Merge "Introducing OEM partner custom input type (HW_CUSTOM_INPUT)"
diff --git a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
index b09e9bf..dc5d3d3 100644
--- a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
@@ -78,6 +78,7 @@
         } else {
             ALOGW("Requested config for undefined property: 0x%x", prop);
             _hidl_cb(StatusCode::INVALID_ARG, hidl_vec<VehiclePropConfig>());
+            return Void();
         }
     }
 
diff --git a/automotive/vehicle/2.0/utils/UserHalHelper.cpp b/automotive/vehicle/2.0/utils/UserHalHelper.cpp
index fcfe4bf..abf59b7 100644
--- a/automotive/vehicle/2.0/utils/UserHalHelper.cpp
+++ b/automotive/vehicle/2.0/utils/UserHalHelper.cpp
@@ -141,11 +141,6 @@
 template <typename T>
 Result<T> verifyAndCast(int32_t value) {
     T castValue = static_cast<T>(value);
-    const auto iter = hidl_enum_range<T>();
-    if (castValue < *iter.begin() || castValue > *std::prev(iter.end())) {
-        return Error() << "Value " << value << " not in range [" << toString(*iter.begin()) << ", "
-                       << toString(*std::prev(iter.end())) << "]";
-    }
     for (const auto& v : hidl_enum_range<T>()) {
         if (castValue == v) {
             return castValue;
diff --git a/biometrics/README.md b/biometrics/README.md
new file mode 100644
index 0000000..8ae1ad6
--- /dev/null
+++ b/biometrics/README.md
@@ -0,0 +1,12 @@
+## Biometric HALs ##
+---
+
+## Overview: ##
+
+The interfaces within the biometrics.* HAL tree are used by the Android Biometric Services
+(e.g. FingerprintService, FaceService) to discover and operate biometric sensors on the device.
+
+More details and versioning information can be found within each particular HAL.
+
+More complete information about the Android Biometric HALs and subsystem can be found at
+[source.android.com](https://source.android.com/security/biometric).
\ No newline at end of file
diff --git a/biometrics/common/aidl/Android.bp b/biometrics/common/aidl/Android.bp
new file mode 100644
index 0000000..f7462e6
--- /dev/null
+++ b/biometrics/common/aidl/Android.bp
@@ -0,0 +1,16 @@
+aidl_interface {
+    name: "android.hardware.biometrics.common",
+    vendor_available: true,
+    srcs: [
+        "android/hardware/biometrics/common/*.aidl",
+    ],
+    stability: "vintf",
+    backend: {
+        java: {
+            platform_apis: true,
+        },
+        cpp: {
+            enabled: false,
+        },
+    }
+}
\ No newline at end of file
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/CommonProps.aidl
similarity index 80%
copy from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/CommonProps.aidl
index 6f3d2db..8dbc149 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/CommonProps.aidl
@@ -15,8 +15,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.biometrics.common;
 @VintfStability
-interface ICancellationSignal {
-  oneway void cancel();
+parcelable CommonProps {
+  int sensorId;
+  android.hardware.biometrics.common.SensorStrength sensorStrength;
+  int maxEnrollmentsPerUser;
+  android.hardware.biometrics.common.HardwareInfo[] hardwareInfo;
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/HardwareInfo.aidl
similarity index 85%
copy from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/HardwareInfo.aidl
index 6f3d2db..b94b6b0 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/HardwareInfo.aidl
@@ -15,8 +15,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.biometrics.common;
 @VintfStability
-interface ICancellationSignal {
-  oneway void cancel();
+parcelable HardwareInfo {
+  String deviceName;
+  String hardwareVersion;
+  String firmwareVersion;
+  String serialNumber;
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/ICancellationSignal.aidl
similarity index 95%
rename from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
rename to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/ICancellationSignal.aidl
index 6f3d2db..1a875bf 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/ICancellationSignal.aidl
@@ -15,7 +15,7 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.biometrics.common;
 @VintfStability
 interface ICancellationSignal {
   oneway void cancel();
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/SensorStrength.aidl
similarity index 86%
copy from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/SensorStrength.aidl
index 6f3d2db..eaff85d 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/SensorStrength.aidl
@@ -15,8 +15,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
-@VintfStability
-interface ICancellationSignal {
-  oneway void cancel();
+package android.hardware.biometrics.common;
+@Backing(type="byte") @VintfStability
+enum SensorStrength {
+  CONVENIENCE = 0,
+  WEAK = 1,
+  STRONG = 2,
 }
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/CommonProps.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/CommonProps.aidl
new file mode 100644
index 0000000..9c3fd58
--- /dev/null
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/CommonProps.aidl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.common;
+
+import android.hardware.biometrics.common.HardwareInfo;
+import android.hardware.biometrics.common.SensorStrength;
+
+@VintfStability
+parcelable CommonProps {
+    /**
+     * A statically configured unique ID that identifies a single biometric sensor. IDs must start
+     * at zero and increment by one for each unique sensor. Note that ID allocations are shared
+     * between all biometric modalities (e.g. fingerprint, face, iris), and a single ID must never
+     * be claimed by more than a single sensor.
+     */
+    int sensorId;
+
+    /**
+     * A statically configured strength for this sensor. See the SensorStrength interface for more
+     * information.
+     */
+    SensorStrength sensorStrength;
+
+    /**
+     * The maximum number of enrollments that a single user can have. Statically configured.
+     */
+    int maxEnrollmentsPerUser;
+
+    /**
+     * A list of hardware information for subsystems that pertain to this biometric sensor.
+     */
+    HardwareInfo[] hardwareInfo;
+}
\ No newline at end of file
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/HardwareInfo.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/HardwareInfo.aidl
new file mode 100644
index 0000000..23f0202
--- /dev/null
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/HardwareInfo.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.common;
+
+@VintfStability
+parcelable HardwareInfo {
+    /**
+     * An identifier uniquely identifying a subsystem.
+     */
+    String deviceName;
+
+    /**
+     * The hardware version. For example, <vendor>/<model>/<revision>.
+     */
+    String hardwareVersion;
+
+    /**
+     * The firmware version.
+     */
+    String firmwareVersion;
+
+    /**
+     * The sensor's serial number.
+     */
+    String serialNumber;
+}
\ No newline at end of file
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/ICancellationSignal.aidl
similarity index 93%
rename from biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
rename to biometrics/common/aidl/android/hardware/biometrics/common/ICancellationSignal.aidl
index abfbb2a..1010256 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/ICancellationSignal.aidl
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.biometrics.common;
 
 @VintfStability
 oneway interface ICancellationSignal {
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/SensorStrength.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/SensorStrength.aidl
new file mode 100644
index 0000000..790691c
--- /dev/null
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/SensorStrength.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.common;
+
+@VintfStability
+@Backing(type="byte")
+enum SensorStrength {
+    /**
+     * A sensor that meets the requirements for Class 1 biometrics as defined in the CDD. This does
+     * not correspond to a public BiometricManager.Authenticators constant. Sensors of this strength
+     * are not available to applications via the public API surface.
+     */
+    CONVENIENCE,
+
+    /**
+     * A sensor that meets the requirements for Class 2 biometrics as defined in the CDD.
+     * Corresponds to BiometricManager.Authenticators.BIOMETRIC_WEAK.
+     */
+    WEAK,
+
+    /**
+     * A sensor that meets the requirements for Class 3 biometrics as defined in the CDD.
+     * Corresponds to BiometricManager.Authenticators.BIOMETRIC_STRONG.
+     *
+     * Notably, this is the only strength that allows generation/verification of
+     * HardwareAuthToken(s).
+     */
+    STRONG,
+}
\ No newline at end of file
diff --git a/biometrics/fingerprint/aidl/Android.bp b/biometrics/fingerprint/aidl/Android.bp
index e6baa8a..6bf2038 100644
--- a/biometrics/fingerprint/aidl/Android.bp
+++ b/biometrics/fingerprint/aidl/Android.bp
@@ -5,6 +5,7 @@
         "android/hardware/biometrics/fingerprint/**/*.aidl",
     ],
     imports: [
+        "android.hardware.biometrics.common",
         "android.hardware.keymaster",
     ],
     stability: "vintf",
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
index 329a35d..df30dca 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
@@ -24,6 +24,6 @@
   SENSOR_DIRTY = 3,
   TOO_SLOW = 4,
   TOO_FAST = 5,
-  START = 6,
-  VENDOR = 7,
+  VENDOR = 6,
+  START = 7,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
index 0298c12..6bd71b2 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
@@ -18,13 +18,11 @@
 package android.hardware.biometrics.fingerprint;
 @Backing(type="byte") @VintfStability
 enum Error {
-  HW_UNAVAILABLE = 0,
-  UNABLE_TO_PROCESS = 1,
-  TIMEOUT = 2,
-  NO_SPACE = 3,
-  CANCELED = 4,
-  UNABLE_TO_REMOVE = 5,
-  LOCKOUT = 6,
-  LOCKOUT_PERMANENT = 7,
+  HW_UNAVAILABLE = 1,
+  UNABLE_TO_PROCESS = 2,
+  TIMEOUT = 3,
+  NO_SPACE = 4,
+  CANCELED = 5,
+  UNABLE_TO_REMOVE = 6,
   VENDOR = 8,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorType.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
similarity index 97%
rename from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorType.aidl
rename to biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
index 2aaf94f..14bfece 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorType.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
@@ -17,7 +17,7 @@
 
 package android.hardware.biometrics.fingerprint;
 @Backing(type="byte") @VintfStability
-enum SensorType {
+enum FingerprintSensorType {
   UNKNOWN = 0,
   REAR = 1,
   UNDER_DISPLAY_ULTRASONIC = 2,
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IFingerprint.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IFingerprint.aidl
index a376acf..6ca6d16 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IFingerprint.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IFingerprint.aidl
@@ -20,7 +20,6 @@
 interface IFingerprint {
   android.hardware.biometrics.fingerprint.SensorProps[] getSensorProps();
   android.hardware.biometrics.fingerprint.ISession createSession(in int sensorId, in int userId, in android.hardware.biometrics.fingerprint.ISessionCallback cb);
-  void setResetLockoutCallback(in android.hardware.biometrics.fingerprint.IResetLockoutCallback cb);
-  void generateChallenge(in int sensorId, in int userId, in long keystoreOperationId, in int timeoutSec, in android.hardware.biometrics.fingerprint.IGenerateChallengeCallback cb);
-  void revokeChallenge(in int sensorId, in int userId, in android.hardware.biometrics.fingerprint.IRevokeChallengeCallback cb);
+  void generateChallenge(in int sensorId, in int userId, in int timeoutSec, in android.hardware.biometrics.fingerprint.IGenerateChallengeCallback cb);
+  void revokeChallenge(in int sensorId, in int userId, in long challenge, in android.hardware.biometrics.fingerprint.IRevokeChallengeCallback cb);
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
index eaf27d2..063be60 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
@@ -18,5 +18,5 @@
 package android.hardware.biometrics.fingerprint;
 @VintfStability
 interface IGenerateChallengeCallback {
-  oneway void onChallengeGenerated(in int sensorId, in int userId, in long keystoreOperationId, in long challenge);
+  oneway void onChallengeGenerated(in int sensorId, in int userId, in long challenge);
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl
deleted file mode 100644
index ac0decd..0000000
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl
+++ /dev/null
@@ -1,22 +0,0 @@
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL interface (or parcelable). Do not try to
-// edit this file. It looks like you are doing that because you have modified
-// an AIDL interface in a backward-incompatible way, e.g., deleting a function
-// from an interface or a field from a parcelable and it broke the build. That
-// breakage is intended.
-//
-// You must not make a backward incompatible changes to the AIDL files built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.biometrics.fingerprint;
-@VintfStability
-interface IResetLockoutCallback {
-  oneway void onLockoutReset(in int sensorId, in int userId, in long durationMilli);
-}
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
index 4b71527..c1f66e3 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -18,12 +18,13 @@
 package android.hardware.biometrics.fingerprint;
 @VintfStability
 interface ISession {
-  android.hardware.biometrics.fingerprint.ICancellationSignal enroll(in int cookie, in android.hardware.keymaster.HardwareAuthToken hat);
-  android.hardware.biometrics.fingerprint.ICancellationSignal authenticate(in int cookie, in long keystoreOperationId);
-  android.hardware.biometrics.fingerprint.ICancellationSignal detectInteraction(in int cookie);
+  android.hardware.biometrics.common.ICancellationSignal enroll(in int cookie, in android.hardware.keymaster.HardwareAuthToken hat);
+  android.hardware.biometrics.common.ICancellationSignal authenticate(in int cookie, in long operationId);
+  android.hardware.biometrics.common.ICancellationSignal detectInteraction(in int cookie);
   void enumerateEnrollments(in int cookie);
   void removeEnrollments(in int cookie, in int[] enrollmentIds);
   void getAuthenticatorId(in int cookie);
+  void invalidateAuthenticatorId(in int cookie, in android.hardware.keymaster.HardwareAuthToken hat);
   void resetLockout(in int cookie, in android.hardware.keymaster.HardwareAuthToken hat);
   void onPointerDown(in int pointerId, in int x, in int y, in float minor, in float major);
   void onPointerUp(in int pointerId);
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISessionCallback.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
index f50554b..74ec077 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
@@ -21,9 +21,15 @@
   void onStateChanged(in int cookie, in android.hardware.biometrics.fingerprint.SessionState state);
   void onAcquired(in android.hardware.biometrics.fingerprint.AcquiredInfo info, in int vendorCode);
   void onError(in android.hardware.biometrics.fingerprint.Error error, in int vendorCode);
-  void onEnrollmentProgress(in int enrollmentId, int remaining, int vendorCode);
-  void onAuthenticated(in int enrollmentId, in android.hardware.keymaster.HardwareAuthToken hat);
+  void onEnrollmentProgress(in int enrollmentId, int remaining);
+  void onAuthenticationSucceeded(in int enrollmentId, in android.hardware.keymaster.HardwareAuthToken hat);
+  void onAuthenticationFailed();
+  void onLockoutTimed(in long durationMillis);
+  void onLockoutPermanent();
+  void onLockoutCleared();
   void onInteractionDetected();
   void onEnrollmentsEnumerated(in int[] enrollmentIds);
   void onEnrollmentsRemoved(in int[] enrollmentIds);
+  void onAuthenticatorIdRetrieved(in long authenticatorId);
+  void onAuthenticatorIdInvalidated();
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
index c30e35d..8c779ab 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
@@ -18,7 +18,11 @@
 package android.hardware.biometrics.fingerprint;
 @VintfStability
 parcelable SensorProps {
-  int sensorId;
-  android.hardware.biometrics.fingerprint.SensorType sensorType;
-  boolean resetLockoutRequiresHardwareAuthToken;
+  android.hardware.biometrics.common.CommonProps commonProps;
+  android.hardware.biometrics.fingerprint.FingerprintSensorType sensorType;
+  boolean supportsNavigationGestures;
+  int sensorLocationX;
+  int sensorLocationY;
+  int sensorRadius;
+  int displayId;
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SessionState.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SessionState.aidl
index 38ca1e0..97f1a1e 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SessionState.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SessionState.aidl
@@ -25,5 +25,6 @@
   ENUMERATING_ENROLLMENTS = 4,
   REMOVING_ENROLLMENTS = 5,
   GETTING_AUTHENTICATOR_ID = 6,
-  RESETTING_LOCKOUT = 7,
+  INVALIDATING_AUTHENTICATOR_ID = 7,
+  RESETTING_LOCKOUT = 8,
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
index 8cb7833..adb1c78 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
@@ -19,13 +19,49 @@
 @VintfStability
 @Backing(type="byte")
 enum AcquiredInfo {
+    /**
+     * A high quality fingerprint image was detected, no further user interaction is necessary.
+     */
     GOOD,
+
+    /**
+     * Not enough of a fingerprint was detected. Reposition the finger, or a longer swipe needed.
+     */
     PARTIAL,
+
+    /**
+     * Image doesn't contain enough detail for recognition.
+     */
     INSUFFICIENT,
+
+    /**
+     * The sensor needs to be cleaned.
+     */
     SENSOR_DIRTY,
+
+    /**
+     * For swipe-type sensors, the swipe was too slow and not enough data was collected.
+     */
     TOO_SLOW,
+
+    /**
+     * For swipe-type sensors, the swipe was too fast and not enough data was collected.
+     */
     TOO_FAST,
+
+    /**
+     * Vendor-specific acquisition message. See ISessionCallback#onAcquired vendorCode
+     * documentation.
+     */
+    VENDOR,
+
+    /**
+     * This message represents the earliest message sent at the beginning of the authentication
+     * pipeline. It is expected to be used to measure latency. For example, in a camera-based
+     * authentication system it's expected to be sent prior to camera initialization. Note this
+     * should be sent whenever authentication is started or restarted. The framework may measure
+     * latency based on the time between the last START message and the onAuthenticated callback.
+     */
     START,
-    VENDOR
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
index cc79de7..4fe7f5f 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
@@ -19,14 +19,58 @@
 @VintfStability
 @Backing(type="byte")
 enum Error {
-    HW_UNAVAILABLE,
-    UNABLE_TO_PROCESS,
-    TIMEOUT,
-    NO_SPACE,
-    CANCELED,
-    UNABLE_TO_REMOVE,
-    LOCKOUT,
-    LOCKOUT_PERMANENT,
-    VENDOR
+    /**
+     * Used for testing, and to keep subsequent numbering consistent with older HIDLs.
+     */
+    // NO_ERROR = 0,
+
+    /**
+     * A hardware error has occurred that cannot be resolved. For example, I2C failure or a broken
+     * sensor.
+     */
+    HW_UNAVAILABLE = 1,
+
+    /**
+     * The implementation is unable to process the request. For example, invalid arguments were
+     * supplied.
+     */
+    UNABLE_TO_PROCESS = 2,
+
+    /**
+     * The current operation took too long to complete.
+     */
+    TIMEOUT = 3,
+
+    /**
+     * No space available to store additional enrollments.
+     */
+    NO_SPACE = 4,
+
+    /**
+     * The operation was canceled. See common::ICancellationSignal.
+     */
+    CANCELED = 5,
+
+    /**
+     * The implementation was unable to remove an enrollment.
+     * See ISession#removeEnrollments.
+     */
+    UNABLE_TO_REMOVE = 6,
+
+    /**
+     * Reserved to maintain backwards compatibility. See ISessionCallback#onLockoutTimed instead.
+     */
+    // LOCKOUT = 7,
+
+    /**
+     * Used to enable vendor-specific error messages.
+     */
+    VENDOR = 8,
+
+    /**
+     * Reserved to maintain backwards compatibility. See ISessionCallback#onLockoutPermanent
+     * instead.
+     */
+    // LOCKOUT_PERMANENT = 9,
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorType.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
similarity index 96%
rename from biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorType.aidl
rename to biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
index 589e737..765a2ed 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorType.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
@@ -18,7 +18,7 @@
 
 @VintfStability
 @Backing(type="byte")
-enum SensorType {
+enum FingerprintSensorType {
     UNKNOWN,
     REAR,
     UNDER_DISPLAY_ULTRASONIC,
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IFingerprint.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IFingerprint.aidl
index 9aafeab..4b907b4 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IFingerprint.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IFingerprint.aidl
@@ -17,7 +17,6 @@
 package android.hardware.biometrics.fingerprint;
 
 import android.hardware.biometrics.fingerprint.IGenerateChallengeCallback;
-import android.hardware.biometrics.fingerprint.IResetLockoutCallback;
 import android.hardware.biometrics.fingerprint.IRevokeChallengeCallback;
 import android.hardware.biometrics.fingerprint.ISession;
 import android.hardware.biometrics.fingerprint.ISessionCallback;
@@ -25,13 +24,103 @@
 
 @VintfStability
 interface IFingerprint {
+    /**
+     * getSensorProps:
+     *
+     * @return A list of properties for all sensors that an instance of the HAL supports.
+     */
     SensorProps[] getSensorProps();
 
+    /**
+     * createSession:
+     *
+     * Creates a session which can then be used by the framework to perform operations such as
+     * enroll, authenticate, etc for the given sensorId and userId.
+     *
+     * A physical sensor identified by sensorId typically supports only a single in-flight session
+     * at a time. As such, if a session is currently in a state other than SessionState::IDLING, the
+     * HAL MUST finish or cancel the current operation and return to SessionState::IDLING before the
+     * new session is created. For example:
+     *   1) If a session for sensorId=0, userId=0 is currently in a cancellable state (see
+     *      ICancellationSignal) such as SessionState::AUTHENTICATING and the framework requests a
+     *      new session for sensorId=0, userId=10, the HAL must end the current session with
+     *      Error::CANCELED, invoke ISessionCallback#onStateChanged with SessionState::IDLING, and
+     *      then return a new session for sensorId=0, userId=10.
+     *   2) If a session for sensorId=0, userId=0 is currently in a non-cancellable state such as
+     *      SessionState::REMOVING_ENROLLMENTS, and the framework requests a new session for
+     *      sensorId=0, userId=10, the HAL must finish the current operation before invoking
+     *      ISessionCallback#onStateChanged with SessionState::IDLING, and return a new session for
+     *      sensorId=0, userId=10.
+     *
+     * Implementations must store user-specific state or metadata in /data/vendor_de/<user>/fpdata
+     * as specified by the SeLinux policy. This directory is created/removed by vold (see
+     * vold_prepare_subdirs.cpp). Implementations may store additional user-specific data, such as
+     * embeddings or templates in StrongBox.
+     *
+     * @param sensorId The sensor with which this session is being created.
+     * @param userId The userId with which this session is being created.
+     * @param cb Used to notify the framework.
+     * @return A new session
+     */
     ISession createSession(in int sensorId, in int userId, in ISessionCallback cb);
 
