Merge "Add functional tests for bad input to 1.2"
diff --git a/audio/2.0/default/Android.mk b/audio/2.0/default/Android.mk
index 12713d3..edf1761 100644
--- a/audio/2.0/default/Android.mk
+++ b/audio/2.0/default/Android.mk
@@ -31,6 +31,7 @@
 LOCAL_CFLAGS := -Wall -Werror
 
 LOCAL_SHARED_LIBRARIES := \
+    libbinder \
     libhidlbase \
     libhidltransport \
     liblog \
diff --git a/audio/2.0/default/service.cpp b/audio/2.0/default/service.cpp
index 3cf7134..d554481 100644
--- a/audio/2.0/default/service.cpp
+++ b/audio/2.0/default/service.cpp
@@ -20,6 +20,7 @@
 #include <android/hardware/audio/effect/2.0/IEffectsFactory.h>
 #include <android/hardware/soundtrigger/2.0/ISoundTriggerHw.h>
 #include <android/hardware/soundtrigger/2.1/ISoundTriggerHw.h>
+#include <binder/ProcessState.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hidl/LegacySupport.h>
 
@@ -36,6 +37,9 @@
 using android::OK;
 
 int main(int /* argc */, char* /* argv */ []) {
+    android::ProcessState::initWithDriver("/dev/vndbinder");
+    // start a threadpool for vndbinder interactions
+    android::ProcessState::self()->startThreadPool();
     configureRpcThreadpool(16, true /*callerWillJoin*/);
     android::status_t status;
     status = registerPassthroughServiceImplementation<IDevicesFactory>();
diff --git a/audio/common/2.0/default/OWNERS b/audio/common/2.0/default/OWNERS
new file mode 100644
index 0000000..6fdc97c
--- /dev/null
+++ b/audio/common/2.0/default/OWNERS
@@ -0,0 +1,3 @@
+elaurent@google.com
+krocard@google.com
+mnaganov@google.com
diff --git a/audio/common/4.0/default/OWNERS b/audio/common/4.0/default/OWNERS
new file mode 100644
index 0000000..6fdc97c
--- /dev/null
+++ b/audio/common/4.0/default/OWNERS
@@ -0,0 +1,3 @@
+elaurent@google.com
+krocard@google.com
+mnaganov@google.com
diff --git a/audio/core/4.0/default/OWNERS b/audio/core/4.0/default/OWNERS
new file mode 100644
index 0000000..6fdc97c
--- /dev/null
+++ b/audio/core/4.0/default/OWNERS
@@ -0,0 +1,3 @@
+elaurent@google.com
+krocard@google.com
+mnaganov@google.com
diff --git a/audio/effect/4.0/default/OWNERS b/audio/effect/4.0/default/OWNERS
new file mode 100644
index 0000000..6fdc97c
--- /dev/null
+++ b/audio/effect/4.0/default/OWNERS
@@ -0,0 +1,3 @@
+elaurent@google.com
+krocard@google.com
+mnaganov@google.com
diff --git a/authsecret/1.0/vts/functional/VtsHalAuthSecretV1_0TargetTest.cpp b/authsecret/1.0/vts/functional/VtsHalAuthSecretV1_0TargetTest.cpp
index a610a75..255d4de 100644
--- a/authsecret/1.0/vts/functional/VtsHalAuthSecretV1_0TargetTest.cpp
+++ b/authsecret/1.0/vts/functional/VtsHalAuthSecretV1_0TargetTest.cpp
@@ -17,18 +17,35 @@
 #include <android/hardware/authsecret/1.0/IAuthSecret.h>
 
 #include <VtsHalHidlTargetTestBase.h>
+#include <VtsHalHidlTargetTestEnvBase.h>
 
 using ::android::hardware::hidl_vec;
 using ::android::hardware::authsecret::V1_0::IAuthSecret;
 using ::android::sp;
 
+// Test environment for Boot HIDL HAL.
+class AuthSecretHidlEnvironment : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static AuthSecretHidlEnvironment* Instance() {
+        static AuthSecretHidlEnvironment* instance = new AuthSecretHidlEnvironment;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IAuthSecret>(); }
+
+   private:
+    AuthSecretHidlEnvironment() {}
+};
+
 /**
  * There is no expected behaviour that can be tested so these tests check the
  * HAL doesn't crash with different execution orders.
  */
 struct AuthSecretHidlTest : public ::testing::VtsHalHidlTargetTestBase {
     virtual void SetUp() override {
-        authsecret = ::testing::VtsHalHidlTargetTestBase::getService<IAuthSecret>();
+        authsecret = ::testing::VtsHalHidlTargetTestBase::getService<IAuthSecret>(
+            AuthSecretHidlEnvironment::Instance()->getServiceName<IAuthSecret>());
         ASSERT_NE(authsecret, nullptr);
 
         // All tests must enroll the correct secret first as this cannot be changed
@@ -69,3 +86,12 @@
     // Secret provisioned by SetUp()
     authsecret->primaryUserCredential(WRONG_SECRET);
 }
+
+int main(int argc, char** argv) {
+    ::testing::AddGlobalTestEnvironment(AuthSecretHidlEnvironment::Instance());
+    ::testing::InitGoogleTest(&argc, argv);
+    AuthSecretHidlEnvironment::Instance()->init(&argc, argv);
+    int status = RUN_ALL_TESTS();
+    ALOGI("Test result = %d", status);
+    return status;
+}
diff --git a/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp b/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
index b9f505d..bf8b547 100644
--- a/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
+++ b/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
@@ -90,13 +90,15 @@
 #define EVENT_NUMBER_OF_COMPLETED_PACKETS_NUM_HANDLES 2
 
 #define ACL_BROADCAST_FLAG_OFFSET 6
-#define ACL_BROADCAST_FLAG_ACTIVE_SLAVE 0x1
-#define ACL_BROADCAST_ACTIVE_SLAVE (ACL_BROADCAST_FLAG_ACTIVE_SLAVE << ACL_BROADCAST_FLAG_OFFSET)
+#define ACL_BROADCAST_FLAG_POINT_TO_POINT 0x0
+#define ACL_BROADCAST_POINT_TO_POINT \
+  (ACL_BROADCAST_FLAG_POINT_TO_POINT << ACL_BROADCAST_FLAG_OFFSET)
 
 #define ACL_PACKET_BOUNDARY_FLAG_OFFSET 4
-#define ACL_PACKET_BOUNDARY_FLAG_COMPLETE 0x3
-#define ACL_PACKET_BOUNDARY_COMPLETE \
-    (ACL_PACKET_BOUNDARY_FLAG_COMPLETE << ACL_PACKET_BOUNDARY_FLAG_OFFSET)
+#define ACL_PACKET_BOUNDARY_FLAG_FIRST_AUTO_FLUSHABLE 0x2
+#define ACL_PACKET_BOUNDARY_FIRST_AUTO_FLUSHABLE \
+  (ACL_PACKET_BOUNDARY_FLAG_FIRST_AUTO_FLUSHABLE \
+   << ACL_PACKET_BOUNDARY_FLAG_OFFSET)
 
 constexpr char kCallbackNameAclEventReceived[] = "aclDataReceived";
 constexpr char kCallbackNameHciEventReceived[] = "hciEventReceived";
@@ -189,6 +191,7 @@
 
   virtual void TearDown() override {
     bluetooth->close();
+    handle_no_ops();
     EXPECT_EQ(static_cast<size_t>(0), event_queue.size());
     EXPECT_EQ(static_cast<size_t>(0), sco_queue.size());
     EXPECT_EQ(static_cast<size_t>(0), acl_queue.size());
@@ -204,6 +207,8 @@
   // Helper functions to try to get a handle on verbosity
   void enterLoopbackMode(std::vector<uint16_t>& sco_handles,
                          std::vector<uint16_t>& acl_handles);
+  void handle_no_ops();
+  void wait_for_event(bool timeout_is_error);
   void wait_for_command_complete_event(hidl_vec<uint8_t> cmd);
   int wait_for_completed_packets_event(uint16_t handle);
 
@@ -269,31 +274,50 @@
   int max_sco_data_packets;
 };
 
-// Receive and check status events until a COMMAND_COMPLETE is received.
-void BluetoothHidlTest::wait_for_command_complete_event(hidl_vec<uint8_t> cmd) {
-  // Allow intermediate COMMAND_STATUS events
-  int status_event_count = 0;
+// Discard NO-OPs from the event queue.
+void BluetoothHidlTest::handle_no_ops() {
+  while (event_queue.size() > 0) {
+    hidl_vec<uint8_t> event = event_queue.front();
+    EXPECT_GE(event.size(),
+              static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
+    bool event_is_no_op =
+        (event[EVENT_CODE_BYTE] == EVENT_COMMAND_COMPLETE) &&
+        (event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE] == 0x00) &&
+        (event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1] == 0x00);
+    event_is_no_op |= (event[EVENT_CODE_BYTE] == EVENT_COMMAND_STATUS) &&
+                      (event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE] == 0x00) &&
+                      (event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1] == 0x00);
+    if (event_is_no_op) {
+      event_queue.pop();
+    } else {
+      return;
+    }
+  }
+}
+
+// Receive an event, discarding NO-OPs.
+void BluetoothHidlTest::wait_for_event(bool timeout_is_error = true) {
   hidl_vec<uint8_t> event;
   do {
-      EXPECT_TRUE(bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived)
-                      .no_timeout);
+    bool no_timeout =
+        bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived).no_timeout;
+    EXPECT_TRUE(no_timeout || !timeout_is_error);
+    if (no_timeout && timeout_is_error) {
       EXPECT_LT(static_cast<size_t>(0), event_queue.size());
-      if (event_queue.size() == 0) {
-          event.resize(0);
-          break;
     }
-    event = event_queue.front();
-    event_queue.pop();
-    EXPECT_GT(event.size(),
-              static_cast<size_t>(EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1));
-    if (event[EVENT_CODE_BYTE] == EVENT_COMMAND_STATUS) {
-      EXPECT_EQ(EVENT_COMMAND_STATUS_LENGTH, event[EVENT_LENGTH_BYTE]);
-      EXPECT_EQ(cmd[0], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE]);
-      EXPECT_EQ(cmd[1], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1]);
-      EXPECT_EQ(event[EVENT_COMMAND_STATUS_STATUS_BYTE], HCI_STATUS_SUCCESS);
-      status_event_count++;
+    if (event_queue.size() == 0) {
+      // WaitForCallback timed out.
+      return;
     }
-  } while (event.size() > 0 && event[EVENT_CODE_BYTE] == EVENT_COMMAND_STATUS);
+    handle_no_ops();
+  } while (event_queue.size() == 0);
+}
+
+// Wait until a COMMAND_COMPLETE is received.
+void BluetoothHidlTest::wait_for_command_complete_event(hidl_vec<uint8_t> cmd) {
+  wait_for_event();
+  hidl_vec<uint8_t> event = event_queue.front();
+  event_queue.pop();
 
   EXPECT_GT(event.size(),
             static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
@@ -308,10 +332,7 @@
   hidl_vec<uint8_t> cmd = COMMAND_HCI_READ_BUFFER_SIZE;
   bluetooth->sendHciCommand(cmd);
 
