diff --git a/audio/aidl/Android.bp b/audio/aidl/Android.bp
index 56ac510..01af940 100644
--- a/audio/aidl/Android.bp
+++ b/audio/aidl/Android.bp
@@ -226,6 +226,7 @@
     srcs: [
         "android/hardware/audio/effect/AcousticEchoCanceler.aidl",
         "android/hardware/audio/effect/AutomaticGainControl.aidl",
+        "android/hardware/audio/effect/AutomaticGainControlV1.aidl",
         "android/hardware/audio/effect/BassBoost.aidl",
         "android/hardware/audio/effect/Capability.aidl",
         "android/hardware/audio/effect/CommandId.aidl",
@@ -243,6 +244,7 @@
         "android/hardware/audio/effect/Parameter.aidl",
         "android/hardware/audio/effect/PresetReverb.aidl",
         "android/hardware/audio/effect/Processing.aidl",
+        "android/hardware/audio/effect/Range.aidl",
         "android/hardware/audio/effect/State.aidl",
         "android/hardware/audio/effect/VendorExtension.aidl",
         "android/hardware/audio/effect/Virtualizer.aidl",
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
index 1e798e1..45217e7 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
@@ -69,6 +69,11 @@
   void addDeviceEffect(int portConfigId, in android.hardware.audio.effect.IEffect effect);
   void removeDeviceEffect(int portConfigId, in android.hardware.audio.effect.IEffect effect);
   android.media.audio.common.AudioMMapPolicyInfo[] getMmapPolicyInfos(android.media.audio.common.AudioMMapPolicyType mmapPolicyType);
+  boolean supportsVariableLatency();
+  int getAAudioMixerBurstCount();
+  int getAAudioHardwareBurstMinUsec();
+  const int DEFAULT_AAUDIO_MIXER_BURST_COUNT = 2;
+  const int DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US = 1000;
   @VintfStability
   parcelable OpenInputStreamArguments {
     int portConfigId;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
similarity index 75%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
index 711ac19..ff010c6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,21 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.audio.effect;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+union AutomaticGainControlV1 {
+  android.hardware.audio.effect.VendorExtension vendor;
+  int targetPeakLevelDbFs;
+  int maxCompressionGainDb;
+  boolean enableLimiter;
+  @VintfStability
+  union Id {
+    int vendorExtensionTag;
+    android.hardware.audio.effect.AutomaticGainControlV1.Tag commonTag;
+  }
+  @VintfStability
+  parcelable Capability {
+    ParcelableHolder extension;
+    android.hardware.audio.effect.Range[] ranges;
+  }
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
index 397f897..1cf92ef 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
@@ -50,5 +50,6 @@
     LOW,
     MEDIUM,
     HIGH,
+    VERY_HIGH,
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
similarity index 69%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
index 711ac19..531d3a1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,36 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.audio.effect;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable Range {
+  int tag;
+  android.hardware.audio.effect.Range.Types types;
+  @VintfStability
+  parcelable Int {
+    int min;
+    int max;
+  }
+  @VintfStability
+  parcelable Float {
+    float min;
+    float max;
+  }
+  @VintfStability
+  parcelable Long {
+    long min;
+    long max;
+  }
+  @VintfStability
+  parcelable Byte {
+    byte min;
+    byte max;
+  }
+  @VintfStability
+  union Types {
+    android.hardware.audio.effect.Range.Int rangeInt;
+    android.hardware.audio.effect.Range.Float rangeFloat;
+    android.hardware.audio.effect.Range.Long rangeLong;
+    android.hardware.audio.effect.Range.Byte rangeByte;
+  }
 }
diff --git a/audio/aidl/android/hardware/audio/core/IModule.aidl b/audio/aidl/android/hardware/audio/core/IModule.aidl
index 7d17099..968b573 100644
--- a/audio/aidl/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/android/hardware/audio/core/IModule.aidl
@@ -822,4 +822,42 @@
      * @return The vector with mmap policy information.
      */
     AudioMMapPolicyInfo[] getMmapPolicyInfos(AudioMMapPolicyType mmapPolicyType);
+
+    /**
+     * Indicates if this module supports variable latency control for instance
+     * over Bluetooth A2DP or LE Audio links.
+     *
+     * If supported, all instances of IStreamOut interface returned by this module must
+     * implement getRecommendedLatencyModes() and setLatencyMode() APIs.
+     *
+     * @return Whether the module supports variable latency control.
+     */
+    boolean supportsVariableLatency();
+
+    /**
+     * Default value for number of bursts per aaudio mixer cycle. This is a suggested value
+     * to return for the HAL module, unless it is known that a better option exists.
+     */
+    const int DEFAULT_AAUDIO_MIXER_BURST_COUNT = 2;
+    /**
+     * Get the number of bursts per aaudio mixer cycle.
+     *
+     * @return The number of burst per aaudio mixer cycle.
+     * @throw EX_UNSUPPORTED_OPERATION If the module does not support aaudio MMAP.
+     */
+    int getAAudioMixerBurstCount();
+
+    /**
+     * Default value for minimum duration in microseconds for a MMAP hardware burst. This
+     * is a suggested value to return for the HAL module, unless it is known that a better
+     * option exists.
+     */
+    const int DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US = 1000;
+    /**
+     * Get the minimum duration in microseconds for a MMAP hardware burst.
+     *
+     * @return The minimum number of microseconds for a MMAP hardware burst.
+     * @throw EX_UNSUPPORTED_OPERATION If the module does not support aaudio MMAP.
+     */
+    int getAAudioHardwareBurstMinUsec();
 }
diff --git a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
index b60b0fd..0e58add 100644
--- a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
+++ b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
@@ -157,7 +157,8 @@
      *
      * Implementation for this method is mandatory only on specific spatial
      * audio streams indicated by AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can
-     * be routed to a BT classic sink.
+     * be routed to a BT sinks or if the implementation indicates support
+     * on all streams via IModule.supportsVariableLatency().
      *
      * @return Currently supported latency modes.
      * @throws EX_ILLEGAL_STATE If the stream is closed.
@@ -172,7 +173,8 @@
      *
      * Implementation for this method is mandatory only on specific spatial
      * audio streams indicated by AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can
-     * be routed to a BT classic sink.
+     * be routed to a BT sinks or if the implementation indicates support
+     * on all streams via IModule.supportsVariableLatency().
      *
      * @throws EX_ILLEGAL_ARGUMENT If the specified mode is not supported.
      * @throws EX_ILLEGAL_STATE If the stream is closed.
diff --git a/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl b/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl
new file mode 100644
index 0000000..d6e0648
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.effect;
+
+import android.hardware.audio.effect.Range;
+import android.hardware.audio.effect.VendorExtension;
+
+/**
+ * Automatic Gain Control (AGC) is an audio pre-processor which automatically normalizes the output
+ * of the captured signal by boosting or lowering input from the microphone to match a preset level
+ * so that the output signal level is virtually constant. AGC can be used by applications where the
+ * input signal dynamic range is not important but where a constant strong capture level is desired.
+ *
+ * All parameters defined in union AutomaticGainControlV1 must be gettable and settable. The
+ * capabilities defined in AutomaticGainControlV1.Capability can only acquired with
+ * IEffect.getDescriptor() and not settable.
+ */
+@VintfStability
+union AutomaticGainControlV1 {
+    /**
+     * Effect parameter tag to identify the parameters for getParameter().
+     */
+    @VintfStability
+    union Id {
+        int vendorExtensionTag;
+        AutomaticGainControlV1.Tag commonTag;
+    }
+
+    /**
+     * Vendor AutomaticGainControlV1 implementation definition for additional parameters.
+     */
+    VendorExtension vendor;
+
+    /**
+     * Capability supported by AutomaticGainControlV1 implementation.
+     */
+    @VintfStability
+    parcelable Capability {
+        /**
+         * AutomaticGainControlV1 capability extension, vendor can use this extension in case
+         * existing capability definition not enough.
+         */
+        ParcelableHolder extension;
+        /**
+         * Supported range for parameters.
+         */
+        Range[] ranges;
+    }
+
+    /**
+     * Target peak level (or envelope) of the AGC implementation in dBFs (dB relative to full
+     * scale).
+     * Must be in range of AutomaticGainControlV1.Capability.ranges with targetPeakLevelDbFs tag.
+     */
+    int targetPeakLevelDbFs;
+    /*
+     * Sets the maximum gain the digital compression stage may apply, in dB. A higher number
+     * corresponds to greater compression, while a value of 0 will leave the signal uncompressed.
+     * Must be in range of AutomaticGainControlV1.Capability.ranges with maxCompressionGainDb tag.
+     */
+    int maxCompressionGainDb;
+    /**
+     * Enable or disable limiter.
+     * When enabled, the compression stage will hard limit the signal to the target level.
+     * Otherwise, the signal will be compressed but not limited above the target level.
+     */
+    boolean enableLimiter;
+}
diff --git a/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl b/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
index 946fa87..9969a0b 100644
--- a/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
+++ b/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
@@ -62,7 +62,7 @@
      * suppression, NsConfig::SuppressionLevel::k12dB for MEDIUM, and
      * NsConfig::SuppressionLevel::k18dB for HIGH.
      */
-    @VintfStability @Backing(type="int") enum Level { LOW, MEDIUM, HIGH }
+    @VintfStability @Backing(type="int") enum Level { LOW, MEDIUM, HIGH, VERY_HIGH }
 
     /**
      * The NS level.
diff --git a/audio/aidl/android/hardware/audio/effect/Range.aidl b/audio/aidl/android/hardware/audio/effect/Range.aidl
new file mode 100644
index 0000000..c052502
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/effect/Range.aidl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.effect;
+
+/**
+ * Define the range (min and max) of a certain field, identified by tag.
+ * Can be used by effect capabilities to define supported value ranges.
+ */
+@VintfStability
+parcelable Range {
+    /**
+     * The union tag name which the range is defined for.
+     * For example: if used in AutomaticGainControlV1.Capability, value of Range.tag could be
+     * targetLevelDbFs or compressionGainDb.
+     */
+    int tag;
+
+    @VintfStability
+    parcelable Int {
+        int min;
+        int max;
+    }
+
+    @VintfStability
+    parcelable Float {
+        float min;
+        float max;
+    }
+
+    @VintfStability
+    parcelable Long {
+        long min;
+        long max;
+    }
+
+    @VintfStability
+    parcelable Byte {
+        byte min;
+        byte max;
+    }
+
+    @VintfStability
+    union Types {
+        Int rangeInt;
+        Float rangeFloat;
+        Long rangeLong;
+        Byte rangeByte;
+    }
+
+    Types types;
+}
diff --git a/audio/aidl/default/Configuration.cpp b/audio/aidl/default/Configuration.cpp
index 6d5357b..7b2deb7 100644
--- a/audio/aidl/default/Configuration.cpp
+++ b/audio/aidl/default/Configuration.cpp
@@ -393,4 +393,73 @@
     return std::make_unique<Configuration>(configuration);
 }
 
+// Usb configuration:
+//
+// Device ports:
+//  * "USB Headset Out", OUT_HEADSET, CONNECTION_USB
+//    - no profiles specified
+//  * "USB Headset In", IN_HEADSET, CONNECTION_USB
+//    - no profiles specified
+//
+// Mix ports:
+//  * "usb_headset output", 1 max open, 1 max active stream
+//    - no profiles specified
+//  * "usb_headset input", 1 max open, 1 max active stream
+//    - no profiles specified
+//
+// Profiles for device port connected state:
+//  * USB Headset Out":
+//    - profile PCM 16-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//    - profile PCM 24-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//  * USB Headset In":
+//    - profile PCM 16-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//    - profile PCM 24-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//
+std::unique_ptr<Configuration> getUsbConfiguration() {
+    static const Configuration configuration = []() {
+        const std::vector<AudioProfile> standardPcmAudioProfiles = {
+                createProfile(PcmType::INT_16_BIT,
+                              {AudioChannelLayout::LAYOUT_MONO, AudioChannelLayout::LAYOUT_STEREO,
+                               AudioChannelLayout::INDEX_MASK_1, AudioChannelLayout::INDEX_MASK_2},
+                              {44100, 48000}),
+                createProfile(PcmType::INT_24_BIT,
+                              {AudioChannelLayout::LAYOUT_MONO, AudioChannelLayout::LAYOUT_STEREO,
+                               AudioChannelLayout::INDEX_MASK_1, AudioChannelLayout::INDEX_MASK_2},
+                              {44100, 48000})};
+        Configuration c;
+
+        // Device ports
+
+        AudioPort usbOutHeadset =
+                createPort(c.nextPortId++, "USB Headset Out", 0, false,
+                           createDeviceExt(AudioDeviceType::OUT_HEADSET, 0,
+                                           AudioDeviceDescription::CONNECTION_USB));
+        c.ports.push_back(usbOutHeadset);
+        c.connectedProfiles[usbOutHeadset.id] = standardPcmAudioProfiles;
+
+        AudioPort usbInHeadset =
+                createPort(c.nextPortId++, "USB Headset In", 0, true,
+                           createDeviceExt(AudioDeviceType::IN_HEADSET, 0,
+                                           AudioDeviceDescription::CONNECTION_USB));
+        c.ports.push_back(usbInHeadset);
+        c.connectedProfiles[usbInHeadset.id] = standardPcmAudioProfiles;
+
+        // Mix ports
+
+        AudioPort usbHeadsetOutMix =
+                createPort(c.nextPortId++, "usb_headset output", 0, false, createPortMixExt(1, 1));
+        c.ports.push_back(usbHeadsetOutMix);
+
+        AudioPort usbHeadsetInMix =
+                createPort(c.nextPortId++, "usb_headset input", 0, true, createPortMixExt(1, 1));
+        c.ports.push_back(usbHeadsetInMix);
+
+        c.routes.push_back(createRoute({usbHeadsetOutMix}, usbOutHeadset));
+        c.routes.push_back(createRoute({usbInHeadset}, usbHeadsetInMix));
+
+        return c;
+    }();
+    return std::make_unique<Configuration>(configuration);
+}
+
 }  // namespace aidl::android::hardware::audio::core::internal
diff --git a/audio/aidl/default/EffectImpl.cpp b/audio/aidl/default/EffectImpl.cpp
index b24ca63..403a4b9 100644
--- a/audio/aidl/default/EffectImpl.cpp
+++ b/audio/aidl/default/EffectImpl.cpp
@@ -49,7 +49,6 @@
     auto context = createContext(common);
     RETURN_IF(!context, EX_NULL_POINTER, "createContextFailed");
 
-    RETURN_IF_ASTATUS_NOT_OK(setParameterCommon(common), "setCommParamErr");
     if (specific.has_value()) {
         RETURN_IF_ASTATUS_NOT_OK(setParameterSpecific(specific.value()), "setSpecParamErr");
     }
diff --git a/audio/aidl/default/Module.cpp b/audio/aidl/default/Module.cpp
index 9ca26d2..82d1ef8 100644
--- a/audio/aidl/default/Module.cpp
+++ b/audio/aidl/default/Module.cpp
@@ -259,6 +259,8 @@
             case Type::R_SUBMIX:
                 mConfig = std::move(internal::getRSubmixConfiguration());
                 break;
+            case Type::USB:
+                mConfig = std::move(internal::getUsbConfiguration());
         }
     }
     return *mConfig;
@@ -1145,4 +1147,47 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus Module::supportsVariableLatency(bool* _aidl_return) {
+    LOG(DEBUG) << __func__;
+    *_aidl_return = false;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::getAAudioMixerBurstCount(int32_t* _aidl_return) {
+    if (!isMmapSupported()) {
+        LOG(DEBUG) << __func__ << ": mmap is not supported ";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    *_aidl_return = DEFAULT_AAUDIO_MIXER_BURST_COUNT;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::getAAudioHardwareBurstMinUsec(int32_t* _aidl_return) {
+    if (!isMmapSupported()) {
+        LOG(DEBUG) << __func__ << ": mmap is not supported ";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    *_aidl_return = DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+bool Module::isMmapSupported() {
+    if (mIsMmapSupported.has_value()) {
+        return mIsMmapSupported.value();
+    }
+    std::vector<AudioMMapPolicyInfo> mmapPolicyInfos;
+    if (!getMmapPolicyInfos(AudioMMapPolicyType::DEFAULT, &mmapPolicyInfos).isOk()) {
+        mIsMmapSupported = false;
+    } else {
+        mIsMmapSupported =
+                std::find_if(mmapPolicyInfos.begin(), mmapPolicyInfos.end(), [](const auto& info) {
+                    return info.mmapPolicy == AudioMMapPolicy::AUTO ||
+                           info.mmapPolicy == AudioMMapPolicy::ALWAYS;
+                }) != mmapPolicyInfos.end();
+    }
+    return mIsMmapSupported.value();
+}
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/android.hardware.audio.service-aidl.xml b/audio/aidl/default/android.hardware.audio.service-aidl.xml
index 46b665f..9636a58 100644
--- a/audio/aidl/default/android.hardware.audio.service-aidl.xml
+++ b/audio/aidl/default/android.hardware.audio.service-aidl.xml
@@ -12,6 +12,11 @@
   <hal format="aidl">
     <name>android.hardware.audio.core</name>
     <version>1</version>
+    <fqname>IModule/usb</fqname>
+  </hal>
+  <hal format="aidl">
+    <name>android.hardware.audio.core</name>
+    <version>1</version>
     <fqname>IConfig/default</fqname>
   </hal>
 </manifest>
diff --git a/audio/aidl/default/include/core-impl/Configuration.h b/audio/aidl/default/include/core-impl/Configuration.h
index 3b4c494..1aca1fe 100644
--- a/audio/aidl/default/include/core-impl/Configuration.h
+++ b/audio/aidl/default/include/core-impl/Configuration.h
@@ -44,5 +44,6 @@
 
 std::unique_ptr<Configuration> getPrimaryConfiguration();
 std::unique_ptr<Configuration> getRSubmixConfiguration();
+std::unique_ptr<Configuration> getUsbConfiguration();
 
 }  // namespace aidl::android::hardware::audio::core::internal
diff --git a/audio/aidl/default/include/core-impl/Module.h b/audio/aidl/default/include/core-impl/Module.h
index 555506a..80a22dc 100644
--- a/audio/aidl/default/include/core-impl/Module.h
+++ b/audio/aidl/default/include/core-impl/Module.h
@@ -31,7 +31,7 @@
   public:
     // This value is used for all AudioPatches and reported by all streams.
     static constexpr int32_t kLatencyMs = 10;
-    enum Type : int { DEFAULT, R_SUBMIX };
+    enum Type : int { DEFAULT, R_SUBMIX, USB };
 
     explicit Module(Type type) : mType(type) {}
 
@@ -114,6 +114,9 @@
             ::aidl::android::media::audio::common::AudioMMapPolicyType mmapPolicyType,
             std::vector<::aidl::android::media::audio::common::AudioMMapPolicyInfo>* _aidl_return)
             override;
+    ndk::ScopedAStatus supportsVariableLatency(bool* _aidl_return) override;
+    ndk::ScopedAStatus getAAudioMixerBurstCount(int32_t* _aidl_return) override;
+    ndk::ScopedAStatus getAAudioHardwareBurstMinUsec(int32_t* _aidl_return) override;
 
     void cleanUpPatch(int32_t patchId);
     ndk::ScopedAStatus createStreamContext(
@@ -131,6 +134,7 @@
     std::set<int32_t> portIdsFromPortConfigIds(C portConfigIds);
     void registerPatch(const AudioPatch& patch);
     void updateStreamsConnectedState(const AudioPatch& oldPatch, const AudioPatch& newPatch);
+    bool isMmapSupported();
 
     // This value is used for all AudioPatches.
     static constexpr int32_t kMinimumStreamBufferSizeFrames = 16;
@@ -158,6 +162,7 @@
     bool mMicMute = false;
     std::shared_ptr<sounddose::ISoundDose> mSoundDose;
     ndk::SpAIBinder mSoundDoseBinder;
+    std::optional<bool> mIsMmapSupported;
 };
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/effect-impl/EffectContext.h b/audio/aidl/default/include/effect-impl/EffectContext.h
index 7bbf19e..2ab0ade 100644
--- a/audio/aidl/default/include/effect-impl/EffectContext.h
+++ b/audio/aidl/default/include/effect-impl/EffectContext.h
@@ -37,7 +37,6 @@
             DataMQ;
 
     EffectContext(size_t statusDepth, const Parameter::Common& common) {
-        mSessionId = common.session;
         auto& input = common.input;
         auto& output = common.output;
 
@@ -63,6 +62,7 @@
             LOG(ERROR) << __func__ << " created invalid FMQ";
         }
         mWorkBuffer.reserve(std::max(inBufferSizeInFloat, outBufferSizeInFloat));
+        mCommon = common;
     }
     virtual ~EffectContext() {}
 
@@ -88,7 +88,8 @@
     }
     size_t getInputFrameSize() { return mInputFrameSize; }
     size_t getOutputFrameSize() { return mOutputFrameSize; }
-    int getSessionId() { return mSessionId; }
+    int getSessionId() { return mCommon.session; }
+    int getIoHandle() { return mCommon.ioHandle; }
 
     virtual RetCode setOutputDevice(
             const std::vector<aidl::android::media::audio::common::AudioDeviceDescription>&
@@ -96,6 +97,7 @@
         mOutputDevice = device;
         return RetCode::SUCCESS;
     }
+
     virtual std::vector<aidl::android::media::audio::common::AudioDeviceDescription>
     getOutputDevice() {
         return mOutputDevice;
@@ -131,7 +133,6 @@
 
   protected:
     // common parameters
-    int mSessionId = INVALID_AUDIO_SESSION_ID;
     size_t mInputFrameSize;
     size_t mOutputFrameSize;
     Parameter::Common mCommon;
diff --git a/audio/aidl/default/main.cpp b/audio/aidl/default/main.cpp
index b66c134..1933509 100644
--- a/audio/aidl/default/main.cpp
+++ b/audio/aidl/default/main.cpp
@@ -55,7 +55,8 @@
         return std::make_pair(module, moduleBinder);
     };
     auto modules = {createModule(Module::Type::DEFAULT, "default"),
-                    createModule(Module::Type::R_SUBMIX, "r_submix")};
+                    createModule(Module::Type::R_SUBMIX, "r_submix"),
+                    createModule(Module::Type::USB, "usb")};
 
     ABinderProcess_joinThreadPool();
     return EXIT_FAILURE;  // should not reach
diff --git a/audio/aidl/vts/ModuleConfig.cpp b/audio/aidl/vts/ModuleConfig.cpp
index b48d1ba..7b002ad 100644
--- a/audio/aidl/vts/ModuleConfig.cpp
+++ b/audio/aidl/vts/ModuleConfig.cpp
@@ -438,3 +438,11 @@
     }
     return result;
 }
+
+bool ModuleConfig::isMmapSupported() const {
+    const std::vector<AudioPort> mmapOutMixPorts =
+            getMmapOutMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+    const std::vector<AudioPort> mmapInMixPorts =
+            getMmapInMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+    return !mmapOutMixPorts.empty() || !mmapInMixPorts.empty();
+}
diff --git a/audio/aidl/vts/ModuleConfig.h b/audio/aidl/vts/ModuleConfig.h
index 8a55754..6a22075 100644
--- a/audio/aidl/vts/ModuleConfig.h
+++ b/audio/aidl/vts/ModuleConfig.h
@@ -139,6 +139,8 @@
         return *config.begin();
     }
 
+    bool isMmapSupported() const;
+
     std::string toString() const;
 
   private:
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index 21ad0e6..3ca51c7 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -1893,20 +1893,49 @@
 
 TEST_P(AudioCoreModule, GetMmapPolicyInfos) {
     ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
-    const std::vector<AudioPort> mmapOutMixPorts =
-            moduleConfig->getMmapOutMixPorts(false /*attachedOnly*/, false /*singlePort*/);
-    const std::vector<AudioPort> mmapInMixPorts =
-            moduleConfig->getMmapInMixPorts(false /*attachedOnly*/, false /*singlePort*/);
-    const bool mmapSupported = (!mmapOutMixPorts.empty() || !mmapInMixPorts.empty());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
     for (const auto mmapPolicyType :
          {AudioMMapPolicyType::DEFAULT, AudioMMapPolicyType::EXCLUSIVE}) {
         std::vector<AudioMMapPolicyInfo> policyInfos;
         EXPECT_IS_OK(module->getMmapPolicyInfos(mmapPolicyType, &policyInfos))
                 << toString(mmapPolicyType);
-        EXPECT_EQ(mmapSupported, !policyInfos.empty());
+        EXPECT_EQ(isMmapSupported, !policyInfos.empty());
     }
 }
 
+TEST_P(AudioCoreModule, BluetoothVariableLatency) {
+    bool isSupported = false;
+    EXPECT_IS_OK(module->supportsVariableLatency(&isSupported));
+    LOG(INFO) << "supportsVariableLatency: " << isSupported;
+}
+
+TEST_P(AudioCoreModule, GetAAudioMixerBurstCount) {
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
+    int32_t mixerBursts = 0;
+    ndk::ScopedAStatus status = module->getAAudioMixerBurstCount(&mixerBursts);
+    EXPECT_EQ(isMmapSupported, status.getExceptionCode() != EX_UNSUPPORTED_OPERATION)
+            << "Support for AAudio MMAP and getting AAudio mixer burst count must be consistent";
+    if (!isMmapSupported) {
+        GTEST_SKIP() << "AAudio MMAP is not supported";
+    }
+    EXPECT_GE(mixerBursts, 0);
+}
+
+TEST_P(AudioCoreModule, GetAAudioHardwareBurstMinUsec) {
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
+    int32_t aaudioHardwareBurstMinUsec = 0;
+    ndk::ScopedAStatus status = module->getAAudioHardwareBurstMinUsec(&aaudioHardwareBurstMinUsec);
+    EXPECT_EQ(isMmapSupported, status.getExceptionCode() != EX_UNSUPPORTED_OPERATION)
+            << "Support for AAudio MMAP and getting AAudio hardware burst minimum usec "
+            << "must be consistent";
+    if (!isMmapSupported) {
+        GTEST_SKIP() << "AAudio MMAP is not supported";
+    }
+    EXPECT_GE(aaudioHardwareBurstMinUsec, 0);
+}
+
 class AudioCoreBluetooth : public AudioCoreModuleBase, public testing::TestWithParam<std::string> {
   public:
     void SetUp() override {
@@ -2344,7 +2373,7 @@
 
     void HwGainHwVolume() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, false /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2383,7 +2412,7 @@
     // it as an invalid argument, or say that offloaded effects are not supported.
     void AddRemoveEffectInvalidArguments() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, false /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2664,7 +2693,7 @@
 }
 
