For new Thread network APIs or shell command for only testing, a new
signature permission is deversed to protect them (so to distinguish them
from existing system APIs which are designed for privileged apps such as
GMS Core).

Bug: 329368792
Change-Id: I291989eb0e024614568044945726edc07e20b8be

Since the underlying code in connectivity manager is moving to metered
firewalls to denote the uid policy for metered restrictions, NPMS can
start using them now.
Rather than having a single PENALTY_BOX, we have separate firewalls for
user and admin imposed restrictions. Once NPMS uses the appropriate
firewalls for these, it does not need to separately convey the blocked
reasons for metered restrictions on uids to the ConnectivityManager.

Flag: com.android.server.net.use_metered_firewall_chains

Test: atest FrameworksServicesTests:NetworkManagementServiceTest
Test: atest FrameworksServicesTests:NetworkPolicyManagerTest
Test: atest CtsHostsideNetworkPolicyTests

Bug: 336693007
Change-Id: I8da11ff663257d3dafcb5e22ae3313a9255ef0a6
Merged-In: I8da11ff663257d3dafcb5e22ae3313a9255ef0a6

Bug: n/a
Change-Id: Iff211c9fed743e0da93b8a5aa72c6c28e462bb4c
Test: n/a

Bug: NA
Test: NA

Change-Id: Id40751c8eaaae76a8391de6b3eef60ac38b48d86

Bug: 336807339
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0a05dd541c34dcd5d60f2cbc43c2471d7952e900)
Merged-In: I8aed84fab3b5f12e781f3834a087e186c6f61cca
Change-Id: I8aed84fab3b5f12e781f3834a087e186c6f61cca
(cherry picked from commit 98332a78)

Change-Id: I77f267228b8e9d83a6726aa25351a59cd06634b0
Bug: 335068579

Add notes to indicate that developer is responsible for validating data files picked through a file picker on WebView.

Bug: 309408775
Change-Id: Iefae7f325f5457461dd91c87c3dd2a7eee22ad36

Require VCN to be used by a "main user" instead of a "system user"
since "system user" will no longer be a full user on HSUM devices

Bug: 310310661
Test: FrameworksVcnTests, CtsVcnTestCases on non-hsum and hsum devices
Flag: android.net.vcn.enforce_main_user
Change-Id: I5abfa7ba82055cd953083b1ab3f83e61bafd8a55

This change makes sure that the consecutive delimiters at the
beginning of the just refilled buffer are consumed.

Previously, if there were consecutive delimiters at the beginning
of the just refilled buffer, they were not being consumed and were
causing parsing errors. This was also causing fatal exceptions.

```
04-22 12:37:53.077   607   707 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: CachedAppOptimizerThread
04-22 12:37:53.077   607   707 E AndroidRuntime: java.lang.NumberFormatException: invalid long: READ
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.util.ProcFileReader.invalidLong(ProcFileReader.java:238)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.util.ProcFileReader.parseAndConsumeLong(ProcFileReader.java:220)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.util.ProcFileReader.nextLong(ProcFileReader.java:183)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.util.ProcFileReader.nextLong(ProcFileReader.java:172)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.util.ProcFileReader.nextInt(ProcFileReader.java:246)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.internal.os.ProcLocksReader.handleBlockingFileLocks(ProcLocksReader.java:111)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at com.android.server.am.CachedAppOptimizer$FreezeHandler.handleMessage(CachedAppOptimizer.java:2267)
04-22 12:37:53.077   607   707 E AndroidRuntime: 	at android.os.Handler.dispatchMessage(Handler.java:107)
04-22 12
```

Bug: 336208153
Bug: 338416108
Bug: 331988929
Test: atest --host-unit-test-only -c  ProcFileReaderTest
Change-Id: I12813fa204d53d53687ffe6e8e3c0a85595b7e25

Allow disabling detector for better configurability

Bug: 336638836
Test: atest FrameworksVcnTests(new tests) && atest CtsVcnTestCases
Flag: android.net.vcn.allow_disable_ipsec_loss_detector
Change-Id: Icd7183d12fb287399a500ea9c0ee4125c749275c

This is imported from material icon at https://fonts.corp.google.com/icons?selected=Google%20Symbols%3Athread_logo%3AFILL%400%3Bwght%40400%3BGRAD%400%3Bopsz%4024

But system notifications and settings also need to use this icon. For
example, it will be used in Settings > Connected devices > Connection preferences.