-  EXPECT_TRUE(
-      bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived).no_timeout);
-
-  EXPECT_LT(static_cast<size_t>(0), event_queue.size());
+  wait_for_event();
   if (event_queue.size() == 0) return;
 
   hidl_vec<uint8_t> event = event_queue.front();
@@ -341,6 +362,7 @@
 // Send an HCI command (in Loopback mode) and check the response.
 void BluetoothHidlTest::sendAndCheckHCI(int num_packets) {
   ThroughputLogger logger = {__func__};
+  int command_size = 0;
   for (int n = 0; n < num_packets; n++) {
     // Send an HCI packet
     std::vector<uint8_t> write_name = COMMAND_HCI_WRITE_LOCAL_NAME;
@@ -350,11 +372,9 @@
     for (size_t i = 0; i < new_name_length; i++)
       write_name.push_back(static_cast<uint8_t>(new_name[i]));
     // And the packet number
-    {
-      size_t i = new_name_length - 1;
-      for (int digits = n; digits > 0; digits = digits / 10, i--)
-        write_name[i] = static_cast<uint8_t>('0' + digits % 10);
-    }
+    size_t i = new_name_length - 1;
+    for (int digits = n; digits > 0; digits = digits / 10, i--)
+      write_name[i] = static_cast<uint8_t>('0' + digits % 10);
     // And padding
     for (size_t i = 0; i < 248 - new_name_length; i++)
       write_name.push_back(static_cast<uint8_t>(0));
@@ -363,8 +383,9 @@
     bluetooth->sendHciCommand(cmd);
 
     // Check the loopback of the HCI packet
-    EXPECT_TRUE(bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived)
-                    .no_timeout);
+    wait_for_event();
+    if (event_queue.size() == 0) return;
+
     hidl_vec<uint8_t> event = event_queue.front();
     event_queue.pop();
     size_t compare_length =
@@ -374,11 +395,21 @@
 
     EXPECT_EQ(EVENT_LOOPBACK_COMMAND, event[EVENT_CODE_BYTE]);
     EXPECT_EQ(compare_length, event[EVENT_LENGTH_BYTE]);
-    if (n == 0) logger.setTotalBytes(cmd.size() * num_packets * 2);
+
+    // Don't compare past the end of the event.
+    if (compare_length + EVENT_FIRST_PAYLOAD_BYTE > event.size()) {
+      compare_length = event.size() - EVENT_FIRST_PAYLOAD_BYTE;
+      ALOGE("Only comparing %d bytes", static_cast<int>(compare_length));
+    }
+
+    if (n == num_packets - 1) {
+      command_size = cmd.size();
+    }
 
     for (size_t i = 0; i < compare_length; i++)
       EXPECT_EQ(cmd[i], event[EVENT_FIRST_PAYLOAD_BYTE + i]);
   }
+  logger.setTotalBytes(command_size * num_packets * 2);
 }
 
 // Send a SCO data packet (in Loopback mode) and check the response.
@@ -408,8 +439,6 @@
     EXPECT_EQ(sco_packet.size(), sco_loopback.size());
     size_t successful_bytes = 0;
 
-    if (n == 0) logger.setTotalBytes(num_packets * size * 2);
-
     for (size_t i = 0; i < sco_packet.size(); i++) {
       if (sco_packet[i] == sco_loopback[i]) {
         successful_bytes = i;
@@ -423,6 +452,7 @@
     }
     EXPECT_EQ(sco_packet.size(), successful_bytes + 1);
   }
+  logger.setTotalBytes(num_packets * size * 2);
 }
 
 // Send an ACL data packet (in Loopback mode) and check the response.
@@ -435,8 +465,8 @@
     std::vector<uint8_t> acl_vector;
     acl_vector.push_back(static_cast<uint8_t>(handle & 0xff));
     acl_vector.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8) |
-                         ACL_BROADCAST_ACTIVE_SLAVE |
-                         ACL_PACKET_BOUNDARY_COMPLETE);
+                         ACL_BROADCAST_POINT_TO_POINT |
+                         ACL_PACKET_BOUNDARY_FIRST_AUTO_FLUSHABLE);
     acl_vector.push_back(static_cast<uint8_t>(size & 0xff));
     acl_vector.push_back(static_cast<uint8_t>((size & 0xff00) >> 8));
     for (size_t i = 0; i < size; i++) {
@@ -454,8 +484,6 @@
     EXPECT_EQ(acl_packet.size(), acl_loopback.size());
     size_t successful_bytes = 0;
 
-    if (n == 0) logger.setTotalBytes(num_packets * size * 2);
-
     for (size_t i = 0; i < acl_packet.size(); i++) {
       if (acl_packet[i] == acl_loopback[i]) {
         successful_bytes = i;
@@ -469,25 +497,28 @@
     }
     EXPECT_EQ(acl_packet.size(), successful_bytes + 1);
   }
+  logger.setTotalBytes(num_packets * size * 2);
 }
 
 // Return the number of completed packets reported by the controller.
 int BluetoothHidlTest::wait_for_completed_packets_event(uint16_t handle) {
-    if (!bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived).no_timeout) {
-        ALOGW("%s: WaitForCallback timed out.", __func__);
-    }
-    int packets_processed = 0;
-    while (event_queue.size() > 0) {
-        hidl_vec<uint8_t> event = event_queue.front();
-        event_queue.pop();
+  int packets_processed = 0;
+  wait_for_event(false);
+  if (event_queue.size() == 0) {
+    ALOGW("%s: WaitForCallback timed out.", __func__);
+    return packets_processed;
+  }
+  while (event_queue.size() > 0) {
+    hidl_vec<uint8_t> event = event_queue.front();
+    event_queue.pop();
 
-        EXPECT_EQ(EVENT_NUMBER_OF_COMPLETED_PACKETS, event[EVENT_CODE_BYTE]);
-        EXPECT_EQ(1, event[EVENT_NUMBER_OF_COMPLETED_PACKETS_NUM_HANDLES]);
+    EXPECT_EQ(EVENT_NUMBER_OF_COMPLETED_PACKETS, event[EVENT_CODE_BYTE]);
+    EXPECT_EQ(1, event[EVENT_NUMBER_OF_COMPLETED_PACKETS_NUM_HANDLES]);
 
-        uint16_t event_handle = event[3] + (event[4] << 8);
-        EXPECT_EQ(handle, event_handle);
+    uint16_t event_handle = event[3] + (event[4] << 8);
+    EXPECT_EQ(handle, event_handle);
 
-        packets_processed += event[5] + (event[6] << 8);
+    packets_processed += event[5] + (event[6] << 8);
   }
   return packets_processed;
 }
@@ -500,45 +531,48 @@
 
   // Receive connection complete events with data channels
   int connection_event_count = 0;
-  hidl_vec<uint8_t> event;
-  do {
-      EXPECT_TRUE(bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived)
-                      .no_timeout);
-      event = event_queue.front();
-      event_queue.pop();
-      EXPECT_GT(event.size(),
-                static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
-      if (event[EVENT_CODE_BYTE] == EVENT_CONNECTION_COMPLETE) {
-          EXPECT_GT(event.size(),
-                    static_cast<size_t>(EVENT_CONNECTION_COMPLETE_TYPE));
-          EXPECT_EQ(event[EVENT_LENGTH_BYTE],
-                    EVENT_CONNECTION_COMPLETE_PARAM_LENGTH);
-          uint8_t connection_type = event[EVENT_CONNECTION_COMPLETE_TYPE];
-
-          EXPECT_TRUE(connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO ||
-                      connection_type == EVENT_CONNECTION_COMPLETE_TYPE_ACL);
-
-          // Save handles
-          uint16_t handle = event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE] |
-                            event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE + 1]
-                                << 8;
-          if (connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO)
-              sco_handles.push_back(handle);
-          else
-              acl_handles.push_back(handle);
-
-          ALOGD("Connect complete type = %d handle = %d",
-                event[EVENT_CONNECTION_COMPLETE_TYPE], handle);
-          connection_event_count++;
+  bool command_complete_received = false;
+  while (true) {
+    wait_for_event(false);
+    if (event_queue.size() == 0) {
+      // Fail if there was no event received or no connections completed.
+      EXPECT_TRUE(command_complete_received);
+      EXPECT_LT(0, connection_event_count);
+      return;
     }
-  } while (event[EVENT_CODE_BYTE] == EVENT_CONNECTION_COMPLETE);
+    hidl_vec<uint8_t> event = event_queue.front();
+    event_queue.pop();
+    EXPECT_GT(event.size(),
+              static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
+    if (event[EVENT_CODE_BYTE] == EVENT_CONNECTION_COMPLETE) {
+      EXPECT_GT(event.size(),
+                static_cast<size_t>(EVENT_CONNECTION_COMPLETE_TYPE));
+      EXPECT_EQ(event[EVENT_LENGTH_BYTE],
+                EVENT_CONNECTION_COMPLETE_PARAM_LENGTH);
+      uint8_t connection_type = event[EVENT_CONNECTION_COMPLETE_TYPE];
 
-  EXPECT_GT(connection_event_count, 0);
+      EXPECT_TRUE(connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO ||
+                  connection_type == EVENT_CONNECTION_COMPLETE_TYPE_ACL);
 
-  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
-  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
-  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
-  EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+      // Save handles
+      uint16_t handle = event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE] |
+                        event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE + 1] << 8;
+      if (connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO)
+        sco_handles.push_back(handle);
+      else
+        acl_handles.push_back(handle);
+
+      ALOGD("Connect complete type = %d handle = %d",
+            event[EVENT_CONNECTION_COMPLETE_TYPE], handle);
+      connection_event_count++;
+    } else {
+      EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+      EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+      EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+      EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+      command_complete_received = true;
+    }
+  }
 }
 
 // Empty test: Initialize()/Close() are called in SetUp()/TearDown().
@@ -557,8 +591,8 @@
   hidl_vec<uint8_t> cmd = COMMAND_HCI_READ_LOCAL_VERSION_INFORMATION;
   bluetooth->sendHciCommand(cmd);
 
-  EXPECT_TRUE(
-      bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived).no_timeout);
+  wait_for_event();
+  if (event_queue.size() == 0) return;
 
   hidl_vec<uint8_t> event = event_queue.front();
   event_queue.pop();
@@ -578,19 +612,26 @@
   hidl_vec<uint8_t> cmd = COMMAND_HCI_SHOULD_BE_UNKNOWN;
   bluetooth->sendHciCommand(cmd);
 
-  EXPECT_TRUE(
-      bluetooth_cb->WaitForCallback(kCallbackNameHciEventReceived).no_timeout);
+  wait_for_event();
+  if (event_queue.size() == 0) return;
 
   hidl_vec<uint8_t> event = event_queue.front();
   event_queue.pop();
-  EXPECT_GT(event.size(),
-            static_cast<size_t>(EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1));
 
-  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
-  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
-  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
-  EXPECT_EQ(HCI_STATUS_UNKNOWN_HCI_COMMAND,
-            event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+  EXPECT_GT(event.size(),
+            static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
+  if (event[EVENT_CODE_BYTE] == EVENT_COMMAND_COMPLETE) {
+    EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+    EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+    EXPECT_EQ(HCI_STATUS_UNKNOWN_HCI_COMMAND,
+              event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+  } else {
+    EXPECT_EQ(EVENT_COMMAND_STATUS, event[EVENT_CODE_BYTE]);
+    EXPECT_EQ(cmd[0], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE]);
+    EXPECT_EQ(cmd[1], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1]);
+    EXPECT_EQ(HCI_STATUS_UNKNOWN_HCI_COMMAND,
+              event[EVENT_COMMAND_STATUS_STATUS_BYTE]);
+  }
 }
 