 TEST_P(AudioStreamOut, AudioDescriptionMixLevel) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2692,7 +2721,7 @@
 }
 
 TEST_P(AudioStreamOut, DualMonoMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2716,7 +2745,7 @@
 }
 
 TEST_P(AudioStreamOut, LatencyMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
diff --git a/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp b/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
index 3cab204..2706c49 100644
--- a/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
+++ b/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
@@ -619,6 +619,7 @@
         getPhysicalCameraIds(cam.id, isLogicalCam);
         if (mIsHwModule && isLogicalCam) {
             LOG(INFO) << "Skip a logical device " << cam.id << " for HW target.";
+            ASSERT_TRUE(mEnumerator->closeDisplay(pDisplay).isOk());
             continue;
         }
 
@@ -1437,7 +1438,8 @@
         ASSERT_TRUE(pCam1->getParameterList(&cam1Cmds).isOk());
         if (cam0Cmds.size() < 1 || cam1Cmds.size() < 1) {
             // Cannot execute this test.
-            return;
+            ASSERT_TRUE(mEnumerator->closeDisplay(pDisplay).isOk());
+            continue;
         }
 
         // Set up a frame receiver object which will fire up its own thread.
diff --git a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyAccess.aidl b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyAccess.aidl
index ec9587f..dde9a88 100644
--- a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyAccess.aidl
+++ b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyAccess.aidl
@@ -34,8 +34,8 @@
 package android.hardware.automotive.vehicle;
 @Backing(type="int") @VintfStability
 enum VehiclePropertyAccess {
-  NONE = 0,
-  READ = 1,
-  WRITE = 2,
-  READ_WRITE = 3,
+  NONE = 0x00,
+  READ = 0x01,
+  WRITE = 0x02,
+  READ_WRITE = 0x03,
 }
diff --git a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyChangeMode.aidl b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyChangeMode.aidl
index 5455fdd..2f9d107 100644
--- a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyChangeMode.aidl
+++ b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyChangeMode.aidl
@@ -34,7 +34,7 @@
 package android.hardware.automotive.vehicle;
 @Backing(type="int") @VintfStability
 enum VehiclePropertyChangeMode {
-  STATIC = 0,
-  ON_CHANGE = 1,
-  CONTINUOUS = 2,
+  STATIC = 0x00,
+  ON_CHANGE = 0x01,
+  CONTINUOUS = 0x02,
 }
diff --git a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyStatus.aidl b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyStatus.aidl
index 6d0e041..642ce83 100644
--- a/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyStatus.aidl
+++ b/automotive/vehicle/aidl/aidl_api/android.hardware.automotive.vehicle/current/android/hardware/automotive/vehicle/VehiclePropertyStatus.aidl
@@ -34,7 +34,7 @@
 package android.hardware.automotive.vehicle;
 @Backing(type="int") @VintfStability
 enum VehiclePropertyStatus {
-  AVAILABLE = 0,
-  UNAVAILABLE = 1,
-  ERROR = 2,
+  AVAILABLE = 0x00,
+  UNAVAILABLE = 0x01,
+  ERROR = 0x02,
 }
diff --git a/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h b/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
index 8b77040..aef5fe7 100644
--- a/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
+++ b/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
@@ -238,7 +238,9 @@
         {VehicleProperty::SUPPORTED_PROPERTY_IDS, VehiclePropertyAccess::READ},
         {VehicleProperty::SHUTDOWN_REQUEST, VehiclePropertyAccess::WRITE},
         {VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_ENABLED, VehiclePropertyAccess::READ_WRITE},
+        {VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_STATE, VehiclePropertyAccess::READ},
         {VehicleProperty::FORWARD_COLLISION_WARNING_ENABLED, VehiclePropertyAccess::READ_WRITE},
+        {VehicleProperty::FORWARD_COLLISION_WARNING_STATE, VehiclePropertyAccess::READ},
         {VehicleProperty::BLIND_SPOT_WARNING_ENABLED, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::LANE_DEPARTURE_WARNING_ENABLED, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::LANE_KEEP_ASSIST_ENABLED, VehiclePropertyAccess::READ_WRITE},
diff --git a/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h b/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
index d7e87e2..4a58404 100644
--- a/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
+++ b/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
@@ -238,7 +238,9 @@
         {VehicleProperty::SUPPORTED_PROPERTY_IDS, VehiclePropertyChangeMode::STATIC},
         {VehicleProperty::SHUTDOWN_REQUEST, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_STATE, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::FORWARD_COLLISION_WARNING_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::FORWARD_COLLISION_WARNING_STATE, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::BLIND_SPOT_WARNING_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::LANE_DEPARTURE_WARNING_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::LANE_KEEP_ASSIST_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
diff --git a/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java b/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
index 14600f0..eec9daf 100644
--- a/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
+++ b/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
@@ -230,7 +230,9 @@
         Map.entry(VehicleProperty.SUPPORTED_PROPERTY_IDS, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.SHUTDOWN_REQUEST, VehiclePropertyAccess.WRITE),
         Map.entry(VehicleProperty.AUTOMATIC_EMERGENCY_BRAKING_ENABLED, VehiclePropertyAccess.READ_WRITE),
+        Map.entry(VehicleProperty.AUTOMATIC_EMERGENCY_BRAKING_STATE, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.FORWARD_COLLISION_WARNING_ENABLED, VehiclePropertyAccess.READ_WRITE),
+        Map.entry(VehicleProperty.FORWARD_COLLISION_WARNING_STATE, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.BLIND_SPOT_WARNING_ENABLED, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.LANE_DEPARTURE_WARNING_ENABLED, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.LANE_KEEP_ASSIST_ENABLED, VehiclePropertyAccess.READ_WRITE),
diff --git a/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java b/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
index 864f392..91c3637 100644
--- a/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
+++ b/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
@@ -230,7 +230,9 @@
         Map.entry(VehicleProperty.SUPPORTED_PROPERTY_IDS, VehiclePropertyChangeMode.STATIC),
         Map.entry(VehicleProperty.SHUTDOWN_REQUEST, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.AUTOMATIC_EMERGENCY_BRAKING_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.AUTOMATIC_EMERGENCY_BRAKING_STATE, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.FORWARD_COLLISION_WARNING_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.FORWARD_COLLISION_WARNING_STATE, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.BLIND_SPOT_WARNING_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.LANE_DEPARTURE_WARNING_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.LANE_KEEP_ASSIST_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
diff --git a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
index 5521ed1..f39376b 100644
--- a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
+++ b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
@@ -35,10 +35,13 @@
 namespace jsonconfigloader_impl {
 
 using ::aidl::android::hardware::automotive::vehicle::AccessForVehicleProperty;
+using ::aidl::android::hardware::automotive::vehicle::AutomaticEmergencyBrakingState;
 using ::aidl::android::hardware::automotive::vehicle::ChangeModeForVehicleProperty;
+using ::aidl::android::hardware::automotive::vehicle::ErrorState;
 using ::aidl::android::hardware::automotive::vehicle::EvConnectorType;
 using ::aidl::android::hardware::automotive::vehicle::EvsServiceState;
 using ::aidl::android::hardware::automotive::vehicle::EvsServiceType;
+using ::aidl::android::hardware::automotive::vehicle::ForwardCollisionWarningState;
 using ::aidl::android::hardware::automotive::vehicle::FuelType;
 using ::aidl::android::hardware::automotive::vehicle::GsrComplianceRequirementType;
 using ::aidl::android::hardware::automotive::vehicle::RawPropValues;
@@ -207,6 +210,11 @@
     mConstantParsersByType["VehicleIgnitionState"] =
             std::make_unique<ConstantParser<VehicleIgnitionState>>();
     mConstantParsersByType["FuelType"] = std::make_unique<ConstantParser<FuelType>>();
+    mConstantParsersByType["ErrorState"] = std::make_unique<ConstantParser<ErrorState>>();
+    mConstantParsersByType["AutomaticEmergencyBrakingState"] =
+            std::make_unique<ConstantParser<AutomaticEmergencyBrakingState>>();
+    mConstantParsersByType["ForwardCollisionWarningState"] =
+            std::make_unique<ConstantParser<ForwardCollisionWarningState>>();
     mConstantParsersByType["Constants"] = std::make_unique<LocalVariableParser>();
 }
 
diff --git a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
index 8181769..50e2428 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
+++ b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
@@ -3163,6 +3163,28 @@
             }
         },
         {
+            "property": "VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_STATE",
+            "defaultValue": {
+                "int32Values": [
+                    "AutomaticEmergencyBrakingState::ENABLED"
+                ]
+            },
+            "areas": [
+                {
+                    "areaId": 0,
+                    "supportedEnumValues": [
+                        "ErrorState::NOT_AVAILABLE_SAFETY",
+                        "ErrorState::NOT_AVAILABLE_SPEED_HIGH",
+                        "ErrorState::NOT_AVAILABLE_SPEED_LOW",
+                        "ErrorState::NOT_AVAILABLE_DISABLED",
+                        "AutomaticEmergencyBrakingState::ENABLED",
+                        "AutomaticEmergencyBrakingState::ACTIVATED",
+                        "AutomaticEmergencyBrakingState::USER_OVERRIDE"
+                    ]
+                }
+            ]
+        },
+        {
             "property": "VehicleProperty::FORWARD_COLLISION_WARNING_ENABLED",
             "defaultValue": {
                 "int32Values": [
@@ -3171,6 +3193,27 @@
             }
         },
         {
+            "property": "VehicleProperty::FORWARD_COLLISION_WARNING_STATE",
+            "defaultValue": {
+                "int32Values": [
+                    "ForwardCollisionWarningState::NO_WARNING"
+                ]
+            },
+            "areas": [
+                {
+                    "areaId": 0,
+                    "supportedEnumValues": [
+                        "ErrorState::NOT_AVAILABLE_SAFETY",
+                        "ErrorState::NOT_AVAILABLE_SPEED_HIGH",
+                        "ErrorState::NOT_AVAILABLE_SPEED_LOW",
+                        "ErrorState::NOT_AVAILABLE_DISABLED",
+                        "ForwardCollisionWarningState::NO_WARNING",
+                        "ForwardCollisionWarningState::WARNING"
+                    ]
+                }
+            ]
+        },
+        {
             "property": "VehicleProperty::BLIND_SPOT_WARNING_ENABLED",
             "defaultValue": {
                 "int32Values": [
diff --git a/automotive/vehicle/aidl/impl/default_config/config/README.md b/automotive/vehicle/aidl/impl/default_config/config/README.md
index 0e3fc5e..a5d8cdf 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/README.md
+++ b/automotive/vehicle/aidl/impl/default_config/config/README.md
@@ -141,6 +141,12 @@
 
 * FuelType
 
+* AutomaticEmergencyBrakingState
+
+* ForwardCollisionWarningState
+
+* ErrorState
+
 * Constants
 
 Every constant type except "Constants" corresponds to a enum defined in Vehicle
diff --git a/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h b/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
index 0915701..5a84d58 100644
--- a/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
+++ b/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
@@ -17,12 +17,15 @@
 #ifndef android_hardware_automotive_vehicle_aidl_impl_utils_common_include_VehicleHalTypes_H_
 #define android_hardware_automotive_vehicle_aidl_impl_utils_common_include_VehicleHalTypes_H_
 
+#include <aidl/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.h>
 #include <aidl/android/hardware/automotive/vehicle/DiagnosticFloatSensorIndex.h>
 #include <aidl/android/hardware/automotive/vehicle/DiagnosticIntegerSensorIndex.h>
+#include <aidl/android/hardware/automotive/vehicle/ErrorState.h>
 #include <aidl/android/hardware/automotive/vehicle/EvConnectorType.h>
 #include <aidl/android/hardware/automotive/vehicle/EvStoppingMode.h>
 #include <aidl/android/hardware/automotive/vehicle/EvsServiceState.h>
 #include <aidl/android/hardware/automotive/vehicle/EvsServiceType.h>
+#include <aidl/android/hardware/automotive/vehicle/ForwardCollisionWarningState.h>
 #include <aidl/android/hardware/automotive/vehicle/FuelType.h>
 #include <aidl/android/hardware/automotive/vehicle/GetValueRequest.h>
 #include <aidl/android/hardware/automotive/vehicle/GetValueResult.h>
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl
similarity index 86%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl
index 711ac19..b316df7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.automotive.vehicle;
+@Backing(type="int") @VintfStability
+enum AutomaticEmergencyBrakingState {
+  OTHER = 0,
+  ENABLED = 1,
+  ACTIVATED = 2,
+  USER_OVERRIDE = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ErrorState.aidl
similarity index 85%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ErrorState.aidl
index 711ac19..4fdbe1b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ErrorState.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.automotive.vehicle;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+enum ErrorState {
+  OTHER_ERROR_STATE = (-1),
+  NOT_AVAILABLE_DISABLED = (-2),
+  NOT_AVAILABLE_SPEED_LOW = (-3),
+  NOT_AVAILABLE_SPEED_HIGH = (-4),
+  NOT_AVAILABLE_SAFETY = (-5),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl
index 711ac19..371885d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.automotive.vehicle;
+@Backing(type="int") @VintfStability
+enum ForwardCollisionWarningState {
+  OTHER = 0,
+  NO_WARNING = 1,
+  WARNING = 2,
 }
diff --git a/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
index 914787e..1039347 100644
--- a/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -238,7 +238,9 @@
   SUPPORTED_PROPERTY_IDS = 289476424,
   SHUTDOWN_REQUEST = 289410889,
   AUTOMATIC_EMERGENCY_BRAKING_ENABLED = 287313920,
+  AUTOMATIC_EMERGENCY_BRAKING_STATE = 289411073,
   FORWARD_COLLISION_WARNING_ENABLED = 287313922,
+  FORWARD_COLLISION_WARNING_STATE = 289411075,
   BLIND_SPOT_WARNING_ENABLED = 287313924,
   LANE_DEPARTURE_WARNING_ENABLED = 287313926,
   LANE_KEEP_ASSIST_ENABLED = 287313928,
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl
new file mode 100644
index 0000000..540c663
--- /dev/null
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/AutomaticEmergencyBrakingState.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.vehicle;
+
+/**
+ * Used to enumerate the state of Automatic Emergency Braking (AEB).
+ */
+@VintfStability
+@Backing(type="int")
+enum AutomaticEmergencyBrakingState {
+
+    /**
+     * This state is used as an alternative to any AutomaticEmergencyBrakingState value that is not
+     * defined in the platform. Ideally, implementations of
+     * VehicleProperty#AUTOMATIC_EMERGENCY_BRAKING_STATE should not use this state. The framework
+     * can use this field to remain backwards compatible if AutomaticEmergencyBrakingState is
+     * extended to include additional states.
+     */
+    OTHER = 0,
+    /**
+     * AEB is enabled and monitoring safety, but brakes are not activated.
+     */
+    ENABLED = 1,
+    /**
+     * AEB is enabled and currently has the brakes applied for the vehicle.
+     */
+    ACTIVATED = 2,
+    /**
+     * Many AEB implementations allow the driver to override AEB. This means that the car has
+     * determined it should brake, but a user decides to take over and do something else. This is
+     * often done for safety reasons and to ensure that the driver can always take control of the
+     * vehicle. This state should be set when the user is actively overriding the AEB system.
+     */
+    USER_OVERRIDE = 3,
+}
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ErrorState.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ErrorState.aidl
new file mode 100644
index 0000000..42007fa
--- /dev/null
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ErrorState.aidl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.vehicle;
+
+/**
+ * Used to enumerate the possible error states. For version 2 of this interface, ErrorState is used
+ * by ADAS STATE properties, but its use may be expanded in future releases.
+ */
+@VintfStability
+enum ErrorState {
+
+    /**
+     * This state is used as an alternative to any ErrorState value that is not defined in the
+     * platform. Ideally, implementations of vehicle properties should not use this state. The
+     * framework can use this field to remain backwards compatible if this enum is extended to
+     * include additional states.
+     */
+    OTHER_ERROR_STATE = -1,
+    NOT_AVAILABLE_DISABLED = -2,
+    NOT_AVAILABLE_SPEED_LOW = -3,
+    NOT_AVAILABLE_SPEED_HIGH = -4,
+    NOT_AVAILABLE_SAFETY = -5,
+}
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl
new file mode 100644
index 0000000..b20cf25
--- /dev/null
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/ForwardCollisionWarningState.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.vehicle;
+
+/**
+ * Used to enumerate the state of Forward Collision Warning State (FCW).
+ */
+@VintfStability
+@Backing(type="int")
+enum ForwardCollisionWarningState {
+
+    /**
+     * This state is used as an alternative to any ForwardCollisionWarningState value that is not
+     * defined in the platform. Ideally, implementations of
+     * VehicleProperty#FORWARD_COLLISION_WARNING_STATE should not use this state. The framework
+     * can use this field to remain backwards compatible if ForwardCollisionWarningState is
+     * extended to include additional states.
+     */
+    OTHER = 0,
+    /**
+     * FCW is enabled and monitoring safety, but no potential collision is detected.
+     */
+    NO_WARNING = 1,
+    /**
+     * FCW is enabled, detects a potential collision, and is actively warning the user.
+     */
+    WARNING = 2,
+}
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
index e776154..446a9fa 100644
--- a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -3429,6 +3429,10 @@
      * Set true to enable AEB and false to disable AEB. When AEB is enabled, the ADAS system in the
      * vehicle should be turned on and monitoring to avoid potential collisions.
      *
+     * If AEB is not available, IVehicle#get must not return any NOT_AVAILABLE value in StatusCode.
+     * Other StatusCode values like TRY_AGAIN may still be used as needed. For example, if AEB is
+     * not available because the vehicle speed is too low, IVehicle#get must return false.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
@@ -3439,11 +3443,37 @@
             0x1000 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.BOOLEAN,
 
     /**
+     * Automatic Emergency Braking (AEB) state.
+     *
+     * Returns the current state of AEB. This property must always return a valid state defined in
+     * AutomaticEmergencyBrakingState or ErrorState. It must not surface errors through StatusCode
+     * and must use the supported error states instead.
+     *
+     * If AEB includes forward collision warnings before activating the brakes, those warnings must
+     * be surfaced through the Forward Collision Warning (FCW) properties.
+     *
+     * For the global area ID (0), the VehicleAreaConfig#supportedEnumValues array must be defined
+     * unless all states of both AutomaticEmergencyBrakingState (including OTHER, which is not
+     * recommended) and ErrorState are supported.
+     *
+     * @change_mode VehiclePropertyChangeMode.ON_CHANGE
+     * @access VehiclePropertyAccess.READ
+     * @data_enum AutomaticEmergencyBrakingState
+     * @data_enum ErrorState
+     */
+    AUTOMATIC_EMERGENCY_BRAKING_STATE =
+            0x1001 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.INT32,
+
+    /**
      * Enable or disable forward collision warning (FCW).
      *
      * Set true to enable FCW and false to disable FCW. When FCW is enabled, the ADAS system in the
      * vehicle should be turned on and monitoring for potential collisions.
      *
+     * If FCW is not available, IVehicle#get must not return any NOT_AVAILABLE value in StatusCode.
+     * Other StatusCode values like TRY_AGAIN may still be used as needed. For example, if FCW is
+     * not available because the vehicle speed is too low, IVehicle#get must return false.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
@@ -3454,6 +3484,25 @@
             0x1002 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.BOOLEAN,
 
     /**
+     * Forward Collision Warning (FCW) state.
+     *
+     * Returns the current state of FCW. This property must always return a valid state defined in
+     * ForwardCollisionWarningState or ErrorState. It must not surface errors through StatusCode
+     * and must use the supported error states instead.
+     *
+     * For the global area ID (0), the VehicleAreaConfig#supportedEnumValues array must be defined
+     * unless all states of both ForwardCollisionWarningState (including OTHER, which is not
+     * recommended) and ErrorState are supported.
+     *
+     * @change_mode VehiclePropertyChangeMode.ON_CHANGE
+     * @access VehiclePropertyAccess.READ
+     * @data_enum ForwardCollisionWarningState
+     * @data_enum ErrorState
+     */
+    FORWARD_COLLISION_WARNING_STATE =
+            0x1003 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.INT32,
+
+    /**
      * Enable and disable blind spot warning (BSW).
      *
      * Set true to enable BSW and false to disable BSW. When BSW is enabled, the ADAS system in the
diff --git a/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp b/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
index 848edb8..28b4dcf 100644
--- a/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
+++ b/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
@@ -684,12 +684,24 @@
                    VehiclePropertyGroup::SYSTEM, VehicleArea::GLOBAL, VehiclePropertyType::BOOLEAN);
 }
 
+TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyAutomaticEmergencyBrakingStateConfig) {
+    verifyProperty(VehicleProperty::AUTOMATIC_EMERGENCY_BRAKING_STATE, VehiclePropertyAccess::READ,
+                   VehiclePropertyChangeMode::ON_CHANGE, VehiclePropertyGroup::SYSTEM,
+                   VehicleArea::GLOBAL, VehiclePropertyType::INT32);
+}
+
 TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyForwardCollisionWarningEnabledConfig) {
     verifyProperty(VehicleProperty::FORWARD_COLLISION_WARNING_ENABLED,
                    VehiclePropertyAccess::READ_WRITE, VehiclePropertyChangeMode::ON_CHANGE,
                    VehiclePropertyGroup::SYSTEM, VehicleArea::GLOBAL, VehiclePropertyType::BOOLEAN);
 }
 
+TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyForwardCollisionWarningStateConfig) {
+    verifyProperty(VehicleProperty::FORWARD_COLLISION_WARNING_STATE, VehiclePropertyAccess::READ,
+                   VehiclePropertyChangeMode::ON_CHANGE, VehiclePropertyGroup::SYSTEM,
+                   VehicleArea::GLOBAL, VehiclePropertyType::INT32);
+}
+
 TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyBlindSpotWarningEnabledConfig) {
     verifyProperty(VehicleProperty::BLIND_SPOT_WARNING_ENABLED, VehiclePropertyAccess::READ_WRITE,
                    VehiclePropertyChangeMode::ON_CHANGE, VehiclePropertyGroup::SYSTEM,
diff --git a/bluetooth/aidl/TEST_MAPPING b/bluetooth/aidl/TEST_MAPPING
new file mode 100644
index 0000000..342a1e4
--- /dev/null
+++ b/bluetooth/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit" : [
+    {
+      "name" : "VtsHalBluetoothTargetTest"
+    }
+  ]
+}
diff --git a/bluetooth/aidl/default/Android.bp b/bluetooth/aidl/default/Android.bp
index d1761f5..3f4ba99 100644
--- a/bluetooth/aidl/default/Android.bp
+++ b/bluetooth/aidl/default/Android.bp
@@ -30,6 +30,7 @@
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
         "BluetoothHci.cpp",
+        "net_bluetooth_mgmt.cpp",
     ],
 }
 
@@ -37,7 +38,7 @@
     name: "android.hardware.bluetooth-service.default",
     relative_install_path: "hw",
     init_rc: ["bluetooth-service-default.rc"],
-    vintf_fragments: ["bluetooth-service-default.xml"],
+    vintf_fragments: [":manifest_android.hardware.bluetooth-service.default.xml"],
     vendor: true,
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
@@ -77,3 +78,8 @@
         ],
     },
 }
+
+filegroup {
+    name: "manifest_android.hardware.bluetooth-service.default.xml",
+    srcs: ["bluetooth-service-default.xml"],
+}
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index 4d4896d..eebbbc0 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -44,6 +44,7 @@
 
 using namespace ::android::hardware::bluetooth::hci;
 using namespace ::android::hardware::bluetooth::async;
+using aidl::android::hardware::bluetooth::Status;
 
 namespace aidl::android::hardware::bluetooth::impl {
 
@@ -97,21 +98,25 @@
   mDeathRecipient = std::make_shared<BluetoothDeathRecipient>(this);
 }
 
-ndk::ScopedAStatus BluetoothHci::initialize(
-    const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
-  ALOGI(__func__);
-
-  mFd = open(mDevPath.c_str(), O_RDWR);
-  if (mFd < 0) {
+int BluetoothHci::getFdFromDevPath() {
+  int fd = open(mDevPath.c_str(), O_RDWR);
+  if (fd < 0) {
     ALOGE("Could not connect to bt: %s (%s)", mDevPath.c_str(),
           strerror(errno));
-    return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    return fd;
   }
   if (int ret = SetTerminalRaw(mFd) < 0) {
     ALOGE("Could not make %s a raw terminal %d(%s)", mDevPath.c_str(), ret,
           strerror(errno));
-    return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    ::close(fd);
+    return -1;
   }
+  return fd;
+}
+
+ndk::ScopedAStatus BluetoothHci::initialize(
+    const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
+  ALOGI(__func__);
 
   mCb = cb;
   if (mCb == nullptr) {
@@ -119,32 +124,36 @@
     return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
   }
 
+  management_.reset(new NetBluetoothMgmt);
+  mFd = management_->openHci();
+  if (mFd < 0) {
+    management_.reset();
+
+    ALOGI("Unable to open Linux interface, trying default path.");
+    mFd = getFdFromDevPath();
+    if (mFd < 0) {
+      return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    }
+  }
+
   mDeathRecipient->LinkToDeath(mCb);
 
