diff --git a/audio/aidl/default/Stream.cpp b/audio/aidl/default/Stream.cpp
index a805b87..cf0870e 100644
--- a/audio/aidl/default/Stream.cpp
+++ b/audio/aidl/default/Stream.cpp
@@ -180,17 +180,20 @@
     StreamDescriptor::Reply reply{};
     reply.status = STATUS_BAD_VALUE;
     switch (command.getTag()) {
-        case Tag::halReservedExit:
-            if (const int32_t cookie = command.get<Tag::halReservedExit>();
-                cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
+        case Tag::halReservedExit: {
+            const int32_t cookie = command.get<Tag::halReservedExit>();
+            if (cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
                 mDriver->shutdown();
                 setClosed();
-                // This is an internal command, no need to reply.
-                return Status::EXIT;
             } else {
                 LOG(WARNING) << __func__ << ": EXIT command has a bad cookie: " << cookie;
             }
-            break;
+            if (cookie != 0) {  // This is an internal command, no need to reply.
+                return Status::EXIT;
+            } else {
+                break;
+            }
+        }
         case Tag::getStatus:
             populateReply(&reply, mIsConnected);
             break;
@@ -400,17 +403,20 @@
     reply.status = STATUS_BAD_VALUE;
     using Tag = StreamDescriptor::Command::Tag;
     switch (command.getTag()) {
-        case Tag::halReservedExit:
-            if (const int32_t cookie = command.get<Tag::halReservedExit>();
-                cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
+        case Tag::halReservedExit: {
+            const int32_t cookie = command.get<Tag::halReservedExit>();
+            if (cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
                 mDriver->shutdown();
                 setClosed();
-                // This is an internal command, no need to reply.
-                return Status::EXIT;
             } else {
                 LOG(WARNING) << __func__ << ": EXIT command has a bad cookie: " << cookie;
             }
-            break;
+            if (cookie != 0) {  // This is an internal command, no need to reply.
+                return Status::EXIT;
+            } else {
+                break;
+            }
+        }
         case Tag::getStatus:
             populateReply(&reply, mIsConnected);
             break;
diff --git a/audio/aidl/default/include/core-impl/Stream.h b/audio/aidl/default/include/core-impl/Stream.h
index aa9fb19..21e63f9 100644
--- a/audio/aidl/default/include/core-impl/Stream.h
+++ b/audio/aidl/default/include/core-impl/Stream.h
@@ -90,7 +90,7 @@
                   std::weak_ptr<sounddose::StreamDataProcessorInterface> streamDataProcessor,
                   DebugParameters debugParameters)
         : mCommandMQ(std::move(commandMQ)),
-          mInternalCommandCookie(std::rand()),
+          mInternalCommandCookie(std::rand() | 1 /* make sure it's not 0 */),
           mReplyMQ(std::move(replyMQ)),
           mFormat(format),
           mChannelLayout(channelLayout),
diff --git a/audio/aidl/vts/VtsHalDownmixTargetTest.cpp b/audio/aidl/vts/VtsHalDownmixTargetTest.cpp
index b82bde1..360bf26 100644
--- a/audio/aidl/vts/VtsHalDownmixTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalDownmixTargetTest.cpp
@@ -138,7 +138,6 @@
 
     void setDataTestParams(int32_t layoutType) {
         mInputBuffer.resize(kBufferSize);
-        mOutputBuffer.resize(kBufferSize);
 
         // Get the number of channels used
         mInputChannelCount = getChannelCount(
@@ -146,6 +145,7 @@
 
         // In case of downmix, output is always configured to stereo layout.
         mOutputBufferSize = (mInputBuffer.size() / mInputChannelCount) * kOutputChannelCount;
+        mOutputBuffer.resize(mOutputBufferSize);
     }
 
