Merge "Default permissions for sim call manager" into mnc-dev
diff --git a/api/current.txt b/api/current.txt
index 06b9494..df72adf 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -5697,6 +5697,7 @@
     method public void uninstallCaCert(android.content.ComponentName, byte[]);
     method public void wipeData(int);
     field public static final java.lang.String ACTION_ADD_DEVICE_ADMIN = "android.app.action.ADD_DEVICE_ADMIN";
+    field public static final java.lang.String ACTION_DEVICE_OWNER_CHANGED = "android.app.action.DEVICE_OWNER_CHANGED";
     field public static final java.lang.String ACTION_MANAGED_PROFILE_PROVISIONED = "android.app.action.MANAGED_PROFILE_PROVISIONED";
     field public static final java.lang.String ACTION_PROVISION_MANAGED_DEVICE = "android.app.action.PROVISION_MANAGED_DEVICE";
     field public static final java.lang.String ACTION_PROVISION_MANAGED_PROFILE = "android.app.action.PROVISION_MANAGED_PROFILE";
diff --git a/api/system-current.txt b/api/system-current.txt
index 83c3beb..319aa9f 100644
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -5829,6 +5829,7 @@
     method public void uninstallCaCert(android.content.ComponentName, byte[]);
     method public void wipeData(int);
     field public static final java.lang.String ACTION_ADD_DEVICE_ADMIN = "android.app.action.ADD_DEVICE_ADMIN";
+    field public static final java.lang.String ACTION_DEVICE_OWNER_CHANGED = "android.app.action.DEVICE_OWNER_CHANGED";
     field public static final java.lang.String ACTION_MANAGED_PROFILE_PROVISIONED = "android.app.action.MANAGED_PROFILE_PROVISIONED";
     field public static final java.lang.String ACTION_PROVISION_MANAGED_DEVICE = "android.app.action.PROVISION_MANAGED_DEVICE";
     field public static final java.lang.String ACTION_PROVISION_MANAGED_PROFILE = "android.app.action.PROVISION_MANAGED_PROFILE";
diff --git a/core/java/android/app/admin/DevicePolicyManager.java b/core/java/android/app/admin/DevicePolicyManager.java
index 33cbc9d..b2b1727 100644
--- a/core/java/android/app/admin/DevicePolicyManager.java
+++ b/core/java/android/app/admin/DevicePolicyManager.java
@@ -690,7 +690,7 @@
             = "android.app.extra.PROFILE_OWNER_NAME";
 
     /**
-     * Activity action: send when any policy admin changes a policy.
+     * Broadcast action: send when any policy admin changes a policy.
      * This is generally used to find out when a new policy is in effect.
      *
      * @hide
@@ -699,6 +699,16 @@
             = "android.app.action.DEVICE_POLICY_MANAGER_STATE_CHANGED";
 
     /**
+     * Broadcast action: sent when the device owner is set or changed.
+     *
+     * This broadcast is sent only to the primary user.
+     * @see #ACTION_PROVISION_MANAGED_DEVICE
+     */
+    @SdkConstant(SdkConstantType.BROADCAST_INTENT_ACTION)
+    public static final String ACTION_DEVICE_OWNER_CHANGED
+            = "android.app.action.DEVICE_OWNER_CHANGED";
+
+    /**
      * The ComponentName of the administrator component.
      *
      * @see #ACTION_ADD_DEVICE_ADMIN
diff --git a/core/java/android/app/assist/AssistStructure.java b/core/java/android/app/assist/AssistStructure.java
index ee0fc91..e08686c 100644
--- a/core/java/android/app/assist/AssistStructure.java
+++ b/core/java/android/app/assist/AssistStructure.java
@@ -141,10 +141,10 @@
             if (DEBUG_PARCEL) Log.d(TAG, "Creating PooledStringWriter @ " + out.dataPosition());
             PooledStringWriter pwriter = new PooledStringWriter(out);
             while (writeNextEntryToParcel(as, out, pwriter)) {
-                // If the parcel contains more than 100K of data, then we are getting too
+                // If the parcel is above the IPC limit, then we are getting too
                 // large for a single IPC so stop here and let the caller come back when it
                 // is ready for more.
-                if (out.dataSize() > 1024*1024) {
+                if (out.dataSize() > IBinder.MAX_IPC_SIZE) {
                     if (DEBUG_PARCEL) Log.d(TAG, "Assist data size is " + out.dataSize()
                             + " @ pos " + out.dataPosition() + "; returning partial result");
                     out.writeInt(0);
diff --git a/core/java/android/content/pm/ParceledListSlice.java b/core/java/android/content/pm/ParceledListSlice.java
index e5c2203..cfb4473 100644
--- a/core/java/android/content/pm/ParceledListSlice.java
+++ b/core/java/android/content/pm/ParceledListSlice.java
@@ -46,8 +46,7 @@
      * TODO get this number from somewhere else. For now set it to a quarter of
      * the 1MB limit.
      */
-    private static final int MAX_IPC_SIZE = 256 * 1024;
-    private static final int MAX_FIRST_IPC_SIZE = MAX_IPC_SIZE / 2;
+    private static final int MAX_IPC_SIZE = IBinder.MAX_IPC_SIZE;
 
