diff --git a/compatibility_matrices/compatibility_matrix.3.xml b/compatibility_matrices/compatibility_matrix.3.xml
index f271642..9c6b12a 100644
--- a/compatibility_matrices/compatibility_matrix.3.xml
+++ b/compatibility_matrices/compatibility_matrix.3.xml
@@ -290,7 +290,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.power</name>
-        <version>1.0-2</version>
+        <version>1.0-3</version>
         <interface>
             <name>IPower</name>
             <instance>default</instance>
diff --git a/current.txt b/current.txt
index 978f6c6..64bd5a8 100644
--- a/current.txt
+++ b/current.txt
@@ -348,6 +348,8 @@
 5e278fcaa3287d397d8eebe1c22aaa28150f5caae1cf9381cd6dc32cb37899c5 android.hardware.nfc@1.1::types
 163e115e833fc1d77cdd4a8cf0c833bb8b8d74fe35c880fe693101d17774926f android.hardware.power@1.2::IPower
 7899b9305587b2d5cd74a3cc87e9090f58bf4ae74256ce3ee36e7ec011822840 android.hardware.power@1.2::types
+5a464e6db53fad223986d655028a18185b73db8e2bfa9663f9042c9623eb0aa0 android.hardware.power@1.3::IPower
+a54a28d39b892d27a3cb06829181c038edcdd9e8eef359543b01e4313ae59aa0 android.hardware.power@1.3::types
 ab132c990a62f0aca35871c092c22fb9c85d478e22124ef6a4d0a2302da76a9f android.hardware.radio@1.2::IRadio
 cda752aeabaabc20486a82ac57a3dd107785c006094a349bc5e224e8aa22a17c android.hardware.radio@1.2::IRadioIndication
 da8c6ae991c6a4b284cc6e445332e064e28ee8a09482ed5afff9d159ec6694b7 android.hardware.radio@1.2::IRadioResponse
diff --git a/gnss/1.0/vts/functional/VtsHalGnssV1_0TargetTest.cpp b/gnss/1.0/vts/functional/VtsHalGnssV1_0TargetTest.cpp
index 010a46d..608ee70 100644
--- a/gnss/1.0/vts/functional/VtsHalGnssV1_0TargetTest.cpp
+++ b/gnss/1.0/vts/functional/VtsHalGnssV1_0TargetTest.cpp
@@ -472,6 +472,16 @@
   }
 }
 
+/*
+ * SchedulingCapabilities:
+ * Verifies that 2018+ hardware supports Scheduling capabilities.
+ */
+TEST_F(GnssHalTest, SchedulingCapabilities) {
+    if (info_called_count_ > 0 && last_info_.yearOfHw >= 2018) {
+        EXPECT_TRUE(last_capabilities_ & IGnssCallback::Capabilities::SCHEDULING);
+    }
+}
+
 int main(int argc, char** argv) {
   ::testing::AddGlobalTestEnvironment(GnssHidlEnvironment::Instance());
   ::testing::InitGoogleTest(&argc, argv);
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index cce46f1..eeb9d03 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -428,7 +428,7 @@
             EXPECT_GE(data.position.ageSeconds, 0);
         }
 
-        EXPECT_GE(data.time.timeEstimate, 1514764800000);  // Jan 01 2018 00:00:00
+        EXPECT_GE(data.time.timeEstimate, 1483228800000);  // Jan 01 2017 00:00:00 GMT.
 
         EXPECT_GT(data.time.timeUncertaintyNs, 0);
 
diff --git a/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc b/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
index a41d902..efe6dad 100644
--- a/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
+++ b/graphics/composer/2.2/default/android.hardware.graphics.composer@2.2-service.rc
@@ -4,3 +4,4 @@
     group graphics drmrpc
     capabilities SYS_NICE
     onrestart restart surfaceflinger
+    writepid /dev/cpuset/system-background/tasks
diff --git a/health/2.0/README b/health/2.0/README
index 11e6a7a..dfd965a 100644
--- a/health/2.0/README
+++ b/health/2.0/README
@@ -6,12 +6,7 @@
 1. If the device does not have a vendor-specific libhealthd AND does not
    implement storage-related APIs, just do the following:
 