     // Generate mInputBuffer values between -kMaxDownmixSample to kMaxDownmixSample
@@ -262,13 +262,13 @@
         for (size_t i = 0, j = position; i < mOutputBufferSize;
              i += kOutputChannelCount, j += mInputChannelCount) {
             // Validate Left channel has no audio
-            ASSERT_EQ(mOutputBuffer[i], 0);
+            ASSERT_EQ(mOutputBuffer[i], 0) << " at " << i;
             // Validate Right channel has audio
             if (mInputBuffer[j] != 0) {
-                ASSERT_NE(mOutputBuffer[i + 1], 0);
+                ASSERT_NE(mOutputBuffer[i + 1], 0) << " at " << i;
             } else {
                 // No change in output when input is 0
-                ASSERT_EQ(mOutputBuffer[i + 1], mInputBuffer[j]);
+                ASSERT_EQ(mOutputBuffer[i + 1], mInputBuffer[j]) << " at " << i;
             }
         }
     }
@@ -402,9 +402,6 @@
             ASSERT_EQ(mOutputBuffer[j], mInputBuffer[i]);
             ASSERT_EQ(mOutputBuffer[j + 1], mInputBuffer[i + 1]);
         }
-        for (size_t i = mOutputBufferSize; i < kBufferSize; i++) {
-            ASSERT_EQ(mOutputBuffer[i], mInputBuffer[i]);
-        }
     }
 
     int32_t mInputChannelLayout;
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index 9bee3b9..eefca39 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -84,10 +84,10 @@
 }
 
 vintf_compatibility_matrix {
-    name: "framework_compatibility_matrix.9.xml",
-    stem: "compatibility_matrix.9.xml",
+    name: "framework_compatibility_matrix.202404.xml",
+    stem: "compatibility_matrix.202404.xml",
     srcs: [
-        "compatibility_matrix.9.xml",
+        "compatibility_matrix.202404.xml",
     ],
     kernel_configs: [
         "kernel_config_v_6.1",
diff --git a/compatibility_matrices/Android.mk b/compatibility_matrices/Android.mk
index c2ffb84..72ead58 100644
--- a/compatibility_matrices/Android.mk
+++ b/compatibility_matrices/Android.mk
@@ -112,7 +112,7 @@
 # interfaces (in the `next` release configuration).
 ifeq ($(RELEASE_AIDL_USE_UNFROZEN),true)
 my_system_matrix_deps += \
-    framework_compatibility_matrix.9.xml
+    framework_compatibility_matrix.202404.xml
 endif
 
 my_framework_matrix_deps += \
diff --git a/compatibility_matrices/compatibility_matrix.9.xml b/compatibility_matrices/compatibility_matrix.202404.xml
similarity index 99%
rename from compatibility_matrices/compatibility_matrix.9.xml
rename to compatibility_matrices/compatibility_matrix.202404.xml
index a7f0845..4498f90 100644
--- a/compatibility_matrices/compatibility_matrix.9.xml
+++ b/compatibility_matrices/compatibility_matrix.202404.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework" level="9">
+<compatibility-matrix version="1.0" type="framework" level="202404">
     <hal format="aidl" optional="true">
         <name>android.hardware.audio.core</name>
         <version>1-2</version>
diff --git a/media/bufferpool/aidl/Android.bp b/media/bufferpool/aidl/Android.bp
index 8e013e0..9dcc90e 100644
--- a/media/bufferpool/aidl/Android.bp
+++ b/media/bufferpool/aidl/Android.bp
@@ -26,6 +26,9 @@
     vendor_available: true,
     double_loadable: true,
     srcs: ["android/hardware/media/bufferpool2/*.aidl"],
+    headers: [
+        "HardwareBuffer_aidl",
+    ],
     imports: [
         "android.hardware.common-V2",
         "android.hardware.common.fmq-V1",
@@ -44,10 +47,13 @@
                 "//apex_available:platform",
                 "com.android.media.swcodec",
             ],
+            additional_shared_libraries: [
+                "libnativewindow",
+            ],
             min_sdk_version: "29",
         },
         rust: {
-            enabled: true,
+            enabled: false,
         },
     },
     versions_with_info: [
@@ -59,6 +65,6 @@
             ],
         },
     ],
-    frozen: true,
+    frozen: false,
 
