diff --git a/audio/common/4.0/types.hal b/audio/common/4.0/types.hal
index dfc350e..e55491d 100644
--- a/audio/common/4.0/types.hal
+++ b/audio/common/4.0/types.hal
@@ -373,21 +373,21 @@
     OUT_TOP_BACK_LEFT         = 0x8000,
     OUT_TOP_BACK_CENTER       = 0x10000,
     OUT_TOP_BACK_RIGHT        = 0x20000,
-    OUT_TOP_CENTER_LEFT       = 0x40000,
-    OUT_TOP_CENTER_RIGHT      = 0x80000,
+    OUT_TOP_SIDE_LEFT         = 0x40000,
+    OUT_TOP_SIDE_RIGHT        = 0x80000,
 
     OUT_MONO     = OUT_FRONT_LEFT,
     OUT_STEREO   = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT),
     OUT_2POINT1  = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT | OUT_LOW_FREQUENCY),
     OUT_2POINT0POINT2 = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT |
-                         OUT_TOP_CENTER_LEFT | OUT_TOP_CENTER_RIGHT),
+                         OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT),
     OUT_2POINT1POINT2 = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT |
-                         OUT_TOP_CENTER_LEFT | OUT_TOP_CENTER_RIGHT |
+                         OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT |
                          OUT_LOW_FREQUENCY),
     OUT_3POINT0POINT2 = (OUT_FRONT_LEFT | OUT_FRONT_CENTER | OUT_FRONT_RIGHT |
-                         OUT_TOP_CENTER_LEFT | OUT_TOP_CENTER_RIGHT),
+                         OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT),
     OUT_3POINT1POINT2 = (OUT_FRONT_LEFT | OUT_FRONT_CENTER | OUT_FRONT_RIGHT |
-                        OUT_TOP_CENTER_LEFT | OUT_TOP_CENTER_RIGHT |
+                        OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT |
                         OUT_LOW_FREQUENCY),
     OUT_QUAD     = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT |
             OUT_BACK_LEFT | OUT_BACK_RIGHT),
@@ -406,6 +406,10 @@
     OUT_5POINT1_SIDE = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT |
             OUT_FRONT_CENTER | OUT_LOW_FREQUENCY |
             OUT_SIDE_LEFT | OUT_SIDE_RIGHT),
+    OUT_5POINT1POINT2  = (OUT_5POINT1 | OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT),
+    OUT_5POINT1POINT4  = (OUT_5POINT1 |
+            OUT_TOP_FRONT_LEFT | OUT_TOP_FRONT_RIGHT |
+            OUT_TOP_BACK_LEFT | OUT_TOP_BACK_RIGHT),
     OUT_6POINT1 = (OUT_FRONT_LEFT | OUT_FRONT_RIGHT |
             OUT_FRONT_CENTER | OUT_LOW_FREQUENCY |
             OUT_BACK_LEFT | OUT_BACK_RIGHT |
@@ -415,6 +419,10 @@
             OUT_FRONT_CENTER | OUT_LOW_FREQUENCY |
             OUT_BACK_LEFT | OUT_BACK_RIGHT |
             OUT_SIDE_LEFT | OUT_SIDE_RIGHT),
+    OUT_7POINT1POINT2  = (OUT_7POINT1 | OUT_TOP_SIDE_LEFT | OUT_TOP_SIDE_RIGHT),
+    OUT_7POINT1POINT4  = (OUT_7POINT1 |
+            OUT_TOP_FRONT_LEFT | OUT_TOP_FRONT_RIGHT |
+            OUT_TOP_BACK_LEFT | OUT_TOP_BACK_RIGHT),
     // Note that the 2.0 OUT_ALL* have been moved to helper functions
 
     /* These are bits only, not complete values */
diff --git a/automotive/vehicle/2.0/Android.bp b/automotive/vehicle/2.0/Android.bp
index bdc44ef..902a4e8 100644
--- a/automotive/vehicle/2.0/Android.bp
+++ b/automotive/vehicle/2.0/Android.bp
@@ -48,6 +48,7 @@
         "VehicleHvacFanDirection",
         "VehicleHwKeyInputAction",
         "VehicleIgnitionState",
+        "VehicleOilLevel",
         "VehiclePropConfig",
         "VehiclePropValue",
         "VehicleProperty",
diff --git a/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp b/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
index 2c3ebfc..f2aa421 100644
--- a/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
@@ -52,6 +52,7 @@
     } else {
         valueToUpdate->timestamp = propValue.timestamp;
         valueToUpdate->value = propValue.value;
+        valueToUpdate->status = propValue.status;
     }
     return true;
 }
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
index 764bebd..dc34a50 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
@@ -138,6 +138,7 @@
             return status;
         }
     } else if (mHvacPowerProps.count(propValue.prop)) {
+        // TODO(75328113): this should be handled by property status
         auto hvacPowerOn = mPropStore->readValueOrNull(
             toInt(VehicleProperty::HVAC_POWER_ON),
             (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT));
@@ -165,6 +166,22 @@
         }
     }
 
+    if (propValue.status != VehiclePropertyStatus::AVAILABLE) {
+        // Android side cannot set property status - this value is the
+        // purview of the HAL implementation to reflect the state of
+        // its underlying hardware
+        return StatusCode::INVALID_ARG;
+    }
+    auto currentPropValue = mPropStore->readValueOrNull(propValue);
+
+    if (currentPropValue == nullptr) {
+        return StatusCode::INVALID_ARG;
+    }
+    if (currentPropValue->status != VehiclePropertyStatus::AVAILABLE) {
+        // do not allow Android side to set() a disabled/error property
+        return StatusCode::NOT_AVAILABLE;
+    }
+
     if (!mPropStore->writeValue(propValue)) {
         return StatusCode::INVALID_ARG;
     }
diff --git a/camera/common/1.0/default/Exif.cpp b/camera/common/1.0/default/Exif.cpp
index 3e894f9..6054999 100644
--- a/camera/common/1.0/default/Exif.cpp
+++ b/camera/common/1.0/default/Exif.cpp
@@ -983,15 +983,15 @@
     camera_metadata_ro_entry entry = metadata.find(ANDROID_LENS_FOCAL_LENGTH);
     if (entry.count) {
         focal_length = entry.data.f[0];
+
+        if (!setFocalLength(
+                        static_cast<uint32_t>(focal_length * kRationalPrecision),
+                        kRationalPrecision)) {
+            ALOGE("%s: setting focal length failed.", __FUNCTION__);
+            return false;
+        }
     } else {
-        ALOGE("%s: Cannot find focal length in metadata.", __FUNCTION__);
-        return false;
-    }
-    if (!setFocalLength(
-                    static_cast<uint32_t>(focal_length * kRationalPrecision),
-                    kRationalPrecision)) {
-        ALOGE("%s: setting focal length failed.", __FUNCTION__);
-        return false;
+        ALOGV("%s: Cannot find focal length in metadata.", __FUNCTION__);
     }
 
     if (metadata.exists(ANDROID_JPEG_GPS_COORDINATES)) {
diff --git a/camera/device/3.4/Android.bp b/camera/device/3.4/Android.bp
index 87acd25..2c649ba 100644
--- a/camera/device/3.4/Android.bp
+++ b/camera/device/3.4/Android.bp
@@ -25,7 +25,6 @@
         "HalStreamConfiguration",
         "PhysicalCameraMetadata",
         "PhysicalCameraSetting",
-        "RequestTemplate",
         "Stream",
         "StreamConfiguration",
     ],
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index 9a02ce8..6b05d4a 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -284,13 +284,6 @@
     const int32_t jpegMaxSize = mCfg.maxJpegBufSize;
     UPDATE(ANDROID_JPEG_MAX_SIZE, &jpegMaxSize, 1);
 
-    const uint8_t jpegQuality = 90;
-    UPDATE(ANDROID_JPEG_QUALITY, &jpegQuality, 1);
-    UPDATE(ANDROID_JPEG_THUMBNAIL_QUALITY, &jpegQuality, 1);
-
-    const int32_t jpegOrientation = 0;
-    UPDATE(ANDROID_JPEG_ORIENTATION, &jpegOrientation, 1);
-
     // android.lens
     const uint8_t focusDistanceCalibration =
             ANDROID_LENS_INFO_FOCUS_DISTANCE_CALIBRATION_UNCALIBRATED;
@@ -322,7 +315,6 @@
     // This means pipeline latency of X frame intervals. The maximum number is 4.
     const uint8_t requestPipelineMaxDepth = 4;
     UPDATE(ANDROID_REQUEST_PIPELINE_MAX_DEPTH, &requestPipelineMaxDepth, 1);
-    UPDATE(ANDROID_REQUEST_PIPELINE_DEPTH, &requestPipelineMaxDepth, 1);
 