-    1.1 (recommended) To remove healthd from the build,
-        PRODUCT_PACKAGES += android.hardware.health@2.0-service.override
-        DEVICE_FRAMEWORK_MANIFEST_FILE += \
-            system/libhidl/vintfdata/manifest_healthd_exclude.xml
-    1.2 To keep healthd in the build,
-        PRODUCT_PACKAGES += android.hardware.health@2.0-service
+    PRODUCT_PACKAGES += android.hardware.health@2.0-service
 
    Otherwise, continue to Step 2.
 
diff --git a/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp
index 77fd6f7..70a5205 100644
--- a/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/3.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -20,6 +20,7 @@
 #include <iostream>
 
 #include <openssl/evp.h>
+#include <openssl/mem.h>
 #include <openssl/x509.h>
 
 #include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
@@ -322,11 +323,11 @@
             char* cert_sub = X509_NAME_oneline(X509_get_subject_name(key_cert.get()), nullptr, 0);
             EXPECT_STREQ("/CN=Android Keystore Key", cert_sub)
                 << "Cert " << i << " has wrong subject.  (Possibly b/38394614)";
-            free(cert_sub);
+            OPENSSL_free(cert_sub);
         }
 
-        free(cert_issuer);
-        free(signer_subj);
+        OPENSSL_free(cert_issuer);
+        OPENSSL_free(signer_subj);
 
         if (dump_Attestations) std::cout << bin2hex(chain[i]) << std::endl;
     }
diff --git a/keymaster/4.0/support/Keymaster.cpp b/keymaster/4.0/support/Keymaster.cpp
index 444298b..9325cc0 100644
--- a/keymaster/4.0/support/Keymaster.cpp
+++ b/keymaster/4.0/support/Keymaster.cpp
@@ -164,10 +164,10 @@
                     sharingCheck = curSharingCheck;
                     firstKeymaster = false;
                 }
-                CHECK(curSharingCheck == sharingCheck)
-                    << "HMAC computation failed for " << *keymaster  //
-                    << " Expected: " << sharingCheck                 //
-                    << " got: " << curSharingCheck;
+                if (curSharingCheck != sharingCheck)
+                    LOG(WARNING) << "HMAC computation failed for " << *keymaster  //
+                                 << " Expected: " << sharingCheck                 //
+                                 << " got: " << curSharingCheck;
             });
         CHECK(rc.isOk()) << "Failed to communicate with " << *keymaster
                          << " error: " << rc.description();
diff --git a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
index e266a86..c89abd9 100644
--- a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
+++ b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
@@ -16,6 +16,9 @@
 
 #include "KeymasterHidlTest.h"
 
+#include <vector>
+
+#include <android-base/logging.h>
 #include <android/hidl/manager/1.0/IServiceManager.h>
 
 #include <keymasterV4_0/key_param_output.h>
@@ -383,12 +386,18 @@
     AuthorizationSet begin_out_params;
     EXPECT_EQ(ErrorCode::OK, Begin(operation, key_blob, in_params, &begin_out_params, &op_handle_));
 
+    string output;
+    size_t consumed = 0;
+    AuthorizationSet update_params;
+    AuthorizationSet update_out_params;
+    EXPECT_EQ(ErrorCode::OK,
+              Update(op_handle_, update_params, message, &update_out_params, &output, &consumed));
+
     string unused;
     AuthorizationSet finish_params;
     AuthorizationSet finish_out_params;
-    string output;
-    EXPECT_EQ(ErrorCode::OK,
-              Finish(op_handle_, finish_params, message, unused, &finish_out_params, &output));
+    EXPECT_EQ(ErrorCode::OK, Finish(op_handle_, finish_params, message.substr(consumed), unused,
+                                    &finish_out_params, &output));
     op_handle_ = kOpHandleSentinel;
 
     out_params->push_back(begin_out_params);
@@ -480,12 +489,20 @@
     ASSERT_EQ(ErrorCode::OK,
               Begin(KeyPurpose::VERIFY, key_blob, params, &begin_out_params, &op_handle_));
 
