diff --git a/apexkey/Android.bp b/apexkey/Android.bp
new file mode 100644
index 0000000..e74717a
--- /dev/null
+++ b/apexkey/Android.bp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+apex_key {
+    name: "com.android.hardware.key",
+    public_key: "com.android.hardware.avbpubkey",
+    private_key: "com.android.hardware.pem",
+}
+
+android_app_certificate {
+    name: "com.android.hardware.certificate",
+    certificate: "com.android.hardware",
+}
diff --git a/apexkey/OWNERS b/apexkey/OWNERS
new file mode 100644
index 0000000..38765f9
--- /dev/null
+++ b/apexkey/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 296524155
+
+jooyung@google.com
diff --git a/apexkey/com.android.hardware.avbpubkey b/apexkey/com.android.hardware.avbpubkey
new file mode 100644
index 0000000..12f0370
--- /dev/null
+++ b/apexkey/com.android.hardware.avbpubkey
Binary files differ
diff --git a/apexkey/com.android.hardware.pem b/apexkey/com.android.hardware.pem
new file mode 100644
index 0000000..4d2882b
--- /dev/null
+++ b/apexkey/com.android.hardware.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCmirL5vFcGDqg9
+JqKZwRqzPr76t8aqJSu+UOdnlmqBLmUBaeun2KwRsZiLku933m5MNv+CPnVQW7ij
+z0lv0z/qB8SXN+KAgSqRdIjL1ySQgp8ygKHu+GcvbMFj9pVuqufwSrEOY9Un1RRY
+InDDj88c/aNbCw64d1QVedgUIs5KDDLjOzkcrrbH+Th26r2YjhlRKQXCZT5jW1fY
+2gJg5LPeuM4fI63ESxFyRTY/V8E3LbAuTYKBSrHRbec22oCkL/pUilJBe2r8aNyp
+ACWEJB96uWdKmIYDCdj6r6SNzHM3S4X+l1C9/Gi9UNK8nuIAI3v2qW07S2RABAWX
+vKfE8rIKAdFmajGlHKfRe6IL9ka1/rsM1xgDr2/FgEsyRgrfJvlvvMb7ampMgTKu
+Az/hv4siSaDD2E3JrRyh3nNxTCuIABla7/jGmNz6vIdwTRJsa2RIEezkeMiUy+jp
+VyeYsWIEBmQwZ5+k6YbdrKTULaay3UJ6/YXEQY9Sbg0JL/7sjQWILwnrtab3/jsn
+iWsr59Qsaf+q3PnrWPCXT/KC8DwKi/2zSWfCX8MHreqaoozjfWXeD87lnBAhukBS
+984xWEmStJGFQG29J4sF4NmgO1I8GPqQRtoB6ghme11U2EX0vIqrDNccX12ohqgh
+CfwMXX64WV5fWscmSLZin5xK+AN+/wIDAQABAoICABLDnda1ebic/ielqrxYHYIE
+l8/31NJmzb7rrqblM6rKZ2b5YCvRJdH4iI9xRrnivdqod7FdCCq9qtgKCuQmkRT1
+Oxkumr6PzxQEZUVSQDRoAzfVdmlOY5HcVw3EQqHtb6SLRdexN9r9DwW/G6VtFpDV
+owom/Mmb6EVjLQ1XvpZpOXKQwaaRqNZvJgV//Uyq9f9G9/cnIRhguk0cgxgXrIxz
+lgW8J1/udVDCq5IHeSWWaDtPUFzw5YgLMfnkNIpLPZE45HusRCmcRwBjm9Z/m2xg
+Z1roRHEjMudL0uaHGpQoVjiRI+/D+Kkb6iKGZEBPvy/TdxMvM2RjD55BC0YNcjGv
+kXTMLwj2ke824rUPJJOYN8bJFIpOYblMcbDrxYVlDZetKOMc6EJw90xaj4za2IMS
+vWDxZx1WQPcn+B/nUvrMMOTN6MkNYKR97lmxBYP6TeCiUUytZiCF72cvvpYcdhE9
+zzOES5kVakSE8NnLTH9xAjrpAguxI9gqxeyLALhz/Rb46fgWwnhcBdqmPtez/IHb
+BgF81SSobSaBlzLcnRyrjwBRWA21DP8U/ApUkmHR/Lm1BJejzxf1hj35Hp9XUwdC
+JK7aoVnjuko/l5TPn0Bvm4pcBArG0AUL75GlRgDJTVCDZbLFR/2JZlnZ9optvN6E
+vniu3HwBRHDHn0K1DqIBAoIBAQDpdBJtyizIlZ5p6k1f0wWE/B2riPzPwv/a+ygD
+GOtzWsukyZjWHXVPjx2XY3bwlbusiqhJE1OcF+oymHTtSSv3VsqMmo2VDIj8d21T
+ycpBvV7+mcehGk6o6lGTJAiPc1wVMajmM0Co2LQb4hRvf2p8dW6+RRn5c3o288B5
+e45zpbq9+l9PMpgrmOBU3m652JmGK8JqQKeKKT96kZQVf/U3ArMif+jW2piAZnmG
+CS00el0K0RtZe/iKrFftoD27ai9GNZx/Z1p55x+9vUD15LiQ/MK0Bk/f9b24zE98
+6T07KAGPB5gXWlSs2yEk4Waufjw3JSYXs18kEoMklTA0IGGhAoIBAQC2oEwGQZI0
+oR1oL7P76FyMNjtp2T2wYnOcnGeKjp4vxZWTZNRfNUmzGqSamVE1ZPhj721sAImS
+mk1pUJbglkpP6aMDNXzA6Z50PuXfhF5+dXBrLftT1tcNo/8/ysd/iKsi1C6hWZ9L
+YYt/7uR8wazeG65jahsOKEfCrNyDBQzyoSft1qfVTvYzxUVmJRQr5S7H0c9jPTwg
+Qj+/RQsDOspsJrBC5+H0tLPkvZDdZCYvdBzVWFL7npHd0fy53TmT6kEjDwwAiE8W
+VggvzkhHOnprAiwq36nlpGo3um5Ona98dXWZ4rfELEdSUOiWCz2Gzz7IL+H8uhen
+iXQAtlAlMVyfAoIBAQDDGmlobgW9YSVyWQlvIxnCyT02pZa7P7m6VhpbdFEaJ/B3
+eLANibMH2ZCee9bkPA8LpRn9cHR4yJfGzxkxUey3mkZO+b+HqGE3tcudsdAh3tTs
+LLLk1eqVSrcAJKYu1PdJEyaXtI++TNVBVFFF2ZOyDiaOR4vsqPCjylS6cmNcDU6j
+BQLwWlVIYkxhQUACe53avumNCRm74rsVgWLkEPtrjQsOsx1xqmC3Nm0rcrHf4L+v
+kZCs2Wme42fcxQWygoydvaJb65F2vY0OcoM+vXbuXP+PmpLYljSHo+BugTLWJJog
+4fTe13RavgvWGbZJ8F/8qkRKnHLP39TQFwqhFcrhAoIBAQCZYipX+syUHVl4ftA4
+2+CW9pmR/h5cvWOCfq5L5hqf3uAQqlfgGv5qSg9DtU9KfCJOtPH/CriBA83OjRwb
+Rr7lPUJnWI4N7GjkE0u4HhHLPlGMA1OaB9AZKcsgxewmhh/OIc2EQKSUiDnE2lzX
+F0dcSH2AC8brbhNPQyX1eNF2GrpRfL77XdVUh/QQpUW61EMlGmeHXw/XvCyUNaXZ
+MZB/o0LY/q59eyO4EyrPduTHaEsrOIKByJ2UY2BSrqZEQDQzANlAvTtHdDxuAmAc
+StY0d9+mprGoKR347kDlEHUqH/EErTFQtyuzzDZ8hrZHOlrtgaHZRGbHlJ90Vasc
+gcfbAoIBAEIR0dtmd38dC7r0h0SZ7ORIvm9F8JRs+wKdWjiPfWLK3trR/jxRx6Eh
+xrrJEoRCeUmT6rc0TwUkzow5ApcEY338KmsqKVbm3iGfPpvZFEO44vBrg3280QBM
+PerIrEfidflUAE9QXNoBpvvnh2KXIOsvyN2MeY2SAyebPJQJtWzJkP35Y8fOtZkJ
+VtIhYj2wvFuobl7iuxKJG0cn4xL3OLysc03oX7Al2qA42hUCy7UMsTT6ZAPWd49+
+3gOFrqmaV3Hu5KY2HaX6Yly5ohhQWSkSL1kZMo9Uq6tTM+2HFzFU6sveFbWW/XQc
+rWnazDdd1WkHT6+nzA/NX24OzPjiUk0=
+-----END PRIVATE KEY-----
diff --git a/apexkey/com.android.hardware.pk8 b/apexkey/com.android.hardware.pk8
new file mode 100644
index 0000000..97007d2
--- /dev/null
+++ b/apexkey/com.android.hardware.pk8
Binary files differ
diff --git a/apexkey/com.android.hardware.x509.pem b/apexkey/com.android.hardware.x509.pem
new file mode 100644
index 0000000..2728a23
--- /dev/null
+++ b/apexkey/com.android.hardware.x509.pem
@@ -0,0 +1,34 @@
+-----BEGIN CERTIFICATE-----
+MIIF6TCCA9ECFDAU6pJXjblHA/w9a354h2QUOharMA0GCSqGSIb3DQEBCwUAMIGv
+MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91
+bnRhaW4gVmlldzEQMA4GA1UECgwHQW5kcm9pZDEQMA4GA1UECwwHQW5kcm9pZDEi
+MCAGCSqGSIb3DQEJARYTYW5kcm9pZEBhbmRyb2lkLmNvbTErMCkGA1UEAwwiY29t
+LmFuZHJvaWQuaGFyZHdhcmUudGhyZWFkbmV0d29yazAgFw0yMzA4MjQwNjE4MTZa
+GA80NzYxMDcyMDA2MTgxNlowga8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxp
+Zm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRAwDgYDVQQKDAdBbmRyb2lk
+MRAwDgYDVQQLDAdBbmRyb2lkMSIwIAYJKoZIhvcNAQkBFhNhbmRyb2lkQGFuZHJv
+aWQuY29tMSswKQYDVQQDDCJjb20uYW5kcm9pZC5oYXJkd2FyZS50aHJlYWRuZXR3
+b3JrMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5eMXZfeadUJiqZ0b
+kbXYSbzjd1opoeAVk/+LxGyBLLPy2z2EAeuUBx8HYEJhyPOyUrs3ohP6OvAtE8O4
+JeEbGBzqOymusKbve8ght7tDjUuTYsbBsKQWw1Gu/UUK7x3lc6zD+wDTK/5NUoTA
+I/5lI8Q4+NHCI1jb/uBRGSlzSO+k2A2oVUPdyaWWgGhLeEiXKo+Xy6XXduhFK1wc
+iSCgVyuQkZnbrJrGCGS1LD1MavsfBTthD3jfuOq+YqMjGjdi6xVPG3fZnwwdVNzW
+mSFwWwHif56ZAtxyZVtQOAksTqwAwGrUjhn70rw5eLBQjXIL1061cLrOZ4XlRSZj
+kHB8mwr6OQOw7isMORO0h+NNJ+5POa5V9rGylqk/hn1vzcTX62YUZy1N6b3rfGc2
+p9LA6STjvoXLeCFaSIc+LfTiHOamkg7LuLlsQ/AIoXeuaLyWAgg4ls2U8IG1Mdkz
+BClX5vMG/At6yZqHiCIbCU8V8VSCz7Rtuu+C/87G5Pwb/G1r4FHXr9x7d0qj4rWV
+u9MhdzvZWoTTnEzDA+DWPQM/ILkGdkSj0g4yC8GR/F5p7xWQ0vqyMyM/ii1KzWVs
+ZJFUxzpGX99C0mfjT2hezHzfEyisPec39PFbdxzC756yP1Le8I5qjMbjl+XeFjxO
+REoC0nDFgHEI7C5RunT1osKmpDUCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEA3HPY
++nHGFE9aFQbEsjvotuxguLMKmrgQ44yGBTr9349MPvnxGDdz1HPWs/m456k9HQxt
+1YWV+xr56NS37UDVMkqS7hzCkJe/LdMT51qvUS+hPHLzSuZNKuFAaCOb8WDa7tGQ
+MuvISlb6T7G512fUdFDRjFjnIXDLTYANzoxI3cqs2N2xQNxsL8uIJ79RWlPm2Upz
+Y5Ad55kv3EygWgirvZnSNo27E/Tt4Bo9KS0HsYXVHgWK9zHHtup1vDOntJ8bX16C
+rP7e8SELanPbUtyIUDcf14P3EFztUYBZIXO2HUSsoOTX3+Hd592h7EsnGDdlWSLU
+oreaRWCAMh4TKI/eP+1N35b8zmPMHaG+WsWjdDPrs6oNpr2MMA4U8AHGW2d6QY0N
+xZ/VhhbjbHMgmmB3Q2LXZZufbSEBawBfuFjhodfmKSgTjNCTYXtTiT/pL2w0PqEM
+v4UxrGD0uFQafFKuxQfL2LYG5tg46daRrT3BoIqLKoseTuykzW4z08NuurwsLvmy
+t7njqMxlf/tN9o+d3D3lWHQpiDJ8kC/TjgKBj7iQTCOJeShutxyR2F3R+3+kUXpP
+w7O4QfoqZDca1qtJRtew2tpmOb1hFkj/QzRi5WRx/oM/Cm0yMttYIA+4vCJeDOja
+gngrtH3jmEwMME71HDyXHlcCIIt95odXoBSBKgk=
+-----END CERTIFICATE-----
diff --git a/atrace/1.0/vts/functional/OWNERS b/atrace/OWNERS
similarity index 97%
rename from atrace/1.0/vts/functional/OWNERS
rename to atrace/OWNERS
index 31043aa..d76ffa6 100644
--- a/atrace/1.0/vts/functional/OWNERS
+++ b/atrace/OWNERS
@@ -1,2 +1,3 @@
 # Bug component: 837454
+
 wvw@google.com
diff --git a/audio/aidl/default/Module.cpp b/audio/aidl/default/Module.cpp
index f81095e..3117134 100644
--- a/audio/aidl/default/Module.cpp
+++ b/audio/aidl/default/Module.cpp
@@ -454,16 +454,15 @@
             LOG(ERROR) << __func__ << ": port id " << templateId << " is not a device port";
             return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
         }
-        if (!templateIt->profiles.empty()) {
-            LOG(ERROR) << __func__ << ": port id " << templateId
-                       << " does not have dynamic profiles";
-            return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
-        }
         auto& templateDevicePort = templateIt->ext.get<AudioPortExt::Tag::device>();
         if (templateDevicePort.device.type.connection.empty()) {
             LOG(ERROR) << __func__ << ": port id " << templateId << " is permanently attached";
             return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
         }
+        if (mConnectedDevicePorts.find(templateId) != mConnectedDevicePorts.end()) {
+            LOG(ERROR) << __func__ << ": port id " << templateId << " is a connected device port";
+            return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+        }
         // Postpone id allocation until we ensure that there are no client errors.
         connectedPort = *templateIt;
         connectedPort.extraAudioDescriptors = in_templateIdAndAdditionalData.extraAudioDescriptors;
@@ -486,19 +485,23 @@
         }
     }
 
-    if (!mDebug.simulateDeviceConnections) {
-        RETURN_STATUS_IF_ERROR(populateConnectedDevicePort(&connectedPort));
-    } else {
-        auto& connectedProfiles = getConfig().connectedProfiles;
-        if (auto connectedProfilesIt = connectedProfiles.find(templateId);
-            connectedProfilesIt != connectedProfiles.end()) {
-            connectedPort.profiles = connectedProfilesIt->second;
-        }
-    }
     if (connectedPort.profiles.empty()) {
-        LOG(ERROR) << "Profiles of a connected port still empty after connecting external device "
-                   << connectedPort.toString();
-        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        if (!mDebug.simulateDeviceConnections) {
+            RETURN_STATUS_IF_ERROR(populateConnectedDevicePort(&connectedPort));
+        } else {
+            auto& connectedProfiles = getConfig().connectedProfiles;
+            if (auto connectedProfilesIt = connectedProfiles.find(templateId);
+                connectedProfilesIt != connectedProfiles.end()) {
+                connectedPort.profiles = connectedProfilesIt->second;
+            }
+        }
+        if (connectedPort.profiles.empty()) {
+            LOG(ERROR) << __func__
+                       << ": profiles of a connected port still empty after connecting external "
+                          "device "
+                       << connectedPort.toString();
+            return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
     }
 
     for (auto profile : connectedPort.profiles) {
@@ -514,7 +517,7 @@
 
     connectedPort.id = ++getConfig().nextPortId;
     auto [connectedPortsIt, _] =
-            mConnectedDevicePorts.insert(std::pair(connectedPort.id, std::vector<int32_t>()));
+            mConnectedDevicePorts.insert(std::pair(connectedPort.id, std::set<int32_t>()));
     LOG(DEBUG) << __func__ << ": template port " << templateId << " external device connected, "
                << "connected port ID " << connectedPort.id;
     ports.push_back(connectedPort);
@@ -547,9 +550,21 @@
     // of all profiles from all routable dynamic device ports would be more involved.
     for (const auto mixPortId : routablePortIds) {
         auto portsIt = findById<AudioPort>(ports, mixPortId);
-        if (portsIt != ports.end() && portsIt->profiles.empty()) {
-            portsIt->profiles = connectedPort.profiles;
-            connectedPortsIt->second.push_back(portsIt->id);
+        if (portsIt != ports.end()) {
+            if (portsIt->profiles.empty()) {
+                portsIt->profiles = connectedPort.profiles;
+                connectedPortsIt->second.insert(portsIt->id);
+            } else {
+                // Check if profiles are non empty because they were populated by
+                // a previous connection. Otherwise, it means that they are not empty because
+                // the mix port has static profiles.
+                for (const auto cp : mConnectedDevicePorts) {
+                    if (cp.second.count(portsIt->id) > 0) {
+                        connectedPortsIt->second.insert(portsIt->id);
+                        break;
+                    }
+                }
+            }
         }
     }
     *_aidl_return = std::move(connectedPort);
@@ -604,13 +619,20 @@
         }
     }
 
-    for (const auto mixPortId : connectedPortsIt->second) {
+    // Clear profiles for mix ports that are not connected to any other ports.
+    std::set<int32_t> mixPortsToClear = std::move(connectedPortsIt->second);
+    mConnectedDevicePorts.erase(connectedPortsIt);
+    for (const auto& connectedPort : mConnectedDevicePorts) {
+        for (int32_t mixPortId : connectedPort.second) {
+            mixPortsToClear.erase(mixPortId);
+        }
+    }
+    for (int32_t mixPortId : mixPortsToClear) {
         auto mixPortIt = findById<AudioPort>(ports, mixPortId);
         if (mixPortIt != ports.end()) {
             mixPortIt->profiles = {};
         }
     }
-    mConnectedDevicePorts.erase(connectedPortsIt);
 
     return ndk::ScopedAStatus::ok();
 }
diff --git a/audio/aidl/default/Stream.cpp b/audio/aidl/default/Stream.cpp
index af89f5f..f7298c0 100644
--- a/audio/aidl/default/Stream.cpp
+++ b/audio/aidl/default/Stream.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <pthread.h>
+
 #define LOG_TAG "AHAL_Stream"
 #include <android-base/logging.h>
 #include <android/binder_ibinder_platform.h>
@@ -94,6 +96,14 @@
     mDataMQ.reset();
 }
 
+pid_t StreamWorkerCommonLogic::getTid() const {
+#if defined(__ANDROID__)
+    return pthread_gettid_np(pthread_self());
+#else
+    return 0;
+#endif
+}
+
 std::string StreamWorkerCommonLogic::init() {
     if (mContext->getCommandMQ() == nullptr) return "Command MQ is null";
     if (mContext->getReplyMQ() == nullptr) return "Reply MQ is null";
@@ -164,7 +174,7 @@
     switch (command.getTag()) {
         case Tag::halReservedExit:
             if (const int32_t cookie = command.get<Tag::halReservedExit>();
-                cookie == mContext->getInternalCommandCookie()) {
+                cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
                 mDriver->shutdown();
                 setClosed();
                 // This is an internal command, no need to reply.
@@ -384,7 +394,7 @@
     switch (command.getTag()) {
         case Tag::halReservedExit:
             if (const int32_t cookie = command.get<Tag::halReservedExit>();
-                cookie == mContext->getInternalCommandCookie()) {
+                cookie == (mContext->getInternalCommandCookie() ^ getTid())) {
                 mDriver->shutdown();
                 setClosed();
                 // This is an internal command, no need to reply.
@@ -717,7 +727,7 @@
     if (auto commandMQ = mContext.getCommandMQ(); commandMQ != nullptr) {
         LOG(DEBUG) << __func__ << ": asking the worker to exit...";
         auto cmd = StreamDescriptor::Command::make<StreamDescriptor::Command::Tag::halReservedExit>(
-                mContext.getInternalCommandCookie());
+                mContext.getInternalCommandCookie() ^ mWorker->getTid());
         // Note: never call 'pause' and 'resume' methods of StreamWorker
         // in the HAL implementation. These methods are to be used by
         // the client side only. Preventing the worker loop from running
diff --git a/audio/aidl/default/include/core-impl/Module.h b/audio/aidl/default/include/core-impl/Module.h
index fb3eef2..bfdab51 100644
--- a/audio/aidl/default/include/core-impl/Module.h
+++ b/audio/aidl/default/include/core-impl/Module.h
@@ -142,7 +142,7 @@
     // ids of device ports created at runtime via 'connectExternalDevice'.
     // Also stores a list of ids of mix ports with dynamic profiles that were populated from
     // the connected port. This list can be empty, thus an int->int multimap can't be used.
-    using ConnectedDevicePorts = std::map<int32_t, std::vector<int32_t>>;
+    using ConnectedDevicePorts = std::map<int32_t, std::set<int32_t>>;
     // Maps port ids and port config ids to patch ids.
     // Multimap because both ports and configs can be used by multiple patches.
     using Patches = std::multimap<int32_t, int32_t>;
diff --git a/audio/aidl/default/include/core-impl/Stream.h b/audio/aidl/default/include/core-impl/Stream.h
index a02655f..88fddec 100644
--- a/audio/aidl/default/include/core-impl/Stream.h
+++ b/audio/aidl/default/include/core-impl/Stream.h
@@ -223,6 +223,7 @@
         : mContext(context),
           mDriver(driver),
           mTransientStateDelayMs(context->getTransientStateDelayMs()) {}
+    pid_t getTid() const;
     std::string init() override;
     void populateReply(StreamDescriptor::Reply* reply, bool isConnected) const;
     void populateReplyWrongState(StreamDescriptor::Reply* reply,
diff --git a/audio/aidl/default/include/effect-impl/EffectWorker.h b/audio/aidl/default/include/effect-impl/EffectWorker.h
deleted file mode 100644
index 421429a..0000000
--- a/audio/aidl/default/include/effect-impl/EffectWorker.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-#include <algorithm>
-#include <memory>
-#include <mutex>
-#include <string>
-
-#include "EffectContext.h"
-#include "EffectThread.h"
-
-namespace aidl::android::hardware::audio::effect {
-
-std::string toString(RetCode& code);
-
-class EffectWorker : public EffectThread {
-  public:
-    // set effect context for worker, suppose to only happen once here
-    void setContext(std::shared_ptr<EffectContext> context) {
-        std::call_once(mOnceFlag, [&]() { mContext = context; });
-    };
-
-    // handle FMQ and call effect implemented virtual function
-    void process() override {
-        RETURN_VALUE_IF(!mContext, void(), "nullContext");
-        std::shared_ptr<EffectContext::StatusMQ> statusMQ = mContext->getStatusFmq();
-        std::shared_ptr<EffectContext::DataMQ> inputMQ = mContext->getInputDataFmq();
-        std::shared_ptr<EffectContext::DataMQ> outputMQ = mContext->getOutputDataFmq();
-
-        // Only this worker will read from input data MQ and write to output data MQ.
-        auto readSamples = inputMQ->availableToRead(), writeSamples = outputMQ->availableToWrite();
-        if (readSamples && writeSamples) {
-            auto processSamples = std::min(readSamples, writeSamples);
-            LOG(VERBOSE) << __func__ << " available to read " << readSamples
-                         << " available to write " << writeSamples << " process " << processSamples;
-
-            auto buffer = mContext->getWorkBuffer();
-            inputMQ->read(buffer, processSamples);
-
-            IEffect::Status status = effectProcessImpl(buffer, buffer, processSamples);
-            outputMQ->write(buffer, status.fmqProduced);
-            statusMQ->writeBlocking(&status, 1);
-            LOG(VERBOSE) << __func__ << " done processing, effect consumed " << status.fmqConsumed
-                         << " produced " << status.fmqProduced;
-        } else {
-            // TODO: maybe add some sleep here to avoid busy waiting
-        }
-    }
-
-    // must implement by each effect implementation
-    // TODO: consider if this interface need adjustment to handle in-place processing
-    virtual IEffect::Status effectProcessImpl(float* in, float* out, int samples) = 0;
-
-  private:
-    // make sure the context only set once.
-    std::once_flag mOnceFlag;
-    std::shared_ptr<EffectContext> mContext;
-};
-
-}  // namespace aidl::android::hardware::audio::effect
diff --git a/audio/aidl/default/r_submix/StreamRemoteSubmix.cpp b/audio/aidl/default/r_submix/StreamRemoteSubmix.cpp
index 3134b86..9c9c08b 100644
--- a/audio/aidl/default/r_submix/StreamRemoteSubmix.cpp
+++ b/audio/aidl/default/r_submix/StreamRemoteSubmix.cpp
@@ -179,7 +179,7 @@
         LOG(ERROR) << __func__ << ": transfer without a pipe!";
         return ::android::UNEXPECTED_NULL;
     }
-
+    mCurrentRoute->exitStandby(mIsInput);
     return (mIsInput ? inRead(buffer, frameCount, actualFrameCount)
                      : outWrite(buffer, frameCount, actualFrameCount));
 }
@@ -190,17 +190,14 @@
         return ::android::NO_INIT;
     }
     const ssize_t framesInPipe = source->availableToRead();
-    if (framesInPipe < 0) {
-        return ::android::INVALID_OPERATION;
+    if (framesInPipe <= 0) {
+        // No need to update the position frames
+        return ::android::OK;
     }
     if (mIsInput) {
         position->frames += framesInPipe;
-    } else {
-        if (position->frames > framesInPipe) {
-            position->frames -= framesInPipe;
-        } else {
-            position->frames = 0;
-        }
+    } else if (position->frames >= framesInPipe) {
+        position->frames -= framesInPipe;
     }
     return ::android::OK;
 }
@@ -280,18 +277,14 @@
                                                size_t* actualFrameCount) {
     // about to read from audio source
     sp<MonoPipeReader> source = mCurrentRoute->getSource();
-    if (source == nullptr || source->availableToRead() == 0) {
-        if (source == nullptr) {
-            int readErrorCount = mCurrentRoute->notifyReadError();
-            if (readErrorCount < kMaxReadErrorLogs) {
-                LOG(ERROR) << __func__
-                           << ": no audio pipe yet we're trying to read! (not all errors will be "
-                              "logged)";
-            } else {
-                LOG(ERROR) << __func__ << ": Read errors " << readErrorCount;
-            }
+    if (source == nullptr) {
+        int readErrorCount = mCurrentRoute->notifyReadError();
+        if (readErrorCount < kMaxReadErrorLogs) {
+            LOG(ERROR) << __func__
+                       << ": no audio pipe yet we're trying to read! (not all errors will be "
+                          "logged)";
         } else {
-            LOG(INFO) << __func__ << ": no data to read yet, providing empty data";
+            LOG(ERROR) << __func__ << ": Read errors " << readErrorCount;
         }
         const size_t delayUs = static_cast<size_t>(
                 std::roundf(frameCount * MICROS_PER_SECOND / mStreamConfig.sampleRate));
@@ -306,9 +299,10 @@
     const size_t delayUs = static_cast<size_t>(std::roundf(kReadAttemptSleepUs));
     char* buff = (char*)buffer;
     size_t remainingFrames = frameCount;
+    int availableToRead = source->availableToRead();
 
-    while ((remainingFrames > 0) && (attempts < kMaxReadFailureAttempts)) {
-        LOG(VERBOSE) << __func__ << ": frames available to read " << source->availableToRead();
+    while ((remainingFrames > 0) && (availableToRead > 0) && (attempts < kMaxReadFailureAttempts)) {
+        LOG(VERBOSE) << __func__ << ": frames available to read " << availableToRead;
 
         ssize_t framesRead = source->read(buff, remainingFrames);
 
