diff --git a/audio/6.0/config/api/current.txt b/audio/6.0/config/api/current.txt
index 01db90e..1814b59 100644
--- a/audio/6.0/config/api/current.txt
+++ b/audio/6.0/config/api/current.txt
@@ -116,6 +116,7 @@
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_APTX_HD;
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_APTX_TWSP;
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_CELT;
+    enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_DEFAULT;
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_DOLBY_TRUEHD;
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_DSD;
     enum_constant public static final audio.policy.configuration.V6_0.AudioFormat AUDIO_FORMAT_DTS;
diff --git a/audio/6.0/config/audio_policy_configuration.xsd b/audio/6.0/config/audio_policy_configuration.xsd
index c2b8c5d..177af16 100644
--- a/audio/6.0/config/audio_policy_configuration.xsd
+++ b/audio/6.0/config/audio_policy_configuration.xsd
@@ -302,6 +302,7 @@
          TODO: generate from hidl to avoid manual sync. -->
     <xs:simpleType name="audioFormat">
         <xs:restriction base="xs:string">
+            <xs:enumeration value="AUDIO_FORMAT_DEFAULT" />
             <xs:enumeration value="AUDIO_FORMAT_PCM_16_BIT" />
             <xs:enumeration value="AUDIO_FORMAT_PCM_8_BIT"/>
             <xs:enumeration value="AUDIO_FORMAT_PCM_32_BIT"/>
diff --git a/audio/aidl/TEST_MAPPING b/audio/aidl/TEST_MAPPING
index d848af9..e325001 100644
--- a/audio/aidl/TEST_MAPPING
+++ b/audio/aidl/TEST_MAPPING
@@ -78,12 +78,6 @@
           "include-filter": "android.virtualdevice.cts.VirtualAudioTest"
         }
       ]
-    },
-    {
-      "name": "VtsHalBassBoostTargetTest"
-    },
-    {
-      "name": "VtsHalDynamicsProcessingTest"
     }
   ]
 }
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
index 584640b..dc36ac0 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
@@ -39,6 +39,9 @@
 static const std::string kLeAudioOffloadProviderName =
     "LE_AUDIO_OFFLOAD_HARDWARE_OFFLOAD_PROVIDER";
 
+static const std::string kHfpOffloadProviderName =
+    "HFP_OFFLOAD_HARDWARE_OFFLOAD_PROVIDER";
+
 BluetoothAudioProviderFactory::BluetoothAudioProviderFactory() {}
 
 ndk::ScopedAStatus BluetoothAudioProviderFactory::openProvider(
@@ -170,6 +173,7 @@
     provider_info.name = a2dp_offload_codec_factory_.name;
     for (auto codec : a2dp_offload_codec_factory_.codecs)
       provider_info.codecInfos.push_back(codec->info);
+    return ndk::ScopedAStatus::ok();
   }
 
   if (session_type ==
@@ -184,12 +188,23 @@
       auto& provider_info = _aidl_return->emplace();
       provider_info.name = kLeAudioOffloadProviderName;
       provider_info.codecInfos = db_codec_info;
-      *_aidl_return = provider_info;
       return ndk::ScopedAStatus::ok();
     }
   }
 
-  return ndk::ScopedAStatus::ok();
+  if (session_type == SessionType::HFP_HARDWARE_OFFLOAD_DATAPATH) {
+    std::vector<CodecInfo> db_codec_info =
+        BluetoothAudioCodecs::GetHfpOffloadCodecInfo();
+    if (!db_codec_info.empty()) {
+      auto& provider_info = _aidl_return->emplace();
+      provider_info.name = kHfpOffloadProviderName;
+      provider_info.codecInfos = db_codec_info;
+      return ndk::ScopedAStatus::ok();
+    }
+  }
+
+  // Unsupported for other sessions
+  return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
 }
 
