Merge "Fixed animation on QSCustomizer ripple"
diff --git a/Android.bp b/Android.bp
index 27b59bc..970d66b 100644
--- a/Android.bp
+++ b/Android.bp
@@ -792,9 +792,10 @@
     name: "platformprotos",
     srcs: [
         "cmds/am/proto/instrumentation_data.proto",
+        "cmds/statsd/src/**/*.proto",
         "core/proto/**/*.proto",
         "libs/incident/proto/**/*.proto",
-        "cmds/statsd/src/**/*.proto",
+        "proto/src/stats_enums.proto",
     ],
     proto: {
         include_dirs: ["external/protobuf/src"],
@@ -832,6 +833,7 @@
     srcs: [
         "core/proto/**/*.proto",
         "libs/incident/proto/android/os/**/*.proto",
+        "proto/src/stats_enums.proto",
     ],
     // Protos have lots of MissingOverride and similar.
     errorprone: {
@@ -857,6 +859,7 @@
     srcs: [
         "core/proto/**/*.proto",
         "libs/incident/**/*.proto",
+        "proto/src/stats_enums.proto",
     ],
 
     target: {
diff --git a/api/current.txt b/api/current.txt
old mode 100644
new mode 100755
index ad7d31d..f750e33
--- a/api/current.txt
+++ b/api/current.txt
@@ -41867,6 +41867,9 @@
     field public static final java.lang.String KEY_ALWAYS_SHOW_EMERGENCY_ALERT_ONOFF_BOOL = "always_show_emergency_alert_onoff_bool";
     field public static final java.lang.String KEY_APN_EXPAND_BOOL = "apn_expand_bool";
     field public static final java.lang.String KEY_AUTO_RETRY_ENABLED_BOOL = "auto_retry_enabled_bool";
+    field public static final java.lang.String KEY_CALL_BARRING_SUPPORTS_DEACTIVATE_ALL_BOOL = "call_barring_supports_deactivate_all_bool";
+    field public static final java.lang.String KEY_CALL_BARRING_SUPPORTS_PASSWORD_CHANGE_BOOL = "call_barring_supports_password_change_bool";
+    field public static final java.lang.String KEY_CALL_BARRING_VISIBILITY_BOOL = "call_barring_visibility_bool";
     field public static final java.lang.String KEY_CALL_FORWARDING_BLOCKS_WHILE_ROAMING_STRING_ARRAY = "call_forwarding_blocks_while_roaming_string_array";
     field public static final java.lang.String KEY_CARRIER_ALLOW_TURNOFF_IMS_BOOL = "carrier_allow_turnoff_ims_bool";
     field public static final java.lang.String KEY_CARRIER_DATA_CALL_PERMANENT_FAILURE_STRINGS = "carrier_data_call_permanent_failure_strings";
@@ -44486,6 +44489,11 @@
     method public abstract void chooseHeight(java.lang.CharSequence, int, int, int, int, android.graphics.Paint.FontMetricsInt);
   }
 
+  public static class LineHeightSpan.Standard implements android.text.style.LineHeightSpan {
+    ctor public LineHeightSpan.Standard(int);
+    method public void chooseHeight(java.lang.CharSequence, int, int, int, int, android.graphics.Paint.FontMetricsInt);
+  }
+
   public static abstract interface LineHeightSpan.WithDensity implements android.text.style.LineHeightSpan {
     method public abstract void chooseHeight(java.lang.CharSequence, int, int, int, int, android.graphics.Paint.FontMetricsInt, android.text.TextPaint);
   }
@@ -45429,6 +45437,7 @@
     field public static final int DENSITY_420 = 420; // 0x1a4
     field public static final int DENSITY_440 = 440; // 0x1b8
     field public static final int DENSITY_560 = 560; // 0x230
+    field public static final int DENSITY_600 = 600; // 0x258
     field public static final int DENSITY_DEFAULT = 160; // 0xa0
     field public static final int DENSITY_DEVICE_STABLE;
     field public static final int DENSITY_HIGH = 240; // 0xf0
diff --git a/cmds/statsd/src/atoms.proto b/cmds/statsd/src/atoms.proto
index 6065bbf..3c9f7ee 100644
--- a/cmds/statsd/src/atoms.proto
+++ b/cmds/statsd/src/atoms.proto
@@ -29,6 +29,7 @@
 import "frameworks/base/core/proto/android/telecomm/enums.proto";
 import "frameworks/base/core/proto/android/telephony/enums.proto";
 import "frameworks/base/core/proto/android/view/enums.proto";
+import "frameworks/base/proto/src/stats_enums.proto";
 
 /**
  * The master atom class. This message defines all of the available
@@ -128,6 +129,7 @@
         LowMemReported low_mem_reported = 81;
         GenericAtom generic_atom = 82;
         KeyValuePairsAtom key_value_pairs_atom = 83;
+        VibratorStateChanged vibrator_state_changed = 84;
     }
 
     // Pulled events will start at field 10000.
@@ -1410,6 +1412,25 @@
     optional ForegroundState foreground_state = 6;
 }
 
+/**
+ * Logs when the vibrator state changes.
+ * Logged from:
+ *      frameworks/base/services/core/java/com/android/server/VibratorService.java
+ */
+message VibratorStateChanged {
+    repeated AttributionNode attribution_node = 1;
+
+    enum State {
+        OFF = 0;
+        ON = 1;
+    }
+    optional State state = 2;
+
+    // Duration (in milliseconds) requested to keep the vibrator on.
+    // Only applicable for State == ON.
+    optional int64 duration_millis = 3;
+}
+
 /*
  * Allows other apps to push events into statsd.
  * Logged from:
@@ -1750,7 +1771,7 @@
     optional int32 uid = 1 [(is_uid) = true];
 
     // An event_id indicates the type of event.
-    optional int32 event_id = 2;
+    optional android.os.statsd.EventType event_id = 2;
 }
 
 //////////////////////////////////////////////////////////////////////
diff --git a/core/java/android/app/IBackupAgent.aidl b/core/java/android/app/IBackupAgent.aidl
index 4517446..d3d7c68 100644
--- a/core/java/android/app/IBackupAgent.aidl
+++ b/core/java/android/app/IBackupAgent.aidl
@@ -48,8 +48,7 @@
      *        be echoed back to the backup service binder once the new
      *        data has been written to the data and newState files.
      *
-     * @param callbackBinder Binder on which to indicate operation completion,
-     *        passed here as a convenience to the agent.
+     * @param callbackBinder Binder on which to indicate operation completion.
      *
      * @param transportFlags Flags with additional information about the transport.
      */
@@ -133,8 +132,9 @@
      *                        Could be less than total backup size if backup process was interrupted
      *                        before finish of processing all backup data.
      * @param quotaBytes Current amount of backup data that is allowed for the app.
+     * @param callbackBinder Binder on which to indicate operation completion.
      */
-    void doQuotaExceeded(long backupDataBytes, long quotaBytes);
+    void doQuotaExceeded(long backupDataBytes, long quotaBytes, IBackupCallback callbackBinder);
 
     /**
      * Restore a single "file" to the application.  The file was typically obtained from
diff --git a/core/java/android/app/backup/BackupAgent.java b/core/java/android/app/backup/BackupAgent.java
index 097dd9c..df27d58 100644
--- a/core/java/android/app/backup/BackupAgent.java
+++ b/core/java/android/app/backup/BackupAgent.java
@@ -126,6 +126,11 @@
     private static final boolean DEBUG = false;
 
     /** @hide */
+    public static final int RESULT_SUCCESS = 0;
+    /** @hide */
+    public static final int RESULT_ERROR = -1;
+
+    /** @hide */
     public static final int TYPE_EOF = 0;
 
     /**
@@ -955,8 +960,10 @@
             BackupDataOutput output = new BackupDataOutput(
                     data.getFileDescriptor(), quotaBytes, transportFlags);
 
+            long result = RESULT_ERROR;
             try {
                 BackupAgent.this.onBackup(oldState, output, newState);
+                result = RESULT_SUCCESS;
             } catch (IOException ex) {
                 Log.d(TAG, "onBackup (" + BackupAgent.this.getClass().getName() + ") threw", ex);
                 throw new RuntimeException(ex);
@@ -971,9 +978,9 @@
 
                 Binder.restoreCallingIdentity(ident);
                 try {
-                    callbackBinder.operationComplete(0);
+                    callbackBinder.operationComplete(result);
                 } catch (RemoteException e) {
-                    // we'll time out anyway, so we're safe
+                    // We will time out anyway.
                 }
 
                 // Don't close the fd out from under the system service if this was local
@@ -1155,10 +1162,16 @@
         }
 
         @Override
-        public void doQuotaExceeded(long backupDataBytes, long quotaBytes) {
+        public void doQuotaExceeded(
+                long backupDataBytes,
+                long quotaBytes,
+                IBackupCallback callbackBinder) {
             long ident = Binder.clearCallingIdentity();
+
+            long result = RESULT_ERROR;
             try {
                 BackupAgent.this.onQuotaExceeded(backupDataBytes, quotaBytes);
+                result = RESULT_SUCCESS;
             } catch (Exception e) {
                 Log.d(TAG, "onQuotaExceeded(" + BackupAgent.this.getClass().getName() + ") threw",
                         e);
@@ -1166,6 +1179,12 @@
             } finally {
                 waitForSharedPrefs();
                 Binder.restoreCallingIdentity(ident);
+
+                try {
+                    callbackBinder.operationComplete(result);
+                } catch (RemoteException e) {
+                    // We will time out anyway.
+                }
             }
         }
     }
diff --git a/core/java/android/hardware/biometrics/BiometricAuthenticator.java b/core/java/android/hardware/biometrics/BiometricAuthenticator.java
index 59195dc..dbb2527 100644
--- a/core/java/android/hardware/biometrics/BiometricAuthenticator.java
+++ b/core/java/android/hardware/biometrics/BiometricAuthenticator.java
@@ -30,6 +30,21 @@
 public interface BiometricAuthenticator {
 
     /**
+     * @hide
+     */
+    int TYPE_FINGERPRINT = 1;
+
+    /**
+     * @hide
+     */
+    int TYPE_IRIS = 2;
+
+    /**
+     * @hide
+     */
+    int TYPE_FACE = 3;
+
+    /**
      * Container for biometric data
      * @hide
      */
@@ -196,6 +211,22 @@
     }
 
     /**
+     * @param acquireInfo
+     * @param vendorCode
+     * @return the help string associated with this code
+     */
+    default String getAcquiredString(int acquireInfo, int vendorCode) {
+        throw new UnsupportedOperationException("Stub!");
+    }
+
+    /**
+     * @return one of {@link #TYPE_FINGERPRINT} {@link #TYPE_IRIS} or {@link #TYPE_FACE}
+     */
+    default int getType() {
+        throw new UnsupportedOperationException("Stub!");
+    }
+
+    /**
      * This call warms up the hardware and starts scanning for valid biometrics. It terminates
      * when {@link AuthenticationCallback#onAuthenticationError(int,
      * CharSequence)} is called or when {@link AuthenticationCallback#onAuthenticationSucceeded(
diff --git a/core/java/android/hardware/face/FaceManager.java b/core/java/android/hardware/face/FaceManager.java
index b3b962f..0f83c8b 100644
--- a/core/java/android/hardware/face/FaceManager.java
+++ b/core/java/android/hardware/face/FaceManager.java
@@ -552,6 +552,7 @@
     /**
      * @hide
      */
+    @Override
     public String getAcquiredString(int acquireInfo, int vendorCode) {
         switch (acquireInfo) {
             case FACE_ACQUIRED_GOOD:
@@ -591,6 +592,14 @@
     }
 
     /**
+     * @hide
+     */
+    @Override
+    public int getType() {
+        return TYPE_FACE;
+    }
+
+    /**
      * Used so BiometricPrompt can map the face ones onto existing public constants.
      * @hide
      */
diff --git a/core/java/android/hardware/fingerprint/FingerprintManager.java b/core/java/android/hardware/fingerprint/FingerprintManager.java
index 44b8faf..b380a2e 100644
--- a/core/java/android/hardware/fingerprint/FingerprintManager.java
+++ b/core/java/android/hardware/fingerprint/FingerprintManager.java
@@ -979,6 +979,7 @@
     /**
      * @hide
      */
+    @Override
     public String getAcquiredString(int acquireInfo, int vendorCode) {
         switch (acquireInfo) {
             case FINGERPRINT_ACQUIRED_GOOD:
@@ -1010,6 +1011,14 @@
         return null;
     }
 
+    /**
+     * @hide
+     */
+    @Override
+    public int getType() {
+        return TYPE_FINGERPRINT;
+    }
+
     private IFingerprintServiceReceiver mServiceReceiver = new IFingerprintServiceReceiver.Stub() {
 
         @Override // binder call
diff --git a/core/java/android/service/wallpaper/WallpaperService.java b/core/java/android/service/wallpaper/WallpaperService.java
index 2846730..febdb83 100644
--- a/core/java/android/service/wallpaper/WallpaperService.java
+++ b/core/java/android/service/wallpaper/WallpaperService.java
@@ -45,6 +45,7 @@
 import android.util.MergedConfiguration;
 import android.view.Display;
 import android.view.DisplayCutout;
+import android.view.DisplayInfo;
 import android.view.Gravity;
 import android.view.IWindowSession;
 import android.view.InputChannel;
@@ -163,7 +164,8 @@
         int mType;
         int mCurWidth;
         int mCurHeight;
-        int mWindowFlags = WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE;
+        int mWindowFlags = WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE
+                         | WindowManager.LayoutParams.FLAG_SCALED;
         int mWindowPrivateFlags =
                 WindowManager.LayoutParams.PRIVATE_FLAG_WANTS_OFFSET_NOTIFICATIONS;
         int mCurWindowFlags = mWindowFlags;
@@ -763,9 +765,19 @@
 
                     mLayout.x = 0;
                     mLayout.y = 0;
-                    mLayout.width = myWidth;
-                    mLayout.height = myHeight;
-                    
+
+                    if (!fixedSize) {
+                        mLayout.width = myWidth;
+                        mLayout.height = myHeight;
+                    } else {
+                        // Force the wallpaper to cover the screen in both dimensions
+                        // only internal implementations like ImageWallpaper
+                        DisplayInfo displayInfo = new DisplayInfo();
+                        mDisplay.getDisplayInfo(displayInfo);
+                        mLayout.width = Math.max(displayInfo.logicalWidth, myWidth);
+                        mLayout.height = Math.max(displayInfo.logicalHeight, myHeight);
+                    }
+
                     mLayout.format = mFormat;
                     
                     mCurWindowFlags = mWindowFlags;
@@ -773,7 +785,8 @@
                             | WindowManager.LayoutParams.FLAG_LAYOUT_NO_LIMITS
                             | WindowManager.LayoutParams.FLAG_LAYOUT_INSET_DECOR
                             | WindowManager.LayoutParams.FLAG_LAYOUT_IN_SCREEN
-                            | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+                            | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE
+                            | WindowManager.LayoutParams.FLAG_SCALED;
                     mCurWindowPrivateFlags = mWindowPrivateFlags;
                     mLayout.privateFlags = mWindowPrivateFlags;
 
@@ -847,6 +860,9 @@
                         mStableInsets.bottom += padding.bottom;
                         mDisplayCutout.set(mDisplayCutout.get().inset(-padding.left, -padding.top,
                                 -padding.right, -padding.bottom));
+                    } else {
+                        w = myWidth;
+                        h = myHeight;
                     }
 
                     if (mCurWidth != w) {
diff --git a/core/java/android/text/style/LineHeightSpan.java b/core/java/android/text/style/LineHeightSpan.java
index 50ee5f3..2742ae0 100644
--- a/core/java/android/text/style/LineHeightSpan.java
+++ b/core/java/android/text/style/LineHeightSpan.java
@@ -16,11 +16,16 @@
 
 package android.text.style;
 
+import android.annotation.IntRange;
+import android.annotation.NonNull;
+import android.annotation.Px;
 import android.graphics.Paint;
 import android.text.TextPaint;
 
+import com.android.internal.util.Preconditions;
+
 /**
- * The classes that affect the height of the line should implement this interface.
+ * The classes that affect the line height of paragraph should implement this interface.
  */
 public interface LineHeightSpan extends ParagraphStyle, WrapTogetherSpan {
     /**
@@ -38,8 +43,8 @@
             Paint.FontMetricsInt fm);
 
     /**
-     * The classes that affect the height of the line with respect to density, should implement this
-     * interface.
+     * The classes that affect the line height of paragraph with respect to density,
+     * should implement this interface.
      */
     public interface WithDensity extends LineHeightSpan {
 
@@ -57,4 +62,38 @@
                 int spanstartv, int lineHeight,
                 Paint.FontMetricsInt fm, TextPaint paint);
     }
+
+    /**
+     * Default implementation of the {@link LineHeightSpan}, which changes the line height of the
+     * attached paragraph.
+     * <p>
+     * LineHeightSpan will change the line height of the entire paragraph, even though it
+     * covers only part of the paragraph.
+     * </p>
+     */
+    class Standard implements LineHeightSpan {
+
+        private final @Px int mHeight;
+        /**
+         * Set the line height of the paragraph to <code>height</code> physical pixels.
+         */
+        public Standard(@Px @IntRange(from = 1) int height) {
+            Preconditions.checkArgument(height > 0, "Height:" + height + "must be positive");
+            mHeight = height;
+        }
+
+        @Override
+        public void chooseHeight(@NonNull CharSequence text, int start, int end,
+                int spanstartv, int lineHeight,
+                @NonNull Paint.FontMetricsInt fm) {
+            final int originHeight = fm.descent - fm.ascent;
+            // If original height is not positive, do nothing.
+            if (originHeight <= 0) {
+                return;
+            }
+            final float ratio = mHeight * 1.0f / originHeight;
+            fm.descent = Math.round(fm.descent * ratio);
+            fm.ascent = fm.descent - mHeight;
+        }
+    }
 }
diff --git a/core/java/android/util/DisplayMetrics.java b/core/java/android/util/DisplayMetrics.java
old mode 100644
new mode 100755
index b092fcf..f2747cf
--- a/core/java/android/util/DisplayMetrics.java
+++ b/core/java/android/util/DisplayMetrics.java
@@ -142,6 +142,14 @@
     public static final int DENSITY_560 = 560;
 
     /**
+     * Intermediate density for screens that sit somewhere between
+     * {@link #DENSITY_XXHIGH} (480 dpi) and {@link #DENSITY_XXXHIGH} (640 dpi).
+     * This is not a density that applications should target, instead relying
+     * on the system to scale their {@link #DENSITY_XXXHIGH} assets for them.
+     */
+    public static final int DENSITY_600 = 600;
+
+    /**
      * Standard quantized DPI for extra-extra-extra-high-density screens.  Applications
      * should not generally worry about this density; relying on XHIGH graphics
      * being scaled up to it should be sufficient for almost all cases.  A typical
diff --git a/core/java/android/widget/Magnifier.java b/core/java/android/widget/Magnifier.java
index 3280d47..8e2786d 100644
--- a/core/java/android/widget/Magnifier.java
+++ b/core/java/android/widget/Magnifier.java
@@ -215,11 +215,11 @@
             final Point windowCoords = getCurrentClampedWindowCoordinates();
             final InternalPopupWindow currentWindowInstance = mWindow;
             sPixelCopyHandlerThread.getThreadHandler().post(() -> {
-                if (mWindow != currentWindowInstance) {
-                    // The magnifier was dismissed (and maybe shown again) in the meantime.
-                    return;
-                }
                 synchronized (mLock) {
+                    if (mWindow != currentWindowInstance) {
+                        // The magnifier was dismissed (and maybe shown again) in the meantime.
+                        return;
+                    }
                     mWindow.setContentPositionForNextDraw(windowCoords.x, windowCoords.y);
                 }
             });
diff --git a/core/java/com/android/internal/statusbar/IStatusBar.aidl b/core/java/com/android/internal/statusbar/IStatusBar.aidl
index 616520f..c4214cf 100644
--- a/core/java/com/android/internal/statusbar/IStatusBar.aidl
+++ b/core/java/com/android/internal/statusbar/IStatusBar.aidl
@@ -141,7 +141,7 @@
     void showShutdownUi(boolean isReboot, String reason);
 
     // Used to show the dialog when BiometricService starts authentication
-    void showBiometricDialog(in Bundle bundle, IBiometricPromptReceiver receiver);
+    void showBiometricDialog(in Bundle bundle, IBiometricPromptReceiver receiver, int type);
     // Used to hide the dialog when a biometric is authenticated
     void onBiometricAuthenticated();
     // Used to set a temporary message, e.g. fingerprint not recognized, finger moved too fast, etc
diff --git a/core/java/com/android/internal/statusbar/IStatusBarService.aidl b/core/java/com/android/internal/statusbar/IStatusBarService.aidl
index b3af147..e48e733 100644
--- a/core/java/com/android/internal/statusbar/IStatusBarService.aidl
+++ b/core/java/com/android/internal/statusbar/IStatusBarService.aidl
@@ -91,7 +91,7 @@
     void showPinningEscapeToast();
 
     // Used to show the dialog when BiometricService starts authentication
-    void showBiometricDialog(in Bundle bundle, IBiometricPromptReceiver receiver);
+    void showBiometricDialog(in Bundle bundle, IBiometricPromptReceiver receiver, int type);
     // Used to hide the dialog when a biometric is authenticated
     void onBiometricAuthenticated();
     // Used to set a temporary message, e.g. fingerprint not recognized, finger moved too fast, etc
diff --git a/core/res/res/values/strings.xml b/core/res/res/values/strings.xml
index e3b90526..d733207 100644
--- a/core/res/res/values/strings.xml
+++ b/core/res/res/values/strings.xml
@@ -1414,8 +1414,8 @@
     <string-array name="fingerprint_acquired_vendor">
     </string-array>
 
-    <!-- Message shown by the fingerprint dialog when fingerprint is not recognized -->
-    <string name="fingerprint_not_recognized">Not recognized</string>
+    <!-- Message shown by the biometric dialog when biometric is not recognized -->
+    <string name="biometric_not_recognized">Not recognized</string>
     <!-- Accessibility message announced when a fingerprint has been authenticated [CHAR LIMIT=NONE] -->
     <string name="fingerprint_authenticated">Fingerprint authenticated</string>
 
diff --git a/core/res/res/values/symbols.xml b/core/res/res/values/symbols.xml
index b82f9e5..e209985 100644
--- a/core/res/res/values/symbols.xml
+++ b/core/res/res/values/symbols.xml
@@ -2394,6 +2394,7 @@
 
   <!-- Biometric messages -->
   <java-symbol type="string" name="biometric_error_hw_unavailable" />
+  <java-symbol type="string" name="biometric_not_recognized" />
 
   <!-- Fingerprint messages -->
   <java-symbol type="string" name="fingerprint_error_unable_to_process" />
@@ -2412,7 +2413,6 @@
   <java-symbol type="string" name="fingerprint_error_lockout" />
   <java-symbol type="string" name="fingerprint_error_lockout_permanent" />
   <java-symbol type="string" name="fingerprint_name_template" />
-  <java-symbol type="string" name="fingerprint_not_recognized" />
   <java-symbol type="string" name="fingerprint_authenticated" />
   <java-symbol type="string" name="fingerprint_error_no_fingerprints" />
   <java-symbol type="string" name="fingerprint_error_hw_not_present" />
diff --git a/libs/hwui/Android.bp b/libs/hwui/Android.bp
index d582983..edce305 100644
--- a/libs/hwui/Android.bp
+++ b/libs/hwui/Android.bp
@@ -72,6 +72,7 @@
         "libft2",
         "libminikin",
         "libandroidfw",
+        "libcrypto",
     ],
     static_libs: [
         "libEGL_blobCache",
diff --git a/libs/hwui/pipeline/skia/ShaderCache.cpp b/libs/hwui/pipeline/skia/ShaderCache.cpp
index 6700748..073b481 100644
--- a/libs/hwui/pipeline/skia/ShaderCache.cpp
+++ b/libs/hwui/pipeline/skia/ShaderCache.cpp
@@ -18,6 +18,8 @@
 #include <algorithm>
 #include <log/log.h>
 #include <thread>
+#include <array>
+#include <openssl/sha.h>
 #include "FileBlobCache.h"
 #include "Properties.h"
 #include "utils/TraceUtils.h"
@@ -41,7 +43,40 @@
     return sCache;
 }
 
-void ShaderCache::initShaderDiskCache() {
+bool ShaderCache::validateCache(const void* identity, ssize_t size) {
+    if (nullptr == identity && size == 0)
+        return true;
+
+    if (nullptr == identity || size < 0) {
+        if (CC_UNLIKELY(Properties::debugLevel & kDebugCaches)) {
+            ALOGW("ShaderCache::validateCache invalid cache identity");
+        }
+        mBlobCache->clear();
+        return false;
+    }
+
+    SHA256_CTX ctx;
+    SHA256_Init(&ctx);
+
+    SHA256_Update(&ctx, identity, size);
+    mIDHash.resize(SHA256_DIGEST_LENGTH);
+    SHA256_Final(mIDHash.data(), &ctx);
+
+    std::array<uint8_t, SHA256_DIGEST_LENGTH> hash;
+    auto key = sIDKey;
+    auto loaded = mBlobCache->get(&key, sizeof(key), hash.data(), hash.size());
+
+    if (loaded && std::equal(hash.begin(), hash.end(), mIDHash.begin()))
+        return true;
+
+    if (CC_UNLIKELY(Properties::debugLevel & kDebugCaches)) {
+        ALOGW("ShaderCache::validateCache cache validation fails");
+    }
+    mBlobCache->clear();
+    return false;
+}
+
+void ShaderCache::initShaderDiskCache(const void* identity, ssize_t size) {
     ATRACE_NAME("initShaderDiskCache");
     std::lock_guard<std::mutex> lock(mMutex);
 
@@ -50,6 +85,7 @@
     // desktop / laptop GPUs. Thus, disable the shader disk cache for emulator builds.
     if (!Properties::runningInEmulator && mFilename.length() > 0) {
         mBlobCache.reset(new FileBlobCache(maxKeySize, maxValueSize, maxTotalSize, mFilename));
+        validateCache(identity, size);
         mInitialized = true;
     }
 }
@@ -104,6 +140,18 @@
     return SkData::MakeFromMalloc(valueBuffer, valueSize);
 }
 
+void ShaderCache::saveToDiskLocked() {
+    ATRACE_NAME("ShaderCache::saveToDiskLocked");
+    if (mInitialized && mBlobCache && mSavePending) {
+        if (mIDHash.size()) {
+            auto key = sIDKey;
+            mBlobCache->set(&key, sizeof(key), mIDHash.data(), mIDHash.size());
+        }
+        mBlobCache->writeToFile();
+    }
+    mSavePending = false;
+}
+
 void ShaderCache::store(const SkData& key, const SkData& data) {
     ATRACE_NAME("ShaderCache::store");
     std::lock_guard<std::mutex> lock(mMutex);
@@ -129,11 +177,7 @@
         std::thread deferredSaveThread([this]() {
             sleep(mDeferredSaveDelay);
             std::lock_guard<std::mutex> lock(mMutex);
-            ATRACE_NAME("ShaderCache::saveToDisk");
-            if (mInitialized && mBlobCache) {
-                mBlobCache->writeToFile();
-            }
-            mSavePending = false;
+            saveToDiskLocked();
         });
         deferredSaveThread.detach();
     }
diff --git a/libs/hwui/pipeline/skia/ShaderCache.h b/libs/hwui/pipeline/skia/ShaderCache.h
index 27473d6..82804cf 100644
--- a/libs/hwui/pipeline/skia/ShaderCache.h
+++ b/libs/hwui/pipeline/skia/ShaderCache.h
@@ -40,12 +40,21 @@
     ANDROID_API static ShaderCache& get();
 
     /**
-     * "initShaderDiskCache" loads the serialized cache contents from disk and puts the ShaderCache
-     * into an initialized state, such that it is able to insert and retrieve entries from the
-     * cache.  This should be called when HWUI pipeline is initialized.  When not in the initialized
-     * state the load and store methods will return without performing any cache operations.
+     * initShaderDiskCache" loads the serialized cache contents from disk,
+     * optionally checks that the on-disk cache matches a provided identity,
+     * and puts the ShaderCache into an initialized state, such that it is
+     * able to insert and retrieve entries from the cache. If identity is
+     * non-null and validation fails, the cache is initialized but contains
+     * no data. If size is less than zero, the cache is initilaized but
+     * contains no data.
+     *
+     * This should be called when HWUI pipeline is initialized. When not in
+     * the initialized state the load and store methods will return without
+     * performing any cache operations.
      */
-    virtual void initShaderDiskCache();
+    virtual void initShaderDiskCache(const void *identity, ssize_t size);
+
+    virtual void initShaderDiskCache() { initShaderDiskCache(nullptr, 0); }
 
     /**
      * "setFilename" sets the name of the file that should be used to store
@@ -83,6 +92,19 @@
     BlobCache* getBlobCacheLocked();
 
     /**
+     * "validateCache" updates the cache to match the given identity.  If the
+     * cache currently has the wrong identity, all entries in the cache are cleared.
+     */
+    bool validateCache(const void* identity, ssize_t size);
+
+    /**
+     * "saveToDiskLocked" attemps to save the current contents of the cache to
+     * disk. If the identity hash exists, we will insert the identity hash into
+     * the cache for next validation.
+     */
+    void saveToDiskLocked();
+
+    /**
      * "mInitialized" indicates whether the ShaderCache is in the initialized
      * state.  It is initialized to false at construction time, and gets set to
      * true when initialize is called.
@@ -111,6 +133,15 @@
     std::string mFilename;
 
     /**
+     * "mIDHash" is the current identity hash for the cache validation. It is
+     * initialized to an empty vector at construction time, and its content is
+     * generated in the call of the validateCache method. An empty vector
+     * indicates that cache validation is not performed, and the hash should
+     * not be stored on disk.
+     */
+    std::vector<uint8_t> mIDHash;
+
+    /**
      * "mSavePending" indicates whether or not a deferred save operation is
      * pending.  Each time a key/value pair is inserted into the cache via
      * load, a deferred save is initiated if one is not already pending.
@@ -140,6 +171,11 @@
      */
     static ShaderCache sCache;
 
+    /**
+     * "sIDKey" is the cache key of the identity hash
+     */
+    static constexpr uint8_t sIDKey = 0;
+
     friend class ShaderCacheTestUtils; //used for unit testing
 };
 
diff --git a/libs/hwui/renderthread/CacheManager.cpp b/libs/hwui/renderthread/CacheManager.cpp
index bec80b1e..82bfc49 100644
--- a/libs/hwui/renderthread/CacheManager.cpp
+++ b/libs/hwui/renderthread/CacheManager.cpp
@@ -50,7 +50,6 @@
     mVectorDrawableAtlas = new skiapipeline::VectorDrawableAtlas(
             mMaxSurfaceArea / 2,
             skiapipeline::VectorDrawableAtlas::StorageMode::disallowSharedSurface);
-    skiapipeline::ShaderCache::get().initShaderDiskCache();
 }
 
 void CacheManager::reset(sk_sp<GrContext> context) {
@@ -103,7 +102,7 @@
     }
 };
 
-void CacheManager::configureContext(GrContextOptions* contextOptions) {
+void CacheManager::configureContext(GrContextOptions* contextOptions, const void* identity, ssize_t size) {
     contextOptions->fAllowPathMaskCaching = true;
 
     float screenMP = mMaxSurfaceArea / 1024.0f / 1024.0f;
@@ -133,7 +132,9 @@
         contextOptions->fExecutor = mTaskProcessor.get();
     }
 