@@ -317,6 +311,7 @@
         if (framesRead > 0) {
             remainingFrames -= framesRead;
             buff += framesRead * mStreamConfig.frameSize;
+            availableToRead -= framesRead;
             LOG(VERBOSE) << __func__ << ": (attempts = " << attempts << ") got " << framesRead
                          << " frames, remaining=" << remainingFrames;
         } else {
diff --git a/audio/aidl/default/usb/StreamUsb.cpp b/audio/aidl/default/usb/StreamUsb.cpp
index b60b4fd..9b10432 100644
--- a/audio/aidl/default/usb/StreamUsb.cpp
+++ b/audio/aidl/default/usb/StreamUsb.cpp
@@ -52,7 +52,7 @@
         }
         connectedDeviceProfiles.push_back(*profile);
     }
-    RETURN_STATUS_IF_ERROR(setConnectedDevices(connectedDevices));
+    RETURN_STATUS_IF_ERROR(StreamCommonImpl::setConnectedDevices(connectedDevices));
     std::lock_guard guard(mLock);
     mConnectedDeviceProfiles = std::move(connectedDeviceProfiles);
     mConnectedDevicesUpdated.store(true, std::memory_order_release);
diff --git a/audio/aidl/vts/Android.bp b/audio/aidl/vts/Android.bp
index f7cf4ce..a2f0260 100644
--- a/audio/aidl/vts/Android.bp
+++ b/audio/aidl/vts/Android.bp
@@ -26,7 +26,10 @@
         "libaudioaidlcommon",
         "libaidlcommonsupport",
     ],
-    header_libs: ["libaudioaidl_headers"],
+    header_libs: [
+        "libaudioaidl_headers",
+        "libexpectedutils_headers",
+    ],
     cflags: [
         "-Wall",
         "-Wextra",
diff --git a/audio/aidl/vts/EffectHelper.h b/audio/aidl/vts/EffectHelper.h
index 685d07d..2c8edf2 100644
--- a/audio/aidl/vts/EffectHelper.h
+++ b/audio/aidl/vts/EffectHelper.h
@@ -250,11 +250,11 @@
                    maxLimit = std::numeric_limits<S>::max();
         if (s.size()) {
             const auto min = *s.begin(), max = *s.rbegin();
-            s.insert(min + (max - min) / 2);
-            if (min != minLimit) {
+            s.insert((min & max) + ((min ^ max) >> 1));
+            if (min > minLimit + 1) {
                 s.insert(min - 1);
             }
-            if (max != maxLimit) {
+            if (max < maxLimit - 1) {
                 s.insert(max + 1);
             }
         }
diff --git a/audio/aidl/vts/ModuleConfig.cpp b/audio/aidl/vts/ModuleConfig.cpp
index 7213034..af3597d 100644
--- a/audio/aidl/vts/ModuleConfig.cpp
+++ b/audio/aidl/vts/ModuleConfig.cpp
@@ -21,6 +21,7 @@
 #include <aidl/android/media/audio/common/AudioInputFlags.h>
 #include <aidl/android/media/audio/common/AudioIoFlags.h>
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
+#include <error/expected_utils.h>
 
 #include "ModuleConfig.h"
 
@@ -66,15 +67,36 @@
     return {};
 }
 
+std::vector<aidl::android::media::audio::common::AudioPort>
+ModuleConfig::getAudioPortsForDeviceTypes(const std::vector<AudioDeviceType>& deviceTypes,
+                                          const std::string& connection) {
+    return getAudioPortsForDeviceTypes(mPorts, deviceTypes, connection);
+}
+
 // static
 std::vector<aidl::android::media::audio::common::AudioPort> ModuleConfig::getBuiltInMicPorts(
         const std::vector<aidl::android::media::audio::common::AudioPort>& ports) {
+    return getAudioPortsForDeviceTypes(
+            ports, std::vector<AudioDeviceType>{AudioDeviceType::IN_MICROPHONE,
+                                                AudioDeviceType::IN_MICROPHONE_BACK});
+}
+
+std::vector<aidl::android::media::audio::common::AudioPort>
+ModuleConfig::getAudioPortsForDeviceTypes(
+        const std::vector<aidl::android::media::audio::common::AudioPort>& ports,
+        const std::vector<AudioDeviceType>& deviceTypes, const std::string& connection) {
     std::vector<AudioPort> result;
-    std::copy_if(ports.begin(), ports.end(), std::back_inserter(result), [](const auto& port) {
-        const auto type = port.ext.template get<AudioPortExt::Tag::device>().device.type;
-        return type.connection.empty() && (type.type == AudioDeviceType::IN_MICROPHONE ||
-                                           type.type == AudioDeviceType::IN_MICROPHONE_BACK);
-    });
+    for (const auto& port : ports) {
+        if (port.ext.getTag() != AudioPortExt::Tag::device) continue;
+        const auto type = port.ext.get<AudioPortExt::Tag::device>().device.type;
+        if (type.connection == connection) {
+            for (auto deviceType : deviceTypes) {
+                if (type.type == deviceType) {
+                    result.push_back(port);
+                }
+            }
+        }
+    }
     return result;
 }
 
@@ -119,6 +141,31 @@
     return result;
 }
 
+std::vector<AudioPort> ModuleConfig::getConnectedExternalDevicePorts() const {
+    std::vector<AudioPort> result;
+    std::copy_if(mPorts.begin(), mPorts.end(), std::back_inserter(result), [&](const auto& port) {
+        return mConnectedExternalSinkDevicePorts.count(port.id) != 0 ||
+               mConnectedExternalSourceDevicePorts.count(port.id) != 0;
+    });
+    return result;
+}
+
+std::set<int32_t> ModuleConfig::getConnectedSinkDevicePorts() const {
+    std::set<int32_t> result;
+    result.insert(mAttachedSinkDevicePorts.begin(), mAttachedSinkDevicePorts.end());
+    result.insert(mConnectedExternalSinkDevicePorts.begin(),
+                  mConnectedExternalSinkDevicePorts.end());
+    return result;
+}
+
+std::set<int32_t> ModuleConfig::getConnectedSourceDevicePorts() const {
+    std::set<int32_t> result;
+    result.insert(mAttachedSourceDevicePorts.begin(), mAttachedSourceDevicePorts.end());
+    result.insert(mConnectedExternalSourceDevicePorts.begin(),
+                  mConnectedExternalSourceDevicePorts.end());
+    return result;
+}
+
 std::vector<AudioPort> ModuleConfig::getExternalDevicePorts() const {
     std::vector<AudioPort> result;
     std::copy_if(mPorts.begin(), mPorts.end(), std::back_inserter(result),
@@ -126,76 +173,77 @@
     return result;
 }
 
-std::vector<AudioPort> ModuleConfig::getInputMixPorts(bool attachedOnly) const {
+std::vector<AudioPort> ModuleConfig::getInputMixPorts(bool connectedOnly) const {
     std::vector<AudioPort> result;
     std::copy_if(mPorts.begin(), mPorts.end(), std::back_inserter(result), [&](const auto& port) {
         return port.ext.getTag() == AudioPortExt::Tag::mix &&
                port.flags.getTag() == AudioIoFlags::Tag::input &&
-               (!attachedOnly || !getAttachedSourceDevicesPortsForMixPort(port).empty());
+               (!connectedOnly || !getConnectedSourceDevicesPortsForMixPort(port).empty());
     });
     return result;
 }
 
-std::vector<AudioPort> ModuleConfig::getOutputMixPorts(bool attachedOnly) const {
+std::vector<AudioPort> ModuleConfig::getOutputMixPorts(bool connectedOnly) const {
     std::vector<AudioPort> result;
     std::copy_if(mPorts.begin(), mPorts.end(), std::back_inserter(result), [&](const auto& port) {
         return port.ext.getTag() == AudioPortExt::Tag::mix &&
                port.flags.getTag() == AudioIoFlags::Tag::output &&
-               (!attachedOnly || !getAttachedSinkDevicesPortsForMixPort(port).empty());
+               (!connectedOnly || !getConnectedSinkDevicesPortsForMixPort(port).empty());
     });
     return result;
 }
 
-std::vector<AudioPort> ModuleConfig::getNonBlockingMixPorts(bool attachedOnly,
+std::vector<AudioPort> ModuleConfig::getNonBlockingMixPorts(bool connectedOnly,
                                                             bool singlePort) const {
-    return findMixPorts(false /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+    return findMixPorts(false /*isInput*/, connectedOnly, singlePort, [&](const AudioPort& port) {
         return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
                                     AudioOutputFlags::NON_BLOCKING);
     });
 }
 
-std::vector<AudioPort> ModuleConfig::getOffloadMixPorts(bool attachedOnly, bool singlePort) const {
-    return findMixPorts(false /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+std::vector<AudioPort> ModuleConfig::getOffloadMixPorts(bool connectedOnly, bool singlePort) const {
+    return findMixPorts(false /*isInput*/, connectedOnly, singlePort, [&](const AudioPort& port) {
         return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
                                     AudioOutputFlags::COMPRESS_OFFLOAD);
     });
 }
 
-std::vector<AudioPort> ModuleConfig::getPrimaryMixPorts(bool attachedOnly, bool singlePort) const {
-    return findMixPorts(false /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+std::vector<AudioPort> ModuleConfig::getPrimaryMixPorts(bool connectedOnly, bool singlePort) const {
+    return findMixPorts(false /*isInput*/, connectedOnly, singlePort, [&](const AudioPort& port) {
         return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
                                     AudioOutputFlags::PRIMARY);
     });
 }
 
-std::vector<AudioPort> ModuleConfig::getMmapOutMixPorts(bool attachedOnly, bool singlePort) const {
-    return findMixPorts(false /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+std::vector<AudioPort> ModuleConfig::getMmapOutMixPorts(bool connectedOnly, bool singlePort) const {
+    return findMixPorts(false /*isInput*/, connectedOnly, singlePort, [&](const AudioPort& port) {
         return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
                                     AudioOutputFlags::MMAP_NOIRQ);
     });
 }
 
-std::vector<AudioPort> ModuleConfig::getMmapInMixPorts(bool attachedOnly, bool singlePort) const {
-    return findMixPorts(true /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+std::vector<AudioPort> ModuleConfig::getMmapInMixPorts(bool connectedOnly, bool singlePort) const {
+    return findMixPorts(true /*isInput*/, connectedOnly, singlePort, [&](const AudioPort& port) {
         return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::input>(),
                                     AudioInputFlags::MMAP_NOIRQ);
     });
 }
 
-std::vector<AudioPort> ModuleConfig::getAttachedDevicesPortsForMixPort(
+std::vector<AudioPort> ModuleConfig::getConnectedDevicesPortsForMixPort(
         bool isInput, const AudioPortConfig& mixPortConfig) const {
     const auto mixPortIt = findById<AudioPort>(mPorts, mixPortConfig.portId);
     if (mixPortIt != mPorts.end()) {
-        return getAttachedDevicesPortsForMixPort(isInput, *mixPortIt);
+        return getConnectedDevicesPortsForMixPort(isInput, *mixPortIt);
     }
     return {};
 }
 
-std::vector<AudioPort> ModuleConfig::getAttachedSinkDevicesPortsForMixPort(
+std::vector<AudioPort> ModuleConfig::getConnectedSinkDevicesPortsForMixPort(
         const AudioPort& mixPort) const {
     std::vector<AudioPort> result;
+    std::set<int32_t> connectedSinkDevicePorts = getConnectedSinkDevicePorts();
     for (const auto& route : mRoutes) {
-        if (mAttachedSinkDevicePorts.count(route.sinkPortId) != 0 &&
+        if ((connectedSinkDevicePorts.count(route.sinkPortId) != 0) &&
             std::find(route.sourcePortIds.begin(), route.sourcePortIds.end(), mixPort.id) !=
                     route.sourcePortIds.end()) {
             const auto devicePortIt = findById<AudioPort>(mPorts, route.sinkPortId);
@@ -205,13 +253,14 @@
     return result;
 }
 
-std::vector<AudioPort> ModuleConfig::getAttachedSourceDevicesPortsForMixPort(
+std::vector<AudioPort> ModuleConfig::getConnectedSourceDevicesPortsForMixPort(
         const AudioPort& mixPort) const {
     std::vector<AudioPort> result;
+    std::set<int32_t> connectedSourceDevicePorts = getConnectedSourceDevicePorts();
     for (const auto& route : mRoutes) {
         if (route.sinkPortId == mixPort.id) {
             for (const auto srcId : route.sourcePortIds) {
-                if (mAttachedSourceDevicePorts.count(srcId) != 0) {
+                if (connectedSourceDevicePorts.count(srcId) != 0) {
                     const auto devicePortIt = findById<AudioPort>(mPorts, srcId);
                     if (devicePortIt != mPorts.end()) result.push_back(*devicePortIt);
                 }
@@ -221,9 +270,10 @@
     return result;
 }
 
-std::optional<AudioPort> ModuleConfig::getSourceMixPortForAttachedDevice() const {
+std::optional<AudioPort> ModuleConfig::getSourceMixPortForConnectedDevice() const {
+    std::set<int32_t> connectedSinkDevicePorts = getConnectedSinkDevicePorts();
     for (const auto& route : mRoutes) {
-        if (mAttachedSinkDevicePorts.count(route.sinkPortId) != 0) {
+        if (connectedSinkDevicePorts.count(route.sinkPortId) != 0) {
             const auto mixPortIt = findById<AudioPort>(mPorts, route.sourcePortIds[0]);
             if (mixPortIt != mPorts.end()) return *mixPortIt;
         }
@@ -233,7 +283,7 @@
 
 std::optional<ModuleConfig::SrcSinkPair> ModuleConfig::getNonRoutableSrcSinkPair(
         bool isInput) const {
-    const auto mixPorts = getMixPorts(isInput, false /*attachedOnly*/);
+    const auto mixPorts = getMixPorts(isInput, false /*connectedOnly*/);
     std::set<std::pair<int32_t, int32_t>> allowedRoutes;
     for (const auto& route : mRoutes) {
         for (const auto srcPortId : route.sourcePortIds) {
@@ -243,7 +293,8 @@
     auto make_pair = [isInput](auto& device, auto& mix) {
         return isInput ? std::make_pair(device, mix) : std::make_pair(mix, device);
     };
-    for (const auto portId : isInput ? mAttachedSourceDevicePorts : mAttachedSinkDevicePorts) {
+    for (const auto portId :
+         isInput ? getConnectedSourceDevicePorts() : getConnectedSinkDevicePorts()) {
         const auto devicePortIt = findById<AudioPort>(mPorts, portId);
         if (devicePortIt == mPorts.end()) continue;
         auto devicePortConfig = getSingleConfigForDevicePort(*devicePortIt);
@@ -262,10 +313,11 @@
 
 std::optional<ModuleConfig::SrcSinkPair> ModuleConfig::getRoutableSrcSinkPair(bool isInput) const {
     if (isInput) {
+        std::set<int32_t> connectedSourceDevicePorts = getConnectedSourceDevicePorts();
         for (const auto& route : mRoutes) {
             auto srcPortIdIt = std::find_if(
                     route.sourcePortIds.begin(), route.sourcePortIds.end(),
-                    [&](const auto& portId) { return mAttachedSourceDevicePorts.count(portId); });
+                    [&](const auto& portId) { return connectedSourceDevicePorts.count(portId); });
             if (srcPortIdIt == route.sourcePortIds.end()) continue;
             const auto devicePortIt = findById<AudioPort>(mPorts, *srcPortIdIt);
             const auto mixPortIt = findById<AudioPort>(mPorts, route.sinkPortId);
@@ -276,8 +328,9 @@
             return std::make_pair(devicePortConfig, mixPortConfig.value());
         }
     } else {
+        std::set<int32_t> connectedSinkDevicePorts = getConnectedSinkDevicePorts();
         for (const auto& route : mRoutes) {
-            if (mAttachedSinkDevicePorts.count(route.sinkPortId) == 0) continue;
+            if (connectedSinkDevicePorts.count(route.sinkPortId) == 0) continue;
             const auto mixPortIt = findById<AudioPort>(mPorts, route.sourcePortIds[0]);
             const auto devicePortIt = findById<AudioPort>(mPorts, route.sinkPortId);
             if (devicePortIt == mPorts.end() || mixPortIt == mPorts.end()) continue;
@@ -293,11 +346,12 @@
 std::vector<ModuleConfig::SrcSinkGroup> ModuleConfig::getRoutableSrcSinkGroups(bool isInput) const {
     std::vector<SrcSinkGroup> result;
     if (isInput) {
+        std::set<int32_t> connectedSourceDevicePorts = getConnectedSourceDevicePorts();
         for (const auto& route : mRoutes) {
             std::vector<int32_t> srcPortIds;
             std::copy_if(route.sourcePortIds.begin(), route.sourcePortIds.end(),
                          std::back_inserter(srcPortIds), [&](const auto& portId) {
-                             return mAttachedSourceDevicePorts.count(portId);
+                             return connectedSourceDevicePorts.count(portId);
                          });
             if (srcPortIds.empty()) continue;
             const auto mixPortIt = findById<AudioPort>(mPorts, route.sinkPortId);
@@ -317,8 +371,9 @@
             }
         }
     } else {
+        std::set<int32_t> connectedSinkDevicePorts = getConnectedSinkDevicePorts();
         for (const auto& route : mRoutes) {
-            if (mAttachedSinkDevicePorts.count(route.sinkPortId) == 0) continue;
+            if (connectedSinkDevicePorts.count(route.sinkPortId) == 0) continue;
             const auto devicePortIt = findById<AudioPort>(mPorts, route.sinkPortId);
             if (devicePortIt == mPorts.end()) continue;
             auto devicePortConfig = getSingleConfigForDevicePort(*devicePortIt);
@@ -352,6 +407,8 @@
     result.append(android::internal::ToString(mAttachedSourceDevicePorts));
     result.append("\nExternal device ports: ");
     result.append(android::internal::ToString(mExternalDevicePorts));
+    result.append("\nConnected external device ports: ");
+    result.append(android::internal::ToString(getConnectedExternalDevicePorts()));
     result.append("\nRoutes: ");
     result.append(android::internal::ToString(mRoutes));
     return result;
@@ -384,10 +441,10 @@
 }
 
 std::vector<AudioPort> ModuleConfig::findMixPorts(
-        bool isInput, bool attachedOnly, bool singlePort,
+        bool isInput, bool connectedOnly, bool singlePort,
         const std::function<bool(const AudioPort&)>& pred) const {
     std::vector<AudioPort> result;
-    const auto mixPorts = getMixPorts(isInput, attachedOnly);
+    const auto mixPorts = getMixPorts(isInput, connectedOnly);
     for (auto mixPortIt = mixPorts.begin(); mixPortIt != mixPorts.end();) {
         mixPortIt = std::find_if(mixPortIt, mixPorts.end(), pred);
         if (mixPortIt == mixPorts.end()) break;
@@ -401,7 +458,7 @@
         const std::vector<AudioPort>& ports, bool isInput, bool singleProfile) const {
     std::vector<AudioPortConfig> result;
     for (const auto& mixPort : ports) {
-        if (getAttachedDevicesPortsForMixPort(isInput, mixPort).empty()) {
+        if (getConnectedDevicesPortsForMixPort(isInput, mixPort).empty()) {
             continue;
         }
         for (const auto& profile : mixPort.profiles) {
@@ -443,10 +500,40 @@
     return result;
 }
 
+ndk::ScopedAStatus ModuleConfig::onExternalDeviceConnected(IModule* module, const AudioPort& port) {
+    RETURN_STATUS_IF_ERROR(module->getAudioPorts(&mPorts));
+    RETURN_STATUS_IF_ERROR(module->getAudioRoutes(&mRoutes));
+
+    // Validate port is present in module
+    if (std::find(mPorts.begin(), mPorts.end(), port) == mPorts.end()) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+
+    if (port.flags.getTag() == aidl::android::media::audio::common::AudioIoFlags::Tag::input) {
+        mConnectedExternalSourceDevicePorts.insert(port.id);
+    } else {
+        mConnectedExternalSinkDevicePorts.insert(port.id);
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus ModuleConfig::onExternalDeviceDisconnected(IModule* module,
+                                                              const AudioPort& port) {
+    RETURN_STATUS_IF_ERROR(module->getAudioPorts(&mPorts));
+    RETURN_STATUS_IF_ERROR(module->getAudioRoutes(&mRoutes));
+
+    if (port.flags.getTag() == aidl::android::media::audio::common::AudioIoFlags::Tag::input) {
+        mConnectedExternalSourceDevicePorts.erase(port.id);
+    } else {
+        mConnectedExternalSinkDevicePorts.erase(port.id);
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
 bool ModuleConfig::isMmapSupported() const {
     const std::vector<AudioPort> mmapOutMixPorts =
-            getMmapOutMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+            getMmapOutMixPorts(false /*connectedOnly*/, false /*singlePort*/);
     const std::vector<AudioPort> mmapInMixPorts =
-            getMmapInMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+            getMmapInMixPorts(false /*connectedOnly*/, false /*singlePort*/);
     return !mmapOutMixPorts.empty() || !mmapInMixPorts.empty();
 }
diff --git a/audio/aidl/vts/ModuleConfig.h b/audio/aidl/vts/ModuleConfig.h
index 6a22075..0cbf24d 100644
--- a/audio/aidl/vts/ModuleConfig.h
+++ b/audio/aidl/vts/ModuleConfig.h
@@ -37,6 +37,14 @@
     static std::optional<aidl::android::media::audio::common::AudioOffloadInfo>
     generateOffloadInfoIfNeeded(
             const aidl::android::media::audio::common::AudioPortConfig& portConfig);
+
+    std::vector<aidl::android::media::audio::common::AudioPort> getAudioPortsForDeviceTypes(
+            const std::vector<aidl::android::media::audio::common::AudioDeviceType>& deviceTypes,
+            const std::string& connection = "");
+    static std::vector<aidl::android::media::audio::common::AudioPort> getAudioPortsForDeviceTypes(
+            const std::vector<aidl::android::media::audio::common::AudioPort>& ports,
+            const std::vector<aidl::android::media::audio::common::AudioDeviceType>& deviceTypes,
+            const std::string& connection = "");
     static std::vector<aidl::android::media::audio::common::AudioPort> getBuiltInMicPorts(
             const std::vector<aidl::android::media::audio::common::AudioPort>& ports);
 
@@ -45,45 +53,55 @@
     std::string getError() const { return mStatus.getMessage(); }
 
     std::vector<aidl::android::media::audio::common::AudioPort> getAttachedDevicePorts() const;
+    std::vector<aidl::android::media::audio::common::AudioPort> getConnectedExternalDevicePorts()
+            const;
+    std::set<int32_t> getConnectedSinkDevicePorts() const;
+    std::set<int32_t> getConnectedSourceDevicePorts() const;
     std::vector<aidl::android::media::audio::common::AudioPort> getAttachedMicrophonePorts() const {
         return getBuiltInMicPorts(getAttachedDevicePorts());
     }
     std::vector<aidl::android::media::audio::common::AudioPort> getExternalDevicePorts() const;
     std::vector<aidl::android::media::audio::common::AudioPort> getInputMixPorts(
-            bool attachedOnly) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getOutputMixPorts(
-            bool attachedOnly) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getMixPorts(
-            bool isInput, bool attachedOnly) const {
-        return isInput ? getInputMixPorts(attachedOnly) : getOutputMixPorts(attachedOnly);
+            bool isInput,
+            bool connectedOnly /*Permanently attached and connected external devices*/) const {
+        return isInput ? getInputMixPorts(connectedOnly) : getOutputMixPorts(connectedOnly);
     }
     std::vector<aidl::android::media::audio::common::AudioPort> getNonBlockingMixPorts(
-            bool attachedOnly, bool singlePort) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/,
+            bool singlePort) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getOffloadMixPorts(
-            bool attachedOnly, bool singlePort) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/,
+            bool singlePort) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getPrimaryMixPorts(
-            bool attachedOnly, bool singlePort) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/,
+            bool singlePort) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getMmapOutMixPorts(
-            bool attachedOnly, bool singlePort) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/,
+            bool singlePort) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getMmapInMixPorts(
-            bool attachedOnly, bool singlePort) const;
+            bool connectedOnly /*Permanently attached and connected external devices*/,
+            bool singlePort) const;
 
-    std::vector<aidl::android::media::audio::common::AudioPort> getAttachedDevicesPortsForMixPort(
+    std::vector<aidl::android::media::audio::common::AudioPort> getConnectedDevicesPortsForMixPort(
             bool isInput, const aidl::android::media::audio::common::AudioPort& mixPort) const {
-        return isInput ? getAttachedSourceDevicesPortsForMixPort(mixPort)
-                       : getAttachedSinkDevicesPortsForMixPort(mixPort);
+        return isInput ? getConnectedSourceDevicesPortsForMixPort(mixPort)
+                       : getConnectedSinkDevicesPortsForMixPort(mixPort);
     }
-    std::vector<aidl::android::media::audio::common::AudioPort> getAttachedDevicesPortsForMixPort(
+    std::vector<aidl::android::media::audio::common::AudioPort> getConnectedDevicesPortsForMixPort(
             bool isInput,
             const aidl::android::media::audio::common::AudioPortConfig& mixPortConfig) const;
     std::vector<aidl::android::media::audio::common::AudioPort>
-    getAttachedSinkDevicesPortsForMixPort(
+    getConnectedSinkDevicesPortsForMixPort(
             const aidl::android::media::audio::common::AudioPort& mixPort) const;
     std::vector<aidl::android::media::audio::common::AudioPort>
-    getAttachedSourceDevicesPortsForMixPort(
+    getConnectedSourceDevicesPortsForMixPort(
             const aidl::android::media::audio::common::AudioPort& mixPort) const;
     std::optional<aidl::android::media::audio::common::AudioPort>
-    getSourceMixPortForAttachedDevice() const;
+    getSourceMixPortForConnectedDevice() const;
 
     std::optional<SrcSinkPair> getNonRoutableSrcSinkPair(bool isInput) const;
     std::optional<SrcSinkPair> getRoutableSrcSinkPair(bool isInput) const;
@@ -96,15 +114,15 @@
     std::vector<aidl::android::media::audio::common::AudioPortConfig> getPortConfigsForMixPorts()
             const {
         auto inputs =
-                generateAudioMixPortConfigs(getInputMixPorts(false /*attachedOnly*/), true, false);
-        auto outputs = generateAudioMixPortConfigs(getOutputMixPorts(false /*attachedOnly*/), false,
-                                                   false);
+                generateAudioMixPortConfigs(getInputMixPorts(false /*connectedOnly*/), true, false);
+        auto outputs = generateAudioMixPortConfigs(getOutputMixPorts(false /*connectedOnly*/),
+                                                   false, false);
         inputs.insert(inputs.end(), outputs.begin(), outputs.end());
         return inputs;
     }
     std::vector<aidl::android::media::audio::common::AudioPortConfig> getPortConfigsForMixPorts(
             bool isInput) const {
-        return generateAudioMixPortConfigs(getMixPorts(isInput, false /*attachedOnly*/), isInput,
+        return generateAudioMixPortConfigs(getMixPorts(isInput, false /*connectedOnly*/), isInput,
                                            false);
     }
     std::vector<aidl::android::media::audio::common::AudioPortConfig> getPortConfigsForMixPorts(
@@ -114,7 +132,7 @@
     std::optional<aidl::android::media::audio::common::AudioPortConfig> getSingleConfigForMixPort(
             bool isInput) const {
         const auto config = generateAudioMixPortConfigs(
-                getMixPorts(isInput, false /*attachedOnly*/), isInput, true);
+                getMixPorts(isInput, false /*connectedOnly*/), isInput, true);
         if (!config.empty()) {
             return *config.begin();
         }
@@ -139,13 +157,20 @@
         return *config.begin();
     }
 
+    ndk::ScopedAStatus onExternalDeviceConnected(
+            aidl::android::hardware::audio::core::IModule* module,
+            const aidl::android::media::audio::common::AudioPort& port);
+    ndk::ScopedAStatus onExternalDeviceDisconnected(
+            aidl::android::hardware::audio::core::IModule* module,
+            const aidl::android::media::audio::common::AudioPort& port);
+
     bool isMmapSupported() const;
 
     std::string toString() const;
 
   private:
     std::vector<aidl::android::media::audio::common::AudioPort> findMixPorts(
-            bool isInput, bool attachedOnly, bool singlePort,
+            bool isInput, bool connectedOnly, bool singlePort,
             const std::function<bool(const aidl::android::media::audio::common::AudioPort&)>& pred)
             const;
     std::vector<aidl::android::media::audio::common::AudioPortConfig> generateAudioMixPortConfigs(
@@ -167,5 +192,7 @@
     std::set<int32_t> mAttachedSinkDevicePorts;
     std::set<int32_t> mAttachedSourceDevicePorts;
     std::set<int32_t> mExternalDevicePorts;
+    std::set<int32_t> mConnectedExternalSinkDevicePorts;
+    std::set<int32_t> mConnectedExternalSourceDevicePorts;
     std::vector<aidl::android::hardware::audio::core::AudioRoute> mRoutes;
 };
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index 94b33d3..5749b15 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -46,6 +46,7 @@
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
 #include <android-base/chrono_utils.h>
 #include <android/binder_enums.h>
+#include <error/expected_utils.h>
 #include <fmq/AidlMessageQueue.h>
 
 #include "AudioHalBinderServiceUtil.h"
@@ -412,9 +413,21 @@
 
     void SetUpImpl(const std::string& moduleName) {
         ASSERT_NO_FATAL_FAILURE(ConnectToService(moduleName));
+        ASSERT_IS_OK(module->getAudioPorts(&initialPorts));
+        ASSERT_IS_OK(module->getAudioRoutes(&initialRoutes));
     }
 
-    void TearDownImpl() { debug.reset(); }
+    void TearDownImpl() {
+        debug.reset();
+        std::vector<AudioPort> finalPorts;
+        ASSERT_IS_OK(module->getAudioPorts(&finalPorts));
+        EXPECT_NO_FATAL_FAILURE(VerifyVectorsAreEqual<AudioPort>(initialPorts, finalPorts))
+                << "The list of audio ports was not restored to the initial state";
+        std::vector<AudioRoute> finalRoutes;
+        ASSERT_IS_OK(module->getAudioRoutes(&finalRoutes));
+        EXPECT_NO_FATAL_FAILURE(VerifyVectorsAreEqual<AudioRoute>(initialRoutes, finalRoutes))
+                << "The list of audio routes was not restored to the initial state";
+    }
 
     void ConnectToService(const std::string& moduleName) {
         ASSERT_EQ(module, nullptr);
@@ -502,17 +515,24 @@
         }
     }
 