 }  // namespace audio
diff --git a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
index 789e8a1..c313fb7 100644
--- a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
+++ b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
@@ -1944,6 +1944,7 @@
         BluetoothAudioHalVersion::VERSION_AIDL_V4) {
       GTEST_SKIP();
     }
+    GetProviderInfoHelper(SessionType::HFP_HARDWARE_OFFLOAD_DATAPATH);
     OpenProviderHelper(SessionType::HFP_HARDWARE_OFFLOAD_DATAPATH);
     // Can open or empty capability
     ASSERT_TRUE(temp_provider_capabilities_.empty() ||
diff --git a/bluetooth/audio/utils/Android.bp b/bluetooth/audio/utils/Android.bp
index c0817f5..cecf8f0 100644
--- a/bluetooth/audio/utils/Android.bp
+++ b/bluetooth/audio/utils/Android.bp
@@ -42,6 +42,7 @@
         "aidl_session/BluetoothAudioSession.cpp",
         "aidl_session/HidlToAidlMiddleware.cpp",
         "aidl_session/BluetoothLeAudioCodecsProvider.cpp",
+        "aidl_session/BluetoothHfpCodecsProvider.cpp",
         "aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp",
     ],
     export_include_dirs: ["aidl_session/"],
@@ -68,9 +69,13 @@
     static_libs: [
         "btaudiohal_flags_c_lib",
     ],
-    generated_sources: ["le_audio_codec_capabilities"],
+    generated_sources: [
+        "le_audio_codec_capabilities",
+        "hfp_codec_capabilities",
+    ],
     generated_headers: [
         "le_audio_codec_capabilities",
+        "hfp_codec_capabilities",
         "AIDLLeAudioSetConfigSchemas_h",
     ],
     required: [
@@ -78,6 +83,7 @@
         "aidl_audio_set_configurations_json",
         "aidl_audio_set_scenarios_bfbs",
         "aidl_audio_set_scenarios_json",
+        "hfp_codec_capabilities_xml",
     ],
 }
 
@@ -106,6 +112,35 @@
     generated_headers: ["le_audio_codec_capabilities"],
 }
 
+cc_test {
+    name: "BluetoothHfpCodecsProviderTest",
+    defaults: [
+        "latest_android_hardware_audio_common_ndk_static",
+        "latest_android_hardware_bluetooth_audio_ndk_static",
+        "latest_android_media_audio_common_types_ndk_static",
+    ],
+    srcs: [
+        "aidl_session/BluetoothHfpCodecsProvider.cpp",
+        "aidl_session/BluetoothHfpCodecsProviderTest.cpp",
+    ],
+    header_libs: [
+        "libxsdc-utils",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libxml2",
+    ],
+    test_suites: [
+        "general-tests",
+    ],
+    test_options: {
+        unit_test: false,
+    },
+    generated_sources: ["hfp_codec_capabilities"],
+    generated_headers: ["hfp_codec_capabilities"],
+}
+
 xsd_config {
     name: "le_audio_codec_capabilities",
     srcs: ["le_audio_codec_capabilities/le_audio_codec_capabilities.xsd"],
@@ -114,6 +149,14 @@
     root_elements: ["leAudioOffloadSetting"],
 }
 
+xsd_config {
+    name: "hfp_codec_capabilities",
+    srcs: ["hfp_codec_capabilities/hfp_codec_capabilities.xsd"],
+    package_name: "aidl.android.hardware.bluetooth.audio.hfp.setting",
+    api_dir: "hfp_codec_capabilities/schema",
+    root_elements: ["hfpOffloadSetting"],
+}
+
 genrule {
     name: "AIDLLeAudioSetConfigSchemas_h",
     tools: [
@@ -177,6 +220,14 @@
 }
 
 prebuilt_etc {
+    name: "hfp_codec_capabilities_xml",
+    src: "hfp_codec_capabilities/hfp_codec_capabilities.xml",
+    filename: "hfp_codec_capabilities.xml",
+    sub_dir: "aidl/hfp",
+    vendor: true,
+}
+
+prebuilt_etc {
     name: "aidl_audio_set_configurations_bfbs",
     src: ":AIDLLeAudioSetConfigsSchema_bfbs",
     filename: "aidl_audio_set_configurations.bfbs",
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
index d37825a..c25b102 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
@@ -32,6 +32,7 @@
 #include <aidl/android/hardware/bluetooth/audio/SbcChannelMode.h>
 #include <android-base/logging.h>
 
+#include "BluetoothHfpCodecsProvider.h"
 #include "BluetoothLeAudioAseConfigurationSettingProvider.h"
 #include "BluetoothLeAudioCodecsProvider.h"
 