+    string output;
+    AuthorizationSet update_params;
+    AuthorizationSet update_out_params;
+    size_t consumed;
+    ASSERT_EQ(ErrorCode::OK,
+              Update(op_handle_, update_params, message, &update_out_params, &output, &consumed));
+    EXPECT_TRUE(output.empty());
+    EXPECT_GT(consumed, 0U);
+
     string unused;
     AuthorizationSet finish_params;
     AuthorizationSet finish_out_params;
-    string output;
-    EXPECT_EQ(ErrorCode::OK,
-              Finish(op_handle_, finish_params, message, signature, &finish_out_params, &output));
+    EXPECT_EQ(ErrorCode::OK, Finish(op_handle_, finish_params, message.substr(consumed), signature,
+                                    &finish_out_params, &output));
     op_handle_ = kOpHandleSentinel;
     EXPECT_TRUE(output.empty());
 }
@@ -585,6 +602,112 @@
                            });
     return retval;
 }
+std::vector<uint32_t> KeymasterHidlTest::ValidKeySizes(Algorithm algorithm) {
+    switch (algorithm) {
+        case Algorithm::RSA:
+            switch (SecLevel()) {
+                case SecurityLevel::TRUSTED_ENVIRONMENT:
+                    return {2048, 3072, 4096};
+                case SecurityLevel::STRONGBOX:
+                    return {2048};
+                default:
+                    CHECK(false) << "Invalid security level " << uint32_t(SecLevel());
+                    break;
+            }
+            break;
+        case Algorithm::EC:
+            switch (SecLevel()) {
+                case SecurityLevel::TRUSTED_ENVIRONMENT:
+                    return {224, 256, 384, 521};
+                case SecurityLevel::STRONGBOX:
+                    return {256};
+                default:
+                    CHECK(false) << "Invalid security level " << uint32_t(SecLevel());
+                    break;
+            }
+            break;
+        case Algorithm::AES:
+            return {128, 256};
+        case Algorithm::TRIPLE_DES:
+            return {168};
+        case Algorithm::HMAC: {
+            std::vector<uint32_t> retval((512 - 64) / 8 + 1);
+            uint32_t size = 64 - 8;
+            std::generate(retval.begin(), retval.end(), [&]() { return (size += 8); });
+            return retval;
+        }
+        default:
+            CHECK(false) << "Invalid Algorithm: " << algorithm;
+            return {};
+    }
+    CHECK(false) << "Should be impossible to get here";
+    return {};
+}
+std::vector<uint32_t> KeymasterHidlTest::InvalidKeySizes(Algorithm algorithm) {
+    if (SecLevel() == SecurityLevel::TRUSTED_ENVIRONMENT) return {};
+    CHECK(SecLevel() == SecurityLevel::STRONGBOX);
+    switch (algorithm) {
+        case Algorithm::RSA:
+            return {3072, 4096};
+        case Algorithm::EC:
+            return {224, 384, 521};
+        default:
+            return {};
+    }
+}
+
+std::vector<EcCurve> KeymasterHidlTest::ValidCurves() {
+    if (securityLevel_ == SecurityLevel::STRONGBOX) {
+        return {EcCurve::P_256};
+    } else {
+        return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521};
+    }
+}
+
+std::vector<EcCurve> KeymasterHidlTest::InvalidCurves() {
+    if (SecLevel() == SecurityLevel::TRUSTED_ENVIRONMENT) return {};
+    CHECK(SecLevel() == SecurityLevel::STRONGBOX);
+    return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521};
+}
+
+std::initializer_list<Digest> KeymasterHidlTest::ValidDigests(bool withNone, bool withMD5) {
+    std::vector<Digest> result;
+    switch (SecLevel()) {
+        case SecurityLevel::TRUSTED_ENVIRONMENT:
+            if (withNone) {
+                if (withMD5)
+                    return {Digest::NONE,      Digest::MD5,       Digest::SHA1,
+                            Digest::SHA_2_224, Digest::SHA_2_256, Digest::SHA_2_384,
+                            Digest::SHA_2_512};
+                else
+                    return {Digest::NONE,      Digest::SHA1,      Digest::SHA_2_224,
+                            Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512};
+            } else {
+                if (withMD5)
+                    return {Digest::MD5,       Digest::SHA1,      Digest::SHA_2_224,
+                            Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512};
+                else
+                    return {Digest::SHA1, Digest::SHA_2_224, Digest::SHA_2_256, Digest::SHA_2_384,
+                            Digest::SHA_2_512};
+            }
+            break;
+        case SecurityLevel::STRONGBOX:
+            if (withNone)
+                return {Digest::NONE, Digest::SHA_2_256};
+            else
+                return {Digest::SHA_2_256};
+            break;
+        default:
+            CHECK(false) << "Invalid security level " << uint32_t(SecLevel());
+            break;
+    }
+    CHECK(false) << "Should be impossible to get here";
+    return {};
+}
+
+std::vector<Digest> KeymasterHidlTest::InvalidDigests() {
+    return {};
+}
 