-  auto init_ret = cb->initializationComplete(Status::SUCCESS);
-  if (!init_ret.isOk()) {
-    if (!mDeathRecipient->getHasDied()) {
-      ALOGE("Error sending init callback, but no death notification.");
-    }
-    return ndk::ScopedAStatus::fromServiceSpecificError(
-        STATUS_FAILED_TRANSACTION);
-  }
   mH4 = std::make_shared<H4Protocol>(
       mFd,
       [](const std::vector<uint8_t>& /* raw_command */) {
         LOG_ALWAYS_FATAL("Unexpected command!");
       },
+      [this](const std::vector<uint8_t>& raw_acl) {
+        mCb->aclDataReceived(raw_acl);
+      },
+      [this](const std::vector<uint8_t>& raw_sco) {
+        mCb->scoDataReceived(raw_sco);
+      },
       [this](const std::vector<uint8_t>& raw_event) {
         mCb->hciEventReceived(raw_event);
       },
-      [this](const std::vector<uint8_t>& raw_acl) {
-        mCb->hciEventReceived(raw_acl);
-      },
-      [this](const std::vector<uint8_t>& raw_sco) {
-        mCb->hciEventReceived(raw_sco);
-      },
       [this](const std::vector<uint8_t>& raw_iso) {
-        mCb->hciEventReceived(raw_iso);
+        mCb->isoDataReceived(raw_iso);
       },
       [this]() {
         ALOGI("HCI socket device disconnected");
@@ -152,13 +161,29 @@
       });
   mFdWatcher.WatchFdForNonBlockingReads(mFd,
                                         [this](int) { mH4->OnDataReady(); });
+
+  ALOGI("initialization complete");
+  auto status = mCb->initializationComplete(Status::SUCCESS);
+  if (!status.isOk()) {
+    if (!mDeathRecipient->getHasDied()) {
+      ALOGE("Error sending init callback, but no death notification");
+    }
+    close();
+    return ndk::ScopedAStatus::fromServiceSpecificError(
+        STATUS_FAILED_TRANSACTION);
+  }
+
   return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus BluetoothHci::close() {
   ALOGI(__func__);
   mFdWatcher.StopWatchingFileDescriptors();
-  ::close(mFd);
+  if (management_) {
+    management_->closeHci();
+  } else {
+    ::close(mFd);
+  }
 
   return ndk::ScopedAStatus::ok();
 }
diff --git a/bluetooth/aidl/default/BluetoothHci.h b/bluetooth/aidl/default/BluetoothHci.h
index 0ed0623..a0908f8 100644
--- a/bluetooth/aidl/default/BluetoothHci.h
+++ b/bluetooth/aidl/default/BluetoothHci.h
@@ -24,6 +24,7 @@
 
 #include "async_fd_watcher.h"
 #include "h4_protocol.h"
+#include "net_bluetooth_mgmt.h"
 
 namespace aidl::android::hardware::bluetooth::impl {
 
@@ -64,8 +65,10 @@
 
   ::android::hardware::bluetooth::async::AsyncFdWatcher mFdWatcher;
 
+  int getFdFromDevPath();
   void send(::android::hardware::bluetooth::hci::PacketType type,
             const std::vector<uint8_t>& packet);
+  std::unique_ptr<NetBluetoothMgmt> management_{};
 };
 
 }  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/bluetooth-service-default.rc b/bluetooth/aidl/default/bluetooth-service-default.rc
index 1841c77..dc78698 100644
--- a/bluetooth/aidl/default/bluetooth-service-default.rc
+++ b/bluetooth/aidl/default/bluetooth-service-default.rc
@@ -1,4 +1,4 @@
-service bluetooth_hal_service /vendor/bin/hw/android.hardware.bluetooth-service.default
+service vendor.bluetooth-default /vendor/bin/hw/android.hardware.bluetooth-service.default
     class hal
     capabilities BLOCK_SUSPEND NET_ADMIN SYS_NICE
     user bluetooth
diff --git a/bluetooth/aidl/default/net_bluetooth_mgmt.cpp b/bluetooth/aidl/default/net_bluetooth_mgmt.cpp
new file mode 100644
index 0000000..937cd57
--- /dev/null
+++ b/bluetooth/aidl/default/net_bluetooth_mgmt.cpp
@@ -0,0 +1,296 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.bluetooth.service.default"
+
+#include "net_bluetooth_mgmt.h"
+
+#include <fcntl.h>
+#include <log/log.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include <cerrno>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+// Definitions imported from <linux/net/bluetooth/bluetooth.h>
+#define BTPROTO_HCI 1
+
+// Definitions imported from <linux/net/bluetooth/hci_sock.h>
+#define HCI_CHANNEL_USER 1
+#define HCI_CHANNEL_CONTROL 3
+#define HCI_DEV_NONE 0xffff
+
+struct sockaddr_hci {
+  sa_family_t hci_family;
+  unsigned short hci_dev;
+  unsigned short hci_channel;
+};
+
+// Definitions imported from <linux/net/bluetooth/mgmt.h>
+#define MGMT_OP_READ_INDEX_LIST 0x0003
+#define MGMT_EV_INDEX_ADDED 0x0004
+#define MGMT_EV_CMD_COMPLETE 0x0001
+#define MGMT_PKT_SIZE_MAX 1024
+#define MGMT_INDEX_NONE 0xFFFF
+
+struct mgmt_pkt {
+  uint16_t opcode;
+  uint16_t index;
+  uint16_t len;
+  uint8_t data[MGMT_PKT_SIZE_MAX];
+} __attribute__((packed));
+
+struct mgmt_ev_read_index_list {
+  uint16_t opcode;
+  uint8_t status;
+  uint16_t num_controllers;
+  uint16_t index[];
+} __attribute__((packed));
+
+// Definitions imported from <linux/rfkill.h>
+#define RFKILL_STATE_SOFT_BLOCKED 0
+#define RFKILL_STATE_UNBLOCKED 1
+#define RFKILL_STATE_HARD_BLOCKED 2
+
+#define RFKILL_TYPE_BLUETOOTH 2
+
+#define RFKILL_OP_ADD 0
+#define RFKILL_OP_CHANGE 2
+
+struct rfkill_event {
+  uint32_t idx;
+  uint8_t type;
+  uint8_t op;
+  uint8_t soft;
+  uint8_t hard;
+} __attribute__((packed));
+
+namespace aidl::android::hardware::bluetooth::impl {
+
+// Wait indefinitely for the selected HCI interface to be enabled in the
+// bluetooth driver.
+int NetBluetoothMgmt::waitHciDev(int hci_interface) {
+  ALOGI("waiting for hci interface %d", hci_interface);
+
+  int ret = -1;
+  struct mgmt_pkt cmd;
+  struct pollfd pollfd;
+  struct sockaddr_hci hci_addr = {
+      .hci_family = AF_BLUETOOTH,
+      .hci_dev = HCI_DEV_NONE,
+      .hci_channel = HCI_CHANNEL_CONTROL,
+  };
+
+  // Open and bind a socket to the bluetooth control interface in the
+  // kernel driver, used to send control commands and receive control
+  // events.
+  int fd = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+  if (fd < 0) {
+    ALOGE("unable to open raw bluetooth socket: %s", strerror(errno));
+    return -1;
+  }
+
+  if (bind(fd, (struct sockaddr*)&hci_addr, sizeof(hci_addr)) < 0) {
+    ALOGE("unable to bind bluetooth control channel: %s", strerror(errno));
+    goto end;
+  }
+
+  // Send the control command [Read Index List].
+  cmd = {
+      .opcode = MGMT_OP_READ_INDEX_LIST,
+      .index = MGMT_INDEX_NONE,
+      .len = 0,
+  };
+
+  if (write(fd, &cmd, 6) != 6) {
+    ALOGE("error writing mgmt command: %s", strerror(errno));
+    goto end;
+  }
+
+  // Poll the control socket waiting for the command response,
+  // and subsequent [Index Added] events. The loops continue without
+  // timeout until the selected hci interface is detected.
+  pollfd = {.fd = fd, .events = POLLIN};
+
+  for (;;) {
+    ret = poll(&pollfd, 1, -1);
+
+    // Poll interrupted, try again.
+    if (ret == -1 && (errno == EINTR || errno == EAGAIN)) {
+      continue;
+    }
+
+    // Poll failure, abandon.
+    if (ret == -1) {
+      ALOGE("poll error: %s", strerror(errno));
+      break;
+    }
+
+    // Spurious wakeup, try again.
+    if (ret == 0 || (pollfd.revents & POLLIN) == 0) {
+      continue;
+    }
+
+    // Read the next control event.
+    struct mgmt_pkt ev {};
+    ret = read(fd, &ev, sizeof(ev));
+    if (ret < 0) {
+      ALOGE("error reading mgmt event: %s", strerror(errno));
+      goto end;
+    }
+
+    // Received [Read Index List] command response.
+    if (ev.opcode == MGMT_EV_CMD_COMPLETE) {
+      struct mgmt_ev_read_index_list* data =
+          (struct mgmt_ev_read_index_list*)ev.data;
+
+      for (int i = 0; i < data->num_controllers; i++) {
+        if (data->index[i] == hci_interface) {
+          ALOGI("hci interface %d found", hci_interface);
+          ret = 0;
+          goto end;
+        }
+      }
+    }
+
+    // Received [Index Added] event.
+    if (ev.opcode == MGMT_EV_INDEX_ADDED && ev.index == hci_interface) {
+      ALOGI("hci interface %d added", hci_interface);
+      ret = 0;
+      goto end;
+    }
+  }
+
+end:
+  ::close(fd);
+  return ret;
+}
+
+int NetBluetoothMgmt::openRfkill() {
+  int fd = open("/dev/rfkill", O_RDWR);
+  if (fd < 0) {
+    ALOGE("unable to open /dev/rfkill: %s", strerror(errno));
+    return -1;
+  }
+
+  if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) {
+    ALOGE("unable to set rfkill control device to non-blocking: %s",
+          strerror(errno));
+    ::close(fd);
+    return -1;
+  }
+
+  for (;;) {
+    struct rfkill_event event {};
+    ssize_t res = read(fd, &event, sizeof(event));
+    if (res < 0) {
+      ALOGE("error reading rfkill events: %s", strerror(errno));
+      break;
+    }
+
+    ALOGI("index:%d type:%d op:%d", event.idx, event.type, event.op);
+
+    if (event.op == RFKILL_OP_ADD && event.type == RFKILL_TYPE_BLUETOOTH) {
+      rfkill_bt_index_ = event.idx;
+      rfkill_fd_ = fd;
+      return 0;
+    }
+  }
+
+  ::close(fd);
+  return -1;
+}
+
+// Block or unblock Bluetooth.
+int NetBluetoothMgmt::rfkill(int block) {
+  if (rfkill_fd_ == -1) {
+    openRfkill();
+  }
+
+  if (rfkill_fd_ == -1) {
+    ALOGE("rfkill unavailable");
+    return -1;
+  }
+
+  struct rfkill_event event = {
+      .idx = static_cast<uint32_t>(rfkill_bt_index_),
+      .type = RFKILL_TYPE_BLUETOOTH,
+      .op = RFKILL_OP_CHANGE,
+      .soft = static_cast<uint8_t>(block),
+      .hard = 0,
+  };
+
+  int res = write(rfkill_fd_, &event, sizeof(event));
+  if (res < 0) {
+    ALOGE("error writing rfkill command: %s", strerror(errno));
+    return -1;
+  }
+
+  return 0;
+}
+
+int NetBluetoothMgmt::openHci(int hci_interface) {
+  ALOGI("opening hci interface %d", hci_interface);
+
+  // Block Bluetooth.
+  rfkill(1);
+
+  // Wait for the HCI interface to complete initialization or to come online.
+  if (waitHciDev(hci_interface)) {
+    ALOGE("hci interface %d not found", hci_interface);
+    return -1;
+  }
+
+  // Open the raw HCI socket.
+  int fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+  if (fd < 0) {
+    ALOGE("unable to open raw bluetooth socket: %s", strerror(errno));
+    return -1;
+  }
+
+  struct sockaddr_hci hci_addr = {
+      .hci_family = AF_BLUETOOTH,
+      .hci_dev = static_cast<uint16_t>(hci_interface),
+      .hci_channel = HCI_CHANNEL_USER,
+  };
+
+  // Bind the socket to the selected interface.
+  if (bind(fd, (struct sockaddr*)&hci_addr, sizeof(hci_addr)) < 0) {
+    ALOGE("unable to bind bluetooth user channel: %s", strerror(errno));
+    ::close(fd);
+    return -1;
+  }
+
+  ALOGI("hci interface %d ready", hci_interface);
+  bt_fd_ = fd;
+  return fd;
+}
+
+void NetBluetoothMgmt::closeHci() {
+  if (bt_fd_ != -1) {
+    ::close(bt_fd_);
+    bt_fd_ = -1;
+  }
+
+  // Unblock Bluetooth.
+  rfkill(0);
+}
+
+}  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/net_bluetooth_mgmt.h b/bluetooth/aidl/default/net_bluetooth_mgmt.h
new file mode 100644
index 0000000..5c473f2
--- /dev/null
+++ b/bluetooth/aidl/default/net_bluetooth_mgmt.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unistd.h>
+
+namespace aidl::android::hardware::bluetooth::impl {
+
+class NetBluetoothMgmt {
+ public:
+  NetBluetoothMgmt() {}
+  ~NetBluetoothMgmt() {
+    ::close(rfkill_fd_);
+    ::close(bt_fd_);
+  }
+
+  int openHci(int hci_interface = 0);
+  void closeHci();
+
+ private:
+  int waitHciDev(int hci_interface);
+  int openRfkill();
+  int rfkill(int block);
+
+  // Index of the first rfkill device of type bluetooth.
+  int rfkill_bt_index_{-1};
+  // File descriptor opened to /dev/rfkill.
+  int rfkill_fd_{-1};
+  // File descriptor opened to the bluetooth user channel.
+  int bt_fd_{-1};
+};
+
+}  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/vts/Android.bp b/bluetooth/aidl/vts/Android.bp
new file mode 100644
index 0000000..414f707
--- /dev/null
+++ b/bluetooth/aidl/vts/Android.bp
@@ -0,0 +1,48 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsHalBluetoothTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: ["VtsHalBluetoothTargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+    ],
+    static_libs: [
+        "android.hardware.bluetooth-V1-ndk",
+        "libbluetooth-types",
+    ],
+    test_config: "VtsHalBluetoothTargetTest.xml",
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+    tidy: true,
+    tidy_checks: [
+        "-*",
+        "readability-inconsistent-declaration-parameter-name",
+        "readability-*",
+        "-readability-function-size",
+        "-readability-identifier-length",
+        "-readability-implicit-bool-conversion",
+        "-readability-magic-numbers",
+        "-readability-use-anyofallof",
+    ],
+    tidy_checks_as_errors: [
+        "readability-*",
+    ],
+    tidy_flags: [
+        "--header-filter=^.*tools\\/rootcanal\\/(model|include|net|desktop)\\/(.(?!\\.pb\\.h))*$",
+    ],
+}
diff --git a/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp
new file mode 100644
index 0000000..57a3361
--- /dev/null
+++ b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp
@@ -0,0 +1,896 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/bluetooth/BnBluetoothHciCallbacks.h>
+#include <aidl/android/hardware/bluetooth/IBluetoothHci.h>
+#include <aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.h>
+#include <aidl/android/hardware/bluetooth/Status.h>
+#include <android/binder_auto_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <binder/IServiceManager.h>
+#include <binder/ProcessState.h>
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <future>
+#include <mutex>
+#include <queue>
+#include <thread>
+#include <vector>
+
+using aidl::android::hardware::bluetooth::IBluetoothHci;
+using aidl::android::hardware::bluetooth::IBluetoothHciCallbacks;
+using aidl::android::hardware::bluetooth::Status;
+using ndk::ScopedAStatus;
+using ndk::SpAIBinder;
+
+// Bluetooth Core Specification 3.0 + HS
+static constexpr uint8_t kHciMinimumHciVersion = 5;
+// Bluetooth Core Specification 3.0 + HS
+static constexpr uint8_t kHciMinimumLmpVersion = 5;
+
+static constexpr size_t kNumHciCommandsBandwidth = 100;
+static constexpr size_t kNumScoPacketsBandwidth = 100;
+static constexpr size_t kNumAclPacketsBandwidth = 100;
+static constexpr std::chrono::milliseconds kWaitForInitTimeout(2000);
+static constexpr std::chrono::milliseconds kWaitForHciEventTimeout(2000);
+static constexpr std::chrono::milliseconds kWaitForScoDataTimeout(1000);
+static constexpr std::chrono::milliseconds kWaitForAclDataTimeout(1000);
+static constexpr std::chrono::milliseconds kInterfaceCloseDelayMs(200);
+
+static constexpr uint8_t kCommandHciShouldBeUnknown[] = {
+    0xff, 0x3B, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07};
+static constexpr uint8_t kCommandHciReadLocalVersionInformation[] = {0x01, 0x10,
+                                                                     0x00};
+static constexpr uint8_t kCommandHciReadBufferSize[] = {0x05, 0x10, 0x00};
+static constexpr uint8_t kCommandHciWriteLoopbackModeLocal[] = {0x02, 0x18,
+                                                                0x01, 0x01};
+static constexpr uint8_t kCommandHciReset[] = {0x03, 0x0c, 0x00};
+static constexpr uint8_t kCommandHciSynchronousFlowControlEnable[] = {
+    0x2f, 0x0c, 0x01, 0x01};
+static constexpr uint8_t kCommandHciWriteLocalName[] = {0x13, 0x0c, 0xf8};
+static constexpr uint8_t kHciStatusSuccess = 0x00;
+static constexpr uint8_t kHciStatusUnknownHciCommand = 0x01;
+
+static constexpr uint8_t kEventConnectionComplete = 0x03;
+static constexpr uint8_t kEventCommandComplete = 0x0e;
+static constexpr uint8_t kEventCommandStatus = 0x0f;
+static constexpr uint8_t kEventNumberOfCompletedPackets = 0x13;
+static constexpr uint8_t kEventLoopbackCommand = 0x19;
+
+static constexpr size_t kEventCodeByte = 0;
+static constexpr size_t kEventLengthByte = 1;
+static constexpr size_t kEventFirstPayloadByte = 2;
+static constexpr size_t kEventCommandStatusStatusByte = 2;
+static constexpr size_t kEventCommandStatusOpcodeLsByte = 4;    // Bytes 4 and 5
+static constexpr size_t kEventCommandCompleteOpcodeLsByte = 3;  // Bytes 3 and 4
+static constexpr size_t kEventCommandCompleteStatusByte = 5;
+static constexpr size_t kEventCommandCompleteFirstParamByte = 6;
+static constexpr size_t kEventLocalHciVersionByte =
+    kEventCommandCompleteFirstParamByte;
+static constexpr size_t kEventLocalLmpVersionByte =
+    kEventLocalHciVersionByte + 3;
+
+static constexpr size_t kEventConnectionCompleteParamLength = 11;
+static constexpr size_t kEventConnectionCompleteType = 11;
+static constexpr size_t kEventConnectionCompleteTypeSco = 0;
+static constexpr size_t kEventConnectionCompleteTypeAcl = 1;
+static constexpr size_t kEventConnectionCompleteHandleLsByte = 3;
+
+static constexpr size_t kEventNumberOfCompletedPacketsNumHandles = 2;
+
+static constexpr size_t kAclBroadcastFlagOffset = 6;
+static constexpr uint8_t kAclBroadcastFlagPointToPoint = 0x0;
+static constexpr uint8_t kAclBroadcastPointToPoint =
+    (kAclBroadcastFlagPointToPoint << kAclBroadcastFlagOffset);
+
+static constexpr uint8_t kAclPacketBoundaryFlagOffset = 4;
+static constexpr uint8_t kAclPacketBoundaryFlagFirstAutoFlushable = 0x2;
+static constexpr uint8_t kAclPacketBoundaryFirstAutoFlushable =
+    kAclPacketBoundaryFlagFirstAutoFlushable << kAclPacketBoundaryFlagOffset;
+
+// To discard Qualcomm ACL debugging
+static constexpr uint16_t kAclHandleQcaDebugMessage = 0xedc;
+
+class ThroughputLogger {
+ public:
+  ThroughputLogger(std::string task)
+      : total_bytes_(0),
+        task_(task),
+        start_time_(std::chrono::steady_clock::now()) {}
+
+  ~ThroughputLogger() {
+    if (total_bytes_ == 0) {
+      return;
+    }
+    std::chrono::duration<double> duration =
+        std::chrono::steady_clock::now() - start_time_;
+    double s = duration.count();
+    if (s == 0) {
+      return;
+    }
+    double rate_kb = (static_cast<double>(total_bytes_) / s) / 1024;
+    ALOGD("%s %.1f KB/s (%zu bytes in %.3fs)", task_.c_str(), rate_kb,
+          total_bytes_, s);
+  }
+
+  void setTotalBytes(size_t total_bytes) { total_bytes_ = total_bytes; }
+
+ private:
+  size_t total_bytes_;
+  std::string task_;
+  std::chrono::steady_clock::time_point start_time_;
+};
+
+// The main test class for Bluetooth HAL.
+class BluetoothAidlTest : public ::testing::TestWithParam<std::string> {
+ public:
+  virtual void SetUp() override {
+    // currently test passthrough mode only
+    hci = IBluetoothHci::fromBinder(
+        SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    ASSERT_NE(hci, nullptr);
+    ALOGI("%s: getService() for bluetooth hci is %s", __func__,
+          hci->isRemote() ? "remote" : "local");
+
+    // Lambda function
+    auto on_binder_death = [](void* /*cookie*/) { FAIL(); };
+
+    bluetooth_hci_death_recipient =
+        AIBinder_DeathRecipient_new(on_binder_death);
+    ASSERT_NE(bluetooth_hci_death_recipient, nullptr);
+    ASSERT_EQ(STATUS_OK,
+              AIBinder_linkToDeath(hci->asBinder().get(),
+                                   bluetooth_hci_death_recipient, 0));
+
+    hci_cb = ndk::SharedRefBase::make<BluetoothHciCallbacks>(*this);
+    ASSERT_NE(hci_cb, nullptr);
+
+    max_acl_data_packet_length = 0;
+    max_sco_data_packet_length = 0;
+    max_acl_data_packets = 0;
+    max_sco_data_packets = 0;
+
+    event_cb_count = 0;
+    acl_cb_count = 0;
+    sco_cb_count = 0;
+
+    ASSERT_TRUE(hci->initialize(hci_cb).isOk());
+    auto future = initialized_promise.get_future();
+    auto timeout_status = future.wait_for(kWaitForInitTimeout);
+    ASSERT_EQ(timeout_status, std::future_status::ready);
+    ASSERT_TRUE(future.get());
+  }
+
+  virtual void TearDown() override {
+    ALOGI("TearDown");
+    // Should not be checked in production code
+    ASSERT_TRUE(hci->close().isOk());
+    std::this_thread::sleep_for(kInterfaceCloseDelayMs);
+    handle_no_ops();
+    discard_qca_debugging();
+    EXPECT_EQ(static_cast<size_t>(0), event_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), sco_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), acl_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), iso_queue.size());
+  }
+
+  void setBufferSizes();
+  void setSynchronousFlowControlEnable();
+
+  // Functions called from within tests in loopback mode
+  void sendAndCheckHci(int num_packets);
+  void sendAndCheckSco(int num_packets, size_t size, uint16_t handle);
+  void sendAndCheckAcl(int num_packets, size_t size, uint16_t handle);
+
+  // Helper functions to try to get a handle on verbosity
+  void reset();
+  void enterLoopbackMode();
+  void handle_no_ops();
+  void discard_qca_debugging();
+  void wait_for_event(bool timeout_is_error);
+  void wait_for_command_complete_event(std::vector<uint8_t> cmd);
+  int wait_for_completed_packets_event(uint16_t handle);
+
+  // A simple test implementation of BluetoothHciCallbacks.
+  class BluetoothHciCallbacks
+      : public aidl::android::hardware::bluetooth::BnBluetoothHciCallbacks {
+    BluetoothAidlTest& parent_;
+
+   public:
+    BluetoothHciCallbacks(BluetoothAidlTest& parent) : parent_(parent){};
+
+    virtual ~BluetoothHciCallbacks() = default;
+
+    ndk::ScopedAStatus initializationComplete(Status status) {
+      parent_.initialized_promise.set_value(status == Status::SUCCESS);
+      ALOGV("%s (status = %d)", __func__, static_cast<int>(status));
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus hciEventReceived(const std::vector<uint8_t>& event) {
+      parent_.event_cb_count++;
+      parent_.event_queue.push(event);
+      ALOGV("Event received (length = %d)", static_cast<int>(event.size()));
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus aclDataReceived(const std::vector<uint8_t>& data) {
+      parent_.acl_cb_count++;
+      parent_.acl_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus scoDataReceived(const std::vector<uint8_t>& data) {
+      parent_.sco_cb_count++;
+      parent_.sco_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus isoDataReceived(const std::vector<uint8_t>& data) {
+      parent_.iso_cb_count++;
+      parent_.iso_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+  };
+
+  template <class T>
+  class WaitQueue {
+   public:
+    WaitQueue(){};
+
+    virtual ~WaitQueue() = default;
+
+    bool empty() const {
+      std::lock_guard<std::mutex> lock(m_);
+      return q_.empty();
+    };
+
+    size_t size() const {
+      std::lock_guard<std::mutex> lock(m_);
+      return q_.size();
+    };
+
+    void push(const T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      q_.push(v);
+      ready_.notify_one();
+    };
+
+    bool pop(T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      if (q_.empty()) {
+        return false;
+      }
+      v = std::move(q_.front());
+      q_.pop();
+      return true;
+    };
+
+    bool front(T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      if (q_.empty()) {
+        return false;
+      }
+      v = q_.front();
+      return true;
+    };
+
+    void wait() {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        ready_.wait(lock);
+      }
+    };
+
+    bool waitWithTimeout(std::chrono::milliseconds timeout) {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        if (ready_.wait_for(lock, timeout) == std::cv_status::timeout) {
+          return false;
+        }
+      }
+      return true;
+    };
+
+    bool tryPopWithTimeout(T& v, std::chrono::milliseconds timeout) {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        if (ready_.wait_for(lock, timeout) == std::cv_status::timeout) {
+          return false;
+        }
+      }
+      v = std::move(q_.front());
+      q_.pop();
+      return true;
+    };
+
+   private:
+    mutable std::mutex m_;
+    std::queue<T> q_;
+    std::condition_variable_any ready_;
+  };
+
+  std::shared_ptr<IBluetoothHci> hci;
+  std::shared_ptr<BluetoothHciCallbacks> hci_cb;
+  AIBinder_DeathRecipient* bluetooth_hci_death_recipient;
+  WaitQueue<std::vector<uint8_t>> event_queue;
+  WaitQueue<std::vector<uint8_t>> acl_queue;
+  WaitQueue<std::vector<uint8_t>> sco_queue;
+  WaitQueue<std::vector<uint8_t>> iso_queue;
+
+  std::promise<bool> initialized_promise;
+  int event_cb_count;
+  int sco_cb_count;
+  int acl_cb_count;
+  int iso_cb_count;
+
+  int max_acl_data_packet_length;
+  int max_sco_data_packet_length;
+  int max_acl_data_packets;
+  int max_sco_data_packets;
+
+  std::vector<uint16_t> sco_connection_handles;
+  std::vector<uint16_t> acl_connection_handles;
+};
+
+// Discard NO-OPs from the event queue.
+void BluetoothAidlTest::handle_no_ops() {
+  while (!event_queue.empty()) {
+    std::vector<uint8_t> event;
+    event_queue.front(event);
+    ASSERT_GE(event.size(),
+              static_cast<size_t>(kEventCommandCompleteStatusByte));
+    bool event_is_no_op =
+        (event[kEventCodeByte] == kEventCommandComplete) &&
+        (event[kEventCommandCompleteOpcodeLsByte] == 0x00) &&
+        (event[kEventCommandCompleteOpcodeLsByte + 1] == 0x00);
+    event_is_no_op |= (event[kEventCodeByte] == kEventCommandStatus) &&
+                      (event[kEventCommandStatusOpcodeLsByte] == 0x00) &&
+                      (event[kEventCommandStatusOpcodeLsByte + 1] == 0x00);
+    if (event_is_no_op) {
+      event_queue.pop(event);
+    } else {
+      break;
+    }
+  }
+}
+
+// Discard Qualcomm ACL debugging
+void BluetoothAidlTest::discard_qca_debugging() {
+  while (!acl_queue.empty()) {
+    std::vector<uint8_t> acl_packet;
+    acl_queue.front(acl_packet);
+    uint16_t connection_handle = acl_packet[1] & 0xF;
+    connection_handle <<= 8;
+    connection_handle |= acl_packet[0];
+    bool packet_is_no_op = connection_handle == kAclHandleQcaDebugMessage;
+    if (packet_is_no_op) {
+      acl_queue.pop(acl_packet);
+    } else {
+      break;
+    }
+  }
+}
+
+// Receive an event, discarding NO-OPs.
+void BluetoothAidlTest::wait_for_event(bool timeout_is_error = true) {
+  // Wait until we get something that's not a no-op.
+  while (true) {
+    bool event_ready = event_queue.waitWithTimeout(kWaitForHciEventTimeout);
+    ASSERT_TRUE(event_ready || !timeout_is_error);
+    if (event_queue.empty()) {
+      // waitWithTimeout timed out
+      return;
+    }
+    handle_no_ops();
+    if (!event_queue.empty()) {
+      // There's an event in the queue that's not a no-op.
+      return;
+    }
+  }
+}
+
+// Wait until a command complete is received.
+void BluetoothAidlTest::wait_for_command_complete_event(
+    std::vector<uint8_t> cmd) {
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+  std::vector<uint8_t> event;
+  ASSERT_FALSE(event_queue.empty());
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventCommandCompleteStatusByte));
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+}
+
+// Send the command to read the controller's buffer sizes.
+void BluetoothAidlTest::setBufferSizes() {
+  std::vector<uint8_t> cmd{
+      kCommandHciReadBufferSize,
+      kCommandHciReadBufferSize + sizeof(kCommandHciReadBufferSize)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+  if (event_queue.empty()) {
+    return;
+  }
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+
+  max_acl_data_packet_length =
+      event[kEventCommandCompleteStatusByte + 1] +
+      (event[kEventCommandCompleteStatusByte + 2] << 8);
+  max_sco_data_packet_length = event[kEventCommandCompleteStatusByte + 3];
+  max_acl_data_packets = event[kEventCommandCompleteStatusByte + 4] +
+                         (event[kEventCommandCompleteStatusByte + 5] << 8);
+  max_sco_data_packets = event[kEventCommandCompleteStatusByte + 6] +
+                         (event[kEventCommandCompleteStatusByte + 7] << 8);
+
+  ALOGD("%s: ACL max %d num %d SCO max %d num %d", __func__,
+        static_cast<int>(max_acl_data_packet_length),
+        static_cast<int>(max_acl_data_packets),
+        static_cast<int>(max_sco_data_packet_length),
+        static_cast<int>(max_sco_data_packets));
+}
+
+// Enable flow control packets for SCO
+void BluetoothAidlTest::setSynchronousFlowControlEnable() {
+  std::vector<uint8_t> cmd{kCommandHciSynchronousFlowControlEnable,
+                           kCommandHciSynchronousFlowControlEnable +
+                               sizeof(kCommandHciSynchronousFlowControlEnable)};
+  hci->sendHciCommand(cmd);
+
+  wait_for_command_complete_event(cmd);
+}
+
+// Send an HCI command (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckHci(int num_packets) {
+  ThroughputLogger logger = {__func__};
+  int command_size = 0;
+  for (int n = 0; n < num_packets; n++) {
+    // Send an HCI packet
+    std::vector<uint8_t> write_name{
+        kCommandHciWriteLocalName,
+        kCommandHciWriteLocalName + sizeof(kCommandHciWriteLocalName)};
+    // With a name
+    char new_name[] = "John Jacob Jingleheimer Schmidt ___________________0";
+    size_t new_name_length = strlen(new_name);
+    for (size_t i = 0; i < new_name_length; i++) {
+      write_name.push_back(static_cast<uint8_t>(new_name[i]));
+    }
+    // And the packet number
+    size_t i = new_name_length - 1;
+    for (int digits = n; digits > 0; digits = digits / 10, i--) {
+      write_name[i] = static_cast<uint8_t>('0' + digits % 10);
+    }
+    // And padding
+    for (size_t i = 0; i < 248 - new_name_length; i++) {
+      write_name.push_back(static_cast<uint8_t>(0));
+    }
+
+    hci->sendHciCommand(write_name);
+
+    // Check the loopback of the HCI packet
+    ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+    std::vector<uint8_t> event;
+    ASSERT_TRUE(event_queue.pop(event));
+
+    size_t compare_length = (write_name.size() > static_cast<size_t>(0xff)
+                                 ? static_cast<size_t>(0xff)
+                                 : write_name.size());
+    ASSERT_GT(event.size(), compare_length + kEventFirstPayloadByte - 1);
+
+    ASSERT_EQ(kEventLoopbackCommand, event[kEventCodeByte]);
+    ASSERT_EQ(compare_length, event[kEventLengthByte]);
+
+    // Don't compare past the end of the event.
+    if (compare_length + kEventFirstPayloadByte > event.size()) {
+      compare_length = event.size() - kEventFirstPayloadByte;
+      ALOGE("Only comparing %d bytes", static_cast<int>(compare_length));
+    }
+
+    if (n == num_packets - 1) {
+      command_size = write_name.size();
+    }
+
+    for (size_t i = 0; i < compare_length; i++) {
+      ASSERT_EQ(write_name[i], event[kEventFirstPayloadByte + i]);
+    }
+  }
+  logger.setTotalBytes(command_size * num_packets * 2);
+}
+
+// Send a SCO data packet (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckSco(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send a SCO packet
+    std::vector<uint8_t> sco_packet;
+    sco_packet.push_back(static_cast<uint8_t>(handle & 0xff));
+    sco_packet.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8));
+    sco_packet.push_back(static_cast<uint8_t>(size & 0xff));
+    for (size_t i = 0; i < size; i++) {
+      sco_packet.push_back(static_cast<uint8_t>(i + n));
+    }
+    hci->sendScoData(sco_packet);
+
+    // Check the loopback of the SCO packet
+    std::vector<uint8_t> sco_loopback;
+    ASSERT_TRUE(
+        sco_queue.tryPopWithTimeout(sco_loopback, kWaitForScoDataTimeout));
+
+    ASSERT_EQ(sco_packet.size(), sco_loopback.size());
+    size_t successful_bytes = 0;
+
+    for (size_t i = 0; i < sco_packet.size(); i++) {
+      if (sco_packet[i] == sco_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              sco_packet[i], sco_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              sco_packet[i + 1], sco_loopback[i + 1]);
+        break;
+      }
+    }
+    ASSERT_EQ(sco_packet.size(), successful_bytes + 1);
+  }
+  logger.setTotalBytes(num_packets * size * 2);
+}
+
+// Send an ACL data packet (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckAcl(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send an ACL packet
+    std::vector<uint8_t> acl_packet;
+    acl_packet.push_back(static_cast<uint8_t>(handle & 0xff));
+    acl_packet.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8) |
+                         kAclBroadcastPointToPoint |
+                         kAclPacketBoundaryFirstAutoFlushable);
+    acl_packet.push_back(static_cast<uint8_t>(size & 0xff));
+    acl_packet.push_back(static_cast<uint8_t>((size & 0xff00) >> 8));
+    for (size_t i = 0; i < size; i++) {
+      acl_packet.push_back(static_cast<uint8_t>(i + n));
+    }
+    hci->sendAclData(acl_packet);
+
+    std::vector<uint8_t> acl_loopback;
+    // Check the loopback of the ACL packet
+    ASSERT_TRUE(
+        acl_queue.tryPopWithTimeout(acl_loopback, kWaitForAclDataTimeout));
+
+    ASSERT_EQ(acl_packet.size(), acl_loopback.size());
+    size_t successful_bytes = 0;
+
+    for (size_t i = 0; i < acl_packet.size(); i++) {
+      if (acl_packet[i] == acl_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              acl_packet[i], acl_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              acl_packet[i + 1], acl_loopback[i + 1]);
+        break;
+      }
+    }
+    ASSERT_EQ(acl_packet.size(), successful_bytes + 1);
+  }
+  logger.setTotalBytes(num_packets * size * 2);
+}
+
+// Return the number of completed packets reported by the controller.
+int BluetoothAidlTest::wait_for_completed_packets_event(uint16_t handle) {
+  int packets_processed = 0;
+  wait_for_event(false);
+  if (event_queue.empty()) {
+    ALOGW("%s: waitForBluetoothCallback timed out.", __func__);
+    return packets_processed;
+  }
+  while (!event_queue.empty()) {
+    std::vector<uint8_t> event;
+    EXPECT_TRUE(event_queue.pop(event));
+
+    EXPECT_EQ(kEventNumberOfCompletedPackets, event[kEventCodeByte]);
+    EXPECT_EQ(1, event[kEventNumberOfCompletedPacketsNumHandles]);
+
+    uint16_t event_handle = event[3] + (event[4] << 8);
+    EXPECT_EQ(handle, event_handle);
+
+    packets_processed += event[5] + (event[6] << 8);
+  }
+  return packets_processed;
+}
+
+// Send the reset command and wait for a response.
+void BluetoothAidlTest::reset() {
+  std::vector<uint8_t> reset{kCommandHciReset,
+                             kCommandHciReset + sizeof(kCommandHciReset)};
+  hci->sendHciCommand(reset);
+
+  wait_for_command_complete_event(reset);
+}
+
+// Send local loopback command and initialize SCO and ACL handles.
+void BluetoothAidlTest::enterLoopbackMode() {
+  std::vector<uint8_t> cmd{kCommandHciWriteLoopbackModeLocal,
+                           kCommandHciWriteLoopbackModeLocal +
+                               sizeof(kCommandHciWriteLoopbackModeLocal)};
+  hci->sendHciCommand(cmd);
+
+  // Receive connection complete events with data channels
+  int connection_event_count = 0;
+  bool command_complete_received = false;
+  while (true) {
+    wait_for_event(false);
+    if (event_queue.empty()) {
+      // Fail if there was no event received or no connections completed.
+      ASSERT_TRUE(command_complete_received);
+      ASSERT_LT(0, connection_event_count);
+      return;
+    }
+    std::vector<uint8_t> event;
+    ASSERT_TRUE(event_queue.pop(event));
+    ASSERT_GT(event.size(),
+              static_cast<size_t>(kEventCommandCompleteStatusByte));
+    if (event[kEventCodeByte] == kEventConnectionComplete) {
+      ASSERT_GT(event.size(),
+                static_cast<size_t>(kEventConnectionCompleteType));
+      ASSERT_EQ(event[kEventLengthByte], kEventConnectionCompleteParamLength);
+      uint8_t connection_type = event[kEventConnectionCompleteType];
+
+      ASSERT_TRUE(connection_type == kEventConnectionCompleteTypeSco ||
+                  connection_type == kEventConnectionCompleteTypeAcl);
+
+      // Save handles
+      uint16_t handle = event[kEventConnectionCompleteHandleLsByte] |
+                        event[kEventConnectionCompleteHandleLsByte + 1] << 8;
+      if (connection_type == kEventConnectionCompleteTypeSco) {
+        sco_connection_handles.push_back(handle);
+      } else {
+        acl_connection_handles.push_back(handle);
+      }
+
+      ALOGD("Connect complete type = %d handle = %d",
+            event[kEventConnectionCompleteType], handle);
+      connection_event_count++;
+    } else {
+      ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+      ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+      ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+      ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+      command_complete_received = true;
+    }
+  }
+}
+
+// Empty test: Initialize()/Close() are called in SetUp()/TearDown().
+TEST_P(BluetoothAidlTest, InitializeAndClose) {}
+
+// Send an HCI Reset with sendHciCommand and wait for a command complete event.
+TEST_P(BluetoothAidlTest, HciReset) { reset(); }
+
+// Read and check the HCI version of the controller.
+TEST_P(BluetoothAidlTest, HciVersionTest) {
+  reset();
+  std::vector<uint8_t> cmd{kCommandHciReadLocalVersionInformation,
+                           kCommandHciReadLocalVersionInformation +
+                               sizeof(kCommandHciReadLocalVersionInformation)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventLocalLmpVersionByte));
+
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+
+  ASSERT_LE(kHciMinimumHciVersion, event[kEventLocalHciVersionByte]);
+  ASSERT_LE(kHciMinimumLmpVersion, event[kEventLocalLmpVersionByte]);
+}
+
+// Send an unknown HCI command and wait for the error message.
+TEST_P(BluetoothAidlTest, HciUnknownCommand) {
+  reset();
+  std::vector<uint8_t> cmd{
+      kCommandHciShouldBeUnknown,
+      kCommandHciShouldBeUnknown + sizeof(kCommandHciShouldBeUnknown)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventCommandCompleteStatusByte));
+  if (event[kEventCodeByte] == kEventCommandComplete) {
+    ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+    ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+    ASSERT_EQ(kHciStatusUnknownHciCommand,
+              event[kEventCommandCompleteStatusByte]);
+  } else {
+    ASSERT_EQ(kEventCommandStatus, event[kEventCodeByte]);
+    ASSERT_EQ(cmd[0], event[kEventCommandStatusOpcodeLsByte]);
+    ASSERT_EQ(cmd[1], event[kEventCommandStatusOpcodeLsByte + 1]);
+    ASSERT_EQ(kHciStatusUnknownHciCommand,
+              event[kEventCommandStatusStatusByte]);
+  }
+}
+
+// Enter loopback mode, but don't send any packets.
+TEST_P(BluetoothAidlTest, WriteLoopbackMode) {
+  reset();
+  enterLoopbackMode();
+}
+
+// Enter loopback mode and send a single command.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleCommand) {
+  reset();
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  sendAndCheckHci(1);
+}
+
+// Enter loopback mode and send a single SCO packet.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleSco) {
+  reset();
+  setBufferSizes();
+  setSynchronousFlowControlEnable();
+
+  enterLoopbackMode();
+
+  if (!sco_connection_handles.empty()) {
+    ASSERT_LT(0, max_sco_data_packet_length);
+    sendAndCheckSco(1, max_sco_data_packet_length, sco_connection_handles[0]);
+    int sco_packets_sent = 1;
+    int completed_packets =
+        wait_for_completed_packets_event(sco_connection_handles[0]);
+    if (sco_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            sco_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Enter loopback mode and send a single ACL packet.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleAcl) {
+  reset();
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  if (!acl_connection_handles.empty()) {
+    ASSERT_LT(0, max_acl_data_packet_length);
+    sendAndCheckAcl(1, max_acl_data_packet_length - 1,
+                    acl_connection_handles[0]);
+    int acl_packets_sent = 1;
+    int completed_packets =
+        wait_for_completed_packets_event(acl_connection_handles[0]);
+    if (acl_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            acl_packets_sent, completed_packets);
+    }
+  }
+  ASSERT_GE(acl_cb_count, 1);
+}
+
+// Enter loopback mode and send command packets for bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeCommandBandwidth) {
+  reset();
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  sendAndCheckHci(kNumHciCommandsBandwidth);
+}
+
+// Enter loopback mode and send SCO packets for bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeScoBandwidth) {
+  reset();
+  setBufferSizes();
+  setSynchronousFlowControlEnable();
+
+  enterLoopbackMode();
+
+  if (!sco_connection_handles.empty()) {
+    ASSERT_LT(0, max_sco_data_packet_length);
+    sendAndCheckSco(kNumScoPacketsBandwidth, max_sco_data_packet_length,
+                    sco_connection_handles[0]);
+    int sco_packets_sent = kNumScoPacketsBandwidth;
+    int completed_packets =
+        wait_for_completed_packets_event(sco_connection_handles[0]);
+    if (sco_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            sco_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Enter loopback mode and send packets for ACL bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeAclBandwidth) {
+  reset();
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  if (!acl_connection_handles.empty()) {
+    ASSERT_LT(0, max_acl_data_packet_length);
+    sendAndCheckAcl(kNumAclPacketsBandwidth, max_acl_data_packet_length - 1,
+                    acl_connection_handles[0]);
+    int acl_packets_sent = kNumAclPacketsBandwidth;
+    int completed_packets =
+        wait_for_completed_packets_event(acl_connection_handles[0]);
+    if (acl_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            acl_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Set all bits in the event mask
+TEST_P(BluetoothAidlTest, SetEventMask) {
+  reset();
+  std::vector<uint8_t> set_event_mask{
+      0x01, 0x0c, 0x08 /*parameter bytes*/, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff};
+  hci->sendHciCommand({set_event_mask});
+  wait_for_command_complete_event(set_event_mask);
+}
+
+// Set all bits in the LE event mask
+TEST_P(BluetoothAidlTest, SetLeEventMask) {
+  reset();
+  std::vector<uint8_t> set_event_mask{
+      0x20, 0x0c, 0x08 /*parameter bytes*/, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff};
+  hci->sendHciCommand({set_event_mask});
+  wait_for_command_complete_event(set_event_mask);
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BluetoothAidlTest);
+INSTANTIATE_TEST_SUITE_P(PerInstance, BluetoothAidlTest,
+                         testing::ValuesIn(android::getAidlHalInstanceNames(
+                             IBluetoothHci::descriptor)),
+                         android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+  ABinderProcess_startThreadPool();
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  ALOGI("Test result = %d", status);
+  return status;
+}
diff --git a/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml
new file mode 100644
index 0000000..3a42ae6
--- /dev/null
+++ b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2023 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalBluetoothTargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
+        <option name="run-command" value="cmd bluetooth_manager disable" />
+        <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
+        <option name="teardown-command" value="cmd bluetooth_manager enable" />
+        <option name="teardown-command" value="cmd bluetooth_manager wait-for-state:STATE_ON" />
+        <option name="teardown-command" value="settings put global ble_scan_always_enabled 1" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="VtsHalBluetoothTargetTest->/data/local/tmp/VtsHalBluetoothTargetTest" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsHalBluetoothTargetTest" />
+    </test>
+</configuration>
diff --git a/bluetooth/hci/h4_protocol.cc b/bluetooth/hci/h4_protocol.cc
index 97ba7aa..51a624f 100644
--- a/bluetooth/hci/h4_protocol.cc
+++ b/bluetooth/hci/h4_protocol.cc
@@ -58,10 +58,8 @@
   while (1) {
     ret = TEMP_FAILURE_RETRY(writev(uart_fd_, iov, 2));
     if (ret == -1) {
-      if (errno == EAGAIN) {
-        ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
-        continue;
-      }
+      LOG_ALWAYS_FATAL("%s error writing to UART (%s)", __func__,
+                       strerror(errno));
     } else if (ret == 0) {
       // Nothing written :(
       ALOGE("%s zero bytes written - something went wrong...", __func__);
diff --git a/camera/common/default/OWNERS b/camera/OWNERS
similarity index 65%
rename from camera/common/default/OWNERS
rename to camera/OWNERS
index f48a95c..b946264 100644
--- a/camera/common/default/OWNERS
+++ b/camera/OWNERS
@@ -1 +1,3 @@
+# Bug component: 41727
+
 include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/1.0/default/OWNERS b/camera/device/1.0/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/1.0/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.2/default/OWNERS b/camera/device/3.2/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.2/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.3/default/OWNERS b/camera/device/3.3/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.3/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.4/default/OWNERS b/camera/device/3.4/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.4/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.5/default/OWNERS b/camera/device/3.5/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.5/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.6/default/OWNERS b/camera/device/3.6/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.6/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/default/OWNERS b/camera/device/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/2.4/default/OWNERS b/camera/provider/2.4/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/provider/2.4/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/2.4/vts/OWNERS b/camera/provider/2.4/vts/OWNERS
deleted file mode 100644
index eb4f0e4..0000000
--- a/camera/provider/2.4/vts/OWNERS
+++ /dev/null
@@ -1,8 +0,0 @@
-# Bug component: 41727
-
-# Camera team
-include platform/frameworks/av:/camera/OWNERS
-
-# VTS team
-yim@google.com
-zhuoyao@google.com
diff --git a/camera/provider/2.4/vts/functional/OWNERS b/camera/provider/2.4/vts/functional/OWNERS
deleted file mode 100644
index 479f465..0000000
--- a/camera/provider/2.4/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 41727
-epeev@google.com
diff --git a/camera/provider/2.5/default/OWNERS b/camera/provider/2.5/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/provider/2.5/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/aidl/vts/OWNERS b/camera/provider/aidl/vts/OWNERS
deleted file mode 100644
index 27d370b..0000000
--- a/camera/provider/aidl/vts/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-# Camera team
-include platform/frameworks/av:/camera/OWNERS
-
-# VTS team
-yim@google.com
-zhuoyao@google.com
\ No newline at end of file
diff --git a/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp b/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
index 4d4bb26..50fb052 100644
--- a/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
+++ b/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
@@ -1847,7 +1847,6 @@
 // Generate and verify 10-bit dynamic range request
 TEST_P(CameraAidlTest, process10BitDynamicRangeRequest) {
     std::vector<std::string> cameraDeviceNames = getCameraDeviceNames(mProvider);
-    int64_t bufferId = 1;
     CameraMetadata settings;
 
