diff --git a/framework/java/android/net/wifi/hotspot2/PasspointConfiguration.java b/framework/java/android/net/wifi/hotspot2/PasspointConfiguration.java
index bafa049..e8a0814 100644
--- a/framework/java/android/net/wifi/hotspot2/PasspointConfiguration.java
+++ b/framework/java/android/net/wifi/hotspot2/PasspointConfiguration.java
@@ -36,6 +36,7 @@
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 
 import androidx.annotation.RequiresApi;
@@ -919,6 +920,13 @@
         if (mPolicy != null && !mPolicy.validate()) {
             return false;
         }
+        // Optional: DecoratedIdentityPrefix
+        if (!TextUtils.isEmpty(mDecoratedIdentityPrefix)
+                && !mDecoratedIdentityPrefix.endsWith("!")) {
+            EventLog.writeEvent(0x534e4554, "246539931", -1,
+                    "Invalid decorated identity prefix");
+            return false;
+        }
 
         if (mTrustRootCertList != null) {
             for (Map.Entry<String, byte[]> entry : mTrustRootCertList.entrySet()) {
diff --git a/service/ServiceWifiResources/res/values-fa/strings.xml b/service/ServiceWifiResources/res/values-fa/strings.xml
index 79b973e..073b520 100644
--- a/service/ServiceWifiResources/res/values-fa/strings.xml
+++ b/service/ServiceWifiResources/res/values-fa/strings.xml
@@ -63,12 +63,12 @@
     <string name="wifi_p2p_frequency_conflict_message" product="default" msgid="2226863827636191980">"‏این گوشی به‌طور موقت از Wi-Fi قطع خواهد شد، در حالی که به <xliff:g id="DEVICE_NAME">%1$s</xliff:g> وصل است"</string>
     <string name="dlg_ok" msgid="254496739491689405">"تأیید"</string>
     <string name="wifi_cannot_connect_with_randomized_mac_title" msgid="2344570489693915253">"اتصال به <xliff:g id="SSID">%1$s</xliff:g> امکان‌پذیر نیست"</string>
-    <string name="wifi_cannot_connect_with_randomized_mac_message" msgid="4834133226521813352">"برای تغییر تنظیم حریم‌خصوصی ضربه بزنید و دوباره امتحان کنید"</string>
-    <string name="wifi_disable_mac_randomization_dialog_title" msgid="2054540994993681606">"تنظیم حریم‌خصوصی تغییر کند؟"</string>
-    <string name="wifi_disable_mac_randomization_dialog_message" msgid="8874064864332248988">"برای اتصال، <xliff:g id="SSID">%1$s</xliff:g> باید از «نشانی واد» دستگاهتان که شناسه‌ای منحصربه‌فرد است استفاده کند. درحال‌حاضر، تنظیم حریم‌خصوصی شما برای این شبکه از شناسه تصادفی استفاده می‌کند. \n\nاین تغییر ممکن است به دستگاه‌های اطراف امکان دهد مکان دستگاهتان را ردیابی کنند."</string>
+    <string name="wifi_cannot_connect_with_randomized_mac_message" msgid="4834133226521813352">"برای تغییر تنظیم حریم خصوصی ضربه بزنید و دوباره امتحان کنید"</string>
+    <string name="wifi_disable_mac_randomization_dialog_title" msgid="2054540994993681606">"تنظیم حریم خصوصی تغییر کند؟"</string>
+    <string name="wifi_disable_mac_randomization_dialog_message" msgid="8874064864332248988">"برای اتصال، <xliff:g id="SSID">%1$s</xliff:g> باید از «مک آدرس» دستگاهتان که شناسه‌ای منحصربه‌فرد است استفاده کند. درحال‌حاضر، تنظیم حریم خصوصی شما برای این شبکه از شناسه تصادفی استفاده می‌کند. \n\nاین تغییر ممکن است به دستگاه‌های اطراف امکان دهد مکان دستگاهتان را ردیابی کنند."</string>
     <string name="wifi_disable_mac_randomization_dialog_confirm_text" msgid="6954419863076751626">"تغییر تنظیم"</string>
     <string name="wifi_disable_mac_randomization_dialog_success" msgid="5849155828154391387">"تنظیم به‌روزرسانی شد. دوباره متصل شوید."</string>
-    <string name="wifi_disable_mac_randomization_dialog_failure" msgid="2894643619143813096">"تنظیم حریم‌خصوصی تغییر نکرد"</string>
+    <string name="wifi_disable_mac_randomization_dialog_failure" msgid="2894643619143813096">"تنظیم حریم خصوصی تغییر نکرد"</string>
     <string name="wifi_disable_mac_randomization_dialog_network_not_found" msgid="7359256966900782004">"شبکه‌ای پیدا نشد"</string>
     <string name="wifi_eap_error_message_code_32760" msgid="5258191595973470188">"‏<xliff:g id="SSID">%1$s</xliff:g> : خطای ۳۲۷۶۰ اصالت‌سنجی EAP"</string>
     <string name="wifi_eap_error_message_code_32761" msgid="3962610712123291591">"‏<xliff:g id="SSID">%1$s</xliff:g> : خطای ۳۲۷۶۱ اصالت‌سنجی EAP"</string>
diff --git a/service/ServiceWifiResources/res/values-ky/strings.xml b/service/ServiceWifiResources/res/values-ky/strings.xml
index 00d0953..4d695d8 100644
--- a/service/ServiceWifiResources/res/values-ky/strings.xml
+++ b/service/ServiceWifiResources/res/values-ky/strings.xml
@@ -49,7 +49,7 @@
     <string name="wifi_connect_alert_title" msgid="2368200646665663612">"Туташууга уруксатпы?"</string>
     <string name="wifi_connect_alert_message" msgid="7226456300982080746">"%1$s колдонмосу %2$s Wifi тармагына туташкысы келет"</string>
     <string name="wifi_connect_default_application" msgid="8917703737222707062">"Колдонмо"</string>
-    <string name="accept" msgid="8346431649376483879">"Кабыл алуу"</string>