     private final List<T> mList;
 
@@ -150,7 +149,7 @@
             final Class<?> listElementClass = mList.get(0).getClass();
             dest.writeParcelableCreator(mList.get(0));
             int i = 0;
-            while (i < N && dest.dataSize() < MAX_FIRST_IPC_SIZE) {
+            while (i < N && dest.dataSize() < MAX_IPC_SIZE) {
                 dest.writeInt(1);
 
                 final T parcelable = mList.get(i);
diff --git a/core/java/android/net/NetworkAgent.java b/core/java/android/net/NetworkAgent.java
index e6fc1ea..808a882 100644
--- a/core/java/android/net/NetworkAgent.java
+++ b/core/java/android/net/NetworkAgent.java
@@ -148,6 +148,13 @@
      */
     public static final int CMD_REQUEST_BANDWIDTH_UPDATE = BASE + 10;
 
+    /**
+     * Sent by ConnectivityService to the NeworkAgent to inform the agent to avoid
+     * automatically reconnecting to this network (e.g. via autojoin).  Happens
+     * when user selects "No" option on the "Stay connected?" dialog box.
+     */
+    public static final int CMD_PREVENT_AUTOMATIC_RECONNECT = BASE + 11;
+
     public NetworkAgent(Looper looper, Context context, String logTag, NetworkInfo ni,
             NetworkCapabilities nc, LinkProperties lp, int score) {
         this(looper, context, logTag, ni, nc, lp, score, null);
@@ -240,6 +247,11 @@
             }
             case CMD_SAVE_ACCEPT_UNVALIDATED: {
                 saveAcceptUnvalidated(msg.arg1 != 0);
+                break;
+            }
+            case CMD_PREVENT_AUTOMATIC_RECONNECT: {
+                preventAutomaticReconnect();
+                break;
             }
         }
     }
@@ -365,6 +377,15 @@
     protected void saveAcceptUnvalidated(boolean accept) {
     }
 
+    /**
+     * Called when the user asks to not stay connected to this network because it was found to not
+     * provide Internet access.  Usually followed by call to {@code unwanted}.  The transport is
+     * responsible for making sure the device does not automatically reconnect to the same network
+     * after the {@code unwanted} call.
+     */
+    protected void preventAutomaticReconnect() {
+    }
+
     protected void log(String s) {
         Log.d(LOG_TAG, "NetworkAgent: " + s);
     }
diff --git a/core/java/android/os/IBinder.java b/core/java/android/os/IBinder.java
index 73a0f65..2c21d13 100644
--- a/core/java/android/os/IBinder.java
+++ b/core/java/android/os/IBinder.java
@@ -149,7 +149,14 @@
      * processes.
      */
     int FLAG_ONEWAY             = 0x00000001;
-    
+
+    /**
+     * Limit that should be placed on IPC sizes to keep them safely under the
+     * transaction buffer limit.
+     * @hide
+     */
+    public static final int MAX_IPC_SIZE = 64 * 1024;
+
     /**
      * Get the canonical name of the interface supported by this binder.
      */
diff --git a/core/java/com/android/internal/logging/MetricsConstants.java b/core/java/com/android/internal/logging/MetricsConstants.java
index 7278d5c..b90cb36 100644
--- a/core/java/com/android/internal/logging/MetricsConstants.java
+++ b/core/java/com/android/internal/logging/MetricsConstants.java
@@ -250,6 +250,18 @@
     public static final int OVERVIEW_ACTIVITY = 224;
     public static final int ABOUT_LEGAL_SETTINGS = 225;
     public static final int ACTION_SEARCH_RESULTS = 226;
+    public static final int TUNER = 227;
+    public static final int TUNER_QS = 228;
+    public static final int TUNER_DEMO_MODE = 229;
+    public static final int TUNER_QS_REORDER = 230;
+    public static final int TUNER_QS_ADD = 231;
+    public static final int TUNER_QS_REMOVE = 232;
+    public static final int TUNER_STATUS_BAR_ENABLE = 233;
+    public static final int TUNER_STATUS_BAR_DISABLE = 234;
+    public static final int TUNER_DEMO_MODE_ENABLED = 235;
+    public static final int TUNER_DEMO_MODE_ON = 236;
+    public static final int TUNER_BATTERY_PERCENTAGE = 237;
+    public static final int FUELGAUGE_INACTIVE_APPS = 238;
 