-    void setResetLockoutCallback(in IResetLockoutCallback cb);
+    /**
+     * generateChallenge:
+     *
+     * Begins a secure transaction request. Note that the challenge by itself is not useful. It only
+     * becomes useful when wrapped in a verifiable message such as a HardwareAuthToken.
+     *
+     * Canonical example:
+     *   1) User requests an operation, such as fingerprint enrollment.
+     *   2) Fingerprint enrollment cannot happen until the user confirms their lockscreen credential
+     *      (PIN/Pattern/Password).
+     *   3) However, the biometric subsystem does not want just "any" proof of credential
+     *      confirmation. It needs proof that the user explicitly authenticated credential in order
+     *      to allow addition of biometric enrollments.
+     * To secure this path, the following path is taken:
+     *   1) Upon user requesting fingerprint enroll, the framework requests
+     *      IFingerprint#generateChallenge
+     *   2) Framework sends the challenge to the credential subsystem, and upon credential
+     *      confirmation, a HAT is created, containing the challenge in the "challenge" field.
+     *   3) Framework sends the HAT to the HAL, e.g. ISession#enroll.
+     *   4) Implementation verifies the authenticity and integrity of the HAT.
+     *   5) Implementation now has confidence that the user entered their credential to allow
+     *      biometric enrollment.
+     *
+     * Note that the interface allows multiple in-flight challenges. For example, invoking
+     * generateChallenge(0, 0, timeoutSec, cb) twice does not invalidate the first challenge. The
+     * challenge is invalidated only when:
+     *   1) The provided timeout expires, or
+     *   2) IFingerprint#revokeChallenge is invoked
+     *
+     * For example, the following is a possible table of valid challenges:
+     * ----------------------------------------------
+     * | SensorId | UserId | ValidUntil | Challenge |
+     * |----------|--------|------------|-----------|
+     * | 0        | 0      | <Time1>    | <Random1> |
+     * | 0        | 0      | <Time2>    | <Random2> |
+     * | 1        | 0      | <Time3>    | <Random3> |
+     * | 0        | 10     | <Time4>    | <Random4> |
+     * ----------------------------------------------
+     *
+     * @param sensorId Sensor to associate the challenge with
+     * @param userId User to associate the challenge with
+     * @param timeoutSec Duration for which the challenge is valid for
+     * @param cb Callback to notify the framework
+     */
+    void generateChallenge(in int sensorId, in int userId, in int timeoutSec, in IGenerateChallengeCallback cb);
 
-    void generateChallenge(in int sensorId, in int userId, in long keystoreOperationId, in int timeoutSec, in IGenerateChallengeCallback cb);
-
-    void revokeChallenge(in int sensorId, in int userId, in IRevokeChallengeCallback cb);
+    /**
+     * revokeChallenge:
+     *
+     * Revokes a challenge that was previously generated. Note that if an invalid combination of
+     * parameters is requested, the implementation must still notify the framework using the
+     * provided callback.
+     *
+     * @param sensorId Sensor that the revocation should apply to.
+     * @param userId User that the revocation should apply to.
+     * @param challenge Challenge that should be revoked.
+     * @param cb Used to notify the framework.
+     */
+    void revokeChallenge(in int sensorId, in int userId, in long challenge, in IRevokeChallengeCallback cb);
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
index 93a2d7b..a51b188 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IGenerateChallengeCallback.aidl
@@ -18,6 +18,9 @@
 
 @VintfStability
 oneway interface IGenerateChallengeCallback {
-    void onChallengeGenerated(in int sensorId, in int userId, in long keystoreOperationId, in long challenge);
+    /**
+     * Notifies the framework when a challenge is successfully generated.
+     */
+    void onChallengeGenerated(in int sensorId, in int userId, in long challenge);
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl
deleted file mode 100644
index d97a701..0000000
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IResetLockoutCallback.aidl
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.biometrics.fingerprint;
-
-@VintfStability
-oneway interface IResetLockoutCallback {
-    void onLockoutReset(in int sensorId, in int userId, in long durationMilli);
-}
-
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IRevokeChallengeCallback.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IRevokeChallengeCallback.aidl
index cca3453..eadba52 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IRevokeChallengeCallback.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/IRevokeChallengeCallback.aidl
@@ -18,6 +18,9 @@
 
 @VintfStability
 oneway interface IRevokeChallengeCallback {
+    /**
+     * Notifies the framework when a challenge has been revoked.
+     */
     void onChallengeRevoked(in int sensorId, in int userId, in long challenge);
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
index 78da7ae..644e214 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -16,38 +16,358 @@
 
 package android.hardware.biometrics.fingerprint;
 
-import android.hardware.biometrics.fingerprint.ICancellationSignal;
+import android.hardware.biometrics.common.ICancellationSignal;
 import android.hardware.keymaster.HardwareAuthToken;
 
+/**
+ * Operations that can be performed for unique sessions retrieved via IFingerprint#createSession.
+ * Methods defined within this interface can be split into the following categories:
+ *   1) Methods associated with a state (see the SessionState enum). State-based operations are
+ *      handled by the HAL in FIFO order.
+ *   1a) Cancellable state-based operations. If a cancellable operation is in-progress and the
+ *       framework requests a subsequent state-based operation, the implementation should finish
+ *       the operation via ISessionCallback#onError with Error::CANCELED.
+ *   1b) Non-cancellable state-based operations. These operations should fully complete before the
+ *       next state-based operation can be started.
+ *   2) Methods without a state. These methods may be invoked by the framework depending on its
+ *      use case. For example on devices with sensors of FingerprintSensorType::UNDER_DISPLAY_*,
+ *      ISession#onFingerDown may be invoked while the HAL is in SessionState::ENROLLING,
+ *      SessionState::AUTHENTICATING, or SessionState::DETECTING_INTERACTION.
+ *
+ * If the HAL has multiple operations in its queue, it is not required to notify the framework
+ * of SessionState::IDLING between each operation. However, it must notify the framework when all
+ * work is completed. See ISessionCallback#onStateChanged. For example, the following is a valid
+ * sequence of ISessionCallback#onStateChanged invocations: SessionState::IDLING -->
+ * SessionState::ENROLLING --> SessionState::ENUMERATING_ENROLLMENTS --> SessionState::IDLING.
+ */
 @VintfStability
 interface ISession {
     /**
      * Methods applicable to any fingerprint type.
      */
 
+    /**
+     * enroll:
+     *
+     * A request to add a fingerprint enrollment.
+     *
+     * Once the HAL is able to start processing the enrollment request, it must notify the framework
+     * via ISessionCallback#onStateChanged with SessionState::ENROLLING.
+     *
+     * At any point during enrollment, if a non-recoverable error occurs, the HAL must notify the
+     * framework via ISessionCallback#onError with the applicable enrollment-specific error, and
+     * then send ISessionCallback#onStateChanged(cookie, SessionState::IDLING) if no subsequent
+     * operation is in the queue.
+     *
+     * Before capturing fingerprint data, the implementation must first verify the authenticity and
+     * integrity of the provided HardwareAuthToken. In addition, it must check that the challenge
+     * within the provided HardwareAuthToken is valid. See IFingerprint#generateChallenge. If any of
+     * the above checks fail, the framework must be notified via ISessionCallback#onError and the
+     * HAL must notify the framework when it returns to the idle state. See
+     * Error::UNABLE_TO_PROCESS.
+     *
+     * During enrollment, the implementation may notify the framework via
+     * ISessionCallback#onAcquired with messages that may be used to guide the user. This callback
+     * can be invoked multiple times if necessary. Similarly, the framework may be notified of
+     * enrollment progress changes via ISessionCallback#onEnrollmentProgress. Once the framework is
+     * notified that there are 0 "remaining" steps, the framework may cache the "enrollmentId". See
+     * ISessionCallback#onEnrollmentProgress for more info. The HAL must notify the framework once
+     * it returns to the idle state.
+     *
+     * When a finger is successfully added and before the framework is notified of remaining=0, the
+     * implementation MUST update and associate this (sensorId, userId) pair with a new new
+     * entropy-encoded random identifier. See ISession#getAuthenticatorId for more information.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path. The
+     *               client must guarantee that it is unique per ISession.
+     * @param hat See above documentation.
+     */
     ICancellationSignal enroll(in int cookie, in HardwareAuthToken hat);
 
-    ICancellationSignal authenticate(in int cookie, in long keystoreOperationId);
+    /**
+     * authenticate:
+     *
+     * A request to start looking for fingerprints to authenticate.
+     *
+     * Once the HAL is able to start processing the authentication request, it must notify framework
+     * via ISessionCallback#onStateChanged with SessionState::AUTHENTICATING.
+     *
+     * At any point during authentication, if a non-recoverable error occurs, the HAL must notify
+     * the framework via ISessionCallback#onError with the applicable authentication-specific error,
+     * and then send ISessionCallback#onStateChanged(cookie, SessionState::IDLING) if no
+     * subsequent operation is in the queue.
+     *
+     * During authentication, the implementation may notify the framework via
+     * ISessionCallback#onAcquired with messages that may be used to guide the user. This callback
+     * can be invoked multiple times if necessary.
+     *
+     * The HAL must notify the framework of accepts/rejects via ISessionCallback#onAuthentication*.
+     *
+     * The authentication lifecycle ends when either
+     *   1) A fingerprint is accepted, and ISessionCallback#onAuthenticationSucceeded is invoked, or
+     *   2) Any non-recoverable error occurs (such as lockout). See the full list of
+     *      authentication-specific errors in the Error enum.
+     *
+     * Note that upon successful authentication, the lockout counter for this (sensorId, userId)
+     * pair must be cleared.
+     *
+     * Note that upon successful authentication, ONLY sensors configured as SensorStrength::STRONG
+     * are allowed to create and send a HardwareAuthToken to the framework. See the Android CDD for
+     * more details. For SensorStrength::STRONG sensors, the HardwareAuthToken's "challenge" field
+     * must be set with the operationId passed in during #authenticate. If the sensor is NOT
+     * SensorStrength::STRONG, the HardwareAuthToken MUST be null.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path. The
+     *               client must guarantee that it is unique per ISession.
+     * @param operationId For sensors configured as SensorStrength::STRONG, this must be used ONLY
+     *                    upon successful authentication and wrapped in the HardwareAuthToken's
+     *                    "challenge" field and sent to the framework via
+     *                    ISessionCallback#onAuthenticated. The operationId is an opaque identifier
+     *                    created from a separate secure subsystem such as, but not limited to
+     *                    KeyStore/KeyMaster. The HardwareAuthToken can then be used as an
+     *                    attestation for the provided operation. For example, this is used
+     *                    to unlock biometric-bound auth-per-use keys (see
+     *                    setUserAuthenticationParameters in KeyGenParameterSpec.Builder and
+     *                    KeyProtection.Builder.
+     */
+    ICancellationSignal authenticate(in int cookie, in long operationId);
 
+    /**
+     * detectInteraction:
+     *
+     * A request to start looking for fingerprints without performing matching.
+     *
+     * Once the HAL is able to start processing this request, it must notify the framework via
+     * ISessionCallback#onStateChanged with SessionState::DETECTING_INTERACTION.
+     *
+     * The framework will use this method in cases where determing user presence is required, but
+     * identifying/authentication is not. For example, when the device is encrypted (first boot) or
+     * in lockdown mode.
+     *
+     * At any point during detectInteraction, if a non-recoverable error occurs, the HAL must notify
+     * the framework via ISessionCallback#onError with the applicable error, and then send
+     * ISessionCallback#onStateChanged(cookie, SessionState::IDLING) if no subsequent operation is
+     * in the queue.
+     *
+     * The implementation must only check for a fingerprint-like image was detected (e.g. to
+     * minimize interactions due to non-fingerprint objects), and the lockout counter must not
+     * be modified.
+     *
+     * Upon detecting any fingerprint, the implementation must invoke
+     * ISessionCallback#onInteractionDetected.
+     *
+     * The lifecycle of this operation ends when either
+     * 1) Any fingerprint is detected and the framework is notified via
+     *    ISessionCallback#onInteractiondetected
+     * 2) The operation was cancelled by the framework (see ICancellationSignal)
+     * 3) The HAL ends the operation, for example when a subsequent operation pre-empts this one.
+     *
+     * Note that if the operation is canceled, the implementation must notify the framework via
+     * ISessionCallback#onError with Error::CANCELED.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path.
+     *               The framework will guarantee that it is unique per ISession.
+     */
     ICancellationSignal detectInteraction(in int cookie);
 
+    /*
+     * enumerateEnrollments:
+     *
+     * A request to enumerate (list) the enrollments for this (sensorId, userId) pair. The
+     * framework typically uses this to ensure that its cache is in sync with the HAL.
+     *
+     * Once the HAL is able to start processing this request, it must notify the framework via
+     * ISessionCallback#onStateChanged with SessionState::ENUMERATING_ENROLLMENTS.
+     *
+     * The implementation must then notify the framework with a list of enrollments applicable
+     * for the current session via ISessionCallback#onEnrollmentsEnumerated.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path.
+     *               The framework will guarantee that it is unique per ISession.
+     */
     void enumerateEnrollments(in int cookie);
 
+    /**
+     * removeEnrollments:
+     *
+     * A request to remove the enrollments for this (sensorId, userId) pair.
+     *
+     * Once the HAL is able to start processing this request, it must notify the framework via
+     * ISessionCallback#onStateChanged with SessionState::REMOVING_ENROLLMENTS.
+     *
+     * After removing the enrollmentIds from everywhere necessary (filesystem, secure subsystems,
+     * etc), the implementation must notify the framework via ISessionCallback#onEnrollmentsRemoved.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path.
+     *               The framework will guarantee that it is unique per ISession.
+     */
     void removeEnrollments(in int cookie, in int[] enrollmentIds);
 
+    /**
+     * getAuthenticatorId:
+     *
+     * MUST return 0 via ISessionCallback#onAuthenticatorIdRetrieved for sensors that are configured
+     * as SensorStrength::WEAK or SensorStrength::CONVENIENCE.
+     *
+     * The following only applies to sensors that are configured as SensorStrength::STRONG.
+     *
+     * The authenticatorId is a (sensorId, user)-specific identifier which can be used during key
+     * generation and key import to to associate a key (in KeyStore / KeyMaster) with the current
+     * set of enrolled fingerprints. For example, the following public Android APIs allow for keys
+     * to be invalidated when the user adds a new enrollment after the key was created:
+     * KeyGenParameterSpec.Builder.setInvalidatedByBiometricEnrollment and
+     * KeyProtection.Builder.setInvalidatedByBiometricEnrollment.
+     *
+     * In addition, upon successful fingerprint authentication, the signed HAT that is returned to
+     * the framework via ISessionCallback#onAuthenticated must contain this identifier in the
+     * authenticatorId field.
+     *
+     * Returns an entropy-encoded random identifier associated with the current set of enrollments
+     * via ISessionCallback#onAuthenticatorIdRetrieved. The authenticatorId
+     *   1) MUST change whenever a new fingerprint is enrolled
+     *   2) MUST return 0 if no fingerprints are enrolled
+     *   3) MUST not change if a fingerprint is deleted.
+     *   4) MUST be an entropy-encoded random number
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path. The
+     *               client must guarantee that it is unique per ISession.
+     */
     void getAuthenticatorId(in int cookie);
 
-    void resetLockout(in int cookie, in HardwareAuthToken hat);
+    /**
+     * invalidateAuthenticatorId:
+     *
+     * This method only applies to sensors that are configured as SensorStrength::STRONG. If invoked
+     * by the framework for sensor of other strengths, the HAL should immediately invoke
+     * ISessionCallback#onAuthenticatorIdInvalidated.
+     *
+     * The following only applies to sensors that are configured as SensorStrength::STRONG.
+     *
+     * When invoked by the framework, the implementation must perform the following sequence of
+     * events:
+     *   1) Verify the authenticity and integrity of the provided HAT. If this check fails, the HAL
+     *      must invoke ISessionCallback#onError with Error::UNABLE_TO_PROCESS and return to
+     *      SessionState::IDLING if no subsequent work is in the queue.
+     *   2) Verify that the timestamp provided within the HAT is relatively recent (e.g. on the
+     *      order of minutes, not hours). If this check fails, the HAL must invoke
+     *      ISessionCallback#onError with Error::UNABLE_TO_PROCESS and return to
+     *      SessionState::IDLING if no subsequent work is in the queue.
+     *   3) Update the authenticatorId with a new entropy-encoded random number
+     *   4) Persist the new authenticatorId to non-ephemeral storage
+     *   5) Notify the framework that the above is completed, via
+     *      ISessionCallback#onAuthenticatorInvalidated
+     *
+     * A practical use case of invalidation would be when the user adds a new enrollment to a sensor
+     * managed by a different HAL instance. The public android.security.keystore APIs bind keys to
+     * "all biometrics" rather than "fingerprint-only" or "face-only" (see #getAuthenticatorId
+     * for more details). As such, the framework would coordinate invalidation across multiple
+     * biometric HALs as necessary.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path. The
+     *               client must guarantee that it is unique per ISession.
+     * @param hat HardwareAuthToken that must be validated before proceeding with this operation.
+     */
+    void invalidateAuthenticatorId(in int cookie, in HardwareAuthToken hat);
 
+    /**
+     * resetLockout:
+     *
+     * Requests the implementation to clear the lockout counter. Upon receiving this request, the
+     * implementation must perform the following:
+     *   1) Verify the authenticity and integrity of the provided HAT
+     *   2) Verify that the timestamp provided within the HAT is relatively recent (e.g. on the
+     *      order of minutes, not hours).
+     * If either of the checks fail, the HAL must invoke ISessionCallback#onError with
+     * Error::UNABLE_TO_PROCESS and return to SessionState::IDLING if no subsequent work is in the
+     * queue.
+     *
+     * Upon successful verification, the HAL must clear the lockout counter and notify the framework
+     * via ISessionCallback#onLockoutCleared.
+     *
+     * Note that lockout is user AND sensor specific. In other words, there is a separate lockout
+     * state for each (user, sensor) pair. For example, the following is a valid state on a
+     * multi-sensor device:
+     * ------------------------------------------------------------------
+     * | SensorId | UserId | FailedAttempts | LockedOut | LockedUntil   |
+     * |----------|--------|----------------|-----------|---------------|
+     * | 0        | 0      | 1              | false     | x             |
+     * | 1        | 0      | 5              | true      | <future_time> |
+     * | 0        | 10     | 0              | false     | x             |
+     * | 1        | 10     | 0              | false     | x             |
+     * ------------------------------------------------------------------
+     *
+     * Lockout may be cleared in the following ways:
+     *   1) ISession#resetLockout
+     *   2) After a period of time, according to a rate-limiter.
+     *
+     * Note that the "FailedAttempts" counter must be cleared upon successful fingerprint
+     * authentication. For example, if SensorId=0 UserId=0 FailedAttempts=1, and a successful
+     * fingerprint authentication occurs, the counter for that (SensorId, UserId) pair must be reset
+     * to 0.
+     *
+     * In addition, lockout states MUST persist after device reboots, HAL crashes, etc.
+     *
+     * See the Android CDD section 7.3.10 for the full set of lockout and rate-limiting
+     * requirements.
+     *
+     * @param cookie An identifier used to track subsystem operations related to this call path. The
+     *               client must guarantee that it is unique per ISession.
+     * @param hat HardwareAuthToken See above documentation.
+     */
+    void resetLockout(in int cookie, in HardwareAuthToken hat);
 
     /**
      * Methods for notifying the under-display fingerprint sensor about external events.
      */
 
+    /**
+     * onPointerDown:
+     *
+     * This method only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_*. If invoked erroneously by the framework for sensors
+     * of other types, the HAL must treat this as a no-op and return immediately.
+     *
+     * For sensors of type FingerprintSensorType::UNDER_DISPLAY_*, this method is used to notify the
+     * HAL of display touches. This method can be invoked when the session is in one of the
+     * following states: SessionState::ENROLLING, SessionState::AUTHENTICATING, or
+     * SessionState::DETECTING_INTERACTION.
+     *
+     * Note that the framework will only invoke this method if the event occurred on the display on
+     * which this sensor is located.
+     *
+     * Note that for sensors which require illumination such as
+     * FingerprintSensorType::UNDER_DISPLAY_OPTICAL, and where illumination is handled below the
+     * framework, this is a good time to start illuminating.
+     *
+     * @param pointerId See android.view.MotionEvent#getPointerId
+     * @param x The distance in pixels from the left edge of the display.
+     * @param y The distance in pixels from the top edge of the display.
+     * @param minor See android.view.MotionEvent#getTouchMinor
+     * @param major See android.view.MotionEvent#getTouchMajor
+     */
     void onPointerDown(in int pointerId, in int x, in int y, in float minor, in float major);
 
+    /**
+     * onPointerUp:
+     *
+     * This method only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_*. If invoked for sensors of other types, the HAL must
+     * treat this as a no-op and return immediately.
+     *
+     * @param pointerId See android.view.MotionEvent#getPointerId
+     */
     void onPointerUp(in int pointerId);
 
+    /*
+     * onUiReady:
+     *
+     * This method only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_OPTICAL. If invoked for sensors of other types, the HAL
+     * must treat this as a no-op and return immediately.
+     *
+     * For FingerprintSensorType::UNDER_DISPLAY_OPTICAL where illumination is handled above the
+     * HAL, the framework will invoke this method to notify that the illumination has started.
+     */
     void onUiReady();
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISessionCallback.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
index 655f030..74792d8 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISessionCallback.aidl
@@ -23,19 +23,168 @@
 
 @VintfStability
 interface ISessionCallback {
+    /**
+     * Used to notify the framework of session state changes. See ISession for more information.
+     */
     void onStateChanged(in int cookie, in SessionState state);
 
+    /**
+     * This method must only be used to notify the framework during the following states:
+     *   1) SessionState::ENROLLING
+     *   2) SessionState::AUTHENTICATING
+     *   3) SessionState::DETECTING_INTERACTION
+     *
+     * These messages may be used to provide user guidance multiple times if necessary per
+     * operation.
+     *
+     * @param info See the AcquiredInfo enum.
+     * @param vendorCode Only valid if info == AcquiredInfo::VENDOR. The vendorCode must be used to
+     *                   index into the configuration
+     *                   com.android.internal.R.array.fingerprint_acquired_vendor that's installed
+     *                   on the vendor partition.
+     */
     void onAcquired(in AcquiredInfo info, in int vendorCode);
 