+    <string name="accept" msgid="8346431649376483879">"Ооба"</string>
     <string name="decline" msgid="4172251727603762084">"Баш тартуу"</string>
     <string name="ok" msgid="847575529546290102">"Жарайт"</string>
     <string name="wifi_p2p_invitation_sent_title" msgid="6552639940428040869">"Чакыруу жөнөтүлдү"</string>
diff --git a/service/ServiceWifiResources/res/values-mcc310-mnc004-in/strings.xml b/service/ServiceWifiResources/res/values-mcc310-mnc004-in/strings.xml
index 1335245..8e49fa7 100644
--- a/service/ServiceWifiResources/res/values-mcc310-mnc004-in/strings.xml
+++ b/service/ServiceWifiResources/res/values-mcc310-mnc004-in/strings.xml
@@ -20,7 +20,7 @@
     <string name="wifi_eap_error_message_code_32761" msgid="7871615432524623339">"<xliff:g id="SSID">%1$s</xliff:g> : Anda tidak berlangganan Akses Wi-Fi Verizon. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32762" msgid="2994908156286205343">"<xliff:g id="SSID">%1$s</xliff:g> : Ada masalah dengan akun Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32763" msgid="8051026304965697200">"<xliff:g id="SSID">%1$s</xliff:g> : Anda sudah terhubung ke Akses Wi-Fi Verizon."</string>
-    <string name="wifi_eap_error_message_code_32764" msgid="7311904315070770780">"<xliff:g id="SSID">%1$s</xliff:g> : Terjadi masalah saat menghubungkan ke Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
+    <string name="wifi_eap_error_message_code_32764" msgid="7311904315070770780">"<xliff:g id="SSID">%1$s</xliff:g> : Terjadi error saat menghubungkan ke Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32765" msgid="576968115890091383">"<xliff:g id="SSID">%1$s</xliff:g> : Ada masalah dengan akun Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32766" msgid="895346637290649533">"<xliff:g id="SSID">%1$s</xliff:g> : Akses Wi-Fi Verizon tidak tersedia di lokasi Anda. Coba lagi nanti atau coba dari lokasi yang berbeda."</string>
 </resources>
diff --git a/service/ServiceWifiResources/res/values-mcc310-mnc004-pa/strings.xml b/service/ServiceWifiResources/res/values-mcc310-mnc004-pa/strings.xml
index 01498b8..2e482e6 100644
--- a/service/ServiceWifiResources/res/values-mcc310-mnc004-pa/strings.xml
+++ b/service/ServiceWifiResources/res/values-mcc310-mnc004-pa/strings.xml
@@ -17,7 +17,7 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="wifi_eap_error_message_code_32760" msgid="5711364720754353427">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon ਕਵਰੇਜ ਖੇਤਰ ਤੋਂ ਬਾਹਰ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਨਹੀਂ ਕਰ ਸਕਦੇ।"</string>
-    <string name="wifi_eap_error_message_code_32761" msgid="7871615432524623339">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon Wi-Fi Access ਲਈ ਗਾਹਕੀ ਨਹੀਂ ਲਈ ਹੋਈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
+    <string name="wifi_eap_error_message_code_32761" msgid="7871615432524623339">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon Wi-Fi Access ਲਈ ਸਬਸਕ੍ਰਾਈਬ ਨਹੀਂ ਕੀਤਾ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
     <string name="wifi_eap_error_message_code_32762" msgid="2994908156286205343">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਹਾਡੇ Verizon Wi-Fi Access ਖਾਤੇ ਵਿੱਚ ਕੋਈ ਸਮੱਸਿਆ ਹੈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
     <string name="wifi_eap_error_message_code_32763" msgid="8051026304965697200">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ ਪਹਿਲਾਂ ਤੋਂ ਹੀ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਹੋ।"</string>
     <string name="wifi_eap_error_message_code_32764" msgid="7311904315070770780">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਹਾਨੂੰ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਕਰਨ ਵਿੱਚ ਕੋਈ ਸਮੱਸਿਆ ਹੈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
diff --git a/service/ServiceWifiResources/res/values-mcc311-mnc480-in/strings.xml b/service/ServiceWifiResources/res/values-mcc311-mnc480-in/strings.xml
index 94fcf63..d9fe0df 100644
--- a/service/ServiceWifiResources/res/values-mcc311-mnc480-in/strings.xml
+++ b/service/ServiceWifiResources/res/values-mcc311-mnc480-in/strings.xml
@@ -20,7 +20,7 @@
     <string name="wifi_eap_error_message_code_32761" msgid="5240496654119200117">"<xliff:g id="SSID">%1$s</xliff:g> : Anda tidak berlangganan Akses Wi-Fi Verizon. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32762" msgid="1380081181230313771">"<xliff:g id="SSID">%1$s</xliff:g> : Ada masalah dengan akun Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32763" msgid="2668371888408710653">"<xliff:g id="SSID">%1$s</xliff:g> : Anda sudah terhubung ke Akses Wi-Fi Verizon."</string>
-    <string name="wifi_eap_error_message_code_32764" msgid="4857239018269450670">"<xliff:g id="SSID">%1$s</xliff:g> : Terjadi masalah saat menghubungkan ke Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