     // Three numbers represent the maximum numbers of different types of output
     // streams simultaneously. The types are raw sensor, processed (but not
@@ -355,7 +347,6 @@
         ANDROID_SENSOR_TEST_PATTERN_MODE_OFF};
     UPDATE(ANDROID_SENSOR_AVAILABLE_TEST_PATTERN_MODES, testPatternModes,
            ARRAY_SIZE(testPatternModes));
-    UPDATE(ANDROID_SENSOR_TEST_PATTERN_MODE, &testPatternModes[0], 1);
 
     const uint8_t timestampSource = ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE_UNKNOWN;
     UPDATE(ANDROID_SENSOR_INFO_TIMESTAMP_SOURCE, &timestampSource, 1);
@@ -576,7 +567,6 @@
     std::vector<int32_t> streamConfigurations;
     std::vector<int64_t> minFrameDurations;
     std::vector<int64_t> stallDurations;
-    int64_t maxFrameDuration = 0;
     int32_t maxFps = std::numeric_limits<int32_t>::min();
     int32_t minFps = std::numeric_limits<int32_t>::max();
     std::set<int32_t> framerates;
@@ -604,9 +594,6 @@
             if (frameDuration < minFrameDuration) {
                 minFrameDuration = frameDuration;
             }
-            if (frameDuration > maxFrameDuration) {
-                maxFrameDuration = frameDuration;
-            }
             int32_t frameRateInt = static_cast<int32_t>(fr.getDouble());
             if (minFps > frameRateInt) {
                 minFps = frameRateInt;
@@ -639,14 +626,15 @@
     }
 
     std::vector<int32_t> fpsRanges;
-    // Variable range
-    fpsRanges.push_back(minFps);
-    fpsRanges.push_back(maxFps);
-    // Fixed ranges
+    // FPS ranges
     for (const auto& framerate : framerates) {
-        fpsRanges.push_back(framerate);
+        // Empirical: webcams often have close to 2x fps error and cannot support fixed fps range
+        fpsRanges.push_back(framerate / 2);
         fpsRanges.push_back(framerate);
     }
+    minFps /= 2;
+    int64_t maxFrameDuration = 1000000000LL / minFps;
+
     UPDATE(ANDROID_CONTROL_AE_AVAILABLE_TARGET_FPS_RANGES, fpsRanges.data(),
            fpsRanges.size());
 
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index 5569439..7015bcb 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -47,6 +47,9 @@
 const int kBadFramesAfterStreamOn = 1; // drop x frames after streamOn to get rid of some initial
                                        // bad frames. TODO: develop a better bad frame detection
                                        // method
+constexpr int MAX_RETRY = 15; // Allow retry some ioctl failures a few times to account for some
+                             // webcam showing temporarily ioctl failures.
+constexpr int IOCTL_RETRY_SLEEP_US = 33000; // 33ms * MAX_RETRY = 5 seconds
 
 bool tryLock(Mutex& mutex)
 {
@@ -1480,6 +1483,7 @@
 
     int jpegQuality, thumbQuality;
     Size thumbSize;
+    bool outputThumbnail = true;
 
     if (req->setting.exists(ANDROID_JPEG_QUALITY)) {
         camera_metadata_entry entry =
@@ -1505,6 +1509,9 @@
         thumbSize = Size { static_cast<uint32_t>(entry.data.i32[0]),
                            static_cast<uint32_t>(entry.data.i32[1])
         };
+        if (thumbSize.width == 0 && thumbSize.height == 0) {
+            outputThumbnail = false;
+        }
     } else {
         return lfail(
             "%s: ANDROID_JPEG_THUMBNAIL_SIZE not set", __FUNCTION__);
@@ -1532,14 +1539,16 @@
     /* Hold actual thumbnail and main image code sizes */
     size_t thumbCodeSize = 0, jpegCodeSize = 0;
     /* Temporary thumbnail code buffer */
-    std::vector<uint8_t> thumbCode(maxThumbCodeSize);
+    std::vector<uint8_t> thumbCode(outputThumbnail ? maxThumbCodeSize : 0);
 
     YCbCrLayout yu12Thumb;
-    ret = cropAndScaleThumbLocked(mYu12Frame, thumbSize, &yu12Thumb);
+    if (outputThumbnail) {
+        ret = cropAndScaleThumbLocked(mYu12Frame, thumbSize, &yu12Thumb);
 
-    if (ret != 0) {
-        return lfail(
-            "%s: crop and scale thumbnail failed!", __FUNCTION__);
+        if (ret != 0) {
+            return lfail(
+                "%s: crop and scale thumbnail failed!", __FUNCTION__);
+        }
     }
 
     /* Scale and crop main jpeg */
@@ -1550,12 +1559,14 @@
     }
 
     /* Encode the thumbnail image */
-    ret = encodeJpegYU12(thumbSize, yu12Thumb,
-            thumbQuality, 0, 0,
-            &thumbCode[0], maxThumbCodeSize, thumbCodeSize);
+    if (outputThumbnail) {
+        ret = encodeJpegYU12(thumbSize, yu12Thumb,
+                thumbQuality, 0, 0,
+                &thumbCode[0], maxThumbCodeSize, thumbCodeSize);
 
-    if (ret != 0) {
-        return lfail("%s: encodeJpegYU12 failed with %d",__FUNCTION__, ret);
+        if (ret != 0) {
+            return lfail("%s: thumbnail encodeJpegYU12 failed with %d",__FUNCTION__, ret);
+        }
     }
 
     /* Combine camera characteristics with request settings to form EXIF
@@ -1570,11 +1581,7 @@
 
     utils->setFromMetadata(meta, jpegSize.width, jpegSize.height);
 
-    /* Check if we made a non-zero-sized thumbnail. Currently not possible
-     * that we got this far and the code is size 0, but if this code moves
-     * around it might become relevant again */
-
-    ret = utils->generateApp1(thumbCodeSize ? &thumbCode[0] : 0, thumbCodeSize);
+    ret = utils->generateApp1(outputThumbnail ? &thumbCode[0] : 0, thumbCodeSize);
 
     if (!ret) {
         return lfail("%s: generating APP1 failed", __FUNCTION__);
@@ -2109,8 +2116,20 @@
     fmt.fmt.pix.pixelformat = v4l2Fmt.fourcc;
     ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_FMT, &fmt));
     if (ret < 0) {
-        ALOGE("%s: S_FMT ioctl failed: %s", __FUNCTION__, strerror(errno));
-        return -errno;
+        int numAttempt = 0;
+        while (ret < 0) {
+            ALOGW("%s: VIDIOC_S_FMT failed, wait 33ms and try again", __FUNCTION__);
+            usleep(IOCTL_RETRY_SLEEP_US); // sleep 100 ms and try again
+            ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_FMT, &fmt));
+            if (numAttempt == MAX_RETRY) {
+                break;
+            }
+            numAttempt++;
+        }
+        if (ret < 0) {
+            ALOGE("%s: S_FMT ioctl failed: %s", __FUNCTION__, strerror(errno));
+            return -errno;
+        }
     }
 
     if (v4l2Fmt.width != fmt.fmt.pix.width || v4l2Fmt.height != fmt.fmt.pix.height ||
@@ -2199,9 +2218,22 @@
 
     // VIDIOC_STREAMON: start streaming
     v4l2_buf_type capture_type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-    if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_STREAMON, &capture_type)) < 0) {
-        ALOGE("%s: VIDIOC_STREAMON failed: %s", __FUNCTION__, strerror(errno));
-        return -errno;
+    ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_STREAMON, &capture_type));
+    if (ret < 0) {
+        int numAttempt = 0;
+        while (ret < 0) {
+            ALOGW("%s: VIDIOC_STREAMON failed, wait 33ms and try again", __FUNCTION__);
+            usleep(IOCTL_RETRY_SLEEP_US); // sleep 100 ms and try again
+            ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_STREAMON, &capture_type));
+            if (numAttempt == MAX_RETRY) {
+                break;
+            }
+            numAttempt++;
+        }
+        if (ret < 0) {
+            ALOGE("%s: VIDIOC_STREAMON ioctl failed: %s", __FUNCTION__, strerror(errno));
+            return -errno;
+        }
     }
 
     // Swallow first few frames after streamOn to account for bad frames from some devices
@@ -2220,6 +2252,8 @@
         }
     }
 
+    ALOGI("%s: start V4L2 streaming %dx%d@%ffps",
+                __FUNCTION__, v4l2Fmt.width, v4l2Fmt.height, fps);
     mV4l2StreamingFmt = v4l2Fmt;
     mV4l2Streaming = true;
     return OK;
@@ -2388,6 +2422,7 @@
     uint32_t maxDim = 0;
     for (const auto& stream : config.streams) {
         float aspectRatio = ASPECT_RATIO(stream);
+        ALOGI("%s: request stream %dx%d", __FUNCTION__, stream.width, stream.height);
         if ((mCroppingType == VERTICAL && aspectRatio < desiredAr) ||
                 (mCroppingType == HORIZONTAL && aspectRatio > desiredAr)) {
             desiredAr = aspectRatio;
@@ -2572,6 +2607,9 @@
     const uint8_t nrMode = ANDROID_NOISE_REDUCTION_MODE_OFF;
     UPDATE(md, ANDROID_NOISE_REDUCTION_MODE, &nrMode, 1);
 
+    const int32_t testPatternModes = ANDROID_SENSOR_TEST_PATTERN_MODE_OFF;
+    UPDATE(md, ANDROID_SENSOR_TEST_PATTERN_MODE, &testPatternModes, 1);
+
     const uint8_t fdMode = ANDROID_STATISTICS_FACE_DETECT_MODE_OFF;
     UPDATE(md, ANDROID_STATISTICS_FACE_DETECT_MODE, &fdMode, 1);
 
@@ -2596,7 +2634,7 @@
         }
     }
     int32_t defaultFramerate = support30Fps ? 30 : maxFps;
-    int32_t defaultFpsRange[] = {defaultFramerate, defaultFramerate};
+    int32_t defaultFpsRange[] = {defaultFramerate / 2, defaultFramerate};
     UPDATE(md, ANDROID_CONTROL_AE_TARGET_FPS_RANGE, defaultFpsRange, ARRAY_SIZE(defaultFpsRange));
 
     uint8_t antibandingMode = ANDROID_CONTROL_AE_ANTIBANDING_MODE_AUTO;
@@ -2691,6 +2729,10 @@
     const uint8_t flashState = ANDROID_FLASH_STATE_UNAVAILABLE;
     UPDATE(md, ANDROID_FLASH_STATE, &flashState, 1);
 