+    /**
+     * This method must only be used to notify the framework during the following states:
+     *   1) SessionState::ENROLLING
+     *   2) SessionState::AUTHENTICATING
+     *   3) SessionState::DETECTING_INTERACTION
+     *   4) SessionState::INVALIDATING_AUTHENTICATOR_ID
+     *   5) SessionState::RESETTING_LOCKOUT
+     *
+     * These messages may be used to notify the framework or user that a non-recoverable error
+     * has occurred. The operation is finished, and the HAL must proceed with the next operation
+     * or return to SessionState::IDLING if the queue is empty.
+     *
+     * Note that cancellation (see common::ICancellationSignal) and preemption most be followed with
+     * an Error::CANCELED message.
+     *
+     * @param error See the Error enum.
+     * @param vendorCode Only valid if error == Error::VENDOR. The vendorCode must be used to index
+     *                   into the configuration
+     *                   com.android.internal.R.fingerprint_error_vendor that's installed on the
+     *                   vendor partition.
+     */
     void onError(in Error error, in int vendorCode);
 
-    void onEnrollmentProgress(in int enrollmentId, int remaining, int vendorCode);
+    /**
+     * This method must only be used to notify the framework during the following state:
+     *   1) SessionState::ENROLLING
+     *
+     * @param enrollmentId Unique stable identifier for the enrollment that's being added by this
+     *                     ISession#enroll invocation.
+     * @param remaining Remaining number of steps before enrollment is complete.
+     */
+    void onEnrollmentProgress(in int enrollmentId, int remaining);
 
-    void onAuthenticated(in int enrollmentId, in HardwareAuthToken hat);
+    /**
+     * This method must only be used to notify the framework during SessionState::AUTHENTICATING.
+     *
+     * Used to notify the framework upon successful authentication. Note that the authentication
+     * lifecycle ends when either 1) a fingerprint is accepted, or 2) an error occurred. The
+     * authentication lifecycle does NOT end when a fingerprint is rejected.
+     *
+     * @param enrollmentId Fingerprint that was accepted.
+     * @param hat If the sensor is configured as SensorStrength::STRONG, a non-null attestation that
+     *            a fingerprint was accepted. The HardwareAuthToken's "challenge" field must be set
+     *            with the operationId passed in during ISession#authenticate. If the sensor is NOT
+     *            SensorStrength::STRONG, the HardwareAuthToken MUST be null.
+     */
+    void onAuthenticationSucceeded(in int enrollmentId, in HardwareAuthToken hat);
 
+    /**
+     * This method must only be used to notify the framework during SessionState::AUTHENTICATING.
+     *
+     * Used to notify the framework upon rejected attempts. Note that the authentication
+     * lifecycle ends when either 1) a fingerprint is accepted, or 2) an occurred. The
+     * authentication lifecycle does NOT end when a fingerprint is rejected.
+     */
+    void onAuthenticationFailed();
+
+    /**
+     * This method must only be used to notify the framework during SessionState::AUTHENTICATING.
+     *
+     * Authentication is locked out due to too many unsuccessful attempts. This is a rate-limiting
+     * lockout, and authentication can be restarted after a period of time. See
+     * ISession#resetLockout.
+     *
+     * @param sensorId Sensor for which the user is locked out.
+     * @param userId User for which the sensor is locked out.
+     * @param durationMillis Remaining duration of the lockout.
+     */
+    void onLockoutTimed(in long durationMillis);
+
+    /**
+     * This method must only be used to notify the framework during SessionState::AUTHENTICATING.
+     *
+     * Authentication is disabled until the user unlocks with their device credential
+     * (PIN/Pattern/Password). See ISession#resetLockout.
+     *
+     * @param sensorId Sensor for which the user is locked out.
+     * @param userId User for which the sensor is locked out.
+     */
+    void onLockoutPermanent();
+
+    /**
+     * Notifies the framework that lockout has been cleared for this (sensorId, userId) pair.
+     *
+     * Note that this method can be used to notify the framework during any state.
+     *
+     * Lockout can be cleared in the following scenarios:
+     * 1) A timed lockout has ended (e.g. durationMillis specified in previous #onLockoutTimed
+     *    has expired.
+     * 2) See ISession#resetLockout.
+     *
+     * @param sensorId Sensor for which the user's lockout is cleared.
+     * @param userId User for the sensor's lockout is cleared.
+     */
+    void onLockoutCleared();
+
+    /**
+     * This method must only be used to notify the framework during
+     * SessionState::DETECTING_INTERACTION
+     *
+     * Notifies the framework that user interaction occurred. See ISession#detectInteraction.
+     */
     void onInteractionDetected();
 
+    /**
+     * This method must only be used to notify the framework during
+     * SessionState::ENUMERATING_ENROLLMENTS.
+     *
+     * Notifies the framework of the current enrollments. See ISession#enumerateEnrollments.
+     *
+     * @param enrollmentIds A list of enrollments for the session's (userId, sensorId) pair.
+     */
     void onEnrollmentsEnumerated(in int[] enrollmentIds);
 
+    /**
+     * This method must only be used to notify the framework during
+     * SessionState::REMOVING_ENROLLMENTS.
+     *
+     * Notifies the framework that the specified enrollments are removed.
+     *
+     * @param enrollmentIds The enrollments that were removed.
+     */
     void onEnrollmentsRemoved(in int[] enrollmentIds);
+
+    /**
+     * This method must only be used to notify the framework during
+     * SessionState::GETTING_AUTHENTICATOR_ID.
+     *
+     * Notifies the framework with the authenticatorId corresponding to this session's
+     * (userId, sensorId) pair.
+     *
+     * @param authenticatorId See the above documentation.
+     */
+    void onAuthenticatorIdRetrieved(in long authenticatorId);
+
+    /**
+     * This method must only be used to notify the framework during
+     * SessionState::INVALIDATING_AUTHENTICATOR_ID.
+     *
+     * See ISession#invalidateAuthenticatorId for more information.
+     */
+    void onAuthenticatorIdInvalidated();
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
index bbb1ecb6..ab70a58 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
@@ -16,14 +16,52 @@
 
 package android.hardware.biometrics.fingerprint;
 
-import android.hardware.biometrics.fingerprint.SensorType;
+import android.hardware.biometrics.common.CommonProps;
+import android.hardware.biometrics.fingerprint.FingerprintSensorType;
 
 @VintfStability
 parcelable SensorProps {
-    int sensorId;
+    /**
+     * Statically configured properties that apply to this fingerprint sensor.
+     */
+    CommonProps commonProps;
 
-    SensorType sensorType;
+    /**
+     * A statically configured sensor type representing this fingerprint sensor.
+     */
+    FingerprintSensorType sensorType;
 
-    boolean resetLockoutRequiresHardwareAuthToken;
+    /**
+     * Must be set to true for sensors that support "swipe" gestures via
+     * android.view.KeyEvent#KEYCODE_SYSTEM_NAVIGATION_*.
+     */
+    boolean supportsNavigationGestures;
+
+    /**
+     * The location of the center of the sensor if applicable. For example, sensors of
+     * FingerprintSensorType::UNDER_DISPLAY_* would report this value as the distance in pixels,
+     * measured from the left edge of the screen.
+     */
+    int sensorLocationX;
+
+    /**
+     * The location of the center of the sensor if applicable. For example, sensors of
+     * FingerprintSensorType::UNDER_DISPLAY_* would report this value as the distance in pixels,
+     * measured from the top edge of the screen.
+     */
+    int sensorLocationY;
+
+    /**
+     * The radius of the sensor if applicable. For example, sensors of
+     * FingerprintSensorType::UNDER_DISPLAY_* would report this value as the radius of the sensor,
+     * in pixels.
+     */
+    int sensorRadius;
+
+    /**
+     * For sensors of FingerprintSensorType::UNDER_DISPLAY_*, this must correspond to the
+     * android.hardware.DisplayManager#getDisplay Android API.
+     */
+    int displayId;
 }
 
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SessionState.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SessionState.aidl
index 3b4ba18..405b011 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SessionState.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SessionState.aidl
@@ -19,13 +19,49 @@
 @VintfStability
 @Backing(type="byte")
 enum SessionState {
+    /**
+     * The HAL is not processing any session requests.
+     */
     IDLING,
+
+    /**
+     * The HAL is processing the ISession#enroll request.
+     */
     ENROLLING,
+
+    /**
+     * The HAL is processing the ISession#authenticate request.
+     */
     AUTHENTICATING,
+
+    /**
+     * The HAL is processing the ISession#detectInteraction request.
+     */
     DETECTING_INTERACTION,
+
+    /**
+     * The HAL is processing the ISession#enumerateEnrollments request.
+     */
     ENUMERATING_ENROLLMENTS,
+
+    /**
+     * The HAL is processing the ISession#removeEnrollments request.
+     */
     REMOVING_ENROLLMENTS,
+
+    /**
+     * The HAL is processing the ISession#getAuthenticatorId request.
+     */
     GETTING_AUTHENTICATOR_ID,
+
+    /**
+     * The HAL is processing the ISession#invalidateAuthenticatorId request.
+     */
+    INVALIDATING_AUTHENTICATOR_ID,
+
+    /**
+     * The HAL is processing the ISession#resetLockout request.
+     */
     RESETTING_LOCKOUT
 }
 
diff --git a/biometrics/fingerprint/aidl/default/Android.bp b/biometrics/fingerprint/aidl/default/Android.bp
index f2536d4..ce1ff59 100644
--- a/biometrics/fingerprint/aidl/default/Android.bp
+++ b/biometrics/fingerprint/aidl/default/Android.bp
@@ -8,6 +8,7 @@
         "libbase",
         "libbinder_ndk",
         "android.hardware.biometrics.fingerprint-ndk_platform",
+        "android.hardware.biometrics.common-unstable-ndk_platform",
     ],
     srcs: [
         "main.cpp",
diff --git a/biometrics/fingerprint/aidl/default/Fingerprint.cpp b/biometrics/fingerprint/aidl/default/Fingerprint.cpp
index 6f9e3a0..b907bf1 100644
--- a/biometrics/fingerprint/aidl/default/Fingerprint.cpp
+++ b/biometrics/fingerprint/aidl/default/Fingerprint.cpp
@@ -19,7 +19,38 @@
 
 namespace aidl::android::hardware::biometrics::fingerprint {
 
-ndk::ScopedAStatus Fingerprint::getSensorProps(std::vector<SensorProps>* /*return_val*/) {
+const int kSensorId = 0;
+const common::SensorStrength kSensorStrength = common::SensorStrength::STRONG;
+const int kMaxEnrollmentsPerUser = 5;
+const FingerprintSensorType kSensorType = FingerprintSensorType::REAR;
+const bool kSupportsNavigationGestures = true;
+const std::string kHwDeviceName = "fingerprintSensor";
+const std::string kHardwareVersion = "vendor/model/revision";
+const std::string kFirmwareVersion = "1.01";
+const std::string kSerialNumber = "00000001";
+
+ndk::ScopedAStatus Fingerprint::getSensorProps(std::vector<SensorProps>* return_val) {
+    *return_val = std::vector<SensorProps>();
+
+    std::vector<common::HardwareInfo> hardwareInfos = std::vector<common::HardwareInfo>();
+    common::HardwareInfo sensorInfo = {kHwDeviceName,
+            kHardwareVersion,
+            kFirmwareVersion,
+            kSerialNumber
+    };
+    hardwareInfos.push_back(sensorInfo);
+    common::CommonProps commonProps = {kSensorId,
+            kSensorStrength,
+            kMaxEnrollmentsPerUser,
+            hardwareInfos};
+    SensorProps props = {commonProps,
+            kSensorType,
+            kSupportsNavigationGestures,
+            0 /* sensorLocationX */,
+            0 /* sensorLocationY */,
+            0 /* sensorRadius */,
+            0 /* displayId */};
+    return_val->push_back(props);
     return ndk::ScopedAStatus::ok();
 }
 
@@ -30,19 +61,14 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus Fingerprint::setResetLockoutCallback(
-        const std::shared_ptr<IResetLockoutCallback>& /*cb*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus Fingerprint::generateChallenge(
-        int32_t /*sensorId*/, int32_t /*userId*/, int64_t /*keystoreOperationId*/,
-        int32_t /*timeoutSec*/, const std::shared_ptr<IGenerateChallengeCallback>& /*cb*/) {
+        int32_t /*sensorId*/, int32_t /*userId*/, int32_t /*timeoutSec*/,
+        const std::shared_ptr<IGenerateChallengeCallback>& /*cb*/) {
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus Fingerprint::revokeChallenge(
-        int32_t /*sensorId*/, int32_t /*userId*/,
+        int32_t /*sensorId*/, int32_t /*userId*/, int64_t /*challenge*/,
         const std::shared_ptr<IRevokeChallengeCallback>& /*cb*/) {
     return ndk::ScopedAStatus::ok();
 }
diff --git a/biometrics/fingerprint/aidl/default/Fingerprint.h b/biometrics/fingerprint/aidl/default/Fingerprint.h
index 9f04893..59cdd44 100644
--- a/biometrics/fingerprint/aidl/default/Fingerprint.h
+++ b/biometrics/fingerprint/aidl/default/Fingerprint.h
@@ -28,15 +28,12 @@
                                      const std::shared_ptr<ISessionCallback>& cb,
                                      std::shared_ptr<ISession>* _aidl_return) override;
 
-    ndk::ScopedAStatus setResetLockoutCallback(
-            const std::shared_ptr<IResetLockoutCallback>& cb) override;
-
     ndk::ScopedAStatus generateChallenge(
-            int32_t sensorId, int32_t userId, int64_t keystoreOperationId, int32_t timeoutSec,
+            int32_t sensorId, int32_t userId, int32_t timeoutSec,
             const std::shared_ptr<IGenerateChallengeCallback>& cb) override;
 
     ndk::ScopedAStatus revokeChallenge(
-            int32_t sensorId, int32_t userId,
+            int32_t sensorId, int32_t userId, int64_t challenge,
             const std::shared_ptr<IRevokeChallengeCallback>& cb) override;
 };
 
diff --git a/biometrics/fingerprint/aidl/default/Session.cpp b/biometrics/fingerprint/aidl/default/Session.cpp
index 5eb3134..c2934a8 100644
--- a/biometrics/fingerprint/aidl/default/Session.cpp
+++ b/biometrics/fingerprint/aidl/default/Session.cpp
@@ -14,13 +14,13 @@
  * limitations under the License.
  */
 
-#include <aidl/android/hardware/biometrics/fingerprint/BnCancellationSignal.h>
+#include <aidl/android/hardware/biometrics/common/BnCancellationSignal.h>
 
 #include "Session.h"
 
 namespace aidl::android::hardware::biometrics::fingerprint {
 
-class CancellationSignal : public BnCancellationSignal {
+class CancellationSignal : public common::BnCancellationSignal {
   public:
     ndk::ScopedAStatus cancel() override { return ndk::ScopedAStatus::ok(); }
 };
@@ -28,12 +28,12 @@
 Session::Session(std::shared_ptr<ISessionCallback> cb) : cb_(std::move(cb)) {}
 
 ndk::ScopedAStatus Session::enroll(int32_t /*cookie*/, const keymaster::HardwareAuthToken& /*hat*/,
-                                   std::shared_ptr<ICancellationSignal>* /*return_val*/) {
+                                   std::shared_ptr<common::ICancellationSignal>* /*return_val*/) {
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus Session::authenticate(int32_t /*cookie*/, int64_t /*keystoreOperationId*/,
-                                         std::shared_ptr<ICancellationSignal>* return_val) {
+                                         std::shared_ptr<common::ICancellationSignal>* return_val) {
     if (cb_) {
         cb_->onStateChanged(0, SessionState::AUTHENTICATING);
     }
@@ -42,7 +42,7 @@
 }
 
 ndk::ScopedAStatus Session::detectInteraction(
-        int32_t /*cookie*/, std::shared_ptr<ICancellationSignal>* /*return_val*/) {
+        int32_t /*cookie*/, std::shared_ptr<common::ICancellationSignal>* /*return_val*/) {
     return ndk::ScopedAStatus::ok();
 }
 
@@ -59,6 +59,11 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus Session::invalidateAuthenticatorId(int32_t /*cookie*/,
+                                        const keymaster::HardwareAuthToken& /*hat*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus Session::resetLockout(int32_t /*cookie*/,
                                          const keymaster::HardwareAuthToken& /*hat*/) {
     return ndk::ScopedAStatus::ok();
diff --git a/biometrics/fingerprint/aidl/default/Session.h b/biometrics/fingerprint/aidl/default/Session.h
index 69950fb..f7cba1b 100644
--- a/biometrics/fingerprint/aidl/default/Session.h
+++ b/biometrics/fingerprint/aidl/default/Session.h
@@ -21,20 +21,21 @@
 
 namespace aidl::android::hardware::biometrics::fingerprint {
 
-namespace aidl::android::hardware::keymaster = keymaster;
+namespace common = aidl::android::hardware::biometrics::common;
+namespace keymaster = aidl::android::hardware::keymaster;
 
 class Session : public BnSession {
   public:
     explicit Session(std::shared_ptr<ISessionCallback> cb);
 
     ndk::ScopedAStatus enroll(int32_t cookie, const keymaster::HardwareAuthToken& hat,
-                              std::shared_ptr<ICancellationSignal>* return_val) override;
+                              std::shared_ptr<common::ICancellationSignal>* return_val) override;
 
     ndk::ScopedAStatus authenticate(int32_t cookie, int64_t keystoreOperationId,
-                                    std::shared_ptr<ICancellationSignal>* return_val) override;
+                                    std::shared_ptr<common::ICancellationSignal>* return_val) override;
 
     ndk::ScopedAStatus detectInteraction(int32_t cookie,
-                                         std::shared_ptr<ICancellationSignal>* return_val) override;
+                                         std::shared_ptr<common::ICancellationSignal>* return_val) override;
 
     ndk::ScopedAStatus enumerateEnrollments(int32_t cookie) override;
 
@@ -43,6 +44,9 @@
 
     ndk::ScopedAStatus getAuthenticatorId(int32_t cookie) override;
 
+    ndk::ScopedAStatus invalidateAuthenticatorId(int32_t cookie,
+                                    const keymaster::HardwareAuthToken& hat) override;
+
     ndk::ScopedAStatus resetLockout(int32_t cookie,
                                     const keymaster::HardwareAuthToken& hat) override;
 
diff --git a/biometrics/fingerprint/aidl/default/main.cpp b/biometrics/fingerprint/aidl/default/main.cpp
index 058a008..4690d73 100644
--- a/biometrics/fingerprint/aidl/default/main.cpp
+++ b/biometrics/fingerprint/aidl/default/main.cpp
@@ -23,6 +23,7 @@
 using aidl::android::hardware::biometrics::fingerprint::Fingerprint;
 
 int main() {
+    LOG(INFO) << "Fingerprint HAL started";
     ABinderProcess_setThreadPoolMaxThreadCount(0);
     std::shared_ptr<Fingerprint> hal = ndk::SharedRefBase::make<Fingerprint>();
 
diff --git a/biometrics/fingerprint/aidl/vts/VtsHalBiometricsFingerprintTargetTest.cpp b/biometrics/fingerprint/aidl/vts/VtsHalBiometricsFingerprintTargetTest.cpp
index 88980bf..496badc 100644
--- a/biometrics/fingerprint/aidl/vts/VtsHalBiometricsFingerprintTargetTest.cpp
+++ b/biometrics/fingerprint/aidl/vts/VtsHalBiometricsFingerprintTargetTest.cpp
@@ -60,16 +60,32 @@
         return ndk::ScopedAStatus::ok();
     }
 
-    ndk::ScopedAStatus onEnrollmentProgress(int32_t /*enrollmentId*/, int32_t /*remaining*/,
-                                            int32_t /*vendorCode*/) override {
+    ndk::ScopedAStatus onEnrollmentProgress(int32_t /*enrollmentId*/,
+                                            int32_t /*remaining*/) override {
         return ndk::ScopedAStatus::ok();
     }
 
-    ndk::ScopedAStatus onAuthenticated(int32_t /*enrollmentId*/,
+    ndk::ScopedAStatus onAuthenticationSucceeded(int32_t /*enrollmentId*/,
                                        const keymaster::HardwareAuthToken& /*hat*/) override {
         return ndk::ScopedAStatus::ok();
     }
 
+    ndk::ScopedAStatus onAuthenticationFailed() override {
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus onLockoutTimed(int64_t /*durationMillis*/) override {
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus onLockoutPermanent() override {
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus onLockoutCleared() override {
+        return ndk::ScopedAStatus::ok();
+    }
+
     ndk::ScopedAStatus onInteractionDetected() override { return ndk::ScopedAStatus::ok(); }
 
     ndk::ScopedAStatus onEnrollmentsEnumerated(
@@ -82,6 +98,14 @@
         return ndk::ScopedAStatus::ok();
     }
 
+    ndk::ScopedAStatus onAuthenticatorIdRetrieved(int64_t /*authenticatorId*/) override {
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus onAuthenticatorIdInvalidated() override {
+        return ndk::ScopedAStatus::ok();
+    }
+
   private:
     std::promise<SessionCallbackInvocation> invocation_promise_;
 };
@@ -106,7 +130,7 @@
     std::shared_ptr<ISession> session;
     ASSERT_TRUE(hal_->createSession(kSensorId, kUserId, session_cb, &session).isOk());
 
-    std::shared_ptr<ICancellationSignal> cancel_cb;
+    std::shared_ptr<common::ICancellationSignal> cancel_cb;
     ASSERT_TRUE(session->authenticate(0, 0, &cancel_cb).isOk());
     ASSERT_EQ(invocation_future.wait_for(kCallbackTimeout), std::future_status::ready);
 