+    <string name="wifi_eap_error_message_code_32764" msgid="4857239018269450670">"<xliff:g id="SSID">%1$s</xliff:g> : Terjadi error saat menghubungkan ke Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32765" msgid="3223606535554861258">"<xliff:g id="SSID">%1$s</xliff:g> : Ada masalah dengan akun Akses Wi-Fi Verizon Anda. Harap hubungi kami di 800-922-0204."</string>
     <string name="wifi_eap_error_message_code_32766" msgid="2703925241673900110">"<xliff:g id="SSID">%1$s</xliff:g> : Akses Wi-Fi Verizon tidak tersedia di lokasi Anda. Coba lagi nanti atau coba dari lokasi yang berbeda."</string>
 </resources>
diff --git a/service/ServiceWifiResources/res/values-mcc311-mnc480-pa/strings.xml b/service/ServiceWifiResources/res/values-mcc311-mnc480-pa/strings.xml
index 3ea97c2..b7d4fbd 100644
--- a/service/ServiceWifiResources/res/values-mcc311-mnc480-pa/strings.xml
+++ b/service/ServiceWifiResources/res/values-mcc311-mnc480-pa/strings.xml
@@ -17,7 +17,7 @@
 <resources xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="wifi_eap_error_message_code_32760" msgid="1073938428568671170">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon ਕਵਰੇਜ ਖੇਤਰ ਤੋਂ ਬਾਹਰ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਨਹੀਂ ਕਰ ਸਕਦੇ।"</string>
-    <string name="wifi_eap_error_message_code_32761" msgid="5240496654119200117">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon Wi-Fi Access ਲਈ ਗਾਹਕੀ ਨਹੀਂ ਲਈ ਹੋਈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
+    <string name="wifi_eap_error_message_code_32761" msgid="5240496654119200117">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ Verizon Wi-Fi Access ਲਈ ਸਬਸਕ੍ਰਾਈਬ ਨਹੀਂ ਕੀਤਾ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
     <string name="wifi_eap_error_message_code_32762" msgid="1380081181230313771">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਹਾਡੇ Verizon Wi-Fi Access ਖਾਤੇ ਵਿੱਚ ਕੋਈ ਸਮੱਸਿਆ ਹੈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
     <string name="wifi_eap_error_message_code_32763" msgid="2668371888408710653">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਸੀਂ ਪਹਿਲਾਂ ਤੋਂ ਹੀ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਹੋ।"</string>
     <string name="wifi_eap_error_message_code_32764" msgid="4857239018269450670">"<xliff:g id="SSID">%1$s</xliff:g> : ਤੁਹਾਨੂੰ Verizon Wi-Fi Access ਨਾਲ ਕਨੈਕਟ ਕਰਨ ਵਿੱਚ ਕੋਈ ਸਮੱਸਿਆ ਹੈ। ਕਿਰਪਾ ਕਰਕੇ ਸਾਨੂੰ 800-922-0204 \'ਤੇ ਕਾਲ ਕਰੋ।"</string>
diff --git a/service/ServiceWifiResources/res/values-te/strings.xml b/service/ServiceWifiResources/res/values-te/strings.xml
index 3893f37..ebe454d 100644
--- a/service/ServiceWifiResources/res/values-te/strings.xml
+++ b/service/ServiceWifiResources/res/values-te/strings.xml
@@ -29,7 +29,7 @@
     <string name="notification_channel_network_available" msgid="8454366142428864948">"నెట్‌వర్క్ అందుబాటులో ఉంది"</string>
     <string name="wifi_suggestion_title" msgid="2564179935989099139">"సూచించిన Wi‑Fi నెట్‌వర్క్‌లను అనుమతించాలా?"</string>
     <string name="wifi_suggestion_content" msgid="6985149577828091835">"<xliff:g id="NAME">%s</xliff:g> సూచించిన నెట్‌వర్క్‌లు. పరికరం ఆటోమేటిక్‌గా కనెక్ట్ అవచ్చు."</string>
-    <string name="wifi_suggestion_action_allow_app" msgid="7757859972144671588">"అనుమతించు"</string>
+    <string name="wifi_suggestion_action_allow_app" msgid="7757859972144671588">"అనుమతించండి"</string>
     <string name="wifi_suggestion_action_disallow_app" msgid="4565857699629860726">"వద్దు"</string>
     <string name="wifi_suggestion_imsi_privacy_title" msgid="8969261812845304079">"<xliff:g id="CARRIERNAME">%s</xliff:g> Wi-Fiకి కనెక్ట్ చేయాలా?"</string>
     <string name="wifi_suggestion_imsi_privacy_content" msgid="4266931269306079184">"పరికర లొకేషన్‌ను ట్రాక్ చేయడానికి ఉపయోగపడే SIM IDని ఈ నెట్‌వర్క్‌లు అందుకుంటాయి"</string>
diff --git a/service/java/com/android/server/wifi/WifiApConfigStore.java b/service/java/com/android/server/wifi/WifiApConfigStore.java
index 4e756d4..17ebe5f 100644
--- a/service/java/com/android/server/wifi/WifiApConfigStore.java
+++ b/service/java/com/android/server/wifi/WifiApConfigStore.java
@@ -161,13 +161,10 @@
      * and the main Wifi thread (CMD_START_AP).
      */
     public synchronized void setApConfiguration(SoftApConfiguration config) {
-        if (config == null) {
-            config = getDefaultApConfiguration();
-        } else {
-            config = sanitizePersistentApConfig(config);
-        }
-        persistConfigAndTriggerBackupManagerProxy(
-                new SoftApConfiguration.Builder(config).setUserConfiguration(true).build());
+        SoftApConfiguration newConfig = config == null ? getDefaultApConfiguration()
+                : new SoftApConfiguration.Builder(sanitizePersistentApConfig(config))
+                        .setUserConfiguration(true).build();
+        persistConfigAndTriggerBackupManagerProxy(newConfig);
     }
 