+    // This means pipeline latency of X frame intervals. The maximum number is 4.
+    const uint8_t requestPipelineMaxDepth = 4;
+    UPDATE(md, ANDROID_REQUEST_PIPELINE_DEPTH, &requestPipelineMaxDepth, 1);
+
     // android.scaler
     const int32_t crop_region[] = {
           active_array_size.data.i32[0], active_array_size.data.i32[1],
diff --git a/camera/device/3.4/default/ExternalCameraUtils.cpp b/camera/device/3.4/default/ExternalCameraUtils.cpp
index d28a4dd..2e2f73b 100644
--- a/camera/device/3.4/default/ExternalCameraUtils.cpp
+++ b/camera/device/3.4/default/ExternalCameraUtils.cpp
@@ -283,9 +283,8 @@
         numVideoBuffers(kDefaultNumVideoBuffer),
         numStillBuffers(kDefaultNumStillBuffer) {
     fpsLimits.push_back({/*Size*/{ 640,  480}, /*FPS upper bound*/30.0});
-    fpsLimits.push_back({/*Size*/{1280,  720}, /*FPS upper bound*/15.0});
-    fpsLimits.push_back({/*Size*/{1920, 1080}, /*FPS upper bound*/10.0});
-    fpsLimits.push_back({/*Size*/{4096, 3072}, /*FPS upper bound*/5.0});
+    fpsLimits.push_back({/*Size*/{1280,  720}, /*FPS upper bound*/7.5});
+    fpsLimits.push_back({/*Size*/{1920, 1080}, /*FPS upper bound*/5.0});
 }
 
 
diff --git a/camera/metadata/3.3/types.hal b/camera/metadata/3.3/types.hal
index ba9eead..4f3f678 100644
--- a/camera/metadata/3.3/types.hal
+++ b/camera/metadata/3.3/types.hal
@@ -74,6 +74,17 @@
      */
     ANDROID_LENS_POSE_REFERENCE = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_LENS_END,
 
+    /** android.lens.distortion [dynamic, float[], public]
+     *
+     * <p>The correction coefficients to correct for this camera device's
+     * radial and tangential lens distortion.</p>
+     * <p>Replaces the deprecated ANDROID_LENS_RADIAL_DISTORTION field, which was
+     * inconsistently defined.</p>
+     *
+     * @see ANDROID_LENS_RADIAL_DISTORTION
+     */
+    ANDROID_LENS_DISTORTION,
+
     ANDROID_LENS_END_3_3,
 
     /** android.request.availableSessionKeys [static, int32[], ndk_public]
diff --git a/camera/provider/2.4/ICameraProvider.hal b/camera/provider/2.4/ICameraProvider.hal
index abb6366..8773bc0 100644
--- a/camera/provider/2.4/ICameraProvider.hal
+++ b/camera/provider/2.4/ICameraProvider.hal
@@ -35,7 +35,8 @@
  * where
  *   - <major>/<minor> is the provider HAL HIDL version,
  *   - <type> is the type of devices this provider knows about, such as
- *     "internal", "legacy", "external", or "remote"
+ *     "internal", "legacy", "external", "remote" etc. The camera framework
+ *     must not differentiate or chage its behavior based on the specific type.
  *   - <instance> is a non-negative integer starting from 0 to disambiguate
  *     between multiple HALs of the same type.
  *
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index dd8d92d..497071d 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -182,7 +182,6 @@
         <interface>
             <name>IKeymasterDevice</name>
             <instance>default</instance>
-	    <!-- TODO: strongbox here? -->
         </interface>
     </hal>
     <hal format="hidl" optional="true">
@@ -214,6 +213,15 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.neuralnetworks</name>
+        <version>1.0</version>
+        <interface>
+            <name>IDevice</name>
+            <!-- TODO(b/73738616): This should be * (match any) -->
+            <instance>hvx</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.nfc</name>
         <version>1.0</version>
         <interface>
@@ -275,7 +283,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.soundtrigger</name>
-        <version>2.0</version>
+        <version>2.0-1</version>
         <interface>
             <name>ISoundTriggerHw</name>
             <instance>default</instance>
@@ -330,8 +338,16 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.usb.gadget</name>
+        <version>1.0</version>
+        <interface>
+            <name>IUsbGadget</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.vibrator</name>
-        <version>1.0-1</version>
+        <version>1.0-2</version>
         <interface>
             <name>IVibrator</name>
             <instance>default</instance>
@@ -355,13 +371,21 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.wifi</name>
-        <version>1.0-1</version>
+        <version>1.0-2</version>
         <interface>
             <name>IWifi</name>
             <instance>default</instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.wifi.hostapd</name>
+        <version>1.0</version>
+        <interface>
+            <name>IHostapd</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.wifi.offload</name>
         <version>1.0</version>
         <interface>
@@ -371,7 +395,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.wifi.supplicant</name>
-        <version>1.0</version>
+        <version>1.0-1</version>
         <interface>
             <name>ISupplicant</name>
             <instance>default</instance>
diff --git a/confirmationui/1.0/default/ConfirmationUI.cpp b/confirmationui/1.0/default/ConfirmationUI.cpp
index f241a76..41e03ce 100644
--- a/confirmationui/1.0/default/ConfirmationUI.cpp
+++ b/confirmationui/1.0/default/ConfirmationUI.cpp
@@ -43,7 +43,12 @@
     const hidl_vec<uint8_t>& extraData, const hidl_string& locale,
     const hidl_vec<UIOption>& uiOptions) {
     auto& operation = MyOperation::get();
-    return operation.init(resultCB, promptText, extraData, locale, uiOptions);
+    auto result = operation.init(resultCB, promptText, extraData, locale, uiOptions);
+    if (result == ResponseCode::OK) {
+        // This is where implementation start the UI and then call setPending on success.
+        operation.setPending();
+    }
+    return result;
 }
 
 Return<ResponseCode> ConfirmationUI::deliverSecureInputEvent(
diff --git a/confirmationui/1.0/default/PlatformSpecifics.h b/confirmationui/1.0/default/PlatformSpecifics.h
index 18b88c8..488da6d 100644
--- a/confirmationui/1.0/default/PlatformSpecifics.h
+++ b/confirmationui/1.0/default/PlatformSpecifics.h
@@ -52,8 +52,14 @@
         const uint8_t key[32], std::initializer_list<support::ByteBufferProxy> buffers);
 };
 
-using MyOperation = generic::Operation<sp<IConfirmationResultCallback>, MonotonicClockTimeStamper,
-                                       HMacImplementation>;
+class MyOperation : public generic::Operation<sp<IConfirmationResultCallback>,
+                                              MonotonicClockTimeStamper, HMacImplementation> {
+   public:
+    static MyOperation& get() {
+        static MyOperation op;
+        return op;
+    }
+};
 
 }  // namespace implementation
 }  // namespace V1_0
diff --git a/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc b/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
index a278028..c04e55e 100644
--- a/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
+++ b/confirmationui/1.0/default/android.hardware.confirmationui@1.0-service.rc
@@ -1,4 +1,4 @@
 service vendor.confirmationui-1-0 /vendor/bin/hw/android.hardware.confirmationui@1.0-service
     class hal
-    user system
-    group system drmrpc
+    user nobody
+    group drmrpc
diff --git a/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h b/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
index a88cd40..b480942 100644
--- a/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
+++ b/confirmationui/support/include/android/hardware/confirmationui/1.0/generic/GenericOperation.h
@@ -55,10 +55,27 @@
         (void)uiOptions;
         resultCB_ = resultCB;
         if (error_ != ResponseCode::Ignored) return ResponseCode::OperationPending;
-        // TODO make copy of promptText before using it may reside in shared buffer
-        auto state = write(
-            WriteState(formattedMessageBuffer_),
-            map(pair(text("prompt"), text(promptText)), pair(text("extra"), bytes(extraData))));
+
+        // We need to access the prompt text multiple times. Once for formatting the CBOR message
+        // and again for rendering the dialog. It is vital that the prompt does not change
+        // in the meantime. As of this point the prompt text is in a shared buffer and therefore
+        // susceptible to TOCTOU attacks. Note that promptText.size() resides on the stack and
+        // is safe to access multiple times. So now we copy the prompt string into the
+        // scratchpad promptStringBuffer_ from where we can format the CBOR message and then
+        // pass it to the renderer.
+        if (promptText.size() >= uint32_t(MessageSize::MAX))
+            return ResponseCode::UIErrorMessageTooLong;
+        auto pos = std::copy(promptText.c_str(), promptText.c_str() + promptText.size(),
+                             promptStringBuffer_);
+        *pos = 0;  // null-terminate the prompt for the renderer.
+
+        // Note the extra data is accessed only once for formating the CBOR message. So it is safe
+        // to read it from the shared buffer directly. Anyway we don't trust or interpret the
+        // extra data in any way so all we do is take a snapshot and we don't care if it is
+        // modified concurrently.
+        auto state = write(WriteState(formattedMessageBuffer_),
+                           map(pair(text("prompt"), text(promptStringBuffer_, promptText.size())),
+                               pair(text("extra"), bytes(extraData))));
         switch (state.error_) {
             case Error::OK:
                 break;
@@ -71,20 +88,20 @@
                 return ResponseCode::Unexpected;
         }
         formattedMessageLength_ = state.data_ - formattedMessageBuffer_;
-        // setup TUI and diagnose more UI errors here.
+
         // on success record the start time
         startTime_ = TimeStamper::now();
         if (!startTime_.isOk()) {
             return ResponseCode::SystemError;
         }
-        error_ = ResponseCode::OK;
         return ResponseCode::OK;
     }
 
