crdroidandroid · iusmac · Dec 9, 2025 · Dec 15, 2024 · Jan 22, 2026 · Jan 22, 2026
diff --git a/Android.bp b/Android.bp
@@ -142,6 +142,7 @@ filegroup {
         ":deviceproductinfoconstants_aidl",
 
         ":adbrootservice_aidl",
+        ":lmofreeform_aidl",
 
         // For the generated R.java and Manifest.java
         ":framework-res{.aapt.srcjar}",

diff --git a/CleanSpec.mk b/CleanSpec.mk
@@ -78,6 +78,7 @@ $(call add-clean-step, rm -rf $(PRODUCT_OUT)/symbols/system/lib/libhwui.so)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/libhwui.so)
 $(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/core/java/android/os/storage/*)
 $(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/core/java/android/content/IClipboard.P)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/core/java/android/pocket/*)
 $(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/telephony/java/com/android/internal/telephony/ITelephonyRegistry.P)
 $(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/android_stubs_current_intermediates)
 $(call add-clean-step, rm -rf $(OUT_DIR)/target/common/docs/api-stubs*)

diff --git a/apex/jobscheduler/service/java/com/android/server/DeviceIdleController.java b/apex/jobscheduler/service/java/com/android/server/DeviceIdleController.java
@@ -3241,9 +3241,11 @@ public int[] getAppIdTempWhitelistInternal() {
     void addPowerSaveTempAllowlistAppChecked(String packageName, long duration,
             int userId, @ReasonCode int reasonCode, @Nullable String reason)
             throws RemoteException {
-        getContext().enforceCallingOrSelfPermission(
-                Manifest.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST,
-                "No permission to change device idle whitelist");
+        if (!packageName.equals("com.google.android.gms")) {
+            getContext().enforceCallingOrSelfPermission(
+                    Manifest.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST,
+                    "No permission to change device idle whitelist");
+        }
         final int callingUid = Binder.getCallingUid();
         userId = ActivityManager.getService().handleIncomingUser(
                 Binder.getCallingPid(),

diff --git a/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java b/apex/jobscheduler/service/java/com/android/server/job/JobServiceContext.java
@@ -1485,9 +1485,11 @@ void handleOpTimeoutLocked() {
                     } else {
                         Slog.i(TAG, "JS was waiting to stop this job."
                                 + " Sending onStop: " + getRunningJobNameLocked());
-                        mParams.setStopReason(mPendingStopReason, mPendingInternalStopReason,
-                                mPendingDebugStopReason);
-                        sendStopMessageLocked(mPendingDebugStopReason);
+                        if (mParams != null) {
+                            mParams.setStopReason(mPendingStopReason, mPendingInternalStopReason,
+                                    mPendingDebugStopReason);
+                            sendStopMessageLocked(mPendingDebugStopReason);
+                        }
                         mAnrTimer.discard();
                         break;
                     }

diff --git a/apex/jobscheduler/service/java/com/android/server/job/controllers/ComponentController.java b/apex/jobscheduler/service/java/com/android/server/job/controllers/ComponentController.java
@@ -157,6 +157,7 @@ private String getServiceProcessLocked(JobStatus jobStatus) {
         }
 
         ServiceInfo si;
+        boolean jobCleared = false;
         try {
             // createContextAsUser may potentially be expensive
             // TODO: cache user context or improve ContextImpl implementation if this becomes
@@ -168,12 +169,16 @@ private String getServiceProcessLocked(JobStatus jobStatus) {
             if (mService.areUsersStartedLocked(jobStatus)) {
                 // User is fully unlocked but PM still says the package doesn't exist.
                 Slog.e(TAG, "Job exists for non-existent package: " + service.getPackageName());
+                mService.getJobStore().remove(jobStatus, true);
+                jobCleared = true;
             }
             // Write null to the cache so we don't keep querying PM.
             si = null;
         }
         final String processName = si == null ? null : si.processName;
-        mServiceProcessCache.add(userId, service, processName);
+        if (!jobCleared) {
+            mServiceProcessCache.add(userId, service, processName);
+        }
 
         return processName;
     }

diff --git a/cmds/bootanimation/BootAnimation.h b/cmds/bootanimation/BootAnimation.h
@@ -239,7 +239,7 @@ class BootAnimation : public Thread, public IBinder::DeathRecipient
     int         mTargetInset;
     bool        mUseNpotTextures = false;
     EGLDisplay  mEgl;
-    EGLDisplay  mEglContext;
+    EGLContext  mEglContext;
     // Per-Display Attributes (to support multi-display)
     std::vector<Display> mDisplays;
     bool        mClockEnabled;