     /**
diff --git a/service/java/com/android/server/wifi/WifiConfigManager.java b/service/java/com/android/server/wifi/WifiConfigManager.java
index 32baa8e..c7bce20 100644
--- a/service/java/com/android/server/wifi/WifiConfigManager.java
+++ b/service/java/com/android/server/wifi/WifiConfigManager.java
@@ -1553,7 +1553,7 @@
         // will remove the enterprise keys when provider is uninstalled. Suggestion enterprise
         // networks will remove the enterprise keys when suggestion is removed.
         if (!config.fromWifiNetworkSuggestion && !config.isPasspoint() && config.isEnterprise()) {
-            mWifiKeyStore.removeKeys(config.enterpriseConfig);
+            mWifiKeyStore.removeKeys(config.enterpriseConfig, false);
         }
 
         // Do not remove the user choice when passpoint or suggestion networks are removed from
diff --git a/service/java/com/android/server/wifi/WifiInjector.java b/service/java/com/android/server/wifi/WifiInjector.java
index 63f194f..e35813a 100644
--- a/service/java/com/android/server/wifi/WifiInjector.java
+++ b/service/java/com/android/server/wifi/WifiInjector.java
@@ -1071,4 +1071,9 @@
     public LinkProbeManager getLinkProbeManager() {
         return mLinkProbeManager;
     }
+
+    @NonNull
+    public WifiKeyStore getWifiKeyStore() {
+        return mWifiKeyStore;
+    }
 }
diff --git a/service/java/com/android/server/wifi/WifiKeyStore.java b/service/java/com/android/server/wifi/WifiKeyStore.java
index 4846586..4a2c5a6 100644
--- a/service/java/com/android/server/wifi/WifiKeyStore.java
+++ b/service/java/com/android/server/wifi/WifiKeyStore.java
@@ -219,11 +219,12 @@
      * Remove enterprise keys from the network config.
      *
      * @param config Config corresponding to the network.
+     * @param forceRemove remove keys regardless of the key installer.
      */
-    public void removeKeys(WifiEnterpriseConfig config) {
+    public void removeKeys(WifiEnterpriseConfig config, boolean forceRemove) {
         Preconditions.checkNotNull(mKeyStore);
         // Do not remove keys that were manually installed by the user
-        if (config.isAppInstalledDeviceKeyAndCert()) {
+        if (forceRemove || config.isAppInstalledDeviceKeyAndCert()) {
             String client = config.getClientCertificateAlias();
             // a valid client certificate is configured
             if (!TextUtils.isEmpty(client)) {
@@ -237,7 +238,7 @@
         }
 