+    void setPending() { error_ = ResponseCode::OK; }
+
     void setHmacKey(const uint8_t (&key)[32]) { hmacKey_ = {key}; }
 
     void abort() {
-        // tear down TUI here
         if (isPending()) {
             resultCB_->result(ResponseCode::Aborted, {}, {});
             error_ = ResponseCode::Ignored;
@@ -92,7 +109,6 @@
     }
 
     void userCancel() {
-        // tear down TUI here
         if (isPending()) error_ = ResponseCode::Canceled;
     }
 
@@ -104,10 +120,10 @@
     }
 
     bool isPending() const { return error_ != ResponseCode::Ignored; }
-
-    static Operation& get() {
-        static Operation operation;
-        return operation;
+    const hidl_string getPrompt() const {
+        hidl_string s;
+        s.setToExternal(promptStringBuffer_, strlen(promptStringBuffer_));
+        return s;
     }
 
     ResponseCode deliverSecureInputEvent(const HardwareAuthToken& secureInputToken) {
@@ -156,7 +172,6 @@
         return result;
     }
     hidl_vec<uint8_t> userConfirm(const uint8_t key[32]) {
-        // tear down TUI here
         if (error_ != ResponseCode::OK) return {};
         confirmationTokenScratchpad_ = HMacer::hmac256(key, "confirmation token", getMessage());
         if (!confirmationTokenScratchpad_.isOk()) {
@@ -169,9 +184,10 @@
         return result;
     }
 
-    ResponseCode error_;
+    ResponseCode error_ = ResponseCode::Ignored;
     uint8_t formattedMessageBuffer_[uint32_t(MessageSize::MAX)];
-    size_t formattedMessageLength_;
+    char promptStringBuffer_[uint32_t(MessageSize::MAX)];
+    size_t formattedMessageLength_ = 0;
     NullOr<array<uint8_t, 32>> confirmationTokenScratchpad_;
     Callback resultCB_;
     typename TimeStamper::TimeStamp startTime_;
diff --git a/current.txt b/current.txt
index 24321cc..48b3877 100644
--- a/current.txt
+++ b/current.txt
@@ -251,10 +251,122 @@
 