 // Enter loopback mode, but don't send any packets.
@@ -603,8 +644,6 @@
 // Enter loopback mode and send single packets.
 TEST_F(BluetoothHidlTest, LoopbackModeSinglePackets) {
   setBufferSizes();
-  EXPECT_LT(0, max_sco_data_packet_length);
-  EXPECT_LT(0, max_acl_data_packet_length);
 
   std::vector<uint16_t> sco_connection_handles;
   std::vector<uint16_t> acl_connection_handles;
@@ -615,6 +654,7 @@
   // This should work, but breaks on some current platforms.  Figure out how to
   // grandfather older devices but test new ones.
   if (0 && sco_connection_handles.size() > 0) {
+    EXPECT_LT(0, max_sco_data_packet_length);
     sendAndCheckSCO(1, max_sco_data_packet_length, sco_connection_handles[0]);
     int sco_packets_sent = 1;
     int completed_packets = wait_for_completed_packets_event(sco_connection_handles[0]);
@@ -625,6 +665,7 @@
   }
 
   if (acl_connection_handles.size() > 0) {
+    EXPECT_LT(0, max_acl_data_packet_length);
     sendAndCheckACL(1, max_acl_data_packet_length, acl_connection_handles[0]);
     int acl_packets_sent = 1;
     int completed_packets = wait_for_completed_packets_event(acl_connection_handles[0]);
@@ -648,6 +689,7 @@
   // This should work, but breaks on some current platforms.  Figure out how to
   // grandfather older devices but test new ones.
   if (0 && sco_connection_handles.size() > 0) {
+    EXPECT_LT(0, max_sco_data_packet_length);
     sendAndCheckSCO(NUM_SCO_PACKETS_BANDWIDTH, max_sco_data_packet_length,
                     sco_connection_handles[0]);
     int sco_packets_sent = NUM_SCO_PACKETS_BANDWIDTH;
@@ -659,6 +701,7 @@
   }
 
   if (acl_connection_handles.size() > 0) {
+    EXPECT_LT(0, max_acl_data_packet_length);
     sendAndCheckACL(NUM_ACL_PACKETS_BANDWIDTH, max_acl_data_packet_length,
                     acl_connection_handles[0]);
     int acl_packets_sent = NUM_ACL_PACKETS_BANDWIDTH;
diff --git a/camera/common/1.0/default/VendorTagDescriptor.cpp b/camera/common/1.0/default/VendorTagDescriptor.cpp
index bc18270..1f53857 100644
--- a/camera/common/1.0/default/VendorTagDescriptor.cpp
+++ b/camera/common/1.0/default/VendorTagDescriptor.cpp
@@ -116,11 +116,11 @@
 }
 
 int VendorTagDescriptor::getTagType(uint32_t tag) const {
-    ssize_t index = mTagToNameMap.indexOfKey(tag);
-    if (index < 0) {
+    auto iter = mTagToTypeMap.find(tag);
+    if (iter == mTagToTypeMap.end()) {
         return VENDOR_TAG_TYPE_ERR;
     }
-    return mTagToTypeMap.valueFor(tag);
+    return iter->second;
 }
 
 const SortedVector<String8>* VendorTagDescriptor::getAllSectionNames() const {
@@ -167,7 +167,7 @@
         String8 name = mTagToNameMap.valueAt(i);
         uint32_t sectionId = mTagToSectionMap.valueFor(tag);
         String8 sectionName = mSections[sectionId];
-        int type = mTagToTypeMap.valueFor(tag);
+        int type = mTagToTypeMap.at(tag);
         const char* typeName = (type >= 0 && type < NUM_TYPES) ?
                 camera_metadata_type_names[type] : "UNKNOWN";
         dprintf(fd, "%*s0x%x (%s) with type %d (%s) defined in section %s\n", indentation + 2,
@@ -251,7 +251,7 @@
             ALOGE("%s: tag type %d from vendor ops does not exist.", __FUNCTION__, tagType);
             return BAD_VALUE;
         }
-        desc->mTagToTypeMap.add(tag, tagType);
+        desc->mTagToTypeMap.insert(std::make_pair(tag, tagType));
     }
 
     desc->mSections = sections;
diff --git a/camera/common/1.0/default/include/VendorTagDescriptor.h b/camera/common/1.0/default/include/VendorTagDescriptor.h
index 8d8ded9..a040540 100644
--- a/camera/common/1.0/default/include/VendorTagDescriptor.h
+++ b/camera/common/1.0/default/include/VendorTagDescriptor.h
@@ -24,6 +24,7 @@
 #include <system/camera_vendor_tags.h>
 
 #include <stdint.h>
+#include <unordered_map>
 
 namespace android {
 namespace hardware {
@@ -94,7 +95,8 @@
         KeyedVector<String8, KeyedVector<String8, uint32_t>*> mReverseMapping;
         KeyedVector<uint32_t, String8> mTagToNameMap;
         KeyedVector<uint32_t, uint32_t> mTagToSectionMap; // Value is offset in mSections
-        KeyedVector<uint32_t, int32_t> mTagToTypeMap;
+
+        std::unordered_map<uint32_t, int32_t> mTagToTypeMap;
         SortedVector<String8> mSections;
         // must be int32_t to be compatible with Parcel::writeInt32
         int32_t mTagCount;
diff --git a/camera/device/3.4/default/CameraDeviceSession.cpp b/camera/device/3.4/default/CameraDeviceSession.cpp
index bb4886d..b032357 100644
--- a/camera/device/3.4/default/CameraDeviceSession.cpp
+++ b/camera/device/3.4/default/CameraDeviceSession.cpp
@@ -107,7 +107,6 @@
 
     const camera_metadata_t *paramBuffer = nullptr;
     if (0 < requestedConfiguration.sessionParams.size()) {
-        ::android::hardware::camera::common::V1_0::helper::CameraMetadata sessionParams;
         V3_2::implementation::convertFromHidl(requestedConfiguration.sessionParams, &paramBuffer);
     }
 
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index 14f82bc..9a02ce8 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -638,12 +638,6 @@
         }
     }
 
-    // The document in aeAvailableTargetFpsRanges section says the minFps should
-    // not be larger than 15.
-    // We cannot support fixed 30fps but Android requires (min, max) and
-    // (max, max) ranges.
-    // TODO: populate more, right now this does not support 30,30 if the device
-    //       has higher than 30 fps modes
     std::vector<int32_t> fpsRanges;
     // Variable range
     fpsRanges.push_back(minFps);
@@ -693,7 +687,7 @@
 #undef UPDATE
 
 void ExternalCameraDevice::getFrameRateList(
-        int fd, float fpsUpperBound, SupportedV4L2Format* format) {
+        int fd, double fpsUpperBound, SupportedV4L2Format* format) {
     format->frameRates.clear();
 
     v4l2_frmivalenum frameInterval {
@@ -715,7 +709,7 @@
                 if (framerate > fpsUpperBound) {
                     continue;
                 }
-                ALOGI("index:%d, format:%c%c%c%c, w %d, h %d, framerate %f",
+                ALOGV("index:%d, format:%c%c%c%c, w %d, h %d, framerate %f",
                     frameInterval.index,
                     frameInterval.pixel_format & 0xFF,
                     (frameInterval.pixel_format >> 8) & 0xFF,
@@ -738,71 +732,68 @@
     }
 }
 
-CroppingType ExternalCameraDevice::initCroppingType(
-        /*inout*/std::vector<SupportedV4L2Format>* pSortedFmts) {
-    std::vector<SupportedV4L2Format>& sortedFmts = *pSortedFmts;
+void ExternalCameraDevice::trimSupportedFormats(
+        CroppingType cropType,
+        /*inout*/std::vector<SupportedV4L2Format>* pFmts) {
+    std::vector<SupportedV4L2Format>& sortedFmts = *pFmts;
+    if (cropType == VERTICAL) {
+        std::sort(sortedFmts.begin(), sortedFmts.end(),
+                [](const SupportedV4L2Format& a, const SupportedV4L2Format& b) -> bool {
+                    if (a.width == b.width) {
+                        return a.height < b.height;
+                    }
+                    return a.width < b.width;
+                });
+    } else {
+        std::sort(sortedFmts.begin(), sortedFmts.end(),
+                [](const SupportedV4L2Format& a, const SupportedV4L2Format& b) -> bool {
+                    if (a.height == b.height) {
+                        return a.width < b.width;
+                    }
+                    return a.height < b.height;
+                });
+    }
+
+    if (sortedFmts.size() == 0) {
+        ALOGE("%s: input format list is empty!", __FUNCTION__);
+        return;
+    }
+
     const auto& maxSize = sortedFmts[sortedFmts.size() - 1];
     float maxSizeAr = ASPECT_RATIO(maxSize);
-    float minAr = kMaxAspectRatio;
-    float maxAr = kMinAspectRatio;
+
+    // Remove formats that has aspect ratio not croppable from largest size
+    std::vector<SupportedV4L2Format> out;
     for (const auto& fmt : sortedFmts) {
         float ar = ASPECT_RATIO(fmt);
-        if (ar < minAr) {
-            minAr = ar;
-        }
-        if (ar > maxAr) {
-            maxAr = ar;
-        }
-    }
-
-    CroppingType ct = VERTICAL;
-    if (isAspectRatioClose(maxSizeAr, maxAr)) {
-        // Ex: 16:9 sensor, cropping horizontally to get to 4:3
-        ct = HORIZONTAL;
-    } else if (isAspectRatioClose(maxSizeAr, minAr)) {
-        // Ex: 4:3 sensor, cropping vertically to get to 16:9
-        ct = VERTICAL;
-    } else {
-        ALOGI("%s: camera maxSizeAr %f is not close to minAr %f or maxAr %f",
-                __FUNCTION__, maxSizeAr, minAr, maxAr);
-        if ((maxSizeAr - minAr) < (maxAr - maxSizeAr)) {
-            ct = VERTICAL;
+        if (isAspectRatioClose(ar, maxSizeAr)) {
+            out.push_back(fmt);
+        } else if (cropType == HORIZONTAL && ar < maxSizeAr) {
+            out.push_back(fmt);
+        } else if (cropType == VERTICAL && ar > maxSizeAr) {
+            out.push_back(fmt);
         } else {
-            ct = HORIZONTAL;
+            ALOGV("%s: size (%d,%d) is removed due to unable to crop %s from (%d,%d)",
+                __FUNCTION__, fmt.width, fmt.height,
+                cropType == VERTICAL ? "vertically" : "horizontally",
+                maxSize.width, maxSize.height);
         }
-
-        // Remove formats that has aspect ratio not croppable from largest size
-        std::vector<SupportedV4L2Format> out;
-        for (const auto& fmt : sortedFmts) {
-            float ar = ASPECT_RATIO(fmt);
-            if (isAspectRatioClose(ar, maxSizeAr)) {
-                out.push_back(fmt);
-            } else if (ct == HORIZONTAL && ar < maxSizeAr) {
-                out.push_back(fmt);
-            } else if (ct == VERTICAL && ar > maxSizeAr) {
-                out.push_back(fmt);
-            } else {
-                ALOGD("%s: size (%d,%d) is removed due to unable to crop %s from (%d,%d)",
-                    __FUNCTION__, fmt.width, fmt.height,
-                    ct == VERTICAL ? "vertically" : "horizontally",
-                    maxSize.width, maxSize.height);
-            }
-        }
-        sortedFmts = out;
     }
-    ALOGI("%s: camera croppingType is %s", __FUNCTION__,
-            ct == VERTICAL ? "VERTICAL" : "HORIZONTAL");
-    return ct;
+    sortedFmts = out;
 }
 
-void ExternalCameraDevice::initSupportedFormatsLocked(int fd) {
+std::vector<SupportedV4L2Format>
+ExternalCameraDevice::getCandidateSupportedFormatsLocked(
+        int fd, CroppingType cropType,
+        const std::vector<ExternalCameraConfig::FpsLimitation>& fpsLimits) {
+    std::vector<SupportedV4L2Format> outFmts;
     struct v4l2_fmtdesc fmtdesc {
         .index = 0,
         .type = V4L2_BUF_TYPE_VIDEO_CAPTURE};
     int ret = 0;
     while (ret == 0) {
         ret = TEMP_FAILURE_RETRY(ioctl(fd, VIDIOC_ENUM_FMT, &fmtdesc));
-        ALOGD("index:%d,ret:%d, format:%c%c%c%c", fmtdesc.index, ret,
+        ALOGV("index:%d,ret:%d, format:%c%c%c%c", fmtdesc.index, ret,
                 fmtdesc.pixelformat & 0xFF,
                 (fmtdesc.pixelformat >> 8) & 0xFF,
                 (fmtdesc.pixelformat >> 16) & 0xFF,
@@ -835,13 +826,20 @@
                             .fourcc = fmtdesc.pixelformat
                         };
 