 }  // namespace test
 }  // namespace V4_0
diff --git a/keymaster/4.0/vts/functional/KeymasterHidlTest.h b/keymaster/4.0/vts/functional/KeymasterHidlTest.h
index 36d3fc2..94beb21 100644
--- a/keymaster/4.0/vts/functional/KeymasterHidlTest.h
+++ b/keymaster/4.0/vts/functional/KeymasterHidlTest.h
@@ -208,6 +208,15 @@
     static bool IsSecure() { return securityLevel_ != SecurityLevel::SOFTWARE; }
     static SecurityLevel SecLevel() { return securityLevel_; }
 
+    std::vector<uint32_t> ValidKeySizes(Algorithm algorithm);
+    std::vector<uint32_t> InvalidKeySizes(Algorithm algorithm);
+
+    std::vector<EcCurve> ValidCurves();
+    std::vector<EcCurve> InvalidCurves();
+
+    std::initializer_list<Digest> ValidDigests(bool withNone, bool withMD5);
+    std::vector<Digest> InvalidDigests();
+
     HidlBuf key_blob_;
     KeyCharacteristics key_characteristics_;
     OperationHandle op_handle_ = kOpHandleSentinel;
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index bc33b2b..450b3eb 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -20,6 +20,7 @@
 #include <iostream>
 
 #include <openssl/evp.h>
+#include <openssl/mem.h>
 #include <openssl/x509.h>
 
 #include <cutils/properties.h>
@@ -208,11 +209,11 @@
             char* cert_sub = X509_NAME_oneline(X509_get_subject_name(key_cert.get()), nullptr, 0);
             EXPECT_STREQ("/CN=Android Keystore Key", cert_sub)
                 << "Cert " << i << " has wrong subject.";
-            free(cert_sub);
+            OPENSSL_free(cert_sub);
         }
 
-        free(cert_issuer);
-        free(signer_subj);
+        OPENSSL_free(cert_issuer);
+        OPENSSL_free(signer_subj);
 
         if (dump_Attestations) std::cout << bin2hex(chain[i]) << std::endl;
     }
@@ -375,7 +376,7 @@
  * correct characteristics.
  */
 TEST_F(NewKeyGenerationTest, Rsa) {
-    for (uint32_t key_size : {1024, 2048, 3072, 4096}) {
+    for (auto key_size : ValidKeySizes(Algorithm::RSA)) {
         HidlBuf key_blob;
         KeyCharacteristics key_characteristics;
         ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
@@ -405,6 +406,23 @@
 }
 