 # ABI preserving changes to HALs during Android P
 cf72ff5a52bfa4d08e9e1000cf3ab5952a2d280c7f13cdad5ab7905c08050766 android.hardware.camera.metadata@3.2::types
-7b4723305354193b889a24153e1292fec62d5a5127bdfba08a5a27440f092de9 android.hardware.camera.provider@2.4::ICameraProvider
+3902efc42097cba55f0655aa389e052ea70164e99ced1a6d1ef53dafc13f7650 android.hardware.camera.provider@2.4::ICameraProvider
 6fa9804a17a8bb7923a56bd10493a5483c20007e4c9026fd04287bee7c945a8c android.hardware.gnss@1.0::IGnssCallback
 fb92e2b40f8e9d494e8fd3b4ac18499a3216342e7cff160714c3bbf3660b6e79 android.hardware.gnss@1.0::IGnssConfiguration
 251594ea9b27447bfa005ebd806e58fb0ae4aad84a69938129c9800ec0c64eda android.hardware.gnss@1.0::IGnssMeasurementCallback
 4e7169919d24fbe5573e5bcd683d0bd7abf553a4e6c34c41f9dfc1e12050db07 android.hardware.gnss@1.0::IGnssNavigationMessageCallback
 d4840db8efabdf1e4b344fc981cd36e5fe81a39aff6e199f6d06c1c8da413efd android.hardware.radio@1.0::types
 b280c4704dfcc548a9bf127b59b7c3578f460c50cce70a06b66fe0df8b27cff0 android.hardware.wifi@1.0::types
+
+# HALs released in Android P
+5860cf040a3d5d771967ecf648b00d06876a7120da985ee2b3e95d01f634dd20 android.hardware.audio@4.0::IDevice
+cf82a0249e918fdc657e189895e92d60af0491868477e82cdc30f6cab0ca2c65 android.hardware.audio@4.0::IDevicesFactory
+be3dc9baed45a0d330152eca3ca24fa419b375b20a41644c88d4fb46b72784d2 android.hardware.audio@4.0::IPrimaryDevice
+3e3acb70c4e6c7d578f511f4a44ee764ab9126f887a3bf65d523c42e40012bf6 android.hardware.audio@4.0::IStream
+d5de64e66b95f135dd42492250a309134b8227203ef3524440798c66b6f5a392 android.hardware.audio@4.0::IStreamIn
+888ac906461327fa0bd93854d5109be8c292a33afdb467164826970a8bd5b789 android.hardware.audio@4.0::IStreamOut
+15f6ae78e73344c8e7d68847ef03caec64fcd9f951bbcf59957d1712c247fcff android.hardware.audio@4.0::IStreamOutCallback
+e8abfc73b7f3c2095ea4fad83b5f42bced4315de2abcc3199376af880dac451b android.hardware.audio@4.0::types
+5d47a2ad2c136b8aba067dd45bb10d0ad390dd76340764154f580658f98f4fe6 android.hardware.audio.common@4.0::types
+b04b6b364938b80008e61fa2e318bc299622433e57c2e1f6cfba332a3f6e3f15 android.hardware.audio.effect@4.0::IAcousticEchoCancelerEffect
+1c17d4ece5c8ba3f7a646a305ee0dd109b0d51372e1bd585812e513cd40e1852 android.hardware.audio.effect@4.0::IAutomaticGainControlEffect
+34174259fe6fbb1bb14e7103e097f2f25529271a676687845b2f55d6d0d9d617 android.hardware.audio.effect@4.0::IBassBoostEffect
+7a18e9bd0163f3784448f6e24be0db75f877e2f0f9bd0d7ec427f1c34b382c0b android.hardware.audio.effect@4.0::IDownmixEffect
+bac81bffbe2661d5b6839087d2dd3a27eded66e60c6c76d35c68d54014cd5c06 android.hardware.audio.effect@4.0::IEffect
+65f0bcf9e498b26f3266ad10cf513a6c2b5906cc49f9db4bc5c7d3ba11a72e05 android.hardware.audio.effect@4.0::IEffectBufferProviderCallback
+5a746e81175489eb2371b88864c36c9bb63bc64ef799fae74cd96003b013c0d1 android.hardware.audio.effect@4.0::IEffectsFactory
+839980c7c5be79da6b95fdb9354a62b04407b4b084749b7a21d2c340773d7638 android.hardware.audio.effect@4.0::IEnvironmentalReverbEffect
+2805fbdac7cff050a1c095b9276bb41ac02a3b7b354336817487eb9a4b6bb462 android.hardware.audio.effect@4.0::IEqualizerEffect
+a91b547f5922f39fe4231d97fac1c3825c1c1b0c8ef7a5136689ceed37e8bfe9 android.hardware.audio.effect@4.0::ILoudnessEnhancerEffect
+1145f5b921ddec184fda5bdc87487b46f2a89cd9f42cc882bbb3a54f4ac80466 android.hardware.audio.effect@4.0::INoiseSuppressionEffect
+3661fa0623056922fdc4235ac5a9c91a2d066ab6f1ab4297e3b240fe302ba500 android.hardware.audio.effect@4.0::IPresetReverbEffect
+e88e520f8c98a62fccd8d5316c6687808f775de145d1405a7a9a66587ee6a001 android.hardware.audio.effect@4.0::IVirtualizerEffect
+fe28829dab10d171783b79ac9cc45412739f8ff275e90228d7c6370ef189b859 android.hardware.audio.effect@4.0::IVisualizerEffect
+5d92f6fd58d40c56611bb12f03be6af9bcf2bb73dfb35b77a99bbf2c3ea5439b android.hardware.audio.effect@4.0::types
+42a06dc288f61b0690580f3d37b30b663c31d74d50bb58d0772386b550d5faab android.hardware.authsecret@1.0::IAuthSecret
+a0f93c768c353cecee6237fe479bce47404eb10b629fafe07e32a054fd67f2af android.hardware.automotive.audiocontrol@1.0::IAudioControl
+ca515ff4b63c80cf5ad7b3395c997c57d6c56157361f6c367d1c96f23cc4860a android.hardware.automotive.audiocontrol@1.0::types
+f2904a4c108ad1b93eb2fa4e43b82bd01ce1ff26156316e49d1d9fc80dfecaad android.hardware.automotive.evs@1.0::IEvsCamera
+94cba6ad04c83aa840de2ed52b74ba2126a26dd960225e61ac36703315279a80 android.hardware.automotive.evs@1.0::IEvsCameraStream
+5ea36fb043d9e3b413219de3dfd7b046b48af4fda39f167f3528652e986cb76d android.hardware.automotive.evs@1.0::IEvsDisplay
+14ef8e993a4a7c899b19bb5e39b5b0cafd28312ea2b127e35b3be8f08e23fe8e android.hardware.automotive.evs@1.0::IEvsEnumerator
+3b17c1fdfc389e0abe626c37054954b07201127d890c2bc05d47613ec1f4de4f android.hardware.automotive.evs@1.0::types
+b3caf524c46a47d67e6453a34419e1881942d059e146cda740502670e9a752c3 android.hardware.automotive.vehicle@2.0::IVehicle
+80fb4156fa91ce86e49bd2cabe215078f6b69591d416a09e914532eae6712052 android.hardware.automotive.vehicle@2.0::IVehicleCallback
+442de3a3d3819ff8b8bfe9ec710592ca8af7c16bfdb5eb8911b898b8f12b2bb0 android.hardware.automotive.vehicle@2.0::types
+32cc50cc2a7658ec613c0c2dd2accbf6a05113b749852879e818b8b7b438db19 android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioHost
+ff4be64d7992f8bec97dff37f35450e79b3430c61f85f54322ce45bef229dc3b android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioOffload
+27f22d2e873e6201f9620cf4d8e2facb25bd0dd30a2b911e441b4600d560fa62 android.hardware.bluetooth.a2dp@1.0::types
+3d8ed67d807e9f15d0708390a416bee00920f6a22196c104cc9e443c8d217df8 android.hardware.broadcastradio@2.0::IAnnouncementListener
+44017c42e6f4d8cb30f07eb1da04540a98736a336ac28c7e0ed2e69e1589f8d1 android.hardware.broadcastradio@2.0::IBroadcastRadio
+e5f4960290b4f3089163dd43251e1a032c81e9bdb796e75a87fc7c5810c262b3 android.hardware.broadcastradio@2.0::ICloseHandle
+7357516e8f4585e211b9b6f271af6fb82d6e9cc208df01851e63118404621e6d android.hardware.broadcastradio@2.0::ITunerCallback
+eacf4e7491fc52c4db90898faddf25ec7bc72501b07ae8737434c47cb845128c android.hardware.broadcastradio@2.0::ITunerSession
+34fe4601072aa5051eb8e41d776a9f6d43f716687de3f5c0031a12e7912ff3d6 android.hardware.broadcastradio@2.0::types
+4fb0725c36ed4f77a42b42e3f18d8b5f7919cb62b90098b23143a555aa7dd96d android.hardware.camera.device@3.4::ICameraDeviceCallback
+812fa66aa10ba0cba27cfddc2fd7f0ee27a8ab65a1f15aa79fdad97d403e6a14 android.hardware.camera.device@3.4::ICameraDeviceSession
+cc288f1f78d1e643eb3d3dbc16e1401d44033d8e6856761f5156814a29986ec7 android.hardware.camera.device@3.4::types
+26462f5a29bef30485f9264115e79e5f5eb6234951dfeb47424709a1b8936030 android.hardware.camera.metadata@3.3::types
+1a46aeae45b7a0e47f79b7207300532986f9d9cd7060779afc7a529f54d712ab android.hardware.confirmationui@1.0::IConfirmationResultCallback
+6d8347ff3cd7de471065ac3e8e68385073630cdeebe9f8fa58cb91cf44436c95 android.hardware.confirmationui@1.0::IConfirmationUI
+a3ff916784dce87a56c757ab5c86433f0cdf562280999a5f978a6e8a0f3f19e7 android.hardware.confirmationui@1.0::types
+1fbf2d7e383632216aaaa1d972a21a618f55659263d2e6f0b309e3cb323b4b63 android.hardware.drm@1.1::ICryptoFactory
+7877ff8e4c1e48b825e6e5e66d050288e5656ed535c61cc7830a92ed4a9e1990 android.hardware.drm@1.1::IDrmFactory
+fef2f0ebde7704548fb203df46673ceb342272fc4fa9d0af25a980d2584a36e7 android.hardware.drm@1.1::IDrmPlugin
+5047a346ecce239404b9020959f60dd467318e9c17b290a6386bc3894df62c3c android.hardware.drm@1.1::types
+be794f5df97f134d6dcabb866b250d1305100e7ae07fb253b7841df890b931bb android.hardware.gnss@1.1::IGnss
+3b912f07e276de598155615491b35f151f59cb2d7a100c831f04a23f4d625311 android.hardware.gnss@1.1::IGnssCallback
+3c5183d7506010be57e0f748e3640fc2ded1ba955784b6256ba427f4c399591c android.hardware.gnss@1.1::IGnssConfiguration
+b054af24fbb70d54cde1fb5cba126809e7c4e863e8f9115dc492321dfbcbc993 android.hardware.gnss@1.1::IGnssMeasurement
+83e7a10ff3702147bd7ffa04567b20d407a3b16bbb7705644af44d919afe9103 android.hardware.gnss@1.1::IGnssMeasurementCallback
+82da7e7624f72ff1927f48738913e20bee3a513adfe5dc7c4f888176e20376e6 android.hardware.graphics.common@1.1::types
+d9b40a5b09962a5a0780b10fe33a4e607e69e2e088fc83de88a584115b7cb1c0 android.hardware.graphics.composer@2.2::IComposer
+d6ce042995239712bc1d0970fa9d512c15c0b1ac9bcb048bd8b69f617b45c25e android.hardware.graphics.composer@2.2::IComposerClient
+dd83be076b6b3f10ed62ab34d8c8b95f2415961fb785200eb842e7bfb2b0ee92 android.hardware.graphics.mapper@2.1::IMapper
+675682dd3007805c985eaaec91612abc88f4c25b3431fb84070b7584a1a741fb android.hardware.health@2.0::IHealth
+434c4c32c00b0e54bb05e40c79503208b40f786a318029a2a4f66e34f10f2a76 android.hardware.health@2.0::IHealthInfoCallback
+c9e498f1ade5e26f00d290b4763a9671ec6720f915e7d592844b62e8cb1f9b5c android.hardware.health@2.0::types
+a6cf986593c6ad15fe2ae3a1995d2cae233500bc32c055912a42723bdc076868 android.hardware.keymaster@4.0::IKeymasterDevice
+3ce01f7a38013f15d2ffc9c66a81eb85061ab6585fb1e659fe6da36bdcbfa9cf android.hardware.keymaster@4.0::types
+6d5c646a83538f0f9d8438c259932509f4353410c6c76e56db0d6ca98b69c3bb android.hardware.media.bufferpool@1.0::IAccessor
+b8c7ed58aa8740361e63d0ce9e7c94227572a629f356958840b34809d2393a7c android.hardware.media.bufferpool@1.0::IClientManager
+4a2c0dc82780e6c90731725a103feab8ab6ecf85a64e049b9cbd2b2c61620fe1 android.hardware.media.bufferpool@1.0::IConnection
+6aef1218e5949f867b0104752ac536c1b707222a403341720de90141df129e3e android.hardware.media.bufferpool@1.0::types
+1529409ed76ae87facab152b770495e9e62544fcc5215daabf146c28d588bab9 android.hardware.neuralnetworks@1.1::IDevice
+e808a6f61cd7b47887c599d8843e67a2dcbf4ec5aadd5d22fdce93020070ef1b android.hardware.neuralnetworks@1.1::types
+8d3d86da0bfa4bf070970d8303c659f67f35d670c287d45a3f542e4fedadd578 android.hardware.nfc@1.1::INfc
+e85f566698d2a2c28100e264fcf2c691a066756ddf8dd341d009ff50cfe10614 android.hardware.nfc@1.1::INfcClientCallback
+2b8f6165b3d350485eb89eb6e931cf876688cde9155f7b31a8d8fe7abdfe5b95 android.hardware.nfc@1.1::types
+163e115e833fc1d77cdd4a8cf0c833bb8b8d74fe35c880fe693101d17774926f android.hardware.power@1.2::IPower
+7899b9305587b2d5cd74a3cc87e9090f58bf4ae74256ce3ee36e7ec011822840 android.hardware.power@1.2::types
+ab132c990a62f0aca35871c092c22fb9c85d478e22124ef6a4d0a2302da76a9f android.hardware.radio@1.2::IRadio
+cda752aeabaabc20486a82ac57a3dd107785c006094a349bc5e224e8aa22a17c android.hardware.radio@1.2::IRadioIndication
+c38b7e1f808565a535ff19fd4c1b512b22dfa0b58ec91dce03f72a8f1eaf6957 android.hardware.radio@1.2::IRadioResponse
+b65332996eb39ba63300a1011404141fa59ce5c252bc17afae637be6eeca5f55 android.hardware.radio@1.2::ISap
+508ace7d4023b865b8b77c3ca3c86cc9525ef3803dc9c6b461b7c1f91b0fec00 android.hardware.radio@1.2::types
+87385469cf4409f0f33b01508e7a477cf71f2a11e466dd7e3ab5971a1baaa72b android.hardware.radio.config@1.0::IRadioConfig
+228b2ee3c8c276c9f0afad2dc313ca3d6bbd9e482ddf313c7204c60ad9b636ab android.hardware.radio.config@1.0::IRadioConfigIndication
+a2e9b7aa09f79426f765838174e04b6f9a3e6c8b76b923fc1705632207bad44b android.hardware.radio.config@1.0::IRadioConfigResponse
+4307696b64ded9bd8de06887f9dfc533e875c4e0d83b8008df4d705164bde0b1 android.hardware.radio.config@1.0::types
+bd7699f07ba5392310fefd33ea964e01f4f4a66015146845c85055004823cc81 android.hardware.secure_element@1.0::ISecureElement
+a65aa82bbe48d81a9ae9e86247bb1b89fd2d3138d4053d7a5b716c71149b7dee android.hardware.secure_element@1.0::ISecureElementHalCallback
+2984c069f48ba35cd1bf49b0e17daad0d418fef52cb7a4a84dba0043114063d4 android.hardware.secure_element@1.0::types
+b4f507b4dc9b5cd5f0e4445926acb7d94525ae60dc307b3951142283632207b6 android.hardware.soundtrigger@2.1::ISoundTriggerHw
+92c2cc0f06ef744c5bda21f1d660258f7937203109b493eee22c3f3e2dbb0d3e android.hardware.soundtrigger@2.1::ISoundTriggerHwCallback
+8ddfa7542772cc7bca19972b2d856264efa31914bfd098aeb7c2079d950194cb android.hardware.usb.gadget@1.0::IUsbGadget
+ad0a620cda08f01b151c30cb7afa23b0637cc84340cf8dec00ac8e32cf54a8db android.hardware.usb.gadget@1.0::IUsbGadgetCallback
+51fc20f223561ac3a32ace3217837ef3860265bd91c8b7ae3859532caef9bc39 android.hardware.usb.gadget@1.0::types
+1bfc9fd9536ed09f04bcaf222a332bc919f1565d4d08bddccdebe1bfca8f01b5 android.hardware.vibrator@1.2::IVibrator
+a0aefa29881235c21e4761d15c55edc35ef85c2e0d9e01d0966176d1dbf5f811 android.hardware.vibrator@1.2::types
+8bc75a0dfac15c6f87ffec950b76c7d7de30d516b54e8e0b1f3c0ff9c7c6873b android.hardware.wifi@1.2::IWifi
+780c16fdeda13b779d993953a67f7ca578c938a172a9424c1c715ae81bc40fd7 android.hardware.wifi@1.2::IWifiChip
+167af870fdb87e1cbbaa0fa62ef35e1031caad20dd1ba695983dedb1e9993486 android.hardware.wifi@1.2::IWifiChipEventCallback
+8c7ef32fc78d5ec6e6956de3784cc2c6f42614b5272d2e461f6d60534ba38ec2 android.hardware.wifi@1.2::IWifiNanIface
+1e6074efad9da333803fb7c1acdb719d51c30b2e1e92087b0420341631c30b60 android.hardware.wifi@1.2::IWifiNanIfaceEventCallback
+a9d733eb0d555f2a6cb79a212810e81b56ecba0e31a8ffe0916de086a29e4f88 android.hardware.wifi@1.2::IWifiStaIface
+6db2e7d274be2dca9bf3087afd1f774a68c99d2b4dc7eeaf41690e5cebcbef7a android.hardware.wifi@1.2::types
+ee08280de21cb41e3ec26d6ed636c701b7f70516e71fb22f4fe60a13e603f406 android.hardware.wifi.hostapd@1.0::IHostapd
+b2479cd7a417a1cf4f3a22db4e4579e21bac38fdcaf381e2bf10176d05397e01 android.hardware.wifi.hostapd@1.0::types
+e362203b941f18bd4cba29a62adfa02453ed00d6be5b72cdb6c4d7e0bf394a40 android.hardware.wifi.supplicant@1.1::ISupplicant
+10ff2fae516346b86121368ce5790d5accdfcb73983246b813f3d488b66db45a android.hardware.wifi.supplicant@1.1::ISupplicantStaNetwork
diff --git a/drm/1.1/Android.bp b/drm/1.1/Android.bp
index ed8196e..dba3e42 100644
--- a/drm/1.1/Android.bp
+++ b/drm/1.1/Android.bp
@@ -17,8 +17,10 @@
         "android.hidl.base@1.0",
     ],
     types: [
+        "DrmMetricGroup",
         "HdcpLevel",
         "KeyRequestType",
+        "SecureStopRelease",
         "SecurityLevel",
     ],
     gen_java: false,
diff --git a/gnss/1.1/default/Android.bp b/gnss/1.1/default/Android.bp
index 977a22f..44aed2b 100644
--- a/gnss/1.1/default/Android.bp
+++ b/gnss/1.1/default/Android.bp
@@ -5,6 +5,7 @@
     vendor: true,
     srcs: [
         "Gnss.cpp",
+        "GnssDebug.cpp",
         "GnssConfiguration.cpp",
         "GnssMeasurement.cpp",
         "service.cpp",
diff --git a/gnss/1.1/default/Gnss.cpp b/gnss/1.1/default/Gnss.cpp
index 98a79ee..bbc4940 100644
--- a/gnss/1.1/default/Gnss.cpp
+++ b/gnss/1.1/default/Gnss.cpp
@@ -1,9 +1,11 @@
 #define LOG_TAG "Gnss"
 
