GrapheneOS · BasedJellyfish11 · Jul 31, 2022 · Jun 2, 2024 · Dec 18, 2023 · Dec 18, 2023
diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__arm_CtsShimPriv_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__arm_CtsShimPriv_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_arm64/CtsShimPriv.apk"
   }

diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__arm_CtsShim_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__arm_CtsShim_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_arm64/CtsShim.apk"
   }

diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__riscv64_CtsShimPriv_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__riscv64_CtsShimPriv_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_riscv64/CtsShimPriv.apk"
   }

diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__riscv64_CtsShim_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__riscv64_CtsShim_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_riscv64/CtsShim.apk"
   }

diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__x86_CtsShimPriv_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__x86_CtsShimPriv_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_x86_64/CtsShimPriv.apk"
   }

diff --git a/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__x86_CtsShim_apk.asciipb b/.prebuilt_info/prebuilt_info_packages_CtsShim_apk__x86_CtsShim_apk.asciipb
@@ -1,6 +1,6 @@
 drops {
   android_build_drop {
-    build_id: "11947186"
+    build_id: "14083884"
     target: "CtsShim"
     source_file: "aosp_x86_64/CtsShim.apk"
   }

diff --git a/METADATA b/METADATA
@@ -1,3 +1,33 @@
 third_party {
   license_type: RECIPROCAL
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/x86/CtsShim.apk"
+    version: "16"
+  }
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/x86/CtsShimPriv.apk"
+    version: "16"
+  }
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/riscv64/CtsShim.apk"
+    version: "16"
+  }
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/riscv64/CtsShimPriv.apk"
+    version: "16"
+  }
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/arm/CtsShim.apk"
+    version: "16"
+  }
+  identifier {
+    type: "PrebuiltByAlphabet"
+    value: "packages/CtsShim/apk/arm/CtsShimPriv.apk"
+    version: "16"
+  }
 }
diff --git a/TODO-16-qpr1 b/TODO-16-qpr1
@@ -0,0 +1,7 @@
+Skipped commits:
+colors: Switch to GrapheneOS blue color palette for Material You
+port 2FA tests
+enable boot/bootloader/radio version checks (not clear whether it's needed)
+
+Potential issue:
+always-on Location indicator changes
diff --git a/apex/jobscheduler/framework/java/android/app/AlarmManager.java b/apex/jobscheduler/framework/java/android/app/AlarmManager.java
@@ -26,6 +26,7 @@
 import android.annotation.SystemApi;
 import android.annotation.SystemService;
 import android.annotation.TestApi;
+import android.app.compat.gms.GmsCompat;
 import android.compat.annotation.ChangeId;
 import android.compat.annotation.EnabledSince;
 import android.compat.annotation.UnsupportedAppUsage;
@@ -1049,6 +1050,17 @@ private void setImpl(@AlarmType int type, long triggerAtMillis, long windowMilli
             long intervalMillis, int flags, PendingIntent operation, final OnAlarmListener listener,
             String listenerTag, Executor targetExecutor, WorkSource workSource,
             AlarmClockInfo alarmClock) {
+        if (GmsCompat.isEnabled()) {
+            if (windowMillis == WINDOW_EXACT && !canScheduleExactAlarms()) {
+                windowMillis = WINDOW_HEURISTIC;
+            }
+            // non-null WorkSource requires privileged UPDATE_DEVICE_STATS permission
+            workSource = null;
+
+            // requires privileged SCHEDULE_PRIORITIZED_ALARM permission
+            flags &= ~FLAG_PRIORITIZE;
+        }
+
         if (triggerAtMillis < 0) {
             /* NOTYET
             if (mAlwaysExact) {

diff --git a/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java b/apex/jobscheduler/framework/java/android/os/PowerExemptionManager.java
@@ -30,8 +30,11 @@
 import android.annotation.SystemApi;
 import android.annotation.SystemService;
 import android.annotation.UserHandleAware;
+import android.app.compat.gms.GmsCompat;
 import android.content.Context;
 