 /*
+ * NewKeyGenerationTest.NoInvalidRsaSizes
+ *
+ * Verifies that keymaster cannot generate any RSA key sizes that are designated as invalid.
+ */
+TEST_F(NewKeyGenerationTest, NoInvalidRsaSizes) {
+    for (auto key_size : InvalidKeySizes(Algorithm::RSA)) {
+        HidlBuf key_blob;
+        KeyCharacteristics key_characteristics;
+        ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE, GenerateKey(AuthorizationSetBuilder()
+                                                                   .RsaSigningKey(key_size, 3)
+                                                                   .Digest(Digest::NONE)
+                                                                   .Padding(PaddingMode::NONE),
+                                                               &key_blob, &key_characteristics));
+    }
+}
+
+/*
  * NewKeyGenerationTest.RsaNoDefaultSize
  *
  * Verifies that failing to specify a key size for RSA key generation returns UNSUPPORTED_KEY_SIZE.
@@ -424,7 +442,7 @@
  * correct characteristics.
  */
 TEST_F(NewKeyGenerationTest, Ecdsa) {
-    for (uint32_t key_size : {224, 256, 384, 521}) {
+    for (auto key_size : ValidKeySizes(Algorithm::EC)) {
         HidlBuf key_blob;
         KeyCharacteristics key_characteristics;
         ASSERT_EQ(
@@ -466,10 +484,18 @@
 /*
  * NewKeyGenerationTest.EcdsaInvalidSize
  *
- * Verifies that failing to specify an invalid key size for EC key generation returns
- * UNSUPPORTED_KEY_SIZE.
+ * Verifies that specifying an invalid key size for EC key generation returns UNSUPPORTED_KEY_SIZE.
  */
 TEST_F(NewKeyGenerationTest, EcdsaInvalidSize) {
+    for (auto key_size : InvalidKeySizes(Algorithm::EC)) {
+        HidlBuf key_blob;
+        KeyCharacteristics key_characteristics;
+        ASSERT_EQ(
+            ErrorCode::UNSUPPORTED_KEY_SIZE,
+            GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(key_size).Digest(Digest::NONE),
+                        &key_blob, &key_characteristics));
+    }
+
     ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE,
               GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(190).Digest(Digest::NONE)));
 }
@@ -481,6 +507,8 @@
  * INVALID_ARGUMENT.
  */
 TEST_F(NewKeyGenerationTest, EcdsaMismatchKeySize) {
+    if (SecLevel() == SecurityLevel::STRONGBOX) return;
+
     ASSERT_EQ(ErrorCode::INVALID_ARGUMENT,
               GenerateKey(AuthorizationSetBuilder()
                               .EcdsaSigningKey(224)
@@ -494,7 +522,7 @@
  * Verifies that keymaster supports all required EC key sizes.
  */
 TEST_F(NewKeyGenerationTest, EcdsaAllValidSizes) {
-    size_t valid_sizes[] = {224, 256, 384, 521};
+    auto valid_sizes = ValidKeySizes(Algorithm::EC);
     for (size_t size : valid_sizes) {
         EXPECT_EQ(ErrorCode::OK,
                   GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(size).Digest(Digest::NONE)))
@@ -505,13 +533,12 @@
 }
 
 /*
- * NewKeyGenerationTest.EcdsaAllValidCurves
+ * NewKeyGenerationTest.EcdsaInvalidCurves
  *
- * Verifies that keymaster supports all required EC curves.
+ * Verifies that keymaster does not support any curve designated as unsupported.
  */
 TEST_F(NewKeyGenerationTest, EcdsaAllValidCurves) {
-    V4_0::EcCurve curves[] = {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521};
-    for (V4_0::EcCurve curve : curves) {
+    for (auto curve : ValidCurves()) {
         EXPECT_EQ(
             ErrorCode::OK,
             GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(curve).Digest(Digest::SHA_2_512)))
@@ -528,8 +555,7 @@
  * characteristics.
  */
 TEST_F(NewKeyGenerationTest, Hmac) {
-    for (auto digest : {Digest::MD5, Digest::SHA1, Digest::SHA_2_224, Digest::SHA_2_256,
-                        Digest::SHA_2_384, Digest::SHA_2_512}) {
+    for (auto digest : ValidDigests(false /* withNone */, true /* withMD5 */)) {
         HidlBuf key_blob;
         KeyCharacteristics key_characteristics;
         constexpr size_t key_size = 128;
@@ -630,6 +656,8 @@
  * Verifies that keymaster rejects HMAC key generation with multiple specified digest algorithms.
  */
 TEST_F(NewKeyGenerationTest, HmacMultipleDigests) {
+    if (SecLevel() == SecurityLevel::STRONGBOX) return;
+
     ASSERT_EQ(ErrorCode::UNSUPPORTED_DIGEST,
               GenerateKey(AuthorizationSetBuilder()
                               .HmacKey(128)
@@ -664,7 +692,7 @@
  */
 TEST_F(SigningOperationsTest, RsaSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 65537)
+                                             .RsaSigningKey(2048, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -680,7 +708,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPssSha256Success) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 65537)
+                                             .RsaSigningKey(2048, 65537)
                                              .Digest(Digest::SHA_2_256)
                                              .Padding(PaddingMode::RSA_PSS)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -698,7 +726,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPaddingNoneDoesNotAllowOther) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 65537)
+                                             .RsaSigningKey(2048, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
@@ -993,11 +1021,8 @@
  * Verifies that ECDSA operations succeed with all possible key sizes and hashes.
  */
 TEST_F(SigningOperationsTest, EcdsaAllSizesAndHashes) {
-    for (auto key_size : {224, 256, 384, 521}) {
-        for (auto digest : {
-                 Digest::SHA1, Digest::SHA_2_224, Digest::SHA_2_256, Digest::SHA_2_384,
-                 Digest::SHA_2_512,
-             }) {
+    for (auto key_size : ValidKeySizes(Algorithm::EC)) {
+        for (auto digest : ValidDigests(false /* withNone */, false /* withMD5 */)) {
             ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                               .Authorization(TAG_NO_AUTH_REQUIRED)
                                               .EcdsaSigningKey(key_size)
@@ -1020,7 +1045,7 @@
  * Verifies that ECDSA operations succeed with all possible curves.
  */
 TEST_F(SigningOperationsTest, EcdsaAllCurves) {
-    for (auto curve : {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521}) {
+    for (auto curve : ValidCurves()) {
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                           .Authorization(TAG_NO_AUTH_REQUIRED)
                                           .EcdsaSigningKey(curve)
@@ -1075,8 +1100,7 @@
  * Verifies that HMAC works with all digests.
  */
 TEST_F(SigningOperationsTest, HmacAllDigests) {
-    for (auto digest : {Digest::SHA1, Digest::SHA_2_224, Digest::SHA_2_256, Digest::SHA_2_384,
-                        Digest::SHA_2_512}) {
+    for (auto digest : ValidDigests(false /* withNone */, false /* withMD5 */)) {
         ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                                  .Authorization(TAG_NO_AUTH_REQUIRED)
                                                  .HmacKey(128)
@@ -1307,15 +1331,15 @@
  * Verifies RSA signature/verification for all padding modes and digests.
  */
 TEST_F(VerificationOperationsTest, RsaAllPaddingsAndDigests) {
-    ASSERT_EQ(ErrorCode::OK,
-              GenerateKey(AuthorizationSetBuilder()
+    auto authorizations = AuthorizationSetBuilder()
                               .Authorization(TAG_NO_AUTH_REQUIRED)
                               .RsaSigningKey(2048, 65537)
-                              .Digest(Digest::NONE, Digest::MD5, Digest::SHA1, Digest::SHA_2_224,
-                                      Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512)
+                              .Digest(ValidDigests(true /* withNone */, true /* withMD5 */))
                               .Padding(PaddingMode::NONE)
                               .Padding(PaddingMode::RSA_PSS)
-                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
+                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN);
+
+    ASSERT_EQ(ErrorCode::OK, GenerateKey(authorizations));
 