@@ -100,6 +101,7 @@
 std::vector<LeAudioCodecCapabilitiesSetting> kDefaultOffloadLeAudioCapabilities;
 std::unordered_map<SessionType, std::vector<CodecInfo>>
     kDefaultOffloadLeAudioCodecInfoMap;
+std::vector<CodecInfo> kDefaultOffloadHfpCodecInfo;
 
 template <class T>
 bool BluetoothAudioCodecs::ContainedInVector(
@@ -439,6 +441,17 @@
   return codec_info_map_iter->second;
 }
 
+std::vector<CodecInfo> BluetoothAudioCodecs::GetHfpOffloadCodecInfo() {
+  if (kDefaultOffloadHfpCodecInfo.empty()) {
+    auto hfp_offload_setting =
+        BluetoothHfpCodecsProvider::ParseFromHfpOffloadSettingFile();
+    // Load file into list
+    kDefaultOffloadHfpCodecInfo =
+        BluetoothHfpCodecsProvider::GetHfpAudioCodecInfo(hfp_offload_setting);
+  }
+  return kDefaultOffloadHfpCodecInfo;
+}
+
 std::vector<LeAudioAseConfigurationSetting>
 BluetoothAudioCodecs::GetLeAudioAseConfigurationSettings() {
   return AudioSetConfigurationProviderJson::
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
index 057b9a7..0a1f708 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
@@ -57,6 +57,8 @@
   static std::vector<LeAudioAseConfigurationSetting>
   GetLeAudioAseConfigurationSettings();
 
