6 files changed, 174 insertions, 0 deletions
diff --git a/core/java/android/app/SystemServiceRegistry.java b/core/java/android/app/SystemServiceRegistry.java
index 19f7426863cb..40fe6af9627d 100644
--- a/core/java/android/app/SystemServiceRegistry.java
+++ b/core/java/android/app/SystemServiceRegistry.java
@@ -120,6 +120,8 @@ import android.print.IPrintManager;
 import android.print.PrintManager;
 import android.view.autofill.AutofillManager;
 import android.view.autofill.IAutoFillManager;
+import android.service.oemlock.IOemLockService;
+import android.service.oemlock.OemLockManager;
 import android.service.persistentdata.IPersistentDataBlockService;
 import android.service.persistentdata.PersistentDataBlockManager;
 import android.service.vr.IVrManager;
@@ -752,6 +754,20 @@ final class SystemServiceRegistry {
                 }
             }});
 
+        registerService(Context.OEM_LOCK_SERVICE, OemLockManager.class,
+                new StaticServiceFetcher<OemLockManager>() {
+            @Override
+            public OemLockManager createService() throws ServiceNotFoundException {
+                IBinder b = ServiceManager.getServiceOrThrow(Context.OEM_LOCK_SERVICE);
+                IOemLockService oemLockService = IOemLockService.Stub.asInterface(b);
+                if (oemLockService != null) {
+                    return new OemLockManager(oemLockService);
+                } else {
+                    // not supported
+                    return null;
+                }
+            }});
+
         registerService(Context.MEDIA_PROJECTION_SERVICE, MediaProjectionManager.class,
                 new CachedServiceFetcher<MediaProjectionManager>() {
             @Override
diff --git a/core/java/android/content/Context.java b/core/java/android/content/Context.java
index 63757755aedd..18120c714793 100644
--- a/core/java/android/content/Context.java
+++ b/core/java/android/content/Context.java
@@ -2897,6 +2897,7 @@ public abstract class Context {
             BATTERY_SERVICE,
             JOB_SCHEDULER_SERVICE,
             //@hide: PERSISTENT_DATA_BLOCK_SERVICE,
+            //@hide: OEM_LOCK_SERVICE,
             MEDIA_PROJECTION_SERVICE,
             MIDI_SERVICE,
             RADIO_SERVICE,
@@ -3819,6 +3820,17 @@ public abstract class Context {
 
     /**
      * Use with {@link #getSystemService} to retrieve a {@link
+     * android.service.oemlock.OemLockManager} instance for managing the OEM lock.
+     *
+     * @see #getSystemService
+     * @see android.service.oemlock.OemLockManager
+     * @hide
+     */
+    @SystemApi
+    public static final String OEM_LOCK_SERVICE = "oem_lock";
+
+    /**
+     * Use with {@link #getSystemService} to retrieve a {@link
      * android.media.projection.MediaProjectionManager} instance for managing
      * media projection sessions.
      * @see #getSystemService
diff --git a/core/java/android/os/UserManager.java b/core/java/android/os/UserManager.java
index a6bf2d26abb3..6f4c9cf7d7ff 100644
--- a/core/java/android/os/UserManager.java
+++ b/core/java/android/os/UserManager.java
@@ -682,8 +682,10 @@ public class UserManager {
      * @see DevicePolicyManager#addUserRestriction(ComponentName, String)
      * @see DevicePolicyManager#clearUserRestriction(ComponentName, String)
      * @see #getUserRestrictions()
+     * @deprecated use {@link OemLockManager#setOemUnlockAllowedByCarrier(boolean, byte[])} instead.
      * @hide
      */
+    @Deprecated
     @SystemApi
     public static final String DISALLOW_OEM_UNLOCK = "no_oem_unlock";
 