     // These constants must match those in the analytic pipeline, do not edit.
     // Add temporary values to the top of MetricsLogger instead.
diff --git a/core/java/com/android/internal/logging/MetricsLogger.java b/core/java/com/android/internal/logging/MetricsLogger.java
index 91ae27b..d954b71 100644
--- a/core/java/com/android/internal/logging/MetricsLogger.java
+++ b/core/java/com/android/internal/logging/MetricsLogger.java
@@ -27,20 +27,7 @@
  */
 public class MetricsLogger implements MetricsConstants {
     // Temporary constants go here, to await migration to MetricsConstants.
-    // next value is 238;
-
-    public static final int TUNER = 227;
-    public static final int TUNER_QS = 228;
-    public static final int TUNER_DEMO_MODE = 229;
-
-    public static final int TUNER_QS_REORDER = 230;
-    public static final int TUNER_QS_ADD = 231;
-    public static final int TUNER_QS_REMOVE = 232;
-    public static final int TUNER_STATUS_BAR_ENABLE = 233;
-    public static final int TUNER_STATUS_BAR_DISABLE = 234;
-    public static final int TUNER_DEMO_MODE_ENABLED = 235;
-    public static final int TUNER_DEMO_MODE_ON = 236;
-    public static final int TUNER_BATTERY_PERCENTAGE = 237;
+    // next value is 239;
 
     public static void visible(Context context, int category) throws IllegalArgumentException {
         if (Build.IS_DEBUGGABLE && category == VIEW_UNKNOWN) {
diff --git a/core/jni/android_hardware_SensorManager.cpp b/core/jni/android_hardware_SensorManager.cpp
index 7d0afdc..ec56507 100644
--- a/core/jni/android_hardware_SensorManager.cpp
+++ b/core/jni/android_hardware_SensorManager.cpp
@@ -138,7 +138,7 @@
 (JNIEnv *env, jclass clazz, jstring opPackageName)
 {
     ScopedUtfChars opPackageNameUtf(env, opPackageName);
-    return (jlong) &SensorManager::getInstanceForPackage(String16(opPackageNameUtf.c_str()));
+    return (jlong) new SensorManager(String16(opPackageNameUtf.c_str()));
 }
 
 static jboolean
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 3e22e09..1f49929 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -319,6 +319,7 @@
 