+  static std::vector<CodecInfo> GetHfpOffloadCodecInfo();
+
  private:
   template <typename T>
   struct identity {
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.cpp b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.cpp
new file mode 100644
index 0000000..d61ec5a
--- /dev/null
+++ b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "BluetoothHfpCodecsProvider.h"
+
+#include <unordered_map>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace audio {
+
+using hfp::setting::CodecType;
+using hfp::setting::PathConfiguration;
+
+static const char* kHfpCodecCapabilitiesFile =
+    "/vendor/etc/aidl/hfp/hfp_codec_capabilities.xml";
+
+std::optional<HfpOffloadSetting>
+BluetoothHfpCodecsProvider::ParseFromHfpOffloadSettingFile() {
+  auto hfp_offload_setting =
+      hfp::setting::readHfpOffloadSetting(kHfpCodecCapabilitiesFile);
+  if (!hfp_offload_setting.has_value()) {
+    LOG(ERROR) << __func__ << ": Failed to read " << kHfpCodecCapabilitiesFile;
+  }
+  return hfp_offload_setting;
+}
+
+std::vector<CodecInfo> BluetoothHfpCodecsProvider::GetHfpAudioCodecInfo(
+    const std::optional<HfpOffloadSetting>& hfp_offload_setting) {
+  std::vector<CodecInfo> result;
+  if (!hfp_offload_setting.has_value()) return result;
+
+  // Convert path configuration into map
+  // Currently transport configuration is unused
+  if (!hfp_offload_setting.value().hasPathConfiguration() ||
+      hfp_offload_setting.value().getPathConfiguration().empty()) {
+    LOG(WARNING) << __func__ << ": path configurations is empty";
+    return result;
+  }
+  auto path_configurations = hfp_offload_setting.value().getPathConfiguration();
+  std::unordered_map<std::string, PathConfiguration> path_config_map;
+  for (const auto& path_cfg : path_configurations)
+    if (path_cfg.hasName() && path_cfg.hasDataPath())
+      path_config_map.insert(make_pair(path_cfg.getName(), path_cfg));
+
+  for (const auto& cfg : hfp_offload_setting.value().getConfiguration()) {
+    auto input_path_cfg = path_config_map.find(cfg.getInputPathConfiguration());
+    auto output_path_cfg =
+        path_config_map.find(cfg.getOutputPathConfiguration());
+    if (input_path_cfg == path_config_map.end()) {
+      LOG(WARNING) << __func__ << ": Input path configuration not found: "
+                   << cfg.getInputPathConfiguration();
+      continue;
+    }
+
+    if (output_path_cfg == path_config_map.end()) {
+      LOG(WARNING) << __func__ << ": Output path configuration not found: "
+                   << cfg.getOutputPathConfiguration();
+      continue;
+    }
+
+    CodecInfo codec_info;
+
+    switch (cfg.getCodec()) {
+      case CodecType::LC3:
+        codec_info.id = CodecId::Core::LC3;
+        break;
+      case CodecType::MSBC:
+        codec_info.id = CodecId::Core::MSBC;
+        break;
+      case CodecType::CVSD:
+        codec_info.id = CodecId::Core::CVSD;
+        break;
+      default:
+        LOG(WARNING) << __func__ << ": Unknown codec from " << cfg.getName();
+        codec_info.id = CodecId::Vendor();
+        break;
+    }
+    codec_info.name = cfg.getName();
+
+    codec_info.transport =
+        CodecInfo::Transport::make<CodecInfo::Transport::Tag::hfp>();
+
+    auto& transport =
+        codec_info.transport.get<CodecInfo::Transport::Tag::hfp>();
+    transport.useControllerCodec = cfg.getUseControllerCodec();
+    transport.inputDataPath = input_path_cfg->second.getDataPath();
+    transport.outputDataPath = output_path_cfg->second.getDataPath();
+
+    result.push_back(codec_info);
+  }
+  LOG(INFO) << __func__ << ": Has " << result.size() << " codec info";
+  return result;
+}
+
+}  // namespace audio
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.h b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.h
new file mode 100644
index 0000000..642ee02
--- /dev/null
+++ b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProvider.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/logging.h>
+
+#include <vector>
+
+#include "aidl/android/hardware/bluetooth/audio/CodecInfo.h"
+#include "aidl_android_hardware_bluetooth_audio_hfp_setting.h"
+#include "aidl_android_hardware_bluetooth_audio_hfp_setting_enums.h"
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace audio {
+
+using hfp::setting::HfpOffloadSetting;
+
+class BluetoothHfpCodecsProvider {
+ public:
+  static std::optional<HfpOffloadSetting> ParseFromHfpOffloadSettingFile();
+
+  static std::vector<CodecInfo> GetHfpAudioCodecInfo(
+      const std::optional<HfpOffloadSetting>& hfp_offload_setting);
+};
+}  // namespace audio
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProviderTest.cpp b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProviderTest.cpp
new file mode 100644
index 0000000..b08c3eb