-    contextOptions->fPersistentCache = &skiapipeline::ShaderCache::get();
+    auto& cache = skiapipeline::ShaderCache::get();
+    cache.initShaderDiskCache(identity, size);
+    contextOptions->fPersistentCache = &cache;
     contextOptions->fGpuPathRenderers &= ~GpuPathRenderers::kCoverageCounting;
 }
 
diff --git a/libs/hwui/renderthread/CacheManager.h b/libs/hwui/renderthread/CacheManager.h
index 7d73352..35fc91a 100644
--- a/libs/hwui/renderthread/CacheManager.h
+++ b/libs/hwui/renderthread/CacheManager.h
@@ -44,7 +44,7 @@
 public:
     enum class TrimMemoryMode { Complete, UiHidden };
 
-    void configureContext(GrContextOptions* context);
+    void configureContext(GrContextOptions* context, const void* identity, ssize_t size);
     void trimMemory(TrimMemoryMode mode);
     void trimStaleResources();
     void dumpMemoryUsage(String8& log, const RenderState* renderState = nullptr);
diff --git a/libs/hwui/renderthread/RenderThread.cpp b/libs/hwui/renderthread/RenderThread.cpp
index c1284ec..36ffaee 100644
--- a/libs/hwui/renderthread/RenderThread.cpp
+++ b/libs/hwui/renderthread/RenderThread.cpp
@@ -191,7 +191,9 @@
     GrContextOptions options;
     options.fPreferExternalImagesOverES3 = true;
     options.fDisableDistanceFieldPaths = true;
-    cacheManager().configureContext(&options);
+    auto glesVersion = reinterpret_cast<const char*>(glGetString(GL_VERSION));
+    auto size = glesVersion ? strlen(glesVersion) : -1;
+    cacheManager().configureContext(&options, glesVersion, size);
     sk_sp<GrContext> grContext(GrContext::MakeGL(std::move(glInterface), options));
     LOG_ALWAYS_FATAL_IF(!grContext.get());
     setGrContext(grContext);
diff --git a/libs/hwui/renderthread/VulkanManager.cpp b/libs/hwui/renderthread/VulkanManager.cpp
index 1517f57..cc4b87a 100644
--- a/libs/hwui/renderthread/VulkanManager.cpp
+++ b/libs/hwui/renderthread/VulkanManager.cpp
@@ -391,7 +391,8 @@
 
     GrContextOptions options;
     options.fDisableDistanceFieldPaths = true;
-    mRenderThread.cacheManager().configureContext(&options);
+    // TODO: get a string describing the SPIR-V compiler version and use it here
+    mRenderThread.cacheManager().configureContext(&options, nullptr, 0);
     sk_sp<GrContext> grContext(GrContext::MakeVulkan(backendContext, options));
     LOG_ALWAYS_FATAL_IF(!grContext.get());
     mRenderThread.setGrContext(grContext);
diff --git a/libs/hwui/tests/unit/ShaderCacheTests.cpp b/libs/hwui/tests/unit/ShaderCacheTests.cpp
index 43080a9..1433aa0 100644
--- a/libs/hwui/tests/unit/ShaderCacheTests.cpp
+++ b/libs/hwui/tests/unit/ShaderCacheTests.cpp
@@ -48,11 +48,18 @@
      */
     static void terminate(ShaderCache& cache, bool saveContent) {
         std::lock_guard<std::mutex> lock(cache.mMutex);
-        if (cache.mInitialized && cache.mBlobCache && saveContent) {
-            cache.mBlobCache->writeToFile();
-        }
+        cache.mSavePending = saveContent;
+        cache.saveToDiskLocked();
         cache.mBlobCache = NULL;
     }
+
+    /**
+     *
+     */
+    template <typename T>
+    static bool validateCache(ShaderCache& cache, std::vector<T> hash) {
+        return cache.validateCache(hash.data(), hash.size() * sizeof(T));
+    }
 };
 
 } /* namespace skiapipeline */
@@ -75,26 +82,39 @@
     return false;
 }
 
-bool checkShader(const sk_sp<SkData>& shader, const char* program) {
-    sk_sp<SkData> shader2 = SkData::MakeWithCString(program);
-    return shader->size() == shader2->size()
-            && 0 == memcmp(shader->data(), shader2->data(), shader->size());
+inline bool
+checkShader(const sk_sp<SkData>& shader1, const sk_sp<SkData>& shader2) {
+    return nullptr != shader1 && nullptr != shader2 && shader1->size() == shader2->size()
+            && 0 == memcmp(shader1->data(), shader2->data(), shader1->size());
 }
 
-bool checkShader(const sk_sp<SkData>& shader, std::vector<char>& program) {
-    sk_sp<SkData> shader2 = SkData::MakeWithCopy(program.data(), program.size());
-    return shader->size() == shader2->size()
-            && 0 == memcmp(shader->data(), shader2->data(), shader->size());
+inline bool
+checkShader(const sk_sp<SkData>& shader, const char* program) {
+    sk_sp<SkData> shader2 = SkData::MakeWithCString(program);
+    return checkShader(shader, shader2);
+}
+
+template <typename T>
+bool checkShader(const sk_sp<SkData>& shader, std::vector<T>& program) {
+    sk_sp<SkData> shader2 = SkData::MakeWithCopy(program.data(), program.size() * sizeof(T));
+    return checkShader(shader, shader2);
 }
 
 void setShader(sk_sp<SkData>& shader, const char* program) {
     shader = SkData::MakeWithCString(program);
 }
 
-void setShader(sk_sp<SkData>& shader, std::vector<char>& program) {
-    shader = SkData::MakeWithCopy(program.data(), program.size());
+template <typename T>
+void setShader(sk_sp<SkData>& shader, std::vector<T>& buffer) {
+    shader = SkData::MakeWithCopy(buffer.data(), buffer.size() * sizeof(T));
 }
 
+template <typename T>
+void genRandomData(std::vector<T>& buffer) {
+    for (auto& data : buffer) {
+        data = T(std::rand());
+    }
+}
 
 
 #define GrProgramDescTest(a) (*SkData::MakeWithCString(#a).get())
@@ -110,6 +130,7 @@
     //remove any test files from previous test run
     int deleteFile = remove(cacheFile1.c_str());
     ASSERT_TRUE(0 == deleteFile || ENOENT == errno);
+    std::srand(0);
 
     //read the cache from a file that does not exist
     ShaderCache::get().setFilename(cacheFile1.c_str());
@@ -158,10 +179,8 @@
 
     //write and read big data chunk (50K)
     size_t dataSize = 50*1024;
-    std::vector<char> dataBuffer(dataSize);
-    for (size_t i = 0; i < dataSize; i++) {
-        dataBuffer[0] = dataSize % 256;
-    }
+    std::vector<uint8_t> dataBuffer(dataSize);
+    genRandomData(dataBuffer);
     setShader(inVS, dataBuffer);
     ShaderCache::get().store(GrProgramDescTest(432), *inVS.get());
     ShaderCacheTestUtils::terminate(ShaderCache::get(), true);
@@ -173,4 +192,96 @@
     remove(cacheFile1.c_str());
 }
 
+TEST(ShaderCacheTest, testCacheValidation) {
+    if (!folderExist(getExternalStorageFolder())) {
+        //don't run the test if external storage folder is not available
+        return;
+    }
+    std::string cacheFile1 =  getExternalStorageFolder() + "/shaderCacheTest1";
+    std::string cacheFile2 =  getExternalStorageFolder() + "/shaderCacheTest2";
+
+    //remove any test files from previous test run
+    int deleteFile = remove(cacheFile1.c_str());
+    ASSERT_TRUE(0 == deleteFile || ENOENT == errno);
+    std::srand(0);
+
+    //generate identity and read the cache from a file that does not exist
+    ShaderCache::get().setFilename(cacheFile1.c_str());
+    ShaderCacheTestUtils::setSaveDelay(ShaderCache::get(), 0); //disable deferred save
+    std::vector<uint8_t> identity(1024);
+    genRandomData(identity);
+    ShaderCache::get().initShaderDiskCache(identity.data(), identity.size() *
+                                           sizeof(decltype(identity)::value_type));
+
+    // generate random content in cache and store to disk
+    constexpr size_t numBlob(10);
+    constexpr size_t keySize(1024);
+    constexpr size_t dataSize(50 * 1024);
+
+    std::vector< std::pair<sk_sp<SkData>, sk_sp<SkData>> > blobVec(numBlob);
+    for (auto& blob : blobVec) {
+        std::vector<uint8_t> keyBuffer(keySize);
+        std::vector<uint8_t> dataBuffer(dataSize);
+        genRandomData(keyBuffer);
+        genRandomData(dataBuffer);
+
+        sk_sp<SkData> key, data;
+        setShader(key, keyBuffer);
+        setShader(data, dataBuffer);
+
+        blob = std::make_pair(key, data);
+        ShaderCache::get().store(*key.get(), *data.get());
+    }
+    ShaderCacheTestUtils::terminate(ShaderCache::get(), true);
+
+    // change to a file that does not exist and verify validation fails
+    ShaderCache::get().setFilename(cacheFile2.c_str());
+    ShaderCache::get().initShaderDiskCache();
+    ASSERT_FALSE( ShaderCacheTestUtils::validateCache(ShaderCache::get(), identity) );
+    ShaderCacheTestUtils::terminate(ShaderCache::get(), false);
+
+    // restore the original file and verify validation succeeds
+    ShaderCache::get().setFilename(cacheFile1.c_str());
+    ShaderCache::get().initShaderDiskCache(identity.data(), identity.size() *
+                                           sizeof(decltype(identity)::value_type));
+    ASSERT_TRUE( ShaderCacheTestUtils::validateCache(ShaderCache::get(), identity) );
+    for (const auto& blob : blobVec) {
+        auto outVS = ShaderCache::get().load(*blob.first.get());
+        ASSERT_TRUE( checkShader(outVS, blob.second) );
+    }
+
+    // generate error identity and verify load fails
+    ShaderCache::get().initShaderDiskCache(identity.data(), -1);
+    for (const auto& blob : blobVec) {
+        ASSERT_EQ( ShaderCache::get().load(*blob.first.get()), sk_sp<SkData>() );
+    }
+    ShaderCache::get().initShaderDiskCache(nullptr, identity.size() *
+                                           sizeof(decltype(identity)::value_type));
+    for (const auto& blob : blobVec) {
+        ASSERT_EQ( ShaderCache::get().load(*blob.first.get()), sk_sp<SkData>() );
+    }
+
+    // verify the cache validation again after load fails
+    ShaderCache::get().initShaderDiskCache(identity.data(), identity.size() *
+                                           sizeof(decltype(identity)::value_type));
+    ASSERT_TRUE( ShaderCacheTestUtils::validateCache(ShaderCache::get(), identity) );
+    for (const auto& blob : blobVec) {
+        auto outVS = ShaderCache::get().load(*blob.first.get());
+        ASSERT_TRUE( checkShader(outVS, blob.second) );
+    }
+
+    // generate another identity and verify load fails
+    for (auto& data : identity) {
+        data += std::rand();
+    }
+    ShaderCache::get().initShaderDiskCache(identity.data(), identity.size() *
+                                           sizeof(decltype(identity)::value_type));
+    for (const auto& blob : blobVec) {
+        ASSERT_EQ( ShaderCache::get().load(*blob.first.get()), sk_sp<SkData>() );
+    }
+
+    ShaderCacheTestUtils::terminate(ShaderCache::get(), false);
+    remove(cacheFile1.c_str());
+}
+
 }  // namespace
diff --git a/packages/CaptivePortalLogin/Android.mk b/packages/CaptivePortalLogin/Android.mk
index 3ea3340..8c63f45 100644
--- a/packages/CaptivePortalLogin/Android.mk
+++ b/packages/CaptivePortalLogin/Android.mk
@@ -4,7 +4,6 @@
 LOCAL_MODULE_TAGS := optional
 LOCAL_USE_AAPT2 := true
 LOCAL_STATIC_ANDROID_LIBRARIES := androidx.legacy_legacy-support-v4
-LOCAL_STATIC_JAVA_LIBRARIES := services.net
 
 LOCAL_SRC_FILES := $(call all-java-files-under, src)
 
diff --git a/packages/SystemUI/shared/Android.bp b/packages/SystemUI/shared/Android.bp
index eb71698..710b5f7 100644
--- a/packages/SystemUI/shared/Android.bp
+++ b/packages/SystemUI/shared/Android.bp
@@ -24,20 +24,3 @@
     // no compatibility issues with launcher
     java_version: "1.7",
 }
-
-android_app {
-
-    name: "SysUISharedLib",
-    platform_apis: true,
-    srcs: [
-        "src/**/*.java",
-        "src/**/I*.aidl",
-    ],
-
-    static_libs: ["SystemUISharedLib"],
-
-    optimize: {
-        enabled: false,
-    },
-
-}
diff --git a/packages/SystemUI/src/com/android/systemui/ImageWallpaper.java b/packages/SystemUI/src/com/android/systemui/ImageWallpaper.java
index acc7b49..77f4bf5 100644
--- a/packages/SystemUI/src/com/android/systemui/ImageWallpaper.java
+++ b/packages/SystemUI/src/com/android/systemui/ImageWallpaper.java
@@ -35,6 +35,8 @@
 import android.view.SurfaceHolder;
 import android.view.WindowManager;
 
+import com.android.internal.annotations.VisibleForTesting;
+
 import java.io.FileDescriptor;
 import java.io.IOException;
 import java.io.PrintWriter;
@@ -77,6 +79,13 @@
             unloadWallpaper(false /* forgetSize */);
         };
 
+        // Surface is rejected if size below a threshold on some devices (ie. 8px on elfin)
+        // set min to 64 px (CTS covers this)
+        @VisibleForTesting
+        static final int MIN_BACKGROUND_WIDTH = 64;
+        @VisibleForTesting
+        static final int MIN_BACKGROUND_HEIGHT = 64;
+
         Bitmap mBackground;
         int mBackgroundWidth = -1, mBackgroundHeight = -1;
         int mLastSurfaceWidth = -1, mLastSurfaceHeight = -1;
@@ -156,9 +165,9 @@
                 hasWallpaper = false;
             }
 
-            // Force the wallpaper to cover the screen in both dimensions
-            int surfaceWidth = Math.max(displayInfo.logicalWidth, mBackgroundWidth);
-            int surfaceHeight = Math.max(displayInfo.logicalHeight, mBackgroundHeight);
+            // Set surface size equal to bitmap size, prevent memory waste
+            int surfaceWidth = Math.max(MIN_BACKGROUND_WIDTH, mBackgroundWidth);
+            int surfaceHeight = Math.max(MIN_BACKGROUND_HEIGHT, mBackgroundHeight);
 
             // Used a fixed size surface, because we are special.  We can do
             // this because we know the current design of window animations doesn't
@@ -257,7 +266,8 @@
             drawFrame();
         }
 
-        private DisplayInfo getDefaultDisplayInfo() {
+        @VisibleForTesting
+        DisplayInfo getDefaultDisplayInfo() {
             mDefaultDisplay.getDisplayInfo(mTmpDisplayInfo);
             return mTmpDisplayInfo;
         }
@@ -420,7 +430,8 @@
             }.executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
         }
 
-        private void updateBitmap(Bitmap bitmap) {
+        @VisibleForTesting
+        void updateBitmap(Bitmap bitmap) {
             mBackground = null;
             mBackgroundWidth = -1;
             mBackgroundHeight = -1;
diff --git a/packages/SystemUI/src/com/android/systemui/biometrics/BiometricDialogImpl.java b/packages/SystemUI/src/com/android/systemui/biometrics/BiometricDialogImpl.java
index 6e62b0d..8fe577a 100644
--- a/packages/SystemUI/src/com/android/systemui/biometrics/BiometricDialogImpl.java
+++ b/packages/SystemUI/src/com/android/systemui/biometrics/BiometricDialogImpl.java
@@ -36,7 +36,7 @@
  * FingerprintDialogView).
  */
 public class BiometricDialogImpl extends SystemUI implements CommandQueue.Callbacks {
-    private static final String TAG = "FingerprintDialogImpl";
+    private static final String TAG = "BiometricDialogImpl";
     private static final boolean DEBUG = true;
 
     private static final int MSG_SHOW_DIALOG = 1;
@@ -120,8 +120,8 @@
     }
 
     @Override
-    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver) {
-        if (DEBUG) Log.d(TAG, "showBiometricDialog");
+    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver, int type) {
+        if (DEBUG) Log.d(TAG, "showBiometricDialog, type: " + type);
         // Remove these messages as they are part of the previous client
         mHandler.removeMessages(MSG_BIOMETRIC_ERROR);
         mHandler.removeMessages(MSG_BIOMETRIC_HELP);
diff --git a/packages/SystemUI/src/com/android/systemui/qs/PagedTileLayout.java b/packages/SystemUI/src/com/android/systemui/qs/PagedTileLayout.java
index f1b7eec..ca1b489 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/PagedTileLayout.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/PagedTileLayout.java
@@ -261,6 +261,12 @@
         return mPages.get(0).mColumns;
     }
 
+    public int getNumVisibleTiles() {
+        if (mPages.size() == 0) return 0;
+        TilePage currentPage = mPages.get(getCurrentItem());
+        return currentPage.mRecords.size();
+    }
+
     public void startTileReveal(Set<String> tileSpecs, final Runnable postAnimation) {
         if (tileSpecs.isEmpty() || mPages.size() < 2 || getScrollX() != 0 || !beginFakeDrag()) {
             // Do not start the reveal animation unless there are tiles to animate, multiple
diff --git a/packages/SystemUI/src/com/android/systemui/qs/QSAnimator.java b/packages/SystemUI/src/com/android/systemui/qs/QSAnimator.java
index 2a4bb60..3744d7d 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/QSAnimator.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/QSAnimator.java
@@ -155,6 +155,7 @@
         TouchAnimator.Builder translationYBuilder = new Builder();
 
         if (mQsPanel.getHost() == null) return;
+        if (mQuickQsPanel.getTileLayout().getNumVisibleTiles() < 1) return;
         Collection<QSTile> tiles = mQsPanel.getHost().getTiles();
         int count = 0;
         int[] loc1 = new int[2];
@@ -169,6 +170,7 @@
         QSTileLayout tileLayout = mQsPanel.getTileLayout();
         mAllViews.add((View) tileLayout);
         int height = mQs.getView() != null ? mQs.getView().getMeasuredHeight() : 0;
+        int width = mQs.getView() != null ? mQs.getView().getMeasuredWidth() : 0;
         int heightDiff = height - mQs.getHeader().getBottom()
                 + mQs.getHeader().getPaddingBottom();
         firstPageBuilder.addFloat(tileLayout, "translationY", heightDiff, 0);
@@ -181,7 +183,9 @@
             }
             final View tileIcon = tileView.getIcon().getIconView();
             View view = mQs.getView();
-            if (count < mNumQuickTiles && mAllowFancy) {
+
+            // This case: less tiles to animate in small displays.
+            if (count < mQuickQsPanel.getTileLayout().getNumVisibleTiles() && mAllowFancy) {
                 // Quick tiles.
                 QSTileView quickTileView = mQuickQsPanel.getTileView(tile);
                 if (quickTileView == null) continue;
@@ -192,18 +196,26 @@
                 final int xDiff = loc2[0] - loc1[0];
                 final int yDiff = loc2[1] - loc1[1];
                 lastXDiff = loc1[0] - lastX;
-                // Move the quick tile right from its location to the new one.
-                translationXBuilder.addFloat(quickTileView, "translationX", 0, xDiff);
-                translationYBuilder.addFloat(quickTileView, "translationY", 0, yDiff);
 
-                // Counteract the parent translation on the tile. So we have a static base to
-                // animate the label position off from.
-                //firstPageBuilder.addFloat(tileView, "translationY", mQsPanel.getHeight(), 0);
+                if (count < tileLayout.getNumVisibleTiles()) {
+                    // Move the quick tile right from its location to the new one.
+                    translationXBuilder.addFloat(quickTileView, "translationX", 0, xDiff);
+                    translationYBuilder.addFloat(quickTileView, "translationY", 0, yDiff);
 
-                // Move the real tile from the quick tile position to its final
-                // location.
-                translationXBuilder.addFloat(tileView, "translationX", -xDiff, 0);
-                translationYBuilder.addFloat(tileView, "translationY", -yDiff, 0);
+                    // Counteract the parent translation on the tile. So we have a static base to
+                    // animate the label position off from.
+                    //firstPageBuilder.addFloat(tileView, "translationY", mQsPanel.getHeight(), 0);
+
+                    // Move the real tile from the quick tile position to its final
+                    // location.
+                    translationXBuilder.addFloat(tileView, "translationX", -xDiff, 0);
+                    translationYBuilder.addFloat(tileView, "translationY", -yDiff, 0);
+
+                } else { // These tiles disappear when expanding
+                    firstPageBuilder.addFloat(quickTileView, "alpha", 1, 0);
+                    translationYBuilder.addFloat(quickTileView, "translationY", 0, yDiff);
+                    translationXBuilder.addFloat(quickTileView, "translationX", 0, xDiff + width);
+                }
 
                 mQuickQsViews.add(tileView.getIconWithBackground());
                 mAllViews.add(tileView.getIcon());
@@ -218,10 +230,9 @@
                 final int xDiff = loc2[0] - loc1[0];
                 final int yDiff = loc2[1] - loc1[1];
 
-                firstPageBuilder.addFloat(tileView, "translationY", heightDiff, 0);
-                translationXBuilder.addFloat(tileView, "translationX", -xDiff, 0);
+                firstPageBuilder.addFloat(tileView, "translationY", -heightDiff, 0);
                 translationYBuilder.addFloat(tileView, "translationY", -yDiff, 0);
-                translationYBuilder.addFloat(tileIcon, "translationY", -yDiff, 0);
+                translationXBuilder.addFloat(tileView, "translationX", -xDiff, 0);
 
                 mAllViews.add(tileIcon);
             } else {
diff --git a/packages/SystemUI/src/com/android/systemui/qs/QSPanel.java b/packages/SystemUI/src/com/android/systemui/qs/QSPanel.java
index 8697015..762fd75 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/QSPanel.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/QSPanel.java
@@ -665,5 +665,7 @@
         void setListening(boolean listening);
 
         default void setExpansion(float expansion) {}
+
+        int getNumVisibleTiles();
     }
 }
diff --git a/packages/SystemUI/src/com/android/systemui/qs/QuickQSPanel.java b/packages/SystemUI/src/com/android/systemui/qs/QuickQSPanel.java
index 1c50f79..556786a 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/QuickQSPanel.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/QuickQSPanel.java
@@ -18,18 +18,17 @@
 
 import android.content.Context;
 import android.content.res.Configuration;
+import android.graphics.Rect;
 import android.util.AttributeSet;
 import android.view.Gravity;
 import android.view.View;
 import android.widget.LinearLayout;
-import android.widget.Space;
 
 import com.android.systemui.Dependency;
 import com.android.systemui.R;
 import com.android.systemui.plugins.qs.QSTile;
 import com.android.systemui.plugins.qs.QSTile.SignalState;
 import com.android.systemui.plugins.qs.QSTile.State;
-import com.android.systemui.plugins.qs.QSTileView;
 import com.android.systemui.qs.customize.QSCustomizer;
 import com.android.systemui.tuner.TunerService;
 import com.android.systemui.tuner.TunerService.Tunable;
@@ -43,6 +42,7 @@
 public class QuickQSPanel extends QSPanel {
 
     public static final String NUM_QUICK_TILES = "sysui_qqs_count";
+    private static final String TAG = "QuickQSPanel";
 
     private boolean mDisabledByPolicy;
     private static int mDefaultMaxTiles;
@@ -178,121 +178,95 @@
         super.setVisibility(visibility);
     }
 
-    private static class HeaderTileLayout extends LinearLayout implements QSTileLayout {
+    private static class HeaderTileLayout extends TileLayout {
 
-        protected final ArrayList<TileRecord> mRecords = new ArrayList<>();
         private boolean mListening;
-        /** Size of the QS tile (width & height). */
-        private int mTileDimensionSize;
 
         public HeaderTileLayout(Context context) {
             super(context);
             setClipChildren(false);
             setClipToPadding(false);
-
-            mTileDimensionSize = mContext.getResources().getDimensionPixelSize(
-                    R.dimen.qs_quick_tile_size);
-            updateLayoutParams();
         }
 
         @Override
         protected void onConfigurationChanged(Configuration newConfig) {
             super.onConfigurationChanged(newConfig);
-            updateLayoutParams();
+            updateResources();
+        }
+
+        @Override
+        public void onFinishInflate(){
+            updateResources();
         }
 
         private void updateLayoutParams() {
-            setGravity(Gravity.CENTER);
             int width = getResources().getDimensionPixelSize(R.dimen.qs_quick_layout_width);
-            LayoutParams lp = new LayoutParams(width, LayoutParams.MATCH_PARENT);
+            LinearLayout.LayoutParams lp = new LinearLayout.LayoutParams(width, LayoutParams.MATCH_PARENT);
             lp.gravity = Gravity.CENTER_HORIZONTAL;
             setLayoutParams(lp);
         }
 
-        /**
-         * Returns {@link LayoutParams} based on the given {@code spaceWidth}. If the width is 0,
-         * then we're going to have the space expand to take up as much space as possible. If the
-         * width is non-zero, we want the inter-tile spacers to be fixed.
-         */
-        private LayoutParams generateSpaceLayoutParams() {
-            LayoutParams lp = new LayoutParams(0, mTileDimensionSize);
-            lp.weight = 1;
-            lp.gravity = Gravity.CENTER;
-            return lp;
-        }
-
-        @Override
-        public void setListening(boolean listening) {
-            if (mListening == listening) return;
-            mListening = listening;
-            for (TileRecord record : mRecords) {
-                record.tile.setListening(this, mListening);
-            }
-        }
-
-        @Override
-        public void addTile(TileRecord tile) {
-            if (getChildCount() != 0) {
-                addView(new Space(mContext), getChildCount(), generateSpaceLayoutParams());
-            }
-
-            addView(tile.tileView, getChildCount(), generateTileLayoutParams());
-            mRecords.add(tile);
-            tile.tile.setListening(this, mListening);
-        }
-
         private LayoutParams generateTileLayoutParams() {
-            LayoutParams lp = new LayoutParams(mTileDimensionSize, mTileDimensionSize);
-            lp.gravity = Gravity.CENTER;
+            LayoutParams lp = new LayoutParams(mCellWidth, mCellHeight);
             return lp;
         }
 
         @Override
-        public void removeTile(TileRecord tile) {
-            int childIndex = getChildIndex(tile.tileView);
-            // Remove the tile.
-            removeViewAt(childIndex);
-            if (getChildCount() != 0) {
-                // Remove its spacer as well.
-                removeViewAt(childIndex);
-            }
-            mRecords.remove(tile);
-            tile.tile.setListening(this, false);
-        }
-
-        private int getChildIndex(QSTileView tileView) {
-            final int childViewCount = getChildCount();
-            for (int i = 0; i < childViewCount; i++) {
-                if (getChildAt(i) == tileView) {
-                    return i;
-                }
-            }
-            return -1;
+        protected void addTileView(TileRecord tile) {
+            addView(tile.tileView, getChildCount(), generateTileLayoutParams());
         }
 
         @Override
-        public int getOffsetTop(TileRecord tile) {
-            return 0;
+        protected void onLayout(boolean changed, int l, int t, int r, int b) {
+            // We only care about clipping on the right side
+            Rect bounds = new Rect(0, 0, r - l, 10000);
+            setClipBounds(bounds);
+
+            calculateColumns();
+
+            for (int i = 0; i < mRecords.size(); i++) {
+                mRecords.get(i).tileView.setVisibility( i < mColumns ? View.VISIBLE : View.GONE);
+            }
+
+            setAccessibilityOrder();
+            layoutTileRecords(mColumns);
         }
 
         @Override
         public boolean updateResources() {
-            // No resources here.
+            mCellWidth = mContext.getResources().getDimensionPixelSize(R.dimen.qs_quick_tile_size);
+            mCellHeight = mCellWidth;
+
+            updateLayoutParams();
+
             return false;
         }
 
-        @Override
-        public boolean hasOverlappingRendering() {
-            return false;
-        }
+        private boolean calculateColumns() {
+            int prevNumColumns = mColumns;
+            int maxTiles = mRecords.size();
 
-        @Override
-        protected void onMeasure(int widthMeasureSpec, int heightMeasureSpec) {
-            super.onMeasure(widthMeasureSpec, heightMeasureSpec);
-            if (hideOverflowingChildren(widthMeasureSpec)) {
-                return; // Rely on visibility change to trigger remeasure.
+            if (maxTiles == 0){ // Early return during setup
+                mColumns = 0;
+                return true;
             }
 
+            final int availableWidth = getMeasuredWidth() - getPaddingStart() - getPaddingEnd();
+            final int leftoverWithespace = availableWidth - maxTiles * mCellWidth;
+            final int smallestHorizontalMarginNeeded = leftoverWithespace / (maxTiles - 1);
+
+            if (smallestHorizontalMarginNeeded > 0){
+                mCellMarginHorizontal = smallestHorizontalMarginNeeded;
+                mColumns = maxTiles;
+            } else{
+                mColumns = mCellWidth == 0 ? 1 :
+                        Math.min(maxTiles, availableWidth / mCellWidth );
+                mCellMarginHorizontal = (availableWidth - mColumns * mCellWidth) / (mColumns - 1);
+            }
+            return mColumns != prevNumColumns;
+        }
+
+        private void setAccessibilityOrder() {
             if (mRecords != null && mRecords.size() > 0) {
                 View previousView = this;
                 for (TileRecord record : mRecords) {
@@ -306,31 +280,28 @@
             }
         }
 
-        /**
-         * Hide child views that would otherwise be clipped.
-         * @return {@code true} if any child visibilities have changed.
-         */
-        private boolean hideOverflowingChildren(int widthMeasureSpec) {
-            if (getChildCount() == 0) {
-                return false;
+        @Override
+        protected void onMeasure(int widthMeasureSpec, int heightMeasureSpec) {
+            // Measure each QS tile.
+            for (TileRecord record : mRecords) {
+                if (record.tileView.getVisibility() == GONE) continue;
+                record.tileView.measure(exactly(mCellWidth), exactly(mCellHeight));
             }
-            boolean childVisibilityChanged = false;
-            int widthRemaining = MeasureSpec.getSize(widthMeasureSpec)
-                - getChildAt(0).getMeasuredWidth() - getPaddingStart() - getPaddingEnd();
-            for (int i = 2; i < getChildCount(); i += 2) {
-                View tileChild = getChildAt(i);
-                LayoutParams lp = (LayoutParams) tileChild.getLayoutParams();
-                // All Space views have 0 width; only tiles contribute to the total width.
-                widthRemaining = widthRemaining
-                    - tileChild.getMeasuredWidth() - lp.getMarginEnd() - lp.getMarginStart();
-                int newVisibility = widthRemaining < 0 ? View.GONE : View.VISIBLE;
-                if (tileChild.getVisibility() != newVisibility) {
-                    tileChild.setVisibility(newVisibility);
-                    getChildAt(i - 1).setVisibility(newVisibility); // Hide spacer as well.
-                    childVisibilityChanged = true;
-                }
-            }
-            return childVisibilityChanged;
+
+            int height = mCellHeight;
+            if (height < 0) height = 0;
+
+            setMeasuredDimension(MeasureSpec.getSize(widthMeasureSpec), height);
+        }
+
+        @Override
+        public int getNumVisibleTiles() {
+            return mColumns;
+        }
+
+        @Override
+        protected int getColumnStart(int column) {
+            return getPaddingStart() + column *  (mCellWidth + mCellMarginHorizontal);
         }
     }
 }
diff --git a/packages/SystemUI/src/com/android/systemui/qs/TileLayout.java b/packages/SystemUI/src/com/android/systemui/qs/TileLayout.java
index 45d63e0..c67165e 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/TileLayout.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/TileLayout.java
@@ -56,6 +56,10 @@
     public void addTile(TileRecord tile) {
         mRecords.add(tile);
         tile.tile.setListening(this, mListening);
+        addTileView(tile);
+    }
+
+    protected void addTileView(TileRecord tile) {
         addView(tile.tileView);
     }
 