+#include <android/hardware/gnss/1.0/types.h>
 #include <log/log.h>
 
 #include "Gnss.h"
-#include "GnssConfiguration.h"
+#include "GnssConstants.h"
+#include "GnssDebug.h"
 #include "GnssMeasurement.h"
 
 namespace android {
@@ -12,10 +14,12 @@
 namespace V1_1 {
 namespace implementation {
 
+using GnssSvFlags = IGnssCallback::GnssSvFlags;
+
 const uint32_t MIN_INTERVAL_MILLIS = 100;
 sp<::android::hardware::gnss::V1_1::IGnssCallback> Gnss::sGnssCallback = nullptr;
 
-Gnss::Gnss() : mMinIntervalMs(1000) {}
+Gnss::Gnss() : mMinIntervalMs(1000), mGnssConfiguration{new GnssConfiguration()} {}
 
 Gnss::~Gnss() {
     stop();
@@ -36,7 +40,10 @@
     mIsActive = true;
     mThread = std::thread([this]() {
         while (mIsActive == true) {
-            V1_0::GnssLocation location = this->getMockLocation();
+            auto svStatus = this->getMockSvStatus();
+            this->reportSvStatus(svStatus);
+
+            auto location = this->getMockLocation();
             this->reportLocation(location);
 
             std::this_thread::sleep_for(std::chrono::milliseconds(mMinIntervalMs));
@@ -70,7 +77,6 @@
 }
 
 Return<void> Gnss::deleteAidingData(::android::hardware::gnss::V1_0::IGnss::GnssAidingData) {
-    // TODO implement
     return Void();
 }
 
@@ -124,8 +130,7 @@
 }
 
 Return<sp<::android::hardware::gnss::V1_0::IGnssDebug>> Gnss::getExtensionGnssDebug() {
-    // TODO implement
-    return ::android::sp<::android::hardware::gnss::V1_0::IGnssDebug>{};
+    return new GnssDebug();
 }
 
 Return<sp<::android::hardware::gnss::V1_0::IGnssBatching>> Gnss::getExtensionGnssBatching() {
@@ -175,8 +180,7 @@
 
 Return<sp<::android::hardware::gnss::V1_1::IGnssConfiguration>>
 Gnss::getExtensionGnssConfiguration_1_1() {
-    // TODO implement
-    return new GnssConfiguration();
+    return mGnssConfiguration;
 }
 
 Return<sp<::android::hardware::gnss::V1_1::IGnssMeasurement>>
@@ -185,27 +189,66 @@
     return new GnssMeasurement();
 }
 
-Return<bool> Gnss::injectBestLocation(const ::android::hardware::gnss::V1_0::GnssLocation&) {
-    // TODO implement
-    return bool{};
+Return<bool> Gnss::injectBestLocation(const GnssLocation&) {
+    return true;
 }
 
-Return<V1_0::GnssLocation> Gnss::getMockLocation() {
-    V1_0::GnssLocation location = {.gnssLocationFlags = 0xFF,
-                                   .latitudeDegrees = 37.4219999,
-                                   .longitudeDegrees = -122.0840575,
-                                   .altitudeMeters = 1.60062531,
-                                   .speedMetersPerSec = 0,
-                                   .bearingDegrees = 0,
-                                   .horizontalAccuracyMeters = 5,
-                                   .verticalAccuracyMeters = 5,
-                                   .speedAccuracyMetersPerSecond = 1,
-                                   .bearingAccuracyDegrees = 90,
-                                   .timestamp = 1519930775453L};
+Return<GnssLocation> Gnss::getMockLocation() const {
+    GnssLocation location = {.gnssLocationFlags = 0xFF,
+                             .latitudeDegrees = kMockLatitudeDegrees,
+                             .longitudeDegrees = kMockLongitudeDegrees,
+                             .altitudeMeters = kMockAltitudeMeters,
+                             .speedMetersPerSec = kMockSpeedMetersPerSec,
+                             .bearingDegrees = kMockBearingDegrees,
+                             .horizontalAccuracyMeters = kMockHorizontalAccuracyMeters,
+                             .verticalAccuracyMeters = kMockVerticalAccuracyMeters,
+                             .speedAccuracyMetersPerSecond = kMockSpeedAccuracyMetersPerSecond,
+                             .bearingAccuracyDegrees = kMockBearingAccuracyDegrees,
+                             .timestamp = kMockTimestamp};
     return location;
 }
 