Bug: 327583301
Change-Id: I08ef9c90b7d4085f9b901b3d9c41b57258aa9680

Fixed end point correctional animation for cell to cell animations
during lock pattern drawing.

In the lock pattern view, cells have an area of slop around them to
allow for drawing the pattern without hitting the exact center of cells.

When a cell is hit, the end point of the line drawn between that cell
and the previous is adjusted with an animation from the hit coordinate
and the exact center of the cell.

With LockPatternView_keepDotActivated set to true, cell animations for
the previous cell are recreated when a new cell is hit to allow changing
how a cells color is updated as the pattern is drawn.

This caused a glitch where the starting position of the end point
correcting animation for said previous cell would be recreated with the
current finger position coordinate, making it jump ahead to be closer to
the current latest cell, and animating back towards the target.

This fix makes the animation instead continue from where it was last, in
the case where the animation is recreated.

Test: manual, set a short, tight lock pattern, and try it in rapid
motion.
Bug: 328088937

Change-Id: Id445266cbc834fec7a514dbb227557f2ceae9dba

Set the container field of aconfig flags

Test: printflags --format='{package}:{container}:' | grep "::"
Bug: 312769710
Flag: NONE
Change-Id: I84fda0d5e9813940609436d825738ff786908ff0

Test: atest bionic-unit-tests CtsGwpAsanTestCases
Bug: N/A
Change-Id: I9bbd4af5d0949b6a207f207929e288a37c0899ff

Bug: 337174893
Test: manual, connect to paired but just factory reseted headset
Flag: EXEMPT, xml file change
Change-Id: I3ff5698f896b7b8caee02bf2d5f7b398c6fad418

Bug: 336807339
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:0a05dd541c34dcd5d60f2cbc43c2471d7952e900)
Merged-In: I8aed84fab3b5f12e781f3834a087e186c6f61cca
Change-Id: I8aed84fab3b5f12e781f3834a087e186c6f61cca

Bug: 318780411
Test: m droid
Change-Id: Ied8117ca15d60a504070ddd03ee72cf6ade39a94

This CL adds try-with-resources around LockscreenCredential objects,
in order to call `close()` when the resource is done being used.
This also clears the LSKF `byte[]` representation in the LockscreenCredential.

This CL applies the above changes to the KeyguardManager.

Bug: 320392352
Test: atest KeyguardManagerTest
Change-Id: Idf1d8545a7bc94a257e939fc41184ea9442694f3

Change-Id: I9714ab3699ca654a71ef3fd2d7133220a78908ca
Flag: DOCS_ONLY
Test: n/a

Change-Id: I5c083896fa47f564627345707aae2cd8afb9682e
Test: N/A OWNERS change
Flag: TEST_ONLY

Adds a flag behind which we add the new storage area API.

Bug: 325129836
Test: atest StorageAreaTest
Change-Id: I974477213015b215e60d2e23392638d674cc14c0

The implementation of ParceledListSlice allows
it to send pretty large transactions if elements are
large, so introduce a warning to aid debugging.

Bug: 333508026
Test: boot cf, no logs from this
Change-Id: I71acfafb1c3e79e1ba3bcd6459977adfa3309cb3

Adds a finalizer to the `LockscreenCredential` class, which calls
the `zeroize` method to zeroize the LSKF `byte[]`. This ensures that
`LockscreenCredential` objects that were not closed still have their
data wiped when they are garbage collected.

This is part of an effort to remove instances of the LSKF available
in a RAMdump.

Bug: 320392352
Test: atest com.android.server.locksettings
Change-Id: Id7f1f102cdaa182659e2632bdaf81bd2c46d0f86

Test: manual
Change-Id: Idd27c2b79455e0895aa73f268113a8aa873fd022

Bug: https://issuetracker.google.com/336223505
Change-Id: I5bbee1c036565d117e95941b8751f26494390be0

Bug: 309426522
Test: manual
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:9d5f70c8d3ca45447c3019bd934e338c05cef193)
Merged-In: I8905841cc46ba62099f44dbecf01c06869677bf5
Change-Id: I8905841cc46ba62099f44dbecf01c06869677bf5

Change-Id: I330e736a7972fe519f1a6487942d2a209dcea807

If hole punching offset is within block, kernel will write
zeros forcefully. Block align offset and length used for punching
to avoid unnecessary write to the disk while punching.