@@ -120,19 +124,18 @@
         return false;
     }
 
-    private static int exactly(int size) {
+    protected static int exactly(int size) {
         return MeasureSpec.makeMeasureSpec(size, MeasureSpec.EXACTLY);
     }
 
-    @Override
-    protected void onLayout(boolean changed, int l, int t, int r, int b) {
-        final int w = getWidth();
+
+    protected void layoutTileRecords(int numRecords) {
         final boolean isRtl = getLayoutDirection() == LAYOUT_DIRECTION_RTL;
         int row = 0;
         int column = 0;
 
         // Layout each QS tile.
-        for (int i = 0; i < mRecords.size(); i++, column++) {
+        for (int i = 0; i < numRecords; i++, column++) {
             // If we reached the last column available to layout a tile, wrap back to the next row.
             if (column == mColumns) {
                 column = 0;
@@ -147,12 +150,22 @@
         }
     }
 
+    @Override
+    protected void onLayout(boolean changed, int l, int t, int r, int b) {
+        layoutTileRecords(mRecords.size());
+    }
+
     private int getRowTop(int row) {
         return row * (mCellHeight + mCellMarginVertical) + mCellMarginTop;
     }
 
-    private int getColumnStart(int column) {
+    protected int getColumnStart(int column) {
         return getPaddingStart() + mSidePadding + mCellMarginHorizontal / 2 +
                 column *  (mCellWidth + mCellMarginHorizontal);
     }
+
+    @Override
+    public int getNumVisibleTiles() {
+        return mRecords.size();
+    }
 }
diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/CommandQueue.java b/packages/SystemUI/src/com/android/systemui/statusbar/CommandQueue.java
index 909cd79..e19c844 100644
--- a/packages/SystemUI/src/com/android/systemui/statusbar/CommandQueue.java
+++ b/packages/SystemUI/src/com/android/systemui/statusbar/CommandQueue.java
@@ -160,7 +160,8 @@
 
         default void onRotationProposal(int rotation, boolean isValid) { }
 
-        default void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver) { }
+        default void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver,
+                int type) { }
         default void onBiometricAuthenticated() { }
         default void onBiometricHelp(String message) { }
         default void onBiometricError(String error) { }
@@ -513,11 +514,12 @@
     }
 
     @Override
-    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver) {
+    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver, int type) {
         synchronized (mLock) {
             SomeArgs args = SomeArgs.obtain();
             args.arg1 = bundle;
             args.arg2 = receiver;
+            args.argi1 = type;
             mHandler.obtainMessage(MSG_BIOMETRIC_SHOW, args)
                     .sendToTarget();
         }
@@ -756,11 +758,14 @@
                     mHandler.removeMessages(MSG_BIOMETRIC_ERROR);
                     mHandler.removeMessages(MSG_BIOMETRIC_HELP);
                     mHandler.removeMessages(MSG_BIOMETRIC_AUTHENTICATED);
+                    SomeArgs someArgs = (SomeArgs) msg.obj;
                     for (int i = 0; i < mCallbacks.size(); i++) {
                         mCallbacks.get(i).showBiometricDialog(
-                                (Bundle)((SomeArgs)msg.obj).arg1,
-                                (IBiometricPromptReceiver)((SomeArgs)msg.obj).arg2);
+                                (Bundle) someArgs.arg1,
+                                (IBiometricPromptReceiver) someArgs.arg2,
+                                someArgs.argi1);
                     }
+                    someArgs.recycle();
                     break;
                 case MSG_BIOMETRIC_AUTHENTICATED:
                     for (int i = 0; i < mCallbacks.size(); i++) {
diff --git a/packages/SystemUI/tests/src/com/android/systemui/ImageWallpaperTest.java b/packages/SystemUI/tests/src/com/android/systemui/ImageWallpaperTest.java
new file mode 100644
index 0000000..521d5d1
--- /dev/null
+++ b/packages/SystemUI/tests/src/com/android/systemui/ImageWallpaperTest.java
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.systemui;
+
+
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.when;
+
+import android.graphics.Bitmap;
+import android.support.test.runner.AndroidJUnit4;
+import android.test.suitebuilder.annotation.SmallTest;
+import android.view.DisplayInfo;
+import android.view.SurfaceHolder;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import java.util.concurrent.CountDownLatch;
+
+@SmallTest
+@RunWith(AndroidJUnit4.class)
+public class ImageWallpaperTest extends SysuiTestCase {
+
+    private static final int BMP_WIDTH = 128;
+    private static final int BMP_HEIGHT = 128;
+
+    private static final int INVALID_BMP_WIDTH = 1;
+    private static final int INVALID_BMP_HEIGHT = 1;
+
+    private ImageWallpaper mImageWallpaper;
+
+    @Mock private SurfaceHolder mSurfaceHolder;
+    @Mock private DisplayInfo mDisplayInfo;
+
+    CountDownLatch mEventCountdown;
+
+    @Before
+    public void setUp() throws Exception {
+        MockitoAnnotations.initMocks(this);
+
+        mEventCountdown = new CountDownLatch(1);
+
+        mImageWallpaper = new ImageWallpaper() {
+            @Override
+            public Engine onCreateEngine() {
+                return new DrawableEngine() {
+                    @Override
+                    DisplayInfo getDefaultDisplayInfo() {
+                        return mDisplayInfo;
+                    }
+
+                    @Override
+                    public SurfaceHolder getSurfaceHolder() {
+                        return mSurfaceHolder;
+                    }
+
+                    @Override
+                    public void setFixedSizeAllowed(boolean allowed) {
+                        super.setFixedSizeAllowed(allowed);
+                        assertTrue("mFixedSizeAllowed should be true", allowed);
+                        mEventCountdown.countDown();
+                    }
+                };
+            }
+        };
+    }
+
+    @Test
+    public void testSetValidBitmapWallpaper() {
+        ImageWallpaper.DrawableEngine wallpaperEngine =
+                (ImageWallpaper.DrawableEngine) mImageWallpaper.onCreateEngine();
+
+        assertEquals("setFixedSizeAllowed should have been called.",
+                0, mEventCountdown.getCount());
+
+        Bitmap mockedBitmap = mock(Bitmap.class);
+        when(mockedBitmap.getWidth()).thenReturn(BMP_WIDTH);
+        when(mockedBitmap.getHeight()).thenReturn(BMP_HEIGHT);
+
+        wallpaperEngine.updateBitmap(mockedBitmap);
+
+        assertEquals(BMP_WIDTH, wallpaperEngine.mBackgroundWidth);
+        assertEquals(BMP_HEIGHT, wallpaperEngine.mBackgroundHeight);
+
+        verify(mSurfaceHolder, times(1)).setFixedSize(BMP_WIDTH, BMP_HEIGHT);
+
+    }
+
+    @Test
+    public void testSetTooSmallBitmapWallpaper() {
+        ImageWallpaper.DrawableEngine wallpaperEngine =
+                (ImageWallpaper.DrawableEngine) mImageWallpaper.onCreateEngine();
+
+        assertEquals("setFixedSizeAllowed should have been called.",
+                0, mEventCountdown.getCount());
+
+        Bitmap mockedBitmap = mock(Bitmap.class);
+        when(mockedBitmap.getWidth()).thenReturn(INVALID_BMP_WIDTH);
+        when(mockedBitmap.getHeight()).thenReturn(INVALID_BMP_HEIGHT);
+
+        wallpaperEngine.updateBitmap(mockedBitmap);
+
+        assertEquals(INVALID_BMP_WIDTH, wallpaperEngine.mBackgroundWidth);
+        assertEquals(INVALID_BMP_HEIGHT, wallpaperEngine.mBackgroundHeight);
+
+        verify(mSurfaceHolder, times(1)).setFixedSize(ImageWallpaper.DrawableEngine.MIN_BACKGROUND_WIDTH, ImageWallpaper.DrawableEngine.MIN_BACKGROUND_HEIGHT);
+    }
+
+}
diff --git a/proto/src/stats_enums.proto b/proto/src/stats_enums.proto
new file mode 100644
index 0000000..6c892cf
--- /dev/null
+++ b/proto/src/stats_enums.proto
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto2";
+
+package android.os.statsd;
+option java_package = "com.android.os";
+option java_outer_classname = "StatsEnums";
+
+enum EventType {
+  // Unknown.
+  TYPE_UNKNOWN = 0;
+}
diff --git a/services/backup/java/com/android/server/backup/BackupAgentTimeoutParameters.java b/services/backup/java/com/android/server/backup/BackupAgentTimeoutParameters.java
index 49fa1cc..df46d260b 100644
--- a/services/backup/java/com/android/server/backup/BackupAgentTimeoutParameters.java
+++ b/services/backup/java/com/android/server/backup/BackupAgentTimeoutParameters.java
@@ -57,6 +57,10 @@
     public static final String SETTING_RESTORE_AGENT_FINISHED_TIMEOUT_MILLIS =
             "restore_agent_finished_timeout_millis";
 
+    @VisibleForTesting
+    public static final String SETTING_QUOTA_EXCEEDED_TIMEOUT_MILLIS =
+            "quota_exceeded_timeout_millis";
+
     // Default values
     @VisibleForTesting public static final long DEFAULT_KV_BACKUP_AGENT_TIMEOUT_MILLIS = 30 * 1000;
 
@@ -71,6 +75,9 @@
     @VisibleForTesting
     public static final long DEFAULT_RESTORE_AGENT_FINISHED_TIMEOUT_MILLIS = 30 * 1000;
 
+    @VisibleForTesting
+    public static final long DEFAULT_QUOTA_EXCEEDED_TIMEOUT_MILLIS = 3 * 1000;
+
     @GuardedBy("mLock")
     private long mKvBackupAgentTimeoutMillis;
 
@@ -86,6 +93,9 @@
     @GuardedBy("mLock")
     private long mRestoreAgentFinishedTimeoutMillis;
 
+    @GuardedBy("mLock")
+    private long mQuotaExceededTimeoutMillis;
+
     private final Object mLock = new Object();
 
     public BackupAgentTimeoutParameters(Handler handler, ContentResolver resolver) {
@@ -118,6 +128,10 @@
                     parser.getLong(
                             SETTING_RESTORE_AGENT_FINISHED_TIMEOUT_MILLIS,
                             DEFAULT_RESTORE_AGENT_FINISHED_TIMEOUT_MILLIS);
+            mQuotaExceededTimeoutMillis =
+                    parser.getLong(
+                            SETTING_QUOTA_EXCEEDED_TIMEOUT_MILLIS,
+                            DEFAULT_QUOTA_EXCEEDED_TIMEOUT_MILLIS);
         }
     }
 
@@ -170,4 +184,16 @@
             return mRestoreAgentFinishedTimeoutMillis;
         }
     }
+
+    public long getQuotaExceededTimeoutMillis() {
+        synchronized (mLock) {
+            if (BackupManagerService.DEBUG_SCHEDULING) {
+                Slog.v(
+                        TAG,
+                        "getQuotaExceededTimeoutMillis(): "
+                                + mQuotaExceededTimeoutMillis);
+            }
+            return mQuotaExceededTimeoutMillis;
+        }
+    }
 }
diff --git a/services/backup/java/com/android/server/backup/fullbackup/FullBackupEngine.java b/services/backup/java/com/android/server/backup/fullbackup/FullBackupEngine.java
index 5694659..16906f7 100644
--- a/services/backup/java/com/android/server/backup/fullbackup/FullBackupEngine.java
+++ b/services/backup/java/com/android/server/backup/fullbackup/FullBackupEngine.java
@@ -46,6 +46,7 @@
 import com.android.server.backup.BackupAgentTimeoutParameters;
 import com.android.server.backup.BackupManagerService;
 import com.android.server.backup.BackupRestoreTask;
+import com.android.server.backup.remote.RemoteCall;
 import com.android.server.backup.utils.FullBackupUtils;
 
 import java.io.BufferedOutputStream;
@@ -270,10 +271,12 @@
         return result;
     }
 
-    public void sendQuotaExceeded(final long backupDataBytes, final long quotaBytes) {
+    public void sendQuotaExceeded(long backupDataBytes, long quotaBytes) {
         if (initializeAgent()) {
             try {
-                mAgent.doQuotaExceeded(backupDataBytes, quotaBytes);
+                RemoteCall.execute(
+                        callback -> mAgent.doQuotaExceeded(backupDataBytes, quotaBytes, callback),
+                        mAgentTimeoutParameters.getQuotaExceededTimeoutMillis());
             } catch (RemoteException e) {
                 Slog.e(TAG, "Remote exception while telling agent about quota exceeded");
             }
diff --git a/services/backup/java/com/android/server/backup/fullbackup/PerformFullTransportBackupTask.java b/services/backup/java/com/android/server/backup/fullbackup/PerformFullTransportBackupTask.java
index f7c1c10..e108026 100644
--- a/services/backup/java/com/android/server/backup/fullbackup/PerformFullTransportBackupTask.java
+++ b/services/backup/java/com/android/server/backup/fullbackup/PerformFullTransportBackupTask.java
@@ -51,6 +51,7 @@
 import com.android.server.backup.TransportManager;
 import com.android.server.backup.internal.OnTaskFinishedListener;
 import com.android.server.backup.internal.Operation;
+import com.android.server.backup.remote.RemoteCall;
 import com.android.server.backup.transport.TransportClient;
 import com.android.server.backup.transport.TransportNotAvailableException;
 import com.android.server.backup.utils.AppBackupUtils;
@@ -739,7 +740,9 @@
                         Slog.d(TAG, "Package hit quota limit on preflight " +
                                 pkg.packageName + ": " + totalSize + " of " + mQuota);
                     }
-                    agent.doQuotaExceeded(totalSize, mQuota);
+                    RemoteCall.execute(
+                            callback -> agent.doQuotaExceeded(totalSize, mQuota, callback),
+                            mAgentTimeoutParameters.getQuotaExceededTimeoutMillis());
                 }
             } catch (Exception e) {
                 Slog.w(TAG, "Exception preflighting " + pkg.packageName + ": " + e.getMessage());
diff --git a/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupReporter.java b/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupReporter.java
index 7f5ddc2..54e6b1d 100644
--- a/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupReporter.java
+++ b/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupReporter.java
@@ -52,11 +52,9 @@
 //       verify calls to this object. Add these and more assertions to the test of this class.
 @VisibleForTesting
 public class KeyValueBackupReporter {
-    @VisibleForTesting
-    static final String TAG = "KeyValueBackupTask";
+    @VisibleForTesting static final String TAG = "KeyValueBackupTask";
     private static final boolean DEBUG = BackupManagerService.DEBUG;
-    @VisibleForTesting
-    static final boolean MORE_DEBUG = BackupManagerService.MORE_DEBUG || true;
+    @VisibleForTesting static final boolean MORE_DEBUG = BackupManagerService.MORE_DEBUG || true;
 
     static void onNewThread(String threadName) {
         if (DEBUG) {
@@ -132,12 +130,6 @@
         Slog.e(TAG, "Error during PM metadata backup", e);
     }
 
-    void onEmptyQueue() {
-        if (MORE_DEBUG) {
-            Slog.i(TAG, "Queue now empty");
-        }
-    }
-
     void onStartPackageBackup(String packageName) {
         Slog.d(TAG, "Starting key-value backup of " + packageName);
     }
@@ -363,6 +355,14 @@
                                 null, BackupManagerMonitor.EXTRA_LOG_CANCEL_ALL, true));
     }
 
+    void onAgentResultError(@Nullable PackageInfo packageInfo) {
+        String packageName = getPackageName(packageInfo);
+        BackupObserverUtils.sendBackupOnPackageResult(
+                mObserver, packageName, BackupManager.ERROR_AGENT_FAILURE);
+        EventLog.writeEvent(EventLogTags.BACKUP_AGENT_FAILURE, packageName, "result error");
+        Slog.w(TAG, "Agent " + packageName + " error in onBackup()");
+    }
+
     private String getPackageName(@Nullable PackageInfo packageInfo) {
         return (packageInfo != null) ? packageInfo.packageName : "no_package_yet";
     }
@@ -377,9 +377,9 @@
         Slog.w(TAG, "Unable to contact transport for recommended backoff: " + e);
     }
 
-    void onRemoteCallReturned(RemoteResult result) {
+    void onRemoteCallReturned(RemoteResult result, String logIdentifier) {
         if (MORE_DEBUG) {
-            Slog.v(TAG, "Agent call returned " + result);
+            Slog.v(TAG, "Agent call " + logIdentifier + " returned " + result);
         }
     }
 
diff --git a/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupTask.java b/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupTask.java
index 7d035cb..a4cd629 100644
--- a/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupTask.java
+++ b/services/backup/java/com/android/server/backup/keyvalue/KeyValueBackupTask.java
@@ -251,15 +251,15 @@
     @Nullable private final DataChangedJournal mJournal;
     @Nullable private PerformFullTransportBackupTask mFullBackupTask;
 
-    private IBackupAgent mAgentBinder;
-    private PackageInfo mCurrentPackage;
-    private File mSavedStateFile;
-    private File mBackupDataFile;
-    private File mNewStateFile;
-    private ParcelFileDescriptor mSavedState;
-    private ParcelFileDescriptor mBackupData;
-    private ParcelFileDescriptor mNewState;
     private int mStatus;
+    @Nullable private IBackupAgent mAgentBinder;
+    @Nullable private PackageInfo mCurrentPackage;
+    @Nullable private File mSavedStateFile;
+    @Nullable private File mBackupDataFile;
+    @Nullable private File mNewStateFile;
+    @Nullable private ParcelFileDescriptor mSavedState;
+    @Nullable private ParcelFileDescriptor mBackupData;
+    @Nullable private ParcelFileDescriptor mNewState;
 
     /**
      * This {@link ConditionVariable} is used to signal that the cancel operation has been
@@ -331,44 +331,45 @@
     public void run() {
         Process.setThreadPriority(THREAD_PRIORITY);
 
-        BackupState state = startTask();
-        while (state == BackupState.RUNNING_QUEUE || state == BackupState.BACKUP_PM) {
-            if (mCancelled) {
-                state = BackupState.CANCELLED;
-            }
-            switch (state) {
-                case BACKUP_PM:
-                    state = backupPm();
-                    break;
-                case RUNNING_QUEUE:
-                    Pair<BackupState, RemoteResult> stateAndResult = extractNextAgentData();
-                    state = stateAndResult.first;
-                    if (state == null) {
-                        state = handleAgentResult(stateAndResult.second);
-                    }
-                    break;
+        boolean processQueue = startTask();
+        while (processQueue && !mQueue.isEmpty() && !mCancelled) {
+            String packageName = mQueue.remove(0);
+            if (PM_PACKAGE.equals(packageName)) {
+                processQueue = backupPm();
+            } else {
+                processQueue = backupPackage(packageName);
             }
         }
         finishTask();
     }
 
-    private BackupState handleAgentResult(RemoteResult result) {
+    /** Returns whether to consume next queue package. */
+    private boolean handleAgentResult(@Nullable PackageInfo packageInfo, RemoteResult result) {
         if (result == RemoteResult.FAILED_THREAD_INTERRUPTED) {
             // Not an explicit cancel, we need to flag it.
             mCancelled = true;
-            handleAgentCancelled();
-            return BackupState.CANCELLED;
+            mReporter.onAgentCancelled(packageInfo);
+            errorCleanup();
+            return false;
         }
         if (result == RemoteResult.FAILED_CANCELLED) {
-            handleAgentCancelled();
-            return BackupState.CANCELLED;
+            mReporter.onAgentCancelled(packageInfo);
+            errorCleanup();
+            return false;
         }
         if (result == RemoteResult.FAILED_TIMED_OUT) {
-            handleAgentTimeout();
-            return BackupState.RUNNING_QUEUE;
+            mReporter.onAgentTimedOut(packageInfo);
+            errorCleanup();
+            return true;
         }
-        Preconditions.checkState(result.succeeded());
-        return sendDataToTransport(result.get());
+        Preconditions.checkState(result.isPresent());
+        long agentResult = result.get();
+        if (agentResult == BackupAgent.RESULT_ERROR) {
+            mReporter.onAgentResultError(packageInfo);
+            errorCleanup();
+            return true;
+        }
+        return sendDataToTransport();
     }
 
     @Override
@@ -377,11 +378,12 @@
     @Override
     public void operationComplete(long unusedResult) {}
 
-    private BackupState startTask() {
+    /** Returns whether to consume next queue package. */
+    private boolean startTask() {
         synchronized (mBackupManagerService.getCurrentOpLock()) {
             if (mBackupManagerService.isBackupOperationInProgress()) {
                 mReporter.onSkipBackup();
-                return BackupState.FINAL;
+                return false;
             }
         }
 
@@ -404,14 +406,18 @@
         mAgentBinder = null;
         mStatus = BackupTransport.TRANSPORT_OK;
 
-        // Sanity check: if the queue is empty we have no work to do.
-        if (mOriginalQueue.isEmpty() && mPendingFullBackups.isEmpty()) {
+        if (mQueue.isEmpty() && mPendingFullBackups.isEmpty()) {
             mReporter.onEmptyQueueAtStart();
-            return BackupState.FINAL;
+            return false;
         }
 
         // We only backup PM if it was explicitly in the queue or if it's incremental.
         boolean backupPm = mQueue.remove(PM_PACKAGE) || !mNonIncremental;
+        if (backupPm) {
+            mQueue.add(0, PM_PACKAGE);
+        } else {
+            mReporter.onSkipPm();
+        }
 
         mReporter.onQueueReady(mQueue);
         File pmState = new File(mStateDirectory, PM_PACKAGE);
@@ -434,18 +440,14 @@
 
         if (mStatus != BackupTransport.TRANSPORT_OK) {
             mBackupManagerService.resetBackupState(mStateDirectory);
-            return BackupState.FINAL;
+            return false;
         }
 
-        if (!backupPm) {
-            mReporter.onSkipPm();
-            return BackupState.RUNNING_QUEUE;
-        }
-
-        return BackupState.BACKUP_PM;
+        return true;
     }
 
-    private BackupState backupPm() {
+    /** Returns whether to consume next queue package. */
+    private boolean backupPm() {
         RemoteResult agentResult = null;
         try {
             mCurrentPackage = new PackageInfo();
@@ -466,31 +468,17 @@
 
         if (mStatus != BackupTransport.TRANSPORT_OK) {
             mBackupManagerService.resetBackupState(mStateDirectory);
-            return BackupState.FINAL;
+            return false;
         }
 
         Preconditions.checkNotNull(agentResult);
-        return handleAgentResult(agentResult);
+        return handleAgentResult(mCurrentPackage, agentResult);
     }
 
-    /**
-     * Returns either:
-     *
-     * <ul>
-     *   <li>(next state, {@code null}): In case we failed to call the agent.
-     *   <li>({@code null}, agent result): In case we successfully called the agent.
-     * </ul>
-     */
-    private Pair<BackupState, RemoteResult> extractNextAgentData() {
-        mStatus = BackupTransport.TRANSPORT_OK;
-
-        if (mQueue.isEmpty()) {
-            mReporter.onEmptyQueue();
-            return Pair.create(BackupState.FINAL, null);
-        }
-
-        String packageName = mQueue.remove(0);
+    /** Returns whether to consume next queue package. */
+    private boolean backupPackage(String packageName) {
         mReporter.onStartPackageBackup(packageName);
+        mStatus = BackupTransport.TRANSPORT_OK;
 
         // Verify that the requested app is eligible for key-value backup.
         RemoteResult agentResult = null;
@@ -502,19 +490,19 @@
                 // The manifest has changed. This won't happen again because the app won't be
                 // requesting further backups.
                 mReporter.onPackageNotEligibleForBackup(packageName);
-                return Pair.create(BackupState.RUNNING_QUEUE, null);
+                return true;
             }
 
             if (AppBackupUtils.appGetsFullBackup(mCurrentPackage)) {
                 // Initially enqueued for key-value backup, but only supports full-backup now.
                 mReporter.onPackageEligibleForFullBackup(packageName);
-                return Pair.create(BackupState.RUNNING_QUEUE, null);
+                return true;
             }
 
             if (AppBackupUtils.appIsStopped(applicationInfo)) {
                 // Just as it won't receive broadcasts, we won't run it for backup.
                 mReporter.onPackageStopped(packageName);
-                return Pair.create(BackupState.RUNNING_QUEUE, null);
+                return true;
             }
 
             try {
@@ -550,22 +538,22 @@
                 mReporter.onAgentError(packageName);
                 mBackupManagerService.dataChangedImpl(packageName);
                 mStatus = BackupTransport.TRANSPORT_OK;
-                return Pair.create(BackupState.RUNNING_QUEUE, null);
+                return true;
             }
 
             if (mStatus == BackupTransport.AGENT_UNKNOWN) {
                 mReporter.onAgentUnknown(packageName);
                 mStatus = BackupTransport.TRANSPORT_OK;
-                return Pair.create(BackupState.RUNNING_QUEUE, null);
+                return true;
             }
 
             // Transport-level failure, re-enqueue everything.
             revertTask();
-            return Pair.create(BackupState.FINAL, null);
+            return false;
         }
 
-        // Success: caller will figure out the state based on call result
-        return Pair.create(null, agentResult);
+        Preconditions.checkNotNull(agentResult);
+        return handleAgentResult(mCurrentPackage, agentResult);
     }
 
     private void finishTask() {
@@ -706,8 +694,6 @@
             IBackupTransport transport = mTransportClient.connectOrThrow("KVBT.extractAgentData()");
             long quota = transport.getBackupQuota(packageName, /* isFullBackup */ false);
             int transportFlags = transport.getTransportFlags();
-            long kvBackupAgentTimeoutMillis =
-                    mAgentTimeoutParameters.getKvBackupAgentTimeoutMillis();
 
             callingAgent = true;
             agentResult =
@@ -720,7 +706,8 @@
                                             quota,
                                             callback,
                                             transportFlags),
-                            kvBackupAgentTimeoutMillis);
+                            mAgentTimeoutParameters.getKvBackupAgentTimeoutMillis(),
+                            "doBackup()");
         } catch (Exception e) {
             mReporter.onCallAgentDoBackupError(packageName, callingAgent, e);
             errorCleanup();
@@ -811,7 +798,8 @@
         }
     }
 
-    private BackupState sendDataToTransport(long agentResult) {
+    /** Returns whether to consume next queue package. */
+    private boolean sendDataToTransport() {
         Preconditions.checkState(mBackupData != null);
 
         String packageName = mCurrentPackage.packageName;
@@ -821,7 +809,7 @@
         try {
             if (!validateBackupData(applicationInfo, mBackupDataFile)) {
                 errorCleanup();
-                return BackupState.RUNNING_QUEUE;
+                return true;
             }
             writingWidgetData = true;
             writeWidgetPayloadIfAppropriate(mBackupData.getFileDescriptor(), packageName);
@@ -832,7 +820,7 @@
                 mReporter.onReadAgentDataError(packageName, e);
             }
             revertTask();
-            return BackupState.FINAL;
+            return false;
         }
 
         clearAgentState();
@@ -892,43 +880,43 @@
         }
     }
 
-    private BackupState handleTransportStatus(int status, String packageName, long size) {
+    /** Returns whether to consume next queue package. */
+    private boolean handleTransportStatus(int status, String packageName, long size) {
         if (status == BackupTransport.TRANSPORT_OK) {
             mReporter.onPackageBackupComplete(packageName, size);
-            return BackupState.RUNNING_QUEUE;
+            return true;
         }
         if (status == BackupTransport.TRANSPORT_PACKAGE_REJECTED) {
             mReporter.onPackageBackupRejected(packageName);
-            return BackupState.RUNNING_QUEUE;
+            return true;
         }
         if (status == BackupTransport.TRANSPORT_NON_INCREMENTAL_BACKUP_REQUIRED) {
             mReporter.onPackageBackupNonIncrementalRequired(mCurrentPackage);
             // Immediately retry the current package.
-            if (PM_PACKAGE.equals(packageName)) {
-                return BackupState.BACKUP_PM;
-            }
             mQueue.add(0, packageName);
-            return BackupState.RUNNING_QUEUE;
+            return true;
         }
         if (status == BackupTransport.TRANSPORT_QUOTA_EXCEEDED) {
             mReporter.onPackageBackupQuotaExceeded(packageName);
             agentDoQuotaExceeded(mAgentBinder, packageName, size);
-            return BackupState.RUNNING_QUEUE;
+            return true;
         }
         // Any other error here indicates a transport-level failure.
         mReporter.onPackageBackupTransportFailure(packageName);
         revertTask();
-        return BackupState.FINAL;
+        return false;
     }
 
-    private void agentDoQuotaExceeded(
-            @Nullable IBackupAgent agent, String packageName, long backupDataSize) {
+    private void agentDoQuotaExceeded(@Nullable IBackupAgent agent, String packageName, long size) {
         if (agent != null) {
             try {
                 IBackupTransport transport =
                         mTransportClient.connectOrThrow("KVBT.agentDoQuotaExceeded()");
                 long quota = transport.getBackupQuota(packageName, false);
-                agent.doQuotaExceeded(backupDataSize, quota);
+                remoteCall(
+                        callback -> agent.doQuotaExceeded(size, quota, callback),
+                        mAgentTimeoutParameters.getQuotaExceededTimeoutMillis(),
+                        "doQuotaExceeded()");
             } catch (Exception e) {
                 mReporter.onAgentDoQuotaExceededError(e);
             }
@@ -1017,16 +1005,6 @@
         mCancelAcknowledged.block();
     }
 
-    private void handleAgentTimeout() {
-        mReporter.onAgentTimedOut(mCurrentPackage);
-        errorCleanup();
-    }
-
-    private void handleAgentCancelled() {
-        mReporter.onAgentCancelled(mCurrentPackage);
-        errorCleanup();
-    }
-
     private void revertTask() {
         mReporter.onRevertTask();
         long delay;
@@ -1079,20 +1057,13 @@
         }
     }
 
-    private RemoteResult remoteCall(RemoteCallable<IBackupCallback> remoteCallable, long timeoutMs)
+    private RemoteResult remoteCall(
+            RemoteCallable<IBackupCallback> remoteCallable, long timeoutMs, String logIdentifier)
             throws RemoteException {
         mPendingCall = new RemoteCall(mCancelled, remoteCallable, timeoutMs);
         RemoteResult result = mPendingCall.call();
-        mReporter.onRemoteCallReturned(result);
+        mReporter.onRemoteCallReturned(result, logIdentifier);
         mPendingCall = null;
         return result;
     }
-
-    private enum BackupState {
-        INITIAL,
-        BACKUP_PM,
-        RUNNING_QUEUE,
-        CANCELLED,
-        FINAL
-    }
 }
diff --git a/services/backup/java/com/android/server/backup/remote/FutureBackupCallback.java b/services/backup/java/com/android/server/backup/remote/FutureBackupCallback.java
index 1445cc3..1ea4249 100644
--- a/services/backup/java/com/android/server/backup/remote/FutureBackupCallback.java
+++ b/services/backup/java/com/android/server/backup/remote/FutureBackupCallback.java
@@ -23,7 +23,7 @@
 
 /**
  * An implementation of {@link IBackupCallback} that completes the {@link CompletableFuture}
- * provided in the constructor with a successful {@link RemoteResult}.
+ * provided in the constructor with a present {@link RemoteResult}.
  */
 public class FutureBackupCallback extends IBackupCallback.Stub {
     private final CompletableFuture<RemoteResult> mFuture;
@@ -34,6 +34,6 @@
 