diff --git a/cmds/idmap2/libidmap2/ResourceMapping.cpp b/cmds/idmap2/libidmap2/ResourceMapping.cpp
@@ -53,9 +53,9 @@ Result<Unit> CheckOverlayable(const TargetResourceContainer& target,
                               const PolicyBitmask& fulfilled_policies,
                               const ResourceId& target_resource) {
   constexpr const PolicyBitmask kDefaultPolicies =
-      PolicyFlags::ODM_PARTITION | PolicyFlags::OEM_PARTITION | PolicyFlags::SYSTEM_PARTITION |
-      PolicyFlags::VENDOR_PARTITION | PolicyFlags::PRODUCT_PARTITION | PolicyFlags::SIGNATURE |
-      PolicyFlags::CONFIG_SIGNATURE;
+      PolicyFlags::PUBLIC | PolicyFlags::ODM_PARTITION | PolicyFlags::OEM_PARTITION |
+      PolicyFlags::SYSTEM_PARTITION | PolicyFlags::VENDOR_PARTITION |
+      PolicyFlags::PRODUCT_PARTITION | PolicyFlags::SIGNATURE | PolicyFlags::CONFIG_SIGNATURE;
 
   // If the resource does not have an overlayable definition, allow the resource to be overlaid if
   // the overlay is preinstalled, signed with the same signature as the target or signed with the
@@ -131,7 +131,6 @@ Result<ResourceMapping> ResourceMapping::FromContainers(const TargetResourceCont
     }
 
     if (enforce_overlayable) {
-      // Filter out resources the overlay is not allowed to override.
       auto overlayable = CheckOverlayable(target, overlay_info, fulfilled_policies, *target_resid);
       if (!overlayable) {
         log_info.Warning(LogMessage() << "overlay '" << overlay.GetPath()

diff --git a/core/java/android/animation/Animator.java b/core/java/android/animation/Animator.java
@@ -739,7 +739,7 @@ <T, A> void callOnList(
             for (int i = 0; i < size; i++) {
                 //noinspection unchecked
                 T item = (T) array[i];
-                call.call(item, animator, isReverse);
+                if (item != null) call.call(item, animator, isReverse);
                 array[i] = null;
             }
             // Store it for the next call so we can reuse this array, if needed.

diff --git a/core/java/android/app/ActivityThread.java b/core/java/android/app/ActivityThread.java
@@ -191,6 +191,8 @@
 import android.se.omapi.SeServiceManager;
 import android.security.NetworkSecurityPolicy;
 import android.security.net.config.NetworkSecurityConfigProvider;
+import android.security.gameprops.GamePropsSpoofService;
+import android.security.pif.PlayIntegritySpoofService;
 import android.system.ErrnoException;
 import android.telephony.TelephonyFrameworkInitializer;
 import android.util.AndroidRuntimeException;
@@ -209,6 +211,7 @@
 import android.util.UtilConfig;
 import android.util.proto.ProtoOutputStream;
 import android.view.Choreographer;
+import android.view.animation.AnimationUtils;
 import android.view.Display;
 import android.view.SurfaceControl;
 import android.view.ThreadedRenderer;
@@ -253,6 +256,7 @@
 import com.android.internal.os.logging.MetricsLoggerWrapper;
 import com.android.internal.policy.DecorView;
 import com.android.internal.protolog.ProtoLog;
+import com.android.internal.util.android.FontController;
 import com.android.internal.util.ArrayUtils;
 import com.android.internal.util.FastPrintWriter;
 import com.android.internal.util.Preconditions;
@@ -4724,7 +4728,7 @@ private void reportSizeConfigurations(ActivityClientRecord r) {
             return;
         }
         Configuration[] configurations = r.activity.getResources().getSizeConfigurations();
-        if (configurations == null) {
+        if (configurations == null || r.activity.mFinished) {
             return;
         }
         r.mSizeConfigurations = new SizeConfigurationBuckets(configurations);
@@ -5571,7 +5575,7 @@ private void handleBindService(BindServiceData data) {
         Service s = mServices.get(data.token);
         if (DEBUG_SERVICE)
             Slog.v(TAG, "handleBindService s=" + s + " rebind=" + data.rebind);
-        if (s != null) {
+        if (s != null && createData != null) {
             try {
                 data.intent.setExtrasClassLoader(s.getClassLoader());
                 data.intent.prepareToEnterProcess(isProtectedComponent(createData.info),
@@ -5602,7 +5606,7 @@ private void handleBindService(BindServiceData data) {
     private void handleUnbindService(BindServiceData data) {
         CreateServiceData createData = mServicesData.get(data.token);
         Service s = mServices.get(data.token);
-        if (s != null) {
+        if (s != null && createData != null) {
             try {
                 data.intent.setExtrasClassLoader(s.getClassLoader());
                 data.intent.prepareToEnterProcess(isProtectedComponent(createData.info),
@@ -5710,7 +5714,7 @@ private void handleDumpProvider(DumpComponentInfo info) {
     private void handleServiceArgs(ServiceArgsData data) {
         CreateServiceData createData = mServicesData.get(data.token);
         Service s = mServices.get(data.token);
-        if (s != null) {
+        if (s != null && createData != null) {
             try {
                 if (data.args != null) {
                     data.args.setExtrasClassLoader(s.getClassLoader());
@@ -7181,6 +7185,8 @@ public void handleConfigurationChanged(Configuration config, int deviceId) {
         mConfigurationController.handleConfigurationChanged(config);
         updateDeviceIdForNonUIContexts(deviceId);
 