-                        float fpsUpperBound = -1.0;
-                        for (const auto& limit : mCfg.fpsLimits) {
-                            if (format.width <= limit.size.width &&
-                                    format.height <= limit.size.height) {
-                                fpsUpperBound = limit.fpsUpperBound;
-                                break;
+                        double fpsUpperBound = -1.0;
+                        for (const auto& limit : fpsLimits) {
+                            if (cropType == VERTICAL) {
+                                if (format.width <= limit.size.width) {
+                                    fpsUpperBound = limit.fpsUpperBound;
+                                    break;
+                                }
+                            } else { // HORIZONTAL
+                                if (format.height <= limit.size.height) {
+                                    fpsUpperBound = limit.fpsUpperBound;
+                                    break;
+                                }
                             }
+
                         }
                         if (fpsUpperBound < 0.f) {
                             continue;
@@ -849,7 +847,7 @@
 
                         getFrameRateList(fd, fpsUpperBound, &format);
                         if (!format.frameRates.empty()) {
-                            mSupportedFormats.push_back(format);
+                            outFmts.push_back(format);
                         }
                     }
                 }
@@ -857,16 +855,66 @@
         }
         fmtdesc.index++;
     }
+    trimSupportedFormats(cropType, &outFmts);
+    return outFmts;
+}
 
-    std::sort(mSupportedFormats.begin(), mSupportedFormats.end(),
-            [](const SupportedV4L2Format& a, const SupportedV4L2Format& b) -> bool {
-                if (a.width == b.width) {
-                    return a.height < b.height;
-                }
-                return a.width < b.width;
-            });
+void ExternalCameraDevice::initSupportedFormatsLocked(int fd) {
 
-    mCroppingType = initCroppingType(&mSupportedFormats);
+    std::vector<SupportedV4L2Format> horizontalFmts =
+            getCandidateSupportedFormatsLocked(fd, HORIZONTAL, mCfg.fpsLimits);
+    std::vector<SupportedV4L2Format> verticalFmts =
+            getCandidateSupportedFormatsLocked(fd, VERTICAL, mCfg.fpsLimits);
+
+    size_t horiSize = horizontalFmts.size();
+    size_t vertSize = verticalFmts.size();
+
+    if (horiSize == 0 && vertSize == 0) {
+        ALOGE("%s: cannot find suitable cropping type!", __FUNCTION__);
+        return;
+    }
+
+    if (horiSize == 0) {
+        mSupportedFormats = verticalFmts;
+        mCroppingType = VERTICAL;
+        return;
+    } else if (vertSize == 0) {
+        mSupportedFormats = horizontalFmts;
+        mCroppingType = HORIZONTAL;
+        return;
+    }
+
+    const auto& maxHoriSize = horizontalFmts[horizontalFmts.size() - 1];
+    const auto& maxVertSize = verticalFmts[verticalFmts.size() - 1];
+
+    // Try to keep largest possible output size
+    // When they are the same or ambiguous, pick the one support more sizes
+    if (maxHoriSize.width == maxVertSize.width &&
+            maxHoriSize.height == maxVertSize.height) {
+        if (horiSize > vertSize) {
+            mSupportedFormats = horizontalFmts;
+            mCroppingType = HORIZONTAL;
+        } else {
+            mSupportedFormats = verticalFmts;
+            mCroppingType = VERTICAL;
+        }
+    } else if (maxHoriSize.width >= maxVertSize.width &&
+            maxHoriSize.height >= maxVertSize.height) {
+        mSupportedFormats = horizontalFmts;
+        mCroppingType = HORIZONTAL;
+    } else if (maxHoriSize.width <= maxVertSize.width &&
+            maxHoriSize.height <= maxVertSize.height) {
+        mSupportedFormats = verticalFmts;
+        mCroppingType = VERTICAL;
+    } else {
+        if (horiSize > vertSize) {
+            mSupportedFormats = horizontalFmts;
+            mCroppingType = HORIZONTAL;
+        } else {
+            mSupportedFormats = verticalFmts;
+            mCroppingType = VERTICAL;
+        }
+    }
 }
 
 }  // namespace implementation
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index 5346f80..5569439 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -15,6 +15,7 @@
  */
 #define LOG_TAG "ExtCamDevSsn@3.4"
 //#define LOG_NDEBUG 0
+#define ATRACE_TAG ATRACE_TAG_CAMERA
 #include <log/log.h>
 
 #include <inttypes.h>
@@ -22,6 +23,7 @@
 
 #include "android-base/macros.h"
 #include <utils/Timers.h>
+#include <utils/Trace.h>
 #include <linux/videodev2.h>
 #include <sync/sync.h>
 
@@ -160,7 +162,6 @@
     SupportedV4L2Format streamingFmt;
     std::unordered_set<uint32_t>  inflightFrames;
     {
-        Mutex::Autolock _l(mLock);
         bool sessionLocked = tryLock(mLock);
         if (!sessionLocked) {
             dprintf(fd, "!! ExternalCameraDeviceSession mLock may be deadlocked !!\n");
@@ -180,12 +181,13 @@
             streaming ? "streaming" : "not streaming");
     if (streaming) {
         // TODO: dump fps later
-        dprintf(fd, "Current V4L2 format %c%c%c%c %dx%d\n",
+        dprintf(fd, "Current V4L2 format %c%c%c%c %dx%d @ %ffps\n",
                 streamingFmt.fourcc & 0xFF,
                 (streamingFmt.fourcc >> 8) & 0xFF,
                 (streamingFmt.fourcc >> 16) & 0xFF,
                 (streamingFmt.fourcc >> 24) & 0xFF,
-                streamingFmt.width, streamingFmt.height);
+                streamingFmt.width, streamingFmt.height,
+                mV4l2StreamingFps);
 
         size_t numDequeuedV4l2Buffers = 0;
         {
@@ -291,7 +293,6 @@
         config_v32.streams[i] = requestedConfiguration.streams[i].v3_2;
     }
 
-    // Ignore requestedConfiguration.sessionParams. External camera does not support it
     Status status = configureStreams(config_v32, &outStreams_v33);
 
     V3_4::HalStreamConfiguration outStreams;
@@ -358,6 +359,7 @@
 }
 
 Return<Status> ExternalCameraDeviceSession::flush() {
+    ATRACE_CALL();
     Mutex::Autolock _il(mInterfaceLock);
     Status status = initStatus();
     if (status != Status::OK) {
@@ -451,7 +453,25 @@
     }
 }
 
+int ExternalCameraDeviceSession::waitForV4L2BufferReturnLocked(std::unique_lock<std::mutex>& lk) {
+    std::chrono::seconds timeout = std::chrono::seconds(kBufferWaitTimeoutSec);
+    mLock.unlock();
+    auto st = mV4L2BufferReturned.wait_for(lk, timeout);
+    // Here we introduce a order where mV4l2BufferLock is acquired before mLock, while
+    // the normal lock acquisition order is reversed. This is fine because in most of
+    // cases we are protected by mInterfaceLock. The only thread that can cause deadlock
+    // is the OutputThread, where we do need to make sure we don't acquire mLock then
+    // mV4l2BufferLock
+    mLock.lock();
+    if (st == std::cv_status::timeout) {
+        ALOGE("%s: wait for V4L2 buffer return timeout!", __FUNCTION__);
+        return -1;
+    }
+    return 0;
+}
+
 Status ExternalCameraDeviceSession::processOneCaptureRequest(const CaptureRequest& request)  {
+    ATRACE_CALL();
     Status status = initStatus();
     if (status != Status::OK) {
         return status;
@@ -510,15 +530,59 @@
         return Status::ILLEGAL_ARGUMENT;
     }
 
+    camera_metadata_entry fpsRange = mLatestReqSetting.find(ANDROID_CONTROL_AE_TARGET_FPS_RANGE);
+    if (fpsRange.count == 2) {
+        double requestFpsMax = fpsRange.data.i32[1];
+        double closestFps = 0.0;
+        double fpsError = 1000.0;
+        bool fpsSupported = false;
+        for (const auto& fr : mV4l2StreamingFmt.frameRates) {
+            double f = fr.getDouble();
+            if (std::fabs(requestFpsMax - f) < 1.0) {
+                fpsSupported = true;
+                break;
+            }
+            if (std::fabs(requestFpsMax - f) < fpsError) {
+                fpsError = std::fabs(requestFpsMax - f);
+                closestFps = f;
+            }
+        }
+        if (!fpsSupported) {
+            /* This can happen in a few scenarios:
+             * 1. The application is sending a FPS range not supported by the configured outputs.
+             * 2. The application is sending a valid FPS range for all cofigured outputs, but
+             *    the selected V4L2 size can only run at slower speed. This should be very rare
+             *    though: for this to happen a sensor needs to support at least 3 different aspect
+             *    ratio outputs, and when (at least) two outputs are both not the main aspect ratio
+             *    of the webcam, a third size that's larger might be picked and runs into this
+             *    issue.
+             */
+            ALOGW("%s: cannot reach fps %d! Will do %f instead",
+                    __FUNCTION__, fpsRange.data.i32[1], closestFps);
+            requestFpsMax = closestFps;
+        }
+
+        if (requestFpsMax != mV4l2StreamingFps) {
+            {
+                std::unique_lock<std::mutex> lk(mV4l2BufferLock);
+                while (mNumDequeuedV4l2Buffers != 0) {
+                    // Wait until pipeline is idle before reconfigure stream
+                    int waitRet = waitForV4L2BufferReturnLocked(lk);
+                    if (waitRet != 0) {
+                        ALOGE("%s: wait for pipeline idle failed!", __FUNCTION__);
+                        return Status::INTERNAL_ERROR;
+                    }
+                }
+            }
+            configureV4l2StreamLocked(mV4l2StreamingFmt, requestFpsMax);
+        }
+    }
+
     status = importRequest(request, allBufPtrs, allFences);
     if (status != Status::OK) {
         return status;
     }
 
-    // TODO: program fps range per capture request here
-    //       or limit the set of availableFpsRange
-
-
     nsecs_t shutterTs = 0;
     sp<V4L2Frame> frameIn = dequeueV4l2FrameLocked(&shutterTs);
     if ( frameIn == nullptr) {
@@ -573,6 +637,7 @@
 //TODO: refactor with processCaptureResult
 Status ExternalCameraDeviceSession::processCaptureRequestError(
         const std::shared_ptr<HalRequest>& req) {
+    ATRACE_CALL();
     // Return V4L2 buffer to V4L2 buffer queue
     enqueueV4l2Frame(req->frameIn);
 
@@ -613,6 +678,7 @@
 }
 
 Status ExternalCameraDeviceSession::processCaptureResult(std::shared_ptr<HalRequest>& req) {
+    ATRACE_CALL();
     // Return V4L2 buffer to V4L2 buffer queue
     enqueueV4l2Frame(req->frameIn);
 
@@ -1389,6 +1455,7 @@
         HalStreamBuffer &halBuf,
         const std::shared_ptr<HalRequest>& req)
 {
+    ATRACE_CALL();
     int ret;
     auto lfail = [&](auto... args) {
         ALOGE(args...);
@@ -1596,8 +1663,8 @@
     uint8_t* inData;
     size_t inDataSize;
     req->frameIn->map(&inData, &inDataSize);
-    // TODO: profile
     // TODO: in some special case maybe we can decode jpg directly to gralloc output?
+    ATRACE_BEGIN("MJPGtoI420");
     int res = libyuv::MJPGToI420(
             inData, inDataSize,
             static_cast<uint8_t*>(mYu12FrameLayout.y),
@@ -1608,6 +1675,7 @@
             mYu12FrameLayout.cStride,
             mYu12Frame->mWidth, mYu12Frame->mHeight,
             mYu12Frame->mWidth, mYu12Frame->mHeight);
+    ATRACE_END();
 
     if (res != 0) {
         // For some webcam, the first few V4L2 frames might be malformed...
@@ -1669,17 +1737,21 @@
                         (outputFourcc >> 24) & 0xFF);
 