     @Override
     public void operationComplete(long result) throws RemoteException {
-        mFuture.complete(RemoteResult.successful(result));
+        mFuture.complete(RemoteResult.of(result));
     }
 }
diff --git a/services/backup/java/com/android/server/backup/remote/RemoteCall.java b/services/backup/java/com/android/server/backup/remote/RemoteCall.java
index ac84811..3af9e1d 100644
--- a/services/backup/java/com/android/server/backup/remote/RemoteCall.java
+++ b/services/backup/java/com/android/server/backup/remote/RemoteCall.java
@@ -44,6 +44,21 @@
  */
 // TODO: Kick-off callable in dedicated thread (because of local calls, which are synchronous)
 public class RemoteCall {
+    /**
+     * Creates a {@link RemoteCall} object with {@code callable} and {@code timeoutMs} and calls
+     * {@link #call()} on it immediately after.
+     *
+     * <p>Note that you won't be able to cancel the call, to do that construct an object regularly
+     * first, then use {@link #call()}.
+     *
+     * @see #RemoteCall(RemoteCallable, long)
+     * @see #call()
+     */
+    public static RemoteResult execute(RemoteCallable<IBackupCallback> callable, long timeoutMs)
+            throws RemoteException {
+        return new RemoteCall(callable, timeoutMs).call();
+    }
+
     private final RemoteCallable<IBackupCallback> mCallable;
     private final CompletableFuture<RemoteResult> mFuture;
     private final long mTimeoutMs;
@@ -83,7 +98,7 @@
      *
      * <ul>
      *   <li>The callback passed to {@link RemoteCallable} is called with the result. We return a
-     *       successful {@link RemoteResult} with the result.
+     *       present {@link RemoteResult} with the result.
      *   <li>Time-out happens. We return {@link RemoteResult#FAILED_TIMED_OUT}.
      *   <li>Someone calls {@link #cancel()} on this object. We return {@link
      *       RemoteResult#FAILED_CANCELLED}.
diff --git a/services/backup/java/com/android/server/backup/remote/RemoteResult.java b/services/backup/java/com/android/server/backup/remote/RemoteResult.java
index 7f4f469..63c79db 100644
--- a/services/backup/java/com/android/server/backup/remote/RemoteResult.java
+++ b/services/backup/java/com/android/server/backup/remote/RemoteResult.java
@@ -29,7 +29,7 @@
  * #FAILED_CANCELLED}, {@link #FAILED_THREAD_INTERRUPTED} or a successful result, in which case
  * {@link #get()} returns its value.
  *
- * <p>Use {@link #succeeded()} to check for successful result, or direct identity comparison to
+ * <p>Use {@link #isPresent()} to check for successful result, or direct identity comparison to
  * check for specific failures, like {@code result == RemoteResult.FAILED_CANCELLED}.
  */
 public class RemoteResult {
@@ -38,7 +38,7 @@
     public static final RemoteResult FAILED_THREAD_INTERRUPTED =
             new RemoteResult(Type.FAILED_THREAD_INTERRUPTED, 0);
 
-    public static RemoteResult successful(long value) {
+    public static RemoteResult of(long value) {
         return new RemoteResult(Type.SUCCESS, value);
     }
 
@@ -50,7 +50,7 @@
         mValue = value;
     }
 
-    public boolean succeeded() {
+    public boolean isPresent() {
         return mType == Type.SUCCESS;
     }
 
@@ -60,7 +60,7 @@
      * @throws IllegalStateException in case this is not a successful result.
      */
     public long get() {
-        Preconditions.checkState(succeeded(), "Can't obtain value of failed result");
+        Preconditions.checkState(isPresent(), "Can't obtain value of failed result");
         return mValue;
     }
 
@@ -79,8 +79,9 @@
                 return "FAILED_CANCELLED";
             case Type.FAILED_THREAD_INTERRUPTED:
                 return "FAILED_THREAD_INTERRUPTED";
+            default:
+                throw new AssertionError("Unknown type");
         }
-        throw new AssertionError("Unknown type");
     }
 
     @Override
diff --git a/services/core/java/com/android/server/InputMethodManagerService.java b/services/core/java/com/android/server/InputMethodManagerService.java
index 665c6b7..aa1b303 100644
--- a/services/core/java/com/android/server/InputMethodManagerService.java
+++ b/services/core/java/com/android/server/InputMethodManagerService.java
@@ -1561,7 +1561,6 @@
                 final String defaultImiId = mSettings.getSelectedInputMethod();
                 final boolean imeSelectedOnBoot = !TextUtils.isEmpty(defaultImiId);
                 buildInputMethodListLocked(!imeSelectedOnBoot /* resetDefaultEnabledIme */);
-                resetDefaultImeLocked(mContext);
                 updateFromSettingsLocked(true);
                 InputMethodUtils.setNonSelectedSystemImesDisabledUntilUsed(mIPackageManager,
                         mSettings.getEnabledInputMethodListLocked(), currentUserId,
diff --git a/services/core/java/com/android/server/VibratorService.java b/services/core/java/com/android/server/VibratorService.java
index ae3946a..b2be5e6 100644
--- a/services/core/java/com/android/server/VibratorService.java
+++ b/services/core/java/com/android/server/VibratorService.java
@@ -27,47 +27,46 @@
 import android.hardware.input.InputManager;
 import android.hardware.vibrator.V1_0.EffectStrength;
 import android.icu.text.DateFormat;
+import android.media.AudioAttributes;
 import android.media.AudioManager;
-import android.os.PowerManager.ServiceType;
-import android.os.PowerSaveState;
 import android.os.BatteryStats;
+import android.os.Binder;
 import android.os.Handler;
+import android.os.IBinder;
 import android.os.IVibratorService;
 import android.os.PowerManager;
+import android.os.PowerManager.ServiceType;
 import android.os.PowerManagerInternal;
+import android.os.PowerSaveState;
 import android.os.Process;
 import android.os.RemoteException;
 import android.os.ResultReceiver;
-import android.os.IBinder;
-import android.os.Binder;
 import android.os.ServiceManager;
 import android.os.ShellCallback;
 import android.os.ShellCommand;
 import android.os.SystemClock;
 import android.os.Trace;
 import android.os.UserHandle;
-import android.os.Vibrator;
 import android.os.VibrationEffect;
+import android.os.Vibrator;
 import android.os.WorkSource;
 import android.provider.Settings;
 import android.provider.Settings.SettingNotFoundException;
 import android.util.DebugUtils;
 import android.util.Slog;
 import android.util.SparseArray;
+import android.util.StatsLog;
 import android.view.InputDevice;
-import android.media.AudioAttributes;
 
 import com.android.internal.annotations.GuardedBy;
-import com.android.internal.app.IAppOpsService;
 import com.android.internal.app.IBatteryStats;
 import com.android.internal.util.DumpUtils;
 
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
 import java.util.ArrayList;
-import java.util.LinkedList;
-import java.util.List;
 import java.util.Date;
+import java.util.LinkedList;
 
 public class VibratorService extends IVibratorService.Stub
         implements InputManager.InputDeviceListener {
@@ -1048,6 +1047,8 @@
     private void noteVibratorOnLocked(int uid, long millis) {
         try {
             mBatteryStatsService.noteVibratorOn(uid, millis);
+            StatsLog.write_non_chained(StatsLog.VIBRATOR_STATE_CHANGED, uid, null,
+                    StatsLog.VIBRATOR_STATE_CHANGED__STATE__ON, millis);
             mCurVibUid = uid;
         } catch (RemoteException e) {
         }
@@ -1057,6 +1058,8 @@
         if (mCurVibUid >= 0) {
             try {
                 mBatteryStatsService.noteVibratorOff(mCurVibUid);
+                StatsLog.write_non_chained(StatsLog.VIBRATOR_STATE_CHANGED, mCurVibUid, null,
+                        StatsLog.VIBRATOR_STATE_CHANGED__STATE__OFF, 0);
             } catch (RemoteException e) { }
             mCurVibUid = -1;
         }
diff --git a/services/core/java/com/android/server/am/ActivityDisplay.java b/services/core/java/com/android/server/am/ActivityDisplay.java
index 3568a47..aa5a2e0 100644
--- a/services/core/java/com/android/server/am/ActivityDisplay.java
+++ b/services/core/java/com/android/server/am/ActivityDisplay.java
@@ -138,6 +138,10 @@
         return new DisplayWindowController(mDisplay, this);
     }
 
+    DisplayWindowController getWindowContainerController() {
+        return mWindowContainerController;
+    }
+
     void updateBounds() {
         mDisplay.getSize(mTmpDisplaySize);
         setBounds(0, 0, mTmpDisplaySize.x, mTmpDisplaySize.y);
@@ -837,7 +841,7 @@
         if (mStacks.isEmpty() && mRemoved) {
             mWindowContainerController.removeContainer();
             mWindowContainerController = null;
-            mSupervisor.releaseActivityDisplayLocked(mDisplayId);
+            mSupervisor.removeChild(this);
         }
     }
 
diff --git a/services/core/java/com/android/server/am/ActivityStack.java b/services/core/java/com/android/server/am/ActivityStack.java
index 78fef65..355d890 100644
--- a/services/core/java/com/android/server/am/ActivityStack.java
+++ b/services/core/java/com/android/server/am/ActivityStack.java
@@ -775,6 +775,11 @@
                 true /* includingParents */);
     }
 
+    void positionChildWindowContainerAtBottom(TaskRecord child) {
+        mWindowContainerController.positionChildAtBottom(child.getWindowContainerController(),
+                true /* includingParents */);
+    }
+
     /**
      * Returns whether to defer the scheduling of the multi-window mode.
      */
@@ -2859,8 +2864,7 @@
         final int position = getAdjustedPositionForTask(task, mTaskHistory.size(), starting);
         mTaskHistory.add(position, task);
         updateTaskMovement(task, true);
-        mWindowContainerController.positionChildAtTop(task.getWindowContainerController(),
-                true /* includingParents */);
+        positionChildWindowContainerAtTop(task);
     }
 
     private void insertTaskAtBottom(TaskRecord task) {
@@ -2869,8 +2873,7 @@
         final int position = getAdjustedPositionForTask(task, 0, null);
         mTaskHistory.add(position, task);
         updateTaskMovement(task, true);
-        mWindowContainerController.positionChildAtBottom(task.getWindowContainerController(),
-                true /* includingParents */);
+        positionChildWindowContainerAtBottom(task);
     }
 
     void startActivityLocked(ActivityRecord r, ActivityRecord focusedTopActivity,
@@ -3141,8 +3144,7 @@
                     p.reparent(targetTask, 0 /* position - bottom */, "resetTargetTaskIfNeeded");
                 }
 
-                mWindowContainerController.positionChildAtBottom(
-                        targetTask.getWindowContainerController(), false /* includingParents */);
+                positionChildWindowContainerAtBottom(targetTask);
                 replyChainEnd = -1;
             } else if (forceReset || finishOnTaskLaunch || clearWhenTaskReset) {
                 // If the activity should just be removed -- either
@@ -3277,8 +3279,7 @@
                         if (DEBUG_TASKS) Slog.v(TAG_TASKS, "Pulling activity " + p
                                 + " from " + srcPos + " in to resetting task " + task);
                     }
-                    mWindowContainerController.positionChildAtTop(
-                            task.getWindowContainerController(), true /* includingParents */);
+                    positionChildWindowContainerAtTop(task);
 
                     // Now we've moved it in to place...  but what if this is
                     // a singleTop activity and we have put it on top of another
@@ -5239,8 +5240,7 @@
         addTask(task, toTop ? MAX_VALUE : 0, true /* schedulePictureInPictureModeChange */, reason);
         if (toTop) {
             // TODO: figure-out a way to remove this call.
-            mWindowContainerController.positionChildAtTop(task.getWindowContainerController(),
-                    true /* includingParents */);
+            positionChildWindowContainerAtTop(task);
         }
     }
 
diff --git a/services/core/java/com/android/server/am/ActivityStackSupervisor.java b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
index 4cfcbee..1ffdc67 100644
--- a/services/core/java/com/android/server/am/ActivityStackSupervisor.java
+++ b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
@@ -176,7 +176,10 @@
 import com.android.server.am.ActivityStack.ActivityState;
 import com.android.server.wm.ActivityTaskManagerInternal.SleepToken;
 import com.android.server.wm.ConfigurationContainer;
+import com.android.server.wm.DisplayWindowController;
 import com.android.server.wm.PinnedStackWindowController;
+import com.android.server.wm.RootWindowContainerController;
+import com.android.server.wm.RootWindowContainerListener;
 import com.android.server.wm.WindowManagerService;
 
 import java.io.FileDescriptor;
@@ -190,7 +193,7 @@
 import java.util.Set;
 
 public class ActivityStackSupervisor extends ConfigurationContainer implements DisplayListener,
-        RecentTasks.Callbacks {
+        RecentTasks.Callbacks, RootWindowContainerListener {
     private static final String TAG = TAG_WITH_CLASS_NAME ? "ActivityStackSupervisor" : TAG_AM;
     private static final String TAG_FOCUS = TAG + POSTFIX_FOCUS;
     private static final String TAG_IDLE = TAG + POSTFIX_IDLE;
@@ -416,9 +419,14 @@
     /** Stack id of the front stack when user switched, indexed by userId. */
     SparseIntArray mUserStackInFront = new SparseIntArray(2);
 
-    // TODO: There should be an ActivityDisplayController coordinating am/wm interaction.
-    /** Mapping from displayId to display current state */
-    private final SparseArray<ActivityDisplay> mActivityDisplays = new SparseArray<>();
+    /** Reference to default display so we can quickly look it up. */
+    private ActivityDisplay mDefaultDisplay;
+
+    /**
+     * List of displays which contain activities, sorted by z-order.
+     * The last entry in the list is the topmost.
+     */
+    private final ArrayList<ActivityDisplay> mActivityDisplays = new ArrayList<>();
 
     private final SparseArray<IntArray> mDisplayAccessUIDs = new SparseArray<>();
 
@@ -453,7 +461,7 @@
 
     @Override
     protected ActivityDisplay getChildAt(int index) {
-        return mActivityDisplays.valueAt(index);
+        return mActivityDisplays.get(index);
     }
 
     @Override
@@ -531,13 +539,6 @@
     private final FindTaskResult mTmpFindTaskResult = new FindTaskResult();
 
     /**
-     * Temp storage for display ids sorted in focus order.
-     * Maps position to id. Using {@link SparseIntArray} instead of {@link ArrayList} because
-     * it's more efficient, as the number of displays is usually small.
-     */
-    private SparseIntArray mTmpOrderedDisplayIds = new SparseIntArray();
-
-    /**
      * Used to keep track whether app visibilities got changed since the last pause. Useful to
      * determine whether to invoke the task stack change listener after pausing.
      */
@@ -569,6 +570,8 @@
 
     private boolean mInitialized;
 
+    private RootWindowContainerController mWindowContainerController;
+
     /**
      * Description of a request to start a new activity, which has been held
      * due to app switches being disabled.
@@ -612,6 +615,11 @@
         mService = service;
     }
 
+    @VisibleForTesting
+    void setWindowContainerController(RootWindowContainerController controller) {
+        mWindowContainerController = controller;
+    }
+
     public void initialize() {
         if (mInitialized) {
             return;
@@ -664,38 +672,57 @@
     void setWindowManager(WindowManagerService wm) {
         mWindowManager = wm;
         getKeyguardController().setWindowManager(wm);
+        setWindowContainerController(new RootWindowContainerController(this));
 
-        mDisplayManager =
-                (DisplayManager) mService.mContext.getSystemService(Context.DISPLAY_SERVICE);
+        mDisplayManager = mService.mContext.getSystemService(DisplayManager.class);
         mDisplayManager.registerDisplayListener(this, null);
         mDisplayManagerInternal = LocalServices.getService(DisplayManagerInternal.class);
 
-        Display[] displays = mDisplayManager.getDisplays();
+        final Display[] displays = mDisplayManager.getDisplays();
         for (int displayNdx = displays.length - 1; displayNdx >= 0; --displayNdx) {
             final Display display = displays[displayNdx];
-            ActivityDisplay activityDisplay = new ActivityDisplay(this, display);
-            mActivityDisplays.put(display.getDisplayId(), activityDisplay);
+            final ActivityDisplay activityDisplay = new ActivityDisplay(this, display);
+            if (activityDisplay.mDisplayId == DEFAULT_DISPLAY) {
+                mDefaultDisplay = activityDisplay;
+            }
+            addChild(activityDisplay, ActivityDisplay.POSITION_TOP);
             calculateDefaultMinimalSizeOfResizeableTasks(activityDisplay);
         }
 
         final ActivityDisplay defaultDisplay = getDefaultDisplay();
         mHomeStack = mLastFocusedStack = defaultDisplay.getOrCreateStack(
                 WINDOWING_MODE_FULLSCREEN, ACTIVITY_TYPE_HOME, ON_TOP);
+        positionChildAt(defaultDisplay, ActivityDisplay.POSITION_TOP);
+    }
+
+    /** Change the z-order of the given display. */
+    private void positionChildAt(ActivityDisplay display, int position) {
+        if (position >= mActivityDisplays.size()) {
+            position = mActivityDisplays.size() - 1;
+        } else if (position < 0) {
+            position = 0;
+        }
+
+        if (mActivityDisplays.isEmpty()) {
+            mActivityDisplays.add(display);
+        } else if (mActivityDisplays.get(position) != display) {
+            mActivityDisplays.remove(display);
+            mActivityDisplays.add(position, display);
+        }
+    }
+
+    @Override
+    public void onChildPositionChanged(DisplayWindowController childController, int position) {
+        // Assume AM lock is held from positionChildAt of controller in each hierarchy.
+        final ActivityDisplay display = getActivityDisplay(childController.getDisplayId());
+        if (display != null) {
+            positionChildAt(display, position);
+        }
     }
 
     ActivityStack getTopDisplayFocusedStack() {
-        mWindowManager.getDisplaysInFocusOrder(mTmpOrderedDisplayIds);
-
-        for (int i = mTmpOrderedDisplayIds.size() - 1; i >= 0; --i) {
-            final int displayId = mTmpOrderedDisplayIds.get(i);
-            final ActivityDisplay display = mActivityDisplays.get(displayId);
-
-            // If WindowManagerService has encountered the display before we have, ignore as there
-            // will be no stacks present and therefore no activities.
-            if (display == null) {
-                continue;
-            }
-            final ActivityStack focusedStack = display.getFocusedStack();
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityStack focusedStack = mActivityDisplays.get(i).getFocusedStack();
             if (focusedStack != null) {
                 return focusedStack;
             }
@@ -718,16 +745,8 @@
         }
         // The top focused stack might not have a resumed activity yet - look on all displays in
         // focus order.
-        mWindowManager.getDisplaysInFocusOrder(mTmpOrderedDisplayIds);
-        for (int i = mTmpOrderedDisplayIds.size() - 1; i >= 0; --i) {
-            final int displayId = mTmpOrderedDisplayIds.get(i);
-            final ActivityDisplay display = mActivityDisplays.get(displayId);
-
-            // If WindowManagerService has encountered the display before we have, ignore as there
-            // will be no stacks present and therefore no activities.
-            if (display == null) {
-                continue;
-            }
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityDisplay display = mActivityDisplays.get(i);
             final ActivityRecord resumedActivityOnDisplay = display.getResumedActivity();
             if (resumedActivityOnDisplay != null) {
                 return resumedActivityOnDisplay;
@@ -848,7 +867,7 @@
 
         int numDisplays = mActivityDisplays.size();
         for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final TaskRecord task = stack.taskForIdLocked(id);
@@ -905,7 +924,7 @@
     ActivityRecord isInAnyStackLocked(IBinder token) {
         int numDisplays = mActivityDisplays.size();
         for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final ActivityRecord r = stack.isInStackLocked(token);
@@ -947,7 +966,7 @@
         mWindowManager.deferSurfaceLayout();
         try {
             for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-                final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+                final ActivityDisplay display = mActivityDisplays.get(displayNdx);
                 for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                     final ActivityStack stack = display.getChildAt(stackNdx);
                     final List<TaskRecord> tasks = stack.getAllTasks();
@@ -1011,7 +1030,7 @@
         final String processName = app.processName;
         boolean didSomething = false;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (!isTopDisplayFocusedStack(stack)) {
@@ -1046,7 +1065,7 @@
 
     boolean allResumedActivitiesIdle() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (!isTopDisplayFocusedStack(stack) || stack.numActivities() == 0) {
@@ -1067,7 +1086,7 @@
 
     boolean allResumedActivitiesComplete() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (isTopDisplayFocusedStack(stack)) {
@@ -1090,7 +1109,7 @@
     private boolean allResumedActivitiesVisible() {
         boolean foundResumed = false;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final ActivityRecord r = stack.getResumedActivity();
@@ -1116,7 +1135,7 @@
     boolean pauseBackStacks(boolean userLeaving, ActivityRecord resuming, boolean dontWait) {
         boolean someActivityPaused = false;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            someActivityPaused |= mActivityDisplays.valueAt(displayNdx)
+            someActivityPaused |= mActivityDisplays.get(displayNdx)
                     .pauseBackStacks(userLeaving, resuming, dontWait);
         }
         return someActivityPaused;
@@ -1125,7 +1144,7 @@
     boolean allPausedActivitiesComplete() {
         boolean pausing = true;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final ActivityRecord r = stack.mPausingActivity;
@@ -1145,7 +1164,7 @@
 
     void cancelInitializingActivities() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.cancelInitializingActivities();
@@ -1266,17 +1285,8 @@
         }
 
         // Look in other non-focused and non-home stacks.
-        mWindowManager.getDisplaysInFocusOrder(mTmpOrderedDisplayIds);
-
-        for (int i = mTmpOrderedDisplayIds.size() - 1; i >= 0; --i) {
-            final int displayId = mTmpOrderedDisplayIds.get(i);
-            final ActivityDisplay display = mActivityDisplays.get(displayId);
-
-            // If WindowManagerService has encountered the display before we have, ignore as there
-            // will be no stacks present and therefore no activities.
-            if (display == null) {
-                continue;
-            }
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityDisplay display = mActivityDisplays.get(i);
 
             // TODO: We probably want to consider the top fullscreen stack as we could have a pinned
             // stack on top.
@@ -1757,7 +1767,7 @@
             boolean noResumedActivities = true;
             boolean allFocusedProcessesDiffer = true;
             for (int displayNdx = 0; displayNdx < mActivityDisplays.size(); ++displayNdx) {
-                final ActivityDisplay activityDisplay = mActivityDisplays.valueAt(displayNdx);
+                final ActivityDisplay activityDisplay = mActivityDisplays.get(displayNdx);
                 final ActivityRecord resumedActivity = activityDisplay.getResumedActivity();
                 final WindowProcessController resumedActivityProcess =
                     resumedActivity == null ? null : resumedActivity.app;
@@ -1927,7 +1937,7 @@
     void updateUIDsPresentOnDisplay() {
         mDisplayAccessUIDs.clear();
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay activityDisplay = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay activityDisplay = mActivityDisplays.get(displayNdx);
             // Only bother calculating the whitelist for private displays
             if (activityDisplay.isPrivate()) {
                 mDisplayAccessUIDs.append(
@@ -2173,7 +2183,7 @@
     boolean handleAppDiedLocked(WindowProcessController app) {
         boolean hasVisibleActivities = false;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 hasVisibleActivities |= stack.handleAppDiedLocked(app);
@@ -2184,7 +2194,7 @@
 
     void closeSystemDialogsLocked() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.closeSystemDialogsLocked();
@@ -2213,7 +2223,7 @@
             boolean doit, boolean evenPersistent, int userId) {
         boolean didSomething = false;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (stack.finishDisabledPackageActivitiesLocked(
@@ -2235,7 +2245,7 @@
         // hosted by the process that is actually still the foreground.
         WindowProcessController fgApp = null;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (isTopDisplayFocusedStack(stack)) {
@@ -2277,7 +2287,7 @@
 
         // Resume all top activities in focused stacks on all displays.
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             final ActivityStack focusedStack = display.getFocusedStack();
             if (focusedStack == null) {
                 continue;
@@ -2296,7 +2306,7 @@
 
     void updateActivityApplicationInfoLocked(ApplicationInfo aInfo) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.updateActivityApplicationInfoLocked(aInfo);
@@ -2314,7 +2324,7 @@
         TaskRecord finishedTask = null;
         ActivityStack focusedStack = getTopDisplayFocusedStack();
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             // It is possible that request to finish activity might also remove its task and stack,
             // so we need to be careful with indexes in the loop and check child count every time.
             for (int stackNdx = 0; stackNdx < display.getChildCount(); ++stackNdx) {
@@ -2330,7 +2340,7 @@
 
     void finishVoiceTask(IVoiceInteractionSession session) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             final int numStacks = display.getChildCount();
             for (int stackNdx = 0; stackNdx < numStacks; ++stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
@@ -2417,7 +2427,7 @@
 
     protected <T extends ActivityStack> T getStack(int stackId) {
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            final T stack = mActivityDisplays.valueAt(i).getStack(stackId);
+            final T stack = mActivityDisplays.get(i).getStack(stackId);
             if (stack != null) {
                 return stack;
             }
@@ -2428,7 +2438,7 @@
     /** @see ActivityDisplay#getStack(int, int) */
     private <T extends ActivityStack> T getStack(int windowingMode, int activityType) {
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            final T stack = mActivityDisplays.valueAt(i).getStack(windowingMode, activityType);
+            final T stack = mActivityDisplays.get(i).getStack(windowingMode, activityType);
             if (stack != null) {
                 return stack;
             }
@@ -2642,19 +2652,12 @@
         }
 
         // Now look through all displays
-        mWindowManager.getDisplaysInFocusOrder(mTmpOrderedDisplayIds);
-        for (int i = mTmpOrderedDisplayIds.size() - 1; i >= 0; --i) {
-            final int displayId = mTmpOrderedDisplayIds.get(i);
-            if (displayId == preferredDisplay.mDisplayId) {
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityDisplay display = mActivityDisplays.get(i);
+            if (display == preferredDisplay) {
                 // We've already checked this one
                 continue;
             }
-            // If a display is registered in WM, it must also be available in AM.
-            final ActivityDisplay display = getActivityDisplayOrCreateLocked(displayId);
-            if (display == null) {
-                // Looks like the display no longer exists in the system...
-                continue;
-            }
             final ActivityStack nextFocusableStack = display.getNextFocusableStack(currentFocus,
                     ignoreCurrent);
             if (nextFocusableStack != null) {
@@ -2676,13 +2679,12 @@
      * @return Next valid {@link ActivityStack}, null if not found.
      */
     ActivityStack getNextValidLaunchStackLocked(@NonNull ActivityRecord r, int currentFocus) {
-        mWindowManager.getDisplaysInFocusOrder(mTmpOrderedDisplayIds);
-        for (int i = mTmpOrderedDisplayIds.size() - 1; i >= 0; --i) {
-            final int displayId = mTmpOrderedDisplayIds.get(i);
-            if (displayId == currentFocus) {
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityDisplay display = mActivityDisplays.get(i);
+            if (display.mDisplayId == currentFocus) {
                 continue;
             }
-            final ActivityStack stack = getValidLaunchStackOnDisplay(displayId, r,
+            final ActivityStack stack = getValidLaunchStackOnDisplay(display.mDisplayId, r,
                     null /* options */);
             if (stack != null) {
                 return stack;
@@ -3081,13 +3083,13 @@
      */
     void removeStacksInWindowingModes(int... windowingModes) {
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            mActivityDisplays.valueAt(i).removeStacksInWindowingModes(windowingModes);
+            mActivityDisplays.get(i).removeStacksInWindowingModes(windowingModes);
         }
     }
 
     void removeStacksWithActivityTypes(int... activityTypes) {
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            mActivityDisplays.valueAt(i).removeStacksWithActivityTypes(activityTypes);
+            mActivityDisplays.get(i).removeStacksWithActivityTypes(activityTypes);
         }
     }
 
@@ -3463,7 +3465,7 @@
         ActivityRecord affinityMatch = null;
         if (DEBUG_TASKS) Slog.d(TAG_TASKS, "Looking for task of " + r);
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (!r.hasCompatibleActivityType(stack)) {
@@ -3500,7 +3502,7 @@
     ActivityRecord findActivityLocked(Intent intent, ActivityInfo info,
             boolean compareIntentFilters) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final ActivityRecord ar = stack.findActivityLocked(
@@ -3515,7 +3517,7 @@
 
     boolean hasAwakeDisplay() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             if (!display.shouldSleep()) {
                 return true;
             }
@@ -3543,7 +3545,7 @@
 
     void prepareForShutdownLocked() {
         for (int i = 0; i < mActivityDisplays.size(); i++) {
-            createSleepTokenLocked("shutdown", mActivityDisplays.keyAt(i));
+            createSleepTokenLocked("shutdown", mActivityDisplays.get(i).mDisplayId);
         }
     }
 
@@ -3586,7 +3588,7 @@
     void applySleepTokensLocked(boolean applyToStacks) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
             // Set the sleeping state of the display.
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             final boolean displayShouldSleep = display.shouldSleep();
             if (displayShouldSleep == display.isSleeping()) {
                 continue;
@@ -3666,7 +3668,7 @@
     private boolean putStacksToSleepLocked(boolean allowDelay, boolean shuttingDown) {
         boolean allSleep = true;
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 if (allowDelay) {
@@ -3697,7 +3699,7 @@
 
     void handleAppCrashLocked(WindowProcessController app) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.handleAppCrashLocked(app);
@@ -3746,7 +3748,7 @@
         try {
             // First the front stacks. In case any are not fullscreen and are in front of home.
             for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-                final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+                final ActivityDisplay display = mActivityDisplays.get(displayNdx);
                 for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                     final ActivityStack stack = display.getChildAt(stackNdx);
                     stack.ensureActivitiesVisibleLocked(starting, configChanges, preserveWindows,
@@ -3760,7 +3762,7 @@
 
     void addStartingWindowsForVisibleActivities(boolean taskSwitch) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.addStartingWindowsForVisibleActivities(taskSwitch);
@@ -3778,7 +3780,7 @@
         }
         mTaskLayersChanged = false;
         for (int displayNdx = 0; displayNdx < mActivityDisplays.size(); displayNdx++) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             int baseLayer = 0;
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
@@ -3789,7 +3791,7 @@
 
     void clearOtherAppTimeTrackers(AppTimeTracker except) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.clearOtherAppTimeTrackers(except);
@@ -3799,7 +3801,7 @@
 
     void scheduleDestroyAllActivities(WindowProcessController app, String reason) {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.scheduleDestroyActivities(app, reason);
@@ -3818,7 +3820,7 @@
         // let's iterate through the tasks and release the oldest one.
         final int numDisplays = mActivityDisplays.size();
         for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             final int stackCount = display.getChildCount();
             // Step through all stacks starting from behind, to hit the oldest things first.
             for (int stackNdx = 0; stackNdx < stackCount; stackNdx++) {
@@ -3849,7 +3851,7 @@
 
         mStartingUsers.add(uss);
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 stack.switchUserLocked(userId);
@@ -3953,7 +3955,7 @@
 
     void validateTopActivitiesLocked() {
         for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 final ActivityRecord r = stack.topRunningActivityLocked();
@@ -3984,7 +3986,7 @@
 
     public void dumpDisplays(PrintWriter pw) {
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(i);
+            final ActivityDisplay display = mActivityDisplays.get(i);
             pw.print("[id:" + display.mDisplayId + " stacks:");
             display.dumpStacks(pw);
             pw.print("]");
@@ -3998,7 +4000,7 @@
         pw.println("mCurTaskIdForUser=" + mCurTaskIdForUser);
         pw.print(prefix); pw.println("mUserStackInFront=" + mUserStackInFront);
         for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(i);
+            final ActivityDisplay display = mActivityDisplays.get(i);
             display.dump(pw, prefix);
         }
         if (!mWaitingForActivityVisible.isEmpty()) {
@@ -4018,7 +4020,7 @@
         final long token = proto.start(fieldId);
         super.writeToProto(proto, CONFIGURATION_CONTAINER, false /* trim */);
         for (int displayNdx = 0; displayNdx < mActivityDisplays.size(); ++displayNdx) {
-            final ActivityDisplay activityDisplay = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay activityDisplay = mActivityDisplays.get(displayNdx);
             activityDisplay.writeToProto(proto, DISPLAYS);
         }
         getKeyguardController().writeToProto(proto, KEYGUARD_CONTROLLER);
@@ -4047,7 +4049,7 @@
         pw.print(prefix); pw.println("Display override configurations:");
         final int displayCount = mActivityDisplays.size();
         for (int i = 0; i < displayCount; i++) {
-            final ActivityDisplay activityDisplay = mActivityDisplays.valueAt(i);
+            final ActivityDisplay activityDisplay = mActivityDisplays.get(i);
             pw.print(prefix); pw.print("  "); pw.print(activityDisplay.mDisplayId); pw.print(": ");
                     pw.println(activityDisplay.getOverrideConfiguration());
         }
@@ -4065,7 +4067,7 @@
             ArrayList<ActivityRecord> activities = new ArrayList<>();
             int numDisplays = mActivityDisplays.size();
             for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
-                final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+                final ActivityDisplay display = mActivityDisplays.get(displayNdx);
                 for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                     final ActivityStack stack = display.getChildAt(stackNdx);
                     if (!dumpVisibleStacksOnly || stack.shouldBeVisible(null)) {
@@ -4096,11 +4098,11 @@
             boolean dumpClient, String dumpPackage) {
         boolean printed = false;
         boolean needSep = false;
-        for (int displayNdx = 0; displayNdx < mActivityDisplays.size(); ++displayNdx) {
-            ActivityDisplay activityDisplay = mActivityDisplays.valueAt(displayNdx);
+        for (int displayNdx = mActivityDisplays.size() - 1; displayNdx >= 0; --displayNdx) {
+            ActivityDisplay activityDisplay = mActivityDisplays.get(displayNdx);
             pw.print("Display #"); pw.print(activityDisplay.mDisplayId);
                     pw.println(" (activities from top to bottom):");
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 pw.println();
@@ -4299,12 +4301,18 @@
 
