diff --git a/camera/provider/2.4/default/service.cpp b/camera/provider/2.4/default/service.cpp
index 84f4839..0a4f787 100644
--- a/camera/provider/2.4/default/service.cpp
+++ b/camera/provider/2.4/default/service.cpp
@@ -22,9 +22,9 @@
 
 #include <android/hardware/camera/provider/2.4/ICameraProvider.h>
 #include <binder/ProcessState.h>
-#include <cutils/memory.h>
 #include <cutils/properties.h>
 #include <hidl/LegacySupport.h>
+#include <malloc.h>
 
 using android::status_t;
 using android::hardware::defaultLazyPassthroughServiceImplementation;
@@ -46,7 +46,13 @@
 
     // b/166675194
     if (property_get_bool("ro.vendor.camera.provider24.disable_mem_init", false)) {
-        process_disable_memory_mitigations();
+        if (mallopt(M_BIONIC_ZERO_INIT, 0) == 0) {
+            // Note - heap initialization is only present on devices with Scudo.
+            // Devices with jemalloc don't have heap-init, and thus the mallopt
+            // will fail. On these devices, you probably just want to remove the
+            // property.
+            ALOGE("Disabling heap initialization failed.");
+        }
     }
 
     status_t status;
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 5a6f168..fa0a70e 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -84,7 +84,7 @@
         <name>android.hardware.automotive.sv</name>
         <version>1.0</version>
         <interface>
-            <name>ISurroundView</name>
+            <name>ISurroundViewService</name>
             <instance>default</instance>
         </interface>
     </hal>
diff --git a/radio/1.6/IRadio.hal b/radio/1.6/IRadio.hal
index 4e9dcdb..a398e7d 100644
--- a/radio/1.6/IRadio.hal
+++ b/radio/1.6/IRadio.hal
@@ -18,12 +18,9 @@
 
 
 import @1.0::CdmaSmsMessage;
-import @1.0::Dial;
 import @1.0::GsmSmsMessage;
 import @1.1::CardPowerState;
 import @1.2::DataRequestReason;
-import @1.4::EmergencyCallRouting;
-import @1.4::EmergencyServiceCategory;
 import @1.4::RadioAccessFamily;
 import @1.5::IRadio;
 import @1.5::AccessNetwork;
@@ -378,64 +375,6 @@
             int64_t completionDurationMillis);
 