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 832c419..aa5c48f 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -1670,7 +1670,7 @@
     Return<void> ret;
     ::android::sp<ICameraDevice> device3_x;
     bool retVal = false;
-    if (getCameraDeviceVersion(mProviderType, name) == CAMERA_DEVICE_API_VERSION_1_0) {
+    if (getCameraDeviceVersion(name, mProviderType) == CAMERA_DEVICE_API_VERSION_1_0) {
         return false;
     }
     ret = provider->getCameraDeviceInterface_V3_x(name, [&](auto status, const auto& device) {
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/SynchronizedReadWrite.aidl
similarity index 90%
copy from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/SynchronizedReadWrite.aidl
index 6f3d2db..aec3d6d 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/SynchronizedReadWrite.aidl
@@ -15,8 +15,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.common;
 @VintfStability
-interface ICancellationSignal {
-  oneway void cancel();
+enum SynchronizedReadWrite {
+  EMPTY = 0,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/UnsynchronizedWrite.aidl
similarity index 90%
copy from biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/UnsynchronizedWrite.aidl
index 6f3d2db..e390d20 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/common/aidl/aidl_api/android.hardware.common/current/android/hardware/common/UnsynchronizedWrite.aidl
@@ -15,8 +15,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.common;
 @VintfStability
-interface ICancellationSignal {
-  oneway void cancel();
+enum UnsynchronizedWrite {
+  EMPTY = 0,
 }
diff --git a/common/aidl/android/hardware/common/MQDescriptor.aidl b/common/aidl/android/hardware/common/MQDescriptor.aidl
index 8997688..7e89b15 100644
--- a/common/aidl/android/hardware/common/MQDescriptor.aidl
+++ b/common/aidl/android/hardware/common/MQDescriptor.aidl
@@ -22,9 +22,12 @@
  * For use with libfmq. This is created from an instance of AidlMessageQueue,
  * and is used to pass information required to create another instance of that
  * queue for fast communication.
+ * T - is used to specify the type of the payload
+ * Flavor - is used to specify the type of the queue using
+ * android.hardware.common.SynchronizedReadWrite or UnsynchronizedWrite
  */
 @VintfStability
-parcelable MQDescriptor {
+parcelable MQDescriptor<T, Flavor> {
     /*
      * Describes each of the grantors for the message queue. They are used to
      * get the readptr, writeptr, dataptr, and the optional EventFlag word
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/common/aidl/android/hardware/common/SynchronizedReadWrite.aidl
similarity index 62%
copy from biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to common/aidl/android/hardware/common/SynchronizedReadWrite.aidl
index abfbb2a..ef93bf2 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/common/aidl/android/hardware/common/SynchronizedReadWrite.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright 2020 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,10 +14,14 @@
  * limitations under the License.
  */
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.common;
 
+/*
+ * For use with android.hardware.common.MQDescriptor to specify which type of
+ * queue to use. SynchronizedReadWrite is single reader, single writer, with no
+ * overflow. All messages written need to be read.
+ */
 @VintfStability
-oneway interface ICancellationSignal {
-    void cancel();
+enum SynchronizedReadWrite {
+    EMPTY,
 }
-
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/common/aidl/android/hardware/common/UnsynchronizedWrite.aidl
similarity index 61%
copy from biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to common/aidl/android/hardware/common/UnsynchronizedWrite.aidl
index abfbb2a..aa27c8d 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/common/aidl/android/hardware/common/UnsynchronizedWrite.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright 2020 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,10 +14,14 @@
  * limitations under the License.
  */
 
-package android.hardware.biometrics.fingerprint;
+package android.hardware.common;
 
+/*
+ * For use with android.hardware.common.MQDescriptor to specify which type of
+ * queue to use. UnsynchronizedWrite is single writer, multiple reader, with
+ * overflow. If messages are not read fast enough, they can be overwritten.
+ */
 @VintfStability
-oneway interface ICancellationSignal {
-    void cancel();
+enum UnsynchronizedWrite {
+    EMPTY,
 }
-
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index 9d4e55c..d22aa68 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -98,7 +98,6 @@
         "compatibility_matrix.current.xml",
     ],
     kernel_configs: [
-        "kernel_config_current_4.14",
         "kernel_config_current_4.19",
         "kernel_config_current_5.4",
     ],
diff --git a/compatibility_matrices/compatibility_matrix.4.xml b/compatibility_matrices/compatibility_matrix.4.xml
index e5e012c..5e1266e 100644
--- a/compatibility_matrices/compatibility_matrix.4.xml
+++ b/compatibility_matrices/compatibility_matrix.4.xml
@@ -432,6 +432,7 @@
     <hal format="hidl" optional="true">
         <name>android.hardware.tv.cec</name>
         <version>1.0</version>
+        <version>2.0</version>
         <interface>
             <name>IHdmiCec</name>
             <instance>default</instance>
diff --git a/compatibility_matrices/compatibility_matrix.5.xml b/compatibility_matrices/compatibility_matrix.5.xml
index e772b6f..8bc663d 100644
--- a/compatibility_matrices/compatibility_matrix.5.xml
+++ b/compatibility_matrices/compatibility_matrix.5.xml
@@ -467,6 +467,7 @@
     <hal format="hidl" optional="true">
         <name>android.hardware.tv.cec</name>
         <version>1.0</version>
+        <version>2.0</version>
         <interface>
             <name>IHdmiCec</name>
             <instance>default</instance>
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index cfd6d1c..bb26bd3 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -9,7 +9,9 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.audio</name>
+        <!-- TODO(b/142480271): remove 6.0 when implemented on reference device. -->
         <version>6.0</version>
+        <version>7.0</version>
         <interface>
             <name>IDevicesFactory</name>
             <instance>default</instance>
@@ -17,7 +19,9 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.audio.effect</name>
+        <!-- TODO(b/142480271): remove 6.0 when implemented on reference device. -->
         <version>6.0</version>
+        <version>7.0</version>
         <interface>
             <name>IEffectsFactory</name>
             <instance>default</instance>
@@ -473,6 +477,7 @@
     <hal format="hidl" optional="true">
         <name>android.hardware.tv.cec</name>
         <version>1.0</version>
+        <version>2.0</version>
         <interface>
             <name>IHdmiCec</name>
             <instance>default</instance>
diff --git a/compatibility_matrices/exclude/Android.bp b/compatibility_matrices/exclude/Android.bp
new file mode 100644
index 0000000..d7bf635
--- /dev/null
+++ b/compatibility_matrices/exclude/Android.bp
@@ -0,0 +1,30 @@
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_library_host_static {
+    name: "libvintf_fcm_exclude",
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+    static_libs: [
+        "libbase",
+    ],
+    export_include_dirs: [
+        "include",
+    ],
+    srcs: [
+        "fcm_exclude.cpp",
+    ],
+}
diff --git a/compatibility_matrices/exclude/fcm_exclude.cpp b/compatibility_matrices/exclude/fcm_exclude.cpp
new file mode 100644
index 0000000..20b7281
--- /dev/null
+++ b/compatibility_matrices/exclude/fcm_exclude.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+#include <vector>
+
+#include <android-base/strings.h>
+#include <vintf/fcm_exclude.h>
+
+namespace android::vintf::details {
+
+// The predicate to VintfObject::checkMissingHalsInMatrices.
+bool ShouldCheckMissingHalsInFcm(const std::string& package) {
+    using std::placeholders::_1;
+
+    static std::vector<std::string> included_prefixes{
+            // Other AOSP HALs (e.g. android.frameworks.*) are not added because only framework
+            // matrix is checked.
+            "android.hardware.",
+    };
+
+    static std::vector<std::string> excluded_prefixes{
+            // Packages without top level interfaces (including types-only packages) are exempted.
+            "android.hardware.camera.device@",
+            "android.hardware.gnss.measurement_corrections@1.",
+            "android.hardware.graphics.bufferqueue@",
+
+            // Test packages are exempted.
+            "android.hardware.tests.",
+    };
+
+    static std::vector<std::string> excluded_exact{
+            // Packages without top level interfaces (including types-only packages) are exempted.
+            // HIDL
+            "android.hardware.cas.native@1.0",
+            "android.hardware.gnss.visibility_control@1.0",
+            "android.hardware.media.bufferpool@1.0",
+            "android.hardware.media.bufferpool@2.0",
+            "android.hardware.radio.config@1.2",
+            // AIDL
+            "android.hardware.biometrics.common",
+            "android.hardware.common",
+            "android.hardware.graphics.common",
+            "android.hardware.keymaster",
+
+            // Fastboot HAL is only used by recovery. Recovery is owned by OEM. Framework
+            // does not depend on this HAL, hence it is not declared in any manifests or matrices.
+            "android.hardware.fastboot@1.0",
+    };
+
+    auto package_has_prefix = [&](const std::string& prefix) {
+        return android::base::StartsWith(package, prefix);
+    };
+
+    // Only check packageAndVersions that are in the include list and not in the exclude list.
+    if (!std::any_of(included_prefixes.begin(), included_prefixes.end(), package_has_prefix)) {
+        return false;
+    }
+
+    if (std::find(excluded_exact.begin(), excluded_exact.end(), package) != excluded_exact.end()) {
+        return false;
+    }
+
+    return !std::any_of(excluded_prefixes.begin(), excluded_prefixes.end(), package_has_prefix);
+}
+
+}  // namespace android::vintf::details
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl b/compatibility_matrices/exclude/include/vintf/fcm_exclude.h
similarity index 60%
copy from biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
copy to compatibility_matrices/exclude/include/vintf/fcm_exclude.h
index abfbb2a..f74c217 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ICancellationSignal.aidl
+++ b/compatibility_matrices/exclude/include/vintf/fcm_exclude.h
@@ -14,10 +14,17 @@
  * limitations under the License.
  */
 
-package android.hardware.biometrics.fingerprint;
+#pragma once
 
-@VintfStability
-oneway interface ICancellationSignal {
-    void cancel();
-}
+#include <string>
+#include <vector>
 
+namespace android::vintf::details {
+
+// Determine whether VINTF checks |package| is missing from FCMs.
+// |package| can be a HIDL package and version like
+// "android.hardware.foo@1.0", or an AIDL package name like
+// "android.hardware.foo".
+bool ShouldCheckMissingHalsInFcm(const std::string& package);
+
+}  // namespace android::vintf::details
diff --git a/current.txt b/current.txt
index b929f7d..9c5091b 100644
--- a/current.txt
+++ b/current.txt
@@ -780,3 +780,4 @@
 57d183b10b13ec0a8e542c0b3d61991ae541c60e85dbbc5499bb21dfd068cbb8 android.hardware.wifi.supplicant@1.4::types
 17818b6b1952a75e4364ae82c534b9d2f5c0a9765a56256b16faa5a5cf45d3a8 android.hardware.wifi.supplicant@1.4::ISupplicant
 8342b5f6ec8f48ad2b741128aede010995d0b5709257b7ec09bb469b4f61ef1a android.hardware.wifi.supplicant@1.4::ISupplicantStaIface
+6f969b191f0b699ceab0573548f1ac505853e56e704711edc51b51976d4f87ad android.hardware.wifi.supplicant@1.4::ISupplicantStaNetwork
diff --git a/graphics/composer/2.2/vts/functional/Android.bp b/graphics/composer/2.2/vts/functional/Android.bp
index d80845f..16e9138 100644
--- a/graphics/composer/2.2/vts/functional/Android.bp
+++ b/graphics/composer/2.2/vts/functional/Android.bp
@@ -16,7 +16,11 @@
 
 cc_test {
     name: "VtsHalGraphicsComposerV2_2TargetTest",
-    defaults: ["VtsHalTargetTestDefaults"],
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        // Needed for librenderengine
+        "skia_deps",
+    ],
     srcs: [
         "VtsHalGraphicsComposerV2_2ReadbackTest.cpp",
         "VtsHalGraphicsComposerV2_2TargetTest.cpp",
diff --git a/health/2.1/vts/functional/VtsHalHealthV2_1TargetTest.cpp b/health/2.1/vts/functional/VtsHalHealthV2_1TargetTest.cpp
index 43e6cdc..d0b0d60 100644
--- a/health/2.1/vts/functional/VtsHalHealthV2_1TargetTest.cpp
+++ b/health/2.1/vts/functional/VtsHalHealthV2_1TargetTest.cpp
@@ -233,7 +233,7 @@
         ASSERT_EQ(Result::SUCCESS, result);
 
         EXPECT_TRUE(IsEnum(value.batteryCapacityLevel)) << " BatteryCapacityLevel";
-        EXPECT_GE(value.batteryChargeTimeToFullNowSeconds, 0);
+        EXPECT_GE(value.batteryChargeTimeToFullNowSeconds, -1);
 
         EXPECT_GE(value.batteryFullChargeDesignCapacityUah, 0)
                 << "batteryFullChargeDesignCapacityUah should not be negative";
diff --git a/radio/1.4/vts/functional/AndroidTest.xml b/radio/1.4/vts/functional/AndroidTest.xml
index 9df8f9c..469e103 100644
--- a/radio/1.4/vts/functional/AndroidTest.xml
+++ b/radio/1.4/vts/functional/AndroidTest.xml
@@ -13,7 +13,7 @@
      See the License for the specific language governing permissions and
      limitations under the License.
 -->
-<configuration description="Runs VtsHalRadioV1_3TargetTest.">
+<configuration description="Runs VtsHalRadioV1_4TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
 
@@ -24,11 +24,11 @@
 
     <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
         <option name="cleanup" value="true" />
-        <option name="push" value="VtsHalRadioV1_3TargetTest->/data/local/tmp/VtsHalRadioV1_3TargetTest" />
+        <option name="push" value="VtsHalRadioV1_4TargetTest->/data/local/tmp/VtsHalRadioV1_4TargetTest" />
     </target_preparer>
 
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
-        <option name="module-name" value="VtsHalRadioV1_3TargetTest" />
+        <option name="module-name" value="VtsHalRadioV1_4TargetTest" />
     </test>
 </configuration>
diff --git a/tests/msgq/1.0/ITestMsgQ.hal b/tests/msgq/1.0/ITestMsgQ.hal
index 112270a..bd10237 100644
--- a/tests/msgq/1.0/ITestMsgQ.hal
+++ b/tests/msgq/1.0/ITestMsgQ.hal
@@ -31,7 +31,7 @@
      *
      * @return ret True if the setup is successful.
      */
-    configureFmqSyncReadWrite(fmq_sync<uint16_t> mqDesc) generates(bool ret);
+    configureFmqSyncReadWrite(fmq_sync<int32_t> mqDesc) generates(bool ret);
 
     /**
      * This method requests the service to return an MQDescriptor to
@@ -46,7 +46,7 @@
      * @return mqDesc This structure describes the unsynchronized FMQ that was
      * set up by the service. Client can use it to set up the FMQ at its end.
      */
-    getFmqUnsyncWrite(bool configureFmq) generates(bool ret, fmq_unsync<uint16_t> mqDesc);
+    getFmqUnsyncWrite(bool configureFmq) generates(bool ret, fmq_unsync<int32_t> mqDesc);
 
     /**
      * This method request the service to write into the synchronized read/write
diff --git a/tests/msgq/1.0/default/TestMsgQ.cpp b/tests/msgq/1.0/default/TestMsgQ.cpp
index ba665c9..4473737 100644
--- a/tests/msgq/1.0/default/TestMsgQ.cpp
+++ b/tests/msgq/1.0/default/TestMsgQ.cpp
@@ -25,7 +25,7 @@
 
 // Methods from ::android::hardware::tests::msgq::V1_0::ITestMsgQ follow.
 Return<bool> TestMsgQ::configureFmqSyncReadWrite(
-    const android::hardware::MQDescriptorSync<uint16_t>& mqDesc) {
+        const android::hardware::MQDescriptorSync<int32_t>& mqDesc) {
     mFmqSynchronized.reset(new (std::nothrow) MessageQueueSync(mqDesc));
     if ((mFmqSynchronized == nullptr) || (mFmqSynchronized->isValid() == false)) {
         return false;
@@ -56,7 +56,7 @@
 }
 
 Return<bool> TestMsgQ::requestWriteFmqSync(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     for (int i = 0; i < count; i++) {
         data[i] = i;
     }
@@ -65,14 +65,14 @@
 }
 
 Return<bool> TestMsgQ::requestReadFmqSync(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     bool result = mFmqSynchronized->read(&data[0], count)
             && verifyData(&data[0], count);
     return result;
 }
 
 Return<bool> TestMsgQ::requestWriteFmqUnsync(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     for (int i = 0; i < count; i++) {
         data[i] = i;
     }
@@ -81,14 +81,14 @@
 }
 
 Return<bool> TestMsgQ::requestReadFmqUnsync(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     bool result =
             mFmqUnsynchronized->read(&data[0], count) && verifyData(&data[0], count);
     return result;
 }
 
 Return<void> TestMsgQ::requestBlockingRead(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     bool result = mFmqSynchronized->readBlocking(
             &data[0],
             count,
@@ -103,7 +103,7 @@
 }
 
 Return<void> TestMsgQ::requestBlockingReadDefaultEventFlagBits(int32_t count) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     bool result = mFmqSynchronized->readBlocking(
             &data[0],
             count);
@@ -116,7 +116,7 @@
 }
 
 Return<void> TestMsgQ::requestBlockingReadRepeat(int32_t count, int32_t numIter) {
-    std::vector<uint16_t> data(count);
+    std::vector<int32_t> data(count);
     for (int i = 0; i < numIter; i++) {
         bool result = mFmqSynchronized->readBlocking(
                 &data[0],
diff --git a/tests/msgq/1.0/default/TestMsgQ.h b/tests/msgq/1.0/default/TestMsgQ.h
index f9fcddd..8a204b7 100644
--- a/tests/msgq/1.0/default/TestMsgQ.h
+++ b/tests/msgq/1.0/default/TestMsgQ.h
@@ -49,13 +49,13 @@
 using android::hardware::MessageQueue;
 
 struct TestMsgQ : public ITestMsgQ {
-    typedef MessageQueue<uint16_t, kSynchronizedReadWrite> MessageQueueSync;
-    typedef MessageQueue<uint16_t, kUnsynchronizedWrite> MessageQueueUnsync;
+    typedef MessageQueue<int32_t, kSynchronizedReadWrite> MessageQueueSync;
+    typedef MessageQueue<int32_t, kUnsynchronizedWrite> MessageQueueUnsync;
 
     TestMsgQ() : mFmqSynchronized(nullptr), mFmqUnsynchronized(nullptr) {}
 
     // Methods from ::android::hardware::tests::msgq::V1_0::ITestMsgQ follow.
-    Return<bool> configureFmqSyncReadWrite(const MQDescriptorSync<uint16_t>& mqDesc) override;
+    Return<bool> configureFmqSyncReadWrite(const MQDescriptorSync<int32_t>& mqDesc) override;
     Return<void> getFmqUnsyncWrite(bool configureFmq, getFmqUnsyncWrite_cb _hidl_cb) override;
     Return<bool> requestWriteFmqSync(int32_t count) override;
     Return<bool> requestReadFmqSync(int32_t count) override;
@@ -73,7 +73,7 @@
     /*
      * Utility function to verify data read from the fast message queue.
      */
-    bool verifyData(uint16_t* data, int count) {
+    bool verifyData(int32_t* data, int count) {
         for (int i = 0; i < count; i++) {
             if (data[i] != i) return false;
         }
diff --git a/tv/tuner/1.1/Android.bp b/tv/tuner/1.1/Android.bp
index 92769f0..6cf47f5 100644
--- a/tv/tuner/1.1/Android.bp
+++ b/tv/tuner/1.1/Android.bp
@@ -4,7 +4,6 @@
     name: "android.hardware.tv.tuner@1.1",
     root: "android.hardware",
     srcs: [
-        "IDemux.hal",
         "IFilter.hal",
         "IFrontend.hal",
         "IFilterCallback.hal",
diff --git a/tv/tuner/1.1/IDemux.hal b/tv/tuner/1.1/IDemux.hal
deleted file mode 100644
index 434ecbd..0000000
--- a/tv/tuner/1.1/IDemux.hal
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.tv.tuner@1.1;
-
-import @1.0::IDemux;
-import @1.0::IFilter;
-import @1.0::Result;
-
-/**
- * Demultiplexer(Demux) takes a single multiplexed input and splits it into
- * one or more output.
- */
-interface IDemux extends @1.0::IDemux {
-    /**
-     * Get a 64-bit hardware sync ID for audio and video.
-     *
-     * It is used by the client to get the hardware sync ID for audio and video.
-     *
-     * @param filter the v1_1 filter instance.
-     * @return result Result status of the operation.
-     *         SUCCESS if successful,
-     *         INVALID_ARGUMENT if failed for a wrong filter ID.
-     *         UNKNOWN_ERROR if failed for other reasons.
-     * @return avSyncHwId the id of hardware A/V sync.
-     */
-    getAvSyncHwId64Bit(IFilter filter) generates (Result result, uint64_t avSyncHwId);
-};
\ No newline at end of file
diff --git a/tv/tuner/1.1/IFilter.hal b/tv/tuner/1.1/IFilter.hal
index 6c4d8a5..2ba9bb7 100644
--- a/tv/tuner/1.1/IFilter.hal
+++ b/tv/tuner/1.1/IFilter.hal
@@ -40,4 +40,34 @@
      * @return filterId the hardware resource Id for the filter.
      */
     getId64Bit() generates (Result result, uint64_t filterId);
+
+    /**
+     * Configure additional Context ID on the IP filter.
+     *
+     * @param ipCid Context Id of the IP filter.
+     * @return result Result status of the operation.
+     *         SUCCESS if successful,
+     *         INVALID_STATE if failed for wrong state.
+     *         UNKNOWN_ERROR if failed for other reasons.
+     */
+    configureIpCid(uint32_t ipCid) generates (Result result);
+
+    /**
+     * Get the shared AV memory handle. Use IFilter.releaseAvHandle to release the handle.
+     *
+     * When media filters are opened, call this API to initialize the share memory handle if it's
+     * needed.
+     *
+     * If DemuxFilterMediaEvent.avMemory contains file descriptor, share memory should be ignored.
+     *
+     * @return avMemory A handle associated to the shared memory for audio or video.
+     *         avMemory.data[0] is normally an fd for ION memory. When the avMemory->numFd is 0, the
+     *         share memory is not initialized and does not contain valid fd.
+     *         avMemory.data[avMemory.numFds] is an index used as a parameter of
+     *         C2DataIdInfo to build C2 buffer in Codec. No C2 buffer would be created if the index
+     *         does not exist.
+     * @return avMemSize the size of the shared av memory. It should be ignored when the share
+     *         memory is not initialized.
+     */
+    getAvSharedHandle() generates (Result result, handle avMemory, uint64_t avMemSize);
 };
diff --git a/tv/tuner/1.1/IFilterCallback.hal b/tv/tuner/1.1/IFilterCallback.hal
index 3e5f047..9960a23 100644
--- a/tv/tuner/1.1/IFilterCallback.hal
+++ b/tv/tuner/1.1/IFilterCallback.hal
@@ -18,7 +18,7 @@
 
 import @1.0::IFilterCallback;
 import @1.0::DemuxFilterEvent;
-import @1.1::DemuxFilterEventExt;
+import DemuxFilterEventExt;
 
 interface IFilterCallback extends @1.0::IFilterCallback {
     /**
diff --git a/tv/tuner/1.1/IFrontend.hal b/tv/tuner/1.1/IFrontend.hal
index 0b0ce39..9858d4b 100644
--- a/tv/tuner/1.1/IFrontend.hal
+++ b/tv/tuner/1.1/IFrontend.hal
@@ -45,7 +45,8 @@
      *         INVALID_STATE if tuning can't be applied at current stage,
      *         UNKNOWN_ERROR if tuning failed for other reasons.
      */
-    tune_1_1(FrontendSettings settings, FrontendSettingsExt settingsExt) generates (Result result);
+    tune_1_1(FrontendSettings settings, FrontendSettingsExt settingsExt)
+        generates (Result result);
 