                 YCbCrLayout cropAndScaled;
+                ATRACE_BEGIN("cropAndScaleLocked");
                 int ret = cropAndScaleLocked(
                         mYu12Frame,
                         Size { halBuf.width, halBuf.height },
                         &cropAndScaled);
+                ATRACE_END();
                 if (ret != 0) {
                     lk.unlock();
                     return onDeviceError("%s: crop and scale failed!", __FUNCTION__);
                 }
 
                 Size sz {halBuf.width, halBuf.height};
+                ATRACE_BEGIN("formatConvertLocked");
                 ret = formatConvertLocked(cropAndScaled, outLayout, sz, outputFourcc);
+                ATRACE_END();
                 if (ret != 0) {
                     lk.unlock();
                     return onDeviceError("%s: format coversion failed!", __FUNCTION__);
@@ -1790,6 +1862,7 @@
 }
 
 void ExternalCameraDeviceSession::OutputThread::flush() {
+    ATRACE_CALL();
     auto parent = mParent.promote();
     if (parent == nullptr) {
        ALOGE("%s: session has been disconnected!", __FUNCTION__);
@@ -1807,6 +1880,7 @@
         }
     }
 
+    ALOGV("%s: flusing inflight requests", __FUNCTION__);
     lk.unlock();
     for (const auto& req : reqs) {
         parent->processCaptureRequestError(req);
@@ -1815,6 +1889,7 @@
 
 void ExternalCameraDeviceSession::OutputThread::waitForNextRequest(
         std::shared_ptr<HalRequest>* out) {
+    ATRACE_CALL();
     if (out == nullptr) {
         ALOGE("%s: out is null", __FUNCTION__);
         return;
@@ -1979,7 +2054,47 @@
     return OK;
 }
 
-int ExternalCameraDeviceSession::configureV4l2StreamLocked(const SupportedV4L2Format& v4l2Fmt) {
+int ExternalCameraDeviceSession::setV4l2FpsLocked(double fps) {
+    // VIDIOC_G_PARM/VIDIOC_S_PARM: set fps
+    v4l2_streamparm streamparm = { .type = V4L2_BUF_TYPE_VIDEO_CAPTURE };
+    // The following line checks that the driver knows about framerate get/set.
+    int ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_G_PARM, &streamparm));
+    if (ret != 0) {
+        if (errno == -EINVAL) {
+            ALOGW("%s: device does not support VIDIOC_G_PARM", __FUNCTION__);
+        }
+        return -errno;
+    }
+    // Now check if the device is able to accept a capture framerate set.
+    if (!(streamparm.parm.capture.capability & V4L2_CAP_TIMEPERFRAME)) {
+        ALOGW("%s: device does not support V4L2_CAP_TIMEPERFRAME", __FUNCTION__);
+        return -EINVAL;
+    }
+
+    // fps is float, approximate by a fraction.
+    const int kFrameRatePrecision = 10000;
+    streamparm.parm.capture.timeperframe.numerator = kFrameRatePrecision;
+    streamparm.parm.capture.timeperframe.denominator =
+        (fps * kFrameRatePrecision);
+
+    if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_PARM, &streamparm)) < 0) {
+        ALOGE("%s: failed to set framerate to %f: %s", __FUNCTION__, fps, strerror(errno));
+        return -1;
+    }
+
+    double retFps = streamparm.parm.capture.timeperframe.denominator /
+            static_cast<double>(streamparm.parm.capture.timeperframe.numerator);
+    if (std::fabs(fps - retFps) > 1.0) {
+        ALOGE("%s: expect fps %f, got %f instead", __FUNCTION__, fps, retFps);
+        return -1;
+    }
+    mV4l2StreamingFps = fps;
+    return 0;
+}
+
+int ExternalCameraDeviceSession::configureV4l2StreamLocked(
+        const SupportedV4L2Format& v4l2Fmt, double requestFps) {
+    ATRACE_CALL();
     int ret = v4l2StreamOffLocked();
     if (ret != OK) {
         ALOGE("%s: stop v4l2 streaming failed: ret %d", __FUNCTION__, ret);
@@ -2016,46 +2131,31 @@
     uint32_t bufferSize = fmt.fmt.pix.sizeimage;
     ALOGI("%s: V4L2 buffer size is %d", __FUNCTION__, bufferSize);
 
-    float maxFps = -1.f;
-    float fps = 1000.f;
-    const float kDefaultFps = 30.f;
-    // Try to pick the slowest fps that is at least 30
-    for (const auto& fr : v4l2Fmt.frameRates) {
-        double f = fr.getDouble();
-        if (maxFps < f) {
-            maxFps = f;
-        }
-        if (f >= kDefaultFps && f < fps) {
-            fps = f;
-        }
-    }
-    if (fps == 1000.f) {
-        fps = maxFps;
-    }
-
-    // VIDIOC_G_PARM/VIDIOC_S_PARM: set fps
-    v4l2_streamparm streamparm = { .type = V4L2_BUF_TYPE_VIDEO_CAPTURE };
-    // The following line checks that the driver knows about framerate get/set.
-    if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_G_PARM, &streamparm)) >= 0) {
-        // Now check if the device is able to accept a capture framerate set.
-        if (streamparm.parm.capture.capability & V4L2_CAP_TIMEPERFRAME) {
-            // |frame_rate| is float, approximate by a fraction.
-            const int kFrameRatePrecision = 10000;
-            streamparm.parm.capture.timeperframe.numerator = kFrameRatePrecision;
-            streamparm.parm.capture.timeperframe.denominator =
-                (fps * kFrameRatePrecision);
-
-            if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_PARM, &streamparm)) < 0) {
-                ALOGE("%s: failed to set framerate to %f", __FUNCTION__, fps);
-                return UNKNOWN_ERROR;
+    const double kDefaultFps = 30.0;
+    double fps = 1000.0;
+    if (requestFps != 0.0) {
+        fps = requestFps;
+    } else {
+        double maxFps = -1.0;
+        // Try to pick the slowest fps that is at least 30
+        for (const auto& fr : v4l2Fmt.frameRates) {
+            double f = fr.getDouble();
+            if (maxFps < f) {
+                maxFps = f;
+            }
+            if (f >= kDefaultFps && f < fps) {
+                fps = f;
             }
         }
+        if (fps == 1000.0) {
+            fps = maxFps;
+        }
     }
-    float retFps = streamparm.parm.capture.timeperframe.denominator /
-                streamparm.parm.capture.timeperframe.numerator;
-    if (std::fabs(fps - retFps) > std::numeric_limits<float>::epsilon()) {
-        ALOGE("%s: expect fps %f, got %f instead", __FUNCTION__, fps, retFps);
-        return BAD_VALUE;
+
+    int fpsRet = setV4l2FpsLocked(fps);
+    if (fpsRet != 0 && fpsRet != -EINVAL) {
+        ALOGE("%s: set fps failed: %s", __FUNCTION__, strerror(fpsRet));
+        return fpsRet;
     }
 
     uint32_t v4lBufferCount = (fps >= kDefaultFps) ?
@@ -2126,6 +2226,7 @@
 }
 
 sp<V4L2Frame> ExternalCameraDeviceSession::dequeueV4l2FrameLocked(/*out*/nsecs_t* shutterTs) {
+    ATRACE_CALL();
     sp<V4L2Frame> ret = nullptr;
 
     if (shutterTs == nullptr) {
@@ -2136,17 +2237,8 @@
     {
         std::unique_lock<std::mutex> lk(mV4l2BufferLock);
         if (mNumDequeuedV4l2Buffers == mV4L2BufferCount) {
-            std::chrono::seconds timeout = std::chrono::seconds(kBufferWaitTimeoutSec);
-            mLock.unlock();
-            auto st = mV4L2BufferReturned.wait_for(lk, timeout);
-            // Here we introduce a case where mV4l2BufferLock is acquired before mLock, while
-            // the normal lock acquisition order is reversed, but this is fine because in most of
-            // cases we are protected by mInterfaceLock. The only thread that can compete these
-            // locks are the OutputThread, where we do need to make sure we don't acquire mLock then
-            // mV4l2BufferLock
-            mLock.lock();
-            if (st == std::cv_status::timeout) {
-                ALOGE("%s: wait for V4L2 buffer return timeout!", __FUNCTION__);
+            int waitRet = waitForV4L2BufferReturnLocked(lk);
+            if (waitRet != 0) {
                 return ret;
             }
         }
@@ -2189,6 +2281,7 @@
 }
 
 void ExternalCameraDeviceSession::enqueueV4l2Frame(const sp<V4L2Frame>& frame) {
+    ATRACE_CALL();
     {
         // Release mLock before acquiring mV4l2BufferLock to avoid potential
         // deadlock
@@ -2214,6 +2307,7 @@
 
 Status ExternalCameraDeviceSession::configureStreams(
         const V3_2::StreamConfiguration& config, V3_3::HalStreamConfiguration* out) {
+    ATRACE_CALL();
     if (config.operationMode != StreamConfigurationMode::NORMAL_MODE) {
         ALOGE("%s: unsupported operation mode: %d", __FUNCTION__, config.operationMode);
         return Status::ILLEGAL_ARGUMENT;
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
index 9c0ad7f..5315097 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
@@ -177,8 +177,11 @@
     status_t initDefaultRequests();
     status_t fillCaptureResult(common::V1_0::helper::CameraMetadata& md, nsecs_t timestamp);
     Status configureStreams(const V3_2::StreamConfiguration&, V3_3::HalStreamConfiguration* out);
-    int configureV4l2StreamLocked(const SupportedV4L2Format& fmt);
+    // fps = 0.0 means default, which is
+    // slowest fps that is at least 30, or fastest fps if 30 is not supported
+    int configureV4l2StreamLocked(const SupportedV4L2Format& fmt, double fps = 0.0);
     int v4l2StreamOffLocked();
+    int setV4l2FpsLocked(double fps);
 
     // TODO: change to unique_ptr for better tracking
     sp<V4L2Frame> dequeueV4l2FrameLocked(/*out*/nsecs_t* shutterTs); // Called with mLock hold
@@ -212,6 +215,8 @@
 
     ssize_t getJpegBufferSize(uint32_t width, uint32_t height) const;
 
+    int waitForV4L2BufferReturnLocked(std::unique_lock<std::mutex>& lk);
+
     class OutputThread : public android::Thread {
     public:
         OutputThread(wp<ExternalCameraDeviceSession> parent, CroppingType);
@@ -307,6 +312,7 @@
 
     bool mV4l2Streaming = false;
     SupportedV4L2Format mV4l2StreamingFmt;
+    double mV4l2StreamingFps = 0.0;
     size_t mV4L2BufferCount = 0;
 
     static const int kBufferWaitTimeoutSec = 3; // TODO: handle long exposure (or not allowing)
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
index 5880469..a52f0e4 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDevice_3_4.h
@@ -78,7 +78,6 @@
     /* End of Methods from ::android::hardware::camera::device::V3_2::ICameraDevice */
 
 protected:
-    void getFrameRateList(int fd, float fpsUpperBound, SupportedV4L2Format* format);
     // Init supported w/h/format/fps in mSupportedFormats. Caller still owns fd
     void initSupportedFormatsLocked(int fd);
 
@@ -92,7 +91,15 @@
     status_t initOutputCharsKeys(int fd,
             ::android::hardware::camera::common::V1_0::helper::CameraMetadata*);
 