     string message(128, 'a');
     string corrupt_message(message);
@@ -1323,8 +1347,7 @@
 
     for (auto padding :
          {PaddingMode::NONE, PaddingMode::RSA_PSS, PaddingMode::RSA_PKCS1_1_5_SIGN}) {
-        for (auto digest : {Digest::NONE, Digest::MD5, Digest::SHA1, Digest::SHA_2_224,
-                            Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512}) {
+        for (auto digest : ValidDigests(true /* withNone */, true /* withMD5 */)) {
             if (padding == PaddingMode::NONE && digest != Digest::NONE) {
                 // Digesting only makes sense with padding.
                 continue;
@@ -1402,14 +1425,11 @@
  * Verifies ECDSA signature/verification for all digests and curves.
  */
 TEST_F(VerificationOperationsTest, EcdsaAllDigestsAndCurves) {
-    auto digests = {
-        Digest::NONE,      Digest::SHA1,      Digest::SHA_2_224,
-        Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512,
-    };
+    auto digests = ValidDigests(true /* withNone */, false /* withMD5 */);
 
     string message = "1234567890";
     string corrupt_message = "2234567890";
-    for (auto curve : {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521}) {
+    for (auto curve : ValidCurves()) {
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                           .Authorization(TAG_NO_AUTH_REQUIRED)
                                           .EcdsaSigningKey(curve)
@@ -1721,6 +1741,7 @@
  * Verifies that importing and using an ECDSA P-521 key pair works correctly.
  */
 TEST_F(ImportKeyTest, Ecdsa521Success) {
+    if (SecLevel() == SecurityLevel::STRONGBOX) return;
     ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
                                            .Authorization(TAG_NO_AUTH_REQUIRED)
                                            .EcdsaSigningKey(521)
@@ -2053,8 +2074,7 @@
  * Verifies that RSA-OAEP encryption operations work, with all digests.
  */
 TEST_F(EncryptionOperationsTest, RsaOaepSuccess) {
-    auto digests = {Digest::MD5,       Digest::SHA1,      Digest::SHA_2_224,
-                    Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512};
+    auto digests = ValidDigests(false /* withNone */, true /* withMD5 */);
 