+import com.android.internal.gmscompat.GmsCompatApp;
+
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Collections;
@@ -626,6 +629,11 @@ public void removeFromPermanentAllowList(@NonNull String packageName) {
     @RequiresPermission(android.Manifest.permission.CHANGE_DEVICE_IDLE_TEMP_WHITELIST)
     public void addToTemporaryAllowList(@NonNull String packageName, @ReasonCode int reasonCode,
             @Nullable String reason, long durationMs) {
+        if (GmsCompat.isEnabled()) {
+            GmsCompatApp.raisePackageToForeground(packageName, durationMs, reason, reasonCode);
+            return;
+        }
+
         try {
             mService.addPowerSaveTempWhitelistApp(packageName, durationMs, mContext.getUserId(),
                     reasonCode, reason);

diff --git a/apex/jobscheduler/framework/java/com/android/server/DeviceIdleInternal.java b/apex/jobscheduler/framework/java/com/android/server/DeviceIdleInternal.java
@@ -74,7 +74,7 @@ void addPowerSaveTempWhitelistAppDirect(int uid, long duration,
 
     boolean isAppOnWhitelist(int appid);
 
-    int[] getPowerSaveWhitelistUserAppIds();
+    int[] getPowerSaveWhitelistAppIds();
 
     int[] getPowerSaveTempWhitelistAppIds();
 

diff --git a/apex/jobscheduler/service/java/com/android/server/DeviceIdleController.java b/apex/jobscheduler/service/java/com/android/server/DeviceIdleController.java
@@ -2394,14 +2394,14 @@ public String[] getFullPowerWhitelistExceptIdle() {
         }
 
         /**
-         * Returns the array of app ids whitelisted by user. Take care not to
+         * Returns the array of whitelisted app ids. Take care not to
          * modify this, as it is a reference to the original copy. But the reference
          * can change when the list changes, so it needs to be re-acquired when
          * {@link PowerManager#ACTION_POWER_SAVE_WHITELIST_CHANGED} is sent.
          */
         @Override
-        public int[] getPowerSaveWhitelistUserAppIds() {
-            return DeviceIdleController.this.getPowerSaveWhitelistUserAppIds();
+        public int[] getPowerSaveWhitelistAppIds() {
+            return DeviceIdleController.this.getAppIdWhitelistInternal();
         }
 
         @Override

diff --git a/...obscheduler/service/java/com/android/server/job/controllers/DeviceIdleJobsController.java b/...obscheduler/service/java/com/android/server/job/controllers/DeviceIdleJobsController.java
@@ -97,7 +97,7 @@ public void onReceive(Context context, Intent intent) {
                 case PowerManager.ACTION_POWER_SAVE_WHITELIST_CHANGED:
                     synchronized (mLock) {
                         mDeviceIdleWhitelistAppIds =
-                                mLocalDeviceIdleController.getPowerSaveWhitelistUserAppIds();
+                                mLocalDeviceIdleController.getPowerSaveWhitelistAppIds();
                         if (DEBUG) {
                             Slog.d(TAG, "Got whitelist "
                                     + Arrays.toString(mDeviceIdleWhitelistAppIds));
@@ -143,7 +143,7 @@ public DeviceIdleJobsController(JobSchedulerService service) {
         mPowerManager = (PowerManager) mContext.getSystemService(Context.POWER_SERVICE);
         mLocalDeviceIdleController =
                 LocalServices.getService(DeviceIdleInternal.class);
-        mDeviceIdleWhitelistAppIds = mLocalDeviceIdleController.getPowerSaveWhitelistUserAppIds();
+        mDeviceIdleWhitelistAppIds = mLocalDeviceIdleController.getPowerSaveWhitelistAppIds();
         mPowerSaveTempWhitelistAppIds =
                 mLocalDeviceIdleController.getPowerSaveTempWhitelistAppIds();
         mDeviceIdleUpdateFunctor = new DeviceIdleUpdateFunctor();
@@ -205,7 +205,7 @@ public void setUidActiveLocked(int uid, boolean active) {
     }
 