-    static CroppingType initCroppingType(/*inout*/std::vector<SupportedV4L2Format>*);
+    static void getFrameRateList(int fd, double fpsUpperBound, SupportedV4L2Format* format);
+
+    // Get candidate supported formats list of input cropping type.
+    static std::vector<SupportedV4L2Format> getCandidateSupportedFormatsLocked(
+            int fd, CroppingType cropType,
+            const std::vector<ExternalCameraConfig::FpsLimitation>& fpsLimits);
+    // Trim supported format list by the cropping type. Also sort output formats by width/height
+    static void trimSupportedFormats(CroppingType cropType,
+            /*inout*/std::vector<SupportedV4L2Format>* pFmts);
 
     Mutex mLock;
     bool mInitFailed = false;
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 002ff31..464b4a3 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -178,9 +178,11 @@
     <hal format="hidl" optional="false">
         <name>android.hardware.keymaster</name>
         <version>3.0</version>
+        <version>4.0</version>
         <interface>
             <name>IKeymasterDevice</name>
             <instance>default</instance>
+	    <!-- TODO: strongbox here? -->
         </interface>
     </hal>
     <hal format="hidl" optional="true">
diff --git a/configstore/1.0/default/surfaceflinger.mk b/configstore/1.0/default/surfaceflinger.mk
index 3ce768a..f7487d5 100644
--- a/configstore/1.0/default/surfaceflinger.mk
+++ b/configstore/1.0/default/surfaceflinger.mk
@@ -17,6 +17,10 @@
     LOCAL_CFLAGS += -DUSE_CONTEXT_PRIORITY=1
 endif
 
+ifeq ($(TARGET_USE_CONTEXT_PRIORITY),true)
+    LOCAL_CFLAGS += -DUSE_CONTEXT_PRIORITY=1
+endif
+
 ifeq ($(TARGET_HAS_WIDE_COLOR_DISPLAY),true)
     LOCAL_CFLAGS += -DHAS_WIDE_COLOR_DISPLAY
 endif
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index dbf5ece..602355b 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -664,7 +664,7 @@
  */
 TEST_F(SigningOperationsTest, RsaSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -680,7 +680,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPssSha256Success) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::SHA_2_256)
                                              .Padding(PaddingMode::RSA_PSS)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -698,7 +698,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPaddingNoneDoesNotAllowOther) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
@@ -720,7 +720,7 @@
  */
 TEST_F(SigningOperationsTest, NoUserConfirmation) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
@@ -741,7 +741,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPkcs1Sha256Success) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::SHA_2_256)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
@@ -758,7 +758,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPkcs1NoDigestSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
@@ -776,7 +776,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPkcs1NoDigestTooLong) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
@@ -804,7 +804,7 @@
  */
 TEST_F(SigningOperationsTest, RsaPssSha512TooSmallKey) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::SHA_2_512)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::RSA_PSS)));
@@ -822,7 +822,7 @@
  */
 TEST_F(SigningOperationsTest, RsaNoPaddingTooLong) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
@@ -856,7 +856,7 @@
  */
 TEST_F(SigningOperationsTest, RsaAbort) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
@@ -881,7 +881,7 @@
  */
 TEST_F(SigningOperationsTest, RsaUnsupportedPadding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Digest(Digest::SHA_2_256 /* supported digest */)
                                              .Padding(PaddingMode::PKCS7)));
@@ -898,7 +898,7 @@
  */
 TEST_F(SigningOperationsTest, RsaNoDigest) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::RSA_PSS)));
@@ -919,7 +919,7 @@
 TEST_F(SigningOperationsTest, RsaNoPadding) {
     // Padding must be specified
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaKey(1024, 3)
+                                             .RsaKey(1024, 65537)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .SigningKey()
                                              .Digest(Digest::NONE)));
@@ -935,7 +935,7 @@
 TEST_F(SigningOperationsTest, RsaTooShortMessage) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
 
@@ -956,7 +956,7 @@
 TEST_F(SigningOperationsTest, RsaSignWithEncryptionKey) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
     ASSERT_EQ(ErrorCode::INCOMPATIBLE_PURPOSE,
@@ -973,7 +973,7 @@
 TEST_F(SigningOperationsTest, RsaSignTooLargeMessage) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
 
@@ -1044,9 +1044,9 @@
 TEST_F(SigningOperationsTest, EcdsaNoDigestHugeData) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .EcdsaSigningKey(224)
+                                             .EcdsaSigningKey(256)
                                              .Digest(Digest::NONE)));
-    string message(2 * 1024, 'a');
+    string message(1 * 1024, 'a');
     SignMessage(message, AuthorizationSetBuilder().Digest(Digest::NONE));
 }
 
@@ -1291,7 +1291,7 @@
 TEST_F(VerificationOperationsTest, RsaSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
     string message = "12345678901234567890123456789012";
@@ -1310,7 +1310,7 @@
     ASSERT_EQ(ErrorCode::OK,
               GenerateKey(AuthorizationSetBuilder()
                               .Authorization(TAG_NO_AUTH_REQUIRED)
-                              .RsaSigningKey(2048, 3)
+                              .RsaSigningKey(2048, 65537)
                               .Digest(Digest::NONE, Digest::MD5, Digest::SHA1, Digest::SHA_2_224,
                                       Digest::SHA_2_256, Digest::SHA_2_384, Digest::SHA_2_512)
                               .Padding(PaddingMode::NONE)
@@ -1534,7 +1534,7 @@
  */
 TEST_F(ExportKeyTest, RsaUnsupportedKeyFormat) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
     HidlBuf export_data;
@@ -1550,7 +1550,7 @@
 TEST_F(ExportKeyTest, RsaCorruptedKeyBlob) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)));
     for (size_t i = 0; i < key_blob_.size(); ++i) {
@@ -1939,7 +1939,7 @@
 TEST_F(EncryptionOperationsTest, RsaNoPaddingSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::NONE)));
 
     string message = string(1024 / 8, 'a');
@@ -1962,7 +1962,7 @@
 TEST_F(EncryptionOperationsTest, RsaNoPaddingShortMessage) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::NONE)));
 
     string message = "1";
@@ -1991,7 +1991,7 @@
 TEST_F(EncryptionOperationsTest, RsaNoPaddingTooLong) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::NONE)));
 
     string message(1024 / 8 + 1, 'a');
@@ -2011,7 +2011,7 @@
 TEST_F(EncryptionOperationsTest, RsaNoPaddingTooLarge) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::NONE)));
 
     HidlBuf exported;
@@ -2057,7 +2057,7 @@
     size_t key_size = 2048;  // Need largish key for SHA-512 test.
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(key_size, 3)
+                                             .RsaEncryptionKey(key_size, 65537)
                                              .Padding(PaddingMode::RSA_OAEP)
                                              .Digest(digests)));
 
@@ -2105,7 +2105,7 @@
 TEST_F(EncryptionOperationsTest, RsaOaepInvalidDigest) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::RSA_OAEP)
                                              .Digest(Digest::NONE)));
     string message = "Hello World!";
@@ -2123,7 +2123,7 @@
 TEST_F(EncryptionOperationsTest, RsaOaepDecryptWithWrongDigest) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::RSA_OAEP)
                                              .Digest(Digest::SHA_2_256, Digest::SHA_2_224)));
     string message = "Hello World!";
@@ -2149,7 +2149,7 @@
 TEST_F(EncryptionOperationsTest, RsaOaepTooLarge) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::RSA_OAEP)
                                              .Digest(Digest::SHA1)));
     constexpr size_t digest_size = 160 /* SHA1 */ / 8;
@@ -2171,7 +2171,7 @@
 TEST_F(EncryptionOperationsTest, RsaPkcs1Success) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_ENCRYPT)));
 
     string message = "Hello World!";
@@ -2210,7 +2210,7 @@
 TEST_F(EncryptionOperationsTest, RsaPkcs1TooLarge) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaEncryptionKey(1024, 3)
+                                             .RsaEncryptionKey(1024, 65537)
                                              .Padding(PaddingMode::RSA_PKCS1_1_5_ENCRYPT)));
     string message(1024 / 8 - 10, 'a');
 
@@ -3229,7 +3229,7 @@
     std::cout << "Hello" << std::endl;
 
     auto auths = AuthorizationSetBuilder()
-                     .TripleDesEncryptionKey(112)
+                     .TripleDesEncryptionKey(168)
                      .BlockMode(BlockMode::ECB)
                      .Padding(PaddingMode::NONE);
 
@@ -3257,7 +3257,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesEcbNotAuthorized) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
 
@@ -3272,7 +3272,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesEcbPkcs7Padding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
                                              .Padding(PaddingMode::PKCS7)));
 
@@ -3294,7 +3294,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesEcbNoPaddingKeyWithPkcs7Padding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
                                              .Padding(PaddingMode::NONE)));
     for (size_t i = 0; i < 32; ++i) {
@@ -3311,7 +3311,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesEcbPkcs7PaddingCorrupted) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
                                              .Padding(PaddingMode::PKCS7)));
 
@@ -3347,49 +3347,6 @@
 // the NIST vectors are multiples of the block size.
 static const TripleDesTestVector kTripleDesTestVectors[] = {
     {
-        "TECBMMT2 Encrypt 0", KeyPurpose::ENCRYPT, BlockMode::ECB, PaddingMode::NONE,
-        "ad192fd064b5579e7a4fb3c8f794f22a",  // key
-        "",                                  // IV
-        "13bad542f3652d67",                  // input
-        "908e543cf2cb254f",                  // output
-    },
-    {
-        "TECBMMT2 Encrypt 0 PKCS7", KeyPurpose::ENCRYPT, BlockMode::ECB, PaddingMode::PKCS7,
-        "ad192fd064b5579e7a4fb3c8f794f22a",  // key
-        "",                                  // IV
-        "13bad542f3652d6700",                // input
-        "908e543cf2cb254fc40165289a89008c",  // output
-    },
-    {
-        "TECBMMT2 Encrypt 0 PKCS7 decrypted", KeyPurpose::DECRYPT, BlockMode::ECB,
-        PaddingMode::PKCS7,
-        "ad192fd064b5579e7a4fb3c8f794f22a",  // key
-        "",                                  // IV
-        "908e543cf2cb254fc40165289a89008c",  // input
-        "13bad542f3652d6700",                // output
-    },
-    {
-        "TECBMMT2 Encrypt 1", KeyPurpose::ENCRYPT, BlockMode::ECB, PaddingMode::NONE,
-        "259df16e7af804fe83b90e9bf7c7e557",  // key
-        "",                                  // IV
-        "a4619c433bbd6787c07c81728f9ac9fa",  // input
-        "9e06de155c483c6bcfd834dbc8bd5830",  // output
-    },
-    {
-        "TECBMMT2 Decrypt 0", KeyPurpose::DECRYPT, BlockMode::ECB, PaddingMode::NONE,
-        "b32ff42092024adf2076b9d3d9f19e6d",  // key
-        "",                                  // IV
-        "2f3f2a49bba807a5",                  // input
-        "2249973fa135fb52",                  // output
-    },
-    {
-        "TECBMMT2 Decrypt 1", KeyPurpose::DECRYPT, BlockMode::ECB, PaddingMode::NONE,
-        "023dfbe6621aa17cc219eae9cdecd923",  // key
-        "",                                  // IV
-        "54045dc71d8d565b227ec19f06fef912",  // input
-        "9b071622181e6412de6066429401410d",  // output
-    },
-    {
         "TECBMMT3 Encrypt 0", KeyPurpose::ENCRYPT, BlockMode::ECB, PaddingMode::NONE,
         "a2b5bc67da13dc92cd9d344aa238544a0e1fa79ef76810cd",  // key
         "",                                                  // IV
@@ -3418,34 +3375,6 @@
         "9b2ae9d998efe62f1b592e7e1df8ff38",                  // output
     },
     {
-        "TCBCMMT2 Encrypt 0", KeyPurpose::ENCRYPT, BlockMode::CBC, PaddingMode::NONE,
-        "34a41a8c293176c1b30732ecfe38ae8a",  // key
-        "f55b4855228bd0b4",                  // IV
-        "7dd880d2a9ab411c",                  // input
-        "c91892948b6cadb4",                  // output
-    },
-    {
-        "TCBCMMT2 Encrypt 1", KeyPurpose::ENCRYPT, BlockMode::CBC, PaddingMode::NONE,
-        "70a88fa1dfb9942fa77f40157ffef2ad",  // key
-        "ece08ce2fdc6ce80",                  // IV
-        "bc225304d5a3a5c9918fc5006cbc40cc",  // input
-        "27f67dc87af7ddb4b68f63fa7c2d454a",  // output
-    },
-    {
-        "TCBCMMT2 Decrypt 0", KeyPurpose::DECRYPT, BlockMode::CBC, PaddingMode::NONE,
-        "4ff47fda89209bda8c85f7fe80192007",  // key
-        "d5bc4891dabe48b9",                  // IV
-        "7e154b28c353adef",                  // input
-        "712b961ea9a1d0af",                  // output
-    },
-    {
-        "TCBCMMT2 Decrypt 1", KeyPurpose::DECRYPT, BlockMode::CBC, PaddingMode::NONE,
-        "464092cdbf736d38fb1fe6a12a94ae0e",  // key
-        "5423455f00023b01",                  // IV
-        "3f6050b74ed64416bc23d53b0469ed7a",  // input
-        "9cbe7d1b5cdd1864c3095ba810575960",  // output
-    },
-    {
         "TCBCMMT3 Encrypt 0", KeyPurpose::ENCRYPT, BlockMode::CBC, PaddingMode::NONE,
         "b5cb1504802326c73df186e3e352a20de643b0d63ee30e37",  // key
         "43f791134c5647ba",                                  // IV
@@ -3512,7 +3441,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcRoundTripSuccess) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
     // Two-block message.
@@ -3540,7 +3469,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCallerIv) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Authorization(TAG_CALLER_NONCE)
                                              .Padding(PaddingMode::NONE)));
@@ -3574,7 +3503,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCallerNonceProhibited) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
 