--- /dev/null
+++ b/bluetooth/audio/utils/aidl_session/BluetoothHfpCodecsProviderTest.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <optional>
+#include <tuple>
+
+#include "BluetoothHfpCodecsProvider.h"
+#include "gtest/gtest.h"
+
+using aidl::android::hardware::bluetooth::audio::BluetoothHfpCodecsProvider;
+using aidl::android::hardware::bluetooth::audio::CodecInfo;
+using aidl::android::hardware::bluetooth::audio::hfp::setting::CodecType;
+using aidl::android::hardware::bluetooth::audio::hfp::setting::Configuration;
+using aidl::android::hardware::bluetooth::audio::hfp::setting::
+    HfpOffloadSetting;
+using aidl::android::hardware::bluetooth::audio::hfp::setting::
+    PathConfiguration;
+using aidl::android::hardware::bluetooth::audio::hfp::setting::
+    TransportConfiguration;
+
+typedef std::tuple<std::vector<PathConfiguration>,
+                   std::vector<TransportConfiguration>,
+                   std::vector<Configuration>>
+    HfpOffloadSettingTuple;
+
+// Define valid components for each list
+// PathConfiguration
+static const PathConfiguration kValidPathConfigurationCVSD("CVSD_IO", 16000,
+                                                           CodecType::CVSD, 16,
+                                                           2, 0, 1, 0);
+static const PathConfiguration kInvalidPathConfigurationNULL(std::nullopt,
+                                                             16000,
+                                                             CodecType::CVSD,
+                                                             16, 2, 0, 1, 0);
+static const PathConfiguration kInvalidPathConfigurationNoPath(
+    "CVSD_NULL", 16000, CodecType::CVSD, 16, 2, 0, std::nullopt, 0);
+
+// Configuration
+static const Configuration kValidConfigurationCVSD("CVSD", CodecType::CVSD,
+                                                   65535, 7, 0, true, "CVSD_IO",
+                                                   "CVSD_IO", std::nullopt,
+                                                   std::nullopt);
+static const Configuration kInvalidConfigurationCVSDNoPath(
+    "CVSD", CodecType::CVSD, 65535, 7, 0, true, "CVSD_NULL", "CVSD_NULL",
+    std::nullopt, std::nullopt);
+static const Configuration kInvalidConfigurationCVSDNotFound(
+    "CVSD", CodecType::CVSD, 65535, 7, 0, true, "CVSD_N", "CVSD_N",
+    std::nullopt, std::nullopt);
+
+class BluetoothHfpCodecsProviderTest : public ::testing::Test {
+ public:
+  static std::vector<HfpOffloadSettingTuple> CreateTestCases(
+      const std::vector<std::vector<PathConfiguration>> path_configs_list,
+      const std::vector<std::vector<TransportConfiguration>>
+          transport_configs_list,
+      const std::vector<std::vector<Configuration>> configs_list) {
+    std::vector<HfpOffloadSettingTuple> test_cases;
+    for (const auto& path_configs : path_configs_list) {
+      for (const auto& transport_configs : transport_configs_list) {
+        for (const auto& configs : configs_list)
+          test_cases.push_back(
+              CreateTestCase(path_configs, transport_configs, configs));
+      }
+    }
+    return test_cases;
+  }
+
+ protected:
+  std::vector<CodecInfo> RunTestCase(HfpOffloadSettingTuple test_case) {
+    auto& [path_configuration_list, transport_configuration_list,
+           configuration_list] = test_case;
+    HfpOffloadSetting hfp_offload_setting(path_configuration_list,
+                                          transport_configuration_list,
+                                          configuration_list);
+    auto capabilities =
+        BluetoothHfpCodecsProvider::GetHfpAudioCodecInfo(hfp_offload_setting);
+    return capabilities;
+  }
+
+ private:
+  static inline HfpOffloadSettingTuple CreateTestCase(
+      const std::vector<PathConfiguration> path_config_list,
+      const std::vector<TransportConfiguration> transport_config_list,
+      const std::vector<Configuration> config_list) {
+    return std::make_tuple(path_config_list, transport_config_list,
+                           config_list);
+  }
+};
+
+class GetHfpCodecInfoTest : public BluetoothHfpCodecsProviderTest {
+ public:
+  static std::vector<std::vector<PathConfiguration>>
+  GetInvalidPathConfigurationLists() {
+    std::vector<std::vector<PathConfiguration>> result;
+    result.push_back({kInvalidPathConfigurationNULL});
+    result.push_back({kInvalidPathConfigurationNoPath});
+    result.push_back({});
+    return result;
+  }
+
+  static std::vector<std::vector<Configuration>>
+  GetInvalidConfigurationLists() {
+    std::vector<std::vector<Configuration>> result;
+    result.push_back({kInvalidConfigurationCVSDNotFound});
+    result.push_back({kInvalidConfigurationCVSDNoPath});
+    result.push_back({});