     /**
-     * Checks if the given job's scheduling app id exists in the device idle user whitelist.
+     * Checks if the given job's scheduling app id exists in the device idle whitelist.
      */
     boolean isWhitelistedLocked(JobStatus job) {
         return Arrays.binarySearch(mDeviceIdleWhitelistAppIds,

diff --git a/apex/jobscheduler/service/java/com/android/server/job/controllers/JobStatus.java b/apex/jobscheduler/service/java/com/android/server/job/controllers/JobStatus.java
@@ -39,6 +39,7 @@
 import android.app.usage.UsageStatsManager;
 import android.content.ClipData;
 import android.content.ComponentName;
+import android.content.Context;
 import android.net.Network;
 import android.net.NetworkRequest;
 import android.net.Uri;
@@ -2549,6 +2550,23 @@ private boolean isConstraintsSatisfied(int satisfiedConstraints) {
             return true;
         }
 
+        if ((mRequiredConstraintsOfInterest & CONSTRAINT_CONNECTIVITY) != 0) {
+            if ((satisfiedConstraints & CONSTRAINT_CONNECTIVITY) != 0) {
+                var pmi = LocalServices.getService(
+                        com.android.server.pm.permission.PermissionManagerServiceInternal.class);
+
+                if (pmi.checkUidPermission(getSourceUid(), android.Manifest.permission.INTERNET, Context.DEVICE_ID_DEFAULT) !=
+                        android.content.pm.PackageManager.PERMISSION_GRANTED) {
+                    if (DEBUG) {
+                        Slog.d(TAG, "skipping job " + getJobId() + " for " + getSourcePackageName()
+                                + " in user " + getSourceUserId() + ": it has CONSTRAINT_CONNECTIVITY, "
+                                + "but its UID doesn't have the INTERNET permission");
+                    }
+                    return false;
+                }
+            }
+        }
+
         int sat = satisfiedConstraints;
         if (overrideState == OVERRIDE_SOFT) {
             // override: pretend all 'soft' requirements are satisfied

diff --git a/cmds/app_process/app_main.cpp b/cmds/app_process/app_main.cpp
@@ -85,8 +85,10 @@ class AppRuntime : public AndroidRuntime
         AndroidRuntime* ar = AndroidRuntime::getRuntime();
         ar->callMain(mClassName, mClass, mArgs);
 
-        IPCThreadState::self()->stopProcess();
-        hardware::IPCThreadState::self()->stopProcess();
+        if (mClassName != "com.android.internal.os.ExecInit") {
+            IPCThreadState::self()->stopProcess();
+            hardware::IPCThreadState::self()->stopProcess();
+        }
     }
 
     virtual void onZygoteInit()
@@ -335,7 +337,12 @@ int main(int argc, char* const argv[])
     if (zygote) {
         runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
     } else if (!className.empty()) {
-        runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
+        const char* isExecSpawning = getenv("IS_EXEC_SPAWNED_APP_PROCESS");
+        if (isExecSpawning != nullptr && strcmp(isExecSpawning, "1") == 0) {
+            runtime.start("com.android.internal.os.ZygoteInit", args, false);
+        } else {
+            runtime.start("com.android.internal.os.RuntimeInit", args, zygote);
+        }
     } else {
         fprintf(stderr, "Error: no class name or --zygote supplied.\n");
         app_usage();

diff --git a/cmds/hid/jni/com_android_commands_hid_Device.cpp b/cmds/hid/jni/com_android_commands_hid_Device.cpp
@@ -380,7 +380,7 @@ static void closeDevice(JNIEnv* /* env */, jclass /* clazz */, jlong ptr) {
     }
 }
 