     for (const auto& name : cameraDeviceNames) {
@@ -1928,12 +1927,12 @@
             // Stream as long as needed to fill the Hal inflight queue
             std::vector<CaptureRequest> requests(halStreams[0].maxBuffers);
 
-            for (int32_t frameNumber = 0; frameNumber < requests.size(); frameNumber++) {
+            for (int32_t requestId = 0; requestId < requests.size(); requestId++) {
                 std::shared_ptr<InFlightRequest> inflightReq = std::make_shared<InFlightRequest>(
                         static_cast<ssize_t>(halStreams.size()), false, supportsPartialResults,
                         partialResultCount, std::unordered_set<std::string>(), resultQueue);
 
-                CaptureRequest& request = requests[frameNumber];
+                CaptureRequest& request = requests[requestId];
                 std::vector<StreamBuffer>& outputBuffers = request.outputBuffers;
                 outputBuffers.resize(halStreams.size());
 
@@ -1942,6 +1941,7 @@
                 std::vector<buffer_handle_t> graphicBuffers;
                 graphicBuffers.reserve(halStreams.size());
 
+                auto bufferId = requestId + 1; // Buffer id value 0 is not valid
                 for (const auto& halStream : halStreams) {
                     buffer_handle_t buffer_handle;
                     if (useHalBufManager) {
@@ -1960,14 +1960,13 @@
                         outputBuffers[k] = {halStream.id, bufferId,
                             android::makeToAidl(buffer_handle), BufferStatus::OK, NativeHandle(),
                             NativeHandle()};
-                        bufferId++;
                     }
                     k++;
                 }
 
                 request.inputBuffer = {
                         -1, 0, NativeHandle(), BufferStatus::ERROR, NativeHandle(), NativeHandle()};
-                request.frameNumber = frameNumber;
+                request.frameNumber = bufferId;
                 request.fmqSettingsSize = 0;
                 request.settings = settings;
                 request.inputWidth = 0;
@@ -1975,7 +1974,7 @@
 
                 {
                     std::unique_lock<std::mutex> l(mLock);
-                    mInflightMap[frameNumber] = inflightReq;
+                    mInflightMap[bufferId] = inflightReq;
                 }
 
             }
@@ -1991,7 +1990,10 @@
                     std::vector<int32_t> {halStreams[0].id});
             ASSERT_TRUE(returnStatus.isOk());
 