     /**
      * Scan the frontend to use the settings given.
@@ -66,7 +67,7 @@
      *         UNKNOWN_ERROR if tuning failed for other reasons.
      */
     scan_1_1(FrontendSettings settings, FrontendScanType type, FrontendSettingsExt settingsExt)
-            generates (Result result);
+        generates (Result result);
 
     /**
      * Link Conditional Access Modules (CAM) to Frontend support Common Interface (CI) bypass mode.
diff --git a/tv/tuner/1.1/default/Demux.cpp b/tv/tuner/1.1/default/Demux.cpp
index 007d5eb..66c95dc 100644
--- a/tv/tuner/1.1/default/Demux.cpp
+++ b/tv/tuner/1.1/default/Demux.cpp
@@ -34,49 +34,6 @@
 
 Demux::~Demux() {}
 
-Return<void> Demux::getAvSyncHwId64Bit(const sp<IFilter>& filter, getAvSyncHwId64Bit_cb _hidl_cb) {
-    ALOGV("%s", __FUNCTION__);
-
-    uint64_t avSyncHwId = -1;
-    uint64_t id;
-    Result status;
-
-    sp<V1_1::IFilter> filter_v1_1 = V1_1::IFilter::castFrom(filter);
-    if (filter_v1_1 != NULL) {
-        filter_v1_1->getId64Bit([&](Result result, uint64_t filterId) {
-            id = filterId;
-            status = result;
-        });
-    } else {
-        filter->getId([&](Result result, uint32_t filterId) {
-            id = filterId;
-            status = result;
-        });
-    }
-
-    if (status != Result::SUCCESS) {
-        ALOGE("[Demux] Can't get 64-bit filter Id.");
-        _hidl_cb(Result::INVALID_STATE, avSyncHwId);
-        return Void();
-    }
-
-    if (!mFilters[id]->isMediaFilter()) {
-        ALOGE("[Demux] Given filter is not a media filter.");
-        _hidl_cb(Result::INVALID_ARGUMENT, avSyncHwId);
-        return Void();
-    }
-
-    if (!mPcrFilterIds.empty()) {
-        // Return the lowest pcr filter id in the default implementation as the av sync id
-        _hidl_cb(Result::SUCCESS, *mPcrFilterIds.begin());
-        return Void();
-    }
-
-    ALOGE("[Demux] No PCR filter opened.");
-    _hidl_cb(Result::INVALID_STATE, avSyncHwId);
-    return Void();
-}
-
 Return<Result> Demux::setFrontendDataSource(uint32_t frontendId) {
     ALOGV("%s", __FUNCTION__);
 
diff --git a/tv/tuner/1.1/default/Demux.h b/tv/tuner/1.1/default/Demux.h
index 3623d0f..5212eae 100644
--- a/tv/tuner/1.1/default/Demux.h
+++ b/tv/tuner/1.1/default/Demux.h
@@ -17,7 +17,6 @@
 #ifndef ANDROID_HARDWARE_TV_TUNER_V1_1_DEMUX_H_
 #define ANDROID_HARDWARE_TV_TUNER_V1_1_DEMUX_H_
 
-#include <android/hardware/tv/tuner/1.1/IDemux.h>
 #include <fmq/MessageQueue.h>
 #include <math.h>
 #include <set>
@@ -49,15 +48,12 @@
 class TimeFilter;
 class Tuner;
 
-class Demux : public V1_1::IDemux {
+class Demux : public IDemux {
   public:
     Demux(uint32_t demuxId, sp<Tuner> tuner);
 
     ~Demux();
 
-    virtual Return<void> getAvSyncHwId64Bit(const sp<IFilter>& filter,
-                                            getAvSyncHwId64Bit_cb _hidl_cb) override;
-
     virtual Return<Result> setFrontendDataSource(uint32_t frontendId) override;
 
     virtual Return<void> openFilter(const DemuxFilterType& type, uint32_t bufferSize,
diff --git a/tv/tuner/1.1/default/Filter.cpp b/tv/tuner/1.1/default/Filter.cpp
index fae83a2..c69beca 100644
--- a/tv/tuner/1.1/default/Filter.cpp
+++ b/tv/tuner/1.1/default/Filter.cpp
@@ -163,8 +163,17 @@
     return Result::SUCCESS;
 }
 
-Return<Result> Filter::releaseAvHandle(const hidl_handle& /*avMemory*/, uint64_t avDataId) {
+Return<Result> Filter::releaseAvHandle(const hidl_handle& avMemory, uint64_t avDataId) {
     ALOGV("%s", __FUNCTION__);
+
+    if ((avMemory.getNativeHandle()->numFds > 0) &&
+        (mSharedAvMemHandle.getNativeHandle()->numFds > 0) &&
+        (sameFile(avMemory.getNativeHandle()->data[0],
+                  mSharedAvMemHandle.getNativeHandle()->data[0]))) {
+        freeSharedAvHandle();
+        return Result::SUCCESS;
+    }
+
     if (mDataId2Avfd.find(avDataId) == mDataId2Avfd.end()) {
         return Result::INVALID_ARGUMENT;
     }
@@ -179,6 +188,46 @@
     return mDemux->removeFilter(mFilterId);
 }
 
+Return<Result> Filter::configureIpCid(uint32_t ipCid) {
+    ALOGV("%s", __FUNCTION__);
+
+    if (mType.mainType != DemuxFilterMainType::IP) {
+        return Result::INVALID_STATE;
+    }
+
+    mCid = ipCid;
+    return Result::SUCCESS;
+}
+
+Return<void> Filter::getAvSharedHandle(getAvSharedHandle_cb _hidl_cb) {
+    ALOGV("%s", __FUNCTION__);
+
+    if (!mIsMediaFilter) {
+        _hidl_cb(Result::INVALID_STATE, NULL, BUFFER_SIZE_16M);
+        return Void();
+    }
+
+    if (mSharedAvMemHandle.getNativeHandle() != nullptr) {
+        _hidl_cb(Result::SUCCESS, mSharedAvMemHandle, BUFFER_SIZE_16M);
+        return Void();
+    }
+
+    int av_fd = createAvIonFd(BUFFER_SIZE_16M);
+    if (av_fd == -1) {
+        _hidl_cb(Result::UNKNOWN_ERROR, NULL, 0);
+    }
+
+    native_handle_t* nativeHandle = createNativeHandle(av_fd);
+    if (nativeHandle == NULL) {
+        _hidl_cb(Result::UNKNOWN_ERROR, NULL, 0);
+    }
+    mSharedAvMemHandle.setTo(nativeHandle, /*shouldOwn=*/true);
+    ::close(av_fd);
+
+    _hidl_cb(Result::SUCCESS, mSharedAvMemHandle, BUFFER_SIZE_16M);
+    return Void();
+}
+
 bool Filter::createFilterMQ() {
     ALOGV("%s", __FUNCTION__);
 
@@ -302,10 +351,19 @@
     }
     for (int i = 0; i < mFilterEvent.events.size(); i++) {
         ::close(mFilterEvent.events[i].media().avMemory.getNativeHandle()->data[0]);
-        native_handle_close(mFilterEvent.events[i].media().avMemory.getNativeHandle());
+        native_handle_delete(const_cast<native_handle_t*>(
+                mFilterEvent.events[i].media().avMemory.getNativeHandle()));
     }
 }
 
+void Filter::freeSharedAvHandle() {
+    if (!mIsMediaFilter) {
+        return;
+    }
+    ::close(mSharedAvMemHandle.getNativeHandle()->data[0]);
+    native_handle_delete(const_cast<native_handle_t*>(mSharedAvMemHandle.getNativeHandle()));
+}
+
 void Filter::maySendFilterStatusCallback() {
     if (!mIsUsingFMQ) {
         return;
@@ -498,8 +556,8 @@
         return Result::SUCCESS;
     }
 
+    Result result;
     if (mPts) {
-        Result result;
         result = createMediaFilterEventWithIon(mFilterOutput);
         if (result == Result::SUCCESS) {
             mFilterOutput.clear();
@@ -540,7 +598,10 @@
             continue;
         }
 
-        createMediaFilterEventWithIon(mPesOutput);
+        result = createMediaFilterEventWithIon(mPesOutput);
+        if (result != Result::SUCCESS) {
+            return result;
+        }
     }
 
     mFilterOutput.clear();
@@ -549,51 +610,14 @@
 }
 
 Result Filter::createMediaFilterEventWithIon(vector<uint8_t> output) {
-    int av_fd = createAvIonFd(output.size());
-    if (av_fd == -1) {
-        return Result::UNKNOWN_ERROR;
+    if (mUsingSharedAvMem) {
+        if (mSharedAvMemHandle.getNativeHandle() == nullptr) {
+            return Result::UNKNOWN_ERROR;
+        }
+        return createShareMemMediaEvents(output);
     }
-    // copy the filtered data to the buffer
-    uint8_t* avBuffer = getIonBuffer(av_fd, output.size());
-    if (avBuffer == NULL) {
-        return Result::UNKNOWN_ERROR;
-    }
-    memcpy(avBuffer, output.data(), output.size() * sizeof(uint8_t));
 
-    native_handle_t* nativeHandle = createNativeHandle(av_fd);
-    if (nativeHandle == NULL) {
-        return Result::UNKNOWN_ERROR;
-    }
-    hidl_handle handle;
-    handle.setTo(nativeHandle, /*shouldOwn=*/true);
-
-    // Create a dataId and add a <dataId, av_fd> pair into the dataId2Avfd map
-    uint64_t dataId = mLastUsedDataId++ /*createdUID*/;
-    mDataId2Avfd[dataId] = dup(av_fd);
-
-    // Create mediaEvent and send callback
-    DemuxFilterMediaEvent mediaEvent;
-    mediaEvent = {
-            .avMemory = std::move(handle),
-            .dataLength = static_cast<uint32_t>(output.size()),
-            .avDataId = dataId,
-    };
-    if (mPts) {
-        mediaEvent.pts = mPts;
-        mPts = 0;
-    }
-    int size = mFilterEvent.events.size();
-    mFilterEvent.events.resize(size + 1);
-    mFilterEvent.events[size].media(mediaEvent);
-
-    // Clear and log
-    output.clear();
-    mAvBufferCopyCount = 0;
-    ::close(av_fd);
-    if (DEBUG_FILTER) {
-        ALOGD("[Filter] av data length %d", mediaEvent.dataLength);
-    }
-    return Result::SUCCESS;
+    return createIndependentMediaEvents(output);
 }
 
 Result Filter::startRecordFilterHandler() {
@@ -702,15 +726,119 @@
 }
 
 native_handle_t* Filter::createNativeHandle(int fd) {
-    // Create a native handle to pass the av fd via the callback event.
-    native_handle_t* nativeHandle = native_handle_create(/*numFd*/ 1, 0);
+    native_handle_t* nativeHandle;
+    if (fd < 0) {
+        nativeHandle = native_handle_create(/*numFd*/ 0, 0);
+    } else {
+        // Create a native handle to pass the av fd via the callback event.
+        nativeHandle = native_handle_create(/*numFd*/ 1, 0);
+    }
     if (nativeHandle == NULL) {
         ALOGE("[Filter] Failed to create native_handle %d", errno);
         return NULL;
     }
-    nativeHandle->data[0] = dup(fd);
+    if (nativeHandle->numFds > 0) {
+        nativeHandle->data[0] = dup(fd);
+    }
     return nativeHandle;
 }
+
+Result Filter::createIndependentMediaEvents(vector<uint8_t> output) {
+    int av_fd = createAvIonFd(output.size());
+    if (av_fd == -1) {
+        return Result::UNKNOWN_ERROR;
+    }
+    // copy the filtered data to the buffer
+    uint8_t* avBuffer = getIonBuffer(av_fd, output.size());
+    if (avBuffer == NULL) {
+        return Result::UNKNOWN_ERROR;
+    }
+    memcpy(avBuffer, output.data(), output.size() * sizeof(uint8_t));
+
+    native_handle_t* nativeHandle = createNativeHandle(av_fd);
+    if (nativeHandle == NULL) {
+        return Result::UNKNOWN_ERROR;
+    }
+    hidl_handle handle;
+    handle.setTo(nativeHandle, /*shouldOwn=*/true);
+
+    // Create a dataId and add a <dataId, av_fd> pair into the dataId2Avfd map
+    uint64_t dataId = mLastUsedDataId++ /*createdUID*/;
+    mDataId2Avfd[dataId] = dup(av_fd);
+
+    // Create mediaEvent and send callback
+    DemuxFilterMediaEvent mediaEvent;
+    mediaEvent = {
+            .avMemory = std::move(handle),
+            .dataLength = static_cast<uint32_t>(output.size()),
+            .avDataId = dataId,
+    };
+    if (mPts) {
+        mediaEvent.pts = mPts;
+        mPts = 0;
+    }
+    int size = mFilterEvent.events.size();
+    mFilterEvent.events.resize(size + 1);
+    mFilterEvent.events[size].media(mediaEvent);
+
+    // Clear and log
+    output.clear();
+    mAvBufferCopyCount = 0;
+    ::close(av_fd);
+    if (DEBUG_FILTER) {
+        ALOGD("[Filter] av data length %d", mediaEvent.dataLength);
+    }
+    return Result::SUCCESS;
+}
+
+Result Filter::createShareMemMediaEvents(vector<uint8_t> output) {
+    // copy the filtered data to the shared buffer
+    uint8_t* sharedAvBuffer = getIonBuffer(mSharedAvMemHandle.getNativeHandle()->data[0],
+                                           output.size() + mSharedAvMemOffset);
+    if (sharedAvBuffer == NULL) {
+        return Result::UNKNOWN_ERROR;
+    }
+    memcpy(sharedAvBuffer + mSharedAvMemOffset, output.data(), output.size() * sizeof(uint8_t));
+
+    // Create a memory handle with numFds == 0
+    native_handle_t* nativeHandle = createNativeHandle(-1);
+    if (nativeHandle == NULL) {
+        return Result::UNKNOWN_ERROR;
+    }
+    hidl_handle handle;
+    handle.setTo(nativeHandle, /*shouldOwn=*/true);
+
+    // Create mediaEvent and send callback
+    DemuxFilterMediaEvent mediaEvent;
+    mediaEvent = {
+            .offset = static_cast<uint32_t>(mSharedAvMemOffset),
+            .dataLength = static_cast<uint32_t>(output.size()),
+            .avMemory = handle,
+    };
+    mSharedAvMemOffset += output.size();
+    if (mPts) {
+        mediaEvent.pts = mPts;
+        mPts = 0;
+    }
+    int size = mFilterEvent.events.size();
+    mFilterEvent.events.resize(size + 1);
+    mFilterEvent.events[size].media(mediaEvent);
+
+    // Clear and log
+    output.clear();
+    if (DEBUG_FILTER) {
+        ALOGD("[Filter] shared av data length %d", mediaEvent.dataLength);
+    }
+    return Result::SUCCESS;
+}
+
+bool Filter::sameFile(int fd1, int fd2) {
+    struct stat stat1, stat2;
+    if (fstat(fd1, &stat1) < 0 || fstat(fd2, &stat2) < 0) {
+        return false;
+    }
+    return (stat1.st_dev == stat2.st_dev) && (stat1.st_ino == stat2.st_ino);
+}
 }  // namespace implementation
 }  // namespace V1_0
 }  // namespace tuner
diff --git a/tv/tuner/1.1/default/Filter.h b/tv/tuner/1.1/default/Filter.h
index fa52f96..f677666 100644
--- a/tv/tuner/1.1/default/Filter.h
+++ b/tv/tuner/1.1/default/Filter.h
@@ -23,6 +23,7 @@
 #include <inttypes.h>
 #include <ion/ion.h>
 #include <math.h>
+#include <sys/stat.h>
 #include <set>
 #include "Demux.h"
 #include "Dvr.h"
@@ -43,6 +44,7 @@
 using ::android::hardware::MQDescriptorSync;
 
 using FilterMQ = MessageQueue<uint8_t, kSynchronizedReadWrite>;
+const uint32_t BUFFER_SIZE_16M = 0x1000000;
 
 class Demux;
 class Dvr;
@@ -76,6 +78,10 @@
 
     virtual Return<Result> close() override;
 
+    virtual Return<Result> configureIpCid(uint32_t ipCid) override;
+
+    virtual Return<void> getAvSharedHandle(getAvSharedHandle_cb _hidl_cb) override;
+
     /**
      * To create a FilterMQ and its Event Flag.
      *
@@ -91,6 +97,7 @@
     void attachFilterToRecord(const sp<Dvr> dvr);
     void detachFilterFromRecord();
     void freeAvHandle();
+    void freeSharedAvHandle();
     bool isMediaFilter() { return mIsMediaFilter; };
     bool isPcrFilter() { return mIsPcrFilter; };
     bool isRecordFilter() { return mIsRecordFilter; };
@@ -111,6 +118,7 @@
     sp<V1_1::IFilterCallback> mCallback_1_1 = nullptr;
 
     uint64_t mFilterId;
+    uint32_t mCid = static_cast<uint32_t>(V1_1::Constant::INVALID_IP_FILTER_CONTEXT_ID);
     uint32_t mBufferSize;
     DemuxFilterType mType;
     bool mIsMediaFilter = false;
@@ -182,6 +190,9 @@
     uint8_t* getIonBuffer(int fd, int size);
     native_handle_t* createNativeHandle(int fd);
     Result createMediaFilterEventWithIon(vector<uint8_t> output);
+    Result createIndependentMediaEvents(vector<uint8_t> output);
+    Result createShareMemMediaEvents(vector<uint8_t> output);
+    bool sameFile(int fd1, int fd2);
 
     /**
      * Lock to protect writes to the FMQs
@@ -209,6 +220,11 @@
     std::map<uint64_t, int> mDataId2Avfd;
     uint64_t mLastUsedDataId = 1;
     int mAvBufferCopyCount = 0;
+
+    // Shared A/V memory handle
+    hidl_handle mSharedAvMemHandle;
+    bool mUsingSharedAvMem = true;
+    uint32_t mSharedAvMemOffset = 0;
 };
 
 }  // namespace implementation
diff --git a/tv/tuner/1.1/types.hal b/tv/tuner/1.1/types.hal
index 9e2f453..af8d628 100644
--- a/tv/tuner/1.1/types.hal
+++ b/tv/tuner/1.1/types.hal
@@ -20,6 +20,7 @@
 import @1.0::DemuxFilterMmtpRecordEvent;
 import @1.0::DemuxFilterTsRecordEvent;
 import @1.0::FrontendDvbcSpectralInversion;
+import @1.0::FrontendDvbtConstellation;
 import @1.0::FrontendDvbtTransmissionMode;
 import android.hidl.safe_union@1.0;
 import android.hidl.safe_union@1.0::Monostate;
@@ -34,6 +35,11 @@
      * An invalid frenquency that can be used as the default value of the frontend setting.
      */
     INVALID_FRONTEND_SETTING_FREQUENCY = 0xFFFFFFFF,
+    /**
+     * An invalid context id that can be used as the default value of the unconfigured id. It can
+     * be used to reset the configured ip context id.
+     */
+    INVALID_IP_FILTER_CONTEXT_ID = 0xFFFFFFFF,
 };
 
 @export
@@ -106,16 +112,6 @@
 };
 
 /**
- *  Rotation status for a DVBT Frontend.
- */
-@export
-enum FrontendDvbtRotation : uint32_t {
-    UNDEFINED,
-    NOT_ROTATED,
-    ROTATED,
-};
-
-/**
  * AFT flag for an Analog Frontend.
  */
 @export
@@ -131,13 +127,22 @@
 @export
 enum FrontendDvbtTransmissionMode : @1.0::FrontendDvbtTransmissionMode {
     MODE_8K_E = 1 << 7,
-
     MODE_16K_E = 1 << 8,
-
     MODE_32K_E = 1 << 9,
 };
 