-static JNINativeMethod sMethods[] = {
+static const JNINativeMethod sMethods[] = {
         {"nativeOpenDevice",
          "(Ljava/lang/String;Ljava/lang/String;IIII[B"
          "Lcom/android/commands/hid/Device$DeviceCallback;)J",

diff --git a/cmds/uinput/jni/com_android_commands_uinput_Device.cpp b/cmds/uinput/jni/com_android_commands_uinput_Device.cpp
@@ -325,7 +325,7 @@ static jint getEvdevInputPropByLabel(JNIEnv* env, jclass /* clazz */, jstring ra
     return InputEventLookup::getLinuxEvdevInputPropByLabel(label.c_str()).value_or(-1);
 }
 
-static JNINativeMethod sMethods[] = {
+static const JNINativeMethod sMethods[] = {
         {"nativeOpenUinputDevice",
          "(Ljava/lang/String;IIIIIILjava/lang/String;"
          "Lcom/android/commands/uinput/Device$DeviceCallback;)J",

diff --git a/core/api/current.txt b/core/api/current.txt
@@ -244,6 +244,7 @@ package android {
     field public static final String NFC = "android.permission.NFC";
     field public static final String NFC_PREFERRED_PAYMENT_INFO = "android.permission.NFC_PREFERRED_PAYMENT_INFO";
     field public static final String NFC_TRANSACTION_EVENT = "android.permission.NFC_TRANSACTION_EVENT";
+    field public static final String OTHER_SENSORS = "android.permission.OTHER_SENSORS";
     field public static final String OVERRIDE_WIFI_CONFIG = "android.permission.OVERRIDE_WIFI_CONFIG";
     field public static final String PACKAGE_USAGE_STATS = "android.permission.PACKAGE_USAGE_STATS";
     field @Deprecated public static final String PERSISTENT_ACTIVITY = "android.permission.PERSISTENT_ACTIVITY";
@@ -372,7 +373,9 @@ package android {
     field public static final String LOCATION = "android.permission-group.LOCATION";
     field public static final String MICROPHONE = "android.permission-group.MICROPHONE";
     field public static final String NEARBY_DEVICES = "android.permission-group.NEARBY_DEVICES";
+    field public static final String NETWORK = "android.permission-group.NETWORK";
     field public static final String NOTIFICATIONS = "android.permission-group.NOTIFICATIONS";
+    field public static final String OTHER_SENSORS = "android.permission-group.OTHER_SENSORS";
     field public static final String PHONE = "android.permission-group.PHONE";
     field public static final String READ_MEDIA_AURAL = "android.permission-group.READ_MEDIA_AURAL";
     field public static final String READ_MEDIA_VISUAL = "android.permission-group.READ_MEDIA_VISUAL";
@@ -45100,7 +45103,7 @@ package android.telecom {
     method public android.telecom.PhoneAccountHandle getSimCallManager();
     method @Nullable public android.telecom.PhoneAccountHandle getSimCallManagerForSubscription(int);
     method @Nullable public String getSystemDialerPackage();
-    method @Nullable @RequiresPermission(android.Manifest.permission.READ_PHONE_STATE) public android.telecom.PhoneAccountHandle getUserSelectedOutgoingPhoneAccount();
+    method @Nullable @RequiresPermission(anyOf={"android.permission.READ_PRIVILEGED_PHONE_STATE", "android.permission.READ_PRIVILEGED_PHONE_STATE_ANDROID_AUTO"}) public android.telecom.PhoneAccountHandle getUserSelectedOutgoingPhoneAccount();
     method @RequiresPermission(android.Manifest.permission.READ_PHONE_STATE) public String getVoiceMailNumber(android.telecom.PhoneAccountHandle);
     method @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE) public boolean handleMmi(String);
     method @RequiresPermission(android.Manifest.permission.MODIFY_PHONE_STATE) public boolean handleMmi(String, android.telecom.PhoneAccountHandle);

diff --git a/core/api/module-lib-current.txt b/core/api/module-lib-current.txt
@@ -86,6 +86,20 @@ package android.app.admin {
 