     <protected-broadcast android:name="android.internal.policy.action.BURN_IN_PROTECTION" />
     <protected-broadcast android:name="android.app.action.SYSTEM_UPDATE_POLICY_CHANGED" />
+    <protected-broadcast android:name="android.app.action.DEVICE_OWNER_CHANGED" />
     <!-- ====================================================================== -->
     <!--                          RUNTIME PERMISSIONS                           -->
     <!-- ====================================================================== -->
diff --git a/keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java b/keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java
index 6b36a58..79095f4 100644
--- a/keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java
+++ b/keystore/java/android/security/keystore/AndroidKeyStoreKeyPairGeneratorSpi.java
@@ -63,7 +63,6 @@
 import java.security.spec.RSAKeyGenParameterSpec;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -215,7 +214,14 @@
                                     KeyProperties.PURPOSE_SIGN
                                     | KeyProperties.PURPOSE_VERIFY);
                             // Authorized to be used with any digest (including no digest).
-                            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
+                            // MD5 was never offered for Android Keystore for ECDSA.
+                            specBuilder.setDigests(
+                                    KeyProperties.DIGEST_NONE,
+                                    KeyProperties.DIGEST_SHA1,
+                                    KeyProperties.DIGEST_SHA224,
+                                    KeyProperties.DIGEST_SHA256,
+                                    KeyProperties.DIGEST_SHA384,
+                                    KeyProperties.DIGEST_SHA512);
                             break;
                         case KeymasterDefs.KM_ALGORITHM_RSA:
                             specBuilder = new KeyGenParameterSpec.Builder(
@@ -225,11 +231,23 @@
                                     | KeyProperties.PURPOSE_SIGN
                                     | KeyProperties.PURPOSE_VERIFY);
                             // Authorized to be used with any digest (including no digest).
-                            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
+                            specBuilder.setDigests(
+                                    KeyProperties.DIGEST_NONE,
+                                    KeyProperties.DIGEST_MD5,
+                                    KeyProperties.DIGEST_SHA1,
+                                    KeyProperties.DIGEST_SHA224,
+                                    KeyProperties.DIGEST_SHA256,
+                                    KeyProperties.DIGEST_SHA384,
+                                    KeyProperties.DIGEST_SHA512);
                             // Authorized to be used with any encryption and signature padding
-                            // scheme (including no padding).
+                            // schemes (including no padding).
                             specBuilder.setEncryptionPaddings(
-                                    KeyProperties.ENCRYPTION_PADDING_NONE);
+                                    KeyProperties.ENCRYPTION_PADDING_NONE,
+                                    KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1,
+                                    KeyProperties.ENCRYPTION_PADDING_RSA_OAEP);
+                            specBuilder.setSignaturePaddings(
+                                    KeyProperties.SIGNATURE_PADDING_RSA_PKCS1,
+                                    KeyProperties.SIGNATURE_PADDING_RSA_PSS);
                             // Disable randomized encryption requirement to support encryption
                             // padding NONE above.
                             specBuilder.setRandomizedEncryptionRequired(false);
@@ -724,27 +742,11 @@
                 // We use Bouncy Castle to generate self-signed RSA certificates. Bouncy Castle
                 // only supports RSA certificates signed using PKCS#1 padding scheme. The key needs
                 // to be authorized for PKCS#1 padding or padding NONE which means any padding.
-                boolean pkcs1SignaturePaddingSupported = false;
-                for (int keymasterPadding : KeyProperties.SignaturePadding.allToKeymaster(
-                        spec.getSignaturePaddings())) {
-                    if ((keymasterPadding == KeymasterDefs.KM_PAD_RSA_PKCS1_1_5_SIGN)
-                            || (keymasterPadding == KeymasterDefs.KM_PAD_NONE)) {
-                        pkcs1SignaturePaddingSupported = true;
-                        break;
-                    }
-                }
-                if (!pkcs1SignaturePaddingSupported) {
-                    // Keymaster doesn't distinguish between encryption padding NONE and signature
-                    // padding NONE. In the Android Keystore API only encryption padding NONE is
-                    // exposed.
-                    for (int keymasterPadding : KeyProperties.EncryptionPadding.allToKeymaster(
-                            spec.getEncryptionPaddings())) {
-                        if (keymasterPadding == KeymasterDefs.KM_PAD_NONE) {
-                            pkcs1SignaturePaddingSupported = true;
-                            break;
-                        }
-                    }
-                }
+                boolean pkcs1SignaturePaddingSupported =
+                        com.android.internal.util.ArrayUtils.contains(
+                                KeyProperties.SignaturePadding.allToKeymaster(
+                                        spec.getSignaturePaddings()),
+                                KeymasterDefs.KM_PAD_RSA_PKCS1_1_5_SIGN);
                 if (!pkcs1SignaturePaddingSupported) {
                     // Key not authorized for PKCS#1 signature padding -- can't sign
                     return null;
@@ -803,14 +805,8 @@
                 : KeyProperties.Digest.allToKeymaster(supportedSignatureDigests)) {
             supportedKeymasterSignatureDigests.add(keymasterDigest);
         }
-        if (authorizedKeymasterKeyDigests.contains(KeymasterDefs.KM_DIGEST_NONE)) {