+    return result;
+  }
+};
+
+TEST_F(GetHfpCodecInfoTest, InvalidPathConfiguration) {
+  auto test_cases = BluetoothHfpCodecsProviderTest::CreateTestCases(
+      GetHfpCodecInfoTest::GetInvalidPathConfigurationLists(), {{}},
+      {{kValidConfigurationCVSD}});
+  for (auto& test_case : test_cases) {
+    auto hfp_codec_capabilities = RunTestCase(test_case);
+    ASSERT_TRUE(hfp_codec_capabilities.empty());
+  }
+}
+
+TEST_F(GetHfpCodecInfoTest, InvalidConfigurationName) {
+  auto test_cases = BluetoothHfpCodecsProviderTest::CreateTestCases(
+      GetHfpCodecInfoTest::GetInvalidPathConfigurationLists(), {{}},
+      {GetHfpCodecInfoTest::GetInvalidConfigurationLists()});
+  for (auto& test_case : test_cases) {
+    auto hfp_codec_capabilities = RunTestCase(test_case);
+    ASSERT_TRUE(hfp_codec_capabilities.empty());
+  }
+}
+
+TEST_F(GetHfpCodecInfoTest, ValidConfiguration) {
+  auto test_cases = BluetoothHfpCodecsProviderTest::CreateTestCases(
+      {{kValidPathConfigurationCVSD}}, {{}}, {{kValidConfigurationCVSD}});
+  for (auto& test_case : test_cases) {
+    auto hfp_codec_capabilities = RunTestCase(test_case);
+    ASSERT_FALSE(hfp_codec_capabilities.empty());
+  }
+}
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xml b/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xml
new file mode 100644
index 0000000..c94843f
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!---
+  This is an example to configure HFP hardware offload supported capability settings
+  There are 3 list in this file. Add element into each list as needed.
+
+  pathConfiguration: input / output path configuration
+  transportConfiguration: transmit / receive configuration
+
+  configuration:
+    For each configuration, there are attributes:
+      - name
+      - codec
+      - useControllerCodec
+      - maxLatencyMs
+      - packetTypes
+      - retransmissionEffort
+      - input and output path configuration (reference by name)
+      - transmit and receive configuration (reference by name)
+-->
+<hfpOffloadSetting>
+
+  <pathConfiguration name="CVSD_IO" bandwidth="16000" codec="CVSD" codedDataSize="16" pcmDataFormat="2" pcmPayloadMsbPosition="0" dataPath="1" transportUnitSize="0" />
+  <pathConfiguration name="MSBC_IO" bandwidth="32000" codec="MSBC" codedDataSize="16" pcmDataFormat="2" pcmPayloadMsbPosition="0" dataPath="1" transportUnitSize="0" />
+  <pathConfiguration name="LC3_IO" bandwidth="64000" codec="MSBC" codedDataSize="16" pcmDataFormat="2" pcmPayloadMsbPosition="0" dataPath="1" transportUnitSize="0" />
+
+  <transportConfiguration name="CVSD_TXRX" bandwidth="8000" codec="CVSD" codedFrameSize="60" />
+  <transportConfiguration name="MSBC_TXRX" bandwidth="8000" codec="MSBC" codedFrameSize="60" />
+  <transportConfiguration name="LC3_TXRX" bandwidth="8000" codec="LC3" codedFrameSize="60" />
+
+  <configuration name="CVSD_D1_controller" codec="CVSD" maxLatencyMs="65535" packetTypes="7" retransmissionEffort="0" useControllerCodec="true" inputPathConfiguration="CVSD_IO" outputPathConfiguration="CVSD_IO" inputTransportConfiguration="CVSD_TXRX" outTransportConfiguration="CVSD_TXRX" />
+  <configuration name="CVSD_S3_controller" codec="CVSD" maxLatencyMs="10" packetTypes="959" retransmissionEffort="1" useControllerCodec="true" inputPathConfiguration="CVSD_IO" outputPathConfiguration="CVSD_IO" inputTransportConfiguration="CVSD_TXRX" outTransportConfiguration="CVSD_TXRX" />
+  <configuration name="CVSD_S4_controller" codec="CVSD" maxLatencyMs="12" packetTypes="959" retransmissionEffort="2" useControllerCodec="true" inputPathConfiguration="CVSD_IO" outputPathConfiguration="CVSD_IO" inputTransportConfiguration="CVSD_TXRX" outTransportConfiguration="CVSD_TXRX" />
+
+  <configuration name="MSBC_T1_controller" codec="MSBC" maxLatencyMs="8" packetTypes="968" retransmissionEffort="2" useControllerCodec="true" inputPathConfiguration="MSBC_IO" outputPathConfiguration="MSBC_IO" inputTransportConfiguration="MSBC_TXRX" outTransportConfiguration="MSBC_TXRX" />
+  <configuration name="MSBC_T2_controller" codec="MSBC" maxLatencyMs="13" packetTypes="904" retransmissionEffort="2" useControllerCodec="true" inputPathConfiguration="MSBC_IO" outputPathConfiguration="MSBC_IO" inputTransportConfiguration="MSBC_TXRX" outTransportConfiguration="MSBC_TXRX" />
+
+  <configuration name="LC3_T1_controller" codec="LC3" maxLatencyMs="8" packetTypes="968" retransmissionEffort="2" useControllerCodec="true" inputPathConfiguration="LC3_IO" outputPathConfiguration="LC3_IO" inputTransportConfiguration="LC3_TXRX" outTransportConfiguration="LC3_TXRX" />
+  <configuration name="LC3_T2_controller" codec="LC3" maxLatencyMs="13" packetTypes="896" retransmissionEffort="2" useControllerCodec="true" inputPathConfiguration="LC3_IO" outputPathConfiguration="LC3_IO" inputTransportConfiguration="LC3_TXRX" outTransportConfiguration="LC3_TXRX" />