-Return<void> Gnss::reportLocation(const V1_0::GnssLocation& location) {
+Return<GnssSvInfo> Gnss::getSvInfo(int16_t svid, GnssConstellationType type, float cN0DbHz,
+                                   float elevationDegrees, float azimuthDegrees) const {
+    GnssSvInfo svInfo = {.svid = svid,
+                         .constellation = type,
+                         .cN0Dbhz = cN0DbHz,
+                         .elevationDegrees = elevationDegrees,
+                         .azimuthDegrees = azimuthDegrees,
+                         .svFlag = GnssSvFlags::USED_IN_FIX | GnssSvFlags::HAS_EPHEMERIS_DATA |
+                                   GnssSvFlags::HAS_ALMANAC_DATA};
+    return svInfo;
+}
+
+Return<GnssSvStatus> Gnss::getMockSvStatus() const {
+    std::unique_lock<std::recursive_mutex> lock(mGnssConfiguration->getMutex());
+    GnssSvInfo mockGnssSvInfoList[] = {
+        getSvInfo(3, GnssConstellationType::GPS, 32.5, 59.1, 166.5),
+        getSvInfo(5, GnssConstellationType::GPS, 27.0, 29.0, 56.5),
+        getSvInfo(17, GnssConstellationType::GPS, 30.5, 71.0, 77.0),
+        getSvInfo(26, GnssConstellationType::GPS, 24.1, 28.0, 253.0),
+        getSvInfo(30, GnssConstellationType::GPS, 20.5, 11.5, 116.0),
+        getSvInfo(10, GnssConstellationType::GLONASS, 25.0, 66.0, 247.0)};
+
+    GnssSvStatus svStatus = {.numSvs = sizeof(mockGnssSvInfoList) / sizeof(GnssSvInfo)};
+    for (uint32_t i = 0; i < svStatus.numSvs; i++) {
+        if (mGnssConfiguration->isBlacklisted(mockGnssSvInfoList[i])) {
+            /**
+             * Note well, this is a simple, mock emulation of not using a satellite by changing the
+             * used bit.  Simply blanking the used bit, as is done here, is *not* an acceptable
+             * actual device implementation - actual devices *must not* use the satellite in the
+             * position calculation, as specified in IGnssConfiguration.hal.
+             */
+            mockGnssSvInfoList[i].svFlag &=
+                ~static_cast<uint8_t>(IGnssCallback::GnssSvFlags::USED_IN_FIX);
+        }
+        svStatus.gnssSvList[i] = mockGnssSvInfoList[i];
+    }
+
+    return svStatus;
+}
+
+Return<void> Gnss::reportLocation(const GnssLocation& location) const {
     std::unique_lock<std::mutex> lock(mMutex);
     if (sGnssCallback == nullptr) {
         ALOGE("%s: sGnssCallback is null.", __func__);
@@ -215,6 +258,16 @@
     return Void();
 }
 
+Return<void> Gnss::reportSvStatus(const GnssSvStatus& svStatus) const {
+    std::unique_lock<std::mutex> lock(mMutex);
+    if (sGnssCallback == nullptr) {
+        ALOGE("%s: sGnssCallback is null.", __func__);
+        return Void();
+    }
+    sGnssCallback->gnssSvStatusCb(svStatus);
+    return Void();
+}
+
 }  // namespace implementation
 }  // namespace V1_1
 }  // namespace gnss
diff --git a/gnss/1.1/default/Gnss.h b/gnss/1.1/default/Gnss.h
index 68c3498..99af34c 100644
--- a/gnss/1.1/default/Gnss.h
+++ b/gnss/1.1/default/Gnss.h
@@ -7,6 +7,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include "GnssConfiguration.h"
 
 namespace android {
 namespace hardware {
@@ -22,6 +23,11 @@
 using ::android::hardware::Void;
 using ::android::sp;
 
+using GnssConstellationType = V1_0::GnssConstellationType;
+using GnssLocation = V1_0::GnssLocation;
+using GnssSvInfo = V1_0::IGnssCallback::GnssSvInfo;
+using GnssSvStatus = V1_0::IGnssCallback::GnssSvStatus;
+
 /**
  * Unlike the gnss/1.0/default implementation, which is a shim layer to the legacy gps.h, this
  * default implementation serves as a mock implementation for emulators
@@ -78,14 +84,19 @@
 
     // Methods from ::android::hidl::base::V1_0::IBase follow.
    private:
-    Return<V1_0::GnssLocation> getMockLocation();
-    Return<void> reportLocation(const V1_0::GnssLocation& location);
+    Return<GnssLocation> getMockLocation() const;
+    Return<GnssSvStatus> getMockSvStatus() const;
+    Return<GnssSvInfo> getSvInfo(int16_t svid, GnssConstellationType type, float cN0DbHz,
+                                 float elevationDegress, float azimuthDegress) const;
+    Return<void> reportLocation(const GnssLocation&) const;
+    Return<void> reportSvStatus(const GnssSvStatus&) const;
 
-    static sp<::android::hardware::gnss::V1_1::IGnssCallback> sGnssCallback;
+    static sp<IGnssCallback> sGnssCallback;
+    std::atomic<long> mMinIntervalMs;
+    sp<GnssConfiguration> mGnssConfiguration;
     std::atomic<bool> mIsActive;
     std::thread mThread;
-    std::mutex mMutex;
-    std::atomic<long> mMinIntervalMs;
+    mutable std::mutex mMutex;
 };
 
 }  // namespace implementation
diff --git a/gnss/1.1/default/GnssConfiguration.cpp b/gnss/1.1/default/GnssConfiguration.cpp
index d05f317..2717571 100644
--- a/gnss/1.1/default/GnssConfiguration.cpp
+++ b/gnss/1.1/default/GnssConfiguration.cpp
@@ -1,4 +1,7 @@
+#define LOG_TAG "GnssConfiguration"
+
 #include "GnssConfiguration.h"
+#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -43,10 +46,33 @@
 }
 
 // Methods from ::android::hardware::gnss::V1_1::IGnssConfiguration follow.
-Return<bool> GnssConfiguration::setBlacklist(
-    const hidl_vec<::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource>&) {
-    // TODO implement
-    return bool{};
+Return<bool> GnssConfiguration::setBlacklist(const hidl_vec<BlacklistedSource>& sourceList) {
+    std::unique_lock<std::recursive_mutex> lock(mMutex);
+    mBlacklistedConstellationSet.clear();
+    mBlacklistedSourceSet.clear();
+    for (auto source : sourceList) {
+        if (source.svid == 0) {
+            // Wildcard blacklist, i.e., blacklist entire constellation.
+            mBlacklistedConstellationSet.insert(source.constellation);
+        } else {
+            mBlacklistedSourceSet.insert(source);
+        }
+    }
+    return true;
+}
+
+Return<bool> GnssConfiguration::isBlacklisted(const GnssSvInfo& gnssSvInfo) const {
+    std::unique_lock<std::recursive_mutex> lock(mMutex);
+    if (mBlacklistedConstellationSet.find(gnssSvInfo.constellation) !=
+        mBlacklistedConstellationSet.end()) {
+        return true;
+    }
+    BlacklistedSource source = {.constellation = gnssSvInfo.constellation, .svid = gnssSvInfo.svid};
+    return (mBlacklistedSourceSet.find(source) != mBlacklistedSourceSet.end());
+}
+
+std::recursive_mutex& GnssConfiguration::getMutex() const {
+    return mMutex;
 }
 
 // Methods from ::android::hidl::base::V1_0::IBase follow.
diff --git a/gnss/1.1/default/GnssConfiguration.h b/gnss/1.1/default/GnssConfiguration.h
index 4f7ed2b..9b2699b 100644
--- a/gnss/1.1/default/GnssConfiguration.h
+++ b/gnss/1.1/default/GnssConfiguration.h
@@ -1,9 +1,12 @@
 #ifndef ANDROID_HARDWARE_GNSS_V1_1_GNSSCONFIGURATION_H
 #define ANDROID_HARDWARE_GNSS_V1_1_GNSSCONFIGURATION_H
 
+#include <android/hardware/gnss/1.1/IGnssCallback.h>
 #include <android/hardware/gnss/1.1/IGnssConfiguration.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
+#include <mutex>
+#include <unordered_set>
 
 namespace android {
 namespace hardware {
@@ -19,6 +22,26 @@
 using ::android::hardware::Void;
 using ::android::sp;
 
+using BlacklistedSource = ::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource;
+using GnssConstellationType = V1_0::GnssConstellationType;
+using GnssSvInfo = V1_0::IGnssCallback::GnssSvInfo;
+
+struct BlacklistedSourceHash {
+    inline int operator()(const BlacklistedSource& source) const {
+        return int(source.constellation) * 1000 + int(source.svid);
+    }
+};
+
+struct BlacklistedSourceEqual {
+    inline bool operator()(const BlacklistedSource& s1, const BlacklistedSource& s2) const {
+        return (s1.constellation == s2.constellation) && (s1.svid == s2.svid);
+    }
+};
+
+using BlacklistedSourceSet =
+    std::unordered_set<BlacklistedSource, BlacklistedSourceHash, BlacklistedSourceEqual>;
+using BlacklistedConstellationSet = std::unordered_set<GnssConstellationType>;
+
 struct GnssConfiguration : public IGnssConfiguration {
     // Methods from ::android::hardware::gnss::V1_0::IGnssConfiguration follow.
     Return<bool> setSuplEs(bool enabled) override;
@@ -30,11 +53,15 @@
     Return<bool> setEmergencySuplPdn(bool enable) override;
 
     // Methods from ::android::hardware::gnss::V1_1::IGnssConfiguration follow.
-    Return<bool> setBlacklist(
-        const hidl_vec<::android::hardware::gnss::V1_1::IGnssConfiguration::BlacklistedSource>&
-            blacklist) override;
+    Return<bool> setBlacklist(const hidl_vec<BlacklistedSource>& blacklist) override;
 
-    // Methods from ::android::hidl::base::V1_0::IBase follow.
+    Return<bool> isBlacklisted(const GnssSvInfo& gnssSvInfo) const;
+    std::recursive_mutex& getMutex() const;
+
+   private:
+    BlacklistedSourceSet mBlacklistedSourceSet;
+    BlacklistedConstellationSet mBlacklistedConstellationSet;
+    mutable std::recursive_mutex mMutex;
 };
 