     // TODO: Look into consolidating with getActivityDisplayOrCreateLocked()
     ActivityDisplay getActivityDisplay(int displayId) {
-        return mActivityDisplays.get(displayId);
+        for (int i = mActivityDisplays.size() - 1; i >= 0; --i) {
+            final ActivityDisplay activityDisplay = mActivityDisplays.get(i);
+            if (activityDisplay.mDisplayId == displayId) {
+                return activityDisplay;
+            }
+        }
+        return null;
     }
 
     // TODO(multi-display): Look at all callpoints to make sure they make sense in multi-display.
     ActivityDisplay getDefaultDisplay() {
-        return mActivityDisplays.get(DEFAULT_DISPLAY);
+        return mDefaultDisplay;
     }
 
     /**
@@ -4313,7 +4321,7 @@
      */
     // TODO: Look into consolidating with getActivityDisplay()
     ActivityDisplay getActivityDisplayOrCreateLocked(int displayId) {
-        ActivityDisplay activityDisplay = mActivityDisplays.get(displayId);
+        ActivityDisplay activityDisplay = getActivityDisplay(displayId);
         if (activityDisplay != null) {
             return activityDisplay;
         }
@@ -4328,15 +4336,23 @@
         }
         // The display hasn't been added to ActivityManager yet, create a new record now.
         activityDisplay = new ActivityDisplay(this, display);
-        attachDisplay(activityDisplay);
+        addChild(activityDisplay, ActivityDisplay.POSITION_BOTTOM);
         calculateDefaultMinimalSizeOfResizeableTasks(activityDisplay);
         mWindowManager.onDisplayAdded(displayId);
         return activityDisplay;
     }
 
     @VisibleForTesting
-    void attachDisplay(ActivityDisplay display) {
-        mActivityDisplays.put(display.mDisplayId, display);
+    void addChild(ActivityDisplay activityDisplay, int position) {
+        positionChildAt(activityDisplay, position);
+        mWindowContainerController.positionChildAt(
+                activityDisplay.getWindowContainerController(), position);
+    }
+
+    void removeChild(ActivityDisplay activityDisplay) {
+        // The caller must tell the controller of {@link ActivityDisplay} to release its container
+        // {@link DisplayContent}. That is done in {@link ActivityDisplay#releaseSelfIfNeeded}).
+        mActivityDisplays.remove(activityDisplay);
     }
 
     private void calculateDefaultMinimalSizeOfResizeableTasks(ActivityDisplay display) {
@@ -4351,7 +4367,7 @@
         }
 
         synchronized (mService.mGlobalLock) {
-            final ActivityDisplay activityDisplay = mActivityDisplays.get(displayId);
+            final ActivityDisplay activityDisplay = getActivityDisplay(displayId);
             if (activityDisplay == null) {
                 return;
             }
@@ -4362,14 +4378,9 @@
         }
     }
 
-    void releaseActivityDisplayLocked(int displayId) {
-        mActivityDisplays.remove(displayId);
-    }
-
-
     private void handleDisplayChanged(int displayId) {
         synchronized (mService.mGlobalLock) {
-            ActivityDisplay activityDisplay = mActivityDisplays.get(displayId);
+            ActivityDisplay activityDisplay = getActivityDisplay(displayId);
             // TODO: The following code block should be moved into {@link ActivityDisplay}.
             if (activityDisplay != null) {
                 // The window policy is responsible for stopping activities on the default display
@@ -4392,7 +4403,7 @@
     }
 
     SleepToken createSleepTokenLocked(String tag, int displayId) {
-        ActivityDisplay display = mActivityDisplays.get(displayId);
+        final ActivityDisplay display = getActivityDisplay(displayId);
         if (display == null) {
             throw new IllegalArgumentException("Invalid display: " + displayId);
         }
@@ -4406,7 +4417,7 @@
     private void removeSleepTokenLocked(SleepTokenImpl token) {
         mSleepTokens.remove(token);
 
-        ActivityDisplay display = mActivityDisplays.get(token.mDisplayId);
+        final ActivityDisplay display = getActivityDisplay(token.mDisplayId);
         if (display != null) {
             display.mAllSleepTokens.remove(token);
             if (display.mAllSleepTokens.isEmpty()) {
@@ -4429,7 +4440,7 @@
 
     private StackInfo getStackInfo(ActivityStack stack) {
         final int displayId = stack.mDisplayId;
-        final ActivityDisplay display = mActivityDisplays.get(displayId);
+        final ActivityDisplay display = getActivityDisplay(displayId);
         StackInfo info = new StackInfo();
         stack.getWindowContainerBounds(info.bounds);
         info.displayId = displayId;
@@ -4483,7 +4494,7 @@
     ArrayList<StackInfo> getAllStackInfosLocked() {
         ArrayList<StackInfo> list = new ArrayList<>();
         for (int displayNdx = 0; displayNdx < mActivityDisplays.size(); ++displayNdx) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = mActivityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 list.add(getStackInfo(stack));
@@ -4765,14 +4776,12 @@
     }
 
     ActivityStack findStackBehind(ActivityStack stack) {
-        // TODO(multi-display): We are only looking for stacks on the default display.
-        final ActivityDisplay display = mActivityDisplays.get(DEFAULT_DISPLAY);
-        if (display == null) {
-            return null;
-        }
-        for (int i = display.getChildCount() - 1; i >= 0; i--) {
-            if (display.getChildAt(i) == stack && i > 0) {
-                return display.getChildAt(i - 1);
+        final ActivityDisplay display = getActivityDisplay(stack.mDisplayId);
+        if (display != null) {
+            for (int i = display.getChildCount() - 1; i >= 0; i--) {
+                if (display.getChildAt(i) == stack && i > 0) {
+                    return display.getChildAt(i - 1);
+                }
             }
         }
         throw new IllegalStateException("Failed to find a stack behind stack=" + stack
@@ -4904,7 +4913,7 @@
         final ActivityStack topFocusedStack = getTopDisplayFocusedStack();
         // Traverse all displays.
         for (int i = mActivityDisplays.size() - 1; i >= 0; i--) {
-            final ActivityDisplay display = mActivityDisplays.valueAt(i);
+            final ActivityDisplay display = mActivityDisplays.get(i);
             // Traverse all stacks on a display.
             for (int j = display.getChildCount() - 1; j >= 0; --j) {
                 final ActivityStack stack = display.getChildAt(j);
diff --git a/services/core/java/com/android/server/am/RunningTasks.java b/services/core/java/com/android/server/am/RunningTasks.java
index 7008cee..d878f51 100644
--- a/services/core/java/com/android/server/am/RunningTasks.java
+++ b/services/core/java/com/android/server/am/RunningTasks.java
@@ -16,13 +16,9 @@
 
 package com.android.server.am;
 
-import static com.android.server.am.ActivityManagerDebugConfig.TAG_AM;
-import static com.android.server.am.ActivityManagerDebugConfig.TAG_WITH_CLASS_NAME;
-
 import android.app.ActivityManager.RunningTaskInfo;
 import android.app.WindowConfiguration.ActivityType;
 import android.app.WindowConfiguration.WindowingMode;
-import android.util.SparseArray;
 
 import java.util.ArrayList;
 import java.util.Comparator;
@@ -45,7 +41,7 @@
     private final ArrayList<TaskRecord> mTmpStackTasks = new ArrayList<>();
 
     void getTasks(int maxNum, List<RunningTaskInfo> list, @ActivityType int ignoreActivityType,
-            @WindowingMode int ignoreWindowingMode, SparseArray<ActivityDisplay> activityDisplays,
+            @WindowingMode int ignoreWindowingMode, ArrayList<ActivityDisplay> activityDisplays,
             int callingUid, boolean allowed) {
         // Return early if there are no tasks to fetch
         if (maxNum <= 0) {
@@ -56,7 +52,7 @@
         mTmpSortedSet.clear();
         final int numDisplays = activityDisplays.size();
         for (int displayNdx = 0; displayNdx < numDisplays; ++displayNdx) {
-            final ActivityDisplay display = activityDisplays.valueAt(displayNdx);
+            final ActivityDisplay display = activityDisplays.get(displayNdx);
             for (int stackNdx = display.getChildCount() - 1; stackNdx >= 0; --stackNdx) {
                 final ActivityStack stack = display.getChildAt(stackNdx);
                 mTmpStackTasks.clear();
diff --git a/services/core/java/com/android/server/biometrics/AuthenticationClient.java b/services/core/java/com/android/server/biometrics/AuthenticationClient.java
index 06462a2..36e7cba 100644
--- a/services/core/java/com/android/server/biometrics/AuthenticationClient.java
+++ b/services/core/java/com/android/server/biometrics/AuthenticationClient.java
@@ -21,7 +21,6 @@
 import android.hardware.biometrics.BiometricConstants;
 import android.hardware.biometrics.BiometricPrompt;
 import android.hardware.biometrics.IBiometricPromptReceiver;
-import android.hardware.fingerprint.FingerprintManager;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
@@ -45,17 +44,16 @@
     public static final int LOCKOUT_TIMED = 1;
     public static final int LOCKOUT_PERMANENT = 2;
 
+    private final BiometricAuthenticator mAuthenticator;
     // Callback mechanism received from the client
-    // (BiometricPrompt -> FingerprintManager -> FingerprintService -> AuthenticationClient)
+    // (BiometricPrompt -> BiometricPromptService -> <Biometric>Service -> AuthenticationClient)
     private IBiometricPromptReceiver mDialogReceiverFromClient;
     private Bundle mBundle;
     private IStatusBarService mStatusBarService;
     private boolean mInLockout;
-    // TODO: BiometricManager, after other biometric modalities are introduced.
-    private final FingerprintManager mFingerprintManager;
     protected boolean mDialogDismissed;
 
-    // Receives events from SystemUI and handles them before forwarding them to FingerprintDialog
+    // Receives events from SystemUI and handles them before forwarding them to BiometricDialog
     protected IBiometricPromptReceiver mDialogReceiver = new IBiometricPromptReceiver.Stub() {
         @Override // binder call
         public void onDialogDismissed(int reason) {
@@ -81,7 +79,7 @@
     public abstract void onStart();
 
     /**
-     * This method is called when a fingerprint is authenticated or authentication is stopped
+     * This method is called when a biometric is authenticated or authentication is stopped
      * (cancelled by the user, or an error such as lockout has occurred).
      */
     public abstract void onStop();
@@ -90,15 +88,15 @@
             BiometricService.DaemonWrapper daemon, long halDeviceId, IBinder token,
             BiometricService.ServiceListener listener, int targetUserId, int groupId, long opId,
             boolean restricted, String owner, Bundle bundle,
-            IBiometricPromptReceiver dialogReceiver, IStatusBarService statusBarService) {
+            IBiometricPromptReceiver dialogReceiver, IStatusBarService statusBarService,
+            BiometricAuthenticator authenticator) {
         super(context, metrics, daemon, halDeviceId, token, listener, targetUserId, groupId,
                 restricted, owner);
         mOpId = opId;
         mBundle = bundle;
         mDialogReceiverFromClient = dialogReceiver;
         mStatusBarService = statusBarService;
-        mFingerprintManager = (FingerprintManager) getContext()
-                .getSystemService(Context.FINGERPRINT_SERVICE);
+        mAuthenticator = authenticator;
         mHandler = new Handler(Looper.getMainLooper());
     }
 
@@ -118,7 +116,7 @@
             try {
                 if (acquiredInfo != BiometricConstants.BIOMETRIC_ACQUIRED_GOOD) {
                     mStatusBarService.onBiometricHelp(
-                            mFingerprintManager.getAcquiredString(acquiredInfo, vendorCode));
+                            mAuthenticator.getAcquiredString(acquiredInfo, vendorCode));
                 }
                 return false; // acquisition continues
             } catch (RemoteException e) {
@@ -139,15 +137,15 @@
     public boolean onError(long deviceId, int error, int vendorCode) {
         if (mDialogDismissed) {
             // If user cancels authentication, the application has already received the
-            // FingerprintManager.FINGERPRINT_ERROR_USER_CANCELED message from onDialogDismissed()
-            // and stopped the fingerprint hardware, so there is no need to send a
-            // FingerprintManager.FINGERPRINT_ERROR_CANCELED message.
+            // ERROR_USER_CANCELED message from onDialogDismissed()
+            // and stopped the biometric hardware, so there is no need to send a
+            // ERROR_CANCELED message.
             return true;
         }
         if (mBundle != null) {
             try {
                 mStatusBarService.onBiometricError(
-                        mFingerprintManager.getErrorString(error, vendorCode));
+                        mAuthenticator.getErrorString(error, vendorCode));
             } catch (RemoteException e) {
                 Slog.e(getLogTag(), "Remote exception when sending error", e);
             }
@@ -160,15 +158,14 @@
             boolean authenticated) {
         boolean result = false;
 
-        // If the fingerprint dialog is showing, notify authentication succeeded
-        // TODO: this goes to BiometricPrompt, split between biometric modalities
+        // If the biometric dialog is showing, notify authentication succeeded
         if (mBundle != null) {
             try {
                 if (authenticated) {
                     mStatusBarService.onBiometricAuthenticated();
                 } else {
                     mStatusBarService.onBiometricHelp(getContext().getResources().getString(
-                            com.android.internal.R.string.fingerprint_not_recognized));
+                            com.android.internal.R.string.biometric_not_recognized));
                 }
             } catch (RemoteException e) {
                 Slog.e(getLogTag(), "Failed to notify Authenticated:", e);
@@ -223,7 +220,7 @@
                     // Send the lockout message to the system dialog
                     if (mBundle != null) {
                         mStatusBarService.onBiometricError(
-                                mFingerprintManager.getErrorString(errorCode, 0 /* vendorCode */));
+                                mAuthenticator.getErrorString(errorCode, 0 /* vendorCode */));
                         mHandler.postDelayed(() -> {
                             try {
                                 listener.onError(getHalDeviceId(), errorCode, 0 /* vendorCode */);
@@ -243,7 +240,7 @@
             if (listener != null) {
                 vibrateSuccess();
             }
-            result |= true; // we have a valid fingerprint, done
+            result |= true; // we have a valid biometric, done
             resetFailedAttempts();
             onStop();
         }
@@ -270,9 +267,10 @@
             // If authenticating with system dialog, show the dialog
             if (mBundle != null) {
                 try {
-                    mStatusBarService.showBiometricDialog(mBundle, mDialogReceiver);
+                    mStatusBarService.showBiometricDialog(mBundle, mDialogReceiver,
+                            mAuthenticator.getType());
                 } catch (RemoteException e) {
-                    Slog.e(getLogTag(), "Unable to show fingerprint dialog", e);
+                    Slog.e(getLogTag(), "Unable to show biometric dialog", e);
                 }
             }
         } catch (RemoteException e) {
@@ -297,7 +295,8 @@
                 Slog.w(getLogTag(), "stopAuthentication failed, result=" + result);
                 return result;
             }
-            if (DEBUG) Slog.w(getLogTag(), "client " + getOwnerString() + " is no longer authenticating");
+            if (DEBUG) Slog.w(getLogTag(), "client " + getOwnerString() +
+                    " is no longer authenticating");
         } catch (RemoteException e) {
             Slog.e(getLogTag(), "stopAuthentication failed", e);
             return ERROR_ESRCH;
@@ -310,7 +309,7 @@
                 try {
                     mStatusBarService.hideBiometricDialog();
                 } catch (RemoteException e) {
-                    Slog.e(getLogTag(), "Unable to hide fingerprint dialog", e);
+                    Slog.e(getLogTag(), "Unable to hide biometric dialog", e);
                 }
             }
         }
diff --git a/services/core/java/com/android/server/biometrics/BiometricService.java b/services/core/java/com/android/server/biometrics/BiometricService.java
index cc2e81f..a181b61 100644
--- a/services/core/java/com/android/server/biometrics/BiometricService.java
+++ b/services/core/java/com/android/server/biometrics/BiometricService.java
@@ -47,6 +47,7 @@
 import android.os.IRemoteCallback;
 import android.os.PowerManager;
 import android.os.RemoteException;
+import android.os.ServiceManager;
 import android.os.SystemClock;
 import android.os.UserHandle;
 import android.os.UserManager;
@@ -96,6 +97,7 @@
     private final LockoutReceiver mLockoutReceiver = new LockoutReceiver();
     private final ArrayList<LockoutResetMonitor> mLockoutMonitors = new ArrayList<>();
 
+    protected final IStatusBarService mStatusBarService;
     protected final Map<Integer, Long> mAuthenticatorIds =
             Collections.synchronizedMap(new HashMap<>());
     protected final ResetFailedAttemptsForUserRunnable mResetFailedAttemptsForCurrentUserRunnable =
@@ -221,10 +223,10 @@
                 IBinder token, ServiceListener listener, int targetUserId, int groupId, long opId,
                 boolean restricted, String owner, Bundle bundle,
                 IBiometricPromptReceiver dialogReceiver,
-                IStatusBarService statusBarService) {
+                IStatusBarService statusBarService, BiometricAuthenticator authenticator) {
             super(context, getMetrics(), daemon, halDeviceId, token, listener,
                     targetUserId, groupId, opId, restricted, owner, bundle, dialogReceiver,
-                    statusBarService);
+                    statusBarService, authenticator);
         }
 
         @Override
@@ -524,6 +526,8 @@
     public BiometricService(Context context) {
         super(context);
         mContext = context;
+        mStatusBarService = IStatusBarService.Stub.asInterface(
+                ServiceManager.getService(Context.STATUS_BAR_SERVICE));
         mKeyguardPackage = ComponentName.unflattenFromString(context.getResources().getString(
                 com.android.internal.R.string.config_keyguardComponent)).getPackageName();
         mAppOps = context.getSystemService(AppOpsManager.class);
diff --git a/services/core/java/com/android/server/biometrics/face/FaceService.java b/services/core/java/com/android/server/biometrics/face/FaceService.java
index 2e76406..f211e17 100644
--- a/services/core/java/com/android/server/biometrics/face/FaceService.java
+++ b/services/core/java/com/android/server/biometrics/face/FaceService.java
@@ -42,7 +42,6 @@
 import android.os.IBinder;
 import android.os.RemoteException;
 import android.os.SELinux;
-import android.os.ServiceManager;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.util.Slog;
@@ -50,7 +49,6 @@
 
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.logging.MetricsLogger;
-import com.android.internal.statusbar.IStatusBarService;
 import com.android.internal.util.DumpUtils;
 import com.android.server.SystemServerInitThreadPool;
 import com.android.server.biometrics.BiometricService;
@@ -133,7 +131,7 @@
             final AuthenticationClientImpl client = new AuthenticationClientImpl(getContext(),
                     mDaemonWrapper, mHalDeviceId, token, new ServiceListenerImpl(receiver),
                     mCurrentUserId, 0 /* groupId */, opId, restricted, opPackageName,
-                    null /* bundle */, null /* dialogReceiver */, mStatusBarService);
+                    null /* bundle */, null /* dialogReceiver */, mStatusBarService, mFaceManager);
 
             authenticateInternal(client, opId, opPackageName);
         }
@@ -149,7 +147,7 @@
                     mDaemonWrapper, mHalDeviceId, token,
                     new BiometricPromptServiceListenerImpl(receiver),
                     mCurrentUserId, 0 /* groupId */, opId, restricted, opPackageName,
-                    bundle, dialogReceiver, mStatusBarService);
+                    bundle, dialogReceiver, mStatusBarService, mFaceManager);
             authenticateInternal(client, opId, opPackageName, callingUid, callingPid,
                     callingUserId);
         }
@@ -326,13 +324,10 @@
      */
     private class BiometricPromptServiceListenerImpl implements ServiceListener {
 
-        // Use FaceManager to get strings, so BiometricPrompt interface is cleaner
-        private FaceManager mFaceManager;
         private IBiometricPromptServiceReceiver mBiometricPromptServiceReceiver;
 
         public BiometricPromptServiceListenerImpl(IBiometricPromptServiceReceiver receiver) {
             mBiometricPromptServiceReceiver = receiver;
-            mFaceManager = (FaceManager) getContext().getSystemService(Context.FACE_SERVICE);
         }
 
         @Override
@@ -451,9 +446,9 @@
 
     @GuardedBy("this")
     private IBiometricsFace mDaemon;
-
     private long mHalDeviceId;
-    private IStatusBarService mStatusBarService;
+    // Use FaceManager to get strings, so BiometricPrompt interface is cleaner
+    private FaceManager mFaceManager;
 
     /**
      * Receives callbacks from the HAL.
@@ -586,15 +581,14 @@
 
     public FaceService(Context context) {
         super(context);
-        // TODO: can this be retrieved from AuthenticationClient, or BiometricService?
-        mStatusBarService = IStatusBarService.Stub.asInterface(
-                ServiceManager.getService(Context.STATUS_BAR_SERVICE));
     }
 
     @Override
     public void onStart() {
+        super.onStart();
         publishBinderService(Context.FACE_SERVICE, new FaceServiceWrapper());
         SystemServerInitThreadPool.get().submit(this::getFaceDaemon, TAG + ".onStart");
+        mFaceManager = (FaceManager) getContext().getSystemService(Context.FACE_SERVICE);
     }
 
     @Override
diff --git a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java
index a25b4b4..95fb9e3 100644
--- a/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java
+++ b/services/core/java/com/android/server/biometrics/fingerprint/FingerprintService.java
@@ -47,7 +47,6 @@
 import android.os.IBinder;
 import android.os.RemoteException;
 import android.os.SELinux;
-import android.os.ServiceManager;
 import android.os.UserHandle;
 import android.os.UserManager;
 import android.util.Slog;
@@ -55,7 +54,6 @@
 
 import com.android.internal.annotations.GuardedBy;
 import com.android.internal.logging.MetricsLogger;
-import com.android.internal.statusbar.IStatusBarService;
 import com.android.internal.util.DumpUtils;
 import com.android.server.SystemServerInitThreadPool;
 import com.android.server.biometrics.BiometricService;
@@ -154,7 +152,7 @@
             final AuthenticationClientImpl client = new AuthenticationClientImpl(getContext(),
                     mDaemonWrapper, mHalDeviceId, token, new ServiceListenerImpl(receiver),
                     mCurrentUserId, groupId, opId, restricted, opPackageName, null /* bundle */,
-                    null /* dialogReceiver */, mStatusBarService);
+                    null /* dialogReceiver */, mStatusBarService, mFingerprintManager);
 
             authenticateInternal(client, opId, opPackageName);
         }
@@ -170,7 +168,7 @@
                     mDaemonWrapper, mHalDeviceId, token,
                     new BiometricPromptServiceListenerImpl(receiver),
                     mCurrentUserId, groupId, opId, restricted, opPackageName, bundle,
-                    dialogReceiver, mStatusBarService);
+                    dialogReceiver, mStatusBarService, mFingerprintManager);
             authenticateInternal(client, opId, opPackageName, callingUid, callingPid,
                     callingUserId);
         }
@@ -362,14 +360,10 @@
      */
     private class BiometricPromptServiceListenerImpl implements ServiceListener {
 
-        // Use FingerprintManager to get strings, so BiometricPrompt interface is cleaner
-        private FingerprintManager mFingerprintManager;
         private IBiometricPromptServiceReceiver mBiometricPromptServiceReceiver;
 
         public BiometricPromptServiceListenerImpl(IBiometricPromptServiceReceiver receiver) {
             mBiometricPromptServiceReceiver = receiver;
-            mFingerprintManager = (FingerprintManager)
-                    getContext().getSystemService(Context.FINGERPRINT_SERVICE);
         }
 
         @Override
@@ -571,9 +565,10 @@
     private IBiometricsFingerprint mDaemon;
 
     private long mHalDeviceId;
-    private IStatusBarService mStatusBarService;
     private IBinder mToken = new Binder(); // used for internal FingerprintService enumeration
     private ArrayList<UserFingerprint> mUnknownFingerprints = new ArrayList<>(); // hw fingerprints
+    // Use FingerprintManager to get strings, so BiometricPrompt interface is cleaner.
+    private FingerprintManager mFingerprintManager;
 
     /**
      * Receives callbacks from the HAL.
@@ -715,9 +710,6 @@
 
     public FingerprintService(Context context) {
         super(context);
-        // TODO: can this be retrieved from AuthenticationClient, or BiometricService?
-        mStatusBarService = IStatusBarService.Stub.asInterface(
-                ServiceManager.getService(Context.STATUS_BAR_SERVICE));
     }
 
     @Override
@@ -725,6 +717,8 @@
         super.onStart();
         publishBinderService(Context.FINGERPRINT_SERVICE, new FingerprintServiceWrapper());
         SystemServerInitThreadPool.get().submit(this::getFingerprintDaemon, TAG + ".onStart");
+        mFingerprintManager = (FingerprintManager)
+                getContext().getSystemService(Context.FINGERPRINT_SERVICE);
     }
 
     @Override
diff --git a/services/core/java/com/android/server/connectivity/PermissionMonitor.java b/services/core/java/com/android/server/connectivity/PermissionMonitor.java
index e471c7d..7b8571c 100644
--- a/services/core/java/com/android/server/connectivity/PermissionMonitor.java
+++ b/services/core/java/com/android/server/connectivity/PermissionMonitor.java
@@ -24,6 +24,7 @@
 import static android.content.pm.ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
 import static android.content.pm.PackageManager.GET_PERMISSIONS;
 
+import android.annotation.NonNull;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
@@ -34,6 +35,7 @@
 import android.content.pm.PackageManager.NameNotFoundException;
 import android.content.pm.UserInfo;
 import android.net.Uri;
+import android.os.Build;
 import android.os.INetworkManagementService;
 import android.os.RemoteException;
 import android.os.UserHandle;
@@ -155,9 +157,8 @@
     }
 
     @VisibleForTesting
-    boolean isPreinstalledSystemApp(PackageInfo app) {
-        int flags = app.applicationInfo != null ? app.applicationInfo.flags : 0;
-        return (flags & (FLAG_SYSTEM | FLAG_UPDATED_SYSTEM_APP)) != 0;
+    static boolean isVendorApp(@NonNull ApplicationInfo appInfo) {
+        return appInfo.isVendor() || appInfo.isOem() || appInfo.isProduct();
     }
 
     @VisibleForTesting
@@ -177,7 +178,13 @@
     }
 
     private boolean hasRestrictedNetworkPermission(PackageInfo app) {
-        if (isPreinstalledSystemApp(app)) return true;
+        // TODO : remove this check in the future(b/31479477). All apps should just
+        // request the appropriate permission for their use case since android Q.
+        if (app.applicationInfo != null
+                && app.applicationInfo.targetSdkVersion < Build.VERSION_CODES.Q
+                && isVendorApp(app.applicationInfo)) {
+            return true;
+        }
         return hasPermission(app, CONNECTIVITY_INTERNAL)
                 || hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS);
     }
@@ -186,13 +193,8 @@
         // This function defines what it means to hold the permission to use
         // background networks.
         return hasPermission(app, CHANGE_NETWORK_STATE)
-                || hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS)
-                || hasPermission(app, CONNECTIVITY_INTERNAL)
                 || hasPermission(app, NETWORK_STACK)
-                // TODO : remove this check (b/31479477). Not all preinstalled apps should
-                // have access to background networks, they should just request the appropriate
-                // permission for their use case from the list above.
-                || isPreinstalledSystemApp(app);
+                || hasRestrictedNetworkPermission(app);
     }
 
     public boolean hasUseBackgroundNetworksPermission(int uid) {
diff --git a/services/core/java/com/android/server/connectivity/tethering/TetheringConfiguration.java b/services/core/java/com/android/server/connectivity/tethering/TetheringConfiguration.java
index 6699444..2b1d919 100644
--- a/services/core/java/com/android/server/connectivity/tethering/TetheringConfiguration.java
+++ b/services/core/java/com/android/server/connectivity/tethering/TetheringConfiguration.java
@@ -162,6 +162,9 @@
         dumpStringArray(pw, "provisioningApp", provisioningApp);
         pw.print("provisioningAppNoUi: ");
         pw.println(provisioningAppNoUi);
+
+        pw.print("enableLegacyDhcpServer: ");
+        pw.println(enableLegacyDhcpServer);
     }
 
     public String toString() {
@@ -176,6 +179,7 @@
                 makeString(preferredUpstreamNames(preferredUpstreamIfaceTypes))));
         sj.add(String.format("provisioningApp:%s", makeString(provisioningApp)));
         sj.add(String.format("provisioningAppNoUi:%s", provisioningAppNoUi));
+        sj.add(String.format("enableLegacyDhcpServer:%s", enableLegacyDhcpServer));
         return String.format("TetheringConfiguration{%s}", sj.toString());
     }
 
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 182901a..9b097bf 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -8960,15 +8960,15 @@
     }
 