 /**
+ *  Extended Constellation for DVBT.
+ */
+@export
+enum FrontendDvbtConstellation : @1.0::FrontendDvbtConstellation {
+    CONSTELLATION_QPSK_R = 1 << 5,
+    CONSTELLATION_16QAM_R = 1 << 6,
+    CONSTELLATION_64QAM_R = 1 << 7,
+    CONSTELLATION_256QAM_R = 1 << 8,
+};
+
+/**
  *  Extended Signal Settings for a DVBS Frontend.
  */
 struct FrontendDvbsSettingsExt {
@@ -148,7 +153,7 @@
  *  Extended Signal Settings for a DVBT Frontend.
  */
 struct FrontendDvbtSettingsExt {
-    FrontendDvbtRotation rotation;
+    FrontendDvbtConstellation constellation;
 
     FrontendDvbtTransmissionMode transmissionMode;
 };
diff --git a/tv/tuner/1.1/vts/functional/DemuxTests.cpp b/tv/tuner/1.1/vts/functional/DemuxTests.cpp
index e0600b6..b1d8a0a 100644
--- a/tv/tuner/1.1/vts/functional/DemuxTests.cpp
+++ b/tv/tuner/1.1/vts/functional/DemuxTests.cpp
@@ -38,34 +38,4 @@
     auto status = mDemux->close();
     mDemux = nullptr;
     return AssertionResult(status.isOk());
-}
-
-AssertionResult DemuxTests::getAvSyncId_64bit(sp<IFilter> filter, uint64_t& avSyncHwId) {
-    EXPECT_TRUE(mDemux) << "Demux is not opened yet.";
-    Result status;
-
-    sp<android::hardware::tv::tuner::V1_1::IDemux> demux_v1_1 =
-            android::hardware::tv::tuner::V1_1::IDemux::castFrom(mDemux);
-    if (demux_v1_1 != NULL) {
-        demux_v1_1->getAvSyncHwId64Bit(filter, [&](Result result, uint64_t id) {
-            status = result;
-            avSyncHwId = id;
-        });
-    } else {
-        ALOGW("[vts] Can't cast IDemux into v1_1.");
-        return failure();
-    }
-
-    return AssertionResult(status == Result::SUCCESS);
-}
-
-AssertionResult DemuxTests::getAvSyncTime(uint32_t avSyncId) {
-    EXPECT_TRUE(mDemux) << "Demux is not opened yet.";
-    Result status;
-    uint64_t syncTime;
-    mDemux->getAvSyncTime(avSyncId, [&](Result result, uint64_t time) {
-        status = result;
-        syncTime = time;
-    });
-    return AssertionResult(status == Result::SUCCESS);
 }
\ No newline at end of file
diff --git a/tv/tuner/1.1/vts/functional/DemuxTests.h b/tv/tuner/1.1/vts/functional/DemuxTests.h
index 393757c..c28d6ca 100644
--- a/tv/tuner/1.1/vts/functional/DemuxTests.h
+++ b/tv/tuner/1.1/vts/functional/DemuxTests.h
@@ -17,7 +17,6 @@
 #include <android-base/logging.h>
 #include <android/hardware/tv/tuner/1.0/IDemux.h>
 #include <android/hardware/tv/tuner/1.0/types.h>
-#include <android/hardware/tv/tuner/1.1/IDemux.h>
 #include <android/hardware/tv/tuner/1.1/IFilter.h>
 #include <android/hardware/tv/tuner/1.1/ITuner.h>
 #include <binder/MemoryDealer.h>
@@ -45,8 +44,6 @@
 
     AssertionResult openDemux(sp<IDemux>& demux, uint32_t& demuxId);
     AssertionResult setDemuxFrontendDataSource(uint32_t frontendId);
-    AssertionResult getAvSyncId_64bit(sp<IFilter> filter, uint64_t& avSyncHwId);
-    AssertionResult getAvSyncTime(uint32_t avSyncId);
     AssertionResult closeDemux();
 
   protected:
diff --git a/tv/tuner/1.1/vts/functional/FilterTests.cpp b/tv/tuner/1.1/vts/functional/FilterTests.cpp
index 24e1fa0..5a8985d 100644
--- a/tv/tuner/1.1/vts/functional/FilterTests.cpp
+++ b/tv/tuner/1.1/vts/functional/FilterTests.cpp
@@ -16,22 +16,70 @@
 
 #include "FilterTests.h"
 
-bool FilterCallback::readFilterEventData() {
-    bool result = false;
-    ALOGW("[vts] reading from filter FMQ or buffer %d", mFilterId);
+void FilterCallback::testFilterDataOutput() {
+    android::Mutex::Autolock autoLock(mMsgLock);
+    while (mPidFilterOutputCount < 1) {
+        if (-ETIMEDOUT == mMsgCondition.waitRelative(mMsgLock, WAIT_TIMEOUT)) {
+            EXPECT_TRUE(false) << "filter output matching pid does not output within timeout";
+            return;
+        }
+    }
+    mPidFilterOutputCount = 0;
+    ALOGW("[vts] pass and stop");
+}
+
+void FilterCallback::readFilterEventData() {
+    ALOGW("[vts] reading filter event");
     // todo separate filter handlers
+    for (int i = 0; i < mFilterEvent.events.size(); i++) {
+        auto event = mFilterEvent.events[i];
+        switch (event.getDiscriminator()) {
+            case DemuxFilterEvent::Event::hidl_discriminator::media:
+                ALOGD("[vts] Media filter event, avMemHandle numFds=%d.",
+                      event.media().avMemory.getNativeHandle()->numFds);
+                dumpAvData(event.media());
+                break;
+            default:
+                break;
+        }
+    }
     for (int i = 0; i < mFilterEventExt.events.size(); i++) {
         auto eventExt = mFilterEventExt.events[i];
         switch (eventExt.getDiscriminator()) {
             case DemuxFilterEventExt::Event::hidl_discriminator::tsRecord:
-                ALOGW("[vts] Extended TS record filter event, pts=%" PRIu64 ".",
+                ALOGD("[vts] Extended TS record filter event, pts=%" PRIu64 ".",
                       eventExt.tsRecord().pts);
                 break;
             default:
                 break;
         }
     }
-    return result;
+}
+
+bool FilterCallback::dumpAvData(DemuxFilterMediaEvent event) {
+    uint32_t length = event.dataLength;
+    uint32_t offset = event.offset;
+    // read data from buffer pointed by a handle
+    hidl_handle handle = event.avMemory;
+    if (handle.getNativeHandle()->numFds == 0) {
+        if (mAvSharedHandle == NULL) {
+            return false;
+        }
+        handle = mAvSharedHandle;
+    }
+
+    int av_fd = handle.getNativeHandle()->data[0];
+    uint8_t* buffer =
+            static_cast<uint8_t*>(mmap(NULL, length, PROT_READ | PROT_WRITE, MAP_SHARED, av_fd, 0));
+    if (buffer == MAP_FAILED) {
+        ALOGE("[vts] fail to allocate av buffer, errno=%d", errno);
+        return false;
+    }
+    uint8_t output[length + 1];
+    memcpy(output, buffer + offset, length);
+    // print buffer and check with golden output.
+    ::close(av_fd);
+    return true;
 }
 
 AssertionResult FilterTests::openFilterInDemux(DemuxFilterType type, uint32_t bufferSize) {
@@ -81,6 +129,33 @@
     return AssertionResult(status == Result::SUCCESS);
 }
 
+AssertionResult FilterTests::getSharedAvMemoryHandle(uint64_t filterId) {
+    EXPECT_TRUE(mFilters[filterId]) << "Open media filter first.";
+    Result status = Result::UNKNOWN_ERROR;
+    sp<android::hardware::tv::tuner::V1_1::IFilter> filter_v1_1 =
+            android::hardware::tv::tuner::V1_1::IFilter::castFrom(mFilters[filterId]);
+    if (filter_v1_1 != NULL) {
+        filter_v1_1->getAvSharedHandle([&](Result r, hidl_handle avMemory, uint64_t avMemSize) {
+            status = r;
+            if (status == Result::SUCCESS) {
+                mFilterCallbacks[mFilterId]->setSharedHandle(avMemory);
+                mFilterCallbacks[mFilterId]->setMemSize(avMemSize);
+                mAvSharedHandle = avMemory;
+            }
+        });
+    }
+    return AssertionResult(status == Result::SUCCESS);
+}
+
+AssertionResult FilterTests::releaseShareAvHandle(uint64_t filterId) {
+    Result status;
+    EXPECT_TRUE(mFilters[filterId]) << "Open media filter first.";
+    EXPECT_TRUE(mAvSharedHandle) << "No shared av handle to release.";
+    status = mFilters[filterId]->releaseAvHandle(mAvSharedHandle, 0 /*dataId*/);
+
+    return AssertionResult(status == Result::SUCCESS);
+}
+
 AssertionResult FilterTests::configFilter(DemuxFilterSettings setting, uint64_t filterId) {
     Result status;
     EXPECT_TRUE(mFilters[filterId]) << "Test with getNewlyOpenedFilterId first.";
@@ -89,6 +164,22 @@
     return AssertionResult(status == Result::SUCCESS);
 }
 
+AssertionResult FilterTests::configIpFilterCid(uint32_t ipCid, uint64_t filterId) {
+    Result status;
+    EXPECT_TRUE(mFilters[filterId]) << "Open Ip filter first.";
+
+    sp<android::hardware::tv::tuner::V1_1::IFilter> filter_v1_1 =
+            android::hardware::tv::tuner::V1_1::IFilter::castFrom(mFilters[filterId]);
+    if (filter_v1_1 != NULL) {
+        status = filter_v1_1->configureIpCid(ipCid);
+    } else {
+        ALOGW("[vts] Can't cast IFilter into v1_1.");
+        return failure();
+    }
+
+    return AssertionResult(status == Result::SUCCESS);
+}
+
 AssertionResult FilterTests::getFilterMQDescriptor(uint64_t filterId) {
     Result status;
     EXPECT_TRUE(mFilters[filterId]) << "Test with getNewlyOpenedFilterId first.";
diff --git a/tv/tuner/1.1/vts/functional/FilterTests.h b/tv/tuner/1.1/vts/functional/FilterTests.h
index 721e419..bc6db86 100644
--- a/tv/tuner/1.1/vts/functional/FilterTests.h
+++ b/tv/tuner/1.1/vts/functional/FilterTests.h
@@ -46,6 +46,7 @@
 using android::hardware::Void;
 using android::hardware::tv::tuner::V1_0::DemuxFilterEvent;
 using android::hardware::tv::tuner::V1_0::DemuxFilterMainType;
+using android::hardware::tv::tuner::V1_0::DemuxFilterMediaEvent;
 using android::hardware::tv::tuner::V1_0::DemuxFilterSettings;
 using android::hardware::tv::tuner::V1_0::DemuxFilterStatus;
 using android::hardware::tv::tuner::V1_0::DemuxFilterType;
@@ -93,7 +94,14 @@
     }
 
     virtual Return<void> onFilterEvent(
-            const android::hardware::tv::tuner::V1_0::DemuxFilterEvent& /*filterEvent*/) override {
+            const android::hardware::tv::tuner::V1_0::DemuxFilterEvent& filterEvent) override {
+        android::Mutex::Autolock autoLock(mMsgLock);
+        // Temprarily we treat the first coming back filter data on the matching pid a success
+        // once all of the MQ are cleared, means we got all the expected output
+        mFilterEvent = filterEvent;
+        readFilterEventData();
+        mPidFilterOutputCount++;
+        mMsgCondition.signal();
         return Void();
     }
 
@@ -104,8 +112,13 @@
     void setFilterId(uint32_t filterId) { mFilterId = filterId; }
     void setFilterInterface(sp<IFilter> filter) { mFilter = filter; }
     void setFilterEventType(FilterEventType type) { mFilterEventType = type; }
+    void setSharedHandle(hidl_handle sharedHandle) { mAvSharedHandle = sharedHandle; }
+    void setMemSize(uint64_t size) { mAvSharedMemSize = size; }
 
-    bool readFilterEventData();
+    void testFilterDataOutput();
+
+    void readFilterEventData();
+    bool dumpAvData(DemuxFilterMediaEvent event);
 
   private:
     uint32_t mFilterId;
@@ -114,6 +127,9 @@
     DemuxFilterEvent mFilterEvent;
     DemuxFilterEventExt mFilterEventExt;
 
+    hidl_handle mAvSharedHandle = NULL;
+    uint64_t mAvSharedMemSize = -1;
+
     android::Mutex mMsgLock;
     android::Mutex mFilterOutputLock;
     android::Condition mMsgCondition;
@@ -127,11 +143,14 @@
     void setDemux(sp<IDemux> demux) { mDemux = demux; }
     sp<IFilter> getFilterById(uint64_t filterId) { return mFilters[filterId]; }
 
-    std::map<uint64_t, sp<FilterCallback>> getFilterCallbacks() { return mFilterCallbacks; }
+    map<uint64_t, sp<FilterCallback>> getFilterCallbacks() { return mFilterCallbacks; }
 
     AssertionResult openFilterInDemux(DemuxFilterType type, uint32_t bufferSize);
     AssertionResult getNewlyOpenedFilterId_64bit(uint64_t& filterId);
+    AssertionResult getSharedAvMemoryHandle(uint64_t filterId);
+    AssertionResult releaseShareAvHandle(uint64_t filterId);
     AssertionResult configFilter(DemuxFilterSettings setting, uint64_t filterId);
+    AssertionResult configIpFilterCid(uint32_t ipCid, uint64_t filterId);
     AssertionResult getFilterMQDescriptor(uint64_t filterId);
     AssertionResult startFilter(uint64_t filterId);
     AssertionResult stopFilter(uint64_t filterId);
@@ -192,12 +211,14 @@
     sp<ITuner> mService;
     sp<IFilter> mFilter;
     sp<IDemux> mDemux;
-    std::map<uint64_t, sp<IFilter>> mFilters;
-    std::map<uint64_t, sp<FilterCallback>> mFilterCallbacks;
+    map<uint64_t, sp<IFilter>> mFilters;
+    map<uint64_t, sp<FilterCallback>> mFilterCallbacks;
 
     sp<FilterCallback> mFilterCallback;
     MQDesc mFilterMQDescriptor;
     vector<uint64_t> mUsedFilterIds;
 
+    hidl_handle mAvSharedHandle = NULL;
+
     uint64_t mFilterId = -1;
 };
diff --git a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.cpp b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.cpp
index c3df078..f87fa3c 100644
--- a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.cpp
+++ b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.cpp
@@ -18,6 +18,10 @@
 
 namespace {
 
+AssertionResult TunerBroadcastHidlTest::filterDataOutputTest() {
+    return filterDataOutputTestBase(mFilterTests);
+}
+
 void TunerFilterHidlTest::configSingleFilterInDemuxTest(FilterConfig filterConf,
                                                         FrontendConfig frontendConf) {
     uint32_t feId;
@@ -35,6 +39,9 @@
     ASSERT_TRUE(mFilterTests.openFilterInDemux(filterConf.type, filterConf.bufferSize));
     ASSERT_TRUE(mFilterTests.getNewlyOpenedFilterId_64bit(filterId));
     ASSERT_TRUE(mFilterTests.configFilter(filterConf.settings, filterId));
+    if (filterConf.type.mainType == DemuxFilterMainType::IP) {
+        ASSERT_TRUE(mFilterTests.configIpFilterCid(filterConf.ipCid, filterId));
+    }
     ASSERT_TRUE(mFilterTests.getFilterMQDescriptor(filterId));
     ASSERT_TRUE(mFilterTests.startFilter(filterId));
     ASSERT_TRUE(mFilterTests.stopFilter(filterId));
@@ -43,6 +50,38 @@
     ASSERT_TRUE(mFrontendTests.closeFrontend());
 }
 
+void TunerBroadcastHidlTest::mediaFilterUsingSharedMemoryTest(FilterConfig filterConf,
+                                                              FrontendConfig frontendConf) {
+    uint32_t feId;
+    uint32_t demuxId;
+    sp<IDemux> demux;
+    uint64_t filterId;
+
+    mFrontendTests.getFrontendIdByType(frontendConf.type, feId);
+    ASSERT_TRUE(feId != INVALID_ID);
+    ASSERT_TRUE(mFrontendTests.openFrontendById(feId));
+    ASSERT_TRUE(mFrontendTests.setFrontendCallback());
+    ASSERT_TRUE(mDemuxTests.openDemux(demux, demuxId));
+    ASSERT_TRUE(mDemuxTests.setDemuxFrontendDataSource(feId));
+    mFrontendTests.setDemux(demux);
+    mFilterTests.setDemux(demux);
+    ASSERT_TRUE(mFilterTests.openFilterInDemux(filterConf.type, filterConf.bufferSize));
+    ASSERT_TRUE(mFilterTests.getNewlyOpenedFilterId_64bit(filterId));
+    ASSERT_TRUE(mFilterTests.getSharedAvMemoryHandle(filterId));
+    ASSERT_TRUE(mFilterTests.configFilter(filterConf.settings, filterId));
+    ASSERT_TRUE(mFilterTests.getFilterMQDescriptor(filterId));
+    ASSERT_TRUE(mFilterTests.startFilter(filterId));
+    // tune test
+    ASSERT_TRUE(mFrontendTests.tuneFrontend(frontendConf, true /*testWithDemux*/));
+    ASSERT_TRUE(filterDataOutputTest());
+    ASSERT_TRUE(mFrontendTests.stopTuneFrontend(true /*testWithDemux*/));
+    ASSERT_TRUE(mFilterTests.stopFilter(filterId));
+    ASSERT_TRUE(mFilterTests.releaseShareAvHandle(filterId));
+    ASSERT_TRUE(mFilterTests.closeFilter(filterId));
+    ASSERT_TRUE(mDemuxTests.closeDemux());
+    ASSERT_TRUE(mFrontendTests.closeFrontend());
+}
+
 void TunerRecordHidlTest::recordSingleFilterTest(FilterConfig filterConf,
                                                  FrontendConfig frontendConf, DvrConfig dvrConf) {
     uint32_t feId;
@@ -86,47 +125,18 @@
     ASSERT_TRUE(mFrontendTests.closeFrontend());
 }
 
-TEST_P(TunerDemuxHidlTest, getAvSyncTime) {
-    description("Get the A/V sync time from a PCR filter.");
-    uint32_t feId;
-    uint32_t demuxId;
-    sp<IDemux> demux;
-    uint64_t mediaFilterId;
-    uint64_t pcrFilterId;
-    uint64_t avSyncHwId;
-    sp<IFilter> mediaFilter;
-
-    mFrontendTests.getFrontendIdByType(frontendArray[DVBT].type, feId);
-    ASSERT_TRUE(feId != INVALID_ID);
-    ASSERT_TRUE(mFrontendTests.openFrontendById(feId));
-    ASSERT_TRUE(mFrontendTests.setFrontendCallback());
-    ASSERT_TRUE(mDemuxTests.openDemux(demux, demuxId));
-    ASSERT_TRUE(mDemuxTests.setDemuxFrontendDataSource(feId));
-    mFilterTests.setDemux(demux);
-    ASSERT_TRUE(mFilterTests.openFilterInDemux(filterArray[TS_VIDEO1].type,
-                                               filterArray[TS_VIDEO1].bufferSize));
-    ASSERT_TRUE(mFilterTests.getNewlyOpenedFilterId_64bit(mediaFilterId));
-    ASSERT_TRUE(mFilterTests.configFilter(filterArray[TS_VIDEO1].settings, mediaFilterId));
-    mediaFilter = mFilterTests.getFilterById(mediaFilterId);
-    ASSERT_TRUE(mFilterTests.openFilterInDemux(filterArray[TS_PCR0].type,
-                                               filterArray[TS_PCR0].bufferSize));
-    ASSERT_TRUE(mFilterTests.getNewlyOpenedFilterId_64bit(pcrFilterId));
-    ASSERT_TRUE(mFilterTests.configFilter(filterArray[TS_PCR0].settings, pcrFilterId));
-    ASSERT_TRUE(mDemuxTests.getAvSyncId_64bit(mediaFilter, avSyncHwId));
-    ASSERT_TRUE(pcrFilterId == avSyncHwId);
-    ASSERT_TRUE(mDemuxTests.getAvSyncTime(pcrFilterId));
-    ASSERT_TRUE(mFilterTests.closeFilter(pcrFilterId));
-    ASSERT_TRUE(mFilterTests.closeFilter(mediaFilterId));
-    ASSERT_TRUE(mDemuxTests.closeDemux());
-    ASSERT_TRUE(mFrontendTests.closeFrontend());
-}
-
 TEST_P(TunerFilterHidlTest, StartFilterInDemux) {
     description("Open and start a filter in Demux.");
     // TODO use parameterized tests
     configSingleFilterInDemuxTest(filterArray[TS_VIDEO0], frontendArray[DVBT]);
 }
 
+TEST_P(TunerFilterHidlTest, ConfigIpFilterInDemuxWithCid) {
+    description("Open and configure an ip filter in Demux.");
+    // TODO use parameterized tests
+    configSingleFilterInDemuxTest(filterArray[IP_IP0], frontendArray[DVBT]);
+}
+
 TEST_P(TunerRecordHidlTest, RecordDataFlowWithTsRecordFilterTest) {
     description("Feed ts data from frontend to recording and test with ts record filter");
     recordSingleFilterTest(filterArray[TS_RECORD0], frontendArray[DVBT], dvrArray[DVR_RECORD0]);
@@ -142,6 +152,16 @@
     mFrontendTests.scanTest(frontendScanArray[SCAN_DVBT], FrontendScanType::SCAN_BLIND);
 }
 
+TEST_P(TunerBroadcastHidlTest, MediaFilterWithSharedMemoryHandle) {
+    description("Test the Media Filter with shared memory handle");
+    mediaFilterUsingSharedMemoryTest(filterArray[TS_VIDEO0], frontendArray[DVBT]);
+}
+
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, TunerBroadcastHidlTest,
+        testing::ValuesIn(android::hardware::getAllHalInstanceNames(ITuner::descriptor)),
+        android::hardware::PrintInstanceNameToString);
+
 INSTANTIATE_TEST_SUITE_P(
         PerInstance, TunerFrontendHidlTest,
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(ITuner::descriptor)),
@@ -153,11 +173,6 @@
         android::hardware::PrintInstanceNameToString);
 