@@ -3605,7 +3534,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcNotAuthorized) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
                                              .Padding(PaddingMode::NONE)));
     // Two-block message.
@@ -3622,7 +3551,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcNoPaddingWrongInputSize) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
     // Message is slightly shorter than two blocks.
@@ -3643,7 +3572,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcPkcs7Padding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::PKCS7)));
 
@@ -3665,7 +3594,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcNoPaddingKeyWithPkcs7Padding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
 
@@ -3684,7 +3613,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcPkcs7PaddingCorrupted) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::PKCS7)));
 
@@ -3714,7 +3643,7 @@
  */
 TEST_F(EncryptionOperationsTest, TripleDesCbcIncrementalNoPadding) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .TripleDesEncryptionKey(112)
+                                             .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
                                              .Padding(PaddingMode::NONE)));
 
@@ -3784,7 +3713,7 @@
 TEST_F(MaxOperationsTest, TestLimitRsa) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .NoDigestOrPadding()
                                              .Authorization(TAG_MAX_USES_PER_BOOT, 3)));
 
@@ -3840,7 +3769,7 @@
 TEST_F(AttestationTest, RsaAttestation) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_INCLUDE_UNIQUE_ID)));
@@ -3867,7 +3796,7 @@
 TEST_F(AttestationTest, RsaAttestationRequiresAppId) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .Authorization(TAG_NO_AUTH_REQUIRED)
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_INCLUDE_UNIQUE_ID)));
@@ -3978,7 +3907,7 @@
  */
 TEST_F(KeyDeletionTest, DeleteKey) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -4022,7 +3951,7 @@
 TEST_F(KeyDeletionTest, DeleteInvalidKey) {
     // Generate key just to check if rollback protection is implemented
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
@@ -4061,7 +3990,7 @@
 TEST_F(KeyDeletionTest, DeleteAllKeys) {
     if (!arm_deleteAllKeys) return;
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                             .RsaSigningKey(1024, 3)
+                                             .RsaSigningKey(1024, 65537)
                                              .Digest(Digest::NONE)
                                              .Padding(PaddingMode::NONE)
                                              .Authorization(TAG_NO_AUTH_REQUIRED)));
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
index c3769f8..34a87e1 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
@@ -655,3 +655,21 @@
              RadioError::REQUEST_NOT_SUPPORTED, RadioError::CANCELLED}));
     }
 }
+
+/*
+ * Test IRadio.getCellInfoList() for the response returned.
+ */
+TEST_F(RadioHidlTest_v1_2, getCellInfoList_1_2) {
+    int serial = GetRandomSerialNumber();
+
+    Return<void> res = radio_v1_2->getCellInfoList(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_2->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_v1_2->rspInfo.serial);
+
+    ALOGI("getCellInfoList_1_2, rspInfo.error = %s\n",
+          toString(radioRsp_v1_2->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_v1_2->rspInfo.error,
+                                 {RadioError::NONE, RadioError::NO_NETWORK_FOUND}));
+}
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
index f9919a2..66d8ca4 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
+++ b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
@@ -405,6 +405,18 @@
     Return<void> setSignalStrengthReportingCriteriaResponse(const RadioResponseInfo& info);
 
     Return<void> setLinkCapacityReportingCriteriaResponse(const RadioResponseInfo& info);
+
+    Return<void> getIccCardStatusResponse_1_2(const RadioResponseInfo& info,
+                                              const CardStatus& card_status);
+
+    Return<void> getCurrentCallsResponse_1_2(const RadioResponseInfo& info,
+                                             const ::android::hardware::hidl_vec<Call>& calls);
+
+    Return<void> getSignalStrengthResponse_1_2(const RadioResponseInfo& info,
+                                               const SignalStrength& sig_strength);
+
+    Return<void> getCellInfoListResponse_1_2(
+        const RadioResponseInfo& info, const ::android::hardware::hidl_vec<CellInfo>& cellInfo);
 };
 
 /* Callback class for radio indication */
diff --git a/radio/1.2/vts/functional/radio_response.cpp b/radio/1.2/vts/functional/radio_response.cpp
index 9bf4531..d96f76b 100644
--- a/radio/1.2/vts/functional/radio_response.cpp
+++ b/radio/1.2/vts/functional/radio_response.cpp
@@ -21,11 +21,8 @@
 RadioResponse_v1_2::RadioResponse_v1_2(RadioHidlTest_v1_2& parent) : parent_v1_2(parent) {}
 
 /* 1.0 Apis */
-Return<void> RadioResponse_v1_2::getIccCardStatusResponse(const RadioResponseInfo& info,
-                                                          const CardStatus& card_status) {
-    rspInfo = info;
-    cardStatus = card_status;
-    parent_v1_2.notify();
+Return<void> RadioResponse_v1_2::getIccCardStatusResponse(const RadioResponseInfo& /*info*/,
+                                                          const CardStatus& /*card_status*/) {
     return Void();
 }
 
@@ -706,3 +703,32 @@
     parent_v1_2.notify();
     return Void();
 }
+
+Return<void> RadioResponse_v1_2::getIccCardStatusResponse_1_2(const RadioResponseInfo& info,
+                                                              const CardStatus& card_status) {
+    rspInfo = info;
+    cardStatus = card_status;
+    parent_v1_2.notify();
+    return Void();
+}
+
+Return<void> RadioResponse_v1_2::getCurrentCallsResponse_1_2(
+    const RadioResponseInfo& info, const ::android::hardware::hidl_vec<Call>& /*calls*/) {
+    rspInfo = info;
+    parent_v1_2.notify();
+    return Void();
+}
+
+Return<void> RadioResponse_v1_2::getSignalStrengthResponse_1_2(
+    const RadioResponseInfo& info, const SignalStrength& /*sig_strength*/) {
+    rspInfo = info;
+    parent_v1_2.notify();
+    return Void();
+}
+
+Return<void> RadioResponse_v1_2::getCellInfoListResponse_1_2(
+    const RadioResponseInfo& info, const ::android::hardware::hidl_vec<CellInfo>& /*cellInfo*/) {
+    rspInfo = info;
+    parent_v1_2.notify();
+    return Void();
+}
\ No newline at end of file
diff --git a/wifi/1.2/default/tests/mock_wifi_legacy_hal.h b/wifi/1.2/default/tests/mock_wifi_legacy_hal.h
index 8e1696e..43370b4 100644
--- a/wifi/1.2/default/tests/mock_wifi_legacy_hal.h
+++ b/wifi/1.2/default/tests/mock_wifi_legacy_hal.h
@@ -36,6 +36,9 @@
     MOCK_METHOD2(stop, wifi_error(std::unique_lock<std::recursive_mutex>*,
                                   const std::function<void()>&));
     MOCK_METHOD2(setDfsFlag, wifi_error(const std::string&, bool));
+    MOCK_METHOD2(registerRadioModeChangeCallbackHandler,
+                 wifi_error(const std::string&,
+                            const on_radio_mode_change_callback&));
     MOCK_METHOD2(nanRegisterCallbackHandlers,
                  wifi_error(const std::string&, const NanCallbackHandlers&));
     MOCK_METHOD2(nanDisableRequest,
diff --git a/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp b/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp
index 1b082d0..27c8d60 100644
--- a/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp
+++ b/wifi/1.2/default/tests/wifi_chip_unit_tests.cpp
@@ -395,10 +395,10 @@
     ASSERT_FALSE(createIface(IfaceType::AP).empty());
 }
 
-TEST_F(WifiChipV2_AwareIfaceCombinationTest, CreateStaSta_ShouldSucceed) {
+TEST_F(WifiChipV2_AwareIfaceCombinationTest, CreateStaSta_ShouldFail) {
     findModeAndConfigureForIfaceType(IfaceType::AP);
     ASSERT_FALSE(createIface(IfaceType::STA).empty());
-    ASSERT_FALSE(createIface(IfaceType::STA).empty());
+    ASSERT_TRUE(createIface(IfaceType::STA).empty());
 }
 
 TEST_F(WifiChipV2_AwareIfaceCombinationTest, CreateStaAp_ShouldSucceed) {
@@ -407,35 +407,18 @@
     ASSERT_FALSE(createIface(IfaceType::STA).empty());
 }
 
-TEST_F(WifiChipV2_AwareIfaceCombinationTest, CreateStaStaAp_ShouldFail) {
-    findModeAndConfigureForIfaceType(IfaceType::AP);
-    ASSERT_FALSE(createIface(IfaceType::STA).empty());
-    ASSERT_FALSE(createIface(IfaceType::STA).empty());
-    ASSERT_TRUE(createIface(IfaceType::AP).empty());
-}
-
 TEST_F(WifiChipV2_AwareIfaceCombinationTest,
-       CreateStaAp_AfterStaRemove_ShouldSucceed) {
+       CreateSta_AfterStaApRemove_ShouldSucceed) {
     findModeAndConfigureForIfaceType(IfaceType::STA);
-    ASSERT_FALSE(createIface(IfaceType::STA).empty());
     const auto sta_iface_name = createIface(IfaceType::STA);
     ASSERT_FALSE(sta_iface_name.empty());
-    ASSERT_TRUE(createIface(IfaceType::AP).empty());
-
-    // After removing STA iface, AP iface creation should succeed.
-    removeIface(IfaceType::STA, sta_iface_name);
-    ASSERT_FALSE(createIface(IfaceType::AP).empty());
-}
-
-TEST_F(WifiChipV2_AwareIfaceCombinationTest,
-       CreateStaSta_AfterApRemove_ShouldSucceed) {
-    findModeAndConfigureForIfaceType(IfaceType::STA);
-    ASSERT_FALSE(createIface(IfaceType::STA).empty());
     const auto ap_iface_name = createIface(IfaceType::AP);
     ASSERT_FALSE(ap_iface_name.empty());
+
     ASSERT_TRUE(createIface(IfaceType::STA).empty());
 