         // Do not remove CA certs that were manually installed by the user
-        if (config.isAppInstalledCaCert()) {
+        if (forceRemove || config.isAppInstalledCaCert()) {
             String[] aliases = config.getCaCertificateAliases();
             if (aliases == null || aliases.length == 0) {
                 return;
diff --git a/service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java b/service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java
index b4c9a3e..1512696 100644
--- a/service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java
+++ b/service/java/com/android/server/wifi/WifiNetworkSuggestionsManager.java
@@ -1269,7 +1269,7 @@
                 removeFromPassPointInfoMap(ewns);
             } else {
                 if (ewns.wns.wifiConfiguration.isEnterprise()) {
-                    mWifiKeyStore.removeKeys(ewns.wns.wifiConfiguration.enterpriseConfig);
+                    mWifiKeyStore.removeKeys(ewns.wns.wifiConfiguration.enterpriseConfig, false);
                 }
                 removeFromScanResultMatchInfoMapAndRemoveRelatedScoreCard(ewns);
                 mWifiConfigManager.removeConnectChoiceFromAllNetworks(ewns
diff --git a/service/java/com/android/server/wifi/WifiServiceImpl.java b/service/java/com/android/server/wifi/WifiServiceImpl.java
index 81db677..077f8f5 100644
--- a/service/java/com/android/server/wifi/WifiServiceImpl.java
+++ b/service/java/com/android/server/wifi/WifiServiceImpl.java
@@ -121,6 +121,7 @@
 import android.telephony.SubscriptionManager;
 import android.telephony.TelephonyManager;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 
 import androidx.annotation.RequiresApi;
@@ -4098,12 +4099,18 @@
             return;
         }
         // Delete all Wifi SSIDs
-        List<WifiConfiguration> networks = mWifiThreadRunner.call(
-                () -> mWifiConfigManager.getSavedNetworks(Process.WIFI_UID),
-                Collections.emptyList());
-        for (WifiConfiguration network : networks) {
-            removeNetwork(network.networkId, packageName);
-        }
+        mWifiThreadRunner.run(() -> {
+            List<WifiConfiguration> networks = mWifiConfigManager
+                    .getSavedNetworks(Process.WIFI_UID);
+            EventLog.writeEvent(0x534e4554, "231985227", -1,
+                    "Remove certs for factory reset");
+            for (WifiConfiguration network : networks) {
+                if (network.isEnterprise()) {
+                    mWifiInjector.getWifiKeyStore().removeKeys(network.enterpriseConfig, true);
+                }
+                removeNetwork(network.networkId, packageName);
+            }
+        });
         // Delete all Passpoint configurations
         List<PasspointConfiguration> configs = mWifiThreadRunner.call(
                 () -> mPasspointManager.getProviderConfigs(Process.WIFI_UID /* ignored */, true),
@@ -4112,6 +4119,9 @@
             removePasspointConfigurationInternal(null, config.getUniqueId());
         }
         mWifiThreadRunner.post(() -> {
+            EventLog.writeEvent(0x534e4554, "241927115", -1,
+                    "Reset SoftApConfiguration to default configuration");
+            mWifiApConfigStore.setApConfiguration(null);
             mPasspointManager.clearAnqpRequestsAndFlushCache();
             mWifiConfigManager.clearUserTemporarilyDisabledList();
             mWifiConfigManager.removeAllEphemeralOrPasspointConfiguredNetworks();
diff --git a/service/java/com/android/server/wifi/util/WifiPermissionsUtil.java b/service/java/com/android/server/wifi/util/WifiPermissionsUtil.java
index 4a30029..4c5f5cf 100644
--- a/service/java/com/android/server/wifi/util/WifiPermissionsUtil.java
+++ b/service/java/com/android/server/wifi/util/WifiPermissionsUtil.java
@@ -200,7 +200,7 @@
      */
     public void enforceFineLocationPermission(String pkgName, @Nullable String featureId,
             int uid) {
-        if (!checkCallersFineLocationPermission(pkgName, featureId, uid, false)) {
+        if (!checkCallersFineLocationPermission(pkgName, featureId, uid, false, false)) {
             throw new SecurityException("UID " + uid + " does not have Fine Location permission");
         }
     }
@@ -215,22 +215,28 @@
      * @param hideFromAppOps True to invoke {@link AppOpsManager#checkOp(int, int, String)}, false
      *                       to invoke {@link AppOpsManager#noteOp(String, int, String, String,
      *                       String)}.
+     * @param ignoreLocationSettings Whether this request can bypass location settings.
      */
     private boolean checkCallersFineLocationPermission(String pkgName, @Nullable String featureId,
-            int uid, boolean hideFromAppOps) {
+            int uid, boolean hideFromAppOps, boolean ignoreLocationSettings) {
         // Having FINE permission implies having COARSE permission (but not the reverse)
         if (mWifiPermissionsWrapper.getUidPermission(
                 Manifest.permission.ACCESS_FINE_LOCATION, uid)
                 == PackageManager.PERMISSION_DENIED) {
             return false;
         }
+
+        boolean isAllowed;
         if (hideFromAppOps) {
             // Don't note the operation, just check if the app is allowed to perform the operation.
-            return checkAppOpAllowed(AppOpsManager.OPSTR_FINE_LOCATION, pkgName, uid);
+            isAllowed = checkAppOpAllowed(AppOpsManager.OPSTR_FINE_LOCATION, pkgName, uid);
         } else {
-            return noteAppOpAllowed(AppOpsManager.OPSTR_FINE_LOCATION, pkgName, featureId, uid,
+            isAllowed = noteAppOpAllowed(AppOpsManager.OPSTR_FINE_LOCATION, pkgName, featureId, uid,
                     null);
         }
+        // If the ignoreLocationSettings is true, we always return true. This is for the emergency
+        // location service use case. But still notify the operation manager.
+        return isAllowed || ignoreLocationSettings;
     }
 