 }
diff --git a/media/bufferpool/aidl/aidl_api/android.hardware.media.bufferpool2/current/android/hardware/media/bufferpool2/Buffer.aidl b/media/bufferpool/aidl/aidl_api/android.hardware.media.bufferpool2/current/android/hardware/media/bufferpool2/Buffer.aidl
index 4ea0bba..85a78ad 100644
--- a/media/bufferpool/aidl/aidl_api/android.hardware.media.bufferpool2/current/android/hardware/media/bufferpool2/Buffer.aidl
+++ b/media/bufferpool/aidl/aidl_api/android.hardware.media.bufferpool2/current/android/hardware/media/bufferpool2/Buffer.aidl
@@ -35,5 +35,6 @@
 @VintfStability
 parcelable Buffer {
   int id;
-  android.hardware.common.NativeHandle buffer;
+  @nullable android.hardware.common.NativeHandle buffer;
+  @nullable android.hardware.HardwareBuffer hwbBuffer;
 }
diff --git a/media/bufferpool/aidl/android/hardware/media/bufferpool2/Buffer.aidl b/media/bufferpool/aidl/android/hardware/media/bufferpool2/Buffer.aidl
index 976f674..79b3f23 100644
--- a/media/bufferpool/aidl/android/hardware/media/bufferpool2/Buffer.aidl
+++ b/media/bufferpool/aidl/android/hardware/media/bufferpool2/Buffer.aidl
@@ -17,6 +17,7 @@
 package android.hardware.media.bufferpool2;
 
 import android.hardware.common.NativeHandle;
+import android.hardware.HardwareBuffer;
 