-    // After removing AP  iface, STA iface creation should succeed.
+    // After removing AP & STA iface, STA iface creation should succeed.
+    removeIface(IfaceType::STA, sta_iface_name);
     removeIface(IfaceType::AP, ap_iface_name);
     ASSERT_FALSE(createIface(IfaceType::STA).empty());
 }
@@ -524,16 +507,6 @@
 }
 
 TEST_F(WifiChipV2_AwareIfaceCombinationTest,
-       CreateStaSta_EnsureDifferentIfaceNames) {
-    findModeAndConfigureForIfaceType(IfaceType::AP);
-    const auto sta1_iface_name = createIface(IfaceType::STA);
-    const auto sta2_iface_name = createIface(IfaceType::STA);
-    ASSERT_FALSE(sta1_iface_name.empty());
-    ASSERT_FALSE(sta2_iface_name.empty());
-    ASSERT_NE(sta1_iface_name, sta2_iface_name);
-}
-
-TEST_F(WifiChipV2_AwareIfaceCombinationTest,
        CreateStaAp_EnsureDifferentIfaceNames) {
     findModeAndConfigureForIfaceType(IfaceType::AP);
     const auto sta_iface_name = createIface(IfaceType::STA);
diff --git a/wifi/1.2/default/wifi_chip.cpp b/wifi/1.2/default/wifi_chip.cpp
index 201b8e4..dcd0a3c 100644
--- a/wifi/1.2/default/wifi_chip.cpp
+++ b/wifi/1.2/default/wifi_chip.cpp
@@ -1171,7 +1171,7 @@
     // (conditional on isDualInterfaceSupported()):
     //    Interface Combination 1: Will support 1 STA and 1 P2P or NAN(optional)
     //                             concurrent iface operations.
-    //    Interface Combination 2: Will support 1 STA and 1 STA or AP concurrent
+    //    Interface Combination 2: Will support 1 STA and 1 AP concurrent
     //                             iface operations.
     // If Aware is enabled (conditional on isAwareSupported()), the iface
     // combination will be modified to support either P2P or NAN in place of
@@ -1181,8 +1181,7 @@
         const IWifiChip::ChipIfaceCombinationLimit
             chip_iface_combination_limit_1 = {{IfaceType::STA}, 1};
         const IWifiChip::ChipIfaceCombinationLimit
-            chip_iface_combination_limit_2 = {{IfaceType::STA, IfaceType::AP},
-                                              1};
+            chip_iface_combination_limit_2 = {{IfaceType::AP}, 1};
         IWifiChip::ChipIfaceCombinationLimit chip_iface_combination_limit_3;
         if (feature_flags_.lock()->isAwareSupported()) {
             chip_iface_combination_limit_3 = {{IfaceType::P2P, IfaceType::NAN},
diff --git a/wifi/1.2/default/wifi_legacy_hal.h b/wifi/1.2/default/wifi_legacy_hal.h
index bd68bcd..dedbbf8 100644
--- a/wifi/1.2/default/wifi_legacy_hal.h
+++ b/wifi/1.2/default/wifi_legacy_hal.h
@@ -274,7 +274,7 @@
     wifi_error deregisterErrorAlertCallbackHandler(
         const std::string& iface_name);
     // Radio mode functions.
-    wifi_error registerRadioModeChangeCallbackHandler(
+    virtual wifi_error registerRadioModeChangeCallbackHandler(
         const std::string& iface_name,
         const on_radio_mode_change_callback& on_user_change_callback);
     // RTT functions.
diff --git a/wifi/1.2/vts/OWNERS b/wifi/1.2/vts/OWNERS
new file mode 100644
index 0000000..811c857
--- /dev/null
+++ b/wifi/1.2/vts/OWNERS
@@ -0,0 +1,4 @@
+rpius@google.com
+quiche@google.com
+arabawy@google.com
+yim@google.com
\ No newline at end of file
diff --git a/wifi/1.2/vts/functional/Android.bp b/wifi/1.2/vts/functional/Android.bp
new file mode 100644
index 0000000..d85d42e
--- /dev/null
+++ b/wifi/1.2/vts/functional/Android.bp
@@ -0,0 +1,30 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalWifiV1_2TargetTest",
+    defaults: ["VtsHalTargetTestDefaults"],
+    srcs: [
+        "VtsHalWifiV1_2TargetTest.cpp",
+        "wifi_chip_hidl_test.cpp",
+    ],
+    static_libs: [
+        "VtsHalWifiV1_0TargetTestUtil",
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+    ],
+}
diff --git a/wifi/1.2/vts/functional/VtsHalWifiV1_2TargetTest.cpp b/wifi/1.2/vts/functional/VtsHalWifiV1_2TargetTest.cpp
new file mode 100644
index 0000000..cfad208
--- /dev/null
+++ b/wifi/1.2/vts/functional/VtsHalWifiV1_2TargetTest.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/hardware/wifi/1.2/IWifi.h>
+
+#include <VtsHalHidlTargetTestEnvBase.h>
+
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::wifi::V1_2::IWifi;
+
+// Test environment for Wifi HIDL HAL.
+class WifiHidlEnvironment_1_2 : public ::testing::VtsHalHidlTargetTestEnvBase {
+   public:
+    // get the test environment singleton
+    static WifiHidlEnvironment_1_2* Instance() {
+        static WifiHidlEnvironment_1_2* instance = new WifiHidlEnvironment_1_2;
+        return instance;
+    }
+
+    virtual void registerTestServices() override { registerTestService<IWifi>(); }
+
+   private:
+    WifiHidlEnvironment_1_2() {}
+};
+
+WifiHidlEnvironment_1_2* gEnv = WifiHidlEnvironment_1_2::Instance();
+
+int main(int argc, char** argv) {
+  ::testing::AddGlobalTestEnvironment(gEnv);
+  ::testing::InitGoogleTest(&argc, argv);
+  gEnv->init(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  LOG(INFO) << "Test result = " << status;
+  return status;
+}
diff --git a/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp
new file mode 100644
index 0000000..a5457b7
--- /dev/null
+++ b/wifi/1.2/vts/functional/wifi_chip_hidl_test.cpp
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.2/IWifiChip.h>
+#include <android/hardware/wifi/1.2/IWifiChipEventCallback.h>
+
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <VtsHalHidlTargetTestBase.h>
+
+#include "wifi_hidl_call_util.h"
+#include "wifi_hidl_test_utils.h"
+
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::wifi::V1_0::ChipModeId;
+using ::android::hardware::wifi::V1_0::IfaceType;
+using ::android::hardware::wifi::V1_0::WifiStatus;
+using ::android::hardware::wifi::V1_0::WifiDebugRingBufferStatus;
+using ::android::hardware::wifi::V1_0::WifiStatusCode;
+using ::android::hardware::wifi::V1_2::IWifiChip;
+using ::android::hardware::wifi::V1_2::IWifiChipEventCallback;
+using ::android::hardware::Void;
+using ::android::sp;
+
+namespace {
+constexpr IWifiChip::TxPowerScenario kPowerScenarioBody =
+    IWifiChip::TxPowerScenario::ON_BODY_CELL_OFF;
+
+constexpr IWifiChip::TxPowerScenario kPowerScenarioVoiceCall =
+    IWifiChip::TxPowerScenario::VOICE_CALL;
+};  // namespace
+
+/**
+ * Fixture to use for all Wifi chip HIDL interface tests.
+ */
+class WifiChipHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+ public:
+  virtual void SetUp() override {
+    wifi_chip_ = IWifiChip::castFrom(getWifiChip());
+    ASSERT_NE(nullptr, wifi_chip_.get());
+  }
+
+  virtual void TearDown() override { stopWifi(); }
+
+  // A simple test implementation of WifiChipEventCallback.
+  class WifiChipEventCallback
+      : public ::testing::VtsHalHidlTargetCallbackBase<WifiChipHidlTest>,
+        public IWifiChipEventCallback {
+
+   public:
+    WifiChipEventCallback() {};
+
+    virtual ~WifiChipEventCallback() = default;
+
+    Return<void> onChipReconfigured(uint32_t modeId __unused) {
+      return Void();
+    };
+
+    Return<void> onChipReconfigureFailure(const WifiStatus& status __unused) {
+      return Void();
+    };
+
+    Return<void> onIfaceAdded(IfaceType type __unused, const hidl_string& name __unused) {
+      return Void();
+    };
+
+    Return<void> onIfaceRemoved(IfaceType type __unused, const hidl_string& name __unused) {
+      return Void();
+    };
+
+    Return<void> onDebugRingBufferDataAvailable(const WifiDebugRingBufferStatus& status __unused,
+        const hidl_vec<uint8_t>& data __unused) {
+      return Void();
+    };
+
+    Return<void> onDebugErrorAlert(int32_t errorCode __unused,
+        const hidl_vec<uint8_t>& debugData __unused) {
+      return Void();
+    };
+
+    Return<void> onRadioModeChange(const hidl_vec<RadioModeInfo>& radioModeInfos __unused) {
+      return Void();
+    };
+  };
+
+ protected:
+  uint32_t configureChipForStaIfaceAndGetCapabilities() {
+    ChipModeId mode_id;
+    EXPECT_TRUE(
+        configureChipToSupportIfaceType(wifi_chip_, IfaceType::STA, &mode_id));
+    const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+    return status_and_caps.second;
+  }
+
+  sp<IWifiChip> wifi_chip_;
+};
+
+/*
+ * SelectTxPowerScenario_1_2_body
+ * This test case tests the selectTxPowerScenario_1_2() API with SAR scenarios
+ * newly defined in 1.2
+ */
+TEST_F(WifiChipHidlTest, SelectTxPowerScenario_1_2_body) {
+  uint32_t caps = configureChipForStaIfaceAndGetCapabilities();
+  const auto& status =
+      HIDL_INVOKE(wifi_chip_, selectTxPowerScenario_1_2, kPowerScenarioBody);
+  if (caps & (IWifiChip::ChipCapabilityMask::SET_TX_POWER_LIMIT |
+              IWifiChip::ChipCapabilityMask::USE_BODY_HEAD_SAR)) {
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status.code);
+  } else {
+    EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status.code);
+  }
+}
+
+/*
+ * SelectTxPowerScenario_1_2_voiceCall
+ * This test case tests the selectTxPowerScenario_1_2() API with previously
+ * defined SAR scenarios
+ */
+TEST_F(WifiChipHidlTest, SelectTxPowerScenario_1_2_voiceCall) {
+  uint32_t caps = configureChipForStaIfaceAndGetCapabilities();
+  const auto& status =
+      HIDL_INVOKE(wifi_chip_, selectTxPowerScenario_1_2, kPowerScenarioVoiceCall);
+  if (caps & (IWifiChip::ChipCapabilityMask::SET_TX_POWER_LIMIT)) {
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status.code);
+  } else {
+    EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status.code);
+  }
+}
+
+/*
+ * registerEventCallback_1_2
+ * This test case tests the registerEventCallback_1_2() API which registers
+ * a call back function with the hal implementation
+ *
+ * Note: it is not feasible to test the invocation of the call back function
+ * since event is triggered internally in the HAL implementation, and can not be
+ * triggered from the test case
+ */
+TEST_F(WifiChipHidlTest, registerEventCallback_1_2) {
+    sp<WifiChipEventCallback> wifiChipEventCallback = new WifiChipEventCallback();
+    const auto& status =
+        HIDL_INVOKE(wifi_chip_, registerEventCallback_1_2, wifiChipEventCallback);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status.code);
+}