+    // Warning: modifies the vectors!
+    template <typename T>
+    void VerifyVectorsAreEqual(std::vector<T>& v1, std::vector<T>& v2) {
+        ASSERT_EQ(v1.size(), v2.size());
+        std::sort(v1.begin(), v1.end());
+        std::sort(v2.begin(), v2.end());
+        if (v1 != v2) {
+            FAIL() << "Vectors are not equal: v1 = " << ::android::internal::ToString(v1)
+                   << ", v2 = " << ::android::internal::ToString(v2);
+        }
+    }
+
     std::shared_ptr<IModule> module;
     std::unique_ptr<ModuleConfig> moduleConfig;
     AudioHalBinderServiceUtil binderUtil;
     std::unique_ptr<WithDebugFlags> debug;
-};
-
-class AudioCoreModule : public AudioCoreModuleBase, public testing::TestWithParam<std::string> {
-  public:
-    void SetUp() override { ASSERT_NO_FATAL_FAILURE(SetUpImpl(GetParam())); }
-
-    void TearDown() override { ASSERT_NO_FATAL_FAILURE(TearDownImpl()); }
+    std::vector<AudioPort> initialPorts;
+    std::vector<AudioRoute> initialRoutes;
 };
 
 class WithDevicePortConnectedState {
@@ -525,13 +545,24 @@
             EXPECT_IS_OK(mModule->disconnectExternalDevice(getId()))
                     << "when disconnecting device port ID " << getId();
         }
+        if (mModuleConfig != nullptr) {
+            EXPECT_IS_OK(mModuleConfig->onExternalDeviceDisconnected(mModule, mConnectedPort))
+                    << "when external device disconnected";
+        }
     }
-    void SetUp(IModule* module) {
-        ASSERT_IS_OK(module->connectExternalDevice(mIdAndData, &mConnectedPort))
+    ScopedAStatus SetUpNoChecks(IModule* module, ModuleConfig* moduleConfig) {
+        RETURN_STATUS_IF_ERROR(module->connectExternalDevice(mIdAndData, &mConnectedPort));
+        RETURN_STATUS_IF_ERROR(moduleConfig->onExternalDeviceConnected(module, mConnectedPort));
+        mModule = module;
+        mModuleConfig = moduleConfig;
+        return ScopedAStatus::ok();
+    }
+    void SetUp(IModule* module, ModuleConfig* moduleConfig) {
+        ASSERT_NE(moduleConfig, nullptr);
+        ASSERT_IS_OK(SetUpNoChecks(module, moduleConfig))
                 << "when connecting device port ID & data " << mIdAndData.toString();
         ASSERT_NE(mIdAndData.id, getId())
                 << "ID of the connected port must not be the same as the ID of the template port";
-        mModule = module;
     }
     int32_t getId() const { return mConnectedPort.id; }
     const AudioPort& get() { return mConnectedPort; }
@@ -539,9 +570,17 @@
   private:
     const AudioPort mIdAndData;
     IModule* mModule = nullptr;
+    ModuleConfig* mModuleConfig = nullptr;
     AudioPort mConnectedPort;
 };
 
+class AudioCoreModule : public AudioCoreModuleBase, public testing::TestWithParam<std::string> {
+  public:
+    void SetUp() override { ASSERT_NO_FATAL_FAILURE(SetUpImpl(GetParam())); }
+
+    void TearDown() override { ASSERT_NO_FATAL_FAILURE(TearDownImpl()); }
+};
+
 class StreamContext {
   public:
     typedef AidlMessageQueue<StreamDescriptor::Command, SynchronizedReadWrite> CommandMQ;
@@ -1249,11 +1288,8 @@
     ASSERT_IS_OK(module->getAudioPorts(&ports1));
     std::vector<AudioPort> ports2;
     ASSERT_IS_OK(module->getAudioPorts(&ports2));
-    ASSERT_EQ(ports1.size(), ports2.size())
-            << "Sizes of audio port arrays do not match across consequent calls to getAudioPorts";
-    std::sort(ports1.begin(), ports1.end());
-    std::sort(ports2.begin(), ports2.end());
-    EXPECT_EQ(ports1, ports2);
+    EXPECT_NO_FATAL_FAILURE(VerifyVectorsAreEqual<AudioPort>(ports1, ports2))
+            << "Audio port arrays do not match across consequent calls to getAudioPorts";
 }
 
 TEST_P(AudioCoreModule, GetAudioRoutesIsStable) {
@@ -1261,11 +1297,8 @@
     ASSERT_IS_OK(module->getAudioRoutes(&routes1));
     std::vector<AudioRoute> routes2;
     ASSERT_IS_OK(module->getAudioRoutes(&routes2));
-    ASSERT_EQ(routes1.size(), routes2.size())
-            << "Sizes of audio route arrays do not match across consequent calls to getAudioRoutes";
-    std::sort(routes1.begin(), routes1.end());
-    std::sort(routes2.begin(), routes2.end());
-    EXPECT_EQ(routes1, routes2);
+    EXPECT_NO_FATAL_FAILURE(VerifyVectorsAreEqual<AudioRoute>(routes1, routes2))
+            << " Audio route arrays do not match across consequent calls to getAudioRoutes";
 }
 
 TEST_P(AudioCoreModule, GetAudioRoutesAreValid) {
@@ -1422,7 +1455,7 @@
     for (const auto& port : ports) {
         AudioPort portWithData = GenerateUniqueDeviceAddress(port);
         WithDevicePortConnectedState portConnected(portWithData);
-        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
         const int32_t connectedPortId = portConnected.getId();
         ASSERT_NE(portWithData.id, connectedPortId);
         ASSERT_EQ(portWithData.ext.getTag(), portConnected.get().ext.getTag());
@@ -1526,7 +1559,7 @@
 
 TEST_P(AudioCoreModule, SetAudioPortConfigSuggestedConfig) {
     ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
-    auto srcMixPort = moduleConfig->getSourceMixPortForAttachedDevice();
+    auto srcMixPort = moduleConfig->getSourceMixPortForConnectedDevice();
     if (!srcMixPort.has_value()) {
         GTEST_SKIP() << "No mix port for attached output devices";
     }
@@ -1578,7 +1611,7 @@
     }
     for (const auto& port : ports) {
         WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(port));
-        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
         ASSERT_NO_FATAL_FAILURE(
                 ApplyEveryConfig(moduleConfig->getPortConfigsForDevicePort(portConnected.get())));
     }
@@ -1648,7 +1681,7 @@
         GTEST_SKIP() << "No external devices in the module.";
     }
     WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(*ports.begin()));
-    ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+    ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
     ModuleDebug midwayDebugChange = debug->flags();
     midwayDebugChange.simulateDeviceConnections = false;
     EXPECT_STATUS(EX_ILLEGAL_STATE, module->setModuleDebug(midwayDebugChange))
@@ -1703,7 +1736,7 @@
                 << "when disconnecting already disconnected device port ID " << port.id;
         AudioPort portWithData = GenerateUniqueDeviceAddress(port);
         WithDevicePortConnectedState portConnected(portWithData);
-        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
         EXPECT_STATUS(EX_ILLEGAL_ARGUMENT,
                       module->connectExternalDevice(portConnected.get(), &ignored))
                 << "when trying to connect a connected device port "
@@ -1725,7 +1758,7 @@
     }
     for (const auto& port : ports) {
         WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(port));
-        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
         const auto portConfig = moduleConfig->getSingleConfigForDevicePort(portConnected.get());
         {
             WithAudioPortConfig config(portConfig);
@@ -1753,7 +1786,7 @@
         int32_t connectedPortId;
         {
             WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(port));
-            ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
+            ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
             connectedPortId = portConnected.getId();
             std::vector<AudioRoute> connectedPortRoutes;
             ASSERT_IS_OK(module->getAudioRoutesForAudioPort(connectedPortId, &connectedPortRoutes))
@@ -1783,39 +1816,151 @@
     }
 }
 
+class RoutedPortsProfilesSnapshot {
+  public:
+    explicit RoutedPortsProfilesSnapshot(int32_t portId) : mPortId(portId) {}
+    void Capture(IModule* module) {
+        std::vector<AudioRoute> routes;
+        ASSERT_IS_OK(module->getAudioRoutesForAudioPort(mPortId, &routes));
+        std::vector<AudioPort> allPorts;
+        ASSERT_IS_OK(module->getAudioPorts(&allPorts));
+        ASSERT_NO_FATAL_FAILURE(GetAllRoutedPorts(routes, allPorts));
+        ASSERT_NO_FATAL_FAILURE(GetProfileSizes());
+    }
+    void VerifyNoProfilesChanges(const RoutedPortsProfilesSnapshot& before) {
+        for (const auto& p : before.mRoutedPorts) {
+            auto beforeIt = before.mPortProfileSizes.find(p.id);
+            ASSERT_NE(beforeIt, before.mPortProfileSizes.end())
+                    << "port ID " << p.id << " not found in the initial profile sizes";
+            EXPECT_EQ(beforeIt->second, mPortProfileSizes[p.id])
+                    << " port " << p.toString() << " has an unexpected profile size change"
+                    << " following an external device connection and disconnection";
+        }
+    }
+    void VerifyProfilesNonEmpty() {
+        for (const auto& p : mRoutedPorts) {
+            EXPECT_NE(0UL, mPortProfileSizes[p.id])
+                    << " port " << p.toString() << " must have had its profiles"
+                    << " populated while having a connected external device";
+        }
+    }
+
+    const std::vector<AudioPort>& getRoutedPorts() const { return mRoutedPorts; }
+
+  private:
+    void GetAllRoutedPorts(const std::vector<AudioRoute>& routes,
+                           std::vector<AudioPort>& allPorts) {
+        for (const auto& r : routes) {
+            if (r.sinkPortId == mPortId) {
+                for (const auto& srcPortId : r.sourcePortIds) {
+                    const auto srcPortIt = findById(allPorts, srcPortId);
+                    ASSERT_NE(allPorts.end(), srcPortIt) << "port ID " << srcPortId;
+                    mRoutedPorts.push_back(*srcPortIt);
+                }
+            } else {
+                const auto sinkPortIt = findById(allPorts, r.sinkPortId);
+                ASSERT_NE(allPorts.end(), sinkPortIt) << "port ID " << r.sinkPortId;
+                mRoutedPorts.push_back(*sinkPortIt);
+            }
+        }
+    }
+    void GetProfileSizes() {
+        std::transform(
+                mRoutedPorts.begin(), mRoutedPorts.end(),
+                std::inserter(mPortProfileSizes, mPortProfileSizes.end()),
+                [](const auto& port) { return std::make_pair(port.id, port.profiles.size()); });
+    }
+
+    const int32_t mPortId;
+    std::vector<AudioPort> mRoutedPorts;
+    std::map<int32_t, size_t> mPortProfileSizes;
+};
+
 // Note: This test relies on simulation of external device connections by the HAL module.
 TEST_P(AudioCoreModule, ExternalDeviceMixPortConfigs) {
     // After an external device has been connected, all mix ports that can be routed
     // to the device port for the connected device must have non-empty profiles.
+    // Since the test connects and disconnects a single device each time, the size
+    // of profiles for all mix ports routed to the device port under test must get back
+    // to the original count once the external device is disconnected.
     ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
     std::vector<AudioPort> externalDevicePorts = moduleConfig->getExternalDevicePorts();
     if (externalDevicePorts.empty()) {
         GTEST_SKIP() << "No external devices in the module.";
     }
     for (const auto& port : externalDevicePorts) {
-        WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(port));
-        ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get()));
-        std::vector<AudioRoute> routes;
-        ASSERT_IS_OK(module->getAudioRoutesForAudioPort(portConnected.getId(), &routes));
-        std::vector<AudioPort> allPorts;
-        ASSERT_IS_OK(module->getAudioPorts(&allPorts));
-        for (const auto& r : routes) {
-            if (r.sinkPortId == portConnected.getId()) {
-                for (const auto& srcPortId : r.sourcePortIds) {
-                    const auto srcPortIt = findById(allPorts, srcPortId);
-                    ASSERT_NE(allPorts.end(), srcPortIt) << "port ID " << srcPortId;
-                    EXPECT_NE(0UL, srcPortIt->profiles.size())
-                            << " source port " << srcPortIt->toString() << " must have its profiles"
-                            << " populated following external device connection";
-                }
-            } else {
-                const auto sinkPortIt = findById(allPorts, r.sinkPortId);
-                ASSERT_NE(allPorts.end(), sinkPortIt) << "port ID " << r.sinkPortId;
-                EXPECT_NE(0UL, sinkPortIt->profiles.size())
-                        << " source port " << sinkPortIt->toString() << " must have its"
-                        << " profiles populated following external device connection";
+        SCOPED_TRACE(port.toString());
+        RoutedPortsProfilesSnapshot before(port.id);
+        ASSERT_NO_FATAL_FAILURE(before.Capture(module.get()));
+        if (before.getRoutedPorts().empty()) continue;
+        {
+            WithDevicePortConnectedState portConnected(GenerateUniqueDeviceAddress(port));
+            ASSERT_NO_FATAL_FAILURE(portConnected.SetUp(module.get(), moduleConfig.get()));
+            RoutedPortsProfilesSnapshot connected(portConnected.getId());
+            ASSERT_NO_FATAL_FAILURE(connected.Capture(module.get()));
+            EXPECT_NO_FATAL_FAILURE(connected.VerifyProfilesNonEmpty());
+        }
+        RoutedPortsProfilesSnapshot after(port.id);
+        ASSERT_NO_FATAL_FAILURE(after.Capture(module.get()));
+        EXPECT_NO_FATAL_FAILURE(after.VerifyNoProfilesChanges(before));
+    }
+}
+
+// Note: This test relies on simulation of external device connections by the HAL module.
+TEST_P(AudioCoreModule, TwoExternalDevicesMixPortConfigsNested) {
+    // Ensure that in the case when two external devices are connected to the same
+    // device port, disconnecting one of them does not erase the profiles of routed mix ports.
+    // In this scenario, the connections are "nested."
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    std::vector<AudioPort> externalDevicePorts = moduleConfig->getExternalDevicePorts();
+    if (externalDevicePorts.empty()) {
+        GTEST_SKIP() << "No external devices in the module.";
+    }
+    for (const auto& port : externalDevicePorts) {
+        SCOPED_TRACE(port.toString());
+        WithDevicePortConnectedState portConnected1(GenerateUniqueDeviceAddress(port));
+        ASSERT_NO_FATAL_FAILURE(portConnected1.SetUp(module.get(), moduleConfig.get()));
+        {
+            // Connect and disconnect another device, if possible. It might not be possible
+            // for point-to-point connections, like analog or SPDIF.
+            WithDevicePortConnectedState portConnected2(GenerateUniqueDeviceAddress(port));
+            if (auto status = portConnected2.SetUpNoChecks(module.get(), moduleConfig.get());
+                !status.isOk()) {
+                continue;
             }
         }
+        RoutedPortsProfilesSnapshot connected(portConnected1.getId());
+        ASSERT_NO_FATAL_FAILURE(connected.Capture(module.get()));
+        EXPECT_NO_FATAL_FAILURE(connected.VerifyProfilesNonEmpty());
+    }
+}
+
+// Note: This test relies on simulation of external device connections by the HAL module.
+TEST_P(AudioCoreModule, TwoExternalDevicesMixPortConfigsInterleaved) {
+    // Ensure that in the case when two external devices are connected to the same
+    // device port, disconnecting one of them does not erase the profiles of routed mix ports.
+    // In this scenario, the connections are "interleaved."
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    std::vector<AudioPort> externalDevicePorts = moduleConfig->getExternalDevicePorts();
+    if (externalDevicePorts.empty()) {
+        GTEST_SKIP() << "No external devices in the module.";
+    }
+    for (const auto& port : externalDevicePorts) {
+        SCOPED_TRACE(port.toString());
+        auto portConnected1 =
+                std::make_unique<WithDevicePortConnectedState>(GenerateUniqueDeviceAddress(port));
+        ASSERT_NO_FATAL_FAILURE(portConnected1->SetUp(module.get(), moduleConfig.get()));
+        WithDevicePortConnectedState portConnected2(GenerateUniqueDeviceAddress(port));
+        // Connect another device, if possible. It might not be possible for point-to-point
+        // connections, like analog or SPDIF.
+        if (auto status = portConnected2.SetUpNoChecks(module.get(), moduleConfig.get());
+            !status.isOk()) {
+            continue;
+        }
+        portConnected1.reset();
+        RoutedPortsProfilesSnapshot connected(portConnected2.getId());
+        ASSERT_NO_FATAL_FAILURE(connected.Capture(module.get()));
+        EXPECT_NO_FATAL_FAILURE(connected.VerifyProfilesNonEmpty());
     }
 }
 
@@ -2459,7 +2604,7 @@
 
     void OpenOverMaxCount() {
         constexpr bool isInput = IOTraits<Stream>::is_input;
-        auto ports = moduleConfig->getMixPorts(isInput, true /*attachedOnly*/);
+        auto ports = moduleConfig->getMixPorts(isInput, true /*connectedOnly*/);
         bool hasSingleRun = false;
         for (const auto& port : ports) {
             const size_t maxStreamCount = port.ext.get<AudioPortExt::Tag::mix>().maxOpenStreamCount;
@@ -2580,7 +2725,7 @@
 
     void HwGainHwVolume() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*connectedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2619,7 +2764,7 @@
     // it as an invalid argument, or say that offloaded effects are not supported.
     void AddRemoveEffectInvalidArguments() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*connectedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2742,7 +2887,7 @@
     if (!status.isOk()) {
         GTEST_SKIP() << "Microphone info is not supported";
     }
-    const auto ports = moduleConfig->getInputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getInputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No input mix ports for attached devices";
     }
@@ -2759,7 +2904,7 @@
                                                "non-empty list of active microphones";
         }
         if (auto micDevicePorts = ModuleConfig::getBuiltInMicPorts(
-                    moduleConfig->getAttachedSourceDevicesPortsForMixPort(port));
+                    moduleConfig->getConnectedSourceDevicesPortsForMixPort(port));
             !micDevicePorts.empty()) {
             auto devicePortConfig = moduleConfig->getSingleConfigForDevicePort(micDevicePorts[0]);
             WithAudioPatch patch(true /*isInput*/, stream.getPortConfig(), devicePortConfig);
@@ -2791,7 +2936,7 @@
 
 TEST_P(AudioStreamIn, MicrophoneDirection) {
     using MD = IStreamIn::MicrophoneDirection;
-    const auto ports = moduleConfig->getInputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getInputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No input mix ports for attached devices";
     }
@@ -2814,7 +2959,7 @@
 }
 
 TEST_P(AudioStreamIn, MicrophoneFieldDimension) {
-    const auto ports = moduleConfig->getInputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getInputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No input mix ports for attached devices";
     }
@@ -2846,7 +2991,7 @@
 
 TEST_P(AudioStreamOut, OpenTwicePrimary) {
     const auto mixPorts =
-            moduleConfig->getPrimaryMixPorts(true /*attachedOnly*/, true /*singlePort*/);
+            moduleConfig->getPrimaryMixPorts(true /*connectedOnly*/, true /*singlePort*/);
     if (mixPorts.empty()) {
         GTEST_SKIP() << "No primary mix port which could be routed to attached devices";
     }
@@ -2857,7 +3002,7 @@
 
 TEST_P(AudioStreamOut, RequireOffloadInfo) {
     const auto offloadMixPorts =
-            moduleConfig->getOffloadMixPorts(true /*attachedOnly*/, true /*singlePort*/);
+            moduleConfig->getOffloadMixPorts(true /*connectedOnly*/, true /*singlePort*/);
     if (offloadMixPorts.empty()) {
         GTEST_SKIP()
                 << "No mix port for compressed offload that could be routed to attached devices";
@@ -2879,7 +3024,7 @@
 
 TEST_P(AudioStreamOut, RequireAsyncCallback) {
     const auto nonBlockingMixPorts =
-            moduleConfig->getNonBlockingMixPorts(true /*attachedOnly*/, true /*singlePort*/);
+            moduleConfig->getNonBlockingMixPorts(true /*connectedOnly*/, true /*singlePort*/);
     if (nonBlockingMixPorts.empty()) {
         GTEST_SKIP()
                 << "No mix port for non-blocking output that could be routed to attached devices";
@@ -2902,7 +3047,7 @@
 }
 
 TEST_P(AudioStreamOut, AudioDescriptionMixLevel) {
-    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2930,7 +3075,7 @@
 }
 
 TEST_P(AudioStreamOut, DualMonoMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2954,7 +3099,7 @@
 }
 
 TEST_P(AudioStreamOut, LatencyMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*connectedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2996,7 +3141,7 @@
 TEST_P(AudioStreamOut, PlaybackRate) {
     static const auto kStatuses = {EX_NONE, EX_UNSUPPORTED_OPERATION};
     const auto offloadMixPorts =
-            moduleConfig->getOffloadMixPorts(true /*attachedOnly*/, false /*singlePort*/);
+            moduleConfig->getOffloadMixPorts(true /*connectedOnly*/, false /*singlePort*/);
     if (offloadMixPorts.empty()) {
         GTEST_SKIP()
                 << "No mix port for compressed offload that could be routed to attached devices";
@@ -3066,7 +3211,7 @@
 TEST_P(AudioStreamOut, SelectPresentation) {
     static const auto kStatuses = {EX_ILLEGAL_ARGUMENT, EX_UNSUPPORTED_OPERATION};
     const auto offloadMixPorts =
-            moduleConfig->getOffloadMixPorts(true /*attachedOnly*/, false /*singlePort*/);
+            moduleConfig->getOffloadMixPorts(true /*connectedOnly*/, false /*singlePort*/);
     if (offloadMixPorts.empty()) {
         GTEST_SKIP()
                 << "No mix port for compressed offload that could be routed to attached devices";
@@ -3088,7 +3233,7 @@
 
 TEST_P(AudioStreamOut, UpdateOffloadMetadata) {
     const auto offloadMixPorts =
-            moduleConfig->getOffloadMixPorts(true /*attachedOnly*/, false /*singlePort*/);
+            moduleConfig->getOffloadMixPorts(true /*connectedOnly*/, false /*singlePort*/);
     if (offloadMixPorts.empty()) {
         GTEST_SKIP()
                 << "No mix port for compressed offload that could be routed to attached devices";
@@ -3301,7 +3446,7 @@
     void RunStreamIoCommandsImplSeq1(const AudioPortConfig& portConfig,
                                      std::shared_ptr<StateSequence> commandsAndStates,
                                      bool validatePositionIncrease) {
-        auto devicePorts = moduleConfig->getAttachedDevicesPortsForMixPort(
+        auto devicePorts = moduleConfig->getConnectedDevicesPortsForMixPort(
                 IOTraits<Stream>::is_input, portConfig);
         ASSERT_FALSE(devicePorts.empty());
         auto devicePortConfig = moduleConfig->getSingleConfigForDevicePort(devicePorts[0]);
@@ -3341,7 +3486,7 @@
         typename IOTraits<Stream>::Worker worker(*stream.getContext(), &driver,
                                                  stream.getEventReceiver());
 
-        auto devicePorts = moduleConfig->getAttachedDevicesPortsForMixPort(
+        auto devicePorts = moduleConfig->getConnectedDevicesPortsForMixPort(
                 IOTraits<Stream>::is_input, portConfig);
         ASSERT_FALSE(devicePorts.empty());
         auto devicePortConfig = moduleConfig->getSingleConfigForDevicePort(devicePorts[0]);
@@ -4001,6 +4146,172 @@
                          android::PrintInstanceNameToString);
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(AudioModulePatch);
 
+static std::vector<std::string> getRemoteSubmixModuleInstance() {
+    auto instances = android::getAidlHalInstanceNames(IModule::descriptor);
+    for (auto instance : instances) {
+        if (instance.find("r_submix") != std::string::npos)
+            return (std::vector<std::string>{instance});
+    }
+    return {};
+}
+
+template <typename Stream>
+class WithRemoteSubmix {
+  public:
+    WithRemoteSubmix() = default;
+    WithRemoteSubmix(AudioDeviceAddress address) : mAddress(address) {}
+    WithRemoteSubmix(const WithRemoteSubmix&) = delete;
+    WithRemoteSubmix& operator=(const WithRemoteSubmix&) = delete;
+    std::optional<AudioPort> getAudioPort() {
+        AudioDeviceType deviceType = IOTraits<Stream>::is_input ? AudioDeviceType::IN_SUBMIX
+                                                                : AudioDeviceType::OUT_SUBMIX;
+        auto ports = mModuleConfig->getAudioPortsForDeviceTypes(
+                std::vector<AudioDeviceType>{deviceType},
+                AudioDeviceDescription::CONNECTION_VIRTUAL);
+        if (!ports.empty()) return ports.front();
+        return {};
+    }
+    /* Connect remote submix external device */
+    void SetUpPortConnection() {
+        auto port = getAudioPort();
+        ASSERT_TRUE(port.has_value()) << "Device AudioPort for remote submix not found";
+        if (mAddress.has_value()) {
+            port.value().ext.template get<AudioPortExt::Tag::device>().device.address =
+                    mAddress.value();
+        } else {
+            port = GenerateUniqueDeviceAddress(port.value());
+        }
+        mConnectedPort = std::make_unique<WithDevicePortConnectedState>(port.value());
+        ASSERT_NO_FATAL_FAILURE(mConnectedPort->SetUp(mModule, mModuleConfig));
+    }
+    AudioDeviceAddress getAudioDeviceAddress() {
+        if (!mAddress.has_value()) {
+            mAddress = mConnectedPort->get()
+                               .ext.template get<AudioPortExt::Tag::device>()
+                               .device.address;
+        }
+        return mAddress.value();
+    }
+    /* Get mix port config for stream and setup patch for it. */
+    void SetupPatch() {
+        const auto portConfig =
+                mModuleConfig->getSingleConfigForMixPort(IOTraits<Stream>::is_input);
+        if (!portConfig.has_value()) {
+            LOG(DEBUG) << __func__ << ": portConfig not found";
+            mSkipTest = true;
+            return;
+        }
+        auto devicePortConfig = mModuleConfig->getSingleConfigForDevicePort(mConnectedPort->get());
+        mPatch = std::make_unique<WithAudioPatch>(IOTraits<Stream>::is_input, portConfig.value(),
+                                                  devicePortConfig);
+        ASSERT_NO_FATAL_FAILURE(mPatch->SetUp(mModule));
+    }
+    void SetUp(IModule* module, ModuleConfig* moduleConfig) {
+        mModule = module;
+        mModuleConfig = moduleConfig;
+        ASSERT_NO_FATAL_FAILURE(SetUpPortConnection());
+        ASSERT_NO_FATAL_FAILURE(SetupPatch());
+        if (!mSkipTest) {
+            // open stream
+            mStream = std::make_unique<WithStream<Stream>>(
+                    mPatch->getPortConfig(IOTraits<Stream>::is_input));
+            ASSERT_NO_FATAL_FAILURE(
+                    mStream->SetUp(mModule, AudioCoreModuleBase::kDefaultBufferSizeFrames));
+        }
+    }
+    void sendBurstCommands() {
+        const StreamContext* context = mStream->getContext();
+        StreamLogicDefaultDriver driver(makeBurstCommands(true), context->getFrameSizeBytes());
+        typename IOTraits<Stream>::Worker worker(*context, &driver, mStream->getEventReceiver());
+
+        LOG(DEBUG) << __func__ << ": starting worker...";
+        ASSERT_TRUE(worker.start());
+        LOG(DEBUG) << __func__ << ": joining worker...";
+        worker.join();
+        EXPECT_FALSE(worker.hasError()) << worker.getError();
+        EXPECT_EQ("", driver.getUnexpectedStateTransition());
+        if (IOTraits<Stream>::is_input) {
+            EXPECT_TRUE(driver.hasObservablePositionIncrease());
+        }
+        EXPECT_FALSE(driver.hasRetrogradeObservablePosition());
+    }
+    bool skipTest() { return mSkipTest; }
+
+  private:
+    bool mSkipTest = false;
+    IModule* mModule = nullptr;
+    ModuleConfig* mModuleConfig = nullptr;
+    std::optional<AudioDeviceAddress> mAddress;
+    std::unique_ptr<WithDevicePortConnectedState> mConnectedPort;
+    std::unique_ptr<WithAudioPatch> mPatch;
+    std::unique_ptr<WithStream<Stream>> mStream;
+};
+
+class AudioModuleRemoteSubmix : public AudioCoreModule {
+  public:
+    void SetUp() override {
+        ASSERT_NO_FATAL_FAILURE(AudioCoreModule::SetUp());
+        ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    }
+
+    void TearDown() override { ASSERT_NO_FATAL_FAILURE(TearDownImpl()); }
+};
+
+TEST_P(AudioModuleRemoteSubmix, OutputDoesNotBlockWhenNoInput) {
+    // open output stream
+    WithRemoteSubmix<IStreamOut> streamOut;
+    ASSERT_NO_FATAL_FAILURE(streamOut.SetUp(module.get(), moduleConfig.get()));
+    if (streamOut.skipTest()) {
+        GTEST_SKIP() << "No mix port for attached devices";
+    }
+    // write something to stream
+    ASSERT_NO_FATAL_FAILURE(streamOut.sendBurstCommands());
+}
+
+TEST_P(AudioModuleRemoteSubmix, OutputDoesNotBlockWhenInputStuck) {
+    // open output stream
+    WithRemoteSubmix<IStreamOut> streamOut;
+    ASSERT_NO_FATAL_FAILURE(streamOut.SetUp(module.get(), moduleConfig.get()));
+    if (streamOut.skipTest()) {
+        GTEST_SKIP() << "No mix port for attached devices";
+    }
+
+    // open input stream
+    WithRemoteSubmix<IStreamIn> streamIn(streamOut.getAudioDeviceAddress());
+    ASSERT_NO_FATAL_FAILURE(streamIn.SetUp(module.get(), moduleConfig.get()));
+    if (streamIn.skipTest()) {
+        GTEST_SKIP() << "No mix port for attached devices";
+    }
+
+    // write something to stream
+    ASSERT_NO_FATAL_FAILURE(streamOut.sendBurstCommands());
+}
+
+TEST_P(AudioModuleRemoteSubmix, OutputAndInput) {
+    // open output stream
+    WithRemoteSubmix<IStreamOut> streamOut;
+    ASSERT_NO_FATAL_FAILURE(streamOut.SetUp(module.get(), moduleConfig.get()));
+    if (streamOut.skipTest()) {
+        GTEST_SKIP() << "No mix port for attached devices";
+    }
+
+    // open input stream
+    WithRemoteSubmix<IStreamIn> streamIn(streamOut.getAudioDeviceAddress());
+    ASSERT_NO_FATAL_FAILURE(streamIn.SetUp(module.get(), moduleConfig.get()));
+    if (streamIn.skipTest()) {
+        GTEST_SKIP() << "No mix port for attached devices";
+    }
+
+    // write something to stream
+    ASSERT_NO_FATAL_FAILURE(streamOut.sendBurstCommands());
+    // read from input stream
+    ASSERT_NO_FATAL_FAILURE(streamIn.sendBurstCommands());
+}
+
+INSTANTIATE_TEST_SUITE_P(AudioModuleRemoteSubmixTest, AudioModuleRemoteSubmix,
+                         ::testing::ValuesIn(getRemoteSubmixModuleInstance()));
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(AudioModuleRemoteSubmix);
+
 class TestExecutionTracer : public ::testing::EmptyTestEventListener {
   public:
     void OnTestStart(const ::testing::TestInfo& test_info) override {
diff --git a/audio/aidl/vts/VtsHalHapticGeneratorTargetTest.cpp b/audio/aidl/vts/VtsHalHapticGeneratorTargetTest.cpp
index 54caed9..b33234b 100644
--- a/audio/aidl/vts/VtsHalHapticGeneratorTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalHapticGeneratorTargetTest.cpp
@@ -208,7 +208,7 @@
         HapticGeneratorInvalidTest, HapticGeneratorParamTest,
         ::testing::Combine(testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
                                    IFactory::descriptor, getEffectTypeUuidHapticGenerator())),
-                           testing::Values(MIN_ID - 1),
+                           testing::Values(MIN_ID),
                            testing::Values(HapticGenerator::VibratorScale::NONE),
                            testing::Values(MIN_FLOAT), testing::Values(MIN_FLOAT),
                            testing::Values(MIN_FLOAT)),
diff --git a/audio/core/all-versions/default/PrimaryDevice.cpp b/audio/core/all-versions/default/PrimaryDevice.cpp
index cf162f1..13efbbc 100644
--- a/audio/core/all-versions/default/PrimaryDevice.cpp
+++ b/audio/core/all-versions/default/PrimaryDevice.cpp
@@ -283,7 +283,7 @@
         _hidl_cb(retval, TtyMode::OFF);
         return Void();
     }
-    TtyMode mode = convertTtyModeToHIDL(halMode);
+    TtyMode mode = convertTtyModeToHIDL(halMode.c_str());
     if (mode == TtyMode(-1)) {
         ALOGE("HAL returned invalid TTY value: %s", halMode.c_str());
         _hidl_cb(Result::INVALID_STATE, TtyMode::OFF);
diff --git a/authsecret/1.0/vts/functional/OWNERS b/authsecret/OWNERS
similarity index 98%
rename from authsecret/1.0/vts/functional/OWNERS
rename to authsecret/OWNERS
index ec8c304..5a5d074 100644
--- a/authsecret/1.0/vts/functional/OWNERS
+++ b/authsecret/OWNERS
@@ -1,3 +1,4 @@
 # Bug component: 186411
+
 chengyouho@google.com
 frankwoo@google.com
diff --git a/authsecret/aidl/vts/OWNERS b/authsecret/aidl/vts/OWNERS
deleted file mode 100644
index 40d95e4..0000000
--- a/authsecret/aidl/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-chengyouho@google.com
-frankwoo@google.com
diff --git a/automotive/evs/OWNERS b/automotive/evs/OWNERS
index 15de48f..4787f0b 100644
--- a/automotive/evs/OWNERS
+++ b/automotive/evs/OWNERS
@@ -1,2 +1,2 @@
 ankitarora@google.com
-jwhpryor@google.com
+changyeon@google.com
diff --git a/bluetooth/aidl/default/Android.bp b/bluetooth/aidl/default/Android.bp
index 32d1a13..3f4ba99 100644
--- a/bluetooth/aidl/default/Android.bp
+++ b/bluetooth/aidl/default/Android.bp
@@ -30,15 +30,8 @@
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
         "BluetoothHci.cpp",
-        ":BluetoothPacketSources",
         "net_bluetooth_mgmt.cpp",
     ],
-    generated_headers: [
-        "BluetoothGeneratedPackets_h",
-    ],
-    include_dirs: [
-        "packages/modules/Bluetooth/system/gd",
-    ],
 }
 