+        FontController.OnConfigurationChanged(getApplication().getResources());
+
         // These are only done to maintain @UnsupportedAppUsage and should be removed someday.
         mCurDefaultDisplayDpi = mConfigurationController.getCurDefaultDisplayDpi();
         mConfiguration = mConfigurationController.getConfiguration();
@@ -7935,6 +7941,9 @@ private void handleBindApplication(AppBindData data) {
         data.info = getPackageInfo(data.appInfo, mCompatibilityInfo, null /* baseLoader */,
                 false /* securityViolation */, true /* includeCode */,
                 false /* registerPackage */, isSdkSandbox);
+
+        FontController.OnConfigurationChanged(data.info.getResources());
+
         if (isSdkSandbox) {
             data.info.setSdkSandboxStorage(data.sdkSandboxClientAppVolumeUuid,
                     data.sdkSandboxClientAppPackage);
@@ -8008,6 +8017,23 @@ private void handleBindApplication(AppBindData data) {
         final ContextImpl appContext = ContextImpl.createAppContext(this, data.info);
         mConfigurationController.updateLocaleListFromAppContext(appContext);
 
+        GamePropsSpoofService gamePropsService = GamePropsSpoofService.getInstance();
+        if (gamePropsService.isEnabled()) {
+            gamePropsService.spoofForPackage(data.appInfo.packageName);
+        }
+
+        PlayIntegritySpoofService pifService = PlayIntegritySpoofService.getInstance();
+        if (pifService.shouldSpoof(data.processName)) {
+            pifService.spoofBuildFields(data.processName);
+            if (pifService.isSpoofSignatureEnabled()) {
+                pifService.spoofSignature();
+            }
+        }
+
+        if (pifService.shouldSpoofPhotos(data.appInfo.packageName)) {
+            pifService.spoofPhotosProps();
+        }
+
         // Initialize the default http proxy in this process.
         Trace.traceBegin(Trace.TRACE_TAG_ACTIVITY_MANAGER, "Setup proxies");
         try {
@@ -8174,6 +8200,16 @@ private void handleBindApplication(AppBindData data) {
             }
         }
 
+        if (!Process.isIsolated()) {
+            try {
+                if (AnimationUtils.ActivityAnimations.sPerfAnimEnabled) {
+                    AnimationUtils.ActivityAnimations.preload(appContext);
+                }
+            } catch (Exception e) {
+                Slog.e(TAG, "Failed to preload animations", e);
+            }
+        }
+
         try {
             mgr.finishAttachApplication(mStartSeq, timestampApplicationOnCreateNs);
         } catch (RemoteException ex) {
@@ -9067,7 +9103,9 @@ private void attach(boolean system, long startSeq) {
             RuntimeInit.setApplicationObject(mAppThread.asBinder());
             final IActivityManager mgr = ActivityManager.getService();
             try {
-                mgr.attachApplication(mAppThread, startSeq);
+                if (mgr != null) {
+                    mgr.attachApplication(mAppThread, startSeq);
+                }
             } catch (RemoteException ex) {
                 throw ex.rethrowFromSystemServer();
             }
@@ -9085,8 +9123,11 @@ private void attach(boolean system, long startSeq) {
                                 + " total=" + (runtime.totalMemory()/1024)
                                 + " used=" + (dalvikUsed/1024));
                         mSomeActivitiesChanged = false;
+                        final IActivityTaskManager atmgr = ActivityTaskManager.getService();
                         try {
-                            ActivityTaskManager.getService().releaseSomeActivities(mAppThread);
+                            if (atmgr != null) {
+                                atmgr.releaseSomeActivities(mAppThread);
+                            }
                         } catch (RemoteException e) {
                             throw e.rethrowFromSystemServer();
                         }

diff --git a/core/java/android/app/ApplicationPackageManager.java b/core/java/android/app/ApplicationPackageManager.java
@@ -116,6 +116,7 @@
 import android.provider.Settings;
 import android.ravenwood.annotation.RavenwoodKeepPartialClass;
 import android.ravenwood.annotation.RavenwoodReplace;
+import android.security.pif.PlayIntegritySpoofService;
 import android.system.ErrnoException;
 import android.system.Os;
 import android.system.OsConstants;
@@ -845,6 +846,12 @@ public boolean hasSystemFeature(String name, int version) {
         //    * IPC-retrieved system features (lazily cached, requires per-feature IPC)
         // TODO(b/375000483): Refactor all of this logic, including flag queries, into
         // the SystemFeaturesCache class after initial rollout and validation.
+        PlayIntegritySpoofService pifService = PlayIntegritySpoofService.getInstance();
+        Boolean spoofedResult = pifService.hasSystemFeature(name, version);
+        if (spoofedResult != null) {
+            return spoofedResult;
+        }
+
         Boolean maybeHasSystemFeature = RoSystemFeatures.maybeHasFeature(name, version);
         if (maybeHasSystemFeature != null) {
             return maybeHasSystemFeature;