 }  // namespace implementation
diff --git a/gnss/1.1/default/GnssConstants.h b/gnss/1.1/default/GnssConstants.h
new file mode 100644
index 0000000..9ce1a12
--- /dev/null
+++ b/gnss/1.1/default/GnssConstants.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_gnss_V1_1_GnssConstants_H_
+#define android_hardware_gnss_V1_1_GnssConstants_H_
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+const float kMockLatitudeDegrees = 37.4219999;
+const float kMockLongitudeDegrees = -122.0840575;
+const float kMockAltitudeMeters = 1.60062531;
+const float kMockSpeedMetersPerSec = 0;
+const float kMockBearingDegrees = 0;
+const float kMockHorizontalAccuracyMeters = 5;
+const float kMockVerticalAccuracyMeters = 5;
+const float kMockSpeedAccuracyMetersPerSecond = 1;
+const float kMockBearingAccuracyDegrees = 90;
+const int64_t kMockTimestamp = 1519930775453L;
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_gnss_V1_1_GnssConstants_H_
diff --git a/gnss/1.1/default/GnssDebug.cpp b/gnss/1.1/default/GnssDebug.cpp
new file mode 100644
index 0000000..62870e4
--- /dev/null
+++ b/gnss/1.1/default/GnssDebug.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "GnssDebug"
+
+#include <log/log.h>
+
+#include "GnssConstants.h"
+#include "GnssDebug.h"
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+// Methods from ::android::hardware::gnss::V1_0::IGnssDebug follow.
+Return<void> GnssDebug::getDebugData(V1_0::IGnssDebug::getDebugData_cb _hidl_cb) {
+    PositionDebug positionDebug = {
+        .valid = true,
+        .latitudeDegrees = kMockLatitudeDegrees,
+        .longitudeDegrees = kMockLongitudeDegrees,
+        .altitudeMeters = kMockAltitudeMeters,
+        .speedMetersPerSec = kMockSpeedMetersPerSec,
+        .bearingDegrees = kMockBearingDegrees,
+        .horizontalAccuracyMeters = kMockHorizontalAccuracyMeters,
+        .verticalAccuracyMeters = kMockVerticalAccuracyMeters,
+        .speedAccuracyMetersPerSecond = kMockSpeedAccuracyMetersPerSecond,
+        .bearingAccuracyDegrees = kMockBearingAccuracyDegrees,
+        .ageSeconds = 0.99};
+
+    TimeDebug timeDebug = {.timeEstimate = kMockTimestamp,
+                           .timeUncertaintyNs = 1000,
+                           .frequencyUncertaintyNsPerSec = 5.0e4};
+
+    DebugData data = {.position = positionDebug, .time = timeDebug};
+
+    _hidl_cb(data);
+
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
diff --git a/gnss/1.1/default/GnssDebug.h b/gnss/1.1/default/GnssDebug.h
new file mode 100644
index 0000000..969d337
--- /dev/null
+++ b/gnss/1.1/default/GnssDebug.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef android_hardware_gnss_V1_1_GnssDebug_H_
+#define android_hardware_gnss_V1_1_GnssDebug_H_
+
+#include <android/hardware/gnss/1.0/IGnssDebug.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace gnss {
+namespace V1_1 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using V1_0::IGnssDebug;
+
+/* Interface for GNSS Debug support. */
+struct GnssDebug : public IGnssDebug {
+    /*
+     * Methods from ::android::hardware::gnss::V1_0::IGnssDebug follow.
+     * These declarations were generated from IGnssDebug.hal.
+     */
+    Return<void> getDebugData(V1_0::IGnssDebug::getDebugData_cb _hidl_cb) override;
+};
+
+}  // namespace implementation
+}  // namespace V1_1
+}  // namespace gnss
+}  // namespace hardware
+}  // namespace android
+
+#endif  // android_hardware_gnss_V1_1_GnssDebug_H_
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.cpp b/gnss/1.1/vts/functional/gnss_hal_test.cpp
index 9c5ac2d..8928a5a 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test.cpp
@@ -33,6 +33,8 @@
         GnssHidlEnvironment::Instance()->getServiceName<IGnss>());
     list_gnss_sv_status_.clear();
     ASSERT_NE(gnss_hal_, nullptr);
+
+    SetUpGnssCallback();
 }
 
 void GnssHalTest::TearDown() {
@@ -44,6 +46,30 @@
     }
 }
 
+void GnssHalTest::SetUpGnssCallback() {
+    gnss_cb_ = new GnssCallback(*this);
+    ASSERT_NE(gnss_cb_, nullptr);
+
+    auto result = gnss_hal_->setCallback_1_1(gnss_cb_);
+    if (!result.isOk()) {
+        ALOGE("result of failed setCallback %s", result.description().c_str());
+    }
+
+    ASSERT_TRUE(result.isOk());
+    ASSERT_TRUE(result);
+
+    /*
+     * All capabilities, name and systemInfo callbacks should trigger
+     */
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
+
+    EXPECT_EQ(capabilities_called_count_, 1);
+    EXPECT_EQ(info_called_count_, 1);
+    EXPECT_EQ(name_called_count_, 1);
+}
+
 void GnssHalTest::StopAndClearLocations() {
     auto result = gnss_hal_->stop();
 
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.h b/gnss/1.1/vts/functional/gnss_hal_test.h
index 6d5bb4c..269366a 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.h
+++ b/gnss/1.1/vts/functional/gnss_hal_test.h
@@ -101,6 +101,12 @@
     };
 
     /*
+     * SetUpGnssCallback:
+     *   Set GnssCallback and verify the result.
+     */
+    void SetUpGnssCallback();
+
+    /*
      * StartAndGetSingleLocation:
      * Helper function to get one Location and check fields
      *
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index 63b6c78..8f4691e 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -39,34 +39,6 @@
 TEST_F(GnssHalTest, SetupTeardownCreateCleanup) {}
 
 /*
- * SetCallbackResponses:
- * Sets up the callback, awaits the capability, info & name
- */
-TEST_F(GnssHalTest, SetCallbackResponses) {
-    gnss_cb_ = new GnssCallback(*this);
-    ASSERT_NE(gnss_cb_, nullptr);
-
-    auto result = gnss_hal_->setCallback_1_1(gnss_cb_);
-    if (!result.isOk()) {
-        ALOGE("result of failed setCallback %s", result.description().c_str());
-    }
-
-    ASSERT_TRUE(result.isOk());
-    ASSERT_TRUE(result);
-
-    /*
-     * All capabilities, name and systemInfo callbacks should trigger
-     */
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-    EXPECT_EQ(std::cv_status::no_timeout, wait(TIMEOUT_SEC));
-
-    EXPECT_EQ(capabilities_called_count_, 1);
-    EXPECT_EQ(info_called_count_, 1);
-    EXPECT_EQ(name_called_count_, 1);
-}
-
-/*
  * TestGnssMeasurementCallback:
  * Gets the GnssMeasurementExtension and verify that it returns an actual extension.
  */
@@ -283,6 +255,7 @@
         if (strongest_sv_is_reobserved) break;
     }
     EXPECT_TRUE(strongest_sv_is_reobserved);
+    StopAndClearLocations();
 }
 
 /*
diff --git a/graphics/mapper/2.1/Android.bp b/graphics/mapper/2.1/Android.bp
index d917e59..8527d3d 100644
--- a/graphics/mapper/2.1/Android.bp
+++ b/graphics/mapper/2.1/Android.bp
@@ -11,6 +11,7 @@
         "IMapper.hal",
     ],
     interfaces: [
+        "android.hardware.graphics.common@1.0",
         "android.hardware.graphics.common@1.1",
         "android.hardware.graphics.mapper@2.0",
         "android.hidl.base@1.0",
diff --git a/light/2.0/default/android.hardware.light@2.0-service.rc b/light/2.0/default/android.hardware.light@2.0-service.rc
index 68f74c4..b54ca95 100644
--- a/light/2.0/default/android.hardware.light@2.0-service.rc
+++ b/light/2.0/default/android.hardware.light@2.0-service.rc
@@ -3,3 +3,5 @@
     class hal
     user system
     group system
+    # shutting off lights while powering-off
+    shutdown critical
diff --git a/light/utils/main.cpp b/light/utils/main.cpp
index 1f9cb9c..d07e799 100644
--- a/light/utils/main.cpp
+++ b/light/utils/main.cpp
@@ -26,6 +26,7 @@
 }
 
 int main() {
+    using ::android::hardware::hidl_vec;
     using ::android::hardware::light::V2_0::Brightness;
     using ::android::hardware::light::V2_0::Flash;
     using ::android::hardware::light::V2_0::ILight;
@@ -44,9 +45,15 @@
         .color = 0u, .flashMode = Flash::NONE, .brightnessMode = Brightness::USER,
     };
 
-    Status ret = service->setLight(Type::BACKLIGHT, off).withDefault(Status::UNKNOWN);
-    if (ret != Status::SUCCESS) {
-        error("Failed to shut off screen");
-    }
+    service->getSupportedTypes([&](const hidl_vec<Type>& types) {
+        for (Type type : types) {
+            Status ret = service->setLight(type, off);
+            if (ret != Status::SUCCESS) {
+                error("Failed to shut off screen for type " +
+                      std::to_string(static_cast<int>(type)));
+            }
+        }
+    });
+
     return 0;
 }
diff --git a/neuralnetworks/1.1/Android.bp b/neuralnetworks/1.1/Android.bp
index 9365d4e..81bcef3 100644
--- a/neuralnetworks/1.1/Android.bp
+++ b/neuralnetworks/1.1/Android.bp
@@ -15,6 +15,7 @@
         "android.hidl.base@1.0",
     ],
     types: [
+        "Capabilities",
         "Model",
         "Operation",
         "OperationType",