     /**
-     * Initiate emergency voice call, with zero or more emergency service category(s), zero or
-     * more emergency Uniform Resource Names (URN), and routing information for handling the call.
-     * Android uses this request to make its emergency call instead of using @1.0::IRadio.dial
-     * if the 'address' in the 'dialInfo' field is identified as an emergency number by Android.
-     *
-     * In multi-sim scenario, if the emergency number is from a specific subscription, this radio
-     * request can still be sent out on the other subscription as long as routing is set to
-     * @1.4::EmergencyNumberRouting#EMERGENCY. This radio request will not be sent on an inactive
-     * (PIN/PUK locked) subscription unless both subscriptions are PIN/PUK locked. In this case,
-     * the request will be sent on the primary subscription.
-     *
-     * Some countries or carriers require some emergency numbers that must be handled with normal
-     * call routing if possible or emergency routing. 1) if the 'routing' field is specified as
-     * @1.4::EmergencyNumberRouting#NORMAL, the implementation must try the full radio service to
-     * use normal call routing to handle the call; if service cannot support normal routing, the
-     * implementation must use emergency routing to handle the call. 2) if 'routing' is specified
-     * as @1.4::EmergencyNumberRouting#EMERGENCY, the implementation must use emergency routing to
-     * handle the call. 3) if 'routing' is specified as @1.4::EmergencyNumberRouting#UNKNOWN,
-     * Android does not know how to handle the call.
-     *
-     * If the dialed emergency number does not have a specified emergency service category, the
-     * 'categories' field is set to @1.4::EmergencyServiceCategory#UNSPECIFIED; if the dialed
-     * emergency number does not have specified emergency Uniform Resource Names, the 'urns' field
-     * is set to an empty list. If the underlying technology used to request emergency services
-     * does not support the emergency service category or emergency uniform resource names, the
-     * field 'categories' or 'urns' may be ignored.
-     *
-     * In the scenarios that the 'address' in the 'dialInfo' field has other functions besides the
-     * emergency number function, if the 'hasKnownUserIntentEmergency' field is true, the user's
-     * intent for this dial request is emergency call, and the modem must treat this as an actual
-     * emergency dial; if the 'hasKnownUserIntentEmergency' field is false, Android does not know
-     * user's intent for this call.
-     *
-     * If 'isTesting' is true, this request is for testing purpose, and must not be sent to a real
-     * emergency service; otherwise it's for a real emergency call request.
-     *
-     * Reference: 3gpp 22.101, Section 10 - Emergency Calls;
-     *            3gpp 23.167, Section 6 - Functional description;
-     *            3gpp 24.503, Section 5.1.6.8.1 - General;
-     *            RFC 5031
-     *
-     * @param serial Serial number of request.
-     * @param dialInfo the same @1.0::Dial information used by @1.0::IRadio.dial.
-     * @param categories bitfield<@1.4::EmergencyServiceCategory> the Emergency Service Category(s)
-     *     of the call.
-     * @param urns the emergency Uniform Resource Names (URN)
-     * @param routing @1.4::EmergencyCallRouting the emergency call routing information.
-     * @param hasKnownUserIntentEmergency Flag indicating if user's intent for the emergency call
-     *     is known.
-     * @param isTesting Flag indicating if this request is for testing purpose.
-     *
-     * Response function is IRadioResponse.emergencyDialResponse()
-     */
-    oneway emergencyDial_1_6(int32_t serial, Dial dialInfo,
-            bitfield<EmergencyServiceCategory> categories, vec<string> urns,
-            EmergencyCallRouting routing, bool hasKnownUserIntentEmergency, bool isTesting);
-
-    /**
      * Get which bands the modem's background scan is acting on.
      *
      * @param serial Serial number of request.
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_api.cpp b/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
index 44900b8..8b87292 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
@@ -412,167 +412,6 @@
 }
 
 /*
- * Test IRadio.emergencyDial() for the response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories = static_cast<int>(
-            ::android::hardware::radio::V1_4::EmergencyServiceCategory::UNSPECIFIED);
-    std::vector<hidl_string> urns = {""};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::UNKNOWN;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
- * Test IRadio.emergencyDial() with specified service and its response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6_withServices) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories =
-            static_cast<int>(::android::hardware::radio::V1_4::EmergencyServiceCategory::AMBULANCE);
-    std::vector<hidl_string> urns = {"urn:service:sos.ambulance"};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::UNKNOWN;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial_withServices, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
- * Test IRadio.emergencyDial() with known emergency call routing and its response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6_withEmergencyRouting) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories = static_cast<int>(
-            ::android::hardware::radio::V1_4::EmergencyServiceCategory::UNSPECIFIED);
-    std::vector<hidl_string> urns = {""};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::EMERGENCY;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial_withEmergencyRouting, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
  * Test IRadio.getCurrentCalls_1_6() for the response returned.
  */
 TEST_P(RadioHidlTest_v1_6, getCurrentCalls_1_6) {
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_test.cpp b/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
index 59f7682..79c3cde 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
+++ b/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
@@ -74,29 +74,6 @@
     return status;
 }
 
-void RadioHidlTest_v1_6::clearPotentialEstablishedCalls() {
-    // Get the current call Id to hangup the established emergency call.
-    serial = GetRandomSerialNumber();
-    radio_v1_6->getCurrentCalls_1_6(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-
-    // Hang up to disconnect the established call channels.
-    for (const ::android::hardware::radio::V1_6::Call& call : radioRsp_v1_6->currentCalls) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->hangup(serial, call.base.base.index);
-        ALOGI("Hang up to disconnect the established call channel: %d", call.base.base.index);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        // Give some time for modem to disconnect the established call channel.
-        sleep(MODEM_EMERGENCY_CALL_DISCONNECT_TIME);
-    }
-
-    // Verify there are no more current calls.
-    serial = GetRandomSerialNumber();
-    radio_v1_6->getCurrentCalls_1_6(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(0, radioRsp_v1_6->currentCalls.size());
-}
-
 void RadioHidlTest_v1_6::updateSimCardStatus() {
     serial = GetRandomSerialNumber();
     radio_v1_6->getIccCardStatus(serial);
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
index db067d7..5fcfa3b 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
+++ b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
@@ -70,8 +70,7 @@
     ::android::hardware::radio::V1_6::RadioResponseInfo rspInfo;
 