 cc_binary {
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index 013ab7f..9862e9e 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -29,11 +29,6 @@
 
 #include "log/log.h"
 
-// TODO: Remove custom logging defines from PDL packets.
-#undef LOG_INFO
-#undef LOG_DEBUG
-#include "hci/hci_packets.h"
-
 namespace {
 int SetTerminalRaw(int fd) {
   termios terminal_settings;
@@ -140,9 +135,7 @@
 void BluetoothHci::reset() {
   // Send a reset command and wait until the command complete comes back.
 
-  std::vector<uint8_t> reset;
-  ::bluetooth::packet::BitInserter bi{reset};
-  ::bluetooth::hci::ResetBuilder::Create()->Serialize(bi);
+  std::vector<uint8_t> reset = {0x03, 0x0c, 0x00};
 
   auto resetPromise = std::make_shared<std::promise<void>>();
   auto resetFuture = resetPromise->get_future();
@@ -162,13 +155,15 @@
               static_cast<int>(raw_sco.size()));
       },
       [resetPromise](const std::vector<uint8_t>& raw_event) {
-        bool valid = ::bluetooth::hci::ResetCompleteView::Create(
-                         ::bluetooth::hci::CommandCompleteView::Create(
-                             ::bluetooth::hci::EventView::Create(
-                                 ::bluetooth::hci::PacketView<true>(
-                                     std::make_shared<std::vector<uint8_t>>(
-                                         raw_event)))))
-                         .IsValid();
+        std::vector<uint8_t> reset_complete = {0x0e, 0x04, 0x01,
+                                               0x03, 0x0c, 0x00};
+        bool valid = raw_event.size() == 6 &&
+                     raw_event[0] == reset_complete[0] &&
+                     raw_event[1] == reset_complete[1] &&
+                     // Don't compare the number of packets field.
+                     raw_event[3] == reset_complete[3] &&
+                     raw_event[4] == reset_complete[4] &&
+                     raw_event[5] == reset_complete[5];
         if (valid) {
           resetPromise->set_value();
         } else {
@@ -306,7 +301,8 @@
   {
     std::lock_guard<std::mutex> guard(mStateMutex);
     if (mState != HalState::ONE_CLIENT) {
-      ASSERT(mState != HalState::INITIALIZING);
+      LOG_ALWAYS_FATAL_IF(mState == HalState::INITIALIZING,
+                          "mState is INITIALIZING");
       ALOGI("Already closed");
       return ndk::ScopedAStatus::ok();
     }
diff --git a/bluetooth/aidl/vts/Android.bp b/bluetooth/aidl/vts/Android.bp
index 5fc0b2e..ade3bef 100644
--- a/bluetooth/aidl/vts/Android.bp
+++ b/bluetooth/aidl/vts/Android.bp
@@ -16,10 +16,6 @@
     srcs: [
         "VtsHalBluetoothTargetTest.cpp",
         ":BluetoothPacketSources",
-        ":BluetoothHciPacketSources",
-    ],
-    generated_headers: [
-        "BluetoothGeneratedPackets_h",
     ],
     include_dirs: [
         "packages/modules/Bluetooth/system/gd",
@@ -31,7 +27,7 @@
     ],
     static_libs: [
         "android.hardware.bluetooth-V1-ndk",
-        "libbluetooth-types",
+        "libbluetooth_hci_pdl",
     ],
     test_config: "VtsHalBluetoothTargetTest.xml",
     test_suites: [
@@ -57,6 +53,5 @@
     ],
     tidy_disabled_srcs: [
         ":BluetoothPacketSources",
-        ":BluetoothHciPacketSources",
     ],
 }
diff --git a/boot/1.0/vts/functional/OWNERS b/boot/1.0/vts/functional/OWNERS
deleted file mode 100644
index 36e79be..0000000
--- a/boot/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 30545
-dvander@google.com
diff --git a/boot/1.1/vts/functional/OWNERS b/boot/1.1/vts/functional/OWNERS
deleted file mode 100644
index 36e79be..0000000
--- a/boot/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 30545
-dvander@google.com
diff --git a/boot/OWNERS b/boot/OWNERS
new file mode 100644
index 0000000..fca3dff
--- /dev/null
+++ b/boot/OWNERS
@@ -0,0 +1,4 @@
+# Bug component: 1014951
+
+dvander@google.com
+zhangkelvin@google.com
diff --git a/boot/aidl/vts/functional/OWNERS b/boot/aidl/vts/functional/OWNERS
deleted file mode 100644
index bc813d8..0000000
--- a/boot/aidl/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 30545
-zhangkelvin@google.com
diff --git a/broadcastradio/1.0/default/OWNERS b/broadcastradio/1.0/default/OWNERS
deleted file mode 100644
index 302fdd7..0000000
--- a/broadcastradio/1.0/default/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/broadcastradio/1.0/vts/functional/OWNERS b/broadcastradio/1.0/vts/functional/OWNERS
deleted file mode 100644
index aa19d6a..0000000
--- a/broadcastradio/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Bug component: 533946
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/broadcastradio/1.1/default/OWNERS b/broadcastradio/1.1/default/OWNERS
deleted file mode 100644
index 259b91e..0000000
--- a/broadcastradio/1.1/default/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Automotive team
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/broadcastradio/2.0/default/OWNERS b/broadcastradio/2.0/default/OWNERS
deleted file mode 100644
index 259b91e..0000000
--- a/broadcastradio/2.0/default/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Automotive team
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/broadcastradio/2.0/vts/OWNERS b/broadcastradio/2.0/vts/OWNERS
deleted file mode 100644
index 09690ef..0000000
--- a/broadcastradio/2.0/vts/OWNERS
+++ /dev/null
@@ -1,8 +0,0 @@
-# Automotive team
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
-
-# VTS team
-dshi@google.com
diff --git a/broadcastradio/2.0/vts/functional/OWNERS b/broadcastradio/2.0/vts/functional/OWNERS
deleted file mode 100644
index aa19d6a..0000000
--- a/broadcastradio/2.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Bug component: 533946
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/broadcastradio/1.1/vts/OWNERS b/broadcastradio/OWNERS
similarity index 80%
rename from broadcastradio/1.1/vts/OWNERS
rename to broadcastradio/OWNERS
index aa19d6a..7c6aaca 100644
--- a/broadcastradio/1.1/vts/OWNERS
+++ b/broadcastradio/OWNERS
@@ -1,5 +1,5 @@
 # Bug component: 533946
-xuweilin@google.com
-oscarazu@google.com
+
 ericjeong@google.com
-keunyoung@google.com
+oscarazu@google.com
+xuweilin@google.com
diff --git a/broadcastradio/common/OWNERS b/broadcastradio/common/OWNERS
deleted file mode 100644
index 259b91e..0000000
--- a/broadcastradio/common/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Automotive team
-xuweilin@google.com
-oscarazu@google.com
-ericjeong@google.com
-keunyoung@google.com
diff --git a/cas/1.0/default/CasImpl.cpp b/cas/1.0/default/CasImpl.cpp
index 178020e..98e7593 100644
--- a/cas/1.0/default/CasImpl.cpp
+++ b/cas/1.0/default/CasImpl.cpp
@@ -103,8 +103,7 @@
 
 Return<Status> CasImpl::setSessionPrivateData(
         const HidlCasSessionId &sessionId, const HidlCasData& pvtData) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__,
-            sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -113,8 +112,7 @@
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId &sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__,
-            sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -124,8 +122,7 @@
 
 Return<Status> CasImpl::processEcm(
         const HidlCasSessionId &sessionId, const HidlCasData& ecm) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__,
-            sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp
index f79b32d..6d7c304 100644
--- a/cas/1.0/default/DescramblerImpl.cpp
+++ b/cas/1.0/default/DescramblerImpl.cpp
@@ -62,8 +62,7 @@
 }
 
 Return<Status> DescramblerImpl::setMediaCasSession(const HidlCasSessionId& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__,
-            sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
 
     std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
@@ -80,7 +79,7 @@
         return false;
     }
 
-    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
+    return holder->requiresSecureDecoderComponent(mime.c_str());
 }
 
 static inline bool validateRangeForSize(
diff --git a/cas/1.0/default/FactoryLoader.h b/cas/1.0/default/FactoryLoader.h
index 45e515a..3d49d9e 100644
--- a/cas/1.0/default/FactoryLoader.h
+++ b/cas/1.0/default/FactoryLoader.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_HARDWARE_CAS_V1_0_FACTORY_LOADER_H_
 #define ANDROID_HARDWARE_CAS_V1_0_FACTORY_LOADER_H_
 
+#include <android-base/strings.h>
 #include <dirent.h>
 #include <dlfcn.h>
 #include "SharedLibrary.h"
@@ -98,17 +99,17 @@
     String8 dirPath("/vendor/lib/mediacas");
 #endif
 
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             if (loadFactoryForSchemeFromPath(
                     pluginPath, CA_system_id, library, factory)) {
                 mCASystemIdToLibraryPathMap.add(CA_system_id, pluginPath);
@@ -138,10 +139,10 @@
     String8 dirPath("/vendor/lib/mediacas");
 #endif
 
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
@@ -150,7 +151,7 @@
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             queryPluginsFromPath(pluginPath, results);
         }
     }
diff --git a/cas/1.0/default/SharedLibrary.cpp b/cas/1.0/default/SharedLibrary.cpp
index 9c7f385..90c84b8 100644
--- a/cas/1.0/default/SharedLibrary.cpp
+++ b/cas/1.0/default/SharedLibrary.cpp
@@ -29,7 +29,7 @@
 namespace implementation {
 
 SharedLibrary::SharedLibrary(const String8 &path) {
-    mLibHandle = dlopen(path.string(), RTLD_NOW);
+    mLibHandle = dlopen(path.c_str(), RTLD_NOW);
 }
 
 SharedLibrary::~SharedLibrary() {
diff --git a/cas/1.0/default/TypeConvert.cpp b/cas/1.0/default/TypeConvert.cpp
index cd0efdb..cc25cf5 100644
--- a/cas/1.0/default/TypeConvert.cpp
+++ b/cas/1.0/default/TypeConvert.cpp
@@ -82,7 +82,7 @@
     for (size_t i = 0; i < sessionId.size(); i++) {
         result.appendFormat("%02x ", sessionId[i]);
     }
-    if (result.isEmpty()) {
+    if (result.empty()) {
         result.append("(null)");
     }
     return result;
diff --git a/cas/1.0/vts/functional/OWNERS b/cas/1.0/vts/functional/OWNERS
deleted file mode 100644
index 7d8c2ee..0000000
--- a/cas/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 1344
-include ../../../1.2/vts/functional/OWNERS
diff --git a/cas/1.1/default/CasImpl.cpp b/cas/1.1/default/CasImpl.cpp
index 4cc6017..105e036 100644
--- a/cas/1.1/default/CasImpl.cpp
+++ b/cas/1.1/default/CasImpl.cpp
@@ -125,7 +125,7 @@
 
 Return<Status> CasImpl::setSessionPrivateData(const HidlCasSessionId& sessionId,
                                               const HidlCasData& pvtData) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -134,7 +134,7 @@
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -143,7 +143,7 @@
 }
 
 Return<Status> CasImpl::processEcm(const HidlCasSessionId& sessionId, const HidlCasData& ecm) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
diff --git a/cas/1.1/default/DescramblerImpl.cpp b/cas/1.1/default/DescramblerImpl.cpp
index 309cd3c..237d56b 100644
--- a/cas/1.1/default/DescramblerImpl.cpp
+++ b/cas/1.1/default/DescramblerImpl.cpp
@@ -59,7 +59,7 @@
 }
 
 Return<Status> DescramblerImpl::setMediaCasSession(const HidlCasSessionId& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
 
     std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
@@ -75,7 +75,7 @@
         return false;
     }
 
-    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
+    return holder->requiresSecureDecoderComponent(mime.c_str());
 }
 
 static inline bool validateRangeForSize(uint64_t offset, uint64_t length, uint64_t size) {
diff --git a/cas/1.1/default/FactoryLoader.h b/cas/1.1/default/FactoryLoader.h
index 121f90c..a575df6 100644
--- a/cas/1.1/default/FactoryLoader.h
+++ b/cas/1.1/default/FactoryLoader.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_HARDWARE_CAS_V1_1_FACTORY_LOADER_H_
 #define ANDROID_HARDWARE_CAS_V1_1_FACTORY_LOADER_H_
 
+#include <android-base/strings.h>
 #include <dirent.h>
 #include <dlfcn.h>
 #include <media/cas/CasAPI.h>
@@ -90,17 +91,17 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             if (loadFactoryForSchemeFromPath(pluginPath, CA_system_id, library, factory)) {
                 mCASystemIdToLibraryPathMap.add(CA_system_id, pluginPath);
                 closedir(pDir);
@@ -127,10 +128,10 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
@@ -139,7 +140,7 @@
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             queryPluginsFromPath(pluginPath, results);
         }
     }
diff --git a/cas/1.1/default/SharedLibrary.cpp b/cas/1.1/default/SharedLibrary.cpp
index ffe4bb9..ac5dbcf 100644
--- a/cas/1.1/default/SharedLibrary.cpp
+++ b/cas/1.1/default/SharedLibrary.cpp
@@ -29,7 +29,7 @@
 namespace implementation {
 
 SharedLibrary::SharedLibrary(const String8& path) {
-    mLibHandle = dlopen(path.string(), RTLD_NOW);
+    mLibHandle = dlopen(path.c_str(), RTLD_NOW);
 }
 
 SharedLibrary::~SharedLibrary() {
diff --git a/cas/1.1/default/TypeConvert.cpp b/cas/1.1/default/TypeConvert.cpp
index 09ef41a..2ffc79a 100644
--- a/cas/1.1/default/TypeConvert.cpp
+++ b/cas/1.1/default/TypeConvert.cpp
@@ -81,7 +81,7 @@
     for (size_t i = 0; i < sessionId.size(); i++) {
         result.appendFormat("%02x ", sessionId[i]);
     }
-    if (result.isEmpty()) {
+    if (result.empty()) {
         result.append("(null)");
     }
     return result;
diff --git a/cas/1.1/vts/functional/OWNERS b/cas/1.1/vts/functional/OWNERS
deleted file mode 100644
index 7d8c2ee..0000000
--- a/cas/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 1344
-include ../../../1.2/vts/functional/OWNERS
diff --git a/cas/1.2/default/CasImpl.cpp b/cas/1.2/default/CasImpl.cpp
index 46dd251..b1038bc 100644
--- a/cas/1.2/default/CasImpl.cpp
+++ b/cas/1.2/default/CasImpl.cpp
@@ -174,7 +174,7 @@
 
 Return<Status> CasImpl::setSessionPrivateData(const HidlCasSessionId& sessionId,
                                               const HidlCasData& pvtData) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -183,7 +183,7 @@
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -192,7 +192,7 @@
 }
 
 Return<Status> CasImpl::processEcm(const HidlCasSessionId& sessionId, const HidlCasData& ecm) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
diff --git a/cas/1.2/default/DescramblerImpl.cpp b/cas/1.2/default/DescramblerImpl.cpp
index 309cd3c..237d56b 100644
--- a/cas/1.2/default/DescramblerImpl.cpp
+++ b/cas/1.2/default/DescramblerImpl.cpp
@@ -59,7 +59,7 @@
 }
 
 Return<Status> DescramblerImpl::setMediaCasSession(const HidlCasSessionId& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
 
     std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
@@ -75,7 +75,7 @@
         return false;
     }
 
-    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
+    return holder->requiresSecureDecoderComponent(mime.c_str());
 }
 
 static inline bool validateRangeForSize(uint64_t offset, uint64_t length, uint64_t size) {
diff --git a/cas/1.2/default/FactoryLoader.h b/cas/1.2/default/FactoryLoader.h
index a374b31..0b05bfc 100644
--- a/cas/1.2/default/FactoryLoader.h
+++ b/cas/1.2/default/FactoryLoader.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_HARDWARE_CAS_V1_1_FACTORY_LOADER_H_
 #define ANDROID_HARDWARE_CAS_V1_1_FACTORY_LOADER_H_
 
+#include <android-base/strings.h>
 #include <dirent.h>
 #include <dlfcn.h>
 #include <media/cas/CasAPI.h>
@@ -90,17 +91,17 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             if (loadFactoryForSchemeFromPath(pluginPath, CA_system_id, library, factory)) {
                 mCASystemIdToLibraryPathMap.add(CA_system_id, pluginPath);
                 closedir(pDir);
@@ -127,10 +128,10 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
@@ -139,7 +140,7 @@
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             queryPluginsFromPath(pluginPath, results);
         }
     }
diff --git a/cas/1.2/default/SharedLibrary.cpp b/cas/1.2/default/SharedLibrary.cpp
index ffe4bb9..ac5dbcf 100644
--- a/cas/1.2/default/SharedLibrary.cpp
+++ b/cas/1.2/default/SharedLibrary.cpp
@@ -29,7 +29,7 @@
 namespace implementation {
 
 SharedLibrary::SharedLibrary(const String8& path) {
-    mLibHandle = dlopen(path.string(), RTLD_NOW);
+    mLibHandle = dlopen(path.c_str(), RTLD_NOW);
 }
 
 SharedLibrary::~SharedLibrary() {
diff --git a/cas/1.2/default/TypeConvert.cpp b/cas/1.2/default/TypeConvert.cpp
index c4bd0dd..7d27fa1 100644
--- a/cas/1.2/default/TypeConvert.cpp
+++ b/cas/1.2/default/TypeConvert.cpp
@@ -108,7 +108,7 @@
     for (size_t i = 0; i < sessionId.size(); i++) {
         result.appendFormat("%02x ", sessionId[i]);
     }
-    if (result.isEmpty()) {
+    if (result.empty()) {
         result.append("(null)");
     }
     return result;
diff --git a/cas/1.2/vts/functional/OWNERS b/cas/1.2/vts/functional/OWNERS
deleted file mode 100644
index 4c55752..0000000
--- a/cas/1.2/vts/functional/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 1344
-quxiangfang@google.com
-hgchen@google.com
diff --git a/cas/aidl/OWNERS b/cas/OWNERS
old mode 100755
new mode 100644
similarity index 98%
rename from cas/aidl/OWNERS
rename to cas/OWNERS
index 4c55752..84cb53b
--- a/cas/aidl/OWNERS
+++ b/cas/OWNERS
@@ -1,3 +1,4 @@
 # Bug component: 1344
-quxiangfang@google.com
+
 hgchen@google.com
+quxiangfang@google.com
diff --git a/cas/aidl/default/Android.bp b/cas/aidl/default/Android.bp
index 6ce5681..576016e 100644
--- a/cas/aidl/default/Android.bp
+++ b/cas/aidl/default/Android.bp
@@ -21,6 +21,7 @@
 
     shared_libs: [
         "android.hardware.cas-V1-ndk",
+        "libbase",
         "libbinder_ndk",
         "liblog",
         "libutils",
@@ -48,6 +49,7 @@
     ],
     shared_libs: [
         "android.hardware.cas-V1-ndk",
+        "libbase",
         "libbinder_ndk",
         "liblog",
         "libutils",
diff --git a/cas/aidl/default/CasImpl.cpp b/cas/aidl/default/CasImpl.cpp
index f08fcc0..9885e16 100644
--- a/cas/aidl/default/CasImpl.cpp
+++ b/cas/aidl/default/CasImpl.cpp
@@ -158,7 +158,7 @@
 
 ScopedAStatus CasImpl::setSessionPrivateData(const vector<uint8_t>& sessionId,
                                              const vector<uint8_t>& pvtData) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     shared_ptr<CasPlugin> holder = atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -167,7 +167,7 @@
 }
 
 ScopedAStatus CasImpl::closeSession(const vector<uint8_t>& sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     shared_ptr<CasPlugin> holder = atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
@@ -176,7 +176,7 @@
 }
 
 ScopedAStatus CasImpl::processEcm(const vector<uint8_t>& sessionId, const vector<uint8_t>& ecm) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(sessionId).c_str());
     shared_ptr<CasPlugin> holder = atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
diff --git a/cas/aidl/default/DescramblerImpl.cpp b/cas/aidl/default/DescramblerImpl.cpp
index a96fd46..0f4e99b 100644
--- a/cas/aidl/default/DescramblerImpl.cpp
+++ b/cas/aidl/default/DescramblerImpl.cpp
@@ -54,7 +54,7 @@
 }
 
 ScopedAStatus DescramblerImpl::setMediaCasSession(const vector<uint8_t>& in_sessionId) {
-    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(in_sessionId).string());
+    ALOGV("%s: sessionId=%s", __FUNCTION__, sessionIdToString(in_sessionId).c_str());
 
     shared_ptr<DescramblerPlugin> holder = atomic_load(&mPluginHolder);
     if (holder.get() == nullptr) {
@@ -71,7 +71,7 @@
         *_aidl_return = false;
     }
 
-    *_aidl_return = holder->requiresSecureDecoderComponent(String8(in_mime.c_str()));
+    *_aidl_return = holder->requiresSecureDecoderComponent(in_mime.c_str());
     return ScopedAStatus::ok();
 }
 
diff --git a/cas/aidl/default/FactoryLoader.h b/cas/aidl/default/FactoryLoader.h
index 6a562f6..bc3d715 100644
--- a/cas/aidl/default/FactoryLoader.h
+++ b/cas/aidl/default/FactoryLoader.h
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <android-base/strings.h>
 #include <dirent.h>
 #include <dlfcn.h>
 #include <media/cas/CasAPI.h>
@@ -86,17 +87,17 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             if (loadFactoryForSchemeFromPath(pluginPath, CA_system_id, library, factory)) {
                 mCASystemIdToLibraryPathMap.add(CA_system_id, pluginPath);
                 closedir(pDir);
@@ -123,10 +124,10 @@
 #else
     String8 dirPath("/vendor/lib/mediacas");
 #endif
-    DIR* pDir = opendir(dirPath.string());
+    DIR* pDir = opendir(dirPath.c_str());
 
     if (pDir == NULL) {
-        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        ALOGE("Failed to open plugin directory %s", dirPath.c_str());
         return false;
     }
 
@@ -135,7 +136,7 @@
     struct dirent* pEntry;
     while ((pEntry = readdir(pDir))) {
         String8 pluginPath = dirPath + "/" + pEntry->d_name;
-        if (pluginPath.getPathExtension() == ".so") {
+        if (base::EndsWith(pluginPath.c_str(), ".so")) {
             queryPluginsFromPath(pluginPath, results);
         }
     }
diff --git a/cas/aidl/default/SharedLibrary.cpp b/cas/aidl/default/SharedLibrary.cpp
index e79f383..c12d17d 100644
--- a/cas/aidl/default/SharedLibrary.cpp
+++ b/cas/aidl/default/SharedLibrary.cpp
@@ -26,7 +26,7 @@
 namespace cas {
 
 SharedLibrary::SharedLibrary(const String8& path) {
-    mLibHandle = dlopen(path.string(), RTLD_NOW);
+    mLibHandle = dlopen(path.c_str(), RTLD_NOW);
 }
 