     /**
-     * Enforces that only the system UID or shell's UID can call a method exposed
-     * via Binder.
+     * Enforces that only the system UID or root's UID or shell's UID can call
+     * a method exposed via Binder.
      *
      * @param message used as message if SecurityException is thrown
      * @throws SecurityException if the caller is not system or shell
      */
-    private static void enforceSystemOrShell(String message) {
+    private static void enforceSystemOrRootOrShell(String message) {
         final int uid = Binder.getCallingUid();
-        if (uid != Process.SYSTEM_UID && uid != Process.SHELL_UID) {
+        if (uid != Process.SYSTEM_UID && uid != Process.ROOT_UID && uid != Process.SHELL_UID) {
             throw new SecurityException(message);
         }
     }
@@ -9454,7 +9454,7 @@
         if (getInstantAppPackageName(Binder.getCallingUid()) != null) {
             return false;
         }
-        enforceSystemOrShell("runBackgroundDexoptJob");
+        enforceSystemOrRootOrShell("runBackgroundDexoptJob");
         final long identity = Binder.clearCallingIdentity();
         try {
             return BackgroundDexOptService.runIdleOptimizationsNow(this, mContext, packageNames);
diff --git a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
index f2c0395..361416a 100644
--- a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
+++ b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
@@ -1302,6 +1302,7 @@
         }
         boolean result = mInterface.runBackgroundDexoptJob(packageNames.isEmpty() ? null :
                 packageNames);
+        getOutPrintWriter().println(result ? "Success" : "Failure");
         return result ? 0 : -1;
     }
 
diff --git a/services/core/java/com/android/server/stats/StatsCompanionService.java b/services/core/java/com/android/server/stats/StatsCompanionService.java
index 556038f..41c0be6 100644
--- a/services/core/java/com/android/server/stats/StatsCompanionService.java
+++ b/services/core/java/com/android/server/stats/StatsCompanionService.java
@@ -19,7 +19,6 @@
 import android.app.ActivityManagerInternal;
 import android.app.AlarmManager;
 import android.app.AlarmManager.OnAlarmListener;
-import android.app.PendingIntent;
 import android.app.ProcessMemoryState;
 import android.app.StatsManager;
 import android.bluetooth.BluetoothActivityEnergyInfo;
@@ -65,10 +64,10 @@
 import com.android.internal.net.NetworkStatsFactory;
 import com.android.internal.os.BinderCallsStats.ExportedCallStat;
 import com.android.internal.os.KernelCpuSpeedReader;
-import com.android.internal.os.KernelUidCpuTimeReader;
-import com.android.internal.os.KernelUidCpuClusterTimeReader;
 import com.android.internal.os.KernelUidCpuActiveTimeReader;
+import com.android.internal.os.KernelUidCpuClusterTimeReader;
 import com.android.internal.os.KernelUidCpuFreqTimeReader;
+import com.android.internal.os.KernelUidCpuTimeReader;
 import com.android.internal.os.KernelWakelockReader;
 import com.android.internal.os.KernelWakelockStats;
 import com.android.internal.os.PowerProfile;
@@ -79,7 +78,6 @@
 
 import java.io.File;
 import java.io.FileDescriptor;
-import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -328,7 +326,6 @@
                             PackageManager pm = context.getPackageManager();
                             String app = intent.getData().getSchemeSpecificPart();
                             sStatsd.informOnePackageRemoved(app, uid);
-                            StatsLog.write(StatsLog.GENERIC_ATOM, uid, 1000);
                         }
                     } else {
                         PackageManager pm = context.getPackageManager();
@@ -337,7 +334,6 @@
                         String app = intent.getData().getSchemeSpecificPart();
                         PackageInfo pi = pm.getPackageInfo(app, PackageManager.MATCH_ANY_USER);
                         sStatsd.informOnePackage(app, uid, pi.getLongVersionCode());
-                        StatsLog.write(StatsLog.GENERIC_ATOM, uid, 1001);
                     }
                 } catch (Exception e) {
                     Slog.w(TAG, "Failed to inform statsd of an app update", e);
diff --git a/services/core/java/com/android/server/statusbar/StatusBarManagerService.java b/services/core/java/com/android/server/statusbar/StatusBarManagerService.java
index b8c9be7..14294ec 100644
--- a/services/core/java/com/android/server/statusbar/StatusBarManagerService.java
+++ b/services/core/java/com/android/server/statusbar/StatusBarManagerService.java
@@ -565,10 +565,10 @@
     }
 
     @Override
-    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver) {
+    public void showBiometricDialog(Bundle bundle, IBiometricPromptReceiver receiver, int type) {
         if (mBar != null) {
             try {
-                mBar.showBiometricDialog(bundle, receiver);
+                mBar.showBiometricDialog(bundle, receiver, type);
             } catch (RemoteException ex) {
             }
         }
diff --git a/services/core/java/com/android/server/wm/DisplayContent.java b/services/core/java/com/android/server/wm/DisplayContent.java
index ba46737..32fa9bf 100644
--- a/services/core/java/com/android/server/wm/DisplayContent.java
+++ b/services/core/java/com/android/server/wm/DisplayContent.java
@@ -921,6 +921,11 @@
     }
 
     @Override
+    DisplayWindowController getController() {
+        return (DisplayWindowController) super.getController();
+    }
+
+    @Override
     public Display getDisplay() {
         return mDisplay;
     }
diff --git a/services/core/java/com/android/server/wm/DisplayWindowController.java b/services/core/java/com/android/server/wm/DisplayWindowController.java
index 74a8a35..76b6dbe 100644
--- a/services/core/java/com/android/server/wm/DisplayWindowController.java
+++ b/services/core/java/com/android/server/wm/DisplayWindowController.java
@@ -73,6 +73,10 @@
         // override configuration propagation to just here.
     }
 
+    public int getDisplayId() {
+        return mDisplayId;
+    }
+
     /**
      * Positions the task stack at the given position in the task stack container.
      */
diff --git a/services/core/java/com/android/server/wm/RootWindowContainer.java b/services/core/java/com/android/server/wm/RootWindowContainer.java
index d8cbb26..86b14337 100644
--- a/services/core/java/com/android/server/wm/RootWindowContainer.java
+++ b/services/core/java/com/android/server/wm/RootWindowContainer.java
@@ -174,24 +174,6 @@
         return null;
     }
 
-    /**
-     * Get an array with display ids ordered by focus priority - last items should be given
-     * focus first. Sparse array just maps position to displayId.
-     */
-    void getDisplaysInFocusOrder(SparseIntArray displaysInFocusOrder) {
-        displaysInFocusOrder.clear();
-
-        final int size = mChildren.size();
-        for (int i = 0; i < size; ++i) {
-            final DisplayContent displayContent = mChildren.get(i);
-            if (displayContent.isRemovalDeferred()) {
-                // Don't report displays that are going to be removed soon.
-                continue;
-            }
-            displaysInFocusOrder.put(i, displayContent.getDisplayId());
-        }
-    }
-
     DisplayContent getDisplayContent(int displayId) {
         for (int i = mChildren.size() - 1; i >= 0; --i) {
             final DisplayContent current = mChildren.get(i);
@@ -1098,6 +1080,25 @@
     }
 
     @Override
+    void positionChildAt(int position, DisplayContent child, boolean includingParents) {
+        super.positionChildAt(position, child, includingParents);
+        final RootWindowContainerController controller = getController();
+        if (controller != null) {
+            controller.onChildPositionChanged(child, position);
+        }
+    }
+
+    void positionChildAt(int position, DisplayContent child) {
+        // Only called from controller so no need to notify the change to controller.
+        super.positionChildAt(position, child, false /* includingParents */);
+    }
+
+    @Override
+    RootWindowContainerController getController() {
+        return (RootWindowContainerController) super.getController();
+    }
+
+    @Override
     void scheduleAnimation() {
         mService.scheduleAnimationLocked();
     }
diff --git a/services/core/java/com/android/server/wm/RootWindowContainerController.java b/services/core/java/com/android/server/wm/RootWindowContainerController.java
new file mode 100644
index 0000000..93be6e9
--- /dev/null
+++ b/services/core/java/com/android/server/wm/RootWindowContainerController.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.wm;
+
+/**
+ * Controller for the root container. This is created by activity manager to link activity
+ * stack supervisor to the root window container they use in window manager.
+ */
+public class RootWindowContainerController
+        extends WindowContainerController<RootWindowContainer, RootWindowContainerListener> {
+
+    public RootWindowContainerController(RootWindowContainerListener listener) {
+        super(listener, WindowManagerService.getInstance());
+        synchronized (mWindowMap) {
+            mRoot.setController(this);
+        }
+    }
+
+    void onChildPositionChanged(DisplayContent child, int position) {
+        // This callback invokes to AM directly so here assumes AM lock is held. If there is another
+        // path called only with WM lock, it should change to use handler to post or move outside of
+        // WM lock with adding AM lock.
+        mListener.onChildPositionChanged(child.getController(), position);
+    }
+
+    /** Move the display to the given position. */
+    public void positionChildAt(DisplayWindowController child, int position) {
+        synchronized (mWindowMap) {
+            mContainer.positionChildAt(position, child.mContainer);
+        }
+    }
+}
diff --git a/services/core/java/com/android/server/wm/RootWindowContainerListener.java b/services/core/java/com/android/server/wm/RootWindowContainerListener.java
new file mode 100644
index 0000000..f413e3f7
--- /dev/null
+++ b/services/core/java/com/android/server/wm/RootWindowContainerListener.java
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.server.wm;
+
+/**
+ * Interface used by the creator of {@link RootWindowContainerController} to notify the changes to
+ * the display container in activity manager.
+ */
+public interface RootWindowContainerListener extends WindowContainerListener {
+    /** Called when the z-order of display is changed. */
+    void onChildPositionChanged(DisplayWindowController childController, int position);
+}
diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index f8d0c72..e80a47e 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -5345,17 +5345,6 @@
         mWindowPlacerLocked.performSurfacePlacement();
     }
 
-    /**
-     * Get an array with display ids ordered by focus priority - last items should be given
-     * focus first. Sparse array just maps position to displayId.
-     */
-    // TODO: Maintain display list in focus order in ActivityManager and remove this call.
-    public void getDisplaysInFocusOrder(SparseIntArray displaysInFocusOrder) {
-        synchronized(mWindowMap) {
-            mRoot.getDisplaysInFocusOrder(displaysInFocusOrder);
-        }
-    }
-
     @Override
     public void setOverscan(int displayId, int left, int top, int right, int bottom) {
         if (mContext.checkCallingOrSelfPermission(
diff --git a/services/net/java/android/net/dhcp/DhcpLease.java b/services/net/java/android/net/dhcp/DhcpLease.java
index d2a15b3..6cdd2aa 100644
--- a/services/net/java/android/net/dhcp/DhcpLease.java
+++ b/services/net/java/android/net/dhcp/DhcpLease.java
@@ -130,9 +130,14 @@
         return HexDump.toHexString(bytes);
     }
 
+    static String inet4AddrToString(@Nullable Inet4Address addr) {
+        return (addr == null) ? "null" : addr.getHostAddress();
+    }
+
     @Override
     public String toString() {
         return String.format("clientId: %s, hwAddr: %s, netAddr: %s, expTime: %d, hostname: %s",
-                clientIdToString(mClientId), mHwAddr.toString(), mNetAddr, mExpTime, mHostname);
+                clientIdToString(mClientId), mHwAddr.toString(), inet4AddrToString(mNetAddr),
+                mExpTime, mHostname);
     }
 }
diff --git a/services/net/java/android/net/dhcp/DhcpLeaseRepository.java b/services/net/java/android/net/dhcp/DhcpLeaseRepository.java
index 9f77ed0..2dda421 100644
--- a/services/net/java/android/net/dhcp/DhcpLeaseRepository.java
+++ b/services/net/java/android/net/dhcp/DhcpLeaseRepository.java
@@ -20,6 +20,7 @@
 import static android.net.NetworkUtils.intToInet4AddressHTH;
 import static android.net.NetworkUtils.prefixLengthToV4NetmaskIntHTH;
 import static android.net.dhcp.DhcpLease.EXPIRATION_NEVER;
+import static android.net.dhcp.DhcpLease.inet4AddrToString;
 import static android.net.util.NetworkConstants.IPV4_ADDR_BITS;
 
 import static java.lang.Math.min;
@@ -98,6 +99,12 @@
         }
     }
 
+    static class InvalidSubnetException extends DhcpLeaseException {
+        InvalidSubnetException(String message) {
+            super(message);
+        }
+    }
+
     /**
      * Leases by IP address
      */
@@ -152,25 +159,17 @@
      * @param reqAddr Requested address by the client (option 50), or {@link #INETADDR_UNSPEC}
      * @param hostname Client-provided hostname, or {@link DhcpLease#HOSTNAME_NONE}
      * @throws OutOfAddressesException The server does not have any available address
-     * @throws InvalidAddressException The lease was requested from an unsupported subnet
+     * @throws InvalidSubnetException The lease was requested from an unsupported subnet
      */
     @NonNull
     public DhcpLease getOffer(@Nullable byte[] clientId, @NonNull MacAddress hwAddr,
-            @NonNull Inet4Address relayAddr,
-            @Nullable Inet4Address reqAddr, @Nullable String hostname)
-            throws OutOfAddressesException, InvalidAddressException {
+            @NonNull Inet4Address relayAddr, @Nullable Inet4Address reqAddr,
+            @Nullable String hostname) throws OutOfAddressesException, InvalidSubnetException {
         final long currentTime = mClock.elapsedRealtime();
         final long expTime = currentTime + mLeaseTimeMs;
 
         removeExpiredLeases(currentTime);
-
-        // As per #4.3.1, addresses are assigned based on the relay address if present. This
-        // implementation only assigns addresses if the relayAddr is inside our configured subnet.
-        // This also applies when the client requested a specific address for consistency between
-        // requests, and with older behavior.
-        if (isIpAddrOutsidePrefix(mPrefix, relayAddr)) {
-            throw new InvalidAddressException("Lease requested by relay from outside of subnet");
-        }
+        checkValidRelayAddr(relayAddr);
 
         final DhcpLease currentLease = findByClient(clientId, hwAddr);
         final DhcpLease newLease;
@@ -188,7 +187,19 @@
         return newLease;
     }
 
-    private static boolean isIpAddrOutsidePrefix(IpPrefix prefix, Inet4Address addr) {
+    private void checkValidRelayAddr(@Nullable Inet4Address relayAddr)
+            throws InvalidSubnetException {
+        // As per #4.3.1, addresses are assigned based on the relay address if present. This
+        // implementation only assigns addresses if the relayAddr is inside our configured subnet.
+        // This also applies when the client requested a specific address for consistency between
+        // requests, and with older behavior.
+        if (isIpAddrOutsidePrefix(mPrefix, relayAddr)) {
+            throw new InvalidSubnetException("Lease requested by relay from outside of subnet");
+        }
+    }
+
+    private static boolean isIpAddrOutsidePrefix(@NonNull IpPrefix prefix,
+            @Nullable Inet4Address addr) {
         return addr != null && !addr.equals(Inet4Address.ANY) && !prefix.contains(addr);
     }
 
@@ -222,10 +233,12 @@
      */
     @NonNull
     public DhcpLease requestLease(@Nullable byte[] clientId, @NonNull MacAddress hwAddr,
-            @NonNull Inet4Address clientAddr, @Nullable Inet4Address reqAddr, boolean sidSet,
-            @Nullable String hostname) throws InvalidAddressException {
+            @NonNull Inet4Address clientAddr, @NonNull Inet4Address relayAddr,
+            @Nullable Inet4Address reqAddr, boolean sidSet, @Nullable String hostname)
+            throws InvalidAddressException, InvalidSubnetException {
         final long currentTime = mClock.elapsedRealtime();
         removeExpiredLeases(currentTime);
+        checkValidRelayAddr(relayAddr);
         final DhcpLease assignedLease = findByClient(clientId, hwAddr);
 
         final Inet4Address leaseAddr = reqAddr != null ? reqAddr : clientAddr;
@@ -252,7 +265,7 @@
         final DhcpLease lease =
                 checkClientAndMakeLease(clientId, hwAddr, leaseAddr, hostname, currentTime);
         mLog.logf("DHCPREQUEST assignedLease %s, reqAddr=%s, sidSet=%s: created/renewed lease %s",
-                assignedLease, reqAddr, sidSet, lease);
+                assignedLease, inet4AddrToString(reqAddr), sidSet, lease);
         return lease;
     }
 
@@ -304,7 +317,7 @@
             @NonNull Inet4Address addr) {
         final DhcpLease currentLease = mCommittedLeases.getOrDefault(addr, null);
         if (currentLease == null) {
-            mLog.w("Could not release unknown lease for " + addr);
+            mLog.w("Could not release unknown lease for " + inet4AddrToString(addr));
             return false;
         }
         if (currentLease.matchesClient(clientId, hwAddr)) {
@@ -319,12 +332,13 @@
 
     public void markLeaseDeclined(@NonNull Inet4Address addr) {
         if (mDeclinedAddrs.containsKey(addr) || !isValidAddress(addr)) {
-            mLog.logf("Not marking %s as declined: already declined or not assignable", addr);
+            mLog.logf("Not marking %s as declined: already declined or not assignable",
+                    inet4AddrToString(addr));
             return;
         }
         final long expTime = mClock.elapsedRealtime() + mLeaseTimeMs;
         mDeclinedAddrs.put(addr, expTime);
-        mLog.logf("Marked %s as declined expiring %d", addr, expTime);
+        mLog.logf("Marked %s as declined expiring %d", inet4AddrToString(addr), expTime);
         maybeUpdateEarliestExpiration(expTime);
     }
 
@@ -515,7 +529,8 @@
         while (it.hasNext()) {
             final Inet4Address addr = it.next();
             it.remove();
-            mLog.logf("Out of addresses in address pool: dropped declined addr %s", addr);
+            mLog.logf("Out of addresses in address pool: dropped declined addr %s",
+                    inet4AddrToString(addr));
             // isValidAddress() is always verified for entries in mDeclinedAddrs.
             // However declined addresses may have been requested (typically by the machine that was
             // already using the address) after being declined.
diff --git a/services/net/java/android/net/dhcp/DhcpPacket.java b/services/net/java/android/net/dhcp/DhcpPacket.java
index 595a129..77a3e21 100644
--- a/services/net/java/android/net/dhcp/DhcpPacket.java
+++ b/services/net/java/android/net/dhcp/DhcpPacket.java
@@ -1281,12 +1281,12 @@
      */
     public static ByteBuffer buildAckPacket(int encap, int transactionId,
         boolean broadcast, Inet4Address serverIpAddr, Inet4Address relayIp, Inet4Address yourIp,
-        byte[] mac, Integer timeout, Inet4Address netMask, Inet4Address bcAddr,
-        List<Inet4Address> gateways, List<Inet4Address> dnsServers,
+        Inet4Address requestClientIp, byte[] mac, Integer timeout, Inet4Address netMask,
+        Inet4Address bcAddr, List<Inet4Address> gateways, List<Inet4Address> dnsServers,
         Inet4Address dhcpServerIdentifier, String domainName, boolean metered) {
         DhcpPacket pkt = new DhcpAckPacket(
-                transactionId, (short) 0, broadcast, serverIpAddr, relayIp,
-                INADDR_ANY /* clientIp */, yourIp, mac);
+                transactionId, (short) 0, broadcast, serverIpAddr, relayIp, requestClientIp, yourIp,
+                mac);
         pkt.mGateways = gateways;
         pkt.mDnsServers = dnsServers;
         pkt.mLeaseTime = timeout;
diff --git a/services/net/java/android/net/dhcp/DhcpServer.java b/services/net/java/android/net/dhcp/DhcpServer.java
index da8c8bb..2b3d577 100644
--- a/services/net/java/android/net/dhcp/DhcpServer.java
+++ b/services/net/java/android/net/dhcp/DhcpServer.java
@@ -269,6 +269,11 @@
         }
     }
 
+    private void logIgnoredPacketInvalidSubnet(DhcpLeaseRepository.InvalidSubnetException e) {
+        // Not an internal error: only logging exception message, not stacktrace
+        mLog.e("Ignored packet from invalid subnet: " + e.getMessage());
+    }
+
     private void processDiscover(@NonNull DhcpDiscoverPacket packet)
             throws MalformedPacketException {
         final DhcpLease lease;
@@ -279,8 +284,8 @@
         } catch (DhcpLeaseRepository.OutOfAddressesException e) {
             transmitNak(packet, "Out of addresses to offer");
             return;
-        } catch (DhcpLeaseRepository.InvalidAddressException e) {
-            transmitNak(packet, "Lease requested from an invalid subnet");
+        } catch (DhcpLeaseRepository.InvalidSubnetException e) {
+            logIgnoredPacketInvalidSubnet(e);
             return;
         }
 
@@ -294,16 +299,20 @@
         final MacAddress clientMac = getMacAddr(packet);
         try {
             lease = mLeaseRepo.requestLease(packet.getExplicitClientIdOrNull(), clientMac,
-                    packet.mClientIp, packet.mRequestedIp, sidSet, packet.mHostName);
+                    packet.mClientIp, packet.mRelayIp, packet.mRequestedIp, sidSet,
+                    packet.mHostName);
         } catch (DhcpLeaseRepository.InvalidAddressException e) {
             transmitNak(packet, "Invalid requested address");
             return;
+        } catch (DhcpLeaseRepository.InvalidSubnetException e) {
+            logIgnoredPacketInvalidSubnet(e);
+            return;
         }
 
         transmitAck(packet, lease, clientMac);
     }
 
-    private void processRelease(@Nullable DhcpReleasePacket packet)
+    private void processRelease(@NonNull DhcpReleasePacket packet)
             throws MalformedPacketException {
         final byte[] clientId = packet.getExplicitClientIdOrNull();
         final MacAddress macAddr = getMacAddr(packet);
@@ -367,7 +376,7 @@
         final int timeout = getLeaseTimeout(lease);
         final ByteBuffer ackPacket = DhcpPacket.buildAckPacket(ENCAP_BOOTP, request.mTransId,
                 broadcastFlag, mServingParams.getServerInet4Addr(), request.mRelayIp,
-                lease.getNetAddr(), request.mClientMac, timeout,
+                lease.getNetAddr(), request.mClientIp, request.mClientMac, timeout,
                 mServingParams.getPrefixMaskAsAddress(), mServingParams.getBroadcastAddress(),
                 new ArrayList<>(mServingParams.defaultRouters),
                 new ArrayList<>(mServingParams.dnsServers),
@@ -464,7 +473,7 @@
         }
     }
 
-    private static boolean isEmpty(@NonNull Inet4Address address) {
+    private static boolean isEmpty(@Nullable Inet4Address address) {
         return address == null || Inet4Address.ANY.equals(address);
     }
 
diff --git a/services/robotests/src/com/android/server/backup/BackupAgentTimeoutParametersTest.java b/services/robotests/src/com/android/server/backup/BackupAgentTimeoutParametersTest.java
index 801451e..0d2c221 100644
--- a/services/robotests/src/com/android/server/backup/BackupAgentTimeoutParametersTest.java
+++ b/services/robotests/src/com/android/server/backup/BackupAgentTimeoutParametersTest.java
@@ -16,6 +16,8 @@
 
 package com.android.server.backup;
 
+import static com.google.common.truth.Truth.assertThat;
+
 import static org.junit.Assert.assertEquals;
 
 import android.content.ContentResolver;
@@ -51,7 +53,6 @@
 
         mContentResolver = context.getContentResolver();
         mParameters = new BackupAgentTimeoutParameters(new Handler(), mContentResolver);
-        mParameters.start();
     }
 
     /** Stop observing changes to the setting. */
@@ -61,8 +62,11 @@
     }
 
     /** Tests that timeout parameters are initialized with default values on creation. */
+    // TODO: Break down tests
     @Test
     public void testGetParameters_afterConstructorWithStart_returnsDefaultValues() {
+        mParameters.start();
+
         long kvBackupAgentTimeoutMillis = mParameters.getKvBackupAgentTimeoutMillis();
         long fullBackupAgentTimeoutMillis = mParameters.getFullBackupAgentTimeoutMillis();
         long sharedBackupAgentTimeoutMillis = mParameters.getSharedBackupAgentTimeoutMillis();
@@ -86,13 +90,33 @@
                 restoreAgentFinishedTimeoutMillis);
     }
 
+    @Test
+    public void testGetQuotaExceededTimeoutMillis_returnsDefaultValue() {
+        mParameters.start();
+
+        long timeout = mParameters.getQuotaExceededTimeoutMillis();
+
+        assertThat(timeout)
+                .isEqualTo(BackupAgentTimeoutParameters.DEFAULT_QUOTA_EXCEEDED_TIMEOUT_MILLIS);
+    }
+
+    @Test
+    public void testGetQuotaExceededTimeoutMillis_whenSettingSet_returnsSetValue() {
+        putStringAndNotify(
+                BackupAgentTimeoutParameters.SETTING_QUOTA_EXCEEDED_TIMEOUT_MILLIS + "=" + 1279);
+        mParameters.start();
+
+        long timeout = mParameters.getQuotaExceededTimeoutMillis();
+
+        assertThat(timeout).isEqualTo(1279);
+    }
+
     /**
      * Tests that timeout parameters are updated when we call start, even when a setting change
      * occurs while we are not observing.
      */
     @Test
     public void testGetParameters_withSettingChangeBeforeStart_updatesValues() {
-        mParameters.stop();
         long testTimeout = BackupAgentTimeoutParameters.DEFAULT_KV_BACKUP_AGENT_TIMEOUT_MILLIS * 2;
         final String setting =
                 BackupAgentTimeoutParameters.SETTING_KV_BACKUP_AGENT_TIMEOUT_MILLIS
@@ -112,6 +136,7 @@
      */
     @Test
     public void testGetParameters_withSettingChangeAfterStart_updatesValues() {
+        mParameters.start();
         long testTimeout = BackupAgentTimeoutParameters.DEFAULT_KV_BACKUP_AGENT_TIMEOUT_MILLIS * 2;
         final String setting =
                 BackupAgentTimeoutParameters.SETTING_KV_BACKUP_AGENT_TIMEOUT_MILLIS
diff --git a/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupReporterTest.java b/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupReporterTest.java
index 72ba439..21b90f1 100644
--- a/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupReporterTest.java
+++ b/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupReporterTest.java
@@ -27,6 +27,7 @@
 import android.util.Log;
 
 import com.android.server.backup.BackupManagerService;
+import com.android.server.backup.remote.RemoteResult;
 import com.android.server.testing.FrameworkRobolectricTestRunner;
 import com.android.server.testing.SystemLoaderPackages;
 import com.android.server.testing.shadows.ShadowEventLog;
@@ -37,6 +38,9 @@
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
 import org.robolectric.annotation.Config;
+import org.robolectric.shadows.ShadowLog;
+
+import java.lang.reflect.Field;
 
 @RunWith(FrameworkRobolectricTestRunner.class)
 @Config(
@@ -77,4 +81,39 @@
 
         assertThat(observer).isEqualTo(mObserver);
     }
+
+    @Test
+    public void testOnRevertTask_logsCorrectly() throws Exception {
+        setMoreDebug(true);
+
+        mReporter.onRevertTask();
+
+        assertLogcat(TAG, Log.INFO);
+    }
+
+    @Test
+    public void testOnRemoteCallReturned_logsCorrectly() throws Exception {
+        setMoreDebug(true);
+
+        mReporter.onRemoteCallReturned(RemoteResult.of(3), "onFoo()");
+
+        assertLogcat(TAG, Log.VERBOSE);
+        ShadowLog.LogItem log = ShadowLog.getLogsForTag(TAG).get(0);
+        assertThat(log.msg).contains("onFoo()");
+        assertThat(log.msg).contains("3");
+    }
+
+    /**
+     * HACK: We actually want {@link KeyValueBackupReporter#MORE_DEBUG} to be a constant to be able
+     * to strip those lines at build time. So, we have to do this to test :(
+     */
+    private static void setMoreDebug(boolean value)
+            throws NoSuchFieldException, IllegalAccessException {
+        if (KeyValueBackupReporter.MORE_DEBUG == value) {
+            return;
+        }
+        Field moreDebugField = KeyValueBackupReporter.class.getDeclaredField("MORE_DEBUG");
+        moreDebugField.setAccessible(true);
+        moreDebugField.set(null, value);
+    }
 }
diff --git a/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupTaskTest.java b/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupTaskTest.java
index 63b0ea8..82d7ab8 100644
--- a/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupTaskTest.java
+++ b/services/robotests/src/com/android/server/backup/keyvalue/KeyValueBackupTaskTest.java
@@ -62,6 +62,8 @@
 import static org.mockito.Mockito.when;
 import static org.robolectric.Shadows.shadowOf;
 import static org.robolectric.shadow.api.Shadow.extract;
+import static org.testng.Assert.fail;
+import static org.testng.Assert.expectThrows;
 
 import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
 import static java.util.Collections.emptyList;
@@ -106,6 +108,7 @@
 import com.android.server.backup.TransportManager;
 import com.android.server.backup.internal.BackupHandler;
 import com.android.server.backup.internal.OnTaskFinishedListener;
+import com.android.server.backup.remote.RemoteCall;
 import com.android.server.backup.testing.PackageData;
 import com.android.server.backup.testing.TestUtils.ThrowingRunnable;
 import com.android.server.backup.testing.TransportData;
@@ -704,14 +707,13 @@
     }
 
     /**
-     * For local agents the exception is thrown in our stack, so it hits the catch clause around
-     * invocation earlier than the {@link KeyValueBackupTask#operationComplete(long)} code-path,
-     * invalidating the latter. Note that this happens because {@link
-     * BackupManagerService#opComplete(int, long)} schedules the actual execution to the backup
-     * handler.
+     * For local agents the exception is thrown in our stack, before {@link RemoteCall} has a chance
+     * to complete cleanly.
      */
+    // TODO: When RemoteCall spins up a new thread the assertions on this method should be the same
+    // as the methods below (non-local call).
     @Test
-    public void testRunTask_whenLocalAgentOnBackupThrows() throws Exception {
+    public void testRunTask_whenLocalAgentOnBackupThrows_setsNullWorkSource() throws Exception {
         TransportMock transportMock = setUpInitializedTransport(mTransport);
         AgentMock agentMock = setUpAgent(PACKAGE_1);
         agentOnBackupDo(
@@ -724,16 +726,119 @@
         runTask(task);
 
         verify(mBackupManagerService).setWorkSource(null);
+    }
+
+    @Test
+    public void testRunTask_whenLocalAgentOnBackupThrows_reportsCorrectly() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        agentOnBackupDo(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        runTask(task);
+
         verify(mObserver).onResult(PACKAGE_1.packageName, ERROR_AGENT_FAILURE);
         verify(mObserver).backupFinished(SUCCESS);
+        verify(mReporter)
+                .onCallAgentDoBackupError(
+                        eq(PACKAGE_1.packageName), eq(true), any(RuntimeException.class));
         assertEventLogged(
                 EventLogTags.BACKUP_AGENT_FAILURE,
                 PACKAGE_1.packageName,
                 new RuntimeException().toString());
+    }
+
+    @Test
+    public void testRunTask_whenLocalAgentOnBackupThrows_doesNotUpdateBookkeping()
+            throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        agentOnBackupDo(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        runTask(task);
+
         assertBackupPendingFor(PACKAGE_1);
     }
 
     @Test
+    public void testRunTask_whenAgentOnBackupThrows_reportsCorrectly() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        remoteAgentOnBackupThrows(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        runTask(task);
+
+        verify(mReporter).onAgentResultError(argThat(packageInfo(PACKAGE_1)));
+    }
+
+    @Test
+    public void testRunTask_whenAgentOnBackupThrows_updatesBookkeeping() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        remoteAgentOnBackupThrows(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        runTask(task);
+
+        assertBackupNotPendingFor(PACKAGE_1);
+    }
+
+    @Test
+    public void testRunTask_whenAgentOnBackupThrows_doesNotCallTransport() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        remoteAgentOnBackupThrows(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        runTask(task);
+
+        verify(transportMock.transport, never())
+                .performBackup(argThat(packageInfo(PACKAGE_1)), any(), anyInt());
+    }
+
+    @Test
+    public void testRunTask_whenAgentOnBackupThrows_updatesAndCleansUpFiles() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        AgentMock agentMock = setUpAgent(PACKAGE_1);
+        remoteAgentOnBackupThrows(
+                agentMock,
+                (oldState, dataOutput, newState) -> {
+                    throw new RuntimeException();
+                });
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+        Files.write(getStateFile(mTransport, PACKAGE_1), "oldState".getBytes());
+
+        runTask(task);
+
+        assertThat(Files.readAllBytes(getStateFile(mTransport, PACKAGE_1)))
+                .isEqualTo("oldState".getBytes());
+        assertThat(Files.exists(getTemporaryStateFile(mTransport, PACKAGE_1))).isFalse();
+        assertThat(Files.exists(getStagingFile(PACKAGE_1))).isFalse();
+    }
+
+    @Test
     public void testRunTask_whenTransportProvidesFlags_passesThemToTheAgent() throws Exception {
         TransportMock transportMock = setUpInitializedTransport(mTransport);
         int flags = BackupAgent.FLAG_CLIENT_SIDE_ENCRYPTION_ENABLED;
@@ -1837,6 +1942,29 @@
         task.markCancel();
     }
 