     size_t key_size = 2048;  // Need largish key for SHA-512 test.
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
@@ -2231,7 +2251,7 @@
 TEST_F(EncryptionOperationsTest, EcdsaEncrypt) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .EcdsaSigningKey(224)
+                                             .EcdsaSigningKey(256)
                                              .Digest(Digest::NONE)));
     auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
     ASSERT_EQ(ErrorCode::UNSUPPORTED_PURPOSE, Begin(KeyPurpose::ENCRYPT, params));
@@ -2486,7 +2506,9 @@
             for (size_t i = 0; i < message.size(); i += increment) {
                 to_send.append(message.substr(i, increment));
                 EXPECT_EQ(ErrorCode::OK, Update(to_send, &ciphertext, &input_consumed));
+                EXPECT_EQ(to_send.length(), input_consumed);
                 to_send = to_send.substr(input_consumed);
+                EXPECT_EQ(0U, to_send.length());
 
                 switch (block_mode) {
                     case BlockMode::ECB:
@@ -2802,6 +2824,8 @@
     ASSERT_EQ(ErrorCode::OK,
               Finish(op_handle_, update_params, message, "", &update_out_params, &ciphertext));
 
+    ASSERT_EQ(ciphertext.length(), message.length() + 16);
+
     // Grab nonce
     begin_params.push_back(begin_out_params);
 
@@ -2813,7 +2837,7 @@
                                     &plaintext, &input_consumed));
     EXPECT_EQ(ciphertext.size(), input_consumed);
     EXPECT_EQ(ErrorCode::OK, Finish("", &plaintext));
-
+    EXPECT_EQ(message.length(), plaintext.length());
     EXPECT_EQ(message, plaintext);
 }
 