 SharedLibrary::~SharedLibrary() {
diff --git a/cas/aidl/default/TypeConvert.cpp b/cas/aidl/default/TypeConvert.cpp
index 4f7005f..1f0a46d 100644
--- a/cas/aidl/default/TypeConvert.cpp
+++ b/cas/aidl/default/TypeConvert.cpp
@@ -98,7 +98,7 @@
     for (auto it = sessionId.begin(); it != sessionId.end(); it++) {
         result.appendFormat("%02x ", *it);
     }
-    if (result.isEmpty()) {
+    if (result.empty()) {
         result.append("(null)");
     }
     return result;
diff --git a/cas/aidl/vts/functional/OWNERS b/cas/aidl/vts/functional/OWNERS
deleted file mode 100644
index 4c55752..0000000
--- a/cas/aidl/vts/functional/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 1344
-quxiangfang@google.com
-hgchen@google.com
diff --git a/common/OWNERS b/common/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/common/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/compatibility_matrices/Android.mk b/compatibility_matrices/Android.mk
index a82a421..d356cf3 100644
--- a/compatibility_matrices/Android.mk
+++ b/compatibility_matrices/Android.mk
@@ -56,6 +56,9 @@
 
 endif # DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE
 
+# TODO(b/296875906): use POLICYVERS from Soong
+POLICYVERS ?= 30
+
 LOCAL_ADD_VBMETA_VERSION := true
 LOCAL_ASSEMBLE_VINTF_ENV_VARS := \
     POLICYVERS \
diff --git a/compatibility_matrices/OWNERS b/compatibility_matrices/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/compatibility_matrices/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/compatibility_matrices/compatibility_matrix.7.xml b/compatibility_matrices/compatibility_matrix.7.xml
index 14c330e..fe424bd 100644
--- a/compatibility_matrices/compatibility_matrix.7.xml
+++ b/compatibility_matrices/compatibility_matrix.7.xml
@@ -404,7 +404,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.light</name>
-        <version>2</version>
+        <version>1-2</version>
         <interface>
             <name>ILights</name>
             <instance>default</instance>
diff --git a/compatibility_matrices/compatibility_matrix.8.xml b/compatibility_matrices/compatibility_matrix.8.xml
index 69a3d4c..0f82e5f 100644
--- a/compatibility_matrices/compatibility_matrix.8.xml
+++ b/compatibility_matrices/compatibility_matrix.8.xml
@@ -133,6 +133,7 @@
         <interface>
             <name>IFace</name>
             <instance>default</instance>
+            <instance>virtual</instance>
         </interface>
     </hal>
     <hal format="aidl" optional="true">
@@ -449,7 +450,7 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.neuralnetworks</name>
         <version>1-4</version>
         <interface>
@@ -457,7 +458,7 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.nfc</name>
         <interface>
             <name>INfc</name>
diff --git a/compatibility_matrices/compatibility_matrix.9.xml b/compatibility_matrices/compatibility_matrix.9.xml
index 9af095f..f006c71 100644
--- a/compatibility_matrices/compatibility_matrix.9.xml
+++ b/compatibility_matrices/compatibility_matrix.9.xml
@@ -446,7 +446,7 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.neuralnetworks</name>
         <version>1-4</version>
         <interface>
@@ -454,7 +454,7 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.nfc</name>
         <interface>
             <name>INfc</name>
@@ -646,6 +646,14 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true" updatable-via-apex="true">
+        <name>android.hardware.threadnetwork</name>
+        <version>1</version>
+        <interface>
+            <name>IThreadChip</name>
+            <regex-instance>chip[0-9]+</regex-instance>
+        </interface>
+    </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.tv.hdmi.cec</name>
         <version>1</version>
@@ -787,12 +795,4 @@
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
-        <name>android.hardware.threadnetwork</name>
-        <version>1</version>
-        <interface>
-            <name>IThreadChip</name>
-            <regex-instance>chip[0-9]+</regex-instance>
-        </interface>
-    </hal>
 </compatibility-matrix>
diff --git a/configstore/1.0/vts/functional/OWNERS b/configstore/OWNERS
similarity index 97%
rename from configstore/1.0/vts/functional/OWNERS
rename to configstore/OWNERS
index edfa1b0..70ad434 100644
--- a/configstore/1.0/vts/functional/OWNERS
+++ b/configstore/OWNERS
@@ -1,2 +1,3 @@
 # Bug component: 24939
+
 lpy@google.com
diff --git a/drm/1.0/default/Android.bp b/drm/1.0/default/Android.bp
index cbdab4f..45aba7b 100644
--- a/drm/1.0/default/Android.bp
+++ b/drm/1.0/default/Android.bp
@@ -134,6 +134,7 @@
     shared_libs: [
         "android.hardware.drm@1.0",
         "android.hidl.memory@1.0",
+        "libbase",
         "libcutils",
         "libhidlbase",
         "libhidlmemory",
diff --git a/drm/1.0/default/OWNERS b/drm/1.0/default/OWNERS
deleted file mode 100644
index ecb421c..0000000
--- a/drm/1.0/default/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-edwinwong@google.com
-fredgc@google.com
-jtinker@google.com
-kylealexander@google.com
-rfrias@google.com
-robertshih@google.com
diff --git a/drm/1.0/default/include/PluginLoader.h b/drm/1.0/default/include/PluginLoader.h
index e243f42..5130b16 100644
--- a/drm/1.0/default/include/PluginLoader.h
+++ b/drm/1.0/default/include/PluginLoader.h
@@ -18,6 +18,8 @@
 #define PLUGIN_LOADER_H_
 
 #include "SharedLibrary.h"
+
+#include <android-base/strings.h>
 #include <utils/Log.h>
 #include <utils/String8.h>
 #include <utils/Vector.h>
@@ -46,7 +48,7 @@
             struct dirent* pEntry;
             while ((pEntry = readdir(pDir))) {
                 String8 file(pEntry->d_name);
-                if (file.getPathExtension() == ".so") {
+                if (base::EndsWith(file.c_str(), ".so")) {
                     String8 path = pluginDir + "/" + pEntry->d_name;
                     T *plugin = loadOne(path, entry);
                     if (plugin) {
diff --git a/drm/1.0/vts/OWNERS b/drm/1.0/vts/OWNERS
deleted file mode 100644
index ecb421c..0000000
--- a/drm/1.0/vts/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-edwinwong@google.com
-fredgc@google.com
-jtinker@google.com
-kylealexander@google.com
-rfrias@google.com
-robertshih@google.com
diff --git a/drm/1.0/vts/functional/OWNERS b/drm/1.0/vts/functional/OWNERS
deleted file mode 100644
index 0b13790..0000000
--- a/drm/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 49079
-jtinker@google.com
-robertshih@google.com
-edwinwong@google.com
\ No newline at end of file
diff --git a/drm/1.1/vts/OWNERS b/drm/1.1/vts/OWNERS
deleted file mode 100644
index ecb421c..0000000
--- a/drm/1.1/vts/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-edwinwong@google.com
-fredgc@google.com
-jtinker@google.com
-kylealexander@google.com
-rfrias@google.com
-robertshih@google.com
diff --git a/drm/1.1/vts/functional/OWNERS b/drm/1.1/vts/functional/OWNERS
deleted file mode 100644
index 0b13790..0000000
--- a/drm/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 49079
-jtinker@google.com
-robertshih@google.com
-edwinwong@google.com
\ No newline at end of file
diff --git a/drm/1.2/vts/OWNERS b/drm/1.2/vts/OWNERS
deleted file mode 100644
index ecb421c..0000000
--- a/drm/1.2/vts/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-edwinwong@google.com
-fredgc@google.com
-jtinker@google.com
-kylealexander@google.com
-rfrias@google.com
-robertshih@google.com
diff --git a/drm/1.2/vts/functional/OWNERS b/drm/1.2/vts/functional/OWNERS
deleted file mode 100644
index 0b13790..0000000
--- a/drm/1.2/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 49079
-jtinker@google.com
-robertshih@google.com
-edwinwong@google.com
\ No newline at end of file
diff --git a/drm/1.4/vts/OWNERS b/drm/1.4/vts/OWNERS
deleted file mode 100644
index 3a0672e..0000000
--- a/drm/1.4/vts/OWNERS
+++ /dev/null
@@ -1,9 +0,0 @@
-conglin@google.com
-edwinwong@google.com
-fredgc@google.com
-jtinker@google.com
-juce@google.com
-kylealexander@google.com
-rfrias@google.com
-robertshih@google.com
-sigquit@google.com
diff --git a/drm/1.3/vts/OWNERS b/drm/OWNERS
similarity index 98%
rename from drm/1.3/vts/OWNERS
rename to drm/OWNERS
index 744827c..c06472a 100644
--- a/drm/1.3/vts/OWNERS
+++ b/drm/OWNERS
@@ -1,4 +1,5 @@
 # Bug component: 49079
+
 conglin@google.com
 fredgc@google.com
 juce@google.com
@@ -8,4 +9,4 @@
 rfrias@google.com
 robertshih@google.com
 sigquit@google.com
-vickymin@google.com
\ No newline at end of file
+vickymin@google.com
diff --git a/drm/aidl/OWNERS b/drm/aidl/OWNERS
deleted file mode 100644
index fa8fd20..0000000
--- a/drm/aidl/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 49079
-edwinwong@google.com
-kelzhan@google.com
-robertshih@google.com
diff --git a/drm/aidl/vts/OWNERS b/drm/aidl/vts/OWNERS
deleted file mode 100644
index e44b93e..0000000
--- a/drm/aidl/vts/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-edwinwong@google.com
-jtinker@google.com
-kelzhan@google.com
-robertshih@google.com
diff --git a/dumpstate/OWNERS b/dumpstate/OWNERS
new file mode 100644
index 0000000..4c9173e
--- /dev/null
+++ b/dumpstate/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298624585
+
+include platform/frameworks/native:/cmds/dumpstate/OWNERS
diff --git a/gnss/1.0/default/OWNERS b/gnss/1.0/default/OWNERS
deleted file mode 100644
index 6c25bd7..0000000
--- a/gnss/1.0/default/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
diff --git a/gnss/1.0/vts/OWNERS b/gnss/1.0/vts/OWNERS
deleted file mode 100644
index 937d70a..0000000
--- a/gnss/1.0/vts/OWNERS
+++ /dev/null
@@ -1,7 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-
-# VTS team
-yim@google.com
-trong@google.com
\ No newline at end of file
diff --git a/gnss/1.0/vts/functional/OWNERS b/gnss/1.0/vts/functional/OWNERS
deleted file mode 100644
index b831eb4..0000000
--- a/gnss/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 393449
-yuhany@google.com
diff --git a/gnss/1.1/default/OWNERS b/gnss/1.1/default/OWNERS
deleted file mode 100644
index a3d8577..0000000
--- a/gnss/1.1/default/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-yuhany@google.com
diff --git a/gnss/1.1/vts/OWNERS b/gnss/1.1/vts/OWNERS
deleted file mode 100644
index 3ed36da..0000000
--- a/gnss/1.1/vts/OWNERS
+++ /dev/null
@@ -1,7 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-yuhany@google.com
-
-# VTS team
-yim@google.com
diff --git a/gnss/1.1/vts/functional/OWNERS b/gnss/1.1/vts/functional/OWNERS
deleted file mode 100644
index b831eb4..0000000
--- a/gnss/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 393449
-yuhany@google.com
diff --git a/gnss/2.0/default/OWNERS b/gnss/2.0/default/OWNERS
deleted file mode 100644
index 8da956c..0000000
--- a/gnss/2.0/default/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-yuhany@google.com
-aadmal@google.com
diff --git a/gnss/2.0/vts/OWNERS b/gnss/2.0/vts/OWNERS
deleted file mode 100644
index 0a7ce6c..0000000
--- a/gnss/2.0/vts/OWNERS
+++ /dev/null
@@ -1,8 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-yuhany@google.com
-aadmal@google.com
-
-# VTS team
-yim@google.com
diff --git a/gnss/2.0/vts/functional/OWNERS b/gnss/2.0/vts/functional/OWNERS
deleted file mode 100644
index b831eb4..0000000
--- a/gnss/2.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 393449
-yuhany@google.com
diff --git a/gnss/2.1/default/OWNERS b/gnss/2.1/default/OWNERS
deleted file mode 100644
index b7b4a2e..0000000
--- a/gnss/2.1/default/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-gomo@google.com
-smalkos@google.com
-wyattriley@google.com
-yuhany@google.com
diff --git a/gnss/2.1/vts/OWNERS b/gnss/2.1/vts/OWNERS
deleted file mode 100644
index b7b4a2e..0000000
--- a/gnss/2.1/vts/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-gomo@google.com
-smalkos@google.com
-wyattriley@google.com
-yuhany@google.com
diff --git a/gnss/2.1/vts/functional/OWNERS b/gnss/2.1/vts/functional/OWNERS
deleted file mode 100644
index b831eb4..0000000
--- a/gnss/2.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 393449
-yuhany@google.com
diff --git a/gnss/aidl/OWNERS b/gnss/OWNERS
similarity index 75%
rename from gnss/aidl/OWNERS
rename to gnss/OWNERS
index e5b585e..57982e7 100644
--- a/gnss/aidl/OWNERS
+++ b/gnss/OWNERS
@@ -2,5 +2,7 @@
 
 gomo@google.com
 smalkos@google.com
+trong@google.com
 wyattriley@google.com
+yim@google.com
 yuhany@google.com
diff --git a/gnss/common/OWNERS b/gnss/common/OWNERS
deleted file mode 100644
index 3ed36da..0000000
--- a/gnss/common/OWNERS
+++ /dev/null
@@ -1,7 +0,0 @@
-wyattriley@google.com
-gomo@google.com
-smalkos@google.com
-yuhany@google.com
-
-# VTS team
-yim@google.com
diff --git a/health/1.0/default/convert.cpp b/health/1.0/default/convert.cpp
index 3680d4d..31b4679 100644
--- a/health/1.0/default/convert.cpp
+++ b/health/1.0/default/convert.cpp
@@ -26,19 +26,18 @@
     config.periodicChoresIntervalFast = hc->periodic_chores_interval_fast;
     config.periodicChoresIntervalSlow = hc->periodic_chores_interval_slow;
 
-    config.batteryStatusPath        = hc->batteryStatusPath.string();
-    config.batteryHealthPath        = hc->batteryHealthPath.string();
-    config.batteryPresentPath       = hc->batteryPresentPath.string();
-    config.batteryCapacityPath      = hc->batteryCapacityPath.string();
-    config.batteryVoltagePath       = hc->batteryVoltagePath.string();
-    config.batteryTemperaturePath   = hc->batteryTemperaturePath.string();
-    config.batteryTechnologyPath    = hc->batteryTechnologyPath.string();
-    config.batteryCurrentNowPath    = hc->batteryCurrentNowPath.string();
-    config.batteryCurrentAvgPath    = hc->batteryCurrentAvgPath.string();
-    config.batteryChargeCounterPath = hc->batteryChargeCounterPath.string();
-    config.batteryFullChargePath    = hc->batteryFullChargePath.string();
-    config.batteryCycleCountPath    = hc->batteryCycleCountPath.string();
-
+    config.batteryStatusPath = hc->batteryStatusPath.c_str();
+    config.batteryHealthPath = hc->batteryHealthPath.c_str();
+    config.batteryPresentPath = hc->batteryPresentPath.c_str();
+    config.batteryCapacityPath = hc->batteryCapacityPath.c_str();
+    config.batteryVoltagePath = hc->batteryVoltagePath.c_str();
+    config.batteryTemperaturePath = hc->batteryTemperaturePath.c_str();
+    config.batteryTechnologyPath = hc->batteryTechnologyPath.c_str();
+    config.batteryCurrentNowPath = hc->batteryCurrentNowPath.c_str();
+    config.batteryCurrentAvgPath = hc->batteryCurrentAvgPath.c_str();
+    config.batteryChargeCounterPath = hc->batteryChargeCounterPath.c_str();
+    config.batteryFullChargePath = hc->batteryFullChargePath.c_str();
+    config.batteryCycleCountPath = hc->batteryCycleCountPath.c_str();
 }
 
 void convertFromHealthConfig(const HealthConfig& c, struct healthd_config *hc) {
diff --git a/health/2.0/vts/OWNERS b/health/2.0/vts/OWNERS
deleted file mode 100644
index 9f96f51..0000000
--- a/health/2.0/vts/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 30545
-elsk@google.com
-sspatil@google.com
diff --git a/health/2.1/vts/OWNERS b/health/2.1/vts/OWNERS
deleted file mode 100644
index a6803cd..0000000
--- a/health/2.1/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-elsk@google.com
-sspatil@google.com
diff --git a/health/2.1/vts/functional/OWNERS b/health/2.1/vts/functional/OWNERS
deleted file mode 100644
index cd06415..0000000
--- a/health/2.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 30545
-elsk@google.com
diff --git a/health/aidl/OWNERS b/health/OWNERS
similarity index 98%
rename from health/aidl/OWNERS
rename to health/OWNERS
index 0f1bee2..1d4d086 100644
--- a/health/aidl/OWNERS
+++ b/health/OWNERS
@@ -1,5 +1,6 @@
 # Bug component: 30545
+
+apelosi@google.com
 elsk@google.com
 smoreland@google.com
 wjack@google.com
-apelosi@google.com
diff --git a/health/storage/1.0/vts/functional/OWNERS b/health/storage/OWNERS
similarity index 79%
rename from health/storage/1.0/vts/functional/OWNERS
rename to health/storage/OWNERS
index 8f66979..7af8d99 100644
--- a/health/storage/1.0/vts/functional/OWNERS
+++ b/health/storage/OWNERS
@@ -1,3 +1,6 @@
 # Bug component: 30545
-elsk@google.com
+
+set noparent
+
 jaegeuk@google.com
+elsk@google.com
diff --git a/health/storage/aidl/vts/functional/OWNERS b/health/storage/aidl/vts/functional/OWNERS
deleted file mode 100644
index a15ed7c..0000000
--- a/health/storage/aidl/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 30545
-file:platform/hardware/interfaces:/health/aidl/OWNERS
\ No newline at end of file
diff --git a/light/OWNERS b/light/OWNERS
new file mode 100644
index 0000000..d1da8a7
--- /dev/null
+++ b/light/OWNERS
@@ -0,0 +1,5 @@
+# Bug Component: 185877106
+
+michaelwr@google.com
+santoscordon@google.com
+philipjunker@google.com
diff --git a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
index 460ff97..069b2cf 100644
--- a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
+++ b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/BaseBlock.aidl
@@ -35,5 +35,6 @@
 @VintfStability
 union BaseBlock {
   android.hardware.common.NativeHandle nativeBlock;
+  android.hardware.HardwareBuffer hwbBlock;
   android.hardware.media.bufferpool2.BufferStatusMessage pooledBlock;
 }
diff --git a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/IComponent.aidl b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/IComponent.aidl
index 1af66d0..c7d8a97 100644
--- a/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/IComponent.aidl
+++ b/media/c2/aidl/aidl_api/android.hardware.media.c2/current/android/hardware/media/c2/IComponent.aidl
@@ -35,7 +35,7 @@
 @VintfStability
 interface IComponent {
   android.hardware.common.NativeHandle configureVideoTunnel(in int avSyncHwId);
-  android.hardware.media.c2.IComponent.BlockPool createBlockPool(in int allocatorId);
+  android.hardware.media.c2.IComponent.BlockPool createBlockPool(in android.hardware.media.c2.IComponent.BlockPoolAllocator allocator);
   void destroyBlockPool(in long blockPoolId);
   void drain(in boolean withEos);
   android.hardware.media.c2.WorkBundle flush();
@@ -43,11 +43,14 @@
   void queue(in android.hardware.media.c2.WorkBundle workBundle);
   void release();
   void reset();
-  void setDecoderOutputAllocator(in android.hardware.media.c2.IGraphicBufferAllocator allocator);
   void start();
   void stop();
   parcelable BlockPool {
     long blockPoolId;
     android.hardware.media.c2.IConfigurable configurable;
   }
+  union BlockPoolAllocator {
+    int allocatorId;
+    android.hardware.media.c2.IGraphicBufferAllocator igba;
+  }
 }
diff --git a/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl b/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
index 8b8b8e0..7cc041c 100644
--- a/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
+++ b/media/c2/aidl/android/hardware/media/c2/BaseBlock.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.media.c2;
 
+import android.hardware.HardwareBuffer;
 import android.hardware.common.NativeHandle;
 
 /**
@@ -32,6 +33,10 @@
      */
     NativeHandle nativeBlock;
     /**
+     * #hwbBlock is the opaque representation of a GraphicBuffer
+     */
+    HardwareBuffer hwbBlock;
+    /**
      * #pooledBlock is a reference to a buffer handled by a BufferPool.
      */
     android.hardware.media.bufferpool2.BufferStatusMessage pooledBlock;
diff --git a/media/c2/aidl/android/hardware/media/c2/IComponent.aidl b/media/c2/aidl/android/hardware/media/c2/IComponent.aidl
index a9fddbb..a330d46 100644
--- a/media/c2/aidl/android/hardware/media/c2/IComponent.aidl
+++ b/media/c2/aidl/android/hardware/media/c2/IComponent.aidl
@@ -43,6 +43,18 @@
         long blockPoolId;
         IConfigurable configurable;
     }
+
+    /**
+     * Allocator for C2BlockPool.
+     *
+     * C2BlockPool will use a C2Allocator which is specified by an id.
+     * or C2AIDL allocator interface directly.
+     */
+    union BlockPoolAllocator {
+        int allocatorId;
+        IGraphicBufferAllocator igba;
+    }
+
     /**
      * Configures a component for a tunneled playback mode.
      *
@@ -86,7 +98,8 @@
      * destroyBlockPool(), reset() or release(). reset() and release() must
      * destroy all `C2BlockPool` objects that have been created.
      *
-     * @param allocatorId Id of a `C2Allocator`.
+     * @param allocator AIDL allocator interface or C2Allocator specifier
+     *     for C2BlockPool
      * @param out configurable Configuration interface for the created pool. This
      *     must not be null.
      * @return Created block pool information. This could be used to config/query and
@@ -97,7 +110,7 @@
      *   - `Status::TIMED_OUT` - The operation cannot be finished in a timely manner.
      *   - `Status::CORRUPTED` - Some unknown error occurred.
      */
-    BlockPool createBlockPool(in int allocatorId);
+    BlockPool createBlockPool(in BlockPoolAllocator allocator);
 
     /**
      * Destroys a local block pool previously created by createBlockPool().
@@ -232,17 +245,6 @@
     void reset();
 
     /**
-     * Specify an allocator for decoder output buffer from HAL.
-     *
-     * The method will be used once during the life-cycle of a codec instance.
-     * @param allocator Decoder output buffer allocator from the client
-     * @throws ServiceSpecificException with one of the following values
-     *   - `Status::CANNOT_DO` - The component does not support allocating from the client.
-     *   - `Status::CORRUPTED` - Some unknown error occurred.
-     */
-    void setDecoderOutputAllocator(in IGraphicBufferAllocator allocator);
-
-    /**
      * Starts the component.
      *
      * This method must be supported in stopped state as well as tripped state.
diff --git a/oemlock/1.0/vts/functional/OWNERS b/oemlock/1.0/vts/functional/OWNERS
deleted file mode 100644
index ec8c304..0000000
--- a/oemlock/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 186411
-chengyouho@google.com
-frankwoo@google.com
diff --git a/authsecret/1.0/vts/functional/OWNERS b/oemlock/OWNERS
similarity index 98%
copy from authsecret/1.0/vts/functional/OWNERS
copy to oemlock/OWNERS
index ec8c304..5a5d074 100644
--- a/authsecret/1.0/vts/functional/OWNERS
+++ b/oemlock/OWNERS
@@ -1,3 +1,4 @@
 # Bug component: 186411
+
 chengyouho@google.com
 frankwoo@google.com
diff --git a/oemlock/aidl/vts/OWNERS b/oemlock/aidl/vts/OWNERS
deleted file mode 100644
index 40d95e4..0000000
--- a/oemlock/aidl/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-chengyouho@google.com
-frankwoo@google.com
diff --git a/radio/1.0/vts/functional/OWNERS b/radio/1.0/vts/functional/OWNERS
deleted file mode 100644
index 1b6d937..0000000
--- a/radio/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-shuoq@google.com
diff --git a/radio/1.1/vts/OWNERS b/radio/1.1/vts/OWNERS
deleted file mode 100644
index 4d199ca..0000000
--- a/radio/1.1/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.2/vts/OWNERS b/radio/1.2/vts/OWNERS
deleted file mode 100644
index 4d199ca..0000000
--- a/radio/1.2/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.3/vts/OWNERS b/radio/1.3/vts/OWNERS
deleted file mode 100644
index 4d199ca..0000000
--- a/radio/1.3/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.4/vts/OWNERS b/radio/1.4/vts/OWNERS
deleted file mode 100644
index 4d199ca..0000000
--- a/radio/1.4/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.5/vts/OWNERS b/radio/1.5/vts/OWNERS
deleted file mode 100644
index 4d199ca..0000000
--- a/radio/1.5/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.6/vts/OWNERS b/radio/1.6/vts/OWNERS
deleted file mode 100644
index a07c917..0000000
--- a/radio/1.6/vts/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include ../../1.0/vts/OWNERS
diff --git a/radio/1.0/vts/OWNERS b/radio/OWNERS
similarity index 63%
rename from radio/1.0/vts/OWNERS
rename to radio/OWNERS
index 117692a..67ac2e2 100644
--- a/radio/1.0/vts/OWNERS
+++ b/radio/OWNERS
@@ -1,5 +1,4 @@
 # Bug component: 20868
-jminjie@google.com
-sarahchin@google.com
-shuoq@google.com
+
 jackyu@google.com
+sarahchin@google.com
diff --git a/radio/aidl/OWNERS b/radio/aidl/OWNERS
deleted file mode 100644
index 7b01aad..0000000
--- a/radio/aidl/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 20868
-include ../1.0/vts/OWNERS
-
diff --git a/radio/aidl/compat/OWNERS b/radio/aidl/compat/OWNERS
index 471d806..3a7a009 100644
--- a/radio/aidl/compat/OWNERS
+++ b/radio/aidl/compat/OWNERS
@@ -1,3 +1,3 @@
 # Bug component: 20868
-include ../../1.0/vts/OWNERS
+
 twasilczyk@google.com
diff --git a/radio/config/1.0/vts/functional/OWNERS b/radio/config/1.0/vts/functional/OWNERS
deleted file mode 100644
index badd6d7..0000000
--- a/radio/config/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-# Bug component: 20868
-jminjie@google.com
-sarahchin@google.com
-amitmahajan@google.com
-shuoq@google.com
-jackyu@google.com
diff --git a/radio/config/1.1/vts/OWNERS b/radio/config/1.1/vts/OWNERS
deleted file mode 100644
index 4109967..0000000
--- a/radio/config/1.1/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include /radio/1.0/vts/OWNERS
diff --git a/radio/config/1.2/vts/OWNERS b/radio/config/1.2/vts/OWNERS
deleted file mode 100644
index 4109967..0000000
--- a/radio/config/1.2/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 20868
-include /radio/1.0/vts/OWNERS
diff --git a/rebootescrow/OWNERS b/rebootescrow/OWNERS
new file mode 100644
index 0000000..c9701ff
--- /dev/null
+++ b/rebootescrow/OWNERS
@@ -0,0 +1,4 @@
+# Bug component: 63928581
+
+kroot@google.com
+paulcrowley@google.com
diff --git a/rebootescrow/aidl/default/OWNERS b/rebootescrow/aidl/default/OWNERS
deleted file mode 100644
index c5288d6..0000000
--- a/rebootescrow/aidl/default/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-kroot@google.com
-paulcrowley@google.com
diff --git a/rebootescrow/aidl/vts/OWNERS b/rebootescrow/aidl/vts/OWNERS
deleted file mode 100644
index c5288d6..0000000
--- a/rebootescrow/aidl/vts/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-kroot@google.com
-paulcrowley@google.com
diff --git a/renderscript/1.0/vts/functional/OWNERS b/renderscript/OWNERS
similarity index 84%
rename from renderscript/1.0/vts/functional/OWNERS
rename to renderscript/OWNERS
index d785790..443ebff 100644
--- a/renderscript/1.0/vts/functional/OWNERS
+++ b/renderscript/OWNERS
@@ -1,6 +1,6 @@
 # Bug component: 43047
+
 butlermichael@google.com
 dgross@google.com
-jeanluc@google.com
 miaowang@google.com
 xusongw@google.com
diff --git a/scripts/OWNERS b/scripts/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/scripts/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/security/README.md b/security/README.md
new file mode 100644
index 0000000..c5b5ba8
--- /dev/null
+++ b/security/README.md
@@ -0,0 +1,109 @@
+# Security-Related HALs
+
+The `security/` subdirectory holds various security-related HALs.  (The final two sections of this
+document also describe security-related HALs that are in other places under `hardware/interfaces/`.)
+
+The most significant HAL is KeyMint (**`IKeyMintDevice`** in the
+`hardware/interfaces/security/keymint/` directory), which allows access to cryptographic
+functionality where the key material is restricted to a secure environment.  This functionality is
+used by Android system services, and is also made available to apps via Android Keystore.
+
+A KeyMint implementation (or an implementation of its predecessor, Keymaster) that runs in an
+isolated execution environment (e.g. ARM TrustZone) is required for most Android devices; see [CDD
+9.11](https://source.android.com/docs/compatibility/13/android-13-cdd#911_keys_and_credentials).
+
+A device may optionally also support a second KeyMint instance, running in a dedicated secure
+processor; this is known as StrongBox ([CDD
+9.11.2](https://source.android.com/docs/compatibility/13/android-13-cdd#9112_strongbox)).
+
+Two specific features of KeyMint are worth highlighting, as they have an impact on the other
+security-related HALs:
+
+- KeyMint supports keys that can only be used when the operation is authenticated by the user,
+  either by their lock screen knowledge factor (LSKF, e.g. PIN or pattern) or by a strong biometric
+  (e.g. fingerprint).
+- KeyMint supports *attestation* of public keys: when an asymmetric keypair is created, the secure
+  environment produces a chain of signed certificates:
+  - starting from a trusted root certificate
+  - terminating in a leaf certificate that holds the public key; this leaf certificate may also
+    describe the state of the device and the policies attached to the key.
+
+## Authentication Verification
+
+User authentication must also take place in a secure environment (see the final section below), but
+the results of that authentication are communicated to KeyMint via Android.  As such, the
+authentication result (a *hardware auth token*) is signed with a per-boot shared HMAC key known only
+to the secure components, so that it's authenticity can be verified.
+
+If an authenticator, for example GateKeeper (described by the **`IGatekeeper`** HAL in
+`hardware/interfaces/gatekeeper/`), is co-located in the same secure environment as KeyMint, it can
+use a local, vendor-specific, method to communicate the shared HMAC key.
+
+However, if the authenticator is in a different environment than the KeyMint instance then a local
+communication mechanism may not be possible.  For example, a StrongBox KeyMint instance running in a
+separate secure processor may not have a communication channel with a TEE on the main processor.
+
+To allow for this, the **`ISharedSecret`** HAL (in `hardware/interfaces/security/sharedsecret`)
+describes an N-party shared key agreement protocol for per-boot derivation of the shared HMAC key,
+based on a pre-provisioned shared secret.  This HAL can be implemented by any security component
+&ndash; whether KeyMint instance or authenticator &ndash; that needs access to the shared HMAC key.
+
+User authentication operations are also timestamped, but a StrongBox KeyMint instance may not have
+access to a secure time source that is aligned with the authenticator's time source.
+
+To allow for this, the **`ISecureClock`** HAL (in `hardware/interfaces/secureclock`) describes a
+challenge-based timestamp authentication protocol.  This HAL is optional; it need only be
+implemented if there is a KeyMint instance without a secure source of time.
+
+## Attestation Key Provisioning
+
+As noted above, key generation may also generate an attestation certificate chain, which requires
+that the secure environment have access to a signing key which in turn chains back to the Google
+root.
+
+Historically these signing keys were created by Google and provided to vendors for installation in
+batches of devices (to prevent their use as unique device identifiers).  However, this mechanism had
+significant disadvantages, as it required secure handling of key material and only allowed for
+coarse-grained revocation.
+
+The remote key provisioning HAL (**`IRemotelyProvisionedComponent`** in
+`hardware/interfaces/security/rkp/`) provides a mechanism whereby signing certificates for
+attestation can be retrieved at runtime from Google servers based on pre-registered device identity
+information.  This mechanism is used to provision certificates for KeyMint's signing keys, but is
+not restricted to that purpose; it can also be used in other scenarios where keys need to be
+provisioned (for example, for [Widevine](https://developers.google.com/widevine/drm/overview)).
+
+## Keymaster
+
+The Keymaster HAL (**`IKeymasterDevice`** in `hardware/interfaces/keymaster/`) is the historical
+ancestor of many of the HALs here (and may still be present on older devices).  Its functionality is
+effectively the union of the following current HALs:
+
+- **`IKeyMintDevice`**
+- **`ISharedSecret`**
+- **`ISecureClock`**
+
+## Related Authentication HALs
+
+Authentication of users needs to happen in a secure environment, using vendor-specific
+functionality, and so involves the use of one of the following HALs (all of which are outside the
+`security/` subdirectory).
+
+- The **`IGatekeeper`** HAL (in `hardware/interfaces/gatekeeper/`) provides user authentication
+  functionality based on the user's lock-screen knowledge factor (LSKF), including throttling
+  behaviour to prevent attacks.  Authentication tokens produced by this HAL are consumed by KeyMint,
+  validated using the shared HMAC key described above.
+  - The optional **`IWeaver`** HAL (in `hardware/interfaces/weaver`) improves the security of LSKF
+    authentication by converting the user's LSKF into a *synthetic password* via hashing and
+    stretching. This is required to be implemented on a separate secure element, which prevents
+    offline attacks on Gatekeeper storage. Note that Weaver does not directly interact with KeyMint;
+    the synthetic password is fed into Gatekeeper in place of the plain user password, and then
+    Gatekeeper interacts with KeyMint as normal.
+- The **`IFingerprint`** and **`IFace`** HAL definitions (under `hardware/interfaces/biometrics/`)
+  allow access to biometric authentication functionality that is implemented in a secure
+  environment.  Authentication tokens produced by these HALs are consumed by KeyMint, validated
+  using the shared HMAC key described above.
+- The optional **`IConfirmationUI`** HAL (in `hardware/interfaces/confirmationui`) supports
+  functionality where the user confirms that they have seen a specific message in a secure manner.
+  Confirmation tokens produced by this HAL are consumed by KeyMint, validated using the shared HMAC
+  key described above.
diff --git a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
index d401247..36f0106 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
@@ -971,7 +971,9 @@
      * Tag::CERTIFICATE_NOT_BEFORE the beginning of the validity of the certificate in UNIX epoch
      * time in milliseconds.  This value is used when generating attestation or self signed
      * certificates.  ErrorCode::MISSING_NOT_BEFORE must be returned if this tag is not provided if
-     * this tag is not provided to generateKey or importKey.
+     * this tag is not provided to generateKey or importKey.  For importWrappedKey, there is no way
+     * to specify the value of this tag for the wrapped key, so a value of 0 must be used for
+     * certificate generation.
      */
     CERTIFICATE_NOT_BEFORE = TagType.DATE | 1008,
 