 /**
  * Generic buffer for fast recycling for media/stagefright.
@@ -26,10 +27,14 @@
  * by a buffer pool, and are recycled to the buffer pool when they are
  * no longer referenced by the clients.
  *
+ * Initially all buffers in media HAL should be NativeHandle(actually native_handle_t).
+ * HardwareBuffer(actually AHardwareBuffer) for GraphicBuffer is added from V2.
+ *
  * E.g. ion or gralloc buffer
  */
 @VintfStability
 parcelable Buffer {
     int id;
-    NativeHandle buffer;
+    @nullable NativeHandle buffer;
+    @nullable HardwareBuffer hwbBuffer;
 }
diff --git a/media/bufferpool/aidl/default/Android.bp b/media/bufferpool/aidl/default/Android.bp
index 11a6163..4d12d63 100644
--- a/media/bufferpool/aidl/default/Android.bp
+++ b/media/bufferpool/aidl/default/Android.bp
@@ -33,15 +33,16 @@
         "libcutils",
         "libfmq",
         "liblog",
+        "libnativewindow",
         "libutils",
-        "android.hardware.media.bufferpool2-V1-ndk",
+        "android.hardware.media.bufferpool2-V2-ndk",
     ],
     static_libs: [
         "libaidlcommonsupport",
     ],
     export_shared_lib_headers: [
         "libfmq",
-        "android.hardware.media.bufferpool2-V1-ndk",
+        "android.hardware.media.bufferpool2-V2-ndk",
     ],
     double_loadable: true,
     cflags: [
diff --git a/media/bufferpool/aidl/default/BufferPoolClient.cpp b/media/bufferpool/aidl/default/BufferPoolClient.cpp
index 0e249d5..ce4ad8e 100644
--- a/media/bufferpool/aidl/default/BufferPoolClient.cpp
+++ b/media/bufferpool/aidl/default/BufferPoolClient.cpp
@@ -757,7 +757,13 @@
         return svcSpecific ? svcSpecific : ResultStatus::CRITICAL_ERROR;
     }
     if (results[0].getTag() == FetchResult::buffer) {
-        *handle = ::android::dupFromAidl(results[0].get<FetchResult::buffer>().buffer);
+        if (results[0].get<FetchResult::buffer>().buffer.has_value()) {
+            *handle = ::android::dupFromAidl(results[0].get<FetchResult::buffer>().buffer.value());
+        } else {
+            // TODO: Support HardwareBuffer
+            ALOGW("handle nullptr");
+            *handle = nullptr;
+        }
         return ResultStatus::OK;
     }
     return results[0].get<FetchResult::failure>();
diff --git a/media/bufferpool/aidl/default/tests/Android.bp b/media/bufferpool/aidl/default/tests/Android.bp
index 549af57..487ed4c 100644
--- a/media/bufferpool/aidl/default/tests/Android.bp
+++ b/media/bufferpool/aidl/default/tests/Android.bp
@@ -36,8 +36,9 @@
         "libcutils",
         "libfmq",
         "liblog",
+        "libnativewindow",
         "libutils",
-        "android.hardware.media.bufferpool2-V1-ndk",
+        "android.hardware.media.bufferpool2-V2-ndk",
     ],
     static_libs: [
         "libaidlcommonsupport",
@@ -59,8 +60,9 @@
         "libcutils",
         "libfmq",
         "liblog",
+        "libnativewindow",
         "libutils",
-        "android.hardware.media.bufferpool2-V1-ndk",
+        "android.hardware.media.bufferpool2-V2-ndk",
     ],
     static_libs: [
         "libaidlcommonsupport",
@@ -82,8 +84,9 @@
         "libcutils",
         "libfmq",
         "liblog",
+        "libnativewindow",
         "libutils",
-        "android.hardware.media.bufferpool2-V1-ndk",
+        "android.hardware.media.bufferpool2-V2-ndk",
     ],
     static_libs: [
         "libaidlcommonsupport",
diff --git a/media/c2/aidl/Android.bp b/media/c2/aidl/Android.bp
index b511e45..2eaeb01 100644
--- a/media/c2/aidl/Android.bp
+++ b/media/c2/aidl/Android.bp
@@ -20,7 +20,7 @@
     ],
     imports: [
         "android.hardware.common-V2",
-        "android.hardware.media.bufferpool2-V1",
+        "android.hardware.media.bufferpool2-V2",
     ],
     include_dirs: [
         "frameworks/native/aidl/gui",
diff --git a/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs b/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
index 4c0f659..26fdb56 100644
--- a/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
+++ b/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
@@ -26,7 +26,7 @@
 use authgraph_boringssl as boring;
 use authgraph_core::key;
 use coset::{CborSerializable, CoseEncrypt0};
-use dice_policy::{ConstraintSpec, ConstraintType, DicePolicy};
+use dice_policy::{ConstraintSpec, ConstraintType, DicePolicy, MissingAction};
 use secretkeeper_client::dice::OwnedDiceArtifactsWithExplicitKey;
 use secretkeeper_client::SkSession;
 use secretkeeper_core::cipher;
@@ -255,16 +255,12 @@
     let security_version: i64 = -70005;
 
     let constraint_spec = [
-        ConstraintSpec::new(
-            ConstraintType::ExactMatch,
-            vec![authority_hash],
-            /* Optional */ false,
-        ),
-        ConstraintSpec::new(ConstraintType::ExactMatch, vec![key_mode], false),
+        ConstraintSpec::new(ConstraintType::ExactMatch, vec![authority_hash], MissingAction::Fail),
+        ConstraintSpec::new(ConstraintType::ExactMatch, vec![key_mode], MissingAction::Fail),
         ConstraintSpec::new(
             ConstraintType::GreaterOrEqual,
             vec![config_desc, security_version],
-            true,
+            MissingAction::Ignore,
         ),
     ];