diff --git a/core/java/android/service/oemlock/IOemLockService.aidl b/core/java/android/service/oemlock/IOemLockService.aidl
new file mode 100644
index 000000000000..2c606f97ab9f
--- /dev/null
+++ b/core/java/android/service/oemlock/IOemLockService.aidl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.service.oemlock;
+
+/**
+ * Interface for communication with the OemLockService.
+ *
+ * @hide
+ */
+interface IOemLockService {
+    void setOemUnlockAllowedByCarrier(boolean allowed, in byte[] signature);
+    boolean isOemUnlockAllowedByCarrier();
+
+    void setOemUnlockAllowedByUser(boolean allowed);
+    boolean isOemUnlockAllowedByUser();
+}
diff --git a/core/java/android/service/oemlock/OemLockManager.java b/core/java/android/service/oemlock/OemLockManager.java
new file mode 100644
index 000000000000..c4fbe5ec7e1a
--- /dev/null
+++ b/core/java/android/service/oemlock/OemLockManager.java
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.service.oemlock;
+
+import android.annotation.Nullable;
+import android.annotation.SystemApi;
+import android.os.RemoteException;
+
+/**
+ * Interface for managing the OEM lock on the device.
+ *
+ * This will only be available if the device implements OEM lock protection.
+ *
+ * Multiple actors have an opinion on whether the device can be OEM unlocked and they must all be in
+ * agreement for unlock to be possible.
+ *
+ * @hide
+ */
+@SystemApi
+public class OemLockManager {
+    private IOemLockService mService;
+
+    /** @hide */
+    public OemLockManager(IOemLockService service) {
+        mService = service;
+    }
+
+    /**
+     * Sets whether the carrier has allowed this device to be OEM unlocked.
+     *
+     * Depending on the implementation, the validity of the request might need to be proved. This
+     * can be acheived by passing a signature that the system will use to verify the request is
+     * legitimate.
+     *
+     * All actors involved must agree for OEM unlock to be possible.
+     *
+     * @param allowed Whether the device should be allowed to be unlocked.
+     * @param signature Optional proof of request validity, {@code null} for none.
+     * @throws IllegalArgumentException if a signature is required but was not provided.
+     * @throws SecurityException if the wrong signature was provided.
+     *
+     * @see #isOemUnlockAllowedByCarrier()
+     */
+    public void setOemUnlockAllowedByCarrier(boolean allowed, @Nullable byte[] signature) {
+        try {
+            mService.setOemUnlockAllowedByCarrier(allowed, signature);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Returns whether the carrier has allowed this device to be OEM unlocked.
+     * @return Whether OEM unlock is allowed by the carrier, or true if no OEM lock is present.
+     *
+     * @see #setOemUnlockAllowedByCarrier(boolean, byte[])
+     */
+    public boolean isOemUnlockAllowedByCarrier() {
+        try {
+            return mService.isOemUnlockAllowedByCarrier();
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Sets whether the user has allowed this device to be unlocked.
+     *
+     * All actors involved must agree for OEM unlock to be possible.
+     *
+     * @param unlocked Whether the device should be made OEM unlocked.
+     *
+     * @see #isOemUnlockAllowedByUser()
+     */
+    public void setOemUnlockAllowedByUser(boolean allowed) {
+        try {
+            mService.setOemUnlockAllowedByUser(allowed);
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Returns whether, or not, the user has allowed this device to be OEM unlocked.
+     * @return Whether OEM unlock is allowed by the user, or true if no OEM lock is present.
+     *
+     * @see #setOemUnlockAllowedByUser(boolean)
+     */
+    public boolean isOemUnlockAllowedByUser() {
+        try {
+            return mService.isOemUnlockAllowedByUser();
+        } catch (RemoteException e) {
+            throw e.rethrowFromSystemServer();
+        }
+    }
+}
diff --git a/core/java/android/service/persistentdata/PersistentDataBlockManager.java b/core/java/android/service/persistentdata/PersistentDataBlockManager.java
index cb021bc03087..326796afb3ad 100644
--- a/core/java/android/service/persistentdata/PersistentDataBlockManager.java
+++ b/core/java/android/service/persistentdata/PersistentDataBlockManager.java
@@ -146,6 +146,8 @@ public class PersistentDataBlockManager {
 
     /**
      * Writes a byte enabling or disabling the ability to "OEM unlock" the device.
+     *
+     * @deprecated use {@link OemLockManager#setOemUnlockAllowedByUser(boolean)} instead.
      */
     public void setOemUnlockEnabled(boolean enabled) {
         try {
@@ -157,6 +159,8 @@ public class PersistentDataBlockManager {
 
     /**
      * Returns whether or not "OEM unlock" is enabled or disabled on this device.
+     *
+     * @deprecated use {@link OemLockManager#isOemUnlockAllowedByUser()} instead.
      */
     public boolean getOemUnlockEnabled() {
         try {