     /**
@@ -343,8 +349,8 @@
         }
         // LocationAccess by App: caller must have fine & hardware Location permission to have
         // access to location information.
-        if (!checkCallersFineLocationPermission(pkgName, featureId, uid, hideFromAppOps)
-                || !checkCallersHardwareLocationPermission(uid)) {
+        if (!checkCallersFineLocationPermission(pkgName, featureId, uid, hideFromAppOps,
+                ignoreLocationSettings) || !checkCallersHardwareLocationPermission(uid)) {
             throw new SecurityException("UID " + uid + " has no location permission");
         }
         // Check if Wifi Scan request is an operation allowed for this App.
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
index fcddf7a..eb6abca 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiApConfigStoreTest.java
@@ -305,7 +305,7 @@
         verifyDefaultApConfig(mDataStoreSource.toSerialize(), TEST_DEFAULT_AP_SSID);
         verify(mWifiConfigManager).saveToStore(true);
         verify(mBackupManagerProxy).notifyDataChanged();
-        assertTrue(store.getApConfiguration().isUserConfigurationInternal());
+        assertFalse(store.getApConfiguration().isUserConfigurationInternal());
     }
 
     /**
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiConfigManagerTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiConfigManagerTest.java
index 29c6d2b..7e5d83d 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiConfigManagerTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiConfigManagerTest.java
@@ -1030,7 +1030,7 @@
         assertEquals(suggestionNetwork.networkId, wifiConfigCaptor.getValue().networkId);
         assertTrue(mWifiConfigManager
                 .removeNetwork(suggestionNetwork.networkId, TEST_CREATOR_UID, TEST_CREATOR_NAME));
-        verify(mWifiKeyStore, never()).removeKeys(any());
+        verify(mWifiKeyStore, never()).removeKeys(any(), eq(false));
     }
 
     /**
@@ -1290,7 +1290,7 @@
                 passpointNetwork.networkId, Process.WIFI_UID, null));
 
         // Verify keys are not being removed.
-        verify(mWifiKeyStore, never()).removeKeys(any(WifiEnterpriseConfig.class));
+        verify(mWifiKeyStore, never()).removeKeys(any(WifiEnterpriseConfig.class), eq(false));
         verifyNetworkRemoveBroadcast();
         // Ensure that the write was not invoked for Passpoint network remove.
         mContextConfigStoreMockOrder.verify(mWifiConfigStore, never()).write(anyBoolean());
@@ -5798,7 +5798,7 @@
                 configuration.networkId, TEST_CREATOR_UID, TEST_CREATOR_NAME));
 
         // Verify keys are not being removed.
-        verify(mWifiKeyStore, never()).removeKeys(any(WifiEnterpriseConfig.class));
+        verify(mWifiKeyStore, never()).removeKeys(any(WifiEnterpriseConfig.class), eq(false));
         verifyNetworkRemoveBroadcast();
         // Ensure that the write was not invoked for Passpoint network remove.
         mContextConfigStoreMockOrder.verify(mWifiConfigStore, never()).write(anyBoolean());
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiKeyStoreTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiKeyStoreTest.java
index 75edcaa..9de443d 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiKeyStoreTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiKeyStoreTest.java
@@ -109,7 +109,7 @@
     public void testRemoveKeysForAppInstalledCerts() throws Exception {
         when(mWifiEnterpriseConfig.isAppInstalledDeviceKeyAndCert()).thenReturn(true);
         when(mWifiEnterpriseConfig.isAppInstalledCaCert()).thenReturn(true);
-        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig);
+        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig, false);
 