-            for (int32_t frameNumber = 0; frameNumber < requests.size(); frameNumber++) {
+            // We are keeping frame numbers and buffer ids consistent. Buffer id value of 0
+            // is used to indicate a buffer that is not present/available so buffer ids as well
+            // as frame numbers begin with 1.
+            for (int32_t frameNumber = 1; frameNumber <= requests.size(); frameNumber++) {
                 const auto& inflightReq = mInflightMap[frameNumber];
                 std::unique_lock<std::mutex> l(mLock);
                 while (!inflightReq->errorCodeValid &&
diff --git a/camera/provider/aidl/vts/camera_aidl_test.cpp b/camera/provider/aidl/vts/camera_aidl_test.cpp
index 974223d..6cad853 100644
--- a/camera/provider/aidl/vts/camera_aidl_test.cpp
+++ b/camera/provider/aidl/vts/camera_aidl_test.cpp
@@ -169,7 +169,7 @@
         ScopedAStatus physicalCameraDeviceStatusChange(
                 const std::string&, const std::string&,
                 ::aidl::android::hardware::camera::common::CameraDeviceStatus) override {
-            return ndk::ScopedAStatus();
+            return ScopedAStatus::ok();
         }
 
         std::vector<std::string> externalCameraDeviceNames;
diff --git a/camera/provider/aidl/vts/device_cb.cpp b/camera/provider/aidl/vts/device_cb.cpp
index 4698b4a..3ec96a1 100644
--- a/camera/provider/aidl/vts/device_cb.cpp
+++ b/camera/provider/aidl/vts/device_cb.cpp
@@ -429,10 +429,11 @@
         CameraAidlTest::InFlightRequest::StreamBufferAndTimestamp streamBufferAndTimestamp;
         auto outstandingBuffers = mUseHalBufManager ? mOutstandingBufferIds :
             request->mOutstandingBufferIds;
+        auto bufferId = mUseHalBufManager ? buffer.bufferId : results.frameNumber;
         auto outputBuffer = outstandingBuffers.empty() ? ::android::makeFromAidl(buffer.buffer) :
-            outstandingBuffers[buffer.streamId][buffer.bufferId];
+            outstandingBuffers[buffer.streamId][bufferId];
         streamBufferAndTimestamp.buffer = {buffer.streamId,
-                                           buffer.bufferId,
+                                           bufferId,
                                            outputBuffer,
                                            buffer.status,
                                            ::android::makeFromAidl(buffer.acquireFence),
diff --git a/camera/provider/default/OWNERS b/camera/provider/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/provider/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/cas/OWNERS b/cas/OWNERS
new file mode 100644
index 0000000..473c8f26
--- /dev/null
+++ b/cas/OWNERS
@@ -0,0 +1 @@
+include /tv/input/OWNERS
diff --git a/cas/aidl/TEST_MAPPING b/cas/aidl/TEST_MAPPING
new file mode 100644
index 0000000..5bcd388
--- /dev/null
+++ b/cas/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit": [
+    {
+      "name": "VtsHalCasAidlTargetTest"
+    }
+  ]
+}
diff --git a/cas/aidl/vts/functional/AndroidTest.xml b/cas/aidl/vts/functional/AndroidTest.xml
new file mode 100644
index 0000000..6e6af93
--- /dev/null
+++ b/cas/aidl/vts/functional/AndroidTest.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2023 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalCasAidlTargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="VtsHalCasAidlTargetTest->/data/local/tmp/VtsHalCasAidlTargetTest" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsHalCasAidlTargetTest" />
+        <option name="native-test-timeout" value="30m" />
+    </test>
+</configuration>
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 982b88b..5cbf85c 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -189,14 +189,6 @@
             <regex-instance>[^/]+/[0-9]+</regex-instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.cas</name>
-        <version>1.1-2</version>
-        <interface>
-            <name>IMediaCasService</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.cas</name>
         <interface>
@@ -297,7 +289,7 @@
     </hal>
     <hal format="aidl" optional="false">
         <name>android.hardware.health</name>
-        <version>1</version>
+        <version>1-2</version>
         <interface>
             <name>IHealth</name>
             <instance>default</instance>
@@ -529,6 +521,16 @@
         </interface>
     </hal>
     <hal format="aidl" optional="true">
+        <name>android.hardware.radio.satellite</name>
+        <version>1</version>
+        <interface>
+            <name>IRadioSatellite</name>
+            <instance>slot1</instance>
+            <instance>slot2</instance>
+            <instance>slot3</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
         <name>android.hardware.radio.ims.media</name>
         <version>1</version>
         <interface>
@@ -618,6 +620,14 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.tetheroffload</name>
+        <version>1</version>
+        <interface>
+            <name>IOffload</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="aidl" optional="false">
         <name>android.hardware.thermal</name>
         <version>1</version>
@@ -750,7 +760,6 @@
         <name>mapper</name>
         <version>5.0</version>
         <interface>
-            <name>I</name>
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
diff --git a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
index f7ff73d..228a569 100644
--- a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
+++ b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
@@ -88,20 +88,20 @@
     Status status = contextHub->setTestMode(true);
     if (status.exceptionCode() == Status::EX_UNSUPPORTED_OPERATION ||
         status.transactionError() == android::UNKNOWN_TRANSACTION) {
-        return;  // not supported -> old API; or not implemented
+        GTEST_SKIP() << "Not supported -> old API; or not implemented";
+    } else {
+        ASSERT_TRUE(status.isOk());
     }
-
-    ASSERT_TRUE(status.isOk());
 }
 
 TEST_P(ContextHubAidl, TestDisableTestMode) {
     Status status = contextHub->setTestMode(false);
     if (status.exceptionCode() == Status::EX_UNSUPPORTED_OPERATION ||
         status.transactionError() == android::UNKNOWN_TRANSACTION) {
-        return;  // not supported -> old API; or not implemented
+        GTEST_SKIP() << "Not supported -> old API; or not implemented";
+    } else {
+        ASSERT_TRUE(status.isOk());
     }
-
-    ASSERT_TRUE(status.isOk());
 }
 
 class EmptyContextHubCallback : public android::hardware::contexthub::BnContextHubCallback {
@@ -186,11 +186,11 @@
     Status status = contextHub->getPreloadedNanoappIds(&preloadedNanoappIds);
     if (status.exceptionCode() == Status::EX_UNSUPPORTED_OPERATION ||
         status.transactionError() == android::UNKNOWN_TRANSACTION) {
-        return;  // not supported -> old API; or not implemented
+        GTEST_SKIP() << "Not supported -> old API; or not implemented";
+    } else {
+        ASSERT_TRUE(status.isOk());
+        ASSERT_FALSE(preloadedNanoappIds.empty());
     }
-
-    ASSERT_TRUE(status.isOk());
-    ASSERT_FALSE(preloadedNanoappIds.empty());
 }
 
 // Helper callback that puts the TransactionResult for the expectedTransactionId into a
diff --git a/drm/README.md b/drm/README.md
new file mode 100644
index 0000000..d56288e
--- /dev/null
+++ b/drm/README.md
@@ -0,0 +1,13 @@
+# DRM HAL
+
+This is the underlying HAL implementation for `MediaDrm`/`MediaCrypto` (and
+their NDK counterparts).
+
+## Plugin-vendor-specific VTS modules
+
+The interface `DrmHalVTSVendorModule_V1` is compatible with all versions of the
+DRM HAL (hidl 1.0-1.4, aidl).
+
+Please see `./1.0/vts/doc/Drm_Vendor_Modules_v1.pdf`.
+
+TODO(b/266091099): convert `Drm_Vendor_Modules_v1.pdf` to Markdown.
\ No newline at end of file
diff --git a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
index 04bacf0..227210b 100644
--- a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
+++ b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
@@ -22,11 +22,12 @@
 @VintfStability
 parcelable GatekeeperEnrollResponse {
     /**
-     * Request completion status
+     * Request completion status. The status code can be IGatekeeper::STATUS_OK
+     * or IGatekeeper::ERROR_RETRY_TIMEOUT.
      */
     int statusCode;
     /**
-     * Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
+     * Retry timeout in ms, if code == IGatekeeper::ERROR_RETRY_TIMEOUT
      * otherwise unused (0)
      */
     int timeoutMs;
diff --git a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
index bcf2d76..f8dbeeb 100644
--- a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
+++ b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
@@ -24,11 +24,12 @@
 @VintfStability
 parcelable GatekeeperVerifyResponse {
     /**
-     * Request completion status
+     * Request completion status. The status code can be IGatekeeper::STATUS_OK
+     * or IGatekeeper::ERROR_RETRY_TIMEOUT or IGatekeeper::STATUS_REENROLL.
      */
     int statusCode;
     /**
-     * Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
+     * Retry timeout in ms, if code == IGatekeeper::ERROR_RETRY_TIMEOUT
      * otherwise unused (0)
      */
     int timeoutMs;
diff --git a/gnss/aidl/vts/gnss_hal_test_cases.cpp b/gnss/aidl/vts/gnss_hal_test_cases.cpp
index 48027b6..bed5a69 100644
--- a/gnss/aidl/vts/gnss_hal_test_cases.cpp
+++ b/gnss/aidl/vts/gnss_hal_test_cases.cpp
@@ -531,6 +531,11 @@
 
     EXPECT_EQ(gnssPowerIndicationCallback->capabilities_cbq_.calledCount(), 1);
 
+    if (gnssPowerIndicationCallback->last_capabilities_ == 0) {
+        // Skipping the test since GnssPowerIndication is not supported.
+        return;
+    }
+
     // Request and verify a GnssPowerStats is received
     gnssPowerIndicationCallback->gnss_power_stats_cbq_.reset();
     iGnssPowerIndication->requestGnssPowerStats();
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionCapability.aidl
similarity index 81%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionCapability.aidl
index 711ac19..66151ca 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionCapability.aidl
@@ -1,11 +1,11 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
+/**
+ * Copyright (c) 2022, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
+ *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.graphics.common;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable HdrConversionCapability {
+  android.hardware.graphics.common.ParcelableHdr sourceType;
+  @nullable android.hardware.graphics.common.ParcelableHdr outputType;
+  boolean addsLatency;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionStrategy.aidl
similarity index 82%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionStrategy.aidl
index 711ac19..db785cf 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/HdrConversionStrategy.aidl
@@ -1,11 +1,11 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
+/**
+ * Copyright (c) 2022, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
+ *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.graphics.common;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+union HdrConversionStrategy {
+  boolean passthrough = true;
+  android.hardware.graphics.common.Hdr[] autoAllowedHdrTypes;
+  android.hardware.graphics.common.Hdr forceHdrConversion;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/ParcelableHdr.aidl
similarity index 85%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/ParcelableHdr.aidl
index 711ac19..788bd4e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/graphics/common/aidl/aidl_api/android.hardware.graphics.common/current/android/hardware/graphics/common/ParcelableHdr.aidl
@@ -1,11 +1,11 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
+/**
+ * Copyright (c) 2023, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      http://www.apache.org/licenses/LICENSE-2.0
+ *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,10 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.graphics.common;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable ParcelableHdr {
+  android.hardware.graphics.common.Hdr hdr;
 }
diff --git a/graphics/common/aidl/android/hardware/graphics/common/HdrConversionCapability.aidl b/graphics/common/aidl/android/hardware/graphics/common/HdrConversionCapability.aidl
new file mode 100644
index 0000000..53b3256
--- /dev/null
+++ b/graphics/common/aidl/android/hardware/graphics/common/HdrConversionCapability.aidl
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) 2022, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.common;
+
+import android.hardware.graphics.common.ParcelableHdr;
+
+/**
+ * Output parameter for IComposerClient.getHdrConversionCapabilities
+ *
+ * @param sourceType is the HDR type that can be converted to outputType.
+ *
+ * @param outputType is the HDR type/ SDR that the source type can be converted to. The value null
+ * is used to depict SDR outputType.
+ *
+ * @param addsLatency is false if no latency added due to HDR conversion from sourceType to
+ * outputType, otherwise true.
+ */
+@VintfStability
+parcelable HdrConversionCapability {
+    ParcelableHdr sourceType;
+    @nullable ParcelableHdr outputType;
+    boolean addsLatency;
+}
diff --git a/graphics/common/aidl/android/hardware/graphics/common/HdrConversionStrategy.aidl b/graphics/common/aidl/android/hardware/graphics/common/HdrConversionStrategy.aidl
new file mode 100644
index 0000000..f564e9f
--- /dev/null
+++ b/graphics/common/aidl/android/hardware/graphics/common/HdrConversionStrategy.aidl
@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) 2022, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.common;
+/**
+ * Input parameter for IComposerClient.setHdrConversionStrategy
+ *
+ * @param passthrough - When this parameter is set to true, HDR conversion is disabled by the
+ * implementation. The output HDR type will change dynamically to match the content. This value is
+ * never set to false, as other union values will be present in the false case.
+ *
+ * @param autoAllowedHdrTypes - When this parameter is set, the output HDR type is selected by the
+ * implementation. The implementation is only allowed to set the output HDR type to the HDR types
+ * present in this list. If conversion to any of the autoHdrTypes types is not possible, the
+ * implementation should do no conversion.
+ *
+ * @param forceHdrConversion - When this parameter is set, the implementation should convert all
+ * content to this HDR type, when possible. If not possible, the functionality should be similar to
+ * passthrough=true.
+ */
+@VintfStability
+union HdrConversionStrategy {
+    boolean passthrough = true;
+    android.hardware.graphics.common.Hdr[] autoAllowedHdrTypes;
+    android.hardware.graphics.common.Hdr forceHdrConversion;
+}
diff --git a/graphics/common/aidl/android/hardware/graphics/common/ParcelableHdr.aidl b/graphics/common/aidl/android/hardware/graphics/common/ParcelableHdr.aidl
new file mode 100644
index 0000000..9aff277
--- /dev/null
+++ b/graphics/common/aidl/android/hardware/graphics/common/ParcelableHdr.aidl
@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2023, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.graphics.common;
+
+import android.hardware.graphics.common.Hdr;
+
+@VintfStability
+parcelable ParcelableHdr {
+    Hdr hdr;
+}
diff --git a/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp b/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
index b66ee19..4822678 100644
--- a/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
+++ b/graphics/composer/2.1/vts/functional/VtsHalGraphicsComposerV2_1TargetTest.cpp
@@ -657,7 +657,6 @@
                                                              IComposerClient::Attribute::WIDTH);
         mDisplayHeight = mComposerClient->getDisplayAttribute(mPrimaryDisplay, activeConfig,
                                                               IComposerClient::Attribute::HEIGHT);
-
         mWriter = std::make_unique<CommandWriterBase>(1024);
         mReader = std::make_unique<TestCommandReader>();
     }
@@ -667,13 +666,11 @@
         ASSERT_NO_FATAL_FAILURE(GraphicsComposerHidlTest::TearDown());
     }
 
-    NativeHandleWrapper allocate() { return allocate(mDisplayWidth, mDisplayHeight); }
-
-    NativeHandleWrapper allocate(uint32_t width, uint32_t height) {
+    NativeHandleWrapper allocate() {
         uint64_t usage =
                 static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN |
                                       BufferUsage::COMPOSER_OVERLAY);
-        return mGralloc->allocate(width, height, 1, PixelFormat::RGBA_8888, usage);
+        return mGralloc->allocate(mDisplayWidth, mDisplayHeight, 1, PixelFormat::RGBA_8888, usage);
     }
 
     void execute() { mComposerClient->execute(mReader.get(), mWriter.get()); }
@@ -887,57 +884,6 @@
 }
 
 /**
- * Test IComposerClient::Command::SET_LAYER_BUFFER with the behavior used for clearing buffer slots.
- */
-TEST_P(GraphicsComposerHidlCommandTest, SET_LAYER_BUFFER_TO_CLEAR_BUFFER_SLOTS) {
-    // A buffer used to clear buffer slots
-    auto clearSlotBuffer = allocate(1u, 1u);
-
-    auto handle1 = allocate();
-    ASSERT_NE(nullptr, handle1.get());
-    IComposerClient::Rect displayFrame{0, 0, mDisplayWidth, mDisplayHeight};
-    Layer layer;
-    ASSERT_NO_FATAL_FAILURE(
-            layer = mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->selectLayer(layer);
-    mWriter->setLayerCompositionType(IComposerClient::Composition::DEVICE);
-    mWriter->setLayerDisplayFrame(displayFrame);
-    mWriter->setLayerBuffer(0, handle1.get(), -1);
-    mWriter->setLayerDataspace(Dataspace::UNKNOWN);
-    mWriter->validateDisplay();
-    execute();
-    if (mReader->mCompositionChanges.size() != 0) {
-        GTEST_SUCCEED() << "Composition change requested, skipping test";
-        return;
-    }
-    ASSERT_EQ(0, mReader->mErrors.size());
-
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->presentDisplay();
-    execute();
-    ASSERT_EQ(0, mReader->mErrors.size());
-
-    // Ensure we can clear a buffer slot and then set that same slot with a new buffer
-    auto handle2 = allocate();
-    ASSERT_NE(nullptr, handle2.get());
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->selectLayer(layer);
-    mWriter->setLayerBuffer(0, clearSlotBuffer.get(), -1);
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->selectLayer(layer);
-    mWriter->setLayerBuffer(0, handle2.get(), -1);
-    mWriter->validateDisplay();
-    execute();
-    ASSERT_EQ(0, mReader->mErrors.size());
-
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->presentDisplay();
-    execute();
-    ASSERT_EQ(0, mReader->mErrors.size());
-}
-
-/**
  * Test IComposerClient::Command::SET_LAYER_SURFACE_DAMAGE.
  */
 TEST_P(GraphicsComposerHidlCommandTest, SET_LAYER_SURFACE_DAMAGE) {
diff --git a/graphics/composer/2.2/utils/vts/ComposerVts.cpp b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
index a6dfcaf..d4f0281 100644
--- a/graphics/composer/2.2/utils/vts/ComposerVts.cpp
+++ b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
@@ -126,23 +126,15 @@
     ASSERT_EQ(Error::NONE, error) << "failed to setReadbackBuffer";
 }
 
-void ComposerClient::getRequiredReadbackBufferAttributes(Display display,
-                                                         PixelFormat* outPixelFormat,
-                                                         Dataspace* outDataspace) {
-    ASSERT_EQ(Error::NONE, getReadbackBufferAttributes(display, outPixelFormat, outDataspace));
-}
-
-Error ComposerClient::getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
-                                                  Dataspace* outDataspace) {
-    Error error;
+void ComposerClient::getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
+                                                 Dataspace* outDataspace) {
     mClient->getReadbackBufferAttributes(
-            display, [&](const Error& tmpError, const PixelFormat& tmpPixelFormat,
-                         const Dataspace& tmpDataspace) {
-                error = tmpError;
-                *outPixelFormat = tmpPixelFormat;
-                *outDataspace = tmpDataspace;
+            display,
+            [&](const auto& tmpError, const auto& tmpOutPixelFormat, const auto& tmpOutDataspace) {
+                ASSERT_EQ(Error::NONE, tmpError) << "failed to get readback buffer attributes";
+                *outPixelFormat = tmpOutPixelFormat;
+                *outDataspace = tmpOutDataspace;
             });
-    return error;
 }
 
 void ComposerClient::getReadbackBufferFence(Display display, int32_t* outFence) {
diff --git a/graphics/composer/2.2/utils/vts/ReadbackVts.cpp b/graphics/composer/2.2/utils/vts/ReadbackVts.cpp
index 5dd68df..a1794af 100644
--- a/graphics/composer/2.2/utils/vts/ReadbackVts.cpp
+++ b/graphics/composer/2.2/utils/vts/ReadbackVts.cpp
@@ -19,8 +19,6 @@
 #include "renderengine/ExternalTexture.h"
 #include "renderengine/impl/ExternalTexture.h"
 
-using ::android::status_t;
-
 namespace android {
 namespace hardware {
 namespace graphics {
@@ -109,40 +107,6 @@
     }
 }
 
-void ReadbackHelper::fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                           IComposerClient::Color desiredColor, int* fillFence) {
-    ASSERT_NE(nullptr, fillFence);
-    std::vector<IComposerClient::Color> desiredColors(
-            static_cast<size_t>(graphicBuffer->getWidth() * graphicBuffer->getHeight()));
-    ::android::Rect bounds = graphicBuffer->getBounds();
-    fillColorsArea(desiredColors, static_cast<int32_t>(graphicBuffer->getWidth()),
-                   {bounds.left, bounds.top, bounds.right, bounds.bottom}, desiredColor);
-    ASSERT_NO_FATAL_FAILURE(fillBufferAndGetFence(graphicBuffer, desiredColors, fillFence));
-}
-
-void ReadbackHelper::fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                           const std::vector<IComposerClient::Color>& desiredColors,
-                                           int* fillFence) {
-    ASSERT_TRUE(graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGB_888 ||
-                graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGBA_8888);
-    void* bufData;
-    int32_t bytesPerPixel = -1;
-    int32_t bytesPerStride = -1;
-    status_t status =
-            graphicBuffer->lock(GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_OFTEN,
-                                &bufData, &bytesPerPixel, &bytesPerStride);
-    ASSERT_EQ(::android::OK, status);
-
-    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
-                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
-                                    : graphicBuffer->getStride();
-    ReadbackHelper::fillBuffer(graphicBuffer->getWidth(), graphicBuffer->getHeight(), stride,
-                               bufData, static_cast<PixelFormat>(graphicBuffer->getPixelFormat()),
-                               desiredColors);
-    status = graphicBuffer->unlockAsync(fillFence);
-    ASSERT_EQ(::android::OK, status);
-}
-
 void ReadbackHelper::fillBuffer(int32_t width, int32_t height, uint32_t stride, void* bufferData,
                                 PixelFormat pixelFormat,
                                 std::vector<IComposerClient::Color> desiredPixelColors) {
@@ -152,16 +116,16 @@
     for (int row = 0; row < height; row++) {
         for (int col = 0; col < width; col++) {
             int pixel = row * width + col;
-            IComposerClient::Color desiredColor = desiredPixelColors[pixel];
+            IComposerClient::Color srcColor = desiredPixelColors[pixel];
 
             int offset = (row * stride + col) * bytesPerPixel;
             uint8_t* pixelColor = (uint8_t*)bufferData + offset;
-            pixelColor[0] = desiredColor.r;
-            pixelColor[1] = desiredColor.g;
-            pixelColor[2] = desiredColor.b;
+            pixelColor[0] = srcColor.r;
+            pixelColor[1] = srcColor.g;
+            pixelColor[2] = srcColor.b;
 
             if (bytesPerPixel == 4) {
-                pixelColor[3] = desiredColor.a;
+                pixelColor[3] = srcColor.a;
             }
         }
     }
@@ -188,14 +152,12 @@
     }
 }
 
-bool ReadbackHelper::readbackSupported(PixelFormat pixelFormat, Dataspace dataspace, Error error) {
+bool ReadbackHelper::readbackSupported(const PixelFormat& pixelFormat, const Dataspace& dataspace,
+                                       const Error error) {
     if (error != Error::NONE) {
         return false;
     }
-    return readbackSupported(pixelFormat, dataspace);
-}
-
-bool ReadbackHelper::readbackSupported(PixelFormat pixelFormat, Dataspace dataspace) {
+    // TODO: add support for RGBA_1010102
     if (pixelFormat != PixelFormat::RGB_888 && pixelFormat != PixelFormat::RGBA_8888) {
         return false;
     }
@@ -205,94 +167,71 @@
     return true;
 }
 
-void ReadbackHelper::createReadbackBuffer(uint32_t width, uint32_t height, PixelFormat pixelFormat,
-                                          Dataspace dataspace, sp<GraphicBuffer>* graphicBuffer) {
-    ASSERT_NE(nullptr, graphicBuffer);
-    if (!readbackSupported(pixelFormat, dataspace)) {
-        *graphicBuffer = nullptr;
-    }
-    android::PixelFormat bufferFormat = static_cast<android::PixelFormat>(pixelFormat);
-    uint32_t layerCount = 1;
-    uint64_t usage = static_cast<uint64_t>(static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN) |
-                                           static_cast<uint64_t>(BufferUsage::GPU_TEXTURE));
-    *graphicBuffer = sp<GraphicBuffer>::make(width, height, bufferFormat, layerCount, usage,
-                                             "ReadbackBuffer");
-    ASSERT_NE(nullptr, *graphicBuffer);
-    ASSERT_EQ(::android::OK, (*graphicBuffer)->initCheck());
-}
-
-void ReadbackHelper::compareColorToBuffer(IComposerClient::Color expectedColor,
-                                          const sp<GraphicBuffer>& graphicBuffer, int32_t fence) {
-    std::vector<IComposerClient::Color> expectedColors(
-            static_cast<size_t>(graphicBuffer->getWidth() * graphicBuffer->getHeight()));
-    ::android::Rect bounds = graphicBuffer->getBounds();
-    fillColorsArea(expectedColors, static_cast<int32_t>(graphicBuffer->getWidth()),
-                   {bounds.left, bounds.top, bounds.right, bounds.bottom}, expectedColor);
-    compareColorsToBuffer(expectedColors, graphicBuffer, fence);
-}
-
-void ReadbackHelper::compareColorsToBuffer(std::vector<IComposerClient::Color>& expectedColors,
-                                           const sp<GraphicBuffer>& graphicBuffer, int32_t fence) {
-    ASSERT_TRUE(graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGB_888 ||
-                graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGBA_8888);
-
-    int bytesPerPixel = -1;
-    int bytesPerStride = -1;
-    void* bufData = nullptr;
-    status_t status = graphicBuffer->lockAsync(GRALLOC_USAGE_SW_READ_OFTEN, &bufData, fence,
-                                               &bytesPerPixel, &bytesPerStride);
-    ASSERT_EQ(::android::OK, status);
-
-    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
-                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
-                                    : graphicBuffer->getStride();
-
-    if (bytesPerPixel == -1) {
-        PixelFormat pixelFormat = static_cast<PixelFormat>(graphicBuffer->getPixelFormat());
-        bytesPerPixel = ReadbackHelper::GetBytesPerPixel(pixelFormat);
-    }
+void ReadbackHelper::compareColorBuffers(std::vector<IComposerClient::Color>& expectedColors,
+                                         void* bufferData, const uint32_t stride,
+                                         const uint32_t width, const uint32_t height,
+                                         const PixelFormat pixelFormat) {
+    const int32_t bytesPerPixel = ReadbackHelper::GetBytesPerPixel(pixelFormat);
     ASSERT_NE(-1, bytesPerPixel);
-    for (int row = 0; row < graphicBuffer->getHeight(); row++) {
-        for (int col = 0; col < graphicBuffer->getWidth(); col++) {
-            int pixel = row * static_cast<int32_t>(graphicBuffer->getWidth()) + col;
-            int offset = (row * static_cast<int32_t>(stride) + col) * bytesPerPixel;
-            uint8_t* pixelColor = (uint8_t*)bufData + offset;
-            const IComposerClient::Color expectedColor = expectedColors[static_cast<size_t>(pixel)];
-            ASSERT_EQ(std::round(255.0f * expectedColor.r), pixelColor[0]);
-            ASSERT_EQ(std::round(255.0f * expectedColor.g), pixelColor[1]);
-            ASSERT_EQ(std::round(255.0f * expectedColor.b), pixelColor[2]);
+    for (int row = 0; row < height; row++) {
+        for (int col = 0; col < width; col++) {
+            int pixel = row * width + col;
+            int offset = (row * stride + col) * bytesPerPixel;
+            uint8_t* pixelColor = (uint8_t*)bufferData + offset;
+
+            ASSERT_EQ(expectedColors[pixel].r, pixelColor[0]);
+            ASSERT_EQ(expectedColors[pixel].g, pixelColor[1]);
+            ASSERT_EQ(expectedColors[pixel].b, pixelColor[2]);
         }
     }
-
-    status = graphicBuffer->unlock();
-    ASSERT_EQ(::android::OK, status);
 }
 