@@ -979,7 +981,8 @@
      * Tag::CERTIFICATE_NOT_AFTER the end of the validity of the certificate in UNIX epoch time in
      * milliseconds.  This value is used when generating attestation or self signed certificates.
      * ErrorCode::MISSING_NOT_AFTER must be returned if this tag is not provided to generateKey or
-     * importKey.
+     * importKey.  For importWrappedKey, there is no way to specify the value of this tag for the
+     * wrapped key, so a value of 253402300799000 is used for certificate generation.
      */
     CERTIFICATE_NOT_AFTER = TagType.DATE | 1009,
 
diff --git a/security/keymint/aidl/default/service.cpp b/security/keymint/aidl/default/service.cpp
index dc0c618..10cbf07 100644
--- a/security/keymint/aidl/default/service.cpp
+++ b/security/keymint/aidl/default/service.cpp
@@ -44,6 +44,8 @@
 }
 
 int main() {
+    // The global logger object required by keymaster's logging macros in keymaster/logger.h.
+    keymaster::SoftKeymasterLogger km_logger;
     // Zero threads seems like a useless pool, but below we'll join this thread to it, increasing
     // the pool size to 1.
     ABinderProcess_setThreadPoolMaxThreadCount(0);
diff --git a/security/keymint/aidl/vts/functional/AuthTest.cpp b/security/keymint/aidl/vts/functional/AuthTest.cpp
index ecaee11..eb5db68 100644
--- a/security/keymint/aidl/vts/functional/AuthTest.cpp
+++ b/security/keymint/aidl/vts/functional/AuthTest.cpp
@@ -350,14 +350,14 @@
 
     // Wait for long enough that the hardware auth token expires.
     sleep(timeout_secs + 1);
-    if (!timestamp_token_required_) {
-        // KeyMint implementation has its own clock, and can immediately detect timeout.
-        EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
-                  Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
-    } else {
-        // KeyMint implementation has no clock, so only detects timeout via timestamp token provided
-        // on update()/finish().
-        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
+
+    auto begin_result = Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat);
+    if (begin_result == ErrorCode::OK) {
+        // If begin() succeeds despite the out-of-date HAT, that must mean that the KeyMint
+        // device doesn't have its own clock.  In that case, it only detects timeout via a
+        // timestamp token provided on update()/finish()
+        ASSERT_TRUE(timestamp_token_required_);
+
         secureclock::TimeStampToken time_token;
         EXPECT_EQ(ErrorCode::OK,
                   GetReturnErrorCode(clock_->generateTimeStamp(challenge_, &time_token)));
@@ -365,6 +365,9 @@
         string output;
         EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
                   Finish(message, {} /* signature */, &output, hat, time_token));
+    } else {
+        // The KeyMint implementation may have its own clock that can immediately detect timeout.
+        ASSERT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED, begin_result);
     }
 }
 
@@ -545,7 +548,7 @@
     ASSERT_GT(dodgy_hat->mac.size(), 0);
     dodgy_hat->mac[0] ^= 0x01;
     EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
-              Finish(message, {} /* signature */, &ciphertext, hat.value()));
+              Finish(message, {} /* signature */, &ciphertext, dodgy_hat.value()));
 }
 
 // Test use of a key that requires an auth token for each action on the operation, with
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 9f8593c..5f8ec0e 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -1300,15 +1300,12 @@
 }
 
 bool KeyMintAidlTestBase::IsRkpSupportRequired() const {
-    if (get_vsr_api_level() >= __ANDROID_API_T__) {
-        return true;
-    }
-
-    if (get_vsr_api_level() >= __ANDROID_API_S__) {
-        return SecLevel() != SecurityLevel::STRONGBOX;
-    }
-
-    return false;
+    // This is technically not a match to the requirements for S chipsets,
+    // however when S shipped there was a bug in the test that skipped the
+    // tests if KeyMint 2 was not on the system. So we allowed many chipests
+    // to ship without RKP support. In T we hardened the requirements around
+    // support for RKP, so relax the test to match.
+    return get_vsr_api_level() >= __ANDROID_API_T__;
 }
 
 vector<uint32_t> KeyMintAidlTestBase::ValidKeySizes(Algorithm algorithm) {
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 022dd3f..c2e52c7 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -2611,16 +2611,16 @@
 /*
  * NewKeyGenerationTest.EcdsaMissingCurve
  *
- * Verifies that EC key generation fails if EC_CURVE not specified after KeyMint V2.
+ * Verifies that EC key generation fails if EC_CURVE not specified after KeyMint V3.
  */
 TEST_P(NewKeyGenerationTest, EcdsaMissingCurve) {
-    if (AidlVersion() < 2) {
+    if (AidlVersion() < 3) {
         /*
          * The KeyMint V1 spec required that EC_CURVE be specified for EC keys.
          * However, this was not checked at the time so we can only be strict about checking this
-         * for implementations of KeyMint version 2 and above.
+         * for implementations of KeyMint version 3 and above.
          */
-        GTEST_SKIP() << "Requiring EC_CURVE only strict since KeyMint v2";
+        GTEST_SKIP() << "Requiring EC_CURVE only strict since KeyMint v3";
     }
     /* If EC_CURVE not provided, generateKey
      * must return ErrorCode::UNSUPPORTED_KEY_SIZE or ErrorCode::UNSUPPORTED_EC_CURVE.
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index c9c3e4d..780c3d2 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <iomanip>
 #include <iterator>
 #include <memory>
 #include <set>
@@ -420,6 +421,36 @@
     return entryName + " has an invalid value.\n";
 }
 
