anyInt(), anyInt());
+        } else {
+            verify(mPackageManager).queryIntentServices(any(), anyInt());
+        }
     }
 
     @Test
@@ -1030,10 +1131,17 @@
         setupInstalledPackages(new PackageCertInfo(PACKAGE_1, CERT_1, USER_1, UID_1));
         ResolveInfo carrierService = new ResolveInfoBuilder().setService(PACKAGE_1).build();
 
-        doReturn(List.of(carrierService))
-                .when(mPackageManager)
-                .queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(carrierService))
+                    .when(mPackageManager)
+                    .queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        } else {
+            doReturn(List.of(carrierService))
+                    .when(mPackageManager)
+                    .queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        }
 
         // Set override, and verify the carrier service package was not set due to a lack of a
         // matching cert.
@@ -1056,11 +1164,19 @@
         ResolveInfo service1 = new ResolveInfoBuilder().setService(PACKAGE_1).build();
         ResolveInfo service2 = new ResolveInfoBuilder().setService(PACKAGE_2).build();
 
-        doReturn(List.of(service1, service2))
-                .when(mPackageManager)
-                .queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
-        when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(service1, service2))
+                    .when(mPackageManager)
+                    .queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        } else {
+            doReturn(List.of(service1, service2))
+                    .when(mPackageManager)
+                    .queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+            when(mPackageManager.getPackageUid(eq(PACKAGE_2), anyInt())).thenReturn(UID_2);
+        }
 
         mCarrierPrivilegesTracker = createCarrierPrivilegesTracker();
 
@@ -1093,10 +1209,17 @@
         setupInstalledPackages(new PackageCertInfo(PACKAGE_1, CERT_1, USER_1, UID_1));
         ResolveInfo carrierService = new ResolveInfoBuilder().setService(PACKAGE_1).build();
 
-        doReturn(List.of(carrierService))
-                .when(mPackageManager)
-                .queryIntentServices(any(), anyInt());
-        when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            doReturn(List.of(carrierService))
+                    .when(mPackageManager)
+                    .queryIntentServicesAsUser(any(), anyInt(), anyInt());
+            when(mPackageManager.getPackageUidAsUser(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        } else {
+            doReturn(List.of(carrierService))
+                    .when(mPackageManager)
+                    .queryIntentServices(any(), anyInt());
+            when(mPackageManager.getPackageUid(eq(PACKAGE_1), anyInt())).thenReturn(UID_1);
+        }
 
         // Set override, and expect that an invalid package name would not be selected as the
         // carrier config service.
@@ -1114,21 +1237,40 @@
     }
 
     private void sendSimCardStateChangedIntent(int phoneId, int simState) {
-        mContext.sendBroadcast(
-                new Intent(TelephonyManager.ACTION_SIM_CARD_STATE_CHANGED)
-                        .putExtra(EXTRA_SIM_STATE, simState)
-                        .putExtra(PhoneConstants.PHONE_KEY, phoneId));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            mContext.sendBroadcastAsUser(
+                    new Intent(TelephonyManager.ACTION_SIM_CARD_STATE_CHANGED)
+                            .putExtra(EXTRA_SIM_STATE, simState)
+                            .putExtra(PhoneConstants.PHONE_KEY, phoneId), UserHandle.ALL);
+        } else {
+            mContext.sendBroadcast(
+                    new Intent(TelephonyManager.ACTION_SIM_CARD_STATE_CHANGED)
+                            .putExtra(EXTRA_SIM_STATE, simState)
+                            .putExtra(PhoneConstants.PHONE_KEY, phoneId));
+        }
     }
 
     private void sendSimApplicationStateChangedIntent(int phoneId, int simState) {
-        mContext.sendBroadcast(
-                new Intent(TelephonyManager.ACTION_SIM_APPLICATION_STATE_CHANGED)
-                        .putExtra(EXTRA_SIM_STATE, simState)
-                        .putExtra(PhoneConstants.PHONE_KEY, phoneId));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            mContext.sendBroadcastAsUser(
+                    new Intent(TelephonyManager.ACTION_SIM_APPLICATION_STATE_CHANGED)
+                            .putExtra(EXTRA_SIM_STATE, simState)
+                            .putExtra(PhoneConstants.PHONE_KEY, phoneId), UserHandle.ALL);
+        } else {
+            mContext.sendBroadcast(
+                    new Intent(TelephonyManager.ACTION_SIM_APPLICATION_STATE_CHANGED)
+                            .putExtra(EXTRA_SIM_STATE, simState)
+                            .putExtra(PhoneConstants.PHONE_KEY, phoneId));
+        }
     }
 
     private void sendPackageChangedIntent(String action, String pkgName) {
-        mContext.sendBroadcast(new Intent(action, new Uri.Builder().path(pkgName).build()));
+        if (mFeatureFlags.supportCarrierServicesForHsum()) {
+            mContext.sendBroadcastAsUser(
+                    new Intent(action, new Uri.Builder().path(pkgName).build()), UserHandle.ALL);
+        } else {
+            mContext.sendBroadcast(new Intent(action, new Uri.Builder().path(pkgName).build()));
+        }
     }
 
     /** Returns the SHA-1 hash (as a hex String) for the given hex String. */