 }
 
+package android.app.compat.gms {
+
+  public class GmsModuleHooks {
+    method @Nullable public static String deviceConfigGetProperty(@NonNull String, @NonNull String);
+    method public static boolean deviceConfigSetProperties(@NonNull android.provider.DeviceConfig.Properties);
+    method public static boolean deviceConfigSetProperty(@NonNull String, @NonNull String, @Nullable String);
+    method @Nullable public static Boolean enableBluetoothAdapter();
+    method public static void enableNfc();
+    method public static boolean interceptSynchronousResultReceiverException(@NonNull RuntimeException);
+    method public static void makeBluetoothAdapterDiscoverable();
+  }
+
+}
+
 package android.content {
 
   public abstract class ContentProvider implements android.content.ComponentCallbacks2 {
@@ -99,7 +113,6 @@ package android.content {
   public abstract class Context {
     method @NonNull public android.content.Context createContextForSdkInSandbox(@NonNull android.content.pm.ApplicationInfo, int) throws android.content.pm.PackageManager.NameNotFoundException;
     method @NonNull public android.os.IBinder getProcessToken();
-    method @NonNull public android.os.UserHandle getUser();
     field @FlaggedApi("android.os.profiling.anomaly.flags.anomaly_detector_core") public static final String ANOMALY_DETECTOR_SERVICE = "anomaly_detector";
     field @FlaggedApi("android.app.ondeviceintelligence.flags.enable_on_device_intelligence_module") public static final int BIND_FOREGROUND_SERVICE = 67108864; // 0x4000000
     field public static final String PAC_PROXY_SERVICE = "pac_proxy";
@@ -145,6 +158,38 @@ package android.content.pm {
 
 }
 
+package android.ext {
+
+  public class ConnectivityUtil {
+    method public static boolean isRegularAppWithLockdownVpnEnabled(@NonNull android.content.Context, int);
+    method public static boolean isSystem(@NonNull android.content.Context, int);
+  }
+
+}
+
+package android.ext.settings {
+
+  public class ConnChecksSetting {
+    method public static int get();
+    method public static boolean put(int);
+    field public static final int VAL_DEFAULT = 0; // 0x0
+    field public static final int VAL_DISABLED = 2; // 0x2
+    field public static final int VAL_GRAPHENEOS = 0; // 0x0
+    field public static final int VAL_STANDARD = 1; // 0x1
+  }
+
+  public class RemoteKeyProvisioningSettings {
+    method @Nullable public static String getServerUrlOverride(@NonNull android.content.Context);
+    field public static final int GRAPHENEOS_PROXY = 0; // 0x0
+    field public static final int STANDARD_SERVER = 1; // 0x1
+  }
+
+  public class WidevineProvisioningSettings {
+    method @Nullable public static String getServerHostnameOverride(@NonNull android.content.Context);
+  }
+
+}
+
 package android.hardware.usb {
 
   @RestrictedForEnvironment(environments=android.annotation.RestrictedForEnvironment.ENVIRONMENT_SDK_RUNTIME, from=android.os.Build.VERSION_CODES.UPSIDE_DOWN_CAKE) public class UsbManager {
@@ -505,6 +550,11 @@ package android.os {
     method @FlaggedApi("android.os.update_engine_api") public void triggerPostinstall(@NonNull String);
   }
 
+  public final class UserHandle implements android.os.Parcelable {
+    method public static int getUid(int, int);
+    method public static int getUserId(int);
+  }
+
   public class UserManager {
     field @FlaggedApi("android.multiuser.user_restriction_config_wifi_shared_private") public static final String DISALLOW_CONFIG_WIFI_PRIVATE = "no_config_wifi_private";
     field @FlaggedApi("android.multiuser.user_restriction_config_wifi_shared_private") public static final String DISALLOW_CONFIG_WIFI_SHARED = "no_config_wifi_shared";