-            // Key is authorized to be used with any digest
-            return supportedKeymasterSignatureDigests;
-        } else {
-            // Key is authorized to be used only with specific digests.
-            Set<Integer> result = new HashSet<Integer>(supportedKeymasterSignatureDigests);
-            result.retainAll(authorizedKeymasterKeyDigests);
-            return result;
-        }
+        Set<Integer> result = new HashSet<Integer>(supportedKeymasterSignatureDigests);
+        result.retainAll(authorizedKeymasterKeyDigests);
+        return result;
     }
 }
diff --git a/keystore/java/android/security/keystore/AndroidKeyStoreSpi.java b/keystore/java/android/security/keystore/AndroidKeyStoreSpi.java
index 915d86f..d300a92 100644
--- a/keystore/java/android/security/keystore/AndroidKeyStoreSpi.java
+++ b/keystore/java/android/security/keystore/AndroidKeyStoreSpi.java
@@ -292,7 +292,14 @@
                     new KeyProtection.Builder(
                             KeyProperties.PURPOSE_SIGN | KeyProperties.PURPOSE_VERIFY);
             // Authorized to be used with any digest (including no digest).
-            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
+            // MD5 was never offered for Android Keystore for ECDSA.
+            specBuilder.setDigests(
+                    KeyProperties.DIGEST_NONE,
+                    KeyProperties.DIGEST_SHA1,
+                    KeyProperties.DIGEST_SHA224,
+                    KeyProperties.DIGEST_SHA256,
+                    KeyProperties.DIGEST_SHA384,
+                    KeyProperties.DIGEST_SHA512);
         } else if (KeyProperties.KEY_ALGORITHM_RSA.equalsIgnoreCase(keyAlgorithm)) {
             specBuilder =
                     new KeyProtection.Builder(
@@ -301,13 +308,25 @@
                             | KeyProperties.PURPOSE_SIGN
                             | KeyProperties.PURPOSE_VERIFY);
             // Authorized to be used with any digest (including no digest).
-            specBuilder.setDigests(KeyProperties.DIGEST_NONE);
-            // Authorized to be used with any encryption and signature padding scheme (including no
-            // padding).
+            specBuilder.setDigests(
+                    KeyProperties.DIGEST_NONE,
+                    KeyProperties.DIGEST_MD5,
+                    KeyProperties.DIGEST_SHA1,
+                    KeyProperties.DIGEST_SHA224,
+                    KeyProperties.DIGEST_SHA256,
+                    KeyProperties.DIGEST_SHA384,
+                    KeyProperties.DIGEST_SHA512);
+            // Authorized to be used with any encryption and signature padding
+            // schemes (including no padding).
             specBuilder.setEncryptionPaddings(
-                    KeyProperties.ENCRYPTION_PADDING_NONE);
-            // Disable randomized encryption requirement to support encryption padding NONE
-            // above.
+                    KeyProperties.ENCRYPTION_PADDING_NONE,
+                    KeyProperties.ENCRYPTION_PADDING_RSA_PKCS1,
+                    KeyProperties.ENCRYPTION_PADDING_RSA_OAEP);
+            specBuilder.setSignaturePaddings(
+                    KeyProperties.SIGNATURE_PADDING_RSA_PKCS1,
+                    KeyProperties.SIGNATURE_PADDING_RSA_PSS);
+            // Disable randomized encryption requirement to support encryption
+            // padding NONE above.
             specBuilder.setRandomizedEncryptionRequired(false);
         } else {
             throw new KeyStoreException("Unsupported key algorithm: " + keyAlgorithm);
diff --git a/keystore/java/android/security/keystore/KeyGenParameterSpec.java b/keystore/java/android/security/keystore/KeyGenParameterSpec.java
index faaa1a6..7605231 100644
--- a/keystore/java/android/security/keystore/KeyGenParameterSpec.java
+++ b/keystore/java/android/security/keystore/KeyGenParameterSpec.java
@@ -65,17 +65,16 @@
  *
  * <p>NOTE: If a private key is not authorized to sign the self-signed certificate, then the
  * certificate will be created with an invalid signature which will not verify. Such a certificate
- * is still useful because it provides access to the public key. To generate a valid
- * signature for the certificate the key needs to be authorized for all of the following:
+ * is still useful because it provides access to the public key. To generate a valid signature for
+ * the certificate the key needs to be authorized for all of the following:
  * <ul>
  * <li>{@link KeyProperties#PURPOSE_SIGN},</li>
  * <li>operation without requiring the user to be authenticated (see
  * {@link Builder#setUserAuthenticationRequired(boolean)}),</li>
  * <li>signing/origination at this moment in time (see {@link Builder#setKeyValidityStart(Date)}
  * and {@link Builder#setKeyValidityForOriginationEnd(Date)}),</li>
- * <li>suitable digest or {@link KeyProperties#DIGEST_NONE},</li>
- * <li>(RSA keys only) padding scheme {@link KeyProperties#SIGNATURE_PADDING_RSA_PKCS1} or
- * {@link KeyProperties#ENCRYPTION_PADDING_NONE}.</li>
+ * <li>suitable digest,</li>
+ * <li>(RSA keys only) padding scheme {@link KeyProperties#SIGNATURE_PADDING_RSA_PKCS1}.</li>
  * </ul>
  *
  * <p>NOTE: The key material of the generated symmetric and private keys is not accessible. The key
@@ -668,7 +667,8 @@
          *
          * <p>For RSA private keys used by TLS/SSL servers to authenticate themselves to clients it
          * is usually necessary to authorize the use of no/any padding
-         * ({@link KeyProperties#ENCRYPTION_PADDING_NONE}). This is because RSA decryption is
+         * ({@link KeyProperties#ENCRYPTION_PADDING_NONE}) and/or PKCS#1 encryption padding
+         * ({@link KeyProperties#ENCRYPTION_PADDING_RSA_PKCS1}). This is because RSA decryption is
          * required by some cipher suites, and some stacks request decryption using no padding
          * whereas others request PKCS#1 padding.
          *
diff --git a/keystore/java/android/security/keystore/KeyProperties.java b/keystore/java/android/security/keystore/KeyProperties.java
index 2b49297..d6b1cf1 100644
--- a/keystore/java/android/security/keystore/KeyProperties.java
+++ b/keystore/java/android/security/keystore/KeyProperties.java
@@ -364,9 +364,6 @@
 