         // Method calls the KeyStore#delete method 4 times, user key, user cert, and 2 CA cert
         verify(mKeyStore).deleteEntry(USER_CERT_ALIAS);
@@ -124,7 +124,7 @@
     public void testRemoveKeysForMixedInstalledCerts1() throws Exception {
         when(mWifiEnterpriseConfig.isAppInstalledDeviceKeyAndCert()).thenReturn(true);
         when(mWifiEnterpriseConfig.isAppInstalledCaCert()).thenReturn(false);
-        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig);
+        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig, false);
 
         // Method calls the KeyStore#deleteEntry method: user key and user cert
         verify(mKeyStore).deleteEntry(USER_CERT_ALIAS);
@@ -139,7 +139,7 @@
     public void testRemoveKeysForMixedInstalledCerts2() throws Exception {
         when(mWifiEnterpriseConfig.isAppInstalledDeviceKeyAndCert()).thenReturn(false);
         when(mWifiEnterpriseConfig.isAppInstalledCaCert()).thenReturn(true);
-        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig);
+        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig, false);
 
         // Method calls the KeyStore#delete method 2 times: 2 CA certs
         verify(mKeyStore).deleteEntry(USER_CA_CERT_ALIASES[0]);
@@ -154,7 +154,24 @@
     public void testRemoveKeysForUserInstalledCerts() {
         when(mWifiEnterpriseConfig.isAppInstalledDeviceKeyAndCert()).thenReturn(false);
         when(mWifiEnterpriseConfig.isAppInstalledCaCert()).thenReturn(false);
-        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig);
+        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig, false);
+        verifyNoMoreInteractions(mKeyStore);
+    }
+
+    /**
+     * Verifies that keys and certs are removed when they were not installed by the user
+     * when forceRemove is true.
+     */
+    @Test
+    public void testForceRemoveKeysForUserInstalledCerts() throws Exception {
+        when(mWifiEnterpriseConfig.isAppInstalledDeviceKeyAndCert()).thenReturn(false);
+        when(mWifiEnterpriseConfig.isAppInstalledCaCert()).thenReturn(false);
+        mWifiKeyStore.removeKeys(mWifiEnterpriseConfig, true);
+
+        // KeyStore#deleteEntry() is called three time for user cert, and 2 CA cert.
+        verify(mKeyStore).deleteEntry(USER_CERT_ALIAS);
+        verify(mKeyStore).deleteEntry(USER_CA_CERT_ALIASES[0]);
+        verify(mKeyStore).deleteEntry(USER_CA_CERT_ALIASES[1]);
         verifyNoMoreInteractions(mKeyStore);
     }
 
@@ -228,8 +245,8 @@
         WifiConfiguration suggestionNetwork = new WifiConfiguration(savedNetwork);
         suggestionNetwork.fromWifiNetworkSuggestion = true;
         suggestionNetwork.creatorName = TEST_PACKAGE_NAME;
-        mWifiKeyStore.removeKeys(savedNetwork.enterpriseConfig);
-        mWifiKeyStore.removeKeys(suggestionNetwork.enterpriseConfig);
+        mWifiKeyStore.removeKeys(savedNetwork.enterpriseConfig, false);
+        mWifiKeyStore.removeKeys(suggestionNetwork.enterpriseConfig, false);
         verify(mKeyStore, never()).deleteEntry(any());
     }
 
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiNetworkSuggestionsManagerTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiNetworkSuggestionsManagerTest.java
index 000c100..6daaab7 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiNetworkSuggestionsManagerTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiNetworkSuggestionsManagerTest.java
@@ -488,7 +488,8 @@
                         new ArrayList<WifiNetworkSuggestion>() {{ add(removingSuggestion); }},
                         TEST_UID_1, TEST_PACKAGE_1));
         // Make sure remove the keyStore with the internal config
-        verify(mWifiKeyStore).removeKeys(networkSuggestion1.wifiConfiguration.enterpriseConfig);
+        verify(mWifiKeyStore).removeKeys(eq(networkSuggestion1.wifiConfiguration.enterpriseConfig),
+                eq(false));
         verify(mLruConnectionTracker).removeNetwork(any());
     }
 
diff --git a/service/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java b/service/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
index f437a7b..adbc706 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/WifiServiceImplTest.java
@@ -380,6 +380,7 @@
     @Mock LastCallerInfoManager mLastCallerInfoManager;
     @Mock BuildProperties mBuildProperties;
     @Mock LinkProbeManager mLinkProbeManager;
+    @Mock WifiKeyStore mWifiKeyStore;
 