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861
Change-Id: Ib65e4fb9419125e89e9253bec769fce53304649a

This patch integrates IkeSessionParams#getIkeOptions into
the process of making IkeSessionParams a PersistableBundle. With
this patch, the encoding process no longer depends on a static
IKE_OPTIONS list. Thus if a new IKE Option is added in the IKE
module, it will be taken care of without needing to update the
IKE_OPTIONS list

Bug: 185941731
Test: atest FrameworksVcnTests && atest CtsVcnTestCases
Test: Manually removed options from IKE_OPTIONS and tests still
      passed
Flag: NONE mainline API flag not accessible; using try catch
      block to gate the behavior
Change-Id: I2c1a9ca1731362b1ab666e5b804911d8b0ca45e7

abtd: https://android-build.corp.google.com/builds/abtd/run/L11500030003236731

Test: atest android.telephony.cts.SmsUsageMonitorShortCodeTest

BUG: 330433149, 331889205, 332672879, 333645334

Change-Id: I22f45dc015f4a61660e719db5e1b726fa3650c83

Test: TH
Bug: 301631861
Change-Id: I079d390bbdf897971e04a5c6421a2f8f869266bf

Adding test to postsubmit first to get slo data.
This will be enabled in presumbit once the data is
available.

Test: TH
Bug: 301631861
Change-Id: Ia190474b8d12fc74cc012bac8b3542b7602d2d7a

This pacth enables IPsec packet loss detector to handle the case when
there is an intentional sequence number leap on the server's downlink.

Previously the detector assumes that sequence number will always
increase consecutively, which is not true. During load balancing the
server might add a big leap on the sequence number intentionally. In
such case a high packet loss rate does not always indicate a lossy
network. At the same time, a low loss rate does mean the network is
not lossy

Bug: 332598276
Test: atest FrameworksVcnTests (new tests) && atest CtsVcnTestCases
Change-Id: I163cb274d293a305499fd60f7ad6eed394af5a4d

Punch holes in extracted elf files in same manner as apks and embedded
shared libs. fallocate may not work on file systems which  don't allow
punching compressed files like f2fs. But that shouldn't hamper any
functionality.

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861
Change-Id: I45a153459a8cfa715a7298562dad9f1f3080b8b4

Apk files are essentially zip files. Zip files contain
central directory which has local file header offsets.
Local file header contains 'extra' field and its length info.

This info can be seen with zipinfo -v <apk_name>

Example zip entry:

Central directory entry #3:
---------------------------

  lib/x86_64/libpunchtest.so

  offset of local header from start of archive:   202
                                                  (00000000000000CAh) bytes
  file system or operating system of origin:      Unix
  version of encoding software:                   1.0
  minimum file system compatibility required:     MS-DOS, OS/2 or NT FAT
  minimum software version required to extract:   1.0
  compression method:                             none (stored)
  file security status:                           not encrypted
  extended local header:                          no
  file last modified on (DOS date/time):          2009 Jan 1 00:00:00
  32-bit CRC value (hex):                         1f180260
  compressed size:                                133376 bytes
  uncompressed size:                              133376 bytes
  length of filename:                             26 characters
  length of extra field:                          16126 bytes
  length of file comment:                         0 characters

Note the length of extra field which is 16126.

Extra field is followed by actual content of the zip entry.
When aligning Apks, Alignment tool add padding inside extra field so that
uncompressed shared libs are page aligned. ZipFileRO already provides
offset to content of a zip entry. For uncompressed libs, padding can be found
by going to the start of the extra field and looking for zero ranges.