+
+</hfpOffloadSetting>
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xsd b/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xsd
new file mode 100644
index 0000000..c4787b9
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/hfp_codec_capabilities.xsd
@@ -0,0 +1,51 @@
+<!-- HFP Offload Codec Capability Schema -->
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+  <xs:element name="hfpOffloadSetting">
+    <xs:complexType>
+      <xs:element ref="pathConfiguration" minOccurs="1" maxOccurs="unbounded"/>
+      <xs:element ref="transportConfiguration" minOccurs="1" maxOccurs="unbounded"/>
+      <xs:element ref="configuration" minOccurs="1" maxOccurs="unbounded"/>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="pathConfiguration">
+    <xs:complexType>
+      <xs:attribute name="name" type="xs:string"/>
+      <xs:attribute name="bandwidth" type="xs:unsignedInt"/>
+      <xs:attribute name="codec" type="codecType"/>
+      <xs:attribute name="codedDataSize" type="xs:unsignedShort"/>
+      <xs:attribute name="pcmDataFormat" type="xs:unsignedByte"/>
+      <xs:attribute name="pcmPayloadMsbPosition" type="xs:unsignedByte"/>
+      <xs:attribute name="dataPath" type="xs:unsignedByte"/>
+      <xs:attribute name="transportUnitSize" type="xs:unsignedByte"/>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="transportConfiguration">
+    <xs:complexType>
+      <xs:attribute name="name" type="xs:string"/>
+      <xs:attribute name="bandwidth" type="xs:unsignedInt"/>
+      <xs:attribute name="codec" type="codecType"/>
+      <xs:attribute name="codedFrameSize" type="xs:unsignedShort"/>
+    </xs:complexType>
+  </xs:element>
+  <xs:element name="configuration">
+    <xs:complexType>
+      <xs:attribute name="name" type="xs:string"/>
+      <xs:attribute name="codec" type="codecType"/>
+      <xs:attribute name="maxLatencyMs" type="xs:unsignedShort"/>
+      <xs:attribute name="packetTypes" type="xs:unsignedShort"/>
+      <xs:attribute name="retransmissionEffort" type="xs:unsignedByte"/>
+      <xs:attribute name="useControllerCodec" type="xs:boolean"/>
+      <xs:attribute name="inputPathConfiguration" type="xs:string"/>
+      <xs:attribute name="outputPathConfiguration" type="xs:string"/>
+      <xs:attribute name="inputTransportConfiguration" type="xs:string"/>
+      <xs:attribute name="outputTransportConfiguration" type="xs:string"/>
+    </xs:complexType>
+  </xs:element>
+  <xs:simpleType name="codecType">
+    <xs:restriction base="xs:string">
+      <xs:enumeration value="LC3"/>
+      <xs:enumeration value="CVSD"/>
+      <xs:enumeration value="MSBC"/>
+    </xs:restriction>
+  </xs:simpleType>
+</xs:schema>
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/schema/current.txt b/bluetooth/audio/utils/hfp_codec_capabilities/schema/current.txt
new file mode 100644
index 0000000..4b49929
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/schema/current.txt
@@ -0,0 +1,82 @@
+// Signature format: 2.0
+package aidl.android.hardware.bluetooth.audio.hfp.setting {
+
+  public enum CodecType {
+    method public String getRawName();
+    enum_constant public static final aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType CVSD;
+    enum_constant public static final aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType LC3;
+    enum_constant public static final aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType MSBC;
+  }
+
+  public class Configuration {
+    ctor public Configuration();
+    method public aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType getCodec();
+    method public String getInputPathConfiguration();
+    method public String getInputTransportConfiguration();
+    method public int getMaxLatencyMs();
+    method public String getName();
+    method public String getOutputPathConfiguration();
+    method public String getOutputTransportConfiguration();
+    method public int getPacketTypes();
+    method public short getRetransmissionEffort();
+    method public boolean getUseControllerCodec();
+    method public void setCodec(aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType);
+    method public void setInputPathConfiguration(String);
+    method public void setInputTransportConfiguration(String);
+    method public void setMaxLatencyMs(int);
+    method public void setName(String);
+    method public void setOutputPathConfiguration(String);
+    method public void setOutputTransportConfiguration(String);
+    method public void setPacketTypes(int);
+    method public void setRetransmissionEffort(short);
+    method public void setUseControllerCodec(boolean);