+    @Test
+    public void testHandleCancel_callsMarkCancelAndWaitCancel() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        setUpAgentWithData(PACKAGE_1);
+        KeyValueBackupTask task = spy(createKeyValueBackupTask(transportMock, PACKAGE_1));
+        doNothing().when(task).waitCancel();
+
+        task.handleCancel(true);
+
+        InOrder inOrder = inOrder(task);
+        inOrder.verify(task).markCancel();
+        inOrder.verify(task).waitCancel();
+    }
+
+    @Test
+    public void testHandleCancel_whenCancelAllFalse_throws() throws Exception {
+        TransportMock transportMock = setUpInitializedTransport(mTransport);
+        setUpAgentWithData(PACKAGE_1);
+        KeyValueBackupTask task = createKeyValueBackupTask(transportMock, PACKAGE_1);
+
+        expectThrows(IllegalArgumentException.class, () -> task.handleCancel(false));
+    }
+
     private void runTask(KeyValueBackupTask task) {
         // Pretend we are not on the main-thread to prevent RemoteCall from complaining
         mShadowMainLooper.setCurrentThread(false);
@@ -2130,6 +2258,10 @@
      * Implements {@code function} for {@link BackupAgent#onBackup(ParcelFileDescriptor,
      * BackupDataOutput, ParcelFileDescriptor)} of {@code agentMock} and populates {@link
      * AgentMock#oldState}.
+     *
+     * <p>Note that for throwing agents this will simulate a local agent (the exception will be
+     * thrown in our stack), use {@link #remoteAgentOnBackupThrows(AgentMock, BackupAgentOnBackup)}
+     * if you want to simulate a remote agent.
      */
     private static void agentOnBackupDo(AgentMock agentMock, BackupAgentOnBackup function)
             throws Exception {
@@ -2150,6 +2282,33 @@
     }
 
     /**
+     * Use this method to simulate a remote agent throwing. We catch the exception thrown, thus
+     * simulating a one-way call. It also populates {@link AgentMock#oldState}.
+     *
+     * @param agentMock The Agent mock.
+     * @param function A function that throws, otherwise the test will fail.
+     */
+    // TODO: Remove when RemoteCall spins up a dedicated thread for calls
+    private static void remoteAgentOnBackupThrows(AgentMock agentMock, BackupAgentOnBackup function)
+            throws Exception {
+        agentOnBackupDo(agentMock, function);
+        doAnswer(
+                        invocation -> {
+                            try {
+                                invocation.callRealMethod();
+                                fail("Agent method expected to throw");
+                            } catch (RuntimeException e) {
+                                // This silences the exception just like a one-way call would, the
+                                // normal completion via IBackupCallback binder still happens, check
+                                // finally() block of IBackupAgent.doBackup().
+                            }
+                            return null;
+                        })
+                .when(agentMock.agentBinder)
+                .doBackup(any(), any(), any(), anyLong(), any(), anyInt());
+    }
+
+    /**
      * Returns an {@link Answer} that can be used for mocking {@link
      * IBackupTransport#performBackup(PackageInfo, ParcelFileDescriptor, int)} that copies the
      * backup data received to {@code backupDataPath} and returns {@code result}.
diff --git a/services/robotests/src/com/android/server/backup/remote/FutureBackupCallbackTest.java b/services/robotests/src/com/android/server/backup/remote/FutureBackupCallbackTest.java
index aec207d..f3621e2 100644
--- a/services/robotests/src/com/android/server/backup/remote/FutureBackupCallbackTest.java
+++ b/services/robotests/src/com/android/server/backup/remote/FutureBackupCallbackTest.java
@@ -41,6 +41,6 @@
 
         callback.operationComplete(7);
 
-        assertThat(future.get()).isEqualTo(RemoteResult.successful(7));
+        assertThat(future.get()).isEqualTo(RemoteResult.of(7));
     }
 }
diff --git a/services/robotests/src/com/android/server/backup/remote/RemoteCallTest.java b/services/robotests/src/com/android/server/backup/remote/RemoteCallTest.java
index 55db616..1d92bed 100644
--- a/services/robotests/src/com/android/server/backup/remote/RemoteCallTest.java
+++ b/services/robotests/src/com/android/server/backup/remote/RemoteCallTest.java
@@ -161,7 +161,7 @@
     }
 
     @Test
-    public void testCall_whenCallbackIsCalledBeforeTimeOut_returnsSuccess() throws Exception {
+    public void testCall_whenCallbackIsCalledBeforeTimeOut_returnsResult() throws Exception {
         ConditionVariable scheduled = new ConditionVariable(false);
         RemoteCall remoteCall =
                 new RemoteCall(
@@ -176,11 +176,11 @@
 
         scheduled.block();
         runToEndOfTasks(Looper.getMainLooper());
-        assertThat(result.get()).isEqualTo(RemoteResult.successful(3));
+        assertThat(result.get()).isEqualTo(RemoteResult.of(3));
     }
 
     @Test
-    public void testCall_whenCallbackIsCalledBeforeCancel_returnsSuccess() throws Exception {
+    public void testCall_whenCallbackIsCalledBeforeCancel_returnsResult() throws Exception {
         CompletableFuture<IBackupCallback> callbackFuture = new CompletableFuture<>();
         RemoteCall remoteCall = new RemoteCall(callbackFuture::complete, 1000);
 
@@ -191,7 +191,7 @@
         IBackupCallback callback = callbackFuture.get();
         callback.operationComplete(3);
         remoteCall.cancel();
-        assertThat(result.get()).isEqualTo(RemoteResult.successful(3));
+        assertThat(result.get()).isEqualTo(RemoteResult.of(3));
     }
 
     @Test
@@ -222,6 +222,37 @@
         assertThat(result.get()).isEqualTo(RemoteResult.FAILED_CANCELLED);
     }
 
+    @Test
+    public void testExecute_whenCallbackIsCalledBeforeTimeout_returnsResult() throws Exception {
+        RemoteResult result =
+                runInWorkerThread(
+                        () -> RemoteCall.execute(callback -> callback.operationComplete(3), 1000));
+
+        assertThat(result.get()).isEqualTo(3);
+    }
+
+    @Test
+    public void testExecute_whenTimesOutBeforeCallback_returnsTimeOut() throws Exception {
+        ConditionVariable scheduled = new ConditionVariable(false);
+
+        Future<RemoteResult> result =
+                runInWorkerThreadAsync(
+                        () ->
+                                RemoteCall.execute(
+                                        callback -> {
+                                            postDelayed(
+                                                    Handler.getMain(),
+                                                    () -> callback.operationComplete(0),
+                                                    1000);
+                                            scheduled.open();
+                                        },
+                                        500));
+
+        scheduled.block();
+        runToEndOfTasks(Looper.getMainLooper());
+        assertThat(result.get()).isEqualTo(RemoteResult.FAILED_TIMED_OUT);
+    }
+
     private static <T> Future<T> runInWorkerThreadAsync(Callable<T> supplier) {
         CompletableFuture<T> future = new CompletableFuture<>();
         new Thread(() -> future.complete(uncheck(supplier)), "test-worker-thread").start();
diff --git a/services/robotests/src/com/android/server/backup/remote/RemoteResultTest.java b/services/robotests/src/com/android/server/backup/remote/RemoteResultTest.java
index f1c4f27..7f6fd57 100644
--- a/services/robotests/src/com/android/server/backup/remote/RemoteResultTest.java
+++ b/services/robotests/src/com/android/server/backup/remote/RemoteResultTest.java
@@ -35,28 +35,38 @@
 @Presubmit
 public class RemoteResultTest {
     @Test
-    public void testSucceeded_whenSuccessfulResult_returnsTrue() {
-        RemoteResult result = RemoteResult.successful(3);
+    public void testIsPresent_whenNonFailedResult_returnsTrue() {
+        RemoteResult result = RemoteResult.of(3);
 
-        boolean succeeded = result.succeeded();
+        boolean isPresent = result.isPresent();
 
-        assertThat(succeeded).isTrue();
+        assertThat(isPresent).isTrue();
     }
 
     @Test
-    public void testSucceeded_whenFailedResults_returnsFalse() {
-        boolean timeOutSucceeded = RemoteResult.FAILED_TIMED_OUT.succeeded();
-        boolean cancelledSucceeded = RemoteResult.FAILED_CANCELLED.succeeded();
-        boolean threadInterruptedSucceeded = RemoteResult.FAILED_THREAD_INTERRUPTED.succeeded();
+    public void testIsPresent_whenTimeOutResult_returnsFalse() {
+        boolean timeOutIsPresent = RemoteResult.FAILED_TIMED_OUT.isPresent();
 
-        assertThat(timeOutSucceeded).isFalse();
-        assertThat(cancelledSucceeded).isFalse();
-        assertThat(threadInterruptedSucceeded).isFalse();
+        assertThat(timeOutIsPresent).isFalse();
+    }
+
+    @Test
+    public void testIsPresent_whenCancelledResult_returnsFalse() {
+        boolean cancelledIsPresent = RemoteResult.FAILED_CANCELLED.isPresent();
+
+        assertThat(cancelledIsPresent).isFalse();
+    }
+
+    @Test
+    public void testIsPresent_whenThreadInterruptedResult_returnsFalse() {
+        boolean threadInterruptedIsPresent = RemoteResult.FAILED_THREAD_INTERRUPTED.isPresent();
+
+        assertThat(threadInterruptedIsPresent).isFalse();
     }
 
     @Test
     public void testGet_whenSuccessfulResult_returnsValue() {
-        RemoteResult result = RemoteResult.successful(7);
+        RemoteResult result = RemoteResult.of(7);
 
         long value = result.get();
 
@@ -72,7 +82,7 @@
 
     @Test
     public void testToString() {
-        assertThat(RemoteResult.successful(3).toString()).isEqualTo("RemoteResult{3}");
+        assertThat(RemoteResult.of(3).toString()).isEqualTo("RemoteResult{3}");
         assertThat(RemoteResult.FAILED_TIMED_OUT.toString())
                 .isEqualTo("RemoteResult{FAILED_TIMED_OUT}");
         assertThat(RemoteResult.FAILED_CANCELLED.toString())
@@ -83,14 +93,14 @@
 
     @Test
     public void testEquals() {
-        assertThat(RemoteResult.successful(3).equals(RemoteResult.successful(3))).isTrue();
-        assertThat(RemoteResult.successful(3).equals(RemoteResult.successful(7))).isFalse();
-        assertThat(RemoteResult.successful(-1).equals(RemoteResult.successful(1))).isFalse();
-        assertThat(RemoteResult.successful(Long.MAX_VALUE).equals(RemoteResult.successful(-1)))
+        assertThat(RemoteResult.of(3).equals(RemoteResult.of(3))).isTrue();
+        assertThat(RemoteResult.of(3).equals(RemoteResult.of(7))).isFalse();
+        assertThat(RemoteResult.of(-1).equals(RemoteResult.of(1))).isFalse();
+        assertThat(RemoteResult.of(Long.MAX_VALUE).equals(RemoteResult.of(-1)))
                 .isFalse();
-        assertThat(RemoteResult.successful(3).equals(RemoteResult.FAILED_TIMED_OUT)).isFalse();
-        assertThat(RemoteResult.successful(3).equals("3")).isFalse();
-        assertThat(RemoteResult.successful(3).equals(null)).isFalse();
+        assertThat(RemoteResult.of(3).equals(RemoteResult.FAILED_TIMED_OUT)).isFalse();
+        assertThat(RemoteResult.of(3).equals("3")).isFalse();
+        assertThat(RemoteResult.of(3).equals(null)).isFalse();
         assertThat(RemoteResult.FAILED_TIMED_OUT.equals(RemoteResult.FAILED_TIMED_OUT)).isTrue();
         assertThat(RemoteResult.FAILED_TIMED_OUT.equals(RemoteResult.FAILED_CANCELLED)).isFalse();
     }
@@ -98,9 +108,9 @@
     /** @see Object#hashCode() */
     @Test
     public void testHashCode() {
-        RemoteResult result3 = RemoteResult.successful(3);
+        RemoteResult result3 = RemoteResult.of(3);
         assertThat(result3.hashCode()).isEqualTo(result3.hashCode());
-        assertThat(result3.hashCode()).isEqualTo(RemoteResult.successful(3).hashCode());
+        assertThat(result3.hashCode()).isEqualTo(RemoteResult.of(3).hashCode());
         assertThat(RemoteResult.FAILED_TIMED_OUT.hashCode())
                 .isEqualTo(RemoteResult.FAILED_TIMED_OUT.hashCode());
         assertThat(RemoteResult.FAILED_CANCELLED.hashCode())
diff --git a/services/tests/servicestests/src/com/android/server/am/ActivityStackSupervisorTests.java b/services/tests/servicestests/src/com/android/server/am/ActivityStackSupervisorTests.java
index 20df2ae..1aa80c8 100644
--- a/services/tests/servicestests/src/com/android/server/am/ActivityStackSupervisorTests.java
+++ b/services/tests/servicestests/src/com/android/server/am/ActivityStackSupervisorTests.java
@@ -33,9 +33,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Matchers.anyInt;
-import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.reset;
@@ -46,7 +44,6 @@
 import android.app.WaitResult;
 import android.graphics.Rect;
 import android.platform.test.annotations.Presubmit;
-import android.util.SparseIntArray;
 
 import androidx.test.filters.MediumTest;
 import androidx.test.runner.AndroidJUnit4;
@@ -54,7 +51,6 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.mockito.invocation.InvocationOnMock;
 
 import java.util.ArrayList;
 
@@ -246,22 +242,6 @@
                 null /* target */, null /* targetOptions */);
     }
 
-    @Test
-    public void testTopRunningActivityLockedWithNonExistentDisplay() throws Exception {
-        // Create display that ActivityManagerService does not know about
-        final int unknownDisplayId = 100;
-
-        doAnswer((InvocationOnMock invocationOnMock) -> {
-            final SparseIntArray displayIds = invocationOnMock.<SparseIntArray>getArgument(0);
-            displayIds.put(0, 0);
-            displayIds.put(1, unknownDisplayId);
-            return null;
-        }).when(mSupervisor.mWindowManager).getDisplaysInFocusOrder(any());
-
-        // Supervisor should skip over the non-existent display.
-        assertEquals(null, mSupervisor.topRunningActivityLocked());
-    }
-
     /**
      * Verifies that removal of activity with task and stack is done correctly.
      */
@@ -339,12 +319,6 @@
         final ActivityRecord activity = new ActivityBuilder(mService).setCreateTask(true)
                 .setStack(stack).build();
 
-        doAnswer((InvocationOnMock invocationOnMock) -> {
-            final SparseIntArray displayIds = invocationOnMock.<SparseIntArray>getArgument(0);
-            displayIds.put(0, display.mDisplayId);
-            return null;
-        }).when(mSupervisor.mWindowManager).getDisplaysInFocusOrder(any());
-
         // Make sure the top running activity is not affected when keyguard is not locked
         assertEquals(activity, mService.mStackSupervisor.topRunningActivityLocked());
         assertEquals(activity, mService.mStackSupervisor.topRunningActivityLocked(
diff --git a/services/tests/servicestests/src/com/android/server/am/ActivityTestsBase.java b/services/tests/servicestests/src/com/android/server/am/ActivityTestsBase.java
index 9c0b525..aef5537 100644
--- a/services/tests/servicestests/src/com/android/server/am/ActivityTestsBase.java
+++ b/services/tests/servicestests/src/com/android/server/am/ActivityTestsBase.java
@@ -35,7 +35,6 @@
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.spy;
-import static org.mockito.Mockito.when;
 
 import android.app.ActivityManagerInternal;
 import android.app.ActivityOptions;
@@ -45,7 +44,6 @@
 import com.android.server.wm.DisplayWindowController;
 
 import org.junit.Rule;
-import org.mockito.Mockito;
 import org.mockito.invocation.InvocationOnMock;
 
 import android.app.IApplicationThread;
@@ -63,26 +61,22 @@
 import android.os.UserHandle;
 import android.service.voice.IVoiceInteractionSession;
 import android.testing.DexmakerShareClassLoaderRule;
-import android.util.SparseIntArray;
 
 import androidx.test.InstrumentationRegistry;
 
 import com.android.internal.app.IVoiceInteractor;
 import com.android.server.AttributeCache;
 import com.android.server.wm.AppWindowContainerController;
-import com.android.server.wm.DisplayWindowController;
 import com.android.server.wm.PinnedStackWindowController;
+import com.android.server.wm.RootWindowContainerController;
 import com.android.server.wm.StackWindowController;
 import com.android.server.wm.TaskWindowContainerController;
 import com.android.server.wm.WindowManagerService;
 import com.android.server.wm.WindowTestUtils;
-import com.android.server.uri.UriGrantsManagerInternal;
 
 import org.junit.After;
 import org.junit.Before;
-import org.junit.Rule;
 import org.mockito.MockitoAnnotations;
-import org.mockito.invocation.InvocationOnMock;
 
 import java.util.List;
 
@@ -500,13 +494,14 @@
                     (DisplayManager) mService.mContext.getSystemService(Context.DISPLAY_SERVICE);
             mWindowManager = prepareMockWindowManager();
             mKeyguardController = mock(KeyguardController.class);
+            setWindowContainerController(mock(RootWindowContainerController.class));
         }
 
         @Override
         public void initialize() {
             super.initialize();
             mDisplay = spy(new TestActivityDisplay(this, DEFAULT_DISPLAY));
-            attachDisplay(mDisplay);
+            addChild(mDisplay, ActivityDisplay.POSITION_TOP);
         }
 
         @Override
@@ -576,12 +571,6 @@
             return null;
         }).when(service).inSurfaceTransaction(any());
 
-        doAnswer((InvocationOnMock invocationOnMock) -> {
-            final SparseIntArray displayIds = invocationOnMock.<SparseIntArray>getArgument(0);
-            displayIds.put(0, 0);
-            return null;
-        }).when(service).getDisplaysInFocusOrder(any());
-
         return service;
     }
 
diff --git a/services/tests/servicestests/src/com/android/server/am/RecentTasksTest.java b/services/tests/servicestests/src/com/android/server/am/RecentTasksTest.java
index ba82487..5195214 100644
--- a/services/tests/servicestests/src/com/android/server/am/RecentTasksTest.java
+++ b/services/tests/servicestests/src/com/android/server/am/RecentTasksTest.java
@@ -872,8 +872,8 @@
             super.initialize();
             mDisplay = new TestActivityDisplay(this, DEFAULT_DISPLAY);
             mOtherDisplay = new TestActivityDisplay(this, DEFAULT_DISPLAY);
-            attachDisplay(mOtherDisplay);
-            attachDisplay(mDisplay);
+            addChild(mOtherDisplay, ActivityDisplay.POSITION_TOP);
+            addChild(mDisplay, ActivityDisplay.POSITION_TOP);
         }
 
         @Override
@@ -1045,7 +1045,7 @@
 
         @Override
         void getTasks(int maxNum, List<RunningTaskInfo> list, int ignoreActivityType,
-                int ignoreWindowingMode, SparseArray<ActivityDisplay> activityDisplays,
+                int ignoreWindowingMode, ArrayList<ActivityDisplay> activityDisplays,
                 int callingUid, boolean allowed) {
             lastAllowed = allowed;
             super.getTasks(maxNum, list, ignoreActivityType, ignoreWindowingMode, activityDisplays,
diff --git a/services/tests/servicestests/src/com/android/server/am/RunningTasksTest.java b/services/tests/servicestests/src/com/android/server/am/RunningTasksTest.java
index 283c027..d56c6a6 100644
--- a/services/tests/servicestests/src/com/android/server/am/RunningTasksTest.java
+++ b/services/tests/servicestests/src/com/android/server/am/RunningTasksTest.java
@@ -68,9 +68,9 @@
     public void testCollectTasksByLastActiveTime() throws Exception {
         // Create a number of stacks with tasks (of incrementing active time)
         final ActivityStackSupervisor supervisor = mService.mStackSupervisor;
-        final SparseArray<ActivityDisplay> displays = new SparseArray<>();
+        final ArrayList<ActivityDisplay> displays = new ArrayList<>();
         final ActivityDisplay display = new TestActivityDisplay(supervisor, DEFAULT_DISPLAY);
-        displays.put(DEFAULT_DISPLAY, display);
+        displays.add(display);
 
         final int numStacks = 2;
         for (int stackIndex = 0; stackIndex < numStacks; stackIndex++) {
diff --git a/services/tests/servicestests/src/com/android/server/wm/DisplayContentTests.java b/services/tests/servicestests/src/com/android/server/wm/DisplayContentTests.java
index 0d40c5e..b330304 100644
--- a/services/tests/servicestests/src/com/android/server/wm/DisplayContentTests.java
+++ b/services/tests/servicestests/src/com/android/server/wm/DisplayContentTests.java
@@ -446,24 +446,6 @@
         assertEquals(anotherAlwaysOnTopStack, mDisplayContent.getStacks().get(topPosition - 1));
     }
 
-    /**
-     * Test that WM does not report displays to AM that are pending to be removed.
-     */
-    @Test
-    public void testDontReportDeferredRemoval() {
-        // Create a display and add an animating window to it.
-        final DisplayContent dc = createNewDisplay();
-        final WindowState window = createWindow(null /* parent */, TYPE_BASE_APPLICATION, dc, "w");
-        window.mAnimatingExit = true;
-        // Request display removal, it should be deferred.
-        dc.removeIfPossible();
-        // Request ordered display ids from WM.
-        final SparseIntArray orderedDisplayIds = new SparseIntArray();
-        sWm.getDisplaysInFocusOrder(orderedDisplayIds);
-        // Make sure that display that is marked for removal is not reported.
-        assertEquals(-1, orderedDisplayIds.indexOfValue(dc.getDisplayId()));
-    }
-
     @Test
     public void testDisplayCutout_rot0() throws Exception {
         synchronized (sWm.getWindowManagerLock()) {
diff --git a/telephony/java/android/telephony/CarrierConfigManager.java b/telephony/java/android/telephony/CarrierConfigManager.java
index 8703e65..ffbe7d3 100644
--- a/telephony/java/android/telephony/CarrierConfigManager.java
+++ b/telephony/java/android/telephony/CarrierConfigManager.java
@@ -107,13 +107,34 @@
 
    /**
     * Boolean indicating if the "Call barring" item is visible in the Call Settings menu.
-    * true means visible. false means gone.
-    * @hide
+    * If true, the "Call Barring" menu will be visible. If false, the menu will be gone.
+    *
+    * Disabled by default.
     */
     public static final String KEY_CALL_BARRING_VISIBILITY_BOOL =
             "call_barring_visibility_bool";
 
     /**
+     * Flag indicating whether or not changing the call barring password via the "Call Barring"
+     * settings menu is supported. If true, the option will be visible in the "Call
+     * Barring" settings menu. If false, the option will not be visible.
+     *
+     * Enabled by default.
+     */
+    public static final String KEY_CALL_BARRING_SUPPORTS_PASSWORD_CHANGE_BOOL =
+            "call_barring_supports_password_change_bool";
+
+    /**
+     * Flag indicating whether or not deactivating all call barring features via the "Call Barring"
+     * settings menu is supported. If true, the option will be visible in the "Call
+     * Barring" settings menu. If false, the option will not be visible.
+     *
+     * Enabled by default.
+     */
+    public static final String KEY_CALL_BARRING_SUPPORTS_DEACTIVATE_ALL_BOOL =
+            "call_barring_supports_deactivate_all_bool";
+
+    /**
      * Flag indicating whether the Phone app should ignore EVENT_SIM_NETWORK_LOCKED
      * events from the Sim.
      * If true, this will prevent the IccNetworkDepersonalizationPanel from being shown, and
@@ -2125,6 +2146,8 @@
 
         sDefaults.putBoolean(KEY_CARRIER_VOLTE_PROVISIONED_BOOL, false);
         sDefaults.putBoolean(KEY_CALL_BARRING_VISIBILITY_BOOL, false);
+        sDefaults.putBoolean(KEY_CALL_BARRING_SUPPORTS_PASSWORD_CHANGE_BOOL, true);
+        sDefaults.putBoolean(KEY_CALL_BARRING_SUPPORTS_DEACTIVATE_ALL_BOOL, true);
         sDefaults.putBoolean(KEY_CALL_FORWARDING_VISIBILITY_BOOL, true);
         sDefaults.putBoolean(KEY_ADDITIONAL_SETTINGS_CALLER_ID_VISIBILITY_BOOL, true);
         sDefaults.putBoolean(KEY_ADDITIONAL_SETTINGS_CALL_WAITING_VISIBILITY_BOOL, true);
diff --git a/telephony/java/android/telephony/ServiceState.java b/telephony/java/android/telephony/ServiceState.java
index 2ee1a09..f2b73dc 100644
--- a/telephony/java/android/telephony/ServiceState.java
+++ b/telephony/java/android/telephony/ServiceState.java
@@ -353,9 +353,11 @@
         mIsDataRoamingFromRegistration = s.mIsDataRoamingFromRegistration;
         mIsUsingCarrierAggregation = s.mIsUsingCarrierAggregation;
         mChannelNumber = s.mChannelNumber;
-        mCellBandwidths = Arrays.copyOf(s.mCellBandwidths, s.mCellBandwidths.length);
+        mCellBandwidths = s.mCellBandwidths == null ? null :
+                Arrays.copyOf(s.mCellBandwidths, s.mCellBandwidths.length);
         mLteEarfcnRsrpBoost = s.mLteEarfcnRsrpBoost;
-        mNetworkRegistrationStates = new ArrayList<>(s.mNetworkRegistrationStates);
+        mNetworkRegistrationStates = s.mNetworkRegistrationStates == null ? null :
+                new ArrayList<>(s.mNetworkRegistrationStates);
     }
 
     /**
@@ -812,7 +814,9 @@
                 && mIsEmergencyOnly == s.mIsEmergencyOnly
                 && mIsDataRoamingFromRegistration == s.mIsDataRoamingFromRegistration
                 && mIsUsingCarrierAggregation == s.mIsUsingCarrierAggregation)
-                && mNetworkRegistrationStates.containsAll(s.mNetworkRegistrationStates);
+                && (mNetworkRegistrationStates == null ? s.mNetworkRegistrationStates == null :
+                        s.mNetworkRegistrationStates != null &&
+                        mNetworkRegistrationStates.containsAll(s.mNetworkRegistrationStates));
     }
 
     /**
diff --git a/tests/BackgroundDexOptServiceIntegrationTests/src/com/android/server/pm/BackgroundDexOptServiceIntegrationTests.java b/tests/BackgroundDexOptServiceIntegrationTests/src/com/android/server/pm/BackgroundDexOptServiceIntegrationTests.java
index e509d2d..fd20f4a 100644
--- a/tests/BackgroundDexOptServiceIntegrationTests/src/com/android/server/pm/BackgroundDexOptServiceIntegrationTests.java
+++ b/tests/BackgroundDexOptServiceIntegrationTests/src/com/android/server/pm/BackgroundDexOptServiceIntegrationTests.java
@@ -154,6 +154,8 @@
             stdout.append(new String(buf, 0, bytesRead));
         }
         fis.close();
+        Log.i(TAG, "stdout");
+        Log.i(TAG, stdout.toString());
         return stdout.toString();
     }
 
@@ -202,7 +204,10 @@
 
     // TODO(aeubanks): figure out how to get scheduled bg-dexopt to run
     private static void runBackgroundDexOpt() throws IOException {
-        runShellCommand("cmd package bg-dexopt-job " + PACKAGE_NAME);
+        String result = runShellCommand("cmd package bg-dexopt-job " + PACKAGE_NAME);
+        if (!result.trim().equals("Success")) {
+            throw new IllegalStateException("Expected command success, received >" + result + "<");
+        }
     }
 
     // Set the time ahead of the last use time of the test app in days.
diff --git a/tests/net/java/android/net/dhcp/DhcpLeaseRepositoryTest.java b/tests/net/java/android/net/dhcp/DhcpLeaseRepositoryTest.java
index 590bd67..7f8e7b5 100644
--- a/tests/net/java/android/net/dhcp/DhcpLeaseRepositoryTest.java
+++ b/tests/net/java/android/net/dhcp/DhcpLeaseRepositoryTest.java
@@ -32,6 +32,7 @@
 import static java.net.InetAddress.parseNumericAddress;
 
 import android.annotation.NonNull;
+import android.annotation.Nullable;
 import android.net.IpPrefix;
 import android.net.MacAddress;
 import android.net.util.SharedLog;
@@ -107,7 +108,7 @@
             MacAddress newMac = MacAddress.fromBytes(hwAddrBytes);
             final String hostname = "host_" + i;
             final DhcpLease lease = mRepo.getOffer(CLIENTID_UNSPEC, newMac,
-                    INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, hostname);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, hostname);
 
             assertNotNull(lease);
             assertEquals(newMac, lease.getHwAddr());
@@ -115,7 +116,7 @@
             assertTrue(format("Duplicate address allocated: %s in %s", lease.getNetAddr(), addrs),
                     addrs.add(lease.getNetAddr()));
 
-            mRepo.requestLease(null, newMac, null, lease.getNetAddr(), true, hostname);
+            requestLeaseSelecting(newMac, lease.getNetAddr(), hostname);
         }
     }
 
@@ -129,7 +130,7 @@
 
         try {
             mRepo.getOffer(null, TEST_MAC_2,
-                    null /* relayAddr */, null /* reqAddr */, HOSTNAME_NONE);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
             fail("Should be out of addresses");
         } catch (DhcpLeaseRepository.OutOfAddressesException e) {
             // Expected
@@ -145,8 +146,7 @@
         // Inside /28, but not available there (first address of the range)
         final Inet4Address declinedFirstAddrIn28 = parseAddr4("192.168.42.240");
 
-        final DhcpLease reqAddrIn28Lease = mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY, reqAddrIn28, false, HOSTNAME_NONE);
+        final DhcpLease reqAddrIn28Lease = requestLeaseSelecting(TEST_MAC_1, reqAddrIn28);
         mRepo.markLeaseDeclined(declinedAddrIn28);
         mRepo.markLeaseDeclined(declinedFirstAddrIn28);
 
@@ -154,14 +154,12 @@
         final Inet4Address reqAddrIn22 = parseAddr4("192.168.42.3");
         final Inet4Address declinedAddrIn22 = parseAddr4("192.168.42.4");
 
-        final DhcpLease reqAddrIn22Lease = mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_3, INET4_ANY, reqAddrIn22, false, HOSTNAME_NONE);
+        final DhcpLease reqAddrIn22Lease = requestLeaseSelecting(TEST_MAC_3, reqAddrIn22);
         mRepo.markLeaseDeclined(declinedAddrIn22);
 
         // Address that will be reserved in the updateParams call below
         final Inet4Address reservedAddr = parseAddr4("192.168.42.244");
-        final DhcpLease reservedAddrLease = mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY, reservedAddr, false, HOSTNAME_NONE);
+        final DhcpLease reservedAddrLease = requestLeaseSelecting(TEST_MAC_2, reservedAddr);
 
         // Update from /22 to /28 and add another reserved address
         Set<Inet4Address> newReserved = new HashSet<>(TEST_EXCL_SET);
@@ -183,11 +181,11 @@
     public void testGetOffer_StableAddress() throws Exception {
         for (final MacAddress macAddr : new MacAddress[] { TEST_MAC_1, TEST_MAC_2, TEST_MAC_3 }) {
             final DhcpLease lease = mRepo.getOffer(CLIENTID_UNSPEC, macAddr,
-                    INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
 
             // Same lease is offered twice
             final DhcpLease newLease = mRepo.getOffer(CLIENTID_UNSPEC, macAddr,
-                    INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
             assertEquals(lease, newLease);
         }
     }
@@ -198,17 +196,16 @@
         mRepo.updateParams(newPrefix, TEST_EXCL_SET, TEST_LEASE_TIME_MS);
 
         DhcpLease lease = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                INETADDR_UNSPEC, INETADDR_UNSPEC, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
         assertTrue(newPrefix.contains(lease.getNetAddr()));
     }
 
     @Test
     public void testGetOffer_ExistingLease() throws Exception {
-        mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY, TEST_INETADDR_1, false, TEST_HOSTNAME_1);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1, TEST_HOSTNAME_1);
 
         DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                INETADDR_UNSPEC, INETADDR_UNSPEC, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
         assertEquals(TEST_INETADDR_1, offer.getNetAddr());
         assertEquals(TEST_HOSTNAME_1, offer.getHostname());
     }
@@ -216,12 +213,12 @@
     @Test
     public void testGetOffer_ClientIdHasExistingLease() throws Exception {
         final byte[] clientId = new byte[] { 1, 2 };
-        mRepo.requestLease(clientId, TEST_MAC_1, INET4_ANY, TEST_INETADDR_1, false,
-                TEST_HOSTNAME_1);
+        mRepo.requestLease(clientId, TEST_MAC_1, INET4_ANY /* clientAddr */,
+                INET4_ANY /* relayAddr */, TEST_INETADDR_1 /* reqAddr */, false, TEST_HOSTNAME_1);
 
         // Different MAC, but same clientId
         DhcpLease offer = mRepo.getOffer(clientId, TEST_MAC_2,
-                INETADDR_UNSPEC, INETADDR_UNSPEC, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
         assertEquals(TEST_INETADDR_1, offer.getNetAddr());
         assertEquals(TEST_HOSTNAME_1, offer.getHostname());
     }
@@ -230,12 +227,12 @@
     public void testGetOffer_DifferentClientId() throws Exception {
         final byte[] clientId1 = new byte[] { 1, 2 };
         final byte[] clientId2 = new byte[] { 3, 4 };
-        mRepo.requestLease(clientId1, TEST_MAC_1, INET4_ANY, TEST_INETADDR_1, false,
-                TEST_HOSTNAME_1);
+        mRepo.requestLease(clientId1, TEST_MAC_1, INET4_ANY /* clientAddr */,
+                INET4_ANY /* relayAddr */, TEST_INETADDR_1 /* reqAddr */, false, TEST_HOSTNAME_1);
 
         // Same MAC, different client ID
         DhcpLease offer = mRepo.getOffer(clientId2, TEST_MAC_1,
-                INETADDR_UNSPEC, INETADDR_UNSPEC, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
         // Obtains a different address
         assertNotEquals(TEST_INETADDR_1, offer.getNetAddr());
         assertEquals(HOSTNAME_NONE, offer.getHostname());
@@ -244,58 +241,57 @@
 
     @Test
     public void testGetOffer_RequestedAddress() throws Exception {
-        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, TEST_HOSTNAME_1);
+        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY /* relayAddr */,
+                TEST_INETADDR_1 /* reqAddr */, TEST_HOSTNAME_1);
         assertEquals(TEST_INETADDR_1, offer.getNetAddr());
         assertEquals(TEST_HOSTNAME_1, offer.getHostname());
     }
 
     @Test
     public void testGetOffer_RequestedAddressInUse() throws Exception {
-        mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY, TEST_INETADDR_1, false, HOSTNAME_NONE);
-        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY,
-                TEST_INETADDR_1, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
+        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY /* relayAddr */,
+                TEST_INETADDR_1 /* reqAddr */, HOSTNAME_NONE);
         assertNotEquals(TEST_INETADDR_1, offer.getNetAddr());
     }
 
     @Test
     public void testGetOffer_RequestedAddressReserved() throws Exception {
-        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_RESERVED_ADDR, HOSTNAME_NONE);
+        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY /* relayAddr */,
+                TEST_RESERVED_ADDR /* reqAddr */, HOSTNAME_NONE);
         assertNotEquals(TEST_RESERVED_ADDR, offer.getNetAddr());
     }
 
     @Test
     public void testGetOffer_RequestedAddressInvalid() throws Exception {
         final Inet4Address invalidAddr = parseAddr4("192.168.42.0");
-        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                invalidAddr, HOSTNAME_NONE);
+        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY /* relayAddr */,
+                invalidAddr /* reqAddr */, HOSTNAME_NONE);
         assertNotEquals(invalidAddr, offer.getNetAddr());
     }
 
     @Test
     public void testGetOffer_RequestedAddressOutsideSubnet() throws Exception {
         final Inet4Address invalidAddr = parseAddr4("192.168.254.2");
-        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                invalidAddr, HOSTNAME_NONE);
+        DhcpLease offer = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY /* relayAddr */,
+                invalidAddr /* reqAddr */, HOSTNAME_NONE);
         assertNotEquals(invalidAddr, offer.getNetAddr());
     }
 
-    @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
+    @Test(expected = DhcpLeaseRepository.InvalidSubnetException.class)
     public void testGetOffer_RelayInInvalidSubnet() throws Exception {
-        mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                parseAddr4("192.168.254.2") /* relayAddr */, INETADDR_UNSPEC, HOSTNAME_NONE);
+        mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1, parseAddr4("192.168.254.2") /* relayAddr */,
+                INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
     }
 
     @Test
     public void testRequestLease_SelectingTwice() throws Exception {
-        DhcpLease lease1 = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, TEST_HOSTNAME_1);
+        final DhcpLease lease1 = requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1,
+                TEST_HOSTNAME_1);
 
         // Second request from same client for a different address
-        DhcpLease lease2 = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_2, true /* sidSet */, TEST_HOSTNAME_2);
+        final DhcpLease lease2 = requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_2,
+                TEST_HOSTNAME_2);
 
         assertEquals(TEST_INETADDR_1, lease1.getNetAddr());
         assertEquals(TEST_HOSTNAME_1, lease1.getHostname());
@@ -304,43 +300,43 @@
         assertEquals(TEST_HOSTNAME_2, lease2.getHostname());
 
         // First address freed when client requested a different one: another client can request it
-        DhcpLease lease3 = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
+        final DhcpLease lease3 = requestLeaseSelecting(TEST_MAC_2, TEST_INETADDR_1, HOSTNAME_NONE);
         assertEquals(TEST_INETADDR_1, lease3.getNetAddr());
     }
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_SelectingInvalid() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                parseAddr4("192.168.254.5"), true /* sidSet */, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, parseAddr4("192.168.254.5"));
     }
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_SelectingInUse() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
+        requestLeaseSelecting(TEST_MAC_2, TEST_INETADDR_1);
     }
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_SelectingReserved() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_RESERVED_ADDR, true /* sidSet */, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_RESERVED_ADDR);
+    }
+
+    @Test(expected = DhcpLeaseRepository.InvalidSubnetException.class)
+    public void testRequestLease_SelectingRelayInInvalidSubnet() throws  Exception {
+        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY /* clientAddr */,
+                parseAddr4("192.168.128.1") /* relayAddr */, TEST_INETADDR_1 /* reqAddr */,
+                true /* sidSet */, HOSTNAME_NONE);
     }
 
     @Test
     public void testRequestLease_InitReboot() throws Exception {
         // Request address once
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
 
         final long newTime = TEST_TIME + 100;
         when(mClock.elapsedRealtime()).thenReturn(newTime);
 
         // init-reboot (sidSet == false): verify configuration
-        DhcpLease lease = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, false, HOSTNAME_NONE);
+        final DhcpLease lease = requestLeaseInitReboot(TEST_MAC_1, TEST_INETADDR_1);
         assertEquals(TEST_INETADDR_1, lease.getNetAddr());
         assertEquals(newTime + TEST_LEASE_TIME_MS, lease.getExpTime());
     }
@@ -348,18 +344,15 @@
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_InitRebootWrongAddr() throws Exception {
         // Request address once
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
         // init-reboot with different requested address
-        mRepo.requestLease(
-                CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY, TEST_INETADDR_2, false, HOSTNAME_NONE);
+        requestLeaseInitReboot(TEST_MAC_1, TEST_INETADDR_2);
     }
 
     @Test
     public void testRequestLease_InitRebootUnknownAddr() throws Exception {
         // init-reboot with unknown requested address
-        DhcpLease lease = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_2, false, HOSTNAME_NONE);
+        final DhcpLease lease = requestLeaseInitReboot(TEST_MAC_1, TEST_INETADDR_2);
         // RFC2131 says we should not reply to accommodate other servers, but since we are
         // authoritative we allow creating the lease to avoid issues with lost lease DB (same as
         // dnsmasq behavior)
@@ -368,22 +361,17 @@
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_InitRebootWrongSubnet() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                parseAddr4("192.168.254.2"), false /* sidSet */, HOSTNAME_NONE);
+        requestLeaseInitReboot(TEST_MAC_1, parseAddr4("192.168.254.2"));
     }
 
     @Test
     public void testRequestLease_Renewing() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1,
-                INET4_ANY /* clientAddr */, TEST_INETADDR_1 /* reqAddr */, true, HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
 
         final long newTime = TEST_TIME + 100;
         when(mClock.elapsedRealtime()).thenReturn(newTime);
 
-        // Renewing: clientAddr filled in, no reqAddr
-        DhcpLease lease = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1,
-                TEST_INETADDR_1 /* clientAddr */, INETADDR_UNSPEC /* reqAddr */, false,
-                HOSTNAME_NONE);
+        final DhcpLease lease = requestLeaseRenewing(TEST_MAC_1, TEST_INETADDR_1);
 
         assertEquals(TEST_INETADDR_1, lease.getNetAddr());
         assertEquals(newTime + TEST_LEASE_TIME_MS, lease.getExpTime());
@@ -393,9 +381,7 @@
     public void testRequestLease_RenewingUnknownAddr() throws Exception {
         final long newTime = TEST_TIME + 100;
         when(mClock.elapsedRealtime()).thenReturn(newTime);
-        DhcpLease lease = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1,
-                TEST_INETADDR_1 /* clientAddr */, INETADDR_UNSPEC /* reqAddr */, false,
-                HOSTNAME_NONE);
+        final DhcpLease lease = requestLeaseRenewing(TEST_MAC_1, TEST_INETADDR_1);
         // Allows renewing an unknown address if available
         assertEquals(TEST_INETADDR_1, lease.getNetAddr());
         assertEquals(newTime + TEST_LEASE_TIME_MS, lease.getExpTime());
@@ -403,31 +389,24 @@
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_RenewingAddrInUse() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_2,
-                INET4_ANY /* clientAddr */, TEST_INETADDR_1 /* reqAddr */, true, HOSTNAME_NONE);
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1,
-                TEST_INETADDR_1 /* clientAddr */, INETADDR_UNSPEC /* reqAddr */, false,
-                HOSTNAME_NONE);
+        requestLeaseSelecting(TEST_MAC_2, TEST_INETADDR_1);
+        requestLeaseRenewing(TEST_MAC_1, TEST_INETADDR_1);
     }
 
     @Test(expected = DhcpLeaseRepository.InvalidAddressException.class)
     public void testRequestLease_RenewingInvalidAddr() throws Exception {
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, parseAddr4("192.168.254.2") /* clientAddr */,
-                INETADDR_UNSPEC /* reqAddr */, false, HOSTNAME_NONE);
+        requestLeaseRenewing(TEST_MAC_1, parseAddr4("192.168.254.2"));
     }
 
     @Test
     public void testReleaseLease() throws Exception {
-        DhcpLease lease1 = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
+        final DhcpLease lease1 = requestLeaseSelecting(TEST_MAC_1, TEST_INETADDR_1);
 
         assertHasLease(lease1);
         assertTrue(mRepo.releaseLease(CLIENTID_UNSPEC, TEST_MAC_1, TEST_INETADDR_1));
         assertNoLease(lease1);
 
-        DhcpLease lease2 = mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY,
-                TEST_INETADDR_1, true /* sidSet */, HOSTNAME_NONE);
-
+        final DhcpLease lease2 = requestLeaseSelecting(TEST_MAC_2, TEST_INETADDR_1);
         assertEquals(TEST_INETADDR_1, lease2.getNetAddr());
     }
 
@@ -440,15 +419,14 @@
     public void testReleaseLease_StableOffer() throws Exception {
         for (MacAddress mac : new MacAddress[] { TEST_MAC_1, TEST_MAC_2, TEST_MAC_3 }) {
             final DhcpLease lease = mRepo.getOffer(CLIENTID_UNSPEC, mac,
-                    INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
-            mRepo.requestLease(
-                    CLIENTID_UNSPEC, mac, INET4_ANY, lease.getNetAddr(), true,
-                    HOSTNAME_NONE);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+
+            requestLeaseSelecting(mac, lease.getNetAddr());
             mRepo.releaseLease(CLIENTID_UNSPEC, mac, lease.getNetAddr());
 
             // Same lease is offered after it was released
             final DhcpLease newLease = mRepo.getOffer(CLIENTID_UNSPEC, mac,
-                    INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+                    INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
             assertEquals(lease.getNetAddr(), newLease.getNetAddr());
         }
     }
@@ -456,13 +434,13 @@
     @Test
     public void testMarkLeaseDeclined() throws Exception {
         final DhcpLease lease = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
 
         mRepo.markLeaseDeclined(lease.getNetAddr());
 
         // Same lease is not offered again
         final DhcpLease newLease = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
         assertNotEquals(lease.getNetAddr(), newLease.getNetAddr());
     }
 
@@ -475,22 +453,20 @@
         mRepo.markLeaseDeclined(TEST_INETADDR_2);
 
         // /28 should have 16 addresses, 14 w/o the first/last, 11 w/o excluded addresses
-        requestAddresses((byte)9);
+        requestAddresses((byte) 9);
 
         // Last 2 addresses: addresses marked declined should be used
         final DhcpLease firstLease = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_1,
-                INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, TEST_HOSTNAME_1);
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_1, INET4_ANY, firstLease.getNetAddr(), true,
-                HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, TEST_HOSTNAME_1);
+        requestLeaseSelecting(TEST_MAC_1, firstLease.getNetAddr());
 
         final DhcpLease secondLease = mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_2,
-                INETADDR_UNSPEC /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, TEST_HOSTNAME_2);
-        mRepo.requestLease(CLIENTID_UNSPEC, TEST_MAC_2, INET4_ANY, secondLease.getNetAddr(), true,
-                HOSTNAME_NONE);
+                INET4_ANY /* relayAddr */, INETADDR_UNSPEC /* reqAddr */, TEST_HOSTNAME_2);
+        requestLeaseSelecting(TEST_MAC_2, secondLease.getNetAddr());
 
         // Now out of addresses
         try {
-            mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_3, INETADDR_UNSPEC /* relayAddr */,
+            mRepo.getOffer(CLIENTID_UNSPEC, TEST_MAC_3, INET4_ANY /* relayAddr */,
                     INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE);
             fail("Repository should be out of addresses and throw");
         } catch (DhcpLeaseRepository.OutOfAddressesException e) { /* expected */ }
@@ -501,6 +477,50 @@
         assertEquals(TEST_HOSTNAME_2, secondLease.getHostname());
     }
 
+    private DhcpLease requestLease(@NonNull MacAddress macAddr, @NonNull Inet4Address clientAddr,
+            @Nullable Inet4Address reqAddr, @Nullable String hostname, boolean sidSet)
+            throws DhcpLeaseRepository.DhcpLeaseException {
+        return mRepo.requestLease(CLIENTID_UNSPEC, macAddr, clientAddr, INET4_ANY /* relayAddr */,
+                reqAddr, sidSet, hostname);
+    }
+
+    /**
+     * Request a lease simulating a client in the SELECTING state.
+     */
+    private DhcpLease requestLeaseSelecting(@NonNull MacAddress macAddr,
+            @NonNull Inet4Address reqAddr, @Nullable String hostname)
+            throws DhcpLeaseRepository.DhcpLeaseException {
+        return requestLease(macAddr, INET4_ANY /* clientAddr */, reqAddr, hostname,
+                true /* sidSet */);
+    }
+
+    /**
+     * Request a lease simulating a client in the SELECTING state.
+     */
+    private DhcpLease requestLeaseSelecting(@NonNull MacAddress macAddr,
+            @NonNull Inet4Address reqAddr) throws DhcpLeaseRepository.DhcpLeaseException {
+        return requestLeaseSelecting(macAddr, reqAddr, HOSTNAME_NONE);
+    }
+
+    /**
+     * Request a lease simulating a client in the INIT-REBOOT state.
+     */
+    private DhcpLease requestLeaseInitReboot(@NonNull MacAddress macAddr,
+            @NonNull Inet4Address reqAddr) throws DhcpLeaseRepository.DhcpLeaseException {
+        return requestLease(macAddr, INET4_ANY /* clientAddr */, reqAddr, HOSTNAME_NONE,
+                false /* sidSet */);
+    }
+
+    /**
+     * Request a lease simulating a client in the RENEWING state.
+     */
+    private DhcpLease requestLeaseRenewing(@NonNull MacAddress macAddr,
+            @NonNull Inet4Address clientAddr) throws DhcpLeaseRepository.DhcpLeaseException {
+        // Renewing: clientAddr filled in, no reqAddr
+        return requestLease(macAddr, clientAddr, INETADDR_UNSPEC /* reqAddr */, HOSTNAME_NONE,
+                true /* sidSet */);
+    }
+
     private void assertNoLease(DhcpLease lease) {
         assertFalse("Leases contain " + lease, mRepo.getCommittedLeases().contains(lease));
     }
diff --git a/tests/net/java/android/net/dhcp/DhcpServerTest.java b/tests/net/java/android/net/dhcp/DhcpServerTest.java
index 66db5a8..45a50d9 100644
--- a/tests/net/java/android/net/dhcp/DhcpServerTest.java
+++ b/tests/net/java/android/net/dhcp/DhcpServerTest.java
@@ -216,8 +216,8 @@
     @Test
     public void testRequest_Selecting_Ack() throws Exception {
         when(mRepository.requestLease(isNull() /* clientId */, eq(TEST_CLIENT_MAC),
-                eq(INADDR_ANY) /* clientAddr */, eq(TEST_CLIENT_ADDR) /* reqAddr */,
-                eq(true) /* sidSet */, isNull() /* hostname */))
+                eq(INADDR_ANY) /* clientAddr */, eq(INADDR_ANY) /* relayAddr */,
+                eq(TEST_CLIENT_ADDR) /* reqAddr */, eq(true) /* sidSet */, isNull() /* hostname */))
                 .thenReturn(TEST_LEASE);
 
         final DhcpRequestPacket request = makeRequestSelectingPacket();
@@ -231,8 +231,8 @@
     @Test
     public void testRequest_Selecting_Nak() throws Exception {
         when(mRepository.requestLease(isNull(), eq(TEST_CLIENT_MAC),
-                eq(INADDR_ANY) /* clientAddr */, eq(TEST_CLIENT_ADDR) /* reqAddr */,
-                eq(true) /* sidSet */, isNull() /* hostname */))
+                eq(INADDR_ANY) /* clientAddr */, eq(INADDR_ANY) /* relayAddr */,
+                eq(TEST_CLIENT_ADDR) /* reqAddr */, eq(true) /* sidSet */, isNull() /* hostname */))
                 .thenThrow(new InvalidAddressException("Test error"));
 
         final DhcpRequestPacket request = makeRequestSelectingPacket();
@@ -248,7 +248,8 @@
         final DhcpRequestPacket request = makeRequestSelectingPacket();
         mServer.processPacket(request, 50000);
 
-        verify(mRepository, never()).requestLease(any(), any(), any(), any(), anyBoolean(), any());
+        verify(mRepository, never())
+                .requestLease(any(), any(), any(), any(), any(), anyBoolean(), any());
         verify(mDeps, never()).sendPacket(any(), any(), any());
     }
 
diff --git a/tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java b/tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java
index f025f41..4dc63f2 100644
--- a/tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java
+++ b/tests/net/java/com/android/server/connectivity/PermissionMonitorTest.java
@@ -21,7 +21,9 @@
 import static android.Manifest.permission.CONNECTIVITY_INTERNAL;
 import static android.Manifest.permission.CONNECTIVITY_USE_RESTRICTED_NETWORKS;
 import static android.Manifest.permission.NETWORK_STACK;
-import static android.content.pm.ApplicationInfo.FLAG_SYSTEM;
+import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_OEM;
+import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_PRODUCT;
+import static android.content.pm.ApplicationInfo.PRIVATE_FLAG_VENDOR;
 import static android.content.pm.PackageManager.GET_PERMISSIONS;
 
 import static org.junit.Assert.assertFalse;
@@ -34,6 +36,7 @@
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
+import android.os.Build;
 import android.support.test.filters.SmallTest;
 import android.support.test.runner.AndroidJUnit4;
 
@@ -48,6 +51,10 @@
 public class PermissionMonitorTest {
     private static final int MOCK_UID = 10001;
     private static final String[] MOCK_PACKAGE_NAMES = new String[] { "com.foo.bar" };
+    private static final String PARTITION_SYSTEM = "system";
+    private static final String PARTITION_OEM = "oem";
+    private static final String PARTITION_PRODUCT = "product";
+    private static final String PARTITION_VENDOR = "vendor";
 
     @Mock private Context mContext;
     @Mock private PackageManager mPackageManager;
@@ -62,39 +69,53 @@
         mPermissionMonitor = new PermissionMonitor(mContext, null);
     }
 
-    private void expectPermission(String[] permissions, boolean preinstalled) throws Exception {
-        final PackageInfo packageInfo = packageInfoWithPermissions(permissions, preinstalled);
+    private void expectPermission(String[] permissions, String partition,
+            int targetSdkVersion) throws Exception {
+        final PackageInfo packageInfo = packageInfoWithPermissions(permissions, partition);
+        packageInfo.applicationInfo.targetSdkVersion = targetSdkVersion;
         when(mPackageManager.getPackageInfoAsUser(
                 eq(MOCK_PACKAGE_NAMES[0]), eq(GET_PERMISSIONS), anyInt())).thenReturn(packageInfo);
     }
 
-    private PackageInfo packageInfoWithPermissions(String[] permissions, boolean preinstalled) {
+    private PackageInfo packageInfoWithPermissions(String[] permissions, String partition) {
         final PackageInfo packageInfo = new PackageInfo();
         packageInfo.requestedPermissions = permissions;
         packageInfo.applicationInfo = new ApplicationInfo();
-        packageInfo.applicationInfo.flags = preinstalled ? FLAG_SYSTEM : 0;
+        int privateFlags = 0;
+        switch (partition) {
+            case PARTITION_OEM:
+                privateFlags = PRIVATE_FLAG_OEM;
+                break;
+            case PARTITION_PRODUCT:
+                privateFlags = PRIVATE_FLAG_PRODUCT;
+                break;
+            case PARTITION_VENDOR:
+                privateFlags = PRIVATE_FLAG_VENDOR;
+                break;
+        }
+        packageInfo.applicationInfo.privateFlags = privateFlags;
         return packageInfo;
     }
 
     @Test
     public void testHasPermission() {
-        PackageInfo app = packageInfoWithPermissions(new String[] {}, false);
+        PackageInfo app = packageInfoWithPermissions(new String[] {}, PARTITION_SYSTEM);
         assertFalse(mPermissionMonitor.hasPermission(app, CHANGE_NETWORK_STATE));
         assertFalse(mPermissionMonitor.hasPermission(app, NETWORK_STACK));
         assertFalse(mPermissionMonitor.hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS));
         assertFalse(mPermissionMonitor.hasPermission(app, CONNECTIVITY_INTERNAL));
 
         app = packageInfoWithPermissions(new String[] {
-                CHANGE_NETWORK_STATE, NETWORK_STACK
-            }, false);
+            CHANGE_NETWORK_STATE, NETWORK_STACK
+        }, PARTITION_SYSTEM);
         assertTrue(mPermissionMonitor.hasPermission(app, CHANGE_NETWORK_STATE));
         assertTrue(mPermissionMonitor.hasPermission(app, NETWORK_STACK));
         assertFalse(mPermissionMonitor.hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS));
         assertFalse(mPermissionMonitor.hasPermission(app, CONNECTIVITY_INTERNAL));
 
         app = packageInfoWithPermissions(new String[] {
-                CONNECTIVITY_USE_RESTRICTED_NETWORKS, CONNECTIVITY_INTERNAL
-            }, false);
+            CONNECTIVITY_USE_RESTRICTED_NETWORKS, CONNECTIVITY_INTERNAL
+        }, PARTITION_SYSTEM);
         assertFalse(mPermissionMonitor.hasPermission(app, CHANGE_NETWORK_STATE));
         assertFalse(mPermissionMonitor.hasPermission(app, NETWORK_STACK));
         assertTrue(mPermissionMonitor.hasPermission(app, CONNECTIVITY_USE_RESTRICTED_NETWORKS));
@@ -102,35 +123,64 @@
     }
 
     @Test
-    public void testIsPreinstalledSystemApp() {
-        PackageInfo app = packageInfoWithPermissions(new String[] {}, false);
-        assertFalse(mPermissionMonitor.isPreinstalledSystemApp(app));
-
-        app = packageInfoWithPermissions(new String[] {}, true);
-        assertTrue(mPermissionMonitor.isPreinstalledSystemApp(app));
+    public void testIsVendorApp() {
+        PackageInfo app = packageInfoWithPermissions(new String[] {}, PARTITION_SYSTEM);
+        assertFalse(mPermissionMonitor.isVendorApp(app.applicationInfo));
+        app = packageInfoWithPermissions(new String[] {}, PARTITION_OEM);
+        assertTrue(mPermissionMonitor.isVendorApp(app.applicationInfo));
+        app = packageInfoWithPermissions(new String[] {}, PARTITION_PRODUCT);
+        assertTrue(mPermissionMonitor.isVendorApp(app.applicationInfo));
+        app = packageInfoWithPermissions(new String[] {}, PARTITION_VENDOR);
+        assertTrue(mPermissionMonitor.isVendorApp(app.applicationInfo));
     }
 
     @Test
     public void testHasUseBackgroundNetworksPermission() throws Exception {
-        expectPermission(new String[] { CHANGE_NETWORK_STATE }, false);
+        expectPermission(new String[] { CHANGE_NETWORK_STATE },
+            PARTITION_SYSTEM, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { NETWORK_STACK }, PARTITION_SYSTEM, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CONNECTIVITY_INTERNAL },
+            PARTITION_SYSTEM, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CONNECTIVITY_USE_RESTRICTED_NETWORKS },
+            PARTITION_SYSTEM, Build.VERSION_CODES.P);
         assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
 
-        expectPermission(new String[] { NETWORK_STACK, CONNECTIVITY_INTERNAL }, false);
+        expectPermission(new String[] { CHANGE_NETWORK_STATE },
+            PARTITION_VENDOR, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { NETWORK_STACK },
+            PARTITION_VENDOR, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CONNECTIVITY_INTERNAL },
+            PARTITION_VENDOR, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CONNECTIVITY_USE_RESTRICTED_NETWORKS },
+            PARTITION_VENDOR, Build.VERSION_CODES.P);
         assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
 
-        // TODO : make this false when b/31479477 is fixed
-        expectPermission(new String[] {}, true);
-        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
-        expectPermission(new String[] { CHANGE_WIFI_STATE }, true);
-        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
-
-        expectPermission(new String[] { NETWORK_STACK, CONNECTIVITY_INTERNAL }, true);
-        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
-
-        expectPermission(new String[] {}, false);
+        expectPermission(new String[] {}, PARTITION_SYSTEM, Build.VERSION_CODES.P);
         assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CHANGE_WIFI_STATE },
+            PARTITION_SYSTEM, Build.VERSION_CODES.P);
+        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] {}, PARTITION_VENDOR, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CHANGE_WIFI_STATE },
+            PARTITION_VENDOR, Build.VERSION_CODES.P);
+        assertTrue(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
 
-        expectPermission(new String[] { CHANGE_WIFI_STATE }, false);
+        expectPermission(new String[] {}, PARTITION_SYSTEM, Build.VERSION_CODES.Q);
+        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CHANGE_WIFI_STATE },
+            PARTITION_SYSTEM, Build.VERSION_CODES.Q);
+        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] {}, PARTITION_VENDOR, Build.VERSION_CODES.Q);
+        assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
+        expectPermission(new String[] { CHANGE_WIFI_STATE },
+            PARTITION_VENDOR, Build.VERSION_CODES.Q);
         assertFalse(mPermissionMonitor.hasUseBackgroundNetworksPermission(MOCK_UID));
     }
 }
diff --git a/wifi/tests/src/android/net/wifi/WifiConfigurationTest.java b/wifi/tests/src/android/net/wifi/WifiConfigurationTest.java
index 3517984..3b9f93e 100644
--- a/wifi/tests/src/android/net/wifi/WifiConfigurationTest.java
+++ b/wifi/tests/src/android/net/wifi/WifiConfigurationTest.java
@@ -18,14 +18,14 @@
 
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.assertFalse;
 
-import android.os.Parcel;
 import android.net.MacAddress;
 import android.net.wifi.WifiConfiguration.NetworkSelectionStatus;
-import android.net.wifi.WifiInfo;
+import android.os.Parcel;
+import android.support.test.filters.SmallTest;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -33,6 +33,7 @@
 /**
  * Unit tests for {@link android.net.wifi.WifiConfiguration}.
  */
+@SmallTest
 public class WifiConfigurationTest {
 
     @Before
diff --git a/wifi/tests/src/android/net/wifi/WifiSsidTest.java b/wifi/tests/src/android/net/wifi/WifiSsidTest.java
index e5794c5..b58f2c7 100644
--- a/wifi/tests/src/android/net/wifi/WifiSsidTest.java
+++ b/wifi/tests/src/android/net/wifi/WifiSsidTest.java
@@ -19,14 +19,16 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
+import android.support.test.filters.SmallTest;
+
 import org.junit.Test;
 
 import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
 
 /**
  * Unit tests for {@link android.net.wifi.WifiSsid}.
  */
+@SmallTest
 public class WifiSsidTest {
 
     private static final String TEST_SSID = "Test SSID";
diff --git a/wifi/tests/src/android/net/wifi/p2p/WifiP2pDeviceTest.java b/wifi/tests/src/android/net/wifi/p2p/WifiP2pDeviceTest.java
index e492475..80f00a4 100644
--- a/wifi/tests/src/android/net/wifi/p2p/WifiP2pDeviceTest.java
+++ b/wifi/tests/src/android/net/wifi/p2p/WifiP2pDeviceTest.java
@@ -19,11 +19,14 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
+import android.support.test.filters.SmallTest;
+
 import org.junit.Test;
 
 /**
  * Unit test harness for {@link android.net.wifi.p2p.WifiP2pDevice}
  */
+@SmallTest
 public class WifiP2pDeviceTest {
 
     /**
diff --git a/wifi/tests/src/android/net/wifi/p2p/WifiP2pManagerTest.java b/wifi/tests/src/android/net/wifi/p2p/WifiP2pManagerTest.java
index e8e4dc2..2132b41 100644
--- a/wifi/tests/src/android/net/wifi/p2p/WifiP2pManagerTest.java
+++ b/wifi/tests/src/android/net/wifi/p2p/WifiP2pManagerTest.java
@@ -21,6 +21,7 @@
 
 import android.content.Context;
 import android.os.test.TestLooper;
+import android.support.test.filters.SmallTest;
 
 import libcore.junit.util.ResourceLeakageDetector;
 
@@ -33,6 +34,7 @@
 /**
  * Unit test harness for WifiP2pManager.
  */
+@SmallTest
 public class WifiP2pManagerTest {
     private WifiP2pManager mDut;
     private TestLooper mTestLooper;
diff --git a/wifi/tests/src/android/net/wifi/rtt/WifiRttManagerTest.java b/wifi/tests/src/android/net/wifi/rtt/WifiRttManagerTest.java
index ccb9031..8997ae9 100644
--- a/wifi/tests/src/android/net/wifi/rtt/WifiRttManagerTest.java
+++ b/wifi/tests/src/android/net/wifi/rtt/WifiRttManagerTest.java
@@ -31,6 +31,7 @@
 import android.os.IBinder;
 import android.os.Parcel;
 import android.os.test.TestLooper;
+import android.support.test.filters.SmallTest;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -45,6 +46,7 @@
 /**
  * Unit test harness for WifiRttManager class.
  */
+@SmallTest
 public class WifiRttManagerTest {
     private WifiRttManager mDut;
     private TestLooper mMockLooper;