This ranges are punched with help of fallocate(2)
Size before punching holes st_blocks: 1832, st_blksize: 4096, st_size: 1058429
Size after punching holes st_blocks: 1808, st_blksize: 4096, st_size: 1058429

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861

Change-Id: I35ac4a061828d84401d6f2d38ceb5b1a6907c00a

DDM is set to be deprecated soon. We need another venue to discover
the capabilities of the VM and Framework we used to get from FEAT and
HELO packets.

Test: NA
Bug: 333926583
Change-Id: I4743e2e840b6f87f9eb41a51e36ef0b6cab3ebe1

Adding ENABLE_PUNCH_HOLES flag to enable punch hole changes in
JNI.

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861
Change-Id: I611893e3171e0a2334e4d49b195768cdfb57fb96

Adding tests to check whether apps can be launched after
loading the punched libs. One app has uncompressed shared lib which
will be directly loaded from apk and other will extract it.

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861
Change-Id: I4f7b38902f2e02e83a350cd1cc907f8edaa20c81

Extra padding at the end of LOAD segments is being introduced when libraries are being
aligned to 64KB. This increases space used by shared libraries.

This change deallocates space used by zero padding at the end of LOAD segments in given
uncompressed ELF file. Zero padding can be detected by reading ELF headers. Executable header
gives out the position of program headers. LOAD segments can be identified from program headers.
FileSiz specifies the size of the data in corresponding LOAD segment.

Ex. ELF header format for libpunchtest.so

Program Headers:
  Type           Offset   VirtAddr           PhysAddr           FileSiz  MemSiz   Flg Align
  PHDR           0x000040 0x0000000000000040 0x0000000000000040 0x0001f8 0x0001f8 R   0x8
  LOAD           0x000000 0x0000000000000000 0x0000000000000000 0x0003e8 0x0003e8 R   0x10000
  LOAD           0x010000 0x0000000000010000 0x0000000000010000 0x000050 0x000050 R E 0x10000
  LOAD           0x020000 0x0000000000020000 0x0000000000020000 0x0001b8 0x0001b8 RW  0x10000
  DYNAMIC        0x020018 0x0000000000020018 0x0000000000020018 0x000180 0x000180 RW  0x8
  GNU_RELRO      0x020000 0x0000000000020000 0x0000000000020000 0x0001b8 0x001000 R   0x1
  GNU_EH_FRAME   0x000368 0x0000000000000368 0x0000000000000368 0x000024 0x000024 R   0x4
  GNU_STACK      0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RW  0
  NOTE           0x000238 0x0000000000000238 0x0000000000000238 0x000050 0x000050 R   0x4

Zero padding can be found as :
Padding Length = Offset of LOAD SEGMENT 2 - (Offset of LOAD SEGMENT 1 + FileSiz of LOAD SEGMENT 1)

This padding is present at position = (Offset of LOAD SEGMENT 1 + FileSiz of LOAD SEGMENT 1)

[fallocate(2)](http://man7.org/linux/man-pages/man2/fallocate.2.html) is used to deallocate the
zero ranges at the end of LOAD segments. It is called with above padding length and position.
If ELF file is present inside of ApK/Zip file, offset to the start of the ELF file should be added
to the position.

From test logs, stats for installation embedded_native_libs_test_app.apk. Note: ELF was 64bit aligned during tests.

Size before punching holes st_blocks: 2072, st_blksize: 4096, st_size: 1058429
Size after punching holes st_blocks: 1832, st_blksize: 4096, st_size: 1058429

Punching will be skipped for content which is less than 4096 bytes in
size.

Test: acloud delete --all && m && acloud create --local-instance --local-image && adb logcat -c && m FileSystemUtilsTests && atest -c FileSystemUtilsTests
Bug: 301631861
Change-Id: I86060f877f90e98c103e884cf6d303f0bdfa4d12

Upstream linux has added support for pgtables, uid, and rss stats fields
in the mark_victim tracepoint[1]. Update the OomKillRecord to track the
new fields, and report them to telemetry.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=72ba14deb40a9e9668ec5e66a341ed657e5215c2



Test: statsd_testdrive 754 displays new fields
Test: m
Bug: 331214192
Change-Id: I23ee8b9a395c991d8506e927346b63d770152433
Merged-In: I23ee8b9a395c991d8506e927346b63d770152433
Signed-off-by: Carlos Galo <carlosgalo@google.com>