     /**
      * No encryption padding.
-     *
-     * <p><b>NOTE</b>: If a key is authorized to be used with no padding, then it can be used with
-     * any padding scheme, both for encryption and signing.
      */
     public static final String ENCRYPTION_PADDING_NONE = "NoPadding";
 
@@ -513,9 +510,6 @@
 
     /**
      * No digest: sign/authenticate the raw message.
-     *
-     * <p><b>NOTE</b>: If a key is authorized to be used with no digest, then it can be used with
-     * any digest.
      */
     public static final String DIGEST_NONE = "NONE";
 
diff --git a/keystore/java/android/security/keystore/KeyProtection.java b/keystore/java/android/security/keystore/KeyProtection.java
index ec0ef24..b71dc82 100644
--- a/keystore/java/android/security/keystore/KeyProtection.java
+++ b/keystore/java/android/security/keystore/KeyProtection.java
@@ -386,7 +386,8 @@
          *
          * <p>For RSA private keys used by TLS/SSL servers to authenticate themselves to clients it
          * is usually necessary to authorize the use of no/any padding
-         * ({@link KeyProperties#ENCRYPTION_PADDING_NONE}). This is because RSA decryption is
+         * ({@link KeyProperties#ENCRYPTION_PADDING_NONE}) and/or PKCS#1 encryption padding
+         * ({@link KeyProperties#ENCRYPTION_PADDING_RSA_PKCS1}). This is because RSA decryption is
          * required by some cipher suites, and some stacks request decryption using no padding
          * whereas others request PKCS#1 padding.
          *
diff --git a/native/android/sensor.cpp b/native/android/sensor.cpp
index ca49476..26b41e8 100644
--- a/native/android/sensor.cpp
+++ b/native/android/sensor.cpp
@@ -39,6 +39,9 @@
 
 /*****************************************************************************/
 
+android::Mutex android::SensorManager::sLock;
+std::map<String16, SensorManager*> android::SensorManager::sPackageInstances;
+
 ASensorManager* ASensorManager_getInstance()
 {
     return ASensorManager_getInstanceForPackage(NULL);
@@ -203,4 +206,4 @@
 bool ASensor_isWakeUpSensor(ASensor const* sensor)
 {
     return static_cast<Sensor const*>(sensor)->isWakeUpSensor();
-}
+}
\ No newline at end of file
diff --git a/packages/SettingsProvider/res/values/defaults.xml b/packages/SettingsProvider/res/values/defaults.xml
index 3f0d71c..1cd2908 100644
--- a/packages/SettingsProvider/res/values/defaults.xml
+++ b/packages/SettingsProvider/res/values/defaults.xml
@@ -210,4 +210,6 @@
     <!-- Default state of tap to wake -->
     <bool name="def_double_tap_to_wake">true</bool>
 