     // Call
-    hidl_vec<::android::hardware::radio::V1_6::Call> currentCalls;
-    ::android::hardware::radio::V1_2::VoiceRegStateResult voiceRegResp;
+    hidl_vec<::android::hardware::radio::V1_2::Call> currentCalls;
 
     // Sms
     SendSmsResult sendSmsResult;
diff --git a/radio/1.6/vts/functional/radio_response.cpp b/radio/1.6/vts/functional/radio_response.cpp
index ba84fd4..7c5cf6d 100644
--- a/radio/1.6/vts/functional/radio_response.cpp
+++ b/radio/1.6/vts/functional/radio_response.cpp
@@ -816,11 +816,8 @@
 }
 
 Return<void> RadioResponse_v1_6::getVoiceRegistrationStateResponse_1_2(
-        const ::android::hardware::radio::V1_0::RadioResponseInfo& info,
-        const ::android::hardware::radio::V1_2::VoiceRegStateResult& voiceRegResponse) {
-    rspInfo_v1_0 = info;
-    voiceRegResp = voiceRegResponse;
-    parent_v1_6.notify(info.serial);
+        const ::android::hardware::radio::V1_0::RadioResponseInfo& /*info*/,
+        const ::android::hardware::radio::V1_2::VoiceRegStateResult& /*voiceRegResponse*/) {
     return Void();
 }
 
@@ -1213,9 +1210,8 @@
 
 Return<void> RadioResponse_v1_6::getCurrentCallsResponse_1_6(
         const ::android::hardware::radio::V1_6::RadioResponseInfo& info,
-        const ::android::hardware::hidl_vec<::android::hardware::radio::V1_6::Call>& calls) {
+        const ::android::hardware::hidl_vec<::android::hardware::radio::V1_6::Call>& /*calls*/) {
     rspInfo = info;
-    currentCalls = calls;
     parent_v1_6.notify(info.serial);
     return Void();
 }
diff --git a/radio/config/1.3/types.hal b/radio/config/1.3/types.hal
index bedb709..ba964bf 100644
--- a/radio/config/1.3/types.hal
+++ b/radio/config/1.3/types.hal
@@ -19,4 +19,10 @@
 /**
  * Contains the device capabilities with respect to the Radio HAL.
  */
-struct HalDeviceCapabilities {};
+struct HalDeviceCapabilities {
+  /**
+   * True indicates that the modem is missing features within the current
+   * version of the Radio HAL.
+   */
+  bool modemReducedFeatureSet1;
+};
diff --git a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
index 78da3e8..c720d6d 100644
--- a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
+++ b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
@@ -36,4 +36,5 @@
   SOFTWARE = 0,
   TRUSTED_ENVIRONMENT = 1,
   STRONGBOX = 2,
+  KEYSTORE = 100,
 }
diff --git a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
index b149ac9..69bec2d7 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
@@ -36,7 +36,6 @@
      * deciding whether a given tag from `keyParams` argument to the generation/import method should
      * be returned in `keyCharacteristics` are:
      *
-     * - If the IKeyMintDevice cannot fully enforce the semantics of the tag, it should be omitted.
      * - If the semantics of the tag are fully enforced by the IKeyMintDevice, without any
      *   assistance from components running at other security levels, it should be included in an
      *   entry with the SecurityLevel of the IKeyMintDevice.
@@ -45,6 +44,9 @@
      *   SecurityLevel of the involved components.  For example if a StrongBox IKeyMintDevice relies
      *   on a TEE to validate biometric authentication, biometric authentication tags go in an entry
      *   with SecurityLevel::TRUSTED_ENVIRONMENT.
+     * - If the semantics are not enforced by KeyMint at all, SecurityLevel::KEYSTORE is used to
+     *   indicate that Keystore should enforce.  Note that in Keymaster (predecessor to KeyMint),
+     *   these tags would have been in SecurityLevel::SOFTWARE.
      */
     KeyCharacteristics[] keyCharacteristics;
 
diff --git a/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl b/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
index 10363e9..c63859c 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
@@ -17,16 +17,59 @@
 package android.hardware.security.keymint;
 