     @Captor ArgumentCaptor<Intent> mIntentCaptor;
     @Captor ArgumentCaptor<Runnable> mOnStoppedListenerCaptor;
@@ -512,6 +513,7 @@
         when(mActiveModeWarden.getClientModeManagers()).thenReturn(mClientModeManagers);
         when(mWifiInjector.getSelfRecovery()).thenReturn(mSelfRecovery);
         when(mWifiInjector.getLastCallerInfoManager()).thenReturn(mLastCallerInfoManager);
+        when(mWifiInjector.getWifiKeyStore()).thenReturn(mWifiKeyStore);
 
         doAnswer(new AnswerWithArguments() {
             public void answer(Runnable onStoppedListener) throws Throwable {
@@ -5693,7 +5695,11 @@
                 anyInt(), anyInt())).thenReturn(PackageManager.PERMISSION_GRANTED);
         when(mWifiPermissionsUtil.checkNetworkSettingsPermission(anyInt())).thenReturn(true);
         final String fqdn = "example.com";
-        WifiConfiguration network = WifiConfigurationTestUtil.createOpenNetwork();
+        WifiConfiguration openNetwork = WifiConfigurationTestUtil.createOpenNetwork();
+        openNetwork.networkId = TEST_NETWORK_ID;
+        WifiConfiguration eapNetwork = WifiConfigurationTestUtil.createEapNetwork(
+                WifiEnterpriseConfig.Eap.TLS, WifiEnterpriseConfig.Phase2.NONE);
+        eapNetwork.networkId = TEST_NETWORK_ID + 1;
         PasspointConfiguration config = new PasspointConfiguration();
         HomeSp homeSp = new HomeSp();
         homeSp.setFqdn(fqdn);
@@ -5703,7 +5709,7 @@
         config.setCredential(credential);
 
         when(mWifiConfigManager.getSavedNetworks(anyInt()))
-                .thenReturn(Arrays.asList(network));
+                .thenReturn(Arrays.asList(openNetwork, eapNetwork));
         when(mPasspointManager.getProviderConfigs(anyInt(), anyBoolean()))
                 .thenReturn(Arrays.asList(config));
 
@@ -5714,8 +5720,12 @@
         // Let the final post inside the |factoryReset| method run to completion.
         mLooper.dispatchAll();
 
+        verify(mWifiApConfigStore).setApConfiguration(null);
         verify(mWifiConfigManager).removeNetwork(
-                network.networkId, Binder.getCallingUid(), TEST_PACKAGE_NAME);
+                openNetwork.networkId, Binder.getCallingUid(), TEST_PACKAGE_NAME);
+        verify(mWifiConfigManager).removeNetwork(
+                eapNetwork.networkId, Binder.getCallingUid(), TEST_PACKAGE_NAME);
+        verify(mWifiKeyStore).removeKeys(eapNetwork.enterpriseConfig, true);
         verify(mPasspointManager).removeProvider(anyInt(), anyBoolean(), eq(config.getUniqueId()),
                 isNull());
         verify(mPasspointManager).clearAnqpRequestsAndFlushCache();
diff --git a/service/tests/wifitests/src/com/android/server/wifi/util/WifiPermissionsUtilTest.java b/service/tests/wifitests/src/com/android/server/wifi/util/WifiPermissionsUtilTest.java
index 6c6b7de..4655fa0 100644
--- a/service/tests/wifitests/src/com/android/server/wifi/util/WifiPermissionsUtilTest.java
+++ b/service/tests/wifitests/src/com/android/server/wifi/util/WifiPermissionsUtilTest.java
@@ -1052,7 +1052,7 @@
      * Validate no Exceptions are thrown - has all permissions & don't note in app-ops.
      */
     @Test
-    public void testCannotAccessScanResultsForWifiScanner_HideFromAppOps()
+    public void testCanAccessScanResultsForWifiScanner_HideFromAppOps()
             throws Exception {
         mThrowSecurityException = false;
         mIsLocationEnabled = true;
@@ -1225,13 +1225,13 @@
      * Validate no Exceptions are thrown - has all permissions & ignores location settings.
      */
     @Test
-    public void testCannotAccessScanResultsForWifiScanner_IgnoreLocationSettings()
+    public void testCanAccessScanResultsForWifiScanner_IgnoreLocationSettings()
             throws Exception {
         mThrowSecurityException = false;
         mIsLocationEnabled = false;
         mFineLocationPermission = PackageManager.PERMISSION_GRANTED;
         mHardwareLocationPermission = PackageManager.PERMISSION_GRANTED;
-        mAllowFineLocationApps = AppOpsManager.MODE_ALLOWED;
+        mAllowFineLocationApps = AppOpsManager.MODE_IGNORED;
         mWifiScanAllowApps = AppOpsManager.MODE_ALLOWED;
         mUid = MANAGED_PROFILE_UID;
         setupTestCase();
@@ -1239,6 +1239,8 @@
                 mMockContext, mMockUserManager, mWifiInjector);
         codeUnderTest.enforceCanAccessScanResultsForWifiScanner(TEST_PACKAGE_NAME, TEST_FEATURE_ID,
                 mUid, IGNORE_LOCATION_SETTINGS, DONT_HIDE_FROM_APP_OPS);
+        verify(mMockAppOps).noteOp(AppOpsManager.OPSTR_FINE_LOCATION, mUid, TEST_PACKAGE_NAME,
+                TEST_FEATURE_ID, null);
     }
 
     /**