+  }
+
+  public class HfpOffloadSetting {
+    ctor public HfpOffloadSetting();
+    method public java.util.List<aidl.android.hardware.bluetooth.audio.hfp.setting.Configuration> getConfiguration();
+    method public java.util.List<aidl.android.hardware.bluetooth.audio.hfp.setting.PathConfiguration> getPathConfiguration();
+    method public java.util.List<aidl.android.hardware.bluetooth.audio.hfp.setting.TransportConfiguration> getTransportConfiguration();
+  }
+
+  public class PathConfiguration {
+    ctor public PathConfiguration();
+    method public long getBandwidth();
+    method public aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType getCodec();
+    method public int getCodedDataSize();
+    method public short getDataPath();
+    method public String getName();
+    method public short getPcmDataFormat();
+    method public short getPcmPayloadMsbPosition();
+    method public short getTransportUnitSize();
+    method public void setBandwidth(long);
+    method public void setCodec(aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType);
+    method public void setCodedDataSize(int);
+    method public void setDataPath(short);
+    method public void setName(String);
+    method public void setPcmDataFormat(short);
+    method public void setPcmPayloadMsbPosition(short);
+    method public void setTransportUnitSize(short);
+  }
+
+  public class TransportConfiguration {
+    ctor public TransportConfiguration();
+    method public long getBandwidth();
+    method public aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType getCodec();
+    method public int getCodedFrameSize();
+    method public String getName();
+    method public void setBandwidth(long);
+    method public void setCodec(aidl.android.hardware.bluetooth.audio.hfp.setting.CodecType);
+    method public void setCodedFrameSize(int);
+    method public void setName(String);
+  }
+
+  public class XmlParser {
+    ctor public XmlParser();
+    method public static aidl.android.hardware.bluetooth.audio.hfp.setting.HfpOffloadSetting readHfpOffloadSetting(java.io.InputStream) throws javax.xml.datatype.DatatypeConfigurationException, java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+    method public static String readText(org.xmlpull.v1.XmlPullParser) throws java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+    method public static void skip(org.xmlpull.v1.XmlPullParser) throws java.io.IOException, org.xmlpull.v1.XmlPullParserException;
+  }
+
+}
+
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_current.txt b/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_current.txt
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_current.txt
@@ -0,0 +1 @@
+
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_removed.txt b/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_removed.txt
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/schema/last_removed.txt
@@ -0,0 +1 @@
+
diff --git a/bluetooth/audio/utils/hfp_codec_capabilities/schema/removed.txt b/bluetooth/audio/utils/hfp_codec_capabilities/schema/removed.txt
new file mode 100644
index 0000000..d802177
--- /dev/null
+++ b/bluetooth/audio/utils/hfp_codec_capabilities/schema/removed.txt
@@ -0,0 +1 @@
+// Signature format: 2.0
diff --git a/radio/aidl/android/hardware/radio/network/SecurityAlgorithm.aidl b/radio/aidl/android/hardware/radio/network/SecurityAlgorithm.aidl
index 01f7327..451eaa9 100644
--- a/radio/aidl/android/hardware/radio/network/SecurityAlgorithm.aidl
+++ b/radio/aidl/android/hardware/radio/network/SecurityAlgorithm.aidl
@@ -62,7 +62,7 @@
     // IMS and SIP layer security (See 3GPP TS 33.203)
     // No IPsec config
     SIP_NO_IPSEC_CONFIG = 66,
-    IMS_NULL = 67,
+    IMS_NULL = 67, // Deprecated. Use SIP_NO_IPSEC_CONFIG and SIP_NULL instead.
 
     // Has IPsec config
     SIP_NULL = 68,
diff --git a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
index f668536..98cf023 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
@@ -28,8 +28,9 @@
 parcelable DeviceInfo {
     /**
      * DeviceInfo is a CBOR Map structure described by the following CDDL. DeviceInfo must be
-     * canonicalized according to the specification in RFC 7049. The ordering presented here is
-     * non-canonical to group similar entries semantically.
+     * ordered according to the Length-First Map Key Ordering specified in RFC 8949,
+     * Section 4.2.3. Please note that the ordering presented here groups similar entries
+     * semantically, and not in the correct order per RFC 8949, Section 4.2.3.
      *
      * The DeviceInfo has changed across versions 1, 2, and 3 of the HAL. All versions of the
      * DeviceInfo CDDL are described in the DeviceInfoV*.cddl files. Please refer to the CDDL