+std::string checkMapPatchLevelEntry(bool isFactory, const cppbor::Map& devInfo,
+                                    const std::string& entryName) {
+    std::string error = checkMapEntry(isFactory, devInfo, cppbor::UINT, entryName);
+    if (!error.empty()) {
+        return error;
+    }
+
+    if (isFactory) {
+        return "";
+    }
+
+    const std::unique_ptr<cppbor::Item>& val = devInfo.get(entryName);
+    std::string dateString = std::to_string(val->asUint()->unsignedValue());
+    if (dateString.size() == 6) {
+        dateString += "01";
+    }
+    if (dateString.size() != 8) {
+        return entryName + " should in the format YYYYMMDD or YYYYMM\n";
+    }
+
+    std::tm t;
+    std::istringstream ss(dateString);
+    ss >> std::get_time(&t, "%Y%m%d");
+    if (!ss) {
+        return entryName + " should in the format YYYYMMDD or YYYYMM\n";
+    }
+
+    return "";
+}
+
 bool isTeeDeviceInfo(const cppbor::Map& devInfo) {
     return devInfo.get("security_level") && devInfo.get("security_level")->asTstr() &&
            devInfo.get("security_level")->asTstr()->value() == "tee";
@@ -520,6 +551,10 @@
                     error += "Err: Unrecognized key entry: <" + key->asTstr()->value() + ">,\n";
                 }
             }
+            // Checks that only apply to v3.
+            error += checkMapPatchLevelEntry(isFactory, *parsed, "system_patch_level");
+            error += checkMapPatchLevelEntry(isFactory, *parsed, "boot_patch_level");
+            error += checkMapPatchLevelEntry(isFactory, *parsed, "vendor_patch_level");
             FALLTHROUGH_INTENDED;
         case 2:
             for (const auto& entry : kAttestationIdEntrySet) {
diff --git a/security/rkp/aidl/Android.bp b/security/rkp/aidl/Android.bp
index 5285477..0ebc3b7 100644
--- a/security/rkp/aidl/Android.bp
+++ b/security/rkp/aidl/Android.bp
@@ -28,6 +28,10 @@
         },
         rust: {
             enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.virt",
+            ],
         },
     },
     versions_with_info: [
diff --git a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
index 8456148..f668536 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfo.aidl
@@ -32,79 +32,9 @@
      * non-canonical to group similar entries semantically.
      *
      * The DeviceInfo has changed across versions 1, 2, and 3 of the HAL. All versions of the
-     * DeviceInfo CDDL are described as follows. Please refer to the CDDL structure version
-     * that corresponds to the HAL version you are working with:
+     * DeviceInfo CDDL are described in the DeviceInfoV*.cddl files. Please refer to the CDDL
+     * structure version that corresponds to the HAL version you are working with.
      *
-     * Version 3, introduced in Android 14:
-     *     DeviceInfo = {
-     *         "brand" : tstr,
-     *         "manufacturer" : tstr,
-     *         "product" : tstr,
-     *         "model" : tstr,
-     *         "device" : tstr,
-     *         "vb_state" : "green" / "yellow" / "orange",    ; Taken from the AVB values
-     *         "bootloader_state" : "locked" / "unlocked",    ; Taken from the AVB values
-     *         "vbmeta_digest": bstr,                         ; Taken from the AVB values
-     *         ? "os_version" : tstr,                         ; Same as
-     *                                                        ; android.os.Build.VERSION.release
-     *                                                        ; Not optional for TEE.
-     *         "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
-     *         "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
-     *         "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
-     *         "security_level" : "tee" / "strongbox",
-     *         "fused": 1 / 0,  ; 1 if secure boot is enforced for the processor that the IRPC
-     *                          ; implementation is contained in. 0 otherwise.
-     *     }
-     *
-     * ---------------------------------------------------------------------------------------------
-     *
-     * Version 2, introduced in Android 13:
-     *     DeviceInfo = {
-     *         "brand" : tstr,
-     *         "manufacturer" : tstr,
-     *         "product" : tstr,
-     *         "model" : tstr,
-     *         "device" : tstr,
-     *         "vb_state" : "green" / "yellow" / "orange",    ; Taken from the AVB values
-     *         "bootloader_state" : "locked" / "unlocked",    ; Taken from the AVB values
-     *         "vbmeta_digest": bstr,                         ; Taken from the AVB values
-     *         ? "os_version" : tstr,                         ; Same as
-     *                                                        ; android.os.Build.VERSION.release
-     *                                                        ; Not optional for TEE.
-     *         "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
-     *         "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
-     *         "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
-     *         "version" : 2,                                 ; The CDDL schema version.
-     *         "security_level" : "tee" / "strongbox",
-     *         "fused": 1 / 0,  ; 1 if secure boot is enforced for the processor that the IRPC
-     *                          ; implementation is contained in. 0 otherwise.
-     *
-     * ---------------------------------------------------------------------------------------------
-     *
-     * Version 1, introduced in Android 12:
-     *     DeviceInfo = {
-     *         ? "brand" : tstr,
-     *         ? "manufacturer" : tstr,
-     *         ? "product" : tstr,
-     *         ? "model" : tstr,
-     *         ? "board" : tstr,
-     *         ? "vb_state" : "green" / "yellow" / "orange",  ; Taken from the AVB values
-     *         ? "bootloader_state" : "locked" / "unlocked",  ; Taken from the AVB values
-     *         ? "vbmeta_digest": bstr,                       ; Taken from the AVB values
-     *         ? "os_version" : tstr,                         ; Same as
-     *                                                        ; android.os.Build.VERSION.release
-     *         ? "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
-     *         ? "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
-     *         ? "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
-     *         "version" : 1,                                 ; The CDDL schema version.
-     *         "security_level" : "tee" / "strongbox"
-     *         "att_id_state": "locked" / "open",  ; Attestation IDs State. If "locked", this
-     *                                             ; indicates a device's attestable IDs are
-     *                                             ; factory-locked and immutable. If "open",
-     *                                             ; this indicates the device is still in a
-     *                                             ; provisionable state and the attestable IDs
-     *                                             ; are not yet frozen.
-     *     }
      */
     byte[] deviceInfo;
 }
diff --git a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV1.cddl b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV1.cddl
new file mode 100644
index 0000000..056316b
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV1.cddl
@@ -0,0 +1,24 @@
+; Version 1, introduced in Android 12:
+DeviceInfo = {
+    ? "brand" : tstr,
+    ? "manufacturer" : tstr,
+    ? "product" : tstr,
+    ? "model" : tstr,
+    ? "board" : tstr,
+    ? "vb_state" : "green" / "yellow" / "orange",  ; Taken from the AVB values
+    ? "bootloader_state" : "locked" / "unlocked",  ; Taken from the AVB values
+    ? "vbmeta_digest": bstr,                       ; Taken from the AVB values
+    ? "os_version" : tstr,                         ; Same as
+                                                   ; android.os.Build.VERSION.release
+    ? "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
+    ? "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
+    ? "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
+    "version" : 1,                                 ; The CDDL schema version.
+    "security_level" : "tee" / "strongbox"
+    "att_id_state": "locked" / "open",  ; Attestation IDs State. If "locked", this
+                                        ; indicates a device's attestable IDs are
+                                        ; factory-locked and immutable. If "open",
+                                        ; this indicates the device is still in a
+                                        ; provisionable state and the attestable IDs
+                                        ; are not yet frozen.
+}
diff --git a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV2.cddl b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV2.cddl
new file mode 100644
index 0000000..e49471e
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV2.cddl
@@ -0,0 +1,21 @@
+; Version 2, introduced in Android 13:
+DeviceInfo = {
+    "brand" : tstr,
+    "manufacturer" : tstr,
+    "product" : tstr,
+    "model" : tstr,
+    "device" : tstr,
+    "vb_state" : "green" / "yellow" / "orange",    ; Taken from the AVB values
+    "bootloader_state" : "locked" / "unlocked",    ; Taken from the AVB values
+    "vbmeta_digest": bstr,                         ; Taken from the AVB values
+    ? "os_version" : tstr,                         ; Same as
+                                                   ; android.os.Build.VERSION.release
+                                                   ; Not optional for TEE.
+    "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
+    "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
+    "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
+    "version" : 2,                                 ; The CDDL schema version.
+    "security_level" : "tee" / "strongbox",
+    "fused": 1 / 0,  ; 1 if secure boot is enforced for the processor that the IRPC
+                     ; implementation is contained in. 0 otherwise.
+}
\ No newline at end of file
diff --git a/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV3.cddl b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV3.cddl
new file mode 100644
index 0000000..e841706
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/DeviceInfoV3.cddl
@@ -0,0 +1,20 @@
+; Version 3, introduced in Android 14:
+DeviceInfo = {
+    "brand" : tstr,
+    "manufacturer" : tstr,
+    "product" : tstr,
+    "model" : tstr,
+    "device" : tstr,
+    "vb_state" : "green" / "yellow" / "orange",    ; Taken from the AVB values
+    "bootloader_state" : "locked" / "unlocked",    ; Taken from the AVB values
+    "vbmeta_digest": bstr,                         ; Taken from the AVB values
+    ? "os_version" : tstr,                         ; Same as
+                                                   ; android.os.Build.VERSION.release
+                                                   ; Not optional for TEE.
+    "system_patch_level" : uint,     ; YYYYMM, must match KeyMint OS_PATCHLEVEL
+    "boot_patch_level" : uint,       ; YYYYMMDD, must match KeyMint BOOT_PATCHLEVEL
+    "vendor_patch_level" : uint,     ; YYYYMMDD, must match KeyMint VENDOR_PATCHLEVEL
+    "security_level" : "tee" / "strongbox",
+    "fused": 1 / 0,  ; 1 if secure boot is enforced for the processor that the IRPC
+                     ; implementation is contained in. 0 otherwise.
+}
diff --git a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index b231dae..21c5315 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -185,77 +185,7 @@
      *
      *        In either case, the root is self-signed.
      *
-     *            EekChain = [ + SignedSignatureKey, SignedEek ]
-     *
-     *            SignedSignatureKey = [              ; COSE_Sign1
-     *                protected: bstr .cbor {
-     *                    1 : AlgorithmEdDSA / AlgorithmES256,  ; Algorithm
-     *                },
-     *                unprotected: {},
-     *                payload: bstr .cbor SignatureKeyEd25519 /
-     *                         bstr .cbor SignatureKeyP256,
-     *                signature: bstr PureEd25519(.cbor SignatureKeySignatureInput) /
-     *                           bstr ECDSA(.cbor SignatureKeySignatureInput)
-     *            ]
-     *
-     *            SignatureKeyEd25519 = {             ; COSE_Key
-     *                 1 : 1,                         ; Key type : Octet Key Pair
-     *                 3 : AlgorithmEdDSA,            ; Algorithm
-     *                 -1 : 6,                        ; Curve : Ed25519
-     *                 -2 : bstr                      ; Ed25519 public key
-     *            }
-     *
-     *            SignatureKeyP256 = {                ; COSE_Key
-     *                 1 : 2,                         ; Key type : EC2
-     *                 3 : AlgorithmES256,            ; Algorithm
-     *                 -1 : 1,                        ; Curve: P256
-     *                 -2 : bstr,                     ; X coordinate
-     *                 -3 : bstr                      ; Y coordinate
-     *            }
-     *
-     *            SignatureKeySignatureInput = [
-     *                context: "Signature1",
-     *                body_protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
-     *                external_aad: bstr .size 0,
-     *                payload: bstr .cbor SignatureKeyEd25519 /
-     *                         bstr .cbor SignatureKeyP256
-     *            ]
-     *
-     *            ; COSE_Sign1
-     *            SignedEek = [
-     *                protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
-     *                unprotected: {},
-     *                payload: bstr .cbor EekX25519 / .cbor EekP256,
-     *                signature: bstr PureEd25519(.cbor EekSignatureInput) /
-     *                           bstr ECDSA(.cbor EekSignatureInput)
-     *            ]
-     *
-     *            EekX25519 = {            ; COSE_Key
-     *                1 : 1,               ; Key type : Octet Key Pair
-     *                2 : bstr             ; KID : EEK ID
-     *                3 : -25,             ; Algorithm : ECDH-ES + HKDF-256
-     *                -1 : 4,              ; Curve : X25519
-     *                -2 : bstr            ; X25519 public key, little-endian
-     *            }
-     *
-     *            EekP256 = {              ; COSE_Key
-     *                1 : 2,               ; Key type : EC2
-     *                2 : bstr             ; KID : EEK ID
-     *                3 : -25,             ; Algorithm : ECDH-ES + HKDF-256
-     *                -1 : 1,              ; Curve : P256
-     *                -2 : bstr            ; Sender X coordinate
-     *                -3 : bstr            ; Sender Y coordinate
-     *            }
-     *
-     *            EekSignatureInput = [
-     *                context: "Signature1",
-     *                body_protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
-     *                external_aad: bstr .size 0,
-     *                payload: bstr .cbor EekX25519 / .cbor EekP256
-     *            ]
-     *
-     *            AlgorithmES256 = -7      ; RFC 8152 section 8.1
-     *            AlgorithmEdDSA = -8      ; RFC 8152 section 8.2
+     *        See generateCertificateRequest.cddl for CDDL definitions.
      *
      *        If the contents of endpointEncryptionKey do not match the SignedEek structure above,
      *        the method must return STATUS_INVALID_EEK.
@@ -283,25 +213,9 @@
      *            HMAC-256(EK_mac, .cbor KeysToMacStructure)
      *
      *        Where EK_mac is an ephemeral MAC key, found in ProtectedData (see below).  The MACed
-     *        data is the "tag" field of a COSE_Mac0 structure like:
+     *        data is the "tag" field of a MacedKeys COSE_Mac0 structure.
      *
-     *            MacedKeys = [                            ; COSE_Mac0
-     *                protected : bstr .cbor {
-     *                    1 : 5,                           ; Algorithm : HMAC-256
-     *                },
-     *                unprotected : {},
-     *                ; Payload is PublicKeys from keysToSign argument, in provided order.
-     *                payload: bstr .cbor [ * PublicKey ],
-     *                tag: bstr
-     *            ]
-     *
-     *            KeysToMacStructure = [
-     *                context : "MAC0",
-     *                protected : bstr .cbor { 1 : 5 },    ; Algorithm : HMAC-256
-     *                external_aad : bstr .size 0,
-     *                ; Payload is PublicKeys from keysToSign argument, in provided order.
-     *                payload : bstr .cbor [ * PublicKey ]
-     *            ]
+     *        See generateCertificateRequest.cddl for CDDL definitions.
      */
     byte[] generateCertificateRequest(in boolean testMode, in MacedPublicKey[] keysToSign,
             in byte[] endpointEncryptionCertChain, in byte[] challenge, out DeviceInfo deviceInfo,
@@ -322,168 +236,9 @@
      *        use different semantic data for this field, but the supported sizes must be between 0
      *        and 64 bytes, inclusive.
      *
-     * @return the following CBOR Certificate Signing Request (Csr) serialized into a byte array:
+     * @return a CBOR Certificate Signing Request (Csr) serialized into a byte array.
      *
-     * Csr = AuthenticatedRequest<CsrPayload>
-     *
-     * CsrPayload = [                      ; CBOR Array defining the payload for Csr
-     *     version: 3,                     ; The CsrPayload CDDL Schema version.
-     *     CertificateType,                ; The type of certificate being requested.
-     *     DeviceInfo,                     ; Defined in DeviceInfo.aidl
-     *     KeysToSign,                     ; Provided by the method parameters
-     * ]
-     *
-     *  ; A tstr identifying the type of certificate. The set of supported certificate types may
-     *  ; be extended without requiring a version bump of the HAL. Custom certificate types may
-     *  ; be used, but the provisioning server may reject the request for an unknown certificate
-     *  ; type. The currently defined certificate types are:
-     *  ;  - "widevine"
-     *  ;  - "keymint"
-     *  CertificateType = tstr
-     *
-     * KeysToSign = [ * PublicKey ]   ; Please see MacedPublicKey.aidl for the PublicKey definition.
-     *
-     * AuthenticatedRequest<T> = [
-     *     version: 1,              ; The AuthenticatedRequest CDDL Schema version.
-     *     UdsCerts,
-     *     DiceCertChain,
-     *     SignedData<[
-     *         challenge: bstr .size (0..64), ; Provided by the method parameters
-     *         bstr .cbor T,
-     *     ]>,
-     * ]
-     *
-     * ; COSE_Sign1 (untagged)
-     * SignedData<Data> = [
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
-     *     unprotected: {},
-     *     payload: bstr .cbor Data / nil,
-     *     signature: bstr      ; PureEd25519(CDI_Leaf_Priv, SignedDataSigStruct<Data>) /
-     *                          ; ECDSA(CDI_Leaf_Priv, SignedDataSigStruct<Data>)
-     * ]
-     *
-     * ; Sig_structure for SignedData
-     * SignedDataSigStruct<Data> = [
-     *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
-     *     external_aad: bstr .size 0,
-     *     payload: bstr .cbor Data / nil,
-     * ]
-     *
-     * ; UdsCerts allows the platform to provide additional certifications for the UDS_Pub. For
-     * ; example, this could be provided by the hardware vendor, who certifies all of their chips.
-     * ; The SignerName is a free-form string describing who generated the signature. The root
-     * ; certificate will need to be communicated to the verifier out of band, along with the
-     * ; SignerName that is expected for the given root certificate.
-     * UdsCerts = {
-     *     * SignerName => UdsCertChain
-     * }
-     *
-     * ; SignerName is a string identifier that indicates both the signing authority as
-     * ; well as the format of the UdsCertChain
-     * SignerName = tstr
-     *
-     * UdsCertChain = [
-     *     2* X509Certificate       ; Root -> ... -> Leaf. "Root" is the vendor self-signed
-     *                              ; cert, "Leaf" contains UDS_Public. There may also be
-     *                              ; intermediate certificates between Root and Leaf.
-     * ]
-     *
-     * ; A bstr containing a DER-encoded X.509 certificate (RSA, NIST P-curve, or EdDSA)
-     * X509Certificate = bstr
-     *
-     * ; The DICE Chain contains measurements about the device firmware.
-     * ; The first entry in the DICE Chain is the UDS_Pub, encoded as a COSE_key. All entries
-     * ; after the first describe a link in the boot chain (e.g. bootloaders: BL1, BL2, ... BLN)
-     * ; Note that there is no DiceChainEntry for UDS_pub, only a "bare" COSE_key.
-     * DiceCertChain = [
-     *     PubKeyEd25519 / PubKeyECDSA256 / PubKeyECDSA384,  ; UDS_Pub
-     *     + DiceChainEntry,                ; First CDI_Certificate -> Last CDI_Certificate
-     *                                      ; Last certificate corresponds to KeyMint's DICE key.
-     * ]
-     *
-     * ; This is the signed payload for each entry in the DICE chain. Note that the "Configuration
-     * ; Input Values" described by the Open Profile are not used here. Instead, the DICE chain
-     * ; defines its own configuration values for the Configuration Descriptor field. See
-     * ; the Open Profile for DICE for more details on the fields. SHA256, SHA384 and SHA512 are
-     * ; acceptable hash algorithms. The digest bstr values in the payload are the digest values
-     * ; without any padding. Note that this implies that the digest is a 32-byte bstr for SHA256
-     * ; and a 48-byte bstr for SHA384. This is an intentional, minor deviation from Open Profile
-     * ; for DICE, which specifies all digests are 64 bytes.
-     * DiceChainEntryPayload = {                    ; CWT [RFC8392]
-     *     1 : tstr,                                ; Issuer
-     *     2 : tstr,                                ; Subject
-     *     -4670552 : bstr .cbor PubKeyEd25519 /
-     *                bstr .cbor PubKeyECDSA256,
-     *                bstr .cbor PubKeyECDSA384,    ; Subject Public Key
-     *     -4670553 : bstr                          ; Key Usage
-     *
-     *     ; NOTE: All of the following fields may be omitted for a "Degenerate DICE Chain", as
-     *     ;       described above.
-     *     -4670545 : bstr,                         ; Code Hash
-     *     ? -4670546 : bstr,                       ; Code Descriptor
-     *     -4670547 : bstr,                         ; Configuration Hash
-     *     -4670548 : bstr .cbor {                  ; Configuration Descriptor
-     *         ? -70002 : tstr,                         ; Component name
-     *         ? -70003 : int / tstr,                   ; Component version
-     *         ? -70004 : null,                         ; Resettable
-     *         ? -70005 : uint,                         ; Security version
-     *     },
-     *     -4670549 : bstr,                         ; Authority Hash
-     *     ? -4670550 : bstr,                       ; Authority Descriptor
-     *     -4670551 : bstr,                         ; Mode
-     * }
-     *
-     * ; Each entry in the DICE chain is a DiceChainEntryPayload signed by the key from the previous
-     * ; entry in the DICE chain array.
-     * DiceChainEntry = [                            ; COSE_Sign1 (untagged)
-     *     protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
-     *     unprotected: {},
-     *     payload: bstr .cbor DiceChainEntryPayload,
-     *     signature: bstr ; PureEd25519(SigningKey, DiceChainEntryInput) /
-     *                     ; ECDSA(SigningKey, DiceChainEntryInput)
-     *                     ; See RFC 8032 for details of how to encode the signature value
-     *                     ; for Ed25519.
-     * ]
-     *
-     * DiceChainEntryInput = [
-     *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
-     *     external_aad: bstr .size 0,
-     *     payload: bstr .cbor DiceChainEntryPayload
-     * ]
-     *
-     * ; The following section defines some types that are reused throughout the above
-     * ; data structures.
-     * ; NOTE: Integer encoding is different for Ed25519 and P256 keys:
-     * ;       - Ed25519 is LE: https://www.rfc-editor.org/rfc/rfc8032#section-3.1
-     * ;       - P256 is BE: https://www.secg.org/sec1-v2.pdf#page=19 (section 2.3.7)
-     * PubKeyEd25519 = {                ; COSE_Key
-     *     1 : 1,                       ; Key type : octet key pair
-     *     3 : AlgorithmEdDSA,          ; Algorithm : EdDSA
-     *     -1 : 6,                      ; Curve : Ed25519
-     *     -2 : bstr                    ; X coordinate, little-endian
-     * }
-     *
-     * PubKeyECDSA256 = {               ; COSE_Key
-     *     1 : 2,                       ; Key type : EC2
-     *     3 : AlgorithmES256,          ; Algorithm : ECDSA w/ SHA-256
-     *     -1 : 1,                      ; Curve: P256
-     *     -2 : bstr,                   ; X coordinate, big-endian
-     *     -3 : bstr                    ; Y coordinate, big-endian
-     * }
-     *
-     * PubKeyECDSA384 = {               ; COSE_Key
-     *     1 : 2,                       ; Key type : EC2
-     *     3 : AlgorithmES384,          ; Algorithm : ECDSA w/ SHA-384
-     *     -1 : 2,                      ; Curve: P384
-     *     -2 : bstr,                   ; X coordinate
-     *     -3 : bstr                    ; Y coordinate
-     * }
-     *
-     * AlgorithmES256 = -7
-     * AlgorithmES384 = -35
-     * AlgorithmEdDSA = -8
+     *         See generateCertificateRequestV2.cddl for CDDL definitions.
      */
     byte[] generateCertificateRequestV2(in MacedPublicKey[] keysToSign, in byte[] challenge);
 }
diff --git a/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.aidl b/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
index 1e41d1b..a290817 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
@@ -28,33 +28,8 @@
      * only to the secure environment, as proof that the public key was generated by that
      * environment. In CDDL, assuming the contained key is a P-256 public key:
      *
-     *     MacedPublicKey = [                     ; COSE_Mac0
-     *         protected: bstr .cbor { 1 : 5},    ; Algorithm : HMAC-256
-     *         unprotected: { },
-     *         payload : bstr .cbor PublicKey,
-     *         tag : bstr HMAC-256(K_mac, MAC_structure)
-     *     ]
+     * See MacedPublicKey.cddl for CDDL definition.
      *
-     *     ; NOTE: -70000 is deprecated for v3 HAL implementations.
-     *     ; NOTE: Integer encoding is different for Ed25519 and P256 keys:
-     *     ;       - Ed25519 is LE: https://www.rfc-editor.org/rfc/rfc8032#section-3.1
-     *     ;       - P256 is BE: https://www.secg.org/sec1-v2.pdf#page=19 (section 2.3.7)
-     *     PublicKey = {               ; COSE_Key
-     *         1 : 2,                  ; Key type : EC2
-     *         3 : -7,                 ; Algorithm : ES256
-     *         -1 : 1,                 ; Curve : P256
-     *         -2 : bstr,              ; X coordinate, big-endian
-     *         -3 : bstr,              ; Y coordinate, big-endian
-     *         -70000 : nil            ; Presence indicates this is a test key. If set, K_mac is
-     *                                 ; all zeros.
-     *     },
-     *
-     *     MAC_structure = [
-     *         context : "MAC0",
-     *         protected : bstr .cbor { 1 : 5 },
-     *         external_aad : bstr .size 0,
-     *         payload : bstr .cbor PublicKey
-     *     ]
      */
     byte[] macedKey;
 }
diff --git a/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.cddl b/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.cddl
new file mode 100644
index 0000000..6ae4be4
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/MacedPublicKey.cddl
@@ -0,0 +1,15 @@
+MacedPublicKey = [                     ; COSE_Mac0 [RFC9052 s6.2]
+    protected: bstr .cbor { 1 : 5},    ; Algorithm : HMAC-256
+    unprotected: { },
+    payload : bstr .cbor PublicKey,
+    tag : bstr ; HMAC-256(K_mac, MAC_structure)
+]
+
+MAC_structure = [                      ; [RFC9052 s6.3]
+    context : "MAC0",
+    protected : bstr .cbor { 1 : 5 },
+    external_aad : bstr .size 0,
+    payload : bstr .cbor PublicKey
+]
+
+; INCLUDE PublicKey.cddl for: PublicKey
diff --git a/security/rkp/aidl/android/hardware/security/keymint/PublicKey.cddl b/security/rkp/aidl/android/hardware/security/keymint/PublicKey.cddl
new file mode 100644
index 0000000..4c1050d
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/PublicKey.cddl
@@ -0,0 +1,13 @@
+; NOTE: -70000 is deprecated for v3 HAL implementations.
+; NOTE: Integer encoding is different for Ed25519 and P256 keys:
+;       - Ed25519 is LE: https://www.rfc-editor.org/rfc/rfc8032#section-3.1
+;       - P256 is BE: https://www.secg.org/sec1-v2.pdf#page=19 (section 2.3.7)
+PublicKey = {               ; COSE_Key [RFC9052 s7]
+    1 : 2,                  ; Key type : EC2
+    3 : -7,                 ; Algorithm : ES256
+    -1 : 1,                 ; Curve : P256
+    -2 : bstr,              ; X coordinate, big-endian
+    -3 : bstr,              ; Y coordinate, big-endian
+    ? -70000 : nil          ; Presence indicates this is a test key. If set, K_mac is
+                            ; all zeros.
+}
diff --git a/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequest.cddl b/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequest.cddl
new file mode 100644
index 0000000..fb11492
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequest.cddl
@@ -0,0 +1,93 @@
+; CDDL for the deprecated version 1 generateCertificateRequest method
+; in IRemotelyProvisionedComponent.aidl
+
+EekChain = [ + SignedSignatureKey, SignedEek ]
+
+SignedSignatureKey = [              ; COSE_Sign1 [RFC9052 s4.2]
+    protected: bstr .cbor {
+        1 : AlgorithmEdDSA / AlgorithmES256,  ; Algorithm
+    },
+    unprotected: {},
+    payload: bstr .cbor SignatureKeyEd25519 /
+                bstr .cbor SignatureKeyP256,
+    signature: bstr ; PureEd25519(.cbor SignatureKeySignatureInput) /
+                    ; ECDSA(.cbor SignatureKeySignatureInput)
+]
+
+SignatureKeyEd25519 = {             ; COSE_Key [RFC9052 s7]
+        1 : 1,                         ; Key type : Octet Key Pair
+        3 : AlgorithmEdDSA,            ; Algorithm
+        -1 : 6,                        ; Curve : Ed25519
+        -2 : bstr                      ; Ed25519 public key
+}
+
+SignatureKeyP256 = {                ; COSE_Key [RC9052 s7]
+        1 : 2,                         ; Key type : EC2
+        3 : AlgorithmES256,            ; Algorithm
+        -1 : 1,                        ; Curve: P256
+        -2 : bstr,                     ; X coordinate
+        -3 : bstr                      ; Y coordinate
+}
+
+SignatureKeySignatureInput = [
+    context: "Signature1",
+    body_protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+    external_aad: bstr .size 0,
+    payload: bstr .cbor SignatureKeyEd25519 /
+                bstr .cbor SignatureKeyP256
+]
+
+SignedEek = [                       ; COSE_Sign1 [RFC9052 s4.2]
+    protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+    unprotected: {},
+    payload: bstr .cbor EekX25519 / EekP256,
+    signature: bstr ; PureEd25519(.cbor EekSignatureInput) /
+                    ; ECDSA(.cbor EekSignatureInput)
+]
+
+EekX25519 = {            ; COSE_Key [RFC9052 s7]
+    1 : 1,               ; Key type : Octet Key Pair
+    2 : bstr             ; KID : EEK ID
+    3 : -25,             ; Algorithm : ECDH-ES + HKDF-256
+    -1 : 4,              ; Curve : X25519
+    -2 : bstr            ; X25519 public key, little-endian
+}
+
+EekP256 = {              ; COSE_Key [RFC9052 s7]
+    1 : 2,               ; Key type : EC2
+    2 : bstr             ; KID : EEK ID
+    3 : -25,             ; Algorithm : ECDH-ES + HKDF-256
+    -1 : 1,              ; Curve : P256
+    -2 : bstr            ; Sender X coordinate
+    -3 : bstr            ; Sender Y coordinate
+}
+
+EekSignatureInput = [
+    context: "Signature1",
+    body_protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+    external_aad: bstr .size 0,
+    payload: bstr .cbor EekX25519 / EekP256
+]
+
+AlgorithmES256 = -7      ; [RFC8152 s8.1]
+AlgorithmEdDSA = -8      ; [RFC8152 s8.2]
+
+MacedKeys = [                            ; COSE_Mac0 [RFC9052 s6.2]
+    protected : bstr .cbor {
+        1 : 5,                           ; Algorithm : HMAC-256
+    },
+    unprotected : {},
+    ; Payload is PublicKeys from keysToSign argument, in provided order.
+    payload: bstr .cbor [ * PublicKey ],
+    tag: bstr
+]
+
+KeysToMacStructure = [                   ; [RFC9052 s6.3]
+    context : "MAC0",
+    protected : bstr .cbor { 1 : 5 },    ; Algorithm : HMAC-256
+    external_aad : bstr .size 0,
+    ; Payload is PublicKeys from keysToSign argument, in provided order.
+    payload : bstr .cbor [ * PublicKey ]
+]
+
+; INCLUDE PublicKey.cddl for: PublicKey
diff --git a/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequestV2.cddl b/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequestV2.cddl
new file mode 100644
index 0000000..80f7cbd
--- /dev/null
+++ b/security/rkp/aidl/android/hardware/security/keymint/generateCertificateRequestV2.cddl
@@ -0,0 +1,166 @@
+; CDDL for the generateCertificateRequestV2 method in
+; IRemotelyProvisionedComponent.aidl
+
+Csr = AuthenticatedRequest<CsrPayload>
+
+CsrPayload = [                      ; CBOR Array defining the payload for Csr
+    version: 3,                     ; The CsrPayload CDDL Schema version.
+    CertificateType,                ; The type of certificate being requested.
+    DeviceInfo,                     ; Defined in the relevant DeviceInfoV*.cddl file.
+    KeysToSign,                     ; Provided by the method parameters
+]
+
+; A tstr identifying the type of certificate. The set of supported certificate types may
+; be extended without requiring a version bump of the HAL. Custom certificate types may
+; be used, but the provisioning server may reject the request for an unknown certificate
+; type. The currently defined certificate types are:
+;  - "widevine"
+;  - "keymint"
+CertificateType = tstr
+
+KeysToSign = [ * PublicKey ]   ; Please see PublicKey.cddl for the PublicKey definition.
+
+AuthenticatedRequest<T> = [
+    version: 1,              ; The AuthenticatedRequest CDDL Schema version.
+    UdsCerts,
+    DiceCertChain,
+    SignedData<[
+        challenge: bstr .size (0..64), ; Provided by the method parameters
+        bstr .cbor T,
+    ]>,
+]
+
+; COSE_Sign1 (untagged) [RFC9052 s4.2]
+SignedData<Data> = [
+    protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
+    unprotected: {},
+    payload: bstr .cbor Data / nil,
+    signature: bstr     ; PureEd25519(CDI_Leaf_Priv, SignedDataSigStruct<Data>) /
+                        ; ECDSA(CDI_Leaf_Priv, SignedDataSigStruct<Data>)
+]
+
+; Sig_structure for SignedData [ RFC9052 s4.4]
+SignedDataSigStruct<Data> = [
+    context: "Signature1",
+    protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
+    external_aad: bstr .size 0,
+    payload: bstr .cbor Data / nil,
+]
+
+; UdsCerts allows the platform to provide additional certifications for the UDS_Pub. For
+; example, this could be provided by the hardware vendor, who certifies all of their chips.
+; The SignerName is a free-form string describing who generated the signature. The root
+; certificate will need to be communicated to the verifier out of band, along with the
+; SignerName that is expected for the given root certificate.
+UdsCerts = {
+    * SignerName => UdsCertChain
+}
+
+; SignerName is a string identifier that indicates both the signing authority as
+; well as the format of the UdsCertChain
+SignerName = tstr
+
+UdsCertChain = [
+    2* X509Certificate      ; Root -> ... -> Leaf. "Root" is the vendor self-signed
+                            ; cert, "Leaf" contains UDS_Public. There may also be
+                            ; intermediate certificates between Root and Leaf.
+]
+
+; A bstr containing a DER-encoded X.509 certificate (RSA, NIST P-curve, or EdDSA)
+X509Certificate = bstr
+
+; The DICE Chain contains measurements about the device firmware.
+; The first entry in the DICE Chain is the UDS_Pub, encoded as a COSE_key. All entries
+; after the first describe a link in the boot chain (e.g. bootloaders: BL1, BL2, ... BLN)
+; Note that there is no DiceChainEntry for UDS_pub, only a "bare" COSE_key.
+DiceCertChain = [
+    PubKeyEd25519 / PubKeyECDSA256 / PubKeyECDSA384,  ; UDS_Pub
+    + DiceChainEntry,               ; First CDI_Certificate -> Last CDI_Certificate
+                                    ; Last certificate corresponds to KeyMint's DICE key.
+]
+
+; This is the signed payload for each entry in the DICE chain. Note that the "Configuration
+; Input Values" described by the Open Profile are not used here. Instead, the DICE chain
+; defines its own configuration values for the Configuration Descriptor field. See
+; the Open Profile for DICE for more details on the fields. SHA256, SHA384 and SHA512 are
+; acceptable hash algorithms. The digest bstr values in the payload are the digest values
+; without any padding. Note that this implies that the digest is a 32-byte bstr for SHA256
+; and a 48-byte bstr for SHA384. This is an intentional, minor deviation from Open Profile
+; for DICE, which specifies all digests are 64 bytes.
+DiceChainEntryPayload = {                    ; CWT [RFC8392]
+    1 : tstr,                                ; Issuer
+    2 : tstr,                                ; Subject
+    -4670552 : bstr .cbor PubKeyEd25519 /
+            bstr .cbor PubKeyECDSA256 /
+            bstr .cbor PubKeyECDSA384,    ; Subject Public Key
+    -4670553 : bstr                          ; Key Usage
+
+    ; NOTE: All of the following fields may be omitted for a "Degenerate DICE Chain", as
+    ;       described above.
+    -4670545 : bstr,                         ; Code Hash
+    ? -4670546 : bstr,                       ; Code Descriptor
+    -4670547 : bstr,                         ; Configuration Hash
+    -4670548 : bstr .cbor {                  ; Configuration Descriptor
+        ? -70002 : tstr,                         ; Component name
+        ? -70003 : int / tstr,                   ; Component version
+        ? -70004 : null,                         ; Resettable
+        ? -70005 : uint,                         ; Security version
+    },
+    -4670549 : bstr,                         ; Authority Hash
+    ? -4670550 : bstr,                       ; Authority Descriptor
+    -4670551 : bstr,                         ; Mode
+}
+
+; Each entry in the DICE chain is a DiceChainEntryPayload signed by the key from the previous
+; entry in the DICE chain array.
+DiceChainEntry = [                            ; COSE_Sign1 (untagged), [RFC9052 s4.2]
+    protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
+    unprotected: {},
+    payload: bstr .cbor DiceChainEntryPayload,
+    signature: bstr ; PureEd25519(SigningKey, DiceChainEntryInput) /
+                    ; ECDSA(SigningKey, DiceChainEntryInput)
+                    ; See RFC 8032 for details of how to encode the signature value
+                    ; for Ed25519.
+]
+
+DiceChainEntryInput = [
+    context: "Signature1",
+    protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
+    external_aad: bstr .size 0,
+    payload: bstr .cbor DiceChainEntryPayload
+]
+
+; The following section defines some types that are reused throughout the above
+; data structures.
+; NOTE: Integer encoding is different for Ed25519 and P256 keys:
+;       - Ed25519 is LE: https://www.rfc-editor.org/rfc/rfc8032#section-3.1
+;       - P256 is BE: https://www.secg.org/sec1-v2.pdf#page=19 (section 2.3.7)
+PubKeyEd25519 = {                ; COSE_Key [RFC9052 s7]
+    1 : 1,                       ; Key type : octet key pair
+    3 : AlgorithmEdDSA,          ; Algorithm : EdDSA
+    -1 : 6,                      ; Curve : Ed25519
+    -2 : bstr                    ; X coordinate, little-endian
+}
+
+PubKeyECDSA256 = {               ; COSE_Key [RFC9052 s7]
+    1 : 2,                       ; Key type : EC2
+    3 : AlgorithmES256,          ; Algorithm : ECDSA w/ SHA-256
+    -1 : 1,                      ; Curve: P256
+    -2 : bstr,                   ; X coordinate, big-endian
+    -3 : bstr                    ; Y coordinate, big-endian
+}
+
+PubKeyECDSA384 = {               ; COSE_Key [RFC9052 s7]
+    1 : 2,                       ; Key type : EC2
+    3 : AlgorithmES384,          ; Algorithm : ECDSA w/ SHA-384
+    -1 : 2,                      ; Curve: P384
+    -2 : bstr,                   ; X coordinate, big-endian
+    -3 : bstr                    ; Y coordinate, big-endian
+}
+
+AlgorithmES256 = -7              ; [RFC9053 s2.1]
+AlgorithmES384 = -35             ; [RFC9053 s2.1]
+AlgorithmEdDSA = -8              ; [RFC9053 s2.2]
+
+; INCLUDE PublicKey.cddl for: PublicKey
+; INCLUDE DeviceInfoV3.cddl for: DeviceInfo
diff --git a/soundtrigger/2.0/default/OWNERS b/soundtrigger/2.0/default/OWNERS
deleted file mode 100644
index ed739cf..0000000
--- a/soundtrigger/2.0/default/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-elaurent@google.com
-mnaganov@google.com
-ytai@google.com
diff --git a/soundtrigger/2.0/vts/functional/OWNERS b/soundtrigger/2.0/vts/functional/OWNERS
deleted file mode 100644
index 3c24468..0000000
--- a/soundtrigger/2.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 48436
-elaurent@google.com
-mdooley@google.com
-ytai@google.com
diff --git a/soundtrigger/2.1/vts/functional/OWNERS b/soundtrigger/2.1/vts/functional/OWNERS
deleted file mode 100644
index 3c24468..0000000
--- a/soundtrigger/2.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 48436
-elaurent@google.com
-mdooley@google.com
-ytai@google.com
diff --git a/soundtrigger/2.2/vts/functional/OWNERS b/soundtrigger/2.2/vts/functional/OWNERS
deleted file mode 100644
index 43126f6..0000000
--- a/soundtrigger/2.2/vts/functional/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-# Bug component: 48436
-ytai@google.com
-mdooley@google.com
diff --git a/soundtrigger/2.3/cli/OWNERS b/soundtrigger/2.3/cli/OWNERS
deleted file mode 100644
index 4fd27f3..0000000
--- a/soundtrigger/2.3/cli/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/base:/services/core/java/com/android/server/soundtrigger_middleware/OWNERS
diff --git a/soundtrigger/2.3/vts/functional/OWNERS b/soundtrigger/2.3/vts/functional/OWNERS
deleted file mode 100644
index 3c24468..0000000
--- a/soundtrigger/2.3/vts/functional/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bug component: 48436
-elaurent@google.com
-mdooley@google.com
-ytai@google.com
diff --git a/soundtrigger/OWNERS b/soundtrigger/OWNERS
new file mode 100644
index 0000000..3b35d27
--- /dev/null
+++ b/soundtrigger/OWNERS
@@ -0,0 +1,8 @@
+# Bug component: 48436
+
+include platform/frameworks/base:/media/aidl/android/media/soundtrigger_middleware/OWNERS
+include platform/frameworks/base:/services/core/java/com/android/server/soundtrigger_middleware/OWNERS
+
+elaurent@google.com
+mdooley@google.com
+mnaganov@google.com
diff --git a/soundtrigger/aidl/cli/OWNERS b/soundtrigger/aidl/cli/OWNERS
deleted file mode 100644
index 9f87c4c..0000000
--- a/soundtrigger/aidl/cli/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/base:/media/aidl/android/media/soundtrigger_middleware/OWNERS
diff --git a/staging/OWNERS b/staging/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/staging/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/tests/OWNERS b/tests/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/tests/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/tetheroffload/OWNERS b/tetheroffload/OWNERS
new file mode 100644
index 0000000..e033269
--- /dev/null
+++ b/tetheroffload/OWNERS
@@ -0,0 +1,5 @@
+# Bug component: 261923493
+
+include platform/packages/modules/Connectivity:/Tethering/OWNERS
+
+kenghua@google.com
diff --git a/tetheroffload/aidl/default/Android.bp b/tetheroffload/aidl/default/Android.bp
index 8f0739c..8c96990 100644
--- a/tetheroffload/aidl/default/Android.bp
+++ b/tetheroffload/aidl/default/Android.bp
@@ -19,18 +19,52 @@
 cc_binary {
     name: "android.hardware.tetheroffload-service.example",
     relative_install_path: "hw",
-    init_rc: ["tetheroffload-example.rc"],
-    vintf_fragments: ["tetheroffload-example.xml"],
     vendor: true,
-    shared_libs: [
+
+    stl: "c++_static",
+    static_libs: [
         "android.hardware.tetheroffload-V1-ndk",
         "libbase",
+    ],
+    shared_libs: [
         "libbinder_ndk",
-        "libcutils",
-        "libutils",
+        "liblog",
     ],
     srcs: [
         "main.cpp",
         "Offload.cpp",
     ],
+
+    installable: false, // installed in APEX
+}
+
+prebuilt_etc {
+    name: "tetheroffload-example.rc",
+    src: "tetheroffload-example.rc",
+    installable: false,
+}
+
+prebuilt_etc {
+    name: "tetheroffload-example.xml",
+    src: "tetheroffload-example.xml",
+    sub_dir: "vintf",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.tetheroffload",
+    manifest: "apex_manifest.json",
+    file_contexts: "apex_file_contexts",
+    key: "com.android.hardware.key",
+    certificate: ":com.android.hardware.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.tetheroffload-service.example",
+    ],
+    prebuilts: [
+        "tetheroffload-example.rc",
+        "tetheroffload-example.xml",
+    ],
 }
diff --git a/tetheroffload/aidl/default/apex_file_contexts b/tetheroffload/aidl/default/apex_file_contexts
new file mode 100644
index 0000000..a520101
--- /dev/null
+++ b/tetheroffload/aidl/default/apex_file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                                                          u:object_r:vendor_file:s0
+/etc(/.*)?                                                      u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.tetheroffload-service\.example       u:object_r:hal_tetheroffload_default_exec:s0
diff --git a/tetheroffload/aidl/default/apex_manifest.json b/tetheroffload/aidl/default/apex_manifest.json
new file mode 100644
index 0000000..4c90889
--- /dev/null
+++ b/tetheroffload/aidl/default/apex_manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.tetheroffload",
+    "version": 1
+}
diff --git a/tetheroffload/aidl/default/tetheroffload-example.rc b/tetheroffload/aidl/default/tetheroffload-example.rc
index 46cda61..b95544b 100644
--- a/tetheroffload/aidl/default/tetheroffload-example.rc
+++ b/tetheroffload/aidl/default/tetheroffload-example.rc
@@ -1,4 +1,4 @@
-service vendor.tetheroffload-example /vendor/bin/hw/android.hardware.tetheroffload-service.example
+service vendor.tetheroffload-example /apex/com.android.hardware.tetheroffload/bin/hw/android.hardware.tetheroffload-service.example
     class hal
     user nobody
     group nobody
diff --git a/thermal/aidl/default/Android.bp b/thermal/aidl/default/Android.bp
index 49a578b..451e1e2 100644
--- a/thermal/aidl/default/Android.bp
+++ b/thermal/aidl/default/Android.bp
@@ -24,26 +24,50 @@
 cc_binary {
     name: "android.hardware.thermal-service.example",
     relative_install_path: "hw",
-    init_rc: [":android.hardware.thermal.example.rc"],
-    vintf_fragments: [":android.hardware.thermal.example.xml"],
     vendor: true,
-    shared_libs: [
-        "libbase",
-        "libbinder_ndk",
+    stl: "c++_static",
+    static_libs: [
         "android.hardware.thermal-V1-ndk",
+        "libbase",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+        "liblog",
     ],
     srcs: [
         "main.cpp",
         "Thermal.cpp",
     ],
+    installable: false,
 }
 
-filegroup {
+prebuilt_etc {
     name: "android.hardware.thermal.example.xml",
-    srcs: ["thermal-example.xml"],
+    src: "thermal-example.xml",
+    sub_dir: "vintf",
+    installable: false,
 }
 
-filegroup {
+prebuilt_etc {
     name: "android.hardware.thermal.example.rc",
-    srcs: ["thermal-example.rc"],
+    src: "thermal-example.rc",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.thermal",
+    manifest: "apex_manifest.json",
+    file_contexts: "apex_file_contexts",
+    key: "com.android.hardware.key",
+    certificate: ":com.android.hardware.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.thermal-service.example",
+    ],
+    prebuilts: [
+        "android.hardware.thermal.example.xml",
+        "android.hardware.thermal.example.rc",
+    ],
 }
diff --git a/thermal/aidl/default/apex_file_contexts b/thermal/aidl/default/apex_file_contexts
new file mode 100644
index 0000000..9fa5339
--- /dev/null
+++ b/thermal/aidl/default/apex_file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                                                          u:object_r:vendor_file:s0
+/etc(/.*)?                                                      u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.thermal-service\.example             u:object_r:hal_thermal_default_exec:s0
diff --git a/thermal/aidl/default/apex_manifest.json b/thermal/aidl/default/apex_manifest.json
new file mode 100644
index 0000000..80420d5
--- /dev/null
+++ b/thermal/aidl/default/apex_manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.thermal",
+    "version": 1
+}
diff --git a/thermal/aidl/default/thermal-example.rc b/thermal/aidl/default/thermal-example.rc
index 591ca03..36dde0d 100644
--- a/thermal/aidl/default/thermal-example.rc
+++ b/thermal/aidl/default/thermal-example.rc
@@ -1,4 +1,4 @@
-service vendor.thermal-example /vendor/bin/hw/android.hardware.thermal-service.example
+service vendor.thermal-example /apex/com.android.hardware.thermal/bin/hw/android.hardware.thermal-service.example
     class hal
     user nobody
     group system
diff --git a/threadnetwork/aidl/Android.bp b/threadnetwork/aidl/Android.bp
index 480ac0f..c621b81 100644
--- a/threadnetwork/aidl/Android.bp
+++ b/threadnetwork/aidl/Android.bp
@@ -14,9 +14,12 @@
         ndk: {
             apex_available: [
                 "//apex_available:platform",
+                "com.android.tethering",
+                // Keep the threadnetwork apex to make it buildable on udc-mainline-prod.
+                // TODO: remove it after moving ot-daemon into tethering.
                 "com.android.threadnetwork",
             ],
-            min_sdk_version: "33",
+            min_sdk_version: "30",
         },
     },
 }
diff --git a/threadnetwork/aidl/default/Android.bp b/threadnetwork/aidl/default/Android.bp
index bcd5704..816f892 100644
--- a/threadnetwork/aidl/default/Android.bp
+++ b/threadnetwork/aidl/default/Android.bp
@@ -9,22 +9,21 @@
 //  in whole or in part, without the express written permission of
 //  Google LLC.
 