 /**
- * Device security levels.
+ * Device security levels.  These enum values are used in two ways:
+ *
+ * 1.  Returned from IKeyMintDevice::getHardwareInfo to identify the security level of the
+ *     IKeyMintDevice.  This characterizes the sort of environment in which the KeyMint
+ *     implementation runs, and therefore the security of its operations.
+ *
+ * 2.  Associated with individual KeyMint authorization Tags in KeyCharacteristics or in attestation
+ *     certificates.  This specifies the security level of the weakest environment involved in
+ *     enforcing that particular tag, i.e. the sort of security environment an attacker would have
+ *     to subvert in order to break the enforcement of that tag.
  */
 @VintfStability
 @Backing(type="int")
 enum SecurityLevel {
+    /**
+     * The SOFTWARE security level represents a KeyMint implementation that runs in an Android
+     * process, or a tag enforced by such an implementation.  An attacker who can compromise that
+     * process, or obtain root, or subvert the kernel on the device can defeat it.
+     *
+     * Note that the distinction between SOFTWARE and KEYSTORE is only relevant on-device.  For
+     * attestation purposes, these categories are combined into the software-enforced authorization
+     * list.
+     */
     SOFTWARE = 0,
+
+    /**
+     * The TRUSTED_ENVIRONMENT security level represents a KeyMint implementation that runs in an
+     * Android process, or a tag enforced by such an implementation.  An attacker who completely
+     * compromises Android, including the Linux kernel, does not have the ability to subvert it.  At
+     * attacker who can find an exploit that gains them control of the trusted environment, or who
+     * has access to the physical device and can mount a sophisticated hardware attack, may be able
+     * to defeat it.
+     */
     TRUSTED_ENVIRONMENT = 1,
     /**
-     * STRONGBOX specifies that the secure hardware satisfies the requirements specified in CDD
-     * 9.11.2.
+     * The STRONGBOX security level represents a KeyMint implementation that runs in security
+     * hardware that satisfies the requirements specified in CDD 9.11.2.  Roughly speaking, these
+     * are discrete, security-focus computing environments that are hardened against physical and
+     * side channel attack, and have had their security formally validated by a competent
+     * penetration testing lab.
      */
     STRONGBOX = 2,
+
+    /**
+     * KeyMint implementations must never return the KEYSTORE security level from getHardwareInfo.
+     * It is used to specify tags that are not enforced by the IKeyMintDevice, but are instead
+     * to be enforced by Keystore.  An attacker who can subvert the keystore process or gain root or
+     * subvert the kernel can prevent proper enforcement of these tags.
+     *
+     *
+     * Note that the distinction between SOFTWARE and KEYSTORE is only relevant on-device.  When
+     * KeyMint generates an attestation certificate, these categories are combined into the
+     * software-enforced authorization list.
+     */
+    KEYSTORE = 100
 }
diff --git a/tetheroffload/control/1.1/IOffloadControl.hal b/tetheroffload/control/1.1/IOffloadControl.hal
index eb5b8a1..2eb54c8 100644
--- a/tetheroffload/control/1.1/IOffloadControl.hal
+++ b/tetheroffload/control/1.1/IOffloadControl.hal
@@ -37,11 +37,9 @@
      * offload is started. This is because the quota values would likely become stale over
      * time and would not reflect any new traffic that has occurred.
      *
-     * This API replaces {@link @1.0::IOffloadControl::setDataLimit}, the framework would always
-     * calls this API if 1.1 HAL is supported. Otherwise, calls the other one. Thus, no
-     * interaction between the two APIs need to be addressed. However, the hardware implementation
-     * still needs to keep functionality of both in case of shipping with older framework that
-     * doesn't support 1.1 HAL.
+     * This API replaces {@link @1.0::IOffloadControl::setDataLimit}, the framework will always
+     * call setDataWarningAndLimit on 1.1 implementations, and setDataLimit on 1.0 implementations.
+     * Thus, no interaction between the two APIs need to be addressed.
      *
      * The specified quota bytes MUST replace any previous quotas set by
      * {@code setDataWarningAndLimit} specified on the same interface. It may be interpreted as