 ReadbackBuffer::ReadbackBuffer(Display display, const std::shared_ptr<ComposerClient>& client,
-                               uint32_t width, uint32_t height, PixelFormat pixelFormat) {
+                               const std::shared_ptr<Gralloc>& gralloc, uint32_t width,
+                               uint32_t height, PixelFormat pixelFormat, Dataspace dataspace) {
     mDisplay = display;
+
     mComposerClient = client;
+    mGralloc = gralloc;
+
+    mPixelFormat = pixelFormat;
+    mDataspace = dataspace;
+
     mWidth = width;
     mHeight = height;
-    mPixelFormat = pixelFormat;
     mLayerCount = 1;
+    mFormat = mPixelFormat;
     mUsage = static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::GPU_TEXTURE);
+
+    mAccessRegion.top = 0;
+    mAccessRegion.left = 0;
+    mAccessRegion.width = width;
+    mAccessRegion.height = height;
 }
 
 void ReadbackBuffer::setReadbackBuffer() {
-    mGraphicBuffer = sp<GraphicBuffer>::make(mWidth, mHeight,
-                                             static_cast<::android::PixelFormat>(mPixelFormat),
-                                             mLayerCount, mUsage, "ReadbackBuffer");
-    ASSERT_NE(nullptr, mGraphicBuffer);
-    ASSERT_EQ(::android::OK, mGraphicBuffer->initCheck());
-    mComposerClient->setReadbackBuffer(mDisplay, mGraphicBuffer->handle, -1 /* fence */);
+    mBufferHandle.reset(new Gralloc::NativeHandleWrapper(
+            mGralloc->allocate(mWidth, mHeight, mLayerCount, mFormat, mUsage,
+                               /*import*/ true, &mStride)));
+    ASSERT_NE(false, mGralloc->validateBufferSize(mBufferHandle->get(), mWidth, mHeight,
+                                                  mLayerCount, mFormat, mUsage, mStride));
+    ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(mDisplay, mBufferHandle->get(), -1));
 }
 
 void ReadbackBuffer::checkReadbackBuffer(std::vector<IComposerClient::Color> expectedColors) {
     // lock buffer for reading
     int32_t fenceHandle;
     ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mDisplay, &fenceHandle));
-    ReadbackHelper::compareColorsToBuffer(expectedColors, mGraphicBuffer, fenceHandle);
+
+    void* bufData = mGralloc->lock(mBufferHandle->get(), mUsage, mAccessRegion, fenceHandle);
+    ASSERT_TRUE(mPixelFormat == PixelFormat::RGB_888 || mPixelFormat == PixelFormat::RGBA_8888);
+    ReadbackHelper::compareColorBuffers(expectedColors, bufData, mStride, mWidth, mHeight,
+                                        mPixelFormat);
+    int32_t unlockFence = mGralloc->unlock(mBufferHandle->get());
+    if (unlockFence != -1) {
+        sync_wait(unlockFence, -1);
+        close(unlockFence);
+    }
 }
 
 void TestColorLayer::write(const std::shared_ptr<CommandWriterBase>& writer) {
diff --git a/graphics/composer/2.2/utils/vts/RenderEngineVts.cpp b/graphics/composer/2.2/utils/vts/RenderEngineVts.cpp
index 254ff3b..1700b2a 100644
--- a/graphics/composer/2.2/utils/vts/RenderEngineVts.cpp
+++ b/graphics/composer/2.2/utils/vts/RenderEngineVts.cpp
@@ -83,7 +83,9 @@
 void TestRenderEngine::checkColorBuffer(std::vector<V2_2::IComposerClient::Color>& expectedColors) {
     void* bufferData;
     ASSERT_EQ(0, mGraphicBuffer->lock(mGraphicBuffer->getUsage(), &bufferData));
-    ReadbackHelper::compareColorsToBuffer(expectedColors, mGraphicBuffer, -1 /* fence */);
+    ReadbackHelper::compareColorBuffers(expectedColors, bufferData, mGraphicBuffer->getStride(),
+                                        mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(),
+                                        mFormat);
     ASSERT_EQ(0, mGraphicBuffer->unlock());
 }
 
diff --git a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
index bbf8ef3..02d7bdb 100644
--- a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
+++ b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
@@ -78,10 +78,8 @@
                                     PixelFormat format, Dataspace dataspace);
     void setPowerMode_2_2(Display display, IComposerClient::PowerMode mode);
     void setReadbackBuffer(Display display, const native_handle_t* buffer, int32_t releaseFence);
-    void getRequiredReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
-                                             Dataspace* outDataspace);
-    Error getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
-                                      Dataspace* outDataspace);
+    void getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
+                                     Dataspace* outDataspace);
     void getReadbackBufferFence(Display display, int32_t* outFence);
 
     std::vector<ColorMode> getColorModes(Display display);
diff --git a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ReadbackVts.h b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ReadbackVts.h
index 7100297..58efde9 100644
--- a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ReadbackVts.h
+++ b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ReadbackVts.h
@@ -34,8 +34,6 @@
 namespace V2_2 {
 namespace vts {
 
-using android::GraphicBuffer;
-using android::sp;
 using android::hardware::hidl_handle;
 using common::V1_1::BufferUsage;
 using common::V1_1::Dataspace;
@@ -158,13 +156,6 @@
 
     static int32_t GetBytesPerPixel(PixelFormat pixelFormat);
 
-    static void fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                      IComposerClient::Color desiredColor, int* fillFence);
-
-    static void fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                      const std::vector<IComposerClient::Color>& desiredColors,
-                                      int* fillFence);
-
     static void fillBuffer(int32_t width, int32_t height, uint32_t stride, void* bufferData,
                            PixelFormat pixelFormat,
                            std::vector<IComposerClient::Color> desiredPixelColors);
@@ -175,39 +166,40 @@
     static void fillColorsArea(std::vector<IComposerClient::Color>& expectedColors, int32_t stride,
                                IComposerClient::Rect area, IComposerClient::Color color);
 
+    static bool readbackSupported(const PixelFormat& pixelFormat, const Dataspace& dataspace,
+                                  const Error error);
+
     static const std::vector<ColorMode> colorModes;
     static const std::vector<Dataspace> dataspaces;
 
-    static bool readbackSupported(PixelFormat pixelFormat, Dataspace dataspace, Error error);
-    static bool readbackSupported(PixelFormat pixelFormat, Dataspace dataspace);
-
-    static void createReadbackBuffer(uint32_t width, uint32_t height, PixelFormat pixelFormat,
-                                     Dataspace dataspace, sp<GraphicBuffer>* graphicBuffer);
-
-    static void compareColorToBuffer(IComposerClient::Color expectedColors,
-                                     const sp<GraphicBuffer>& graphicBuffer, int32_t fence);
-
-    static void compareColorsToBuffer(std::vector<IComposerClient::Color>& expectedColors,
-                                      const sp<GraphicBuffer>& graphicBuffer, int32_t fence);
+    static void compareColorBuffers(std::vector<IComposerClient::Color>& expectedColors,
+                                    void* bufferData, const uint32_t stride, const uint32_t width,
+                                    const uint32_t height, const PixelFormat pixelFormat);
 };
 
 class ReadbackBuffer {
   public:
-    ReadbackBuffer(Display display, const std::shared_ptr<ComposerClient>& client, uint32_t width,
-                   uint32_t height, PixelFormat pixelFormat);
+    ReadbackBuffer(Display display, const std::shared_ptr<ComposerClient>& client,
+                   const std::shared_ptr<Gralloc>& gralloc, uint32_t width, uint32_t height,
+                   PixelFormat pixelFormat, Dataspace dataspace);
 
     void setReadbackBuffer();
 
     void checkReadbackBuffer(std::vector<IComposerClient::Color> expectedColors);
 
   protected:
-    sp<GraphicBuffer> mGraphicBuffer;
     uint32_t mWidth;
     uint32_t mHeight;
-    PixelFormat mPixelFormat;
     uint32_t mLayerCount;
+    PixelFormat mFormat;
     uint64_t mUsage;
+    AccessRegion mAccessRegion;
+    uint32_t mStride;
+    std::unique_ptr<Gralloc::NativeHandleWrapper> mBufferHandle = nullptr;
+    PixelFormat mPixelFormat;
+    Dataspace mDataspace;
     Display mDisplay;
+    std::shared_ptr<Gralloc> mGralloc;
     std::shared_ptr<ComposerClient> mComposerClient;
 };
 
diff --git a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp
index 5b8ce3f..e2a0f4d 100644
--- a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp
+++ b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2ReadbackTest.cpp
@@ -40,6 +40,7 @@
 namespace {
 
 using android::Rect;
+using common::V1_1::BufferUsage;
 using common::V1_1::Dataspace;
 using common::V1_1::PixelFormat;
 using V2_1::Config;
@@ -99,8 +100,8 @@
 
         mTestRenderEngine->initGraphicBuffer(
                 static_cast<uint32_t>(mDisplayWidth), static_cast<uint32_t>(mDisplayHeight), 1,
-                GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN |
-                        GRALLOC_USAGE_HW_RENDER);
+                static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
+                                      BufferUsage::GPU_RENDER_TARGET));
         mTestRenderEngine->setDisplaySettings(clientCompositionDisplay);
     }
 
@@ -115,22 +116,6 @@
         }
     }
 
-    sp<GraphicBuffer> allocateBuffer(uint32_t width, uint32_t height, uint32_t usage) {
-        const auto& graphicBuffer = sp<GraphicBuffer>::make(
-                width, height, android::PIXEL_FORMAT_RGBA_8888,
-                /*layerCount*/ 1u, usage, "VtsHalGraphicsComposer2_2_ReadbackTest");
-
-        if (graphicBuffer && android::OK == graphicBuffer->initCheck()) {
-            return nullptr;
-        }
-        return graphicBuffer;
-    }
-
-    sp<GraphicBuffer> allocateBuffer(uint32_t usage) {
-        return allocateBuffer(static_cast<uint32_t>(mDisplayWidth),
-                              static_cast<uint32_t>(mDisplayHeight), usage);
-    }
-
     void clearCommandReaderState() {
         mReader->mCompositionChanges.clear();
         mReader->mErrors.clear();
@@ -208,9 +193,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -229,8 +220,8 @@
         std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -264,9 +255,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -275,8 +272,8 @@
 
         mWriter->selectDisplay(mPrimaryDisplay);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
@@ -322,155 +319,6 @@
     }
 }
 
-TEST_P(GraphicsCompositionTest, SetLayerBufferWithSlotsToClear) {
-    Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                               &mDataspace);
-    if (error == Error::UNSUPPORTED) {
-        GTEST_SUCCEED() << "Readback is unsupported";
-        return;
-    }
-    ASSERT_EQ(Error::NONE, error);
-
-    sp<GraphicBuffer> readbackBuffer;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::createReadbackBuffer(
-            mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace, &readbackBuffer));
-    if (readbackBuffer == nullptr) {
-        GTEST_SUCCEED() << "Unsupported readback buffer attributes";
-        return;
-    }
-    // no fence needed for the readback buffer
-    int noFence = -1;
-
-    sp<GraphicBuffer> clearSlotBuffer = allocateBuffer(1u, 1u, GRALLOC_USAGE_HW_COMPOSER);
-    ASSERT_NE(nullptr, clearSlotBuffer);
-
-    // red buffer
-    uint32_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
-    sp<GraphicBuffer> redBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, redBuffer);
-    int redFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(redBuffer, RED, &redFence));
-
-    // blue buffer
-    sp<GraphicBuffer> blueBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, blueBuffer);
-    int blueFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(blueBuffer, BLUE, &blueFence));
-
-    // layer defaults
-    IComposerClient::Rect rectFullDisplay = {0, 0, mDisplayWidth, mDisplayHeight};
-    Layer layer = mComposerClient->createLayer(mPrimaryDisplay, 3);
-    mWriter->selectDisplay(mPrimaryDisplay);
-    mWriter->selectLayer(layer);
-    mWriter->setLayerDisplayFrame(rectFullDisplay);
-    mWriter->setLayerCompositionType(IComposerClient::Composition::DEVICE);
-
-    // set the layer to the blue buffer
-    // should be blue
-    {
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(
-                mPrimaryDisplay, readbackBuffer->handle, noFence));
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 0, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay();
-        execute();
-        ASSERT_TRUE(mReader->mCompositionChanges.empty());
-        ASSERT_TRUE(mReader->mErrors.size());
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->presentDisplay();
-        execute();
-        int32_t fence;
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &fence));
-        ASSERT_NO_FATAL_FAILURE(ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence));
-    }
-
-    // change the layer to the red buffer
-    // should be red
-    {
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(
-                mPrimaryDisplay, readbackBuffer->handle, noFence));
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 1, redBuffer->handle, redFence);
-        mWriter->validateDisplay();
-        execute();
-        ASSERT_TRUE(mReader->mCompositionChanges.empty());
-        ASSERT_TRUE(mReader->mErrors.size());
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->presentDisplay();
-        execute();
-        int32_t fence;
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &fence));
-        ReadbackHelper::compareColorToBuffer(RED, readbackBuffer, fence);
-    }
-
-    // clear the slot for the blue buffer
-    // should still be red
-    {
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(
-                mPrimaryDisplay, readbackBuffer->handle, noFence));
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 0, clearSlotBuffer->handle, /*fence*/ -1);
-        mWriter->validateDisplay();
-        execute();
-        ASSERT_TRUE(mReader->mCompositionChanges.empty());
-        ASSERT_TRUE(mReader->mErrors.size());
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->presentDisplay();
-        execute();
-        int32_t fence;
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &fence));
-        ReadbackHelper::compareColorToBuffer(RED, readbackBuffer, fence);
-    }
-
-    // clear the slot for the red buffer, and set the buffer with the same slot to the blue buffer
-    // should be blue
-    {
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(
-                mPrimaryDisplay, readbackBuffer->handle, noFence));
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 1, clearSlotBuffer->handle, /*fence*/ -1);
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 1, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay();
-        execute();
-        ASSERT_TRUE(mReader->mCompositionChanges.empty());
-        ASSERT_TRUE(mReader->mErrors.size());
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->presentDisplay();
-        execute();
-        int32_t fence;
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &fence));
-        ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence);
-    }
-
-    // clear the slot for the now-blue buffer
-    // should be black (no buffer)
-    // TODO(b/262037933) Ensure we never clear the active buffer's slot with the placeholder buffer
-    // by setting the layer to the color black
-    {
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->setReadbackBuffer(
-                mPrimaryDisplay, readbackBuffer->handle, noFence));
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->selectLayer(layer);
-        mWriter->setLayerBuffer(/*slot*/ 1, clearSlotBuffer->handle, /*fence*/ -1);
-        mWriter->validateDisplay();
-        execute();
-        ASSERT_TRUE(mReader->mCompositionChanges.empty());
-        ASSERT_TRUE(mReader->mErrors.size());
-        mWriter->selectDisplay(mPrimaryDisplay);
-        mWriter->presentDisplay();
-        execute();
-        int32_t fence;
-        ASSERT_NO_FATAL_FAILURE(mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &fence));
-        ReadbackHelper::compareColorToBuffer(BLACK, readbackBuffer, fence);
-    }
-}
-
 TEST_P(GraphicsCompositionTest, SetLayerBufferNoEffect) {
     for (ColorMode mode : mTestColorModes) {
         std::cout << "---Testing Color Mode " << ReadbackHelper::getColorModeString(mode) << "---"
@@ -479,9 +327,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -496,7 +350,8 @@
         layer->write(mWriter);
 
         // This following buffer call should have no effect
-        uint32_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
+        uint64_t usage =
+                static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN);
         NativeHandleWrapper bufferHandle =
                 mGralloc->allocate(mDisplayWidth, mDisplayHeight, 1, PixelFormat::RGBA_8888, usage);
         mWriter->setLayerBuffer(0, bufferHandle.get(), -1);
@@ -505,8 +360,8 @@
         std::vector<IComposerClient::Color> expectedColors(mDisplayWidth * mDisplayHeight);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mWriter->validateDisplay();
@@ -537,11 +392,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        PixelFormat pixelFormat;
-        Dataspace dataspace;
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &pixelFormat,
-                                                                   &dataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(pixelFormat, dataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -569,8 +428,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_EQ(0, mReader->mErrors.size());
@@ -582,8 +441,9 @@
             ASSERT_EQ(1, mReader->mCompositionChanges[0].second);
 
             PixelFormat clientFormat = PixelFormat::RGBA_8888;
-            uint32_t clientUsage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN |
-                                   GRALLOC_USAGE_HW_FB;
+            uint64_t clientUsage = static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN |
+                                                         BufferUsage::CPU_WRITE_OFTEN |
+                                                         BufferUsage::COMPOSER_CLIENT_TARGET);
             Dataspace clientDataspace = ReadbackHelper::getDataspaceForColorMode(mode);
             IComposerClient::Rect damage{0, 0, mDisplayWidth, mDisplayHeight};
 
@@ -650,9 +510,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -665,8 +531,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         auto deviceLayer = std::make_shared<TestBufferLayer>(
@@ -686,8 +552,9 @@
         deviceLayer->write(mWriter);
 
         PixelFormat clientFormat = PixelFormat::RGBA_8888;
-        uint32_t clientUsage =
-                GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_HW_FB;
+        uint64_t clientUsage =
+                static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
+                                      BufferUsage::COMPOSER_CLIENT_TARGET);
         Dataspace clientDataspace = ReadbackHelper::getDataspaceForColorMode(mode);
         int32_t clientWidth = mDisplayWidth;
         int32_t clientHeight = mDisplayHeight / 2;
@@ -766,9 +633,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -792,8 +665,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -845,9 +718,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -863,8 +742,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
 
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
@@ -900,9 +779,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -934,8 +819,8 @@
         // update expected colors to match crop
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, 0, mDisplayWidth, mDisplayHeight}, BLUE);
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_EQ(0, mReader->mErrors.size());
@@ -965,9 +850,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -995,8 +886,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, blueRect, BLUE);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -1128,9 +1019,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -1146,8 +1043,8 @@
         setUpLayers(IComposerClient::BlendMode::NONE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_EQ(0, mReader->mErrors.size());
@@ -1180,9 +1077,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -1199,8 +1102,8 @@
         setUpLayers(IComposerClient::BlendMode::COVERAGE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_EQ(0, mReader->mErrors.size());
@@ -1227,9 +1130,15 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
@@ -1244,8 +1153,8 @@
         setUpLayers(IComposerClient::BlendMode::PREMULTIPLIED);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_EQ(0, mReader->mErrors.size());
@@ -1313,16 +1222,22 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         mLayer->setTransform(Transform::FLIP_H);
         mLayer->setDataspace(ReadbackHelper::getDataspaceForColorMode(mode), mWriter);
@@ -1362,16 +1277,22 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::FLIP_V);
@@ -1411,16 +1332,22 @@
         ASSERT_NO_FATAL_FAILURE(
                 mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
 
-        Error error = mComposerClient->getReadbackBufferAttributes(mPrimaryDisplay, &mPixelFormat,
-                                                                   &mDataspace);
-        mHasReadbackBuffer = ReadbackHelper::readbackSupported(mPixelFormat, mDataspace, error);
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = ReadbackHelper::readbackSupported(tmpPixelFormat,
+                                                                           tmpDataspace, tmpError);
+                    mPixelFormat = tmpPixelFormat;
+                    mDataspace = tmpDataspace;
+                });
+
         if (!mHasReadbackBuffer) {
             std::cout << "Readback not supported or unsupported pixelFormat/dataspace" << std::endl;
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
-                                      mDisplayHeight, mPixelFormat);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGralloc, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::ROT_180);
diff --git a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
index f8fbb04..13ae089 100644
--- a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
+++ b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
@@ -23,7 +23,6 @@
 #include <composer-vts/2.1/TestCommandReader.h>
 #include <composer-vts/2.2/ComposerVts.h>
 #include <gtest/gtest.h>
-#include <hardware/gralloc.h>
 #include <hidl/GtestPrinter.h>
 #include <hidl/ServiceManagement.h>
 #include <mapper-vts/2.0/MapperVts.h>
@@ -36,6 +35,7 @@
 namespace vts {
 namespace {
 
+using common::V1_0::BufferUsage;
 using common::V1_1::ColorMode;
 using common::V1_1::Dataspace;
 using common::V1_1::PixelFormat;
@@ -65,13 +65,17 @@
         mComposerClient->setVsyncEnabled(mPrimaryDisplay, false);
         mComposerCallback->setVsyncAllowed(false);
 
-        Error error = mComposerClient->getReadbackBufferAttributes(
-                mPrimaryDisplay, &mReadbackPixelFormat, &mReadbackDataspace);
-        mHasReadbackBuffer = error == Error::NONE;
-        if (mHasReadbackBuffer) {
-            ASSERT_LT(static_cast<PixelFormat>(0), mReadbackPixelFormat);
-            ASSERT_NE(Dataspace::UNKNOWN, mReadbackDataspace);
-        }
+        mComposerClient->getRaw()->getReadbackBufferAttributes(
+                mPrimaryDisplay,
+                [&](const auto& tmpError, const auto& tmpPixelFormat, const auto& tmpDataspace) {
+                    mHasReadbackBuffer = tmpError == Error::NONE;
+                    if (mHasReadbackBuffer) {
+                        mReadbackPixelFormat = tmpPixelFormat;
+                        mReadbackDataspace = tmpDataspace;
+                        ASSERT_LT(static_cast<PixelFormat>(0), mReadbackPixelFormat);
+                        ASSERT_NE(Dataspace::UNKNOWN, mReadbackDataspace);
+                    }
+                });
 
         mInvalidDisplayId = GetInvalidDisplayId();
     }
@@ -149,9 +153,10 @@
     }
 
     NativeHandleWrapper allocate() {
+        uint64_t usage =
+                static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN);
         return mGralloc->allocate(/*width*/ 64, /*height*/ 64, /*layerCount*/ 1,
-                                  PixelFormat::RGBA_8888,
-                                  GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN);
+                                  PixelFormat::RGBA_8888, usage);
     }
 
     void execute() { mComposerClient->execute(mReader.get(), mWriter.get()); }
@@ -429,7 +434,9 @@
     }
 
     // BufferUsage::COMPOSER_OUTPUT is missing
-    uint64_t usage = GRALLOC_USAGE_HW_COMPOSER | GRALLOC_USAGE_SW_READ_OFTEN;
+    uint64_t usage =
+            static_cast<uint64_t>(BufferUsage::COMPOSER_OVERLAY | BufferUsage::CPU_READ_OFTEN);
+
     std::unique_ptr<Gralloc> gralloc;
     std::unique_ptr<NativeHandleWrapper> buffer;
     ASSERT_NO_FATAL_FAILURE(gralloc = std::make_unique<Gralloc>());
@@ -450,7 +457,9 @@
         return;
     }
 