 INSTANTIATE_TEST_SUITE_P(
-        PerInstance, TunerDemuxHidlTest,
-        testing::ValuesIn(android::hardware::getAllHalInstanceNames(ITuner::descriptor)),
-        android::hardware::PrintInstanceNameToString);
-
-INSTANTIATE_TEST_SUITE_P(
         PerInstance, TunerRecordHidlTest,
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(ITuner::descriptor)),
         android::hardware::PrintInstanceNameToString);
diff --git a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.h b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.h
index 505e35a..f77a740 100644
--- a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.h
+++ b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TargetTest.h
@@ -26,6 +26,20 @@
     initDvrConfig();
 }
 
+static AssertionResult success() {
+    return ::testing::AssertionSuccess();
+}
+
+AssertionResult filterDataOutputTestBase(FilterTests tests) {
+    // Data Verify Module
+    std::map<uint64_t, sp<FilterCallback>>::iterator it;
+    std::map<uint64_t, sp<FilterCallback>> filterCallbacks = tests.getFilterCallbacks();
+    for (it = filterCallbacks.begin(); it != filterCallbacks.end(); it++) {
+        it->second->testFilterDataOutput();
+    }
+    return success();
+}
+
 class TunerFilterHidlTest : public testing::TestWithParam<std::string> {
   public:
     virtual void SetUp() override {
@@ -53,31 +67,6 @@
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TunerFilterHidlTest);
 
-class TunerDemuxHidlTest : public testing::TestWithParam<std::string> {
-  public:
-    virtual void SetUp() override {
-        mService = ITuner::getService(GetParam());
-        ASSERT_NE(mService, nullptr);
-        initConfiguration();
-
-        mFrontendTests.setService(mService);
-        mDemuxTests.setService(mService);
-        mFilterTests.setService(mService);
-    }
-
-  protected:
-    static void description(const std::string& description) {
-        RecordProperty("description", description);
-    }
-
-    sp<ITuner> mService;
-    FrontendTests mFrontendTests;
-    DemuxTests mDemuxTests;
-    FilterTests mFilterTests;
-};
-
-GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TunerDemuxHidlTest);
-
 class TunerRecordHidlTest : public testing::TestWithParam<std::string> {
   public:
     virtual void SetUp() override {
@@ -128,4 +117,34 @@
 };
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TunerFrontendHidlTest);
+
+class TunerBroadcastHidlTest : public testing::TestWithParam<std::string> {
+  public:
+    virtual void SetUp() override {
+        mService = ITuner::getService(GetParam());
+        ASSERT_NE(mService, nullptr);
+        initConfiguration();
+
+        mFrontendTests.setService(mService);
+        mDemuxTests.setService(mService);
+        mFilterTests.setService(mService);
+    }
+
+  protected:
+    static void description(const std::string& description) {
+        RecordProperty("description", description);
+    }
+
+    sp<ITuner> mService;
+    FrontendTests mFrontendTests;
+    DemuxTests mDemuxTests;
+    FilterTests mFilterTests;
+
+    AssertionResult filterDataOutputTest();
+
+    void mediaFilterUsingSharedMemoryTest(FilterConfig filterConf, FrontendConfig frontendConf);
+};
+
+// TODO remove from the allow list once the cf tv target is enabled for testing
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TunerBroadcastHidlTest);
 }  // namespace
\ No newline at end of file
diff --git a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
index 34418d1..36b4bd2 100644
--- a/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
+++ b/tv/tuner/1.1/vts/functional/VtsHalTvTunerV1_1TestConfigurations.h
@@ -26,6 +26,8 @@
 using android::hardware::tv::tuner::V1_0::DemuxFilterMainType;
 using android::hardware::tv::tuner::V1_0::DemuxFilterSettings;
 using android::hardware::tv::tuner::V1_0::DemuxFilterType;
+using android::hardware::tv::tuner::V1_0::DemuxIpAddress;
+using android::hardware::tv::tuner::V1_0::DemuxIpFilterSettings;
 using android::hardware::tv::tuner::V1_0::DemuxIpFilterType;
 using android::hardware::tv::tuner::V1_0::DemuxMmtpFilterType;
 using android::hardware::tv::tuner::V1_0::DemuxRecordScIndexType;
@@ -64,6 +66,7 @@
     TS_SECTION0,
     TS_TS0,
     TS_RECORD0,
+    IP_IP0,
     FILTER_MAX,
 } Filter;
 
@@ -88,6 +91,7 @@
     uint32_t bufferSize;
     DemuxFilterType type;
     DemuxFilterSettings settings;
+    uint32_t ipCid;
 
     bool operator<(const FilterConfig& /*c*/) const { return false; }
 };
@@ -227,6 +231,19 @@
     filterArray[TS_RECORD0].settings.ts().filterSettings.record({
             .scIndexType = DemuxRecordScIndexType::NONE,
     });
+    // IP filter setting
+    filterArray[IP_IP0].type.mainType = DemuxFilterMainType::IP;
+    filterArray[IP_IP0].type.subType.ipFilterType(DemuxIpFilterType::IP);
+    uint8_t src[4] = {192, 168, 1, 1};
+    uint8_t dest[4] = {192, 168, 1, 2};
+    DemuxIpAddress ipAddress;
+    ipAddress.srcIpAddress.v4(src);
+    ipAddress.dstIpAddress.v4(dest);
+    DemuxIpFilterSettings ipSettings{
+            .ipAddr = ipAddress,
+    };
+    filterArray[IP_IP0].settings.ip(ipSettings);
+    filterArray[IP_IP0].ipCid = 1;
 };
 
 /** Configuration array for the dvr test */
diff --git a/wifi/hostapd/1.0/vts/functional/hostapd_hidl_call_util.h b/wifi/hostapd/1.0/vts/functional/hostapd_hidl_call_util.h
index ec7ebee..b4b0ea6 100644
--- a/wifi/hostapd/1.0/vts/functional/hostapd_hidl_call_util.h
+++ b/wifi/hostapd/1.0/vts/functional/hostapd_hidl_call_util.h
@@ -95,6 +95,14 @@
     EXPECT_TRUE(res.isOk());
     return result_buffer.saved_values;
 }
+
+// Invokes |void method| on |object| without arguments.
+template <typename MethodT, typename ObjectT>
+void invokeVoidMethodWithoutArguments(MethodT method, ObjectT object) {
+    const auto& res = ((*object).*method)();
+    EXPECT_TRUE(res.isOk());
+}
+
 }  // namespace detail
 }  // namespace
 
@@ -123,3 +131,9 @@
         std::remove_reference<decltype(*strong_pointer)>::type::method##_cb>( \
         &std::remove_reference<decltype(*strong_pointer)>::type::method,      \
         strong_pointer, ##__VA_ARGS__))
+
+// Invokes |void method| on |strong_pointer| without arguments.
+#define HIDL_INVOKE_VOID_WITHOUT_ARGUMENTS(strong_pointer, method)       \
+    (detail::invokeVoidMethodWithoutArguments(                           \
+        &std::remove_reference<decltype(*strong_pointer)>::type::method, \
+        strong_pointer))
diff --git a/wifi/hostapd/1.0/vts/functional/hostapd_hidl_test.cpp b/wifi/hostapd/1.0/vts/functional/hostapd_hidl_test.cpp
index 82c257b..1b4eea6 100644
--- a/wifi/hostapd/1.0/vts/functional/hostapd_hidl_test.cpp
+++ b/wifi/hostapd/1.0/vts/functional/hostapd_hidl_test.cpp
@@ -55,7 +55,10 @@
         ASSERT_NE(hostapd_.get(), nullptr);
     }
 
-    virtual void TearDown() override { stopHostapd(wifi_instance_name_); }
+    virtual void TearDown() override {
+        HIDL_INVOKE_VOID_WITHOUT_ARGUMENTS(hostapd_, terminate);
+        stopHostapd(wifi_instance_name_);
+    }
 
    protected:
     std::string getPrimaryWlanIfaceName() {
diff --git a/wifi/hostapd/1.1/vts/functional/hostapd_hidl_test.cpp b/wifi/hostapd/1.1/vts/functional/hostapd_hidl_test.cpp
index 3944a3a..32bbe72 100644
--- a/wifi/hostapd/1.1/vts/functional/hostapd_hidl_test.cpp
+++ b/wifi/hostapd/1.1/vts/functional/hostapd_hidl_test.cpp
@@ -60,7 +60,10 @@
         ASSERT_NE(hostapd_.get(), nullptr);
     }
 
-    virtual void TearDown() override { stopHostapd(wifi_instance_name_); }
+    virtual void TearDown() override {
+        HIDL_INVOKE_VOID_WITHOUT_ARGUMENTS(hostapd_, terminate);
+        stopHostapd(wifi_instance_name_);
+    }
 
    protected:
     std::string getPrimaryWlanIfaceName() {
diff --git a/wifi/hostapd/1.2/vts/functional/hostapd_hidl_test.cpp b/wifi/hostapd/1.2/vts/functional/hostapd_hidl_test.cpp
index 62e3c16..99784a4 100644
--- a/wifi/hostapd/1.2/vts/functional/hostapd_hidl_test.cpp
+++ b/wifi/hostapd/1.2/vts/functional/hostapd_hidl_test.cpp
@@ -72,7 +72,10 @@
             "wifi_softap_wpa3_sae_supported");
     }
 
-    virtual void TearDown() override { stopHostapd(wifi_instance_name_); }
+    virtual void TearDown() override {
+        HIDL_INVOKE_VOID_WITHOUT_ARGUMENTS(hostapd_, terminate);
+        stopHostapd(wifi_instance_name_);
+    }
 
    protected:
     bool isWpa3SaeSupport_ = false;
diff --git a/wifi/hostapd/1.3/IHostapd.hal b/wifi/hostapd/1.3/IHostapd.hal
index d16448d..0309f3b 100644
--- a/wifi/hostapd/1.3/IHostapd.hal
+++ b/wifi/hostapd/1.3/IHostapd.hal
@@ -16,8 +16,10 @@
 
 package android.hardware.wifi.hostapd@1.3;
 
-import @1.2::IHostapd;
 import @1.2::HostapdStatus;
+import @1.2::IHostapd.IfaceParams;
+import @1.2::IHostapd.NetworkParams;
+import @1.2::IHostapd;
 import IHostapdCallback;
 
 /**
@@ -25,6 +27,40 @@
  */
 interface IHostapd extends @1.2::IHostapd {
     /**
+     * Parameters to use for setting up the access point network.
+     */
+    struct NetworkParams {
+        /**
+         * Baseline information as defined in HAL 1.2.
+         */
+        @1.2::IHostapd.NetworkParams V1_2;
+
+        /**
+         * Enable the interworking service and set access network type to
+         * CHARGEABLE_PUBLIC_NETWORK when set to true.
+         */
+        bool isMetered;
+    };
+
+    /**
+     * Adds a new access point for hostapd to control.
+     *
+     * This should trigger the setup of an access point with the specified
+     * interface and network params.
+     *
+     * @param ifaceParams AccessPoint Params for the access point.
+     * @param nwParams Network Params for the access point.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |HostapdStatusCode.SUCCESS|,
+     *         |HostapdStatusCode.FAILURE_ARGS_INVALID|,
+     *         |HostapdStatusCode.FAILURE_UNKNOWN|,
+     *         |HostapdStatusCode.FAILURE_IFACE_EXISTS|
+     */
+    addAccessPoint_1_3(@1.2::IHostapd.IfaceParams ifaceParams, NetworkParams nwParams)
+        generates (HostapdStatus status);
+
+    /**
      * Register for callbacks from the hostapd service.
      *
      * These callbacks are invoked for global events that are not specific
diff --git a/wifi/hostapd/1.3/IHostapdCallback.hal b/wifi/hostapd/1.3/IHostapdCallback.hal
index 98cde67..a098d87 100644
--- a/wifi/hostapd/1.3/IHostapdCallback.hal
+++ b/wifi/hostapd/1.3/IHostapdCallback.hal
@@ -38,9 +38,10 @@
      * @param freq The operational frequency of the AP.
      * @param bandwidth The operational bandwidth of the AP.
      * @param generation The operational mode of the AP (e.g. 11ac, 11ax).
+     * @param apIfaceInstanceMacAddress MAC Address of the apIfaceInstance.
      */
     oneway onApInstanceInfoChanged(string ifaceName, string apIfaceInstance, uint32_t freq,
-        Bandwidth bandwidth, Generation generation);
+        Bandwidth bandwidth, Generation generation, MacAddress apIfaceInstanceMacAddress);
 
     /**
      * Invoked when a client connects/disconnects from the hotspot.
@@ -51,7 +52,7 @@
      * will have two instances in dual AP mode. The apIfaceInstance can be used
      * to identify which instance the callback is from.
      * Note: The apIfaceInstance must be same as ifaceName in single AP mode.
-     * @param clientAddress Mac Address of hotspot client.
+     * @param clientAddress MAC Address of hotspot client.
      * @param isConnected true when client connected, false when client
      * disconnected.
      */
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
index 5e7a371..da3996b 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
@@ -52,10 +52,6 @@
 // Helper function to initialize the driver and firmware to STA mode
 // using the vendor HAL HIDL interface.
 void initilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
     if (getWifi(wifi_instance_name) != nullptr) {
         sp<IWifiChip> wifi_chip = getWifiChip(wifi_instance_name);
         ChipModeId mode_id;
@@ -69,10 +65,6 @@
 // Helper function to deinitialize the driver and firmware
 // using the vendor HAL HIDL interface.
 void deInitilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
     if (getWifi(wifi_instance_name) != nullptr) {
         stopWifi(wifi_instance_name);
     } else {
@@ -283,3 +275,17 @@
         });
     return !operation_failed;
 }
+
+bool waitForFrameworkReady() {
+    int waitCount = 10;
+    do {
+        // Check whether package service is ready or not.
+        if (!testing::checkSubstringInCommandOutput(
+                "/system/bin/service check package", ": not found")) {
+            return true;
+        }
+        LOG(INFO) << "Framework is not ready";
+        sleep(1);
+    } while (waitCount-- > 0);
+    return false;
+}
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
index 1ccf091..33945cc 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
@@ -17,6 +17,8 @@
 #ifndef SUPPLICANT_HIDL_TEST_UTILS_H
 #define SUPPLICANT_HIDL_TEST_UTILS_H
 
+#include <VtsCoreUtil.h>
+#include <android-base/logging.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicant.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantP2pIface.h>
 #include <android/hardware/wifi/supplicant/1.0/ISupplicantStaIface.h>
@@ -62,4 +64,51 @@
 
 bool turnOnExcessiveLogging();
 
+bool waitForFrameworkReady();
+
+class SupplicantHidlTestBase
+    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+   public:
+    virtual void SetUp() override {
+        // should always be v1.0 wifi
+        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
+        supplicant_instance_name_ = std::get<1>(GetParam());
+        std::system("/system/bin/start");
+        ASSERT_TRUE(waitForFrameworkReady());
+
+        isP2pOn_ =
+            testing::deviceSupportsFeature("android.hardware.wifi.direct");
+        // Stop Framework
+        std::system("/system/bin/stop");
+        stopSupplicant(wifi_v1_0_instance_name_);
+        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
+                                             supplicant_instance_name_);
+        LOG(INFO) << "SupplicantHidlTestBase isP2pOn_: " << isP2pOn_;
+    }
+
+    virtual void TearDown() override {
+        stopSupplicant(wifi_v1_0_instance_name_);
+        // Start Framework
+        std::system("/system/bin/start");
+    }
+
+   protected:
+    bool isP2pOn_ = false;
+    std::string wifi_v1_0_instance_name_;
+    std::string supplicant_instance_name_;
+};
+
+class SupplicantHidlTestBaseV1_0 : public SupplicantHidlTestBase {
+   public:
+    virtual void SetUp() override {
+        SupplicantHidlTestBase::SetUp();
+        supplicant_ = getSupplicant(supplicant_instance_name_, isP2pOn_);
+        ASSERT_NE(supplicant_.get(), nullptr);
+        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+    }
+
+   protected:
+    android::sp<android::hardware::wifi::supplicant::V1_0::ISupplicant>
+        supplicant_;
+};
 #endif /* SUPPLICANT_HIDL_TEST_UTILS_H */
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp
index 616869b..e74fd59 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_p2p_iface_hidl_test.cpp
@@ -71,21 +71,13 @@
 constexpr SupplicantNetworkId kTestNetworkId = 5;
 }  // namespace
 
-class SupplicantP2pIfaceHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantP2pIfaceHidlTest : public SupplicantHidlTestBaseV1_0 {
    public:
     virtual void SetUp() override {
-        wifi_instance_name_ = std::get<0>(GetParam());
-        supplicant_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-        stopSupplicant(wifi_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_instance_name_,
-                                             supplicant_instance_name_);
-        supplicant_ = getSupplicant(supplicant_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_0::SetUp();
+        if (!isP2pOn_) {
+            GTEST_SKIP() << "Wi-Fi Direct is not supported, skip this test.";
+        }
         p2p_iface_ = getSupplicantP2pIface(supplicant_);
         ASSERT_NE(p2p_iface_.get(), nullptr);
 
@@ -93,22 +85,11 @@
         memcpy(peer_mac_addr_.data(), kTestPeerMacAddr, peer_mac_addr_.size());
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
-    bool isP2pOn_ = false;
-    sp<ISupplicant> supplicant_;
-    // ISupplicantP2pIface object used for all tests in this fixture.
     sp<ISupplicantP2pIface> p2p_iface_;
     // MAC address to use for various tests.
     std::array<uint8_t, 6> mac_addr_;
     std::array<uint8_t, 6> peer_mac_addr_;
-    std::string wifi_instance_name_;
-    std::string supplicant_instance_name_;
 };
 
 class IfaceCallback : public ISupplicantP2pIfaceCallback {
@@ -201,8 +182,8 @@
  * successfully created.
  */
 TEST_P(SupplicantP2pIfaceHidlTest, Create) {
-    stopSupplicant(wifi_instance_name_);
-    startSupplicantAndWaitForHidlService(wifi_instance_name_,
+    stopSupplicant(wifi_v1_0_instance_name_);
+    startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
                                          supplicant_instance_name_);
     sp<ISupplicantP2pIface> p2p_iface = getSupplicantP2pIface(
         getSupplicant(supplicant_instance_name_, isP2pOn_));
@@ -301,8 +282,8 @@
         mac_addr_, ISupplicantP2pIface::WpsProvisionMethod::PBC,
         kTestConnectPin, false, false, kTestConnectGoIntent,
         [](const SupplicantStatus& status, const hidl_string& /* pin */) {
-            // This is not going to work with fake values.
-            EXPECT_EQ(SupplicantStatusCode::FAILURE_UNKNOWN, status.code);
+            // After enabling auto-join, it will succeed always.
+            EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
         });
 }
 
@@ -314,12 +295,12 @@
         mac_addr_, ISupplicantP2pIface::WpsProvisionMethod::PBC,
         kTestConnectPin, false, false, kTestConnectGoIntent,
         [](const SupplicantStatus& status, const hidl_string& /* pin */) {
-            // This is not going to work with fake values.
-            EXPECT_EQ(SupplicantStatusCode::FAILURE_UNKNOWN, status.code);
+            // After enabling auto-join, it will succeed always.
+            EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
         });
 
     p2p_iface_->cancelConnect([](const SupplicantStatus& status) {
-        EXPECT_EQ(SupplicantStatusCode::FAILURE_UNKNOWN, status.code);
+        EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
     });
 }
 
@@ -655,4 +636,4 @@
             android::hardware::getAllHalInstanceNames(IWifi::descriptor)),
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(
             ISupplicant::descriptor))),
-    android::hardware::PrintInstanceTupleNameToString<>);
\ No newline at end of file
+    android::hardware::PrintInstanceTupleNameToString<>);
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp
index e4fe52c..6b85e00 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -66,42 +66,22 @@
 constexpr uint16_t kTestWpsConfigMethods = 0xffff;
 }  // namespace
 
-class SupplicantStaIfaceHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBaseV1_0 {
    public:
     virtual void SetUp() override {
-        wifi_instance_name_ = std::get<0>(GetParam());
-        supplicant_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-        stopSupplicant(wifi_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_instance_name_,
-                                             supplicant_instance_name_);
-        supplicant_ = getSupplicant(supplicant_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_0::SetUp();
         sta_iface_ = getSupplicantStaIface(supplicant_);
         ASSERT_NE(sta_iface_.get(), nullptr);
 
         memcpy(mac_addr_.data(), kTestMacAddr, mac_addr_.size());
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
     bool isP2pOn_ = false;
-    sp<ISupplicant> supplicant_;
     // ISupplicantStaIface object used for all tests in this fixture.
     sp<ISupplicantStaIface> sta_iface_;
     // MAC address to use for various tests.
     std::array<uint8_t, 6> mac_addr_;
-    std::string wifi_instance_name_;
-    std::string supplicant_instance_name_;
 };
 
 class IfaceCallback : public ISupplicantStaIfaceCallback {
@@ -183,8 +163,8 @@
  * successfully created.
  */
 TEST_P(SupplicantStaIfaceHidlTest, Create) {
-    stopSupplicant(wifi_instance_name_);
-    startSupplicantAndWaitForHidlService(wifi_instance_name_,
+    stopSupplicant(wifi_v1_0_instance_name_);
+    startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
                                          supplicant_instance_name_);
     EXPECT_NE(nullptr, getSupplicantStaIface(
                            getSupplicant(supplicant_instance_name_, isP2pOn_))
@@ -566,4 +546,4 @@
             android::hardware::getAllHalInstanceNames(IWifi::descriptor)),
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(
             ISupplicant::descriptor))),
-    android::hardware::PrintInstanceTupleNameToString<>);
\ No newline at end of file
+    android::hardware::PrintInstanceTupleNameToString<>);
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp
index 7e93c5f..2b4d681 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -79,21 +79,10 @@
      ISupplicantStaNetwork::PairwiseCipherMask::TKIP);
 }  // namespace
 