-cc_defaults {
-    name: "threadnetwork_service_default",
-    vintf_fragments: ["threadnetwork-default.xml"],
+cc_binary {
+    name: "android.hardware.threadnetwork-service",
     vendor: true,
     relative_install_path: "hw",
 
     shared_libs: [
-        "android.hardware.threadnetwork-V1-ndk",
-        "libbase",
         "libbinder_ndk",
-        "libcutils",
         "liblog",
-        "libutils",
     ],
 
     static_libs: [
+        "android.hardware.threadnetwork-V1-ndk",
+        "libbase",
+        "libcutils",
+        "libutils",
         "openthread-common",
         "openthread-hdlc",
         "openthread-platform",
@@ -33,6 +32,8 @@
         "openthread-url",
     ],
 
+    stl: "c++_static",
+
     srcs: [
         "main.cpp",
         "service.cpp",
@@ -41,22 +42,10 @@
     ],
 }
 
-cc_binary {
-    name: "android.hardware.threadnetwork-service.sim",
-    defaults: ["threadnetwork_service_default"],
-    init_rc: ["android.hardware.threadnetwork-service.sim.rc"],
-    required: ["ot-rcp"],
-}
-
-cc_binary {
-    name: "android.hardware.threadnetwork-service",
-    defaults: ["threadnetwork_service_default"],
-}
-
 cc_fuzz {
     name: "android.hardware.threadnetwork-service.fuzzer",
 
-    defaults:["service_fuzzer_defaults"],
+    defaults: ["service_fuzzer_defaults"],
     shared_libs: [
         "libbinder_ndk",
     ],
@@ -85,3 +74,37 @@
         ],
     },
 }
+
+prebuilt_etc {
+    name: "threadnetwork-default.xml",
+    src: "threadnetwork-default.xml",
+    sub_dir: "vintf",
+    installable: false,
+}
+
+prebuilt_etc {
+    name: "threadnetwork-service.rc",
+    src: "threadnetwork-service.rc",
+    installable: false,
+}
+
+apex {
+    name: "com.android.hardware.threadnetwork",
+    manifest: "manifest.json",
+    file_contexts: "file_contexts",
+    key: "com.android.hardware.key",
+    certificate: ":com.android.hardware.certificate",
+    updatable: false,
+    vendor: true,
+
+    binaries: [
+        "android.hardware.threadnetwork-service",
+        "ot-rcp",
+    ],
+
+    prebuilts: [
+        "threadnetwork-default.xml", // vintf_fragment
+        "threadnetwork-service.rc", // init_rc
+        "android.hardware.thread_network.prebuilt.xml", // permission
+    ],
+}
diff --git a/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc b/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc
deleted file mode 100644
index 2fb409c..0000000
--- a/threadnetwork/aidl/default/android.hardware.threadnetwork-service.sim.rc
+++ /dev/null
@@ -1,3 +0,0 @@
-service vendor.threadnetwork_hal /vendor/bin/hw/android.hardware.threadnetwork-service.sim spinel+hdlc+forkpty:///vendor/bin/ot-rcp?forkpty-arg=1
-    class hal
-    user thread_network
diff --git a/threadnetwork/aidl/default/file_contexts b/threadnetwork/aidl/default/file_contexts
new file mode 100644
index 0000000..39ba3b5
--- /dev/null
+++ b/threadnetwork/aidl/default/file_contexts
@@ -0,0 +1,4 @@
+(/.*)?                                                      u:object_r:vendor_file:s0
+/etc(/.*)?                                                  u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.threadnetwork-service            u:object_r:hal_threadnetwork_default_exec:s0
+/bin/ot-rcp                                                 u:object_r:ot_rcp_exec:s0
diff --git a/threadnetwork/aidl/default/manifest.json b/threadnetwork/aidl/default/manifest.json
new file mode 100644
index 0000000..61e6dc1
--- /dev/null
+++ b/threadnetwork/aidl/default/manifest.json
@@ -0,0 +1,4 @@
+{
+    "name": "com.android.hardware.threadnetwork",
+    "version": 1
+}
diff --git a/threadnetwork/aidl/default/threadnetwork-service.rc b/threadnetwork/aidl/default/threadnetwork-service.rc
new file mode 100644
index 0000000..3b889eb
--- /dev/null
+++ b/threadnetwork/aidl/default/threadnetwork-service.rc
@@ -0,0 +1,3 @@
+service vendor.threadnetwork_hal /apex/com.android.hardware.threadnetwork/bin/hw/android.hardware.threadnetwork-service spinel+hdlc+forkpty:///apex/com.android.hardware.threadnetwork/bin/ot-rcp?forkpty-arg=1
+    class hal
+    user thread_network
diff --git a/tv/OWNERS b/tv/OWNERS
new file mode 100644
index 0000000..ee7f272
--- /dev/null
+++ b/tv/OWNERS
@@ -0,0 +1,12 @@
+# TV tuner
+# Bug component: 136752
+# TV input
+# Bug component: 826094
+
+include platform/frameworks/base:/core/java/android/hardware/hdmi/OWNERS
+
+hgchen@google.com
+quxiangfang@google.com
+shubang@google.com
+yixiaoluo@google.com
+
diff --git a/tv/cec/1.0/default/OWNERS b/tv/cec/1.0/default/OWNERS
deleted file mode 100644
index c1d3f1d..0000000
--- a/tv/cec/1.0/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/base:/core/java/android/hardware/hdmi/OWNERS
diff --git a/tv/cec/OWNERS b/tv/cec/OWNERS
deleted file mode 100644
index 71e74c0..0000000
--- a/tv/cec/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 826094
-include platform/frameworks/base:/core/java/android/hardware/hdmi/OWNERS
diff --git a/tv/hdmi/OWNERS b/tv/hdmi/OWNERS
deleted file mode 100644
index d9c6783..0000000
--- a/tv/hdmi/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 826094
-include platform/frameworks/base:/core/java/android/hardware/hdmi/OWNERS
\ No newline at end of file
diff --git a/tv/input/OWNERS b/tv/input/OWNERS
deleted file mode 100644
index a02291a..0000000
--- a/tv/input/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-hgchen@google.com
-shubang@google.com
-quxiangfang@google.com
-yixiaoluo@google.com
diff --git a/tv/tuner/1.0/default/OWNERS b/tv/tuner/1.0/default/OWNERS
deleted file mode 100644
index 1b3d095..0000000
--- a/tv/tuner/1.0/default/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-nchalko@google.com
-amyjojo@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/1.0/vts/OWNERS b/tv/tuner/1.0/vts/OWNERS
deleted file mode 100644
index 9bdafca..0000000
--- a/tv/tuner/1.0/vts/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Bug component: 136752
-nchalko@google.com
-amyjojo@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/1.1/default/OWNERS b/tv/tuner/1.1/default/OWNERS
deleted file mode 100644
index 1b3d095..0000000
--- a/tv/tuner/1.1/default/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-nchalko@google.com
-amyjojo@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/1.1/vts/OWNERS b/tv/tuner/1.1/vts/OWNERS
deleted file mode 100644
index 9bdafca..0000000
--- a/tv/tuner/1.1/vts/OWNERS
+++ /dev/null
@@ -1,5 +0,0 @@
-# Bug component: 136752
-nchalko@google.com
-amyjojo@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/aidl/default/OWNERS b/tv/tuner/aidl/default/OWNERS
deleted file mode 100644
index bf2b609..0000000
--- a/tv/tuner/aidl/default/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-hgchen@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/aidl/vts/OWNERS b/tv/tuner/aidl/vts/OWNERS
deleted file mode 100644
index bf2b609..0000000
--- a/tv/tuner/aidl/vts/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-hgchen@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/tv/tuner/aidl/vts/functional/Android.bp b/tv/tuner/aidl/vts/functional/Android.bp
index e5fb1e6..5f04293 100644
--- a/tv/tuner/aidl/vts/functional/Android.bp
+++ b/tv/tuner/aidl/vts/functional/Android.bp
@@ -51,6 +51,7 @@
         "android.hardware.cas@1.0",
         "android.hardware.cas@1.1",
         "android.hardware.cas@1.2",
+        "android.hardware.cas-V1-ndk",
         "android.hardware.common-V2-ndk",
         "android.hardware.common.fmq-V1-ndk",
         "android.hardware.tv.tuner-V1-ndk",
diff --git a/tv/tuner/aidl/vts/functional/DescramblerTests.cpp b/tv/tuner/aidl/vts/functional/DescramblerTests.cpp
index 157fa04..f4855c2 100644
--- a/tv/tuner/aidl/vts/functional/DescramblerTests.cpp
+++ b/tv/tuner/aidl/vts/functional/DescramblerTests.cpp
@@ -19,71 +19,115 @@
 using namespace std;
 
 AssertionResult DescramblerTests::createCasPlugin(int32_t caSystemId) {
-    auto status = mMediaCasService->isSystemIdSupported(caSystemId);
-    if (!status.isOk() || !status) {
-        ALOGW("[vts] Failed to check isSystemIdSupported.");
-        return failure();
+    mCasListener = ::ndk::SharedRefBase::make<MediaCasListener>();
+
+    if (mMediaCasServiceAidl != nullptr) {
+        bool rst = false;
+        ScopedAStatus status = mMediaCasServiceAidl->isSystemIdSupported(caSystemId, &rst);
+        if (!status.isOk() || !rst) {
+            ALOGW("[vts] Failed to check isSystemIdSupported for AIDL service.");
+            return failure();
+        }
+        status = mMediaCasServiceAidl->createPlugin(caSystemId, mCasListener, &mCasAidl);
+        if (!status.isOk()) {
+            ALOGW("[vts] Failed to createPlugin for AIDL service.");
+            return failure();
+        }
+    } else {
+        auto status = mMediaCasServiceHidl->isSystemIdSupported(caSystemId);
+        if (!status.isOk() || !status) {
+            ALOGW("[vts] Failed to check isSystemIdSupported for HIDL service.");
+            return failure();
+        }
+        auto pluginStatus = mMediaCasServiceHidl->createPluginExt(
+                caSystemId, sp<ICasListenerHidl>(mCasListener.get()));
+        if (!pluginStatus.isOk()) {
+            ALOGW("[vts] Failed to createPluginExt for HIDL service.");
+            return failure();
+        }
+        mCasHidl = ICasHidl::castFrom(pluginStatus);
+        if (mCasHidl == nullptr) {
+            ALOGW("[vts] Failed to get ICas for HIDL service.");
+            return failure();
+        }
     }
 
-    mCasListener = new MediaCasListener();
-    auto pluginStatus = mMediaCasService->createPluginExt(caSystemId, mCasListener);
-    if (!pluginStatus.isOk()) {
-        ALOGW("[vts] Failed to createPluginExt.");
-        return failure();
-    }
-    mCas = ICas::castFrom(pluginStatus);
-    if (mCas == nullptr) {
-        ALOGW("[vts] Failed to get ICas.");
-        return failure();
-    }
     return success();
 }
 
 AssertionResult DescramblerTests::openCasSession(vector<uint8_t>& sessionId,
-                                                 vector<uint8_t>& hidlPvtData) {
-    Status sessionStatus;
-    SessionIntent intent = SessionIntent::LIVE;
-    ScramblingMode mode = ScramblingMode::RESERVED;
-    auto returnVoid =
-            mCas->openSession_1_2(intent, mode, [&](Status status, const hidl_vec<uint8_t>& id) {
-                sessionStatus = status;
-                sessionId = id;
-            });
-    if (!returnVoid.isOk() || (sessionStatus != Status::OK)) {
-        ALOGW("[vts] Failed to open cas session.");
-        mCas->closeSession(sessionId);
-        return failure();
-    }
-
-    if (hidlPvtData.size() > 0) {
-        auto status = mCas->setSessionPrivateData(sessionId, hidlPvtData);
-        if (status != android::hardware::cas::V1_0::Status::OK) {
-            ALOGW("[vts] Failed to set session private data");
-            mCas->closeSession(sessionId);
+                                                 vector<uint8_t>& pvtData) {
+    if (mMediaCasServiceAidl != nullptr) {
+        SessionIntentAidl intent = SessionIntentAidl::LIVE;
+        ScramblingModeAidl mode = ScramblingModeAidl::RESERVED;
+        std::vector<uint8_t> sessionId;
+        ScopedAStatus status = mCasAidl->openSession(intent, mode, &sessionId);
+        if (!status.isOk()) {
+            ALOGW("[vts] Failed to open cas session for AIDL service.");
+            mCasAidl->closeSession(sessionId);
             return failure();
         }
+
+        if (pvtData.size() > 0) {
+            ScopedAStatus status = mCasAidl->setSessionPrivateData(sessionId, pvtData);
+            if (!status.isOk()) {
+                ALOGW("[vts] Failed to set session private data for AIDL service.");
+                mCasAidl->closeSession(sessionId);
+                return failure();
+            }
+        }
+    } else {
+        Status sessionStatus;
+        SessionIntentHidl intent = SessionIntentHidl::LIVE;
+        ScramblingModeHidl mode = ScramblingModeHidl::RESERVED;
+        auto returnVoid = mCasHidl->openSession_1_2(
+                intent, mode, [&](Status status, const hidl_vec<uint8_t>& id) {
+                    sessionStatus = status;
+                    sessionId = id;
+                });
+        if (!returnVoid.isOk() || (sessionStatus != Status::OK)) {
+            ALOGW("[vts] Failed to open cas session for HIDL service.");
+            mCasHidl->closeSession(sessionId);
+            return failure();
+        }
+
+        if (pvtData.size() > 0) {
+            auto status = mCasHidl->setSessionPrivateData(sessionId, pvtData);
+            if (status != android::hardware::cas::V1_0::Status::OK) {
+                ALOGW("[vts] Failed to set session private data for HIDL service.");
+                mCasHidl->closeSession(sessionId);
+                return failure();
+            }
+        }
     }
 
     return success();
 }
 
 AssertionResult DescramblerTests::getKeyToken(int32_t caSystemId, string& provisonStr,
-                                              vector<uint8_t>& hidlPvtData,
-                                              vector<uint8_t>& token) {
+                                              vector<uint8_t>& pvtData, vector<uint8_t>& token) {
     if (createCasPlugin(caSystemId) != success()) {
         ALOGW("[vts] createCasPlugin failed.");
         return failure();
     }
 
     if (provisonStr.size() > 0) {
-        auto returnStatus = mCas->provision(hidl_string(provisonStr));
-        if (returnStatus != android::hardware::cas::V1_0::Status::OK) {
-            ALOGW("[vts] provision failed.");
-            return failure();
+        if (mMediaCasServiceAidl != nullptr) {
+            ScopedAStatus status = mCasAidl->provision(provisonStr);
+            if (!status.isOk()) {
+                ALOGW("[vts] provision failed for AIDL service.");
+                return failure();
+            }
+        } else {
+            auto returnStatus = mCasHidl->provision(hidl_string(provisonStr));
+            if (returnStatus != android::hardware::cas::V1_0::Status::OK) {
+                ALOGW("[vts] provision failed for HIDL service.");
+                return failure();
+            }
         }
     }
 
-    return openCasSession(token, hidlPvtData);
+    return openCasSession(token, pvtData);
 }
 
 AssertionResult DescramblerTests::openDescrambler(int32_t demuxId) {
diff --git a/tv/tuner/aidl/vts/functional/DescramblerTests.h b/tv/tuner/aidl/vts/functional/DescramblerTests.h
index f0b7691..bab1a88 100644
--- a/tv/tuner/aidl/vts/functional/DescramblerTests.h
+++ b/tv/tuner/aidl/vts/functional/DescramblerTests.h
@@ -30,11 +30,17 @@
 #include <android/hardware/cas/1.2/IMediaCasService.h>
 #include <android/hardware/cas/1.2/types.h>
 
+#include <aidl/android/hardware/cas/BnCasListener.h>
+#include <aidl/android/hardware/cas/ICas.h>
+#include <aidl/android/hardware/cas/IMediaCasService.h>
+#include <aidl/android/hardware/cas/ScramblingMode.h>
+#include <aidl/android/hardware/cas/SessionIntent.h>
 #include <aidl/android/hardware/tv/tuner/IDescrambler.h>
 #include <aidl/android/hardware/tv/tuner/IDvr.h>
 #include <aidl/android/hardware/tv/tuner/IDvrCallback.h>
 #include <aidl/android/hardware/tv/tuner/ITuner.h>
 
+using ::aidl::android::hardware::cas::BnCasListener;
 using android::Condition;
 using android::Mutex;
 using android::sp;
@@ -42,19 +48,26 @@
 using android::hardware::hidl_vec;
 using android::hardware::Return;
 using android::hardware::Void;
-using android::hardware::cas::V1_2::ICas;
-using android::hardware::cas::V1_2::ICasListener;
-using android::hardware::cas::V1_2::IMediaCasService;
-using android::hardware::cas::V1_2::ScramblingMode;
-using android::hardware::cas::V1_2::SessionIntent;
 using android::hardware::cas::V1_2::Status;
 using android::hardware::cas::V1_2::StatusEvent;
+using ICasAidl = ::aidl::android::hardware::cas::ICas;
+using ICasHidl = android::hardware::cas::V1_2::ICas;
+using ICasListenerHidl = android::hardware::cas::V1_2::ICasListener;
+using IMediaCasServiceAidl = ::aidl::android::hardware::cas::IMediaCasService;
+using IMediaCasServiceHidl = android::hardware::cas::V1_2::IMediaCasService;
+using ScramblingModeAidl = ::aidl::android::hardware::cas::ScramblingMode;
+using ScramblingModeHidl = android::hardware::cas::V1_2::ScramblingMode;
+using SessionIntentAidl = ::aidl::android::hardware::cas::SessionIntent;
+using SessionIntentHidl = android::hardware::cas::V1_2::SessionIntent;
 
+using ::ndk::ScopedAStatus;
 using ::testing::AssertionResult;
 
 using namespace aidl::android::hardware::tv::tuner;
 
-class MediaCasListener : public ICasListener {
+const std::string MEDIA_CAS_AIDL_SERVICE_NAME = "android.hardware.cas.IMediaCasService/default";
+
+class MediaCasListener : public ICasListenerHidl, public BnCasListener {
   public:
     virtual Return<void> onEvent(int32_t /*event*/, int32_t /*arg*/,
                                  const hidl_vec<uint8_t>& /*data*/) override {
@@ -70,12 +83,33 @@
     virtual Return<void> onStatusUpdate(StatusEvent /*event*/, int32_t /*arg*/) override {
         return Void();
     }
+
+    ScopedAStatus onEvent(int32_t /*in_event*/, int32_t /*in_arg*/,
+                          const std::vector<uint8_t>& /*in_data*/) override {
+        return ScopedAStatus::ok();
+    }
+
+    ScopedAStatus onSessionEvent(const std::vector<uint8_t>& /*in_sessionId*/, int32_t /*in_event*/,
+                                 int32_t /*in_arg*/,
+                                 const std::vector<uint8_t>& /*in_data*/) override {
+        return ScopedAStatus::ok();
+    }
+
+    ScopedAStatus onStatusUpdate(::aidl::android::hardware::cas::StatusEvent /*in_event*/,
+                                 int32_t /*in_number*/) override {
+        return ScopedAStatus::ok();
+    }
 };
 
 class DescramblerTests {
   public:
     void setService(std::shared_ptr<ITuner> tuner) { mService = tuner; }
-    void setCasService(sp<IMediaCasService> casService) { mMediaCasService = casService; }
+    void setCasServiceHidl(sp<IMediaCasServiceHidl> casService) {
+        mMediaCasServiceHidl = casService;
+    }
+    void setCasServiceAidl(std::shared_ptr<IMediaCasServiceAidl> casService) {
+        mMediaCasServiceAidl = casService;
+    }
 
     AssertionResult setKeyToken(std::vector<uint8_t>& token);
     AssertionResult openDescrambler(int32_t demuxId);
@@ -95,12 +129,13 @@
 
     std::shared_ptr<ITuner> mService;
     std::shared_ptr<IDescrambler> mDescrambler;
-    android::sp<ICas> mCas;
-    android::sp<IMediaCasService> mMediaCasService;
-    android::sp<MediaCasListener> mCasListener;
+    std::shared_ptr<ICasAidl> mCasAidl;
+    android::sp<ICasHidl> mCasHidl;
+    std::shared_ptr<IMediaCasServiceAidl> mMediaCasServiceAidl;
+    android::sp<IMediaCasServiceHidl> mMediaCasServiceHidl;
+    std::shared_ptr<MediaCasListener> mCasListener;
 
   private:
-    AssertionResult openCasSession(std::vector<uint8_t>& sessionId,
-                                   std::vector<uint8_t>& hidlPvtData);
+    AssertionResult openCasSession(std::vector<uint8_t>& sessionId, std::vector<uint8_t>& pvtData);
     AssertionResult createCasPlugin(int32_t caSystemId);
 };
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
index 7f80d90..73dc797 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
@@ -338,16 +338,31 @@
         } else {
             mService = nullptr;
         }
-        mCasService = IMediaCasService::getService();
         ASSERT_NE(mService, nullptr);
-        ASSERT_NE(mCasService, nullptr);
+
+        // Get IMediaCasService. Try getting AIDL service first, if AIDL does not exist, try HIDL.
+        if (AServiceManager_isDeclared(MEDIA_CAS_AIDL_SERVICE_NAME.c_str())) {
+            ::ndk::SpAIBinder binder(
+                    AServiceManager_waitForService(MEDIA_CAS_AIDL_SERVICE_NAME.c_str()));
+            mCasServiceAidl = IMediaCasServiceAidl::fromBinder(binder);
+        } else {
+            mCasServiceAidl = nullptr;
+        }
+        if (mCasServiceAidl == nullptr) {
+            mCasServiceHidl = IMediaCasServiceHidl::getService();
+        }
+        ASSERT_TRUE(mCasServiceAidl != nullptr || mCasServiceHidl != nullptr);
         ASSERT_TRUE(initConfiguration());
 
         mFrontendTests.setService(mService);
         mDemuxTests.setService(mService);
         mDvrTests.setService(mService);
         mDescramblerTests.setService(mService);
-        mDescramblerTests.setCasService(mCasService);
+        if (mCasServiceAidl != nullptr) {
+            mDescramblerTests.setCasServiceAidl(mCasServiceAidl);
+        } else {
+            mDescramblerTests.setCasServiceHidl(mCasServiceHidl);
+        }
     }
 
   protected:
@@ -360,7 +375,8 @@
     AssertionResult filterDataOutputTest();
 
     std::shared_ptr<ITuner> mService;
-    android::sp<IMediaCasService> mCasService;
+    sp<IMediaCasServiceHidl> mCasServiceHidl;
+    std::shared_ptr<IMediaCasServiceAidl> mCasServiceAidl;
     FrontendTests mFrontendTests;
     DemuxTests mDemuxTests;
     FilterTests mFilterTests;
diff --git a/tv/tuner/config/OWNERS b/tv/tuner/config/OWNERS
deleted file mode 100644
index bf2b609..0000000
--- a/tv/tuner/config/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-hgchen@google.com
-shubang@google.com
-quxiangfang@google.com
diff --git a/vr/OWNERS b/vr/OWNERS
new file mode 100644
index 0000000..a07824e
--- /dev/null
+++ b/vr/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 298954331
+
+include platform/hardware/interfaces:/OWNERS
diff --git a/weaver/aidl/android/hardware/weaver/IWeaver.aidl b/weaver/aidl/android/hardware/weaver/IWeaver.aidl
index ae816ef..30168e3 100644
--- a/weaver/aidl/android/hardware/weaver/IWeaver.aidl
+++ b/weaver/aidl/android/hardware/weaver/IWeaver.aidl
@@ -58,7 +58,9 @@
      * Throttling must be used to limit the frequency of failed read attempts.
      * The value is only returned when throttling is not active, even if the
      * correct key is provided. If called when throttling is active, the time
-     * until the next attempt can be made is returned.
+     * until the next attempt can be made is returned. Throttling must be
+     * applied on a per-slot basis so that a successful read from one slot does
+     * not reset the throttling state of any other slot.
      *
      * Service status return:
      *
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
index 02f8209..fae30c0 100644
--- a/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.cpp
@@ -89,6 +89,24 @@
     ChipModeId mode_id;
     return configureChipToSupportIfaceTypeInternal(wifi_chip, type, &mode_id);
 }
+
+bool doesChipSupportIfaceTypeInternal(const sp<IWifiChip>& wifi_chip,
+                                         IfaceType type) {
+    ChipModeId mode_id;
+    if (!wifi_chip.get()) {
+        return false;
+    }
+    const auto& status_and_modes = HIDL_INVOKE(wifi_chip, getAvailableModes);
+    if (status_and_modes.first.code != WifiStatusCode::SUCCESS) {
+        return false;
+    }
+    if (!findAnyModeSupportingIfaceType(type, status_and_modes.second,
+                                        &mode_id)) {
+        return false;
+    }
+
+    return true;
+}
 }  // namespace
 
 sp<IWifi> getWifi(const std::string& instance_name) {
@@ -205,6 +223,11 @@
                                                    configured_mode_id);
 }
 
+bool doesChipSupportIfaceType(const sp<IWifiChip>& wifi_chip,
+                                     IfaceType type) {
+    return doesChipSupportIfaceTypeInternal(wifi_chip, type);
+}
+
 void stopWifi(const std::string& instance_name) {
     sp<IWifi> wifi = IWifi::getService(instance_name);
     ASSERT_NE(wifi, nullptr);
diff --git a/wifi/1.0/vts/functional/wifi_hidl_test_utils.h b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
index 62c015c..876c316 100644
--- a/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
+++ b/wifi/1.0/vts/functional/wifi_hidl_test_utils.h
@@ -49,6 +49,10 @@
     const android::sp<android::hardware::wifi::V1_0::IWifiChip>& wifi_chip,
     android::hardware::wifi::V1_0::IfaceType type,
     android::hardware::wifi::V1_0::ChipModeId* configured_mode_id);
+// Check whether wifi chip supports given interface type mode
+bool doesChipSupportIfaceType(
+        const android::sp<android::hardware::wifi::V1_0::IWifiChip>& wifi_chip,
+        android::hardware::wifi::V1_0::IfaceType type);
 // Used to trigger IWifi.stop() at the end of every test.
 void stopWifi(const std::string& instance_name);
 uint32_t getChipCapabilitiesLatest(
diff --git a/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp b/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
index 424f934..c3bd4d7 100644
--- a/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
+++ b/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
@@ -58,12 +58,16 @@
             "wifi_softap_bridged_ap_supported");
         // Make sure to start with a clean state
         stopWifi(GetInstanceName());
+        // Read AP mode capabilities from the wifi chip modes
+        sp<IWifiChip> wifi_chip_ = getWifiChip_1_5(GetInstanceName());
+        isApModeSupport_ = doesChipSupportIfaceType(wifi_chip_, IfaceType::AP);
     }
 
     virtual void TearDown() override { stopWifi(GetInstanceName()); }
 
    protected:
     bool isBridgedSupport_ = false;
+    bool isApModeSupport_ = false;
     std::string GetInstanceName() { return GetParam(); }
 };
 
@@ -83,6 +87,7 @@
  * resetToFactoryMacAddress in non-bridged mode
  */
 TEST_P(WifiApIfaceHidlTest, resetToFactoryMacAddressTest) {
+    if (!isApModeSupport_) GTEST_SKIP() << "Missing AP support";
     sp<IWifiApIface> wifi_ap_iface = getWifiApIface_1_5(GetInstanceName());
     ASSERT_NE(nullptr, wifi_ap_iface.get());
     const auto& status = HIDL_INVOKE(wifi_ap_iface, resetToFactoryMacAddress);
@@ -93,6 +98,7 @@
  * getBridgedInstances in non-bridged mode
  */
 TEST_P(WifiApIfaceHidlTest, getBridgedInstancesTest) {
+    if (!isApModeSupport_) GTEST_SKIP() << "Missing AP support";
     sp<IWifiApIface> wifi_ap_iface = getWifiApIface_1_5(GetInstanceName());
     ASSERT_NE(nullptr, wifi_ap_iface.get());
     const auto& status_and_instances =
diff --git a/wifi/1.6/default/wifi_feature_flags.cpp b/wifi/1.6/default/wifi_feature_flags.cpp
index e80a3cd..ff23e7c 100644
--- a/wifi/1.6/default/wifi_feature_flags.cpp
+++ b/wifi/1.6/default/wifi_feature_flags.cpp
@@ -136,6 +136,7 @@
 #define AP IfaceConcurrencyType::AP
 #define AP_BRIDGED IfaceConcurrencyType::AP_BRIDGED
 #define P2P IfaceConcurrencyType::P2P
+#undef NAN  // undefine NAN from math.h
 #define NAN IfaceConcurrencyType::NAN
 static const std::vector<V1_6::IWifiChip::ChipMode> kChipModesPrimary{
         {kMainModeId, ChipConcurrencyCombination::make_vec({WIFI_HAL_INTERFACE_COMBINATIONS})},
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
index d95bd03..6f8fde6 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
@@ -524,16 +524,12 @@
  * Connect
  */
 TEST_P(SupplicantP2pIfaceAidlTest, Connect) {
-    /*
-     * Auto-join is not enabled before R. After enabling auto-join,
-     * this should always succeed.
-     */
-    std::string pin;
-    EXPECT_TRUE(p2p_iface_
-                    ->connect(kTestMacAddr, WpsProvisionMethod::PBC,
-                              kTestConnectPin, false, false,
-                              kTestConnectGoIntent, &pin)
-                    .isOk());
+  std::string pin;
+  EXPECT_TRUE(p2p_iface_
+                  ->connect(kTestMacAddr, WpsProvisionMethod::PBC,
+                            kTestConnectPin, true, false, kTestConnectGoIntent,
+                            &pin)
+                  .isOk());
 }
 
 /*
@@ -543,7 +539,7 @@
     std::string pin;
     EXPECT_TRUE(p2p_iface_
                     ->connect(kTestMacAddr, WpsProvisionMethod::PBC,
-                              kTestConnectPin, false, false,
+                              kTestConnectPin, true, false,
                               kTestConnectGoIntent, &pin)
                     .isOk());
     EXPECT_TRUE(p2p_iface_->cancelConnect().isOk());