-    uint64_t usage = GRALLOC_USAGE_HW_COMPOSER | GRALLOC_USAGE_SW_READ_OFTEN;
+    uint64_t usage =
+            static_cast<uint64_t>(BufferUsage::COMPOSER_OVERLAY | BufferUsage::CPU_READ_OFTEN);
+
     std::unique_ptr<Gralloc> gralloc;
     std::unique_ptr<NativeHandleWrapper> buffer;
     ASSERT_NO_FATAL_FAILURE(gralloc = std::make_unique<Gralloc>());
@@ -702,4 +711,4 @@
     }
 
     return RUN_ALL_TESTS();
-}
\ No newline at end of file
+}
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
index b89f7d5..6e844ef 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/Capability.aidl
@@ -38,6 +38,10 @@
   SIDEBAND_STREAM = 1,
   SKIP_CLIENT_COLOR_TRANSFORM = 2,
   PRESENT_FENCE_IS_NOT_RELIABLE = 3,
+  /**
+   * @deprecated - enabled by default.
+   */
   SKIP_VALIDATE = 4,
   BOOT_DISPLAY_CONFIG = 5,
+  HDR_OUTPUT_CONVERSION_CONFIG = 6,
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayRequest.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayRequest.aidl
index 13462ce..00598eb 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayRequest.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/DisplayRequest.aidl
@@ -37,12 +37,12 @@
   long display;
   int mask;
   android.hardware.graphics.composer3.DisplayRequest.LayerRequest[] layerRequests;
-  const int FLIP_CLIENT_TARGET = 1;
-  const int WRITE_CLIENT_TARGET_TO_OUTPUT = 2;
+  const int FLIP_CLIENT_TARGET = (1 << 0);
+  const int WRITE_CLIENT_TARGET_TO_OUTPUT = (1 << 1);
   @VintfStability
   parcelable LayerRequest {
     long layer;
     int mask;
-    const int CLEAR_CLIENT_TARGET = 1;
+    const int CLEAR_CLIENT_TARGET = (1 << 0);
   }
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/FormatColorComponent.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/FormatColorComponent.aidl
index 4b737de..1990350 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/FormatColorComponent.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/FormatColorComponent.aidl
@@ -34,8 +34,8 @@
 package android.hardware.graphics.composer3;
 @Backing(type="byte") @VintfStability
 enum FormatColorComponent {
-  FORMAT_COMPONENT_0 = 1,
-  FORMAT_COMPONENT_1 = 2,
-  FORMAT_COMPONENT_2 = 4,
-  FORMAT_COMPONENT_3 = 8,
+  FORMAT_COMPONENT_0 = (1 << 0),
+  FORMAT_COMPONENT_1 = (1 << 1),
+  FORMAT_COMPONENT_2 = (1 << 2),
+  FORMAT_COMPONENT_3 = (1 << 3),
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
index a7e6535..10ce067 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -76,6 +76,8 @@
   void setVsyncEnabled(long display, boolean enabled);
   void setIdleTimerEnabled(long display, int timeoutMs);
   android.hardware.graphics.composer3.OverlayProperties getOverlaySupport();
+  android.hardware.graphics.common.HdrConversionCapability[] getHdrConversionCapabilities();
+  void setHdrConversionStrategy(in android.hardware.graphics.common.HdrConversionStrategy conversionStrategy);
   const int EX_BAD_CONFIG = 1;
   const int EX_BAD_DISPLAY = 2;
   const int EX_BAD_LAYER = 3;
@@ -86,5 +88,5 @@
   const int EX_UNSUPPORTED = 8;
   const int EX_SEAMLESS_NOT_ALLOWED = 9;
   const int EX_SEAMLESS_NOT_POSSIBLE = 10;
-  const int INVALID_CONFIGURATION = 2147483647;
+  const int INVALID_CONFIGURATION = 0x7fffffff;
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/OverlayProperties.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/OverlayProperties.aidl
index 3db134e..7d31ea3 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/OverlayProperties.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/OverlayProperties.aidl
@@ -38,6 +38,8 @@
   boolean supportMixedColorSpaces;
   parcelable SupportedBufferCombinations {
     android.hardware.graphics.common.PixelFormat[] pixelFormats;
-    android.hardware.graphics.common.Dataspace[] dataspaces;
+    android.hardware.graphics.common.Dataspace[] standards;
+    android.hardware.graphics.common.Dataspace[] transfers;
+    android.hardware.graphics.common.Dataspace[] ranges;
   }
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PerFrameMetadataKey.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PerFrameMetadataKey.aidl
index 8722f87..10a7dee 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PerFrameMetadataKey.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PerFrameMetadataKey.aidl
@@ -34,17 +34,17 @@
 package android.hardware.graphics.composer3;
 @Backing(type="int") @VintfStability
 enum PerFrameMetadataKey {
-  DISPLAY_RED_PRIMARY_X = 0,
-  DISPLAY_RED_PRIMARY_Y = 1,
-  DISPLAY_GREEN_PRIMARY_X = 2,
-  DISPLAY_GREEN_PRIMARY_Y = 3,
-  DISPLAY_BLUE_PRIMARY_X = 4,
-  DISPLAY_BLUE_PRIMARY_Y = 5,
-  WHITE_POINT_X = 6,
-  WHITE_POINT_Y = 7,
-  MAX_LUMINANCE = 8,
-  MIN_LUMINANCE = 9,
-  MAX_CONTENT_LIGHT_LEVEL = 10,
-  MAX_FRAME_AVERAGE_LIGHT_LEVEL = 11,
-  HDR10_PLUS_SEI = 12,
+  DISPLAY_RED_PRIMARY_X,
+  DISPLAY_RED_PRIMARY_Y,
+  DISPLAY_GREEN_PRIMARY_X,
+  DISPLAY_GREEN_PRIMARY_Y,
+  DISPLAY_BLUE_PRIMARY_X,
+  DISPLAY_BLUE_PRIMARY_Y,
+  WHITE_POINT_X,
+  WHITE_POINT_Y,
+  MAX_LUMINANCE,
+  MIN_LUMINANCE,
+  MAX_CONTENT_LIGHT_LEVEL,
+  MAX_FRAME_AVERAGE_LIGHT_LEVEL,
+  HDR10_PLUS_SEI,
 }
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PresentOrValidate.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PresentOrValidate.aidl
index e6ddeba..dbfac22 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PresentOrValidate.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/PresentOrValidate.aidl
@@ -38,7 +38,7 @@
   android.hardware.graphics.composer3.PresentOrValidate.Result result;
   @VintfStability
   enum Result {
-    Validated = 0,
-    Presented = 1,
+    Validated,
+    Presented,
   }
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
index 2f9eab9..509a8f4 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/Capability.aidl
@@ -55,6 +55,7 @@
      * For this capability to be worthwhile the device implementation of
      * presentDisplay should fail as fast as possible in the case a
      * validateDisplay step is needed.
+     * @deprecated - enabled by default.
      */
     SKIP_VALIDATE = 4,
 
@@ -66,4 +67,12 @@
      * @see IComposerClient.getPreferredBootDisplayConfig
      */
     BOOT_DISPLAY_CONFIG = 5,
+
+    /**
+     * Specifies that the device supports HDR output conversion.
+     *
+     * @see IComposerClient.getHdrConversionCapabilities
+     * @see IComposerClient.setHdrConversionStrategy
+     */
+    HDR_OUTPUT_CONVERSION_CONFIG = 6,
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
index 88bb3a4..8091491 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -17,6 +17,8 @@
 package android.hardware.graphics.composer3;
 
 import android.hardware.graphics.common.DisplayDecorationSupport;
+import android.hardware.graphics.common.HdrConversionCapability;
+import android.hardware.graphics.common.HdrConversionStrategy;
 import android.hardware.graphics.common.Transform;
 import android.hardware.graphics.composer3.ClientTargetProperty;
 import android.hardware.graphics.composer3.ColorMode;
@@ -825,4 +827,25 @@
      * @return the overlay properties of the device.
      */
     OverlayProperties getOverlaySupport();
+
+    /**
+     * Returns the array of HDR conversion capability. Each HdrConversionCapability depicts that
+     * HDR conversion is possible from sourceType to outputType. This doesn't change after
+     * initialization.
+     *
+     * @exception EX_UNSUPPORTED when not supported by the underlying HAL
+     *
+     * @see setHdrConversionStrategy
+     */
+    HdrConversionCapability[] getHdrConversionCapabilities();
+
+    /**
+     * Sets the of HDR conversion strategy.
+     *
+     *
+     * @exception EX_UNSUPPORTED when not supported by the underlying HAL
+     *
+     * @see getHdrConversionCapabilities
+     */
+    void setHdrConversionStrategy(in HdrConversionStrategy conversionStrategy);
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/OverlayProperties.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/OverlayProperties.aidl
index 32688e2..c25eea4 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/OverlayProperties.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/OverlayProperties.aidl
@@ -19,16 +19,24 @@
 @VintfStability
 parcelable OverlayProperties {
     parcelable SupportedBufferCombinations {
-        // List of pixelformats and dataspaces that can be used together.
-        // All pixelformats and dataspaces stored inside are valid combinations.
+        // List of pixelformats, standards, transfers and ranges dataspaces that can be used
+        // together.
+        // The pixelformats, standards, transfers and ranges stored inside are valid
+        // combinations.
+        // Dataspace identifies three components of colors - standard, transfer and
+        // range.
         android.hardware.graphics.common.PixelFormat[] pixelFormats;
-        android.hardware.graphics.common.Dataspace[] dataspaces;
+        android.hardware.graphics.common.Dataspace[] standards;
+        android.hardware.graphics.common.Dataspace[] transfers;
+        android.hardware.graphics.common.Dataspace[] ranges;
     }
-    // Array of all valid pixelformat and dataspace combinations.
-    // If all supported formats work with all supported dataspaces,
+    // Array of all valid pixelformat, standard, transfer and range combinations.
+    // If all supported formats work with all standards, transfers and ranges,
     // then this list may only have 1 entry.
-    // If some dataspaces, e.g. scRGB, only work with specific formats,
-    // then this list may contain more than 1 entry.
+    // If some dataspaces, e.g. scRGB (STANDARD_BT709 | TRANSFER_SRGB | RANGE_EXTENDED),
+    // only work with specific formats, then this list may contain more than 1 entry.
+    // If some ranges, e.g. RANGE_LIMITED, only work with specific
+    // formats/standards/transfers, then this list may contain more than 1 entry.
     SupportedBufferCombinations[] combinations;
 
     // True if the DPU is able to color manage at least two overlays
diff --git a/graphics/composer/aidl/vts/ReadbackVts.cpp b/graphics/composer/aidl/vts/ReadbackVts.cpp
index b59793f..abb58e2 100644
--- a/graphics/composer/aidl/vts/ReadbackVts.cpp
+++ b/graphics/composer/aidl/vts/ReadbackVts.cpp
@@ -20,8 +20,6 @@
 #include "renderengine/ExternalTexture.h"
 #include "renderengine/impl/ExternalTexture.h"
 
-using ::android::status_t;
-
 namespace aidl::android::hardware::graphics::composer3::vts {
 
 const std::vector<ColorMode> ReadbackHelper::colorModes = {ColorMode::SRGB, ColorMode::DISPLAY_P3};
@@ -29,9 +27,6 @@
                                                            common::Dataspace::DISPLAY_P3};
 
 void TestLayer::write(ComposerClientWriter& writer) {
-    ::android::status_t status = ::android::OK;
-    ASSERT_EQ(::android::OK, status);
-
     writer.setLayerDisplayFrame(mDisplay, mLayer, mDisplayFrame);
     writer.setLayerSourceCrop(mDisplay, mLayer, mSourceCrop);
     writer.setLayerZOrder(mDisplay, mLayer, mZOrder);
@@ -42,40 +37,6 @@
     writer.setLayerBrightness(mDisplay, mLayer, mBrightness);
 }
 
-bool ReadbackHelper::readbackSupported(const common::PixelFormat& pixelFormat,
-                                       const common::Dataspace& dataspace) {
-    // TODO: add support for RGBA_1010102
-    if (pixelFormat != common::PixelFormat::RGB_888 &&
-        pixelFormat != common::PixelFormat::RGBA_8888) {
-        return false;
-    }
-    if (std::find(dataspaces.begin(), dataspaces.end(), dataspace) == dataspaces.end()) {
-        return false;
-    }
-    return true;
-}
-
-void ReadbackHelper::createReadbackBuffer(ReadbackBufferAttributes readbackBufferAttributes,
-                                          const VtsDisplay& display,
-                                          sp<GraphicBuffer>* graphicBuffer) {
-    ASSERT_NE(nullptr, graphicBuffer);
-    if (!readbackSupported(readbackBufferAttributes.format, readbackBufferAttributes.dataspace)) {
-        *graphicBuffer = nullptr;
-    }
-    uint64_t usage =
-            static_cast<uint64_t>(static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
-                                  static_cast<uint64_t>(common::BufferUsage::GPU_TEXTURE));
-
-    uint32_t layerCount = 1;
-    *graphicBuffer = sp<GraphicBuffer>::make(
-            static_cast<uint32_t>(display.getDisplayWidth()),
-            static_cast<uint32_t>(display.getDisplayHeight()),
-            static_cast<::android::PixelFormat>(readbackBufferAttributes.format), layerCount, usage,
-            "ReadbackBuffer");
-    ASSERT_NE(nullptr, *graphicBuffer);
-    ASSERT_EQ(::android::OK, (*graphicBuffer)->initCheck());
-}
-
 std::string ReadbackHelper::getColorModeString(ColorMode mode) {
     switch (mode) {
         case ColorMode::SRGB:
@@ -142,11 +103,11 @@
     return layerSettings;
 }
 
-int32_t ReadbackHelper::GetBytesPerPixel(PixelFormat pixelFormat) {
+int32_t ReadbackHelper::GetBytesPerPixel(common::PixelFormat pixelFormat) {
     switch (pixelFormat) {
-        case PixelFormat::RGBA_8888:
+        case common::PixelFormat::RGBA_8888:
             return 4;
-        case PixelFormat::RGB_888:
+        case common::PixelFormat::RGB_888:
             return 3;
         default:
             return -1;
@@ -155,161 +116,136 @@
 
 void ReadbackHelper::fillBuffer(uint32_t width, uint32_t height, uint32_t stride, void* bufferData,
                                 common::PixelFormat pixelFormat,
-                                const std::vector<Color>& desiredColors) {
+                                std::vector<Color> desiredPixelColors) {
     ASSERT_TRUE(pixelFormat == common::PixelFormat::RGB_888 ||
                 pixelFormat == common::PixelFormat::RGBA_8888);
     int32_t bytesPerPixel = GetBytesPerPixel(pixelFormat);
     ASSERT_NE(-1, bytesPerPixel);
     for (int row = 0; row < height; row++) {
         for (int col = 0; col < width; col++) {
-            int pixel = row * static_cast<int32_t>(width) + col;
-            Color desiredColor = desiredColors[static_cast<size_t>(pixel)];
+            auto pixel = row * static_cast<int32_t>(width) + col;
+            Color srcColor = desiredPixelColors[static_cast<size_t>(pixel)];
 
             int offset = (row * static_cast<int32_t>(stride) + col) * bytesPerPixel;
             uint8_t* pixelColor = (uint8_t*)bufferData + offset;
-            pixelColor[0] = static_cast<uint8_t>(std::round(255.0f * desiredColor.r));
-            pixelColor[1] = static_cast<uint8_t>(std::round(255.0f * desiredColor.g));
-            pixelColor[2] = static_cast<uint8_t>(std::round(255.0f * desiredColor.b));
+            pixelColor[0] = static_cast<uint8_t>(std::round(255.0f * srcColor.r));
+            pixelColor[1] = static_cast<uint8_t>(std::round(255.0f * srcColor.g));
+            pixelColor[2] = static_cast<uint8_t>(std::round(255.0f * srcColor.b));
 
             if (bytesPerPixel == 4) {
-                pixelColor[3] = static_cast<uint8_t>(std::round(255.0f * desiredColor.a));
+                pixelColor[3] = static_cast<uint8_t>(std::round(255.0f * srcColor.a));
             }
         }
     }
 }
 
-void ReadbackHelper::clearColors(std::vector<Color>& colors, int32_t width, int32_t height,
+void ReadbackHelper::clearColors(std::vector<Color>& expectedColors, int32_t width, int32_t height,
                                  int32_t displayWidth) {
     for (int row = 0; row < height; row++) {
         for (int col = 0; col < width; col++) {
             int pixel = row * displayWidth + col;
-            colors[static_cast<size_t>(pixel)] = BLACK;
+            expectedColors[static_cast<size_t>(pixel)] = BLACK;
         }
     }
 }
 
-void ReadbackHelper::fillColorsArea(std::vector<Color>& colors, int32_t stride, Rect area,
-                                    Color desiredColor) {
+void ReadbackHelper::fillColorsArea(std::vector<Color>& expectedColors, int32_t stride, Rect area,
+                                    Color color) {
     for (int row = area.top; row < area.bottom; row++) {
         for (int col = area.left; col < area.right; col++) {
             int pixel = row * stride + col;
-            colors[static_cast<size_t>(pixel)] = desiredColor;
+            expectedColors[static_cast<size_t>(pixel)] = color;
         }
     }
 }
 
-void ReadbackHelper::fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                           Color desiredColor, int* fillFence) {
-    ASSERT_NE(nullptr, fillFence);
-    std::vector<Color> desiredColors(
-            static_cast<size_t>(graphicBuffer->getWidth() * graphicBuffer->getHeight()));
-    ::android::Rect bounds = graphicBuffer->getBounds();
-    fillColorsArea(desiredColors, static_cast<int32_t>(graphicBuffer->getWidth()),
-                   {bounds.left, bounds.top, bounds.right, bounds.bottom}, desiredColor);
-    ASSERT_NO_FATAL_FAILURE(fillBufferAndGetFence(graphicBuffer, desiredColors, fillFence));
-}
-
-void ReadbackHelper::fillBufferAndGetFence(const sp<GraphicBuffer>& graphicBuffer,
-                                           const std::vector<Color>& desiredColors,
-                                           int* fillFence) {
-    ASSERT_TRUE(graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGB_888 ||
-                graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGBA_8888);
-    void* bufData;
-    int32_t bytesPerPixel = -1;
-    int32_t bytesPerStride = -1;
-    status_t status =
-            graphicBuffer->lock(GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_OFTEN,
-                                &bufData, &bytesPerPixel, &bytesPerStride);
-    ASSERT_EQ(::android::OK, status);
-
-    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
-                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
-                                    : graphicBuffer->getStride();
-    ReadbackHelper::fillBuffer(
-            graphicBuffer->getWidth(), graphicBuffer->getHeight(), stride, bufData,
-            static_cast<common::PixelFormat>(graphicBuffer->getPixelFormat()), desiredColors);
-    status = graphicBuffer->unlockAsync(fillFence);
-    ASSERT_EQ(::android::OK, status);
-}
-
-void ReadbackHelper::compareColorToBuffer(Color expectedColor,
-                                          const sp<GraphicBuffer>& graphicBuffer,
-                                          const ndk::ScopedFileDescriptor& fence) {
-    std::vector<Color> expectedColors(
-            static_cast<size_t>(graphicBuffer->getWidth() * graphicBuffer->getHeight()));
-    ::android::Rect bounds = graphicBuffer->getBounds();
-    fillColorsArea(expectedColors, static_cast<int32_t>(graphicBuffer->getWidth()),
-                   {bounds.left, bounds.top, bounds.right, bounds.bottom}, expectedColor);
-    compareColorsToBuffer(expectedColors, graphicBuffer, fence);
-}
-
-void ReadbackHelper::compareColorsToBuffer(const std::vector<Color>& expectedColors,
-                                           const sp<GraphicBuffer>& graphicBuffer,
-                                           const ndk::ScopedFileDescriptor& fence) {
-    ASSERT_TRUE(graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGB_888 ||
-                graphicBuffer->getPixelFormat() == ::android::PIXEL_FORMAT_RGBA_8888);
-
-    int bytesPerPixel = -1;
-    int bytesPerStride = -1;
-    void* bufData = nullptr;
-    status_t status = graphicBuffer->lockAsync(GRALLOC_USAGE_SW_READ_OFTEN, &bufData,
-                                               dup(fence.get()), &bytesPerPixel, &bytesPerStride);
-    ASSERT_EQ(::android::OK, status);
-
-    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
-                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
-                                    : graphicBuffer->getStride();
-
-    if (bytesPerPixel == -1) {
-        bytesPerPixel = ReadbackHelper::GetBytesPerPixel(
-                static_cast<PixelFormat>(graphicBuffer->getPixelFormat()));
+bool ReadbackHelper::readbackSupported(const common::PixelFormat& pixelFormat,
+                                       const common::Dataspace& dataspace) {
+    if (pixelFormat != common::PixelFormat::RGB_888 &&
+        pixelFormat != common::PixelFormat::RGBA_8888) {
+        return false;
     }
+    if (std::find(dataspaces.begin(), dataspaces.end(), dataspace) == dataspaces.end()) {
+        return false;
+    }
+    return true;
+}
+
+void ReadbackHelper::compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                         const uint32_t stride, const uint32_t width,
+                                         const uint32_t height, common::PixelFormat pixelFormat) {
+    const int32_t bytesPerPixel = ReadbackHelper::GetBytesPerPixel(pixelFormat);
     ASSERT_NE(-1, bytesPerPixel);
-    for (int row = 0; row < graphicBuffer->getHeight(); row++) {
-        for (int col = 0; col < graphicBuffer->getWidth(); col++) {
-            int pixel = row * static_cast<int32_t>(graphicBuffer->getWidth()) + col;
+    for (int row = 0; row < height; row++) {
+        for (int col = 0; col < width; col++) {
+            auto pixel = row * static_cast<int32_t>(width) + col;
             int offset = (row * static_cast<int32_t>(stride) + col) * bytesPerPixel;
-            uint8_t* pixelColor = (uint8_t*)bufData + offset;
+            uint8_t* pixelColor = (uint8_t*)bufferData + offset;
             const Color expectedColor = expectedColors[static_cast<size_t>(pixel)];
             ASSERT_EQ(std::round(255.0f * expectedColor.r), pixelColor[0]);
             ASSERT_EQ(std::round(255.0f * expectedColor.g), pixelColor[1]);
             ASSERT_EQ(std::round(255.0f * expectedColor.b), pixelColor[2]);
         }
     }
-
-    status = graphicBuffer->unlock();
-    ASSERT_EQ(::android::OK, status);
 }
 
 ReadbackBuffer::ReadbackBuffer(int64_t display, const std::shared_ptr<VtsComposerClient>& client,
-                               int32_t width, int32_t height, common::PixelFormat pixelFormat)
+                               int32_t width, int32_t height, common::PixelFormat pixelFormat,
+                               common::Dataspace dataspace)
     : mComposerClient(client) {
     mDisplay = display;
+
+    mPixelFormat = pixelFormat;
+    mDataspace = dataspace;
+
     mWidth = static_cast<uint32_t>(width);
     mHeight = static_cast<uint32_t>(height);
-    mPixelFormat = pixelFormat;
     mLayerCount = 1;
     mUsage = static_cast<uint64_t>(static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
                                    static_cast<uint64_t>(common::BufferUsage::GPU_TEXTURE));
+
+    mAccessRegion.top = 0;
+    mAccessRegion.left = 0;
+    mAccessRegion.right = static_cast<int32_t>(width);
+    mAccessRegion.bottom = static_cast<int32_t>(height);
+}
+
+::android::sp<::android::GraphicBuffer> ReadbackBuffer::allocateBuffer() {
+    return ::android::sp<::android::GraphicBuffer>::make(
+            mWidth, mHeight, static_cast<::android::PixelFormat>(mPixelFormat), mLayerCount, mUsage,
+            "ReadbackBuffer");
 }
 
 void ReadbackBuffer::setReadbackBuffer() {
-    mGraphicBuffer = sp<GraphicBuffer>::make(mWidth, mHeight,
-                                             static_cast<::android::PixelFormat>(mPixelFormat),
-                                             mLayerCount, mUsage, "ReadbackBuffer");
+    mGraphicBuffer = allocateBuffer();
     ASSERT_NE(nullptr, mGraphicBuffer);
     ASSERT_EQ(::android::OK, mGraphicBuffer->initCheck());
-    ::ndk::ScopedFileDescriptor noFence = ::ndk::ScopedFileDescriptor(-1);
-    const auto& status =
-            mComposerClient->setReadbackBuffer(mDisplay, mGraphicBuffer->handle, noFence);
-    ASSERT_TRUE(status.isOk());
+    const auto& bufferHandle = mGraphicBuffer->handle;
+    ::ndk::ScopedFileDescriptor fence = ::ndk::ScopedFileDescriptor(-1);
+    EXPECT_TRUE(mComposerClient->setReadbackBuffer(mDisplay, bufferHandle, fence).isOk());
 }
 
 void ReadbackBuffer::checkReadbackBuffer(const std::vector<Color>& expectedColors) {
+    ASSERT_NE(nullptr, mGraphicBuffer);
     // lock buffer for reading
     const auto& [fenceStatus, bufferFence] = mComposerClient->getReadbackBufferFence(mDisplay);
-    ASSERT_TRUE(fenceStatus.isOk());
-    ReadbackHelper::compareColorsToBuffer(expectedColors, mGraphicBuffer, bufferFence);
+    EXPECT_TRUE(fenceStatus.isOk());
+
+    int bytesPerPixel = -1;
+    int bytesPerStride = -1;
+    void* bufData = nullptr;
+
+    auto status = mGraphicBuffer->lockAsync(mUsage, mAccessRegion, &bufData, dup(bufferFence.get()),
+                                            &bytesPerPixel, &bytesPerStride);
+    EXPECT_EQ(::android::OK, status);
+    ASSERT_TRUE(mPixelFormat == PixelFormat::RGB_888 || mPixelFormat == PixelFormat::RGBA_8888);
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufData, stride, mWidth, mHeight,
+                                        mPixelFormat);
+    status = mGraphicBuffer->unlock();
+    EXPECT_EQ(::android::OK, status);
 }
 
 void TestColorLayer::write(ComposerClientWriter& writer) {
@@ -387,8 +323,9 @@
     const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
                                     ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
                                     : mGraphicBuffer->getStride();
-    ASSERT_EQ(::android::OK, status);
-    ReadbackHelper::fillBuffer(mWidth, mHeight, stride, bufData, mPixelFormat, expectedColors);
+    EXPECT_EQ(::android::OK, status);
+    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBuffer(mWidth, mHeight, stride, bufData,
+                                                       mPixelFormat, expectedColors));
 
     const auto unlockStatus = mGraphicBuffer->unlockAsync(&mFillFence);
     ASSERT_EQ(::android::OK, unlockStatus);
@@ -398,13 +335,13 @@
     mGraphicBuffer = allocateBuffer();
     ASSERT_NE(nullptr, mGraphicBuffer);
     ASSERT_EQ(::android::OK, mGraphicBuffer->initCheck());
-    fillBuffer(colors);
+    ASSERT_NO_FATAL_FAILURE(fillBuffer(colors));
 }
 