-class SupplicantStaNetworkHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBaseV1_0 {
    public:
     virtual void SetUp() override {
-        wifi_instance_name_ = std::get<0>(GetParam());
-        supplicant_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-        stopSupplicant(wifi_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_instance_name_,
-                                             supplicant_instance_name_);
-        supplicant_ = getSupplicant(supplicant_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_0::SetUp();
         sta_network_ = createSupplicantStaNetwork(supplicant_);
         ASSERT_NE(sta_network_.get(), nullptr);
         /* variable used to check if the underlying HAL version is 1.3 or
@@ -105,12 +94,6 @@
         ssid_.assign(kTestSsidStr, kTestSsidStr + strlen(kTestSsidStr));
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
     void removeNetwork() {
         sp<ISupplicantStaIface> sta_iface = getSupplicantStaIface(supplicant_);
@@ -128,14 +111,10 @@
 
     sp<::android::hardware::wifi::supplicant::V1_3::ISupplicantStaNetwork>
         v1_3 = nullptr;
-    bool isP2pOn_ = false;
-    sp<ISupplicant> supplicant_;
     // ISupplicantStaNetwork object used for all tests in this fixture.
     sp<ISupplicantStaNetwork> sta_network_;
     // SSID to use for various tests.
     std::vector<uint8_t> ssid_;
-    std::string wifi_instance_name_;
-    std::string supplicant_instance_name_;
 };
 
 class NetworkCallback : public ISupplicantStaNetworkCallback {
@@ -158,8 +137,8 @@
  * successfully created.
  */
 TEST_P(SupplicantStaNetworkHidlTest, Create) {
-    stopSupplicant(wifi_instance_name_);
-    startSupplicantAndWaitForHidlService(wifi_instance_name_,
+    stopSupplicant(wifi_v1_0_instance_name_);
+    startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
                                          supplicant_instance_name_);
     sp<ISupplicant> supplicant =
         getSupplicant(supplicant_instance_name_, isP2pOn_);
diff --git a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
index 0e404e7..3c4d06b 100644
--- a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
+++ b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test.cpp
@@ -35,9 +35,9 @@
 using ::android::hardware::wifi::supplicant::V1_1::ISupplicant;
 using ::android::sp;
 
-class SupplicantHidlTest : public SupplicantHidlTestBase {
+class SupplicantHidlTest : public SupplicantHidlTestBaseV1_1 {
    public:
-    virtual void SetUp() override { SupplicantHidlTestBase::SetUp(); }
+    virtual void SetUp() override { SupplicantHidlTestBaseV1_1::SetUp(); }
 
    protected:
     std::string getWlan0IfaceName() {
diff --git a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test_utils_1_1.h b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test_utils_1_1.h
index 2104794..b6feb41 100644
--- a/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test_utils_1_1.h
+++ b/wifi/supplicant/1.1/vts/functional/supplicant_hidl_test_utils_1_1.h
@@ -36,34 +36,15 @@
     const android::sp<android::hardware::wifi::supplicant::V1_1::ISupplicant>&
         supplicant);
 
-class SupplicantHidlTestBase
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantHidlTestBaseV1_1 : public SupplicantHidlTestBase {
    public:
     virtual void SetUp() override {
-        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
-        supplicant_v1_1_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-        stopSupplicant(wifi_v1_0_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                             supplicant_v1_1_instance_name_);
-        supplicant_ =
-            getSupplicant_1_1(supplicant_v1_1_instance_name_, isP2pOn_);
+        SupplicantHidlTestBase::SetUp();
+        supplicant_ = getSupplicant_1_1(supplicant_instance_name_, isP2pOn_);
         ASSERT_NE(supplicant_.get(), nullptr);
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_v1_0_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
     android::sp<android::hardware::wifi::supplicant::V1_1::ISupplicant>
         supplicant_;
-    bool isP2pOn_ = false;
-    std::string wifi_v1_0_instance_name_;
-    std::string supplicant_v1_1_instance_name_;
 };
diff --git a/wifi/supplicant/1.1/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.1/vts/functional/supplicant_sta_iface_hidl_test.cpp
index 2fade44..db6323c 100644
--- a/wifi/supplicant/1.1/vts/functional/supplicant_sta_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.1/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -39,11 +39,10 @@
 using ::android::hardware::wifi::supplicant::V1_1::ISupplicantStaIface;
 using ::android::hardware::wifi::supplicant::V1_1::ISupplicantStaIfaceCallback;
 
-class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBase {
+class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBaseV1_1 {
    public:
     virtual void SetUp() override {
-        SupplicantHidlTestBase::SetUp();
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_1::SetUp();
         sta_iface_ = getSupplicantStaIface_1_1(supplicant_);
         ASSERT_NE(sta_iface_.get(), nullptr);
     }
@@ -149,4 +148,4 @@
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(
             android::hardware::wifi::supplicant::V1_1::ISupplicant::
                 descriptor))),
-    android::hardware::PrintInstanceTupleNameToString<>);
\ No newline at end of file
+    android::hardware::PrintInstanceTupleNameToString<>);
diff --git a/wifi/supplicant/1.1/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.1/vts/functional/supplicant_sta_network_hidl_test.cpp
index bd8a2ab..37641a4 100644
--- a/wifi/supplicant/1.1/vts/functional/supplicant_sta_network_hidl_test.cpp
+++ b/wifi/supplicant/1.1/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -37,11 +37,10 @@
 constexpr uint8_t kTestEncryptedIdentity[] = {0x35, 0x37, 0x58, 0x57, 0x26};
 }  // namespace
 
-class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBase {
+class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBaseV1_1 {
    public:
     virtual void SetUp() override {
-        SupplicantHidlTestBase::SetUp();
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_1::SetUp();
         sta_network_ = createSupplicantStaNetwork_1_1(supplicant_);
         ASSERT_NE(sta_network_.get(), nullptr);
     }
@@ -59,9 +58,9 @@
 TEST_P(SupplicantStaNetworkHidlTest, Create) {
     stopSupplicant(wifi_v1_0_instance_name_);
     startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                         supplicant_v1_1_instance_name_);
+                                         supplicant_instance_name_);
     sp<ISupplicant> supplicant =
-        getSupplicant_1_1(supplicant_v1_1_instance_name_, isP2pOn_);
+        getSupplicant_1_1(supplicant_instance_name_, isP2pOn_);
     EXPECT_NE(nullptr, createSupplicantStaNetwork_1_1(supplicant).get());
 }
 
@@ -102,4 +101,4 @@
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(
             android::hardware::wifi::supplicant::V1_1::ISupplicant::
                 descriptor))),
-    android::hardware::PrintInstanceTupleNameToString<>);
\ No newline at end of file
+    android::hardware::PrintInstanceTupleNameToString<>);
diff --git a/wifi/supplicant/1.2/vts/functional/supplicant_hidl_test_utils_1_2.h b/wifi/supplicant/1.2/vts/functional/supplicant_hidl_test_utils_1_2.h
index 2a432d0..b9c5ade 100644
--- a/wifi/supplicant/1.2/vts/functional/supplicant_hidl_test_utils_1_2.h
+++ b/wifi/supplicant/1.2/vts/functional/supplicant_hidl_test_utils_1_2.h
@@ -42,35 +42,16 @@
     const android::sp<android::hardware::wifi::supplicant::V1_2::ISupplicant>&
         supplicant);
 
-class SupplicantHidlTestBase
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantHidlTestBaseV1_2 : public SupplicantHidlTestBase {
    public:
     virtual void SetUp() override {
-        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
-        supplicant_v1_2_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-        stopSupplicant(wifi_v1_0_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                             supplicant_v1_2_instance_name_);
-        supplicant_ =
-            getSupplicant_1_2(supplicant_v1_2_instance_name_, isP2pOn_);
+        SupplicantHidlTestBase::SetUp();
+        supplicant_ = getSupplicant_1_2(supplicant_instance_name_, isP2pOn_);
         ASSERT_NE(supplicant_.get(), nullptr);
         EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_v1_0_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
     android::sp<android::hardware::wifi::supplicant::V1_2::ISupplicant>
         supplicant_;
-    bool isP2pOn_ = false;
-    std::string wifi_v1_0_instance_name_;
-    std::string supplicant_v1_2_instance_name_;
 };
diff --git a/wifi/supplicant/1.2/vts/functional/supplicant_p2p_iface_hidl_test.cpp b/wifi/supplicant/1.2/vts/functional/supplicant_p2p_iface_hidl_test.cpp
index 75512d7..7884cc6 100644
--- a/wifi/supplicant/1.2/vts/functional/supplicant_p2p_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.2/vts/functional/supplicant_p2p_iface_hidl_test.cpp
@@ -38,11 +38,10 @@
 constexpr uint8_t kTestZeroMacAddr[] = {[0 ... 5] = 0x0};
 }  // namespace
 
-class SupplicantP2pIfaceHidlTest : public SupplicantHidlTestBase {
+class SupplicantP2pIfaceHidlTest : public SupplicantHidlTestBaseV1_2 {
    public:
     virtual void SetUp() override {
-        SupplicantHidlTestBase::SetUp();
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_2::SetUp();
         if (!isP2pOn_) {
             GTEST_SKIP() << "Wi-Fi Direct is not supported, skip this test.";
         }
diff --git a/wifi/supplicant/1.2/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.2/vts/functional/supplicant_sta_iface_hidl_test.cpp
index 184543b..cd08468 100644
--- a/wifi/supplicant/1.2/vts/functional/supplicant_sta_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.2/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -53,11 +53,10 @@
 #define TIMEOUT_PERIOD 60
 class IfaceDppCallback;
 
-class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBase {
+class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBaseV1_2 {
    public:
     virtual void SetUp() override {
-        SupplicantHidlTestBase::SetUp();
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_2::SetUp();
         sta_iface_ = getSupplicantStaIface_1_2(supplicant_);
         ASSERT_NE(sta_iface_.get(), nullptr);
         count_ = 0;
diff --git a/wifi/supplicant/1.2/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.2/vts/functional/supplicant_sta_network_hidl_test.cpp
index 5a2f808..ee5de69 100644
--- a/wifi/supplicant/1.2/vts/functional/supplicant_sta_network_hidl_test.cpp
+++ b/wifi/supplicant/1.2/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -37,10 +37,10 @@
 // constexpr uint8_t kTestEncryptedIdentity[] = {0x35, 0x37, 0x58, 0x57, 0x26};
 //}  // namespace
 
-class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBase {
+class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBaseV1_2 {
    public:
     virtual void SetUp() override {
-        SupplicantHidlTestBase::SetUp();
+        SupplicantHidlTestBaseV1_2::SetUp();
         sta_network_ = createSupplicantStaNetwork_1_2(supplicant_);
         ASSERT_NE(sta_network_.get(), nullptr);
     }
diff --git a/wifi/supplicant/1.3/vts/functional/supplicant_hidl_test_utils_1_3.h b/wifi/supplicant/1.3/vts/functional/supplicant_hidl_test_utils_1_3.h
index 69fc598..b28c5a4 100644
--- a/wifi/supplicant/1.3/vts/functional/supplicant_hidl_test_utils_1_3.h
+++ b/wifi/supplicant/1.3/vts/functional/supplicant_hidl_test_utils_1_3.h
@@ -34,4 +34,17 @@
 bool isFilsSupported(
     android::sp<android::hardware::wifi::supplicant::V1_3::ISupplicantStaIface>
         sta_iface);
+
+class SupplicantHidlTestBaseV1_3 : public SupplicantHidlTestBase {
+   public:
+    virtual void SetUp() override {
+        SupplicantHidlTestBase::SetUp();
+        supplicant_ = getSupplicant_1_3(supplicant_instance_name_, isP2pOn_);
+        ASSERT_NE(supplicant_.get(), nullptr);
+    }
+
+   protected:
+    android::sp<android::hardware::wifi::supplicant::V1_3::ISupplicant>
+        supplicant_;
+};
 #endif /* SUPPLICANT_HIDL_TEST_UTILS_1_3_H */
diff --git a/wifi/supplicant/1.3/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.3/vts/functional/supplicant_sta_iface_hidl_test.cpp
index 221c393..6dc267c 100644
--- a/wifi/supplicant/1.3/vts/functional/supplicant_sta_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.3/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -55,33 +55,14 @@
 #define TIMEOUT_PERIOD 60
 class IfaceDppCallback;
 
-class SupplicantStaIfaceHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBaseV1_3 {
    public:
     virtual void SetUp() override {
-        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
-        supplicant_v1_3_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-
-        stopSupplicant(wifi_v1_0_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                             supplicant_v1_3_instance_name_);
-        supplicant_ =
-            getSupplicant_1_3(supplicant_v1_3_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_3::SetUp();
         sta_iface_ = getSupplicantStaIface_1_3(supplicant_);
         ASSERT_NE(sta_iface_.get(), nullptr);
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_v1_0_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
     int64_t pmkCacheExpirationTimeInSec;
     std::vector<uint8_t> serializedPmkCacheEntry;
 
@@ -127,10 +108,6 @@
    protected:
     // ISupplicantStaIface object used for all tests in this fixture.
     sp<ISupplicantStaIface> sta_iface_;
-    sp<ISupplicant> supplicant_;
-    bool isP2pOn_ = false;
-    std::string wifi_v1_0_instance_name_;
-    std::string supplicant_v1_3_instance_name_;
 
     bool isDppSupported() {
         uint32_t keyMgmtMask = 0;
diff --git a/wifi/supplicant/1.3/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.3/vts/functional/supplicant_sta_network_hidl_test.cpp
index 11c55a6..12d8d0d 100644
--- a/wifi/supplicant/1.3/vts/functional/supplicant_sta_network_hidl_test.cpp
+++ b/wifi/supplicant/1.3/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -43,43 +43,20 @@
 constexpr OcspType kTestInvalidOcspType = (OcspType)-1;
 }  // namespace
 
-class SupplicantStaNetworkHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantStaNetworkHidlTest : public SupplicantHidlTestBaseV1_3 {
    public:
     virtual void SetUp() override {
-        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
-        supplicant_v1_3_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-        // Stop Framework
-        std::system("/system/bin/stop");
-
-        stopSupplicant(wifi_v1_0_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                             supplicant_v1_3_instance_name_);
-        supplicant_ =
-            getSupplicant_1_3(supplicant_v1_3_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_3::SetUp();
         sta_iface_ = getSupplicantStaIface_1_3(supplicant_);
         ASSERT_NE(nullptr, sta_iface_.get());
         sta_network_ = createSupplicantStaNetwork_1_3(supplicant_);
         ASSERT_NE(sta_network_.get(), nullptr);
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_v1_0_instance_name_);
-        // Start Framework
-        std::system("/system/bin/start");
-    }
-
    protected:
     sp<ISupplicantStaIface> sta_iface_;
     // ISupplicantStaNetwork object used for all tests in this fixture.
     sp<ISupplicantStaNetwork> sta_network_;
-    sp<ISupplicant> supplicant_;
-    bool isP2pOn_ = false;
-    std::string wifi_v1_0_instance_name_;
-    std::string supplicant_v1_3_instance_name_;
 
     bool isWapiSupported() {
         uint32_t keyMgmtMask = 0;
diff --git a/wifi/supplicant/1.4/Android.bp b/wifi/supplicant/1.4/Android.bp
index f3a7cf8..df0b23a 100644
--- a/wifi/supplicant/1.4/Android.bp
+++ b/wifi/supplicant/1.4/Android.bp
@@ -7,6 +7,7 @@
         "types.hal",
         "ISupplicant.hal",
         "ISupplicantStaIface.hal",
+        "ISupplicantStaNetwork.hal",
     ],
     interfaces: [
         "android.hardware.wifi.supplicant@1.0",
diff --git a/wifi/supplicant/1.4/ISupplicantStaNetwork.hal b/wifi/supplicant/1.4/ISupplicantStaNetwork.hal
new file mode 100644
index 0000000..7b043d0
--- /dev/null
+++ b/wifi/supplicant/1.4/ISupplicantStaNetwork.hal
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant@1.4;
+
+import @1.3::ISupplicantStaNetwork;
+import @1.0::SupplicantStatus;
+
+/**
+ * Interface exposed by the supplicant for each station mode network
+ * configuration it controls.
+ */
+interface ISupplicantStaNetwork extends @1.3::ISupplicantStaNetwork {
+    /**
+     * Possible mask of values for PairwiseCipher param.
+     */
+    enum PairwiseCipherMask : @1.3::ISupplicantStaNetwork.PairwiseCipherMask {
+        /**
+         * GCMP-128 Pairwise Cipher
+         */
+        GCMP_128 = 1 << 9,
+    };
+
+    /**
+     * Possible mask of values for GroupCipher param.
+     */
+    enum GroupCipherMask : @1.3::ISupplicantStaNetwork.GroupCipherMask {
+        /**
+         * GCMP-128 Group Cipher
+         */
+        GCMP_128 = 1 << 9,
+    };
+
+    /**
+     * Set group cipher mask for the network.
+     *
+     * @param groupCipherMask value to set.
+     *        Combination of |ProtoMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+     */
+    setGroupCipher_1_4(bitfield<GroupCipherMask> groupCipherMask)
+        generates (SupplicantStatus status);
+
+    /**
+     * Get the group cipher mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+     * @return groupCipherMask Combination of |GroupCipherMask| values.
+     */
+    getGroupCipher_1_4()
+        generates (SupplicantStatus status, bitfield<GroupCipherMask> groupCipherMask);
+
+    /**
+     * Set pairwise cipher mask for the network.
+     *
+     * @param pairwiseCipherMask value to set.
+     *        Combination of |ProtoMask| values.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+     */
+    setPairwiseCipher_1_4(bitfield<PairwiseCipherMask> pairwiseCipherMask)
+        generates (SupplicantStatus status);
+
+    /**
+     * Get the pairwise cipher mask set for the network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+     * @return pairwiseCipherMask Combination of |PairwiseCipherMask| values.
+     */
+    getPairwiseCipher_1_4()
+        generates (SupplicantStatus status, bitfield<PairwiseCipherMask> pairwiseCipherMask);
+
+    /**
+     * Set whether to enable enhanced directional multi-gigabit (802.11ay EDMG).
+     * Only allowed if hw mode is |HOSTAPD_MODE_IEEE80211AD|
+     *
+     * @param enable true to set, false otherwise.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    setEdmg(bool enable) generates (SupplicantStatus status);
+
+    /**
+     * Get whether enhanced directional multi-gigabit (802.11ay EDMG) is enabled for this network.
+     *
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     * @return enabled true if set, false otherwise.
+     */
+    getEdmg() generates (SupplicantStatus status, bool enabled);
+};
diff --git a/wifi/supplicant/1.4/vts/functional/supplicant_hidl_test_utils_1_4.h b/wifi/supplicant/1.4/vts/functional/supplicant_hidl_test_utils_1_4.h
index bea4dc1..60fe1dc 100644
--- a/wifi/supplicant/1.4/vts/functional/supplicant_hidl_test_utils_1_4.h
+++ b/wifi/supplicant/1.4/vts/functional/supplicant_hidl_test_utils_1_4.h
@@ -27,4 +27,17 @@
 android::sp<android::hardware::wifi::supplicant::V1_4::ISupplicant>
 getSupplicant_1_4(const std::string& supplicant_instance_name, bool isP2pOn);
 
+class SupplicantHidlTestBaseV1_4 : public SupplicantHidlTestBase {
+   public:
+    virtual void SetUp() override {
+        SupplicantHidlTestBase::SetUp();
+        supplicant_ = getSupplicant_1_4(supplicant_instance_name_, isP2pOn_);
+        ASSERT_NE(supplicant_.get(), nullptr);
+        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+    }
+
+   protected:
+    android::sp<android::hardware::wifi::supplicant::V1_4::ISupplicant>
+        supplicant_;
+};
 #endif /* SUPPLICANT_HIDL_TEST_UTILS_1_4_H */
diff --git a/wifi/supplicant/1.4/vts/functional/supplicant_sta_iface_hidl_test.cpp b/wifi/supplicant/1.4/vts/functional/supplicant_sta_iface_hidl_test.cpp
index 0a20455..5b9c750 100644
--- a/wifi/supplicant/1.4/vts/functional/supplicant_sta_iface_hidl_test.cpp
+++ b/wifi/supplicant/1.4/vts/functional/supplicant_sta_iface_hidl_test.cpp
@@ -40,36 +40,17 @@
 using ::android::hardware::wifi::supplicant::V1_4::ISupplicant;
 using ::android::hardware::wifi::supplicant::V1_4::ISupplicantStaIface;
 
-class SupplicantStaIfaceHidlTest
-    : public ::testing::TestWithParam<std::tuple<std::string, std::string>> {
+class SupplicantStaIfaceHidlTest : public SupplicantHidlTestBaseV1_4 {
    public:
     virtual void SetUp() override {
-        wifi_v1_0_instance_name_ = std::get<0>(GetParam());
-        supplicant_v1_4_instance_name_ = std::get<1>(GetParam());
-        isP2pOn_ =
-            testing::deviceSupportsFeature("android.hardware.wifi.direct");
-
-        stopSupplicant(wifi_v1_0_instance_name_);
-        startSupplicantAndWaitForHidlService(wifi_v1_0_instance_name_,
-                                             supplicant_v1_4_instance_name_);
-        supplicant_ =
-            getSupplicant_1_4(supplicant_v1_4_instance_name_, isP2pOn_);
-        EXPECT_TRUE(turnOnExcessiveLogging(supplicant_));
+        SupplicantHidlTestBaseV1_4::SetUp();
         sta_iface_ = getSupplicantStaIface_1_4(supplicant_);
         ASSERT_NE(sta_iface_.get(), nullptr);
     }
 
-    virtual void TearDown() override {
-        stopSupplicant(wifi_v1_0_instance_name_);
-    }
-
    protected:
     // ISupplicantStaIface object used for all tests in this fixture.
     sp<ISupplicantStaIface> sta_iface_;
-    sp<ISupplicant> supplicant_;
-    bool isP2pOn_ = false;
-    std::string wifi_v1_0_instance_name_;
-    std::string supplicant_v1_4_instance_name_;
 };
 
 /*