+    <!-- Default for Settings.Secure.NFC_PAYMENT_COMPONENT -->
+    <string name="def_nfc_payment_component"></string>
 </resources>
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
index 8d9f3fd..2a68252 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
@@ -1867,7 +1867,7 @@
         }
 
         private final class UpgradeController {
-            private static final int SETTINGS_VERSION = 121;
+            private static final int SETTINGS_VERSION = 122;
 
             private final int mUserId;
 
@@ -1999,6 +1999,24 @@
                 // here; SettingsState knows how to handle pre-version 120 files.
                 currentVersion = 121;
 
+                if (currentVersion == 121) {
+                    // Version 122: allow OEMs to set a default payment component in resources.
+                    // Note that we only write the default if no default has been set;
+                    // if there is, we just leave the default at whatever it currently is.
+                    final SettingsState secureSettings = getSecureSettingsLocked(userId);
+                    String defaultComponent = (getContext().getResources().getString(
+                            R.string.def_nfc_payment_component));
+                    Setting currentSetting = secureSettings.getSettingLocked(
+                            Settings.Secure.NFC_PAYMENT_DEFAULT_COMPONENT);
+                    if (defaultComponent != null && !defaultComponent.isEmpty() &&
+                        currentSetting == null) {
+                        secureSettings.insertSettingLocked(
+                                Settings.Secure.NFC_PAYMENT_DEFAULT_COMPONENT,
+                                defaultComponent,
+                                SettingsState.SYSTEM_PACKAGE_NAME);
+                    }
+                    currentVersion = 122;
+                }
                 // vXXX: Add new settings above this point.
 
                 // Return the current version.
diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index 76d2258..0b610ae 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -2378,14 +2378,10 @@
         }
 
         if (!accept) {
-            // Tell the NetworkAgent that the network does not have Internet access (because that's
-            // what we just told the user). This will hint to Wi-Fi not to autojoin this network in
-            // the future. We do this now because NetworkMonitor might not yet have finished
-            // validating and thus we might not yet have received an EVENT_NETWORK_TESTED.
-            nai.asyncChannel.sendMessage(NetworkAgent.CMD_REPORT_NETWORK_STATUS,
-                    NetworkAgent.INVALID_NETWORK, 0, null);
-            // TODO: Tear the network down once we have determined how to tell WifiStateMachine not
-            // to reconnect to it immediately. http://b/20739299
+            // Tell the NetworkAgent to not automatically reconnect to the network.
+            nai.asyncChannel.sendMessage(NetworkAgent.CMD_PREVENT_AUTOMATIC_RECONNECT);
+            // Teardown the nework.
+            teardownUnneededNetwork(nai);
         }
 
     }
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index b0d66ed..e6ce16e 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -298,7 +298,7 @@
     private static final boolean DEBUG_DEXOPT = false;
     private static final boolean DEBUG_ABI_SELECTION = false;
 
-    static final boolean CLEAR_RUNTIME_PERMISSIONS_ON_UPGRADE = Build.IS_DEBUGGABLE;
+    static final boolean CLEAR_RUNTIME_PERMISSIONS_ON_UPGRADE = false;
 
     private static final int RADIO_UID = Process.PHONE_UID;
     private static final int LOG_UID = Process.LOG_UID;
@@ -3628,8 +3628,6 @@
         if (getCallingUid() != Process.SYSTEM_UID) {
             flagMask &= ~PackageManager.FLAG_PERMISSION_SYSTEM_FIXED;
             flagValues &= ~PackageManager.FLAG_PERMISSION_SYSTEM_FIXED;
-            flagMask &= ~PackageManager.FLAG_PERMISSION_POLICY_FIXED;
-            flagValues &= ~PackageManager.FLAG_PERMISSION_POLICY_FIXED;
             flagMask &= ~PackageManager.FLAG_PERMISSION_GRANTED_BY_DEFAULT;
             flagValues &= ~PackageManager.FLAG_PERMISSION_GRANTED_BY_DEFAULT;
         }
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index 5d05f32..d9afa00 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -4140,6 +4140,14 @@
             }
             mDeviceOwner.writeOwnerFile();
             updateDeviceOwnerLocked();
+            Intent intent = new Intent(DevicePolicyManager.ACTION_DEVICE_OWNER_CHANGED);
+
+            ident = Binder.clearCallingIdentity();
+            try {
+                mContext.sendBroadcastAsUser(intent, UserHandle.OWNER);
+            } finally {
+                Binder.restoreCallingIdentity(ident);
+            }
             return true;
         }
     }