@@ -3700,6 +3724,8 @@
  * Verifies that the max uses per boot tag works correctly with AES keys.
  */
 TEST_F(MaxOperationsTest, TestLimitAes) {
+    if (SecLevel() == SecurityLevel::STRONGBOX) return;
+
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .AesEncryptionKey(128)
@@ -3725,6 +3751,8 @@
  * Verifies that the max uses per boot tag works correctly with RSA keys.
  */
 TEST_F(MaxOperationsTest, TestLimitRsa) {
+    if (SecLevel() == SecurityLevel::STRONGBOX) return;
+
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .RsaSigningKey(1024, 65537)
diff --git a/power/1.3/Android.bp b/power/1.3/Android.bp
new file mode 100644
index 0000000..65b7597
--- /dev/null
+++ b/power/1.3/Android.bp
@@ -0,0 +1,21 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.power@1.3",
+    root: "android.hardware",
+    srcs: [
+        "types.hal",
+        "IPower.hal",
+    ],
+    interfaces: [
+        "android.hardware.power@1.0",
+        "android.hardware.power@1.1",
+        "android.hardware.power@1.2",
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "PowerHint",
+    ],
+    gen_java: true,
+}
+
diff --git a/power/1.3/IPower.hal b/power/1.3/IPower.hal
new file mode 100644
index 0000000..18b00a3
--- /dev/null
+++ b/power/1.3/IPower.hal
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.power@1.3;
+
+import @1.2::IPower;
+
+interface IPower extends @1.2::IPower {
+    /**
+     * Called to pass hints on power requirements which
+     * may result in adjustment of power/performance parameters of the
+     * cpufreq governor and other controls.
+     *
+     * A particular platform may choose to ignore any hint.
+     *
+     * @param hint PowerHint which is passed
+     * @param data contains additional information about the hint
+     *     and is described along with the comments for each of the hints.
+     */
+    oneway powerHintAsync_1_3(PowerHint hint, int32_t data);
+};
diff --git a/power/1.3/types.hal b/power/1.3/types.hal
new file mode 100644
index 0000000..658495c
--- /dev/null
+++ b/power/1.3/types.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.power@1.3;
+
+import @1.2::PowerHint;
+
+/** Power hint identifiers passed to powerHintAsync_1_3() */
+enum PowerHint : @1.2::PowerHint {
+   /**
+    * This hint indicates that the device is about to enter a period of expensive rendering, and
+    * the GPU should be configured accordingly. The data parameter is always 1 when entering this
+    * state and 0 when leaving it.
+    */
+    EXPENSIVE_RENDERING,
+};
diff --git a/power/1.3/vts/functional/Android.bp b/power/1.3/vts/functional/Android.bp
new file mode 100644
index 0000000..34cdb60
--- /dev/null
+++ b/power/1.3/vts/functional/Android.bp
@@ -0,0 +1,27 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalPowerV1_3TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: ["VtsHalPowerV1_3TargetTest.cpp"],
+    static_libs: [
+        "android.hardware.power@1.0",
+        "android.hardware.power@1.1",
+        "android.hardware.power@1.2",
+        "android.hardware.power@1.3",
+    ],
+}
diff --git a/power/1.3/vts/functional/VtsHalPowerV1_3TargetTest.cpp b/power/1.3/vts/functional/VtsHalPowerV1_3TargetTest.cpp
new file mode 100644
index 0000000..af1a1d8
--- /dev/null
+++ b/power/1.3/vts/functional/VtsHalPowerV1_3TargetTest.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "power_hidl_hal_test"
+#include <android-base/logging.h>
+#include <android/hardware/power/1.3/IPower.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+using ::android::sp;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::power::V1_3::IPower;
+using ::android::hardware::power::V1_3::PowerHint;
+
+// Test environment for Power HIDL HAL.
+class PowerHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static PowerHidlEnvironment* Instance() {
+        static PowerHidlEnvironment* instance = new PowerHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IPower>(); }
+};
+
+class PowerHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        power = ::testing::VtsHalHidlTargetTestBase::getService<IPower>(
+            PowerHidlEnvironment::Instance()->getServiceName<IPower>());
+        ASSERT_NE(power, nullptr);
+    }
+
+    sp<IPower> power;
+};
+
+TEST_F(PowerHidlTest, PowerHintAsync_1_3) {
+    ASSERT_TRUE(power->powerHintAsync_1_3(PowerHint::EXPENSIVE_RENDERING, 0).isOk());
+}
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(PowerHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    PowerHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    return status;
+}
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
index 03911da..21e5dd1 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
@@ -636,8 +636,9 @@
     if (cardStatus.base.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckAnyOfErrors(
             radioRsp_v1_2->rspInfo.error,
-            {RadioError::SIM_ABSENT, RadioError::RADIO_NOT_AVAILABLE, RadioError::INVALID_ARGUMENTS,
-             RadioError::OP_NOT_ALLOWED_BEFORE_REG_TO_NW, RadioError::REQUEST_NOT_SUPPORTED}));
+            {RadioError::NONE, RadioError::SIM_ABSENT, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::INVALID_ARGUMENTS, RadioError::OP_NOT_ALLOWED_BEFORE_REG_TO_NW,
+             RadioError::REQUEST_NOT_SUPPORTED}));
     } else if (cardStatus.base.cardState == CardState::PRESENT) {
         ASSERT_TRUE(CheckAnyOfErrors(
             radioRsp_v1_2->rspInfo.error,
diff --git a/radio/1.2/vts/functional/radio_response.cpp b/radio/1.2/vts/functional/radio_response.cpp
index f6bead2..c5c7b14 100644
--- a/radio/1.2/vts/functional/radio_response.cpp
+++ b/radio/1.2/vts/functional/radio_response.cpp
@@ -653,7 +653,9 @@
     return Void();
 }
 
-Return<void> RadioResponse_v1_2::setIndicationFilterResponse(const RadioResponseInfo& /*info*/) {
+Return<void> RadioResponse_v1_2::setIndicationFilterResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_v1_2.notify(info.serial);
     return Void();
 }
 
@@ -745,13 +747,17 @@
 }
 
 Return<void> RadioResponse_v1_2::getVoiceRegistrationStateResponse_1_2(
-    const RadioResponseInfo& /*info*/,
+    const RadioResponseInfo& info,
     const ::android::hardware::radio::V1_2::VoiceRegStateResult& /*voiceRegResponse*/) {
+    rspInfo = info;
+    parent_v1_2.notify(info.serial);
     return Void();
 }
 
 Return<void> RadioResponse_v1_2::getDataRegistrationStateResponse_1_2(
-    const RadioResponseInfo& /*info*/,
+    const RadioResponseInfo& info,
     const ::android::hardware::radio::V1_2::DataRegStateResult& /*dataRegResponse*/) {
+    rspInfo = info;
+    parent_v1_2.notify(info.serial);
     return Void();
-}
\ No newline at end of file
+}