-sp<GraphicBuffer> TestBufferLayer::allocateBuffer() {
-    return sp<GraphicBuffer>::make(mWidth, mHeight,
-                                   static_cast<::android::PixelFormat>(mPixelFormat), mLayerCount,
-                                   mUsage, "TestBufferLayer");
+::android::sp<::android::GraphicBuffer> TestBufferLayer::allocateBuffer() {
+    return ::android::sp<::android::GraphicBuffer>::make(
+            mWidth, mHeight, static_cast<::android::PixelFormat>(mPixelFormat), mLayerCount, mUsage,
+            "TestBufferLayer");
 }
 
 void TestBufferLayer::setDataspace(common::Dataspace dataspace, ComposerClientWriter& writer) {
diff --git a/graphics/composer/aidl/vts/ReadbackVts.h b/graphics/composer/aidl/vts/ReadbackVts.h
index ecf0d52..ee9f0d5 100644
--- a/graphics/composer/aidl/vts/ReadbackVts.h
+++ b/graphics/composer/aidl/vts/ReadbackVts.h
@@ -33,8 +33,6 @@
 using common::Dataspace;
 using common::PixelFormat;
 using IMapper2_1 = ::android::hardware::graphics::mapper::V2_1::IMapper;
-using ::android::GraphicBuffer;
-using ::android::sp;
 
 static const Color BLACK = {0.0f, 0.0f, 0.0f, 1.0f};
 static const Color RED = {1.0f, 0.0f, 0.0f, 1.0f};
@@ -148,7 +146,7 @@
 
   protected:
     Composition mComposition;
-    sp<GraphicBuffer> mGraphicBuffer;
+    ::android::sp<::android::GraphicBuffer> mGraphicBuffer;
     TestRenderEngine& mRenderEngine;
     int32_t mFillFence;
     uint32_t mWidth;
@@ -164,11 +162,6 @@
 
 class ReadbackHelper {
   public:
-    static bool readbackSupported(const PixelFormat& pixelFormat, const Dataspace& dataspace);
-
-    static void createReadbackBuffer(ReadbackBufferAttributes readbackBufferAttributes,
-                                     const VtsDisplay& display, sp<GraphicBuffer>* graphicBuffer);
-
     static std::string getColorModeString(ColorMode mode);
 
     static std::string getDataspaceString(Dataspace dataspace);
@@ -178,36 +171,28 @@
     static int32_t GetBytesPerPixel(PixelFormat pixelFormat);
 
     static void fillBuffer(uint32_t width, uint32_t height, uint32_t stride, void* bufferData,
-                           PixelFormat pixelFormat, const std::vector<Color>& desriedColors);
+                           PixelFormat pixelFormat, std::vector<Color> desiredPixelColors);
 
-    static void clearColors(std::vector<Color>& colors, int32_t width, int32_t height,
+    static void clearColors(std::vector<Color>& expectedColors, int32_t width, int32_t height,
                             int32_t displayWidth);
 
-    static void fillColorsArea(std::vector<Color>& colors, int32_t stride, Rect area,
-                               Color desiredColor);
+    static void fillColorsArea(std::vector<Color>& expectedColors, int32_t stride, Rect area,
+                               Color color);
 
-    static void fillBufferAndGetFence(const sp<GraphicBuffer>& buffer, Color desiredColor,
-                                      int* fillFence);
-
-    static void fillBufferAndGetFence(const sp<GraphicBuffer>& buffer,
-                                      const std::vector<Color>& desiredColors, int* fillFence);
-
-    static void compareColorToBuffer(
-            Color expectedColor, const sp<GraphicBuffer>& graphicBuffer,
-            const ndk::ScopedFileDescriptor& fence = ::ndk::ScopedFileDescriptor(-1));
-
-    static void compareColorsToBuffer(
-            const std::vector<Color>& expectedColors, const sp<GraphicBuffer>& graphicBuffer,
-            const ndk::ScopedFileDescriptor& fence = ::ndk::ScopedFileDescriptor(-1));
+    static bool readbackSupported(const PixelFormat& pixelFormat, const Dataspace& dataspace);
 
     static const std::vector<ColorMode> colorModes;
     static const std::vector<Dataspace> dataspaces;
+
+    static void compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                    const uint32_t stride, const uint32_t width,
+                                    const uint32_t height, PixelFormat pixelFormat);
 };
 
 class ReadbackBuffer {
   public:
     ReadbackBuffer(int64_t display, const std::shared_ptr<VtsComposerClient>& client, int32_t width,
-                   int32_t height, common::PixelFormat pixelFormat);
+                   int32_t height, common::PixelFormat pixelFormat, common::Dataspace dataspace);
 
     void setReadbackBuffer();
 
@@ -216,12 +201,18 @@
   protected:
     uint32_t mWidth;
     uint32_t mHeight;
-    PixelFormat mPixelFormat;
     uint32_t mLayerCount;
     uint32_t mUsage;
+    PixelFormat mPixelFormat;
+    Dataspace mDataspace;
     int64_t mDisplay;
-    sp<GraphicBuffer> mGraphicBuffer;
+    ::android::sp<::android::GraphicBuffer> mGraphicBuffer;
     std::shared_ptr<VtsComposerClient> mComposerClient;
+    ::android::Rect mAccessRegion;
+    native_handle_t mBufferHandle;
+
+  private:
+    ::android::sp<::android::GraphicBuffer> allocateBuffer();
 };
 
 }  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/vts/RenderEngineVts.cpp b/graphics/composer/aidl/vts/RenderEngineVts.cpp
index b84d0d0..66779c8 100644
--- a/graphics/composer/aidl/vts/RenderEngineVts.cpp
+++ b/graphics/composer/aidl/vts/RenderEngineVts.cpp
@@ -76,7 +76,18 @@
 }
 
 void TestRenderEngine::checkColorBuffer(const std::vector<Color>& expectedColors) {
-    ReadbackHelper::compareColorsToBuffer(expectedColors, mGraphicBuffer);
+    void* bufferData;
+    int32_t bytesPerPixel = -1;
+    int32_t bytesPerStride = -1;
+    ASSERT_EQ(0, mGraphicBuffer->lock(static_cast<uint32_t>(mGraphicBuffer->getUsage()),
+                                      &bufferData, &bytesPerPixel, &bytesPerStride));
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufferData, stride,
+                                        mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(),
+                                        mFormat);
+    ASSERT_EQ(::android::OK, mGraphicBuffer->unlock());
 }
 
 }  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/vts/VtsComposerClient.cpp b/graphics/composer/aidl/vts/VtsComposerClient.cpp
index 43f4b84..f95e747 100644
--- a/graphics/composer/aidl/vts/VtsComposerClient.cpp
+++ b/graphics/composer/aidl/vts/VtsComposerClient.cpp
@@ -337,6 +337,18 @@
     return {mComposerClient->getPreferredBootDisplayConfig(display, &outConfig), outConfig};
 }
 
+std::pair<ScopedAStatus, std::vector<common::HdrConversionCapability>>
+VtsComposerClient::getHdrConversionCapabilities() {
+    std::vector<common::HdrConversionCapability> hdrConversionCapability;
+    return {mComposerClient->getHdrConversionCapabilities(&hdrConversionCapability),
+            hdrConversionCapability};
+}
+
+ScopedAStatus VtsComposerClient::setHdrConversionStrategy(
+        const common::HdrConversionStrategy& conversionStrategy) {
+    return mComposerClient->setHdrConversionStrategy(conversionStrategy);
+}
+
 std::pair<ScopedAStatus, common::Transform> VtsComposerClient::getDisplayPhysicalOrientation(
         int64_t display) {
     common::Transform outDisplayOrientation;
diff --git a/graphics/composer/aidl/vts/VtsComposerClient.h b/graphics/composer/aidl/vts/VtsComposerClient.h
index c4bc464..27788e7 100644
--- a/graphics/composer/aidl/vts/VtsComposerClient.h
+++ b/graphics/composer/aidl/vts/VtsComposerClient.h
@@ -163,6 +163,11 @@
 
     std::pair<ScopedAStatus, int32_t> getPreferredBootDisplayConfig(int64_t display);
 
+    std::pair<ScopedAStatus, std::vector<common::HdrConversionCapability>>
+    getHdrConversionCapabilities();
+
+    ScopedAStatus setHdrConversionStrategy(const common::HdrConversionStrategy& conversionStrategy);
+
     std::pair<ScopedAStatus, common::Transform> getDisplayPhysicalOrientation(int64_t display);
 
     ScopedAStatus setIdleTimerEnabled(int64_t display, int32_t timeoutMs);
diff --git a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
index 166127d..6fa3392 100644
--- a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
+++ b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
@@ -18,6 +18,7 @@
 
 #include <aidl/Gtest.h>
 #include <aidl/Vintf.h>
+#include <aidl/android/hardware/graphics/common/BufferUsage.h>
 #include <aidl/android/hardware/graphics/composer3/IComposer.h>
 #include <gtest/gtest.h>
 #include <ui/DisplayId.h>
@@ -80,11 +81,13 @@
         clientCompositionDisplay.physicalDisplay = Rect(getDisplayWidth(), getDisplayHeight());
         clientCompositionDisplay.clip = clientCompositionDisplay.physicalDisplay;
 
-        mTestRenderEngine->initGraphicBuffer(static_cast<uint32_t>(getDisplayWidth()),
-                                             static_cast<uint32_t>(getDisplayHeight()),
-                                             /*layerCount*/ 1U,
-                                             GRALLOC_USAGE_HW_RENDER | GRALLOC_USAGE_SW_READ_OFTEN |
-                                                     GRALLOC_USAGE_SW_WRITE_OFTEN);
+        mTestRenderEngine->initGraphicBuffer(
+                static_cast<uint32_t>(getDisplayWidth()), static_cast<uint32_t>(getDisplayHeight()),
+                /*layerCount*/ 1U,
+                static_cast<uint64_t>(
+                        static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
+                        static_cast<uint64_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                        static_cast<uint64_t>(common::BufferUsage::GPU_RENDER_TARGET)));
         mTestRenderEngine->setDisplaySettings(clientCompositionDisplay);
     }
 
@@ -112,21 +115,18 @@
         ASSERT_EQ(status.getServiceSpecificError(), serviceSpecificError);
     }
 
-    sp<GraphicBuffer> allocateBuffer(uint32_t width, uint32_t height, uint64_t usage) {
-        sp<GraphicBuffer> graphicBuffer =
-                sp<GraphicBuffer>::make(width, height, ::android::PIXEL_FORMAT_RGBA_8888,
-                                        /*layerCount*/ 1u, static_cast<uint32_t>(usage),
-                                        "VtsHalGraphicsComposer3_ReadbackTest");
+    std::pair<bool, ::android::sp<::android::GraphicBuffer>> allocateBuffer(uint32_t usage) {
+        const auto width = static_cast<uint32_t>(getDisplayWidth());
+        const auto height = static_cast<uint32_t>(getDisplayHeight());
+
+        const auto& graphicBuffer = ::android::sp<::android::GraphicBuffer>::make(
+                width, height, ::android::PIXEL_FORMAT_RGBA_8888,
+                /*layerCount*/ 1u, usage, "VtsHalGraphicsComposer3_ReadbackTest");
 
         if (graphicBuffer && ::android::OK == graphicBuffer->initCheck()) {
-            return graphicBuffer;
+            return {true, graphicBuffer};
         }
-        return nullptr;
-    }
-
-    sp<GraphicBuffer> allocateBuffer(uint64_t usage) {
-        return allocateBuffer(static_cast<uint32_t>(getDisplayWidth()),
-                              static_cast<uint32_t>(getDisplayHeight()), usage);
+        return {false, graphicBuffer};
     }
 
     uint64_t getStableDisplayId(int64_t display) {
@@ -293,7 +293,7 @@
         ReadbackHelper::fillColorsArea(expectedColors, getDisplayWidth(), coloredSquare, BLUE);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -332,7 +332,7 @@
         }
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         std::vector<Color> expectedColors(
                 static_cast<size_t>(getDisplayWidth() * getDisplayHeight()));
@@ -378,296 +378,6 @@
     }
 }
 
-TEST_P(GraphicsCompositionTest, SetLayerBufferWithSlotsToClear) {
-    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
-    ASSERT_TRUE(versionStatus.isOk());
-    if (version == 1) {
-        GTEST_SUCCEED() << "Device does not support the new API for clearing buffer slots";
-        return;
-    }
-
-    const auto& [readbackStatus, readbackBufferAttributes] =
-            mComposerClient->getReadbackBufferAttributes(getPrimaryDisplayId());
-    if (!readbackStatus.isOk()) {
-        GTEST_SUCCEED() << "Readback not supported";
-        return;
-    }
-
-    sp<GraphicBuffer> readbackBuffer;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::createReadbackBuffer(
-            readbackBufferAttributes, getPrimaryDisplay(), &readbackBuffer));
-    if (readbackBuffer == nullptr) {
-        GTEST_SUCCEED() << "Unsupported readback buffer attributes";
-        return;
-    }
-    // no fence needed for the readback buffer
-    ScopedFileDescriptor noFence(-1);
-
-    // red buffer
-    uint64_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
-    sp<GraphicBuffer> redBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, redBuffer);
-    int redFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(redBuffer, RED, &redFence));
-
-    // blue buffer
-    sp<GraphicBuffer> blueBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, blueBuffer);
-    int blueFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(blueBuffer, BLUE, &blueFence));
-
-    // green buffer
-    sp<GraphicBuffer> greenBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, greenBuffer);
-    int greenFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(greenBuffer, GREEN, &greenFence));
-
-    // layer defaults
-    common::Rect rectFullDisplay = {0, 0, getDisplayWidth(), getDisplayHeight()};
-    int64_t display = getPrimaryDisplayId();
-    const auto& [layerStatus, layer] = mComposerClient->createLayer(getPrimaryDisplayId(), 3);
-    ASSERT_TRUE(layerStatus.isOk());
-    mWriter->setLayerDisplayFrame(display, layer, rectFullDisplay);
-    mWriter->setLayerCompositionType(display, layer, Composition::DEVICE);
-
-    // set the layer to the blue buffer
-    // should be blue
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 0, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence);
-    }
-
-    // change the layer to the red buffer
-    // should be red
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 1, redBuffer->handle, redFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(RED, readbackBuffer, fence);
-    }
-
-    // change the layer to the green buffer
-    // should be green
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 2, greenBuffer->handle, greenFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(GREEN, readbackBuffer, fence);
-    }
-
-    // clear the slots for all buffers
-    // should still be green since the active buffer should not be cleared by the HAL implementation
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBufferSlotsToClear(display, layer, /*slotsToClear*/ {0, 1, 2});
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(GREEN, readbackBuffer, fence);
-    }
-
-    // clear the slot for the green buffer, and set the buffer with the same slot to the blue buffer
-    // should be blue
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBufferSlotsToClear(display, layer, /*slotsToClear*/ {2});
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 2, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence);
-    }
-}
-
-TEST_P(GraphicsCompositionTest, SetLayerBufferWithSlotsToClear_backwardsCompatible) {
-    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
-    ASSERT_TRUE(versionStatus.isOk());
-    if (version > 1) {
-        GTEST_SUCCEED() << "Device does not need a backwards compatible way to clear buffer slots";
-        return;
-    }
-
-    const auto& [readbackStatus, readbackBufferAttributes] =
-            mComposerClient->getReadbackBufferAttributes(getPrimaryDisplayId());
-    if (!readbackStatus.isOk()) {
-        GTEST_SUCCEED() << "Readback not supported";
-        return;
-    }
-
-    sp<GraphicBuffer> readbackBuffer;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::createReadbackBuffer(
-            readbackBufferAttributes, getPrimaryDisplay(), &readbackBuffer));
-    if (readbackBuffer == nullptr) {
-        GTEST_SUCCEED() << "Unsupported readback buffer attributes";
-        return;
-    }
-    // no fence needed for the readback buffer
-    ScopedFileDescriptor noFence(-1);
-
-    sp<GraphicBuffer> clearSlotBuffer = allocateBuffer(1u, 1u, GRALLOC_USAGE_HW_COMPOSER);
-    ASSERT_NE(nullptr, clearSlotBuffer);
-
-    // red buffer
-    uint64_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
-    sp<GraphicBuffer> redBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, redBuffer);
-    int redFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(redBuffer, RED, &redFence));
-
-    // blue buffer
-    sp<GraphicBuffer> blueBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, blueBuffer);
-    int blueFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(blueBuffer, BLUE, &blueFence));
-
-    // green buffer
-    sp<GraphicBuffer> greenBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, greenBuffer);
-    int greenFence;
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBufferAndGetFence(greenBuffer, GREEN, &greenFence));
-
-    // layer defaults
-    common::Rect rectFullDisplay = {0, 0, getDisplayWidth(), getDisplayHeight()};
-    int64_t display = getPrimaryDisplayId();
-    const auto& [layerStatus, layer] = mComposerClient->createLayer(getPrimaryDisplayId(), 3);
-    ASSERT_TRUE(layerStatus.isOk());
-    mWriter->setLayerDisplayFrame(display, layer, rectFullDisplay);
-    mWriter->setLayerCompositionType(display, layer, Composition::DEVICE);
-
-    // set the layer to the blue buffer
-    // should be blue
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 0, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence);
-    }
-
-    // change the layer to the red buffer
-    // should be red
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 1, redBuffer->handle, redFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(RED, readbackBuffer, fence);
-    }
-
-    // change the layer to the green buffer
-    // should be green
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 2, greenBuffer->handle, greenFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(GREEN, readbackBuffer, fence);
-    }
-
-    // clear the slot for the blue buffer
-    // should still be green
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBufferWithNewCommand(display, layer, /*slot*/ 0, clearSlotBuffer->handle,
-                                              /*fence*/ -1);
-        // SurfaceFlinger will re-set the active buffer slot after other buffer slots are cleared
-        mWriter->setLayerBufferWithNewCommand(display, layer, /*slot*/ 2, /*handle*/ nullptr,
-                                              /*fence*/ -1);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(GREEN, readbackBuffer, fence);
-    }
-
-    // clear the slot for all buffers, and set the buffer with the same slot as the green buffer
-    // should be blue now
-    {
-        auto status = mComposerClient->setReadbackBuffer(display, readbackBuffer->handle, noFence);
-        ASSERT_TRUE(status.isOk());
-        mWriter->setLayerBufferWithNewCommand(display, layer, /*slot*/ 0, clearSlotBuffer->handle,
-                                              /*fence*/ -1);
-        mWriter->setLayerBufferWithNewCommand(display, layer, /*slot*/ 1, clearSlotBuffer->handle,
-                                              /*fence*/ -1);
-        // SurfaceFlinger will never clear the active buffer (slot 2), but will free up the
-        // buffer slot so it will be re-used for the next setLayerBuffer command
-        mWriter->setLayerBuffer(display, layer, /*slot*/ 2, blueBuffer->handle, blueFence);
-        mWriter->validateDisplay(display, ComposerClientWriter::kNoTimestamp);
-        execute();
-        ASSERT_TRUE(mReader.takeChangedCompositionTypes(display).empty());
-        ASSERT_TRUE(mReader.takeErrors().empty());
-        mWriter->presentDisplay(display);
-        execute();
-        auto [fenceStatus, fence] = mComposerClient->getReadbackBufferFence(display);
-        ASSERT_TRUE(fenceStatus.isOk());
-        ReadbackHelper::compareColorToBuffer(BLUE, readbackBuffer, fence);
-    }
-}
-
 TEST_P(GraphicsCompositionTest, SetLayerBufferNoEffect) {
     for (ColorMode mode : mTestColorModes) {
         EXPECT_TRUE(mComposerClient
@@ -689,9 +399,10 @@
         layer->write(*mWriter);
 
         // This following buffer call should have no effect
-        uint64_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
-        sp<GraphicBuffer> graphicBuffer = allocateBuffer(usage);
-        ASSERT_NE(nullptr, graphicBuffer);
+        const auto usage = static_cast<uint32_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                           static_cast<uint32_t>(common::BufferUsage::CPU_READ_OFTEN);
+        const auto& [graphicBufferStatus, graphicBuffer] = allocateBuffer(usage);
+        ASSERT_TRUE(graphicBufferStatus);
         const auto& buffer = graphicBuffer->handle;
         mWriter->setLayerBuffer(getPrimaryDisplayId(), layer->getLayer(), /*slot*/ 0, buffer,
                                 /*acquireFence*/ -1);
@@ -702,7 +413,7 @@
         ReadbackHelper::fillColorsArea(expectedColors, getDisplayWidth(), coloredSquare, BLUE);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mWriter->validateDisplay(getPrimaryDisplayId(), ComposerClientWriter::kNoTimestamp);
@@ -730,7 +441,7 @@
     }
 
     ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                  getDisplayHeight(), mPixelFormat);
+                                  getDisplayHeight(), mPixelFormat, mDataspace);
 
     ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 }
@@ -743,9 +454,10 @@
         return;
     }
 
-    uint64_t usage = GRALLOC_USAGE_SW_WRITE_OFTEN | GRALLOC_USAGE_SW_READ_OFTEN;
-    sp<GraphicBuffer> graphicBuffer = allocateBuffer(usage);
-    ASSERT_NE(nullptr, graphicBuffer);
+    const auto usage = static_cast<uint32_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                       static_cast<uint32_t>(common::BufferUsage::CPU_READ_OFTEN);
+    const auto& [graphicBufferStatus, graphicBuffer] = allocateBuffer(usage);
+    ASSERT_TRUE(graphicBufferStatus);
     const auto& bufferHandle = graphicBuffer->handle;
     ::ndk::ScopedFileDescriptor fence = ::ndk::ScopedFileDescriptor(-1);
 
@@ -827,7 +539,7 @@
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -840,14 +552,16 @@
             ASSERT_EQ(Composition::CLIENT, changedCompositionTypes[0].composition);
 
             PixelFormat clientFormat = PixelFormat::RGBA_8888;
-            auto clientUsage = GRALLOC_USAGE_HW_FB | GRALLOC_USAGE_SW_READ_OFTEN |
-                               GRALLOC_USAGE_SW_WRITE_OFTEN;
+            auto clientUsage = static_cast<uint32_t>(
+                    static_cast<uint32_t>(common::BufferUsage::CPU_READ_OFTEN) |
+                    static_cast<uint32_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                    static_cast<uint32_t>(common::BufferUsage::COMPOSER_CLIENT_TARGET));
             Dataspace clientDataspace = ReadbackHelper::getDataspaceForColorMode(mode);
             common::Rect damage{0, 0, getDisplayWidth(), getDisplayHeight()};
 
             // create client target buffer
-            sp<GraphicBuffer> graphicBuffer = allocateBuffer(clientUsage);
-            ASSERT_NE(nullptr, graphicBuffer);
+            const auto& [graphicBufferStatus, graphicBuffer] = allocateBuffer(clientUsage);
+            ASSERT_TRUE(graphicBufferStatus);
             const auto& buffer = graphicBuffer->handle;
             void* clientBufData;
             const auto stride = static_cast<uint32_t>(graphicBuffer->stride);
@@ -904,7 +618,7 @@
                 {0, getDisplayHeight() / 2, getDisplayWidth(), getDisplayHeight()}, RED);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         auto deviceLayer = std::make_shared<TestBufferLayer>(
@@ -923,8 +637,10 @@
         deviceLayer->write(*mWriter);
 
         PixelFormat clientFormat = PixelFormat::RGBA_8888;
-        auto clientUsage =
-                GRALLOC_USAGE_HW_FB | GRALLOC_USAGE_SW_READ_OFTEN | GRALLOC_USAGE_SW_WRITE_OFTEN;
+        auto clientUsage = static_cast<uint32_t>(
+                static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
+                static_cast<uint32_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                static_cast<uint32_t>(common::BufferUsage::COMPOSER_CLIENT_TARGET));
         Dataspace clientDataspace = ReadbackHelper::getDataspaceForColorMode(mode);
         int32_t clientWidth = getDisplayWidth();
         int32_t clientHeight = getDisplayHeight() / 2;
@@ -946,8 +662,8 @@
         }
         // create client target buffer
         ASSERT_EQ(Composition::CLIENT, changedCompositionTypes[0].composition);
-        sp<GraphicBuffer> graphicBuffer = allocateBuffer(clientUsage);
-        ASSERT_NE(nullptr, graphicBuffer);
+        const auto& [graphicBufferStatus, graphicBuffer] = allocateBuffer(clientUsage);
+        ASSERT_TRUE(graphicBufferStatus);
         const auto& buffer = graphicBuffer->handle;
 
         void* clientBufData;
@@ -1009,7 +725,7 @@
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -1077,7 +793,7 @@
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
 
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
@@ -1143,7 +859,7 @@
         ReadbackHelper::fillColorsArea(expectedColors, getDisplayWidth(),
                                        {0, 0, getDisplayWidth(), getDisplayHeight()}, BLUE);
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1200,7 +916,7 @@
         ReadbackHelper::fillColorsArea(expectedColors, getDisplayWidth(), redRect, RED);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -1310,7 +1026,7 @@
         ReadbackHelper::fillColorsArea(expectedColors, getDisplayWidth(), dimmerRedRect, DIM_RED);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -1446,7 +1162,7 @@
         setExpectedColors(expectedColors);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1491,7 +1207,7 @@
         setExpectedColors(expectedColors);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1531,7 +1247,7 @@
         setExpectedColors(expectedColors);
 
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1605,7 +1321,7 @@
             return;
         }
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         mLayer->setTransform(Transform::FLIP_H);
         mLayer->setDataspace(ReadbackHelper::getDataspaceForColorMode(mode), *mWriter);
@@ -1650,7 +1366,7 @@
             return;
         }
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::FLIP_V);
@@ -1695,7 +1411,7 @@
             return;
         }
         ReadbackBuffer readbackBuffer(getPrimaryDisplayId(), mComposerClient, getDisplayWidth(),
-                                      getDisplayHeight(), mPixelFormat);
+                                      getDisplayHeight(), mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::ROT_180);
diff --git a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
index 7b852e0..55e0a13 100644
--- a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
+++ b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
@@ -621,6 +621,63 @@
     }
 }
 
+TEST_P(GraphicsComposerAidlTest, GetHdrConversionCapabilities) {
+    if (!hasCapability(Capability::HDR_OUTPUT_CONVERSION_CONFIG)) {
+        GTEST_SUCCEED() << "HDR output conversion not supported";
+        return;
+    }
+    const auto& [status, conversionCapabilities] = mComposerClient->getHdrConversionCapabilities();
+    EXPECT_TRUE(status.isOk());
+}
+
+TEST_P(GraphicsComposerAidlTest, SetHdrConversionStrategy_Passthrough) {
+    if (!hasCapability(Capability::HDR_OUTPUT_CONVERSION_CONFIG)) {
+        GTEST_SUCCEED() << "HDR output conversion not supported";
+        return;
+    }
+    common::HdrConversionStrategy hdrConversionStrategy;
+    hdrConversionStrategy.set<common::HdrConversionStrategy::Tag::passthrough>(true);
+    const auto& status = mComposerClient->setHdrConversionStrategy(hdrConversionStrategy);
+    EXPECT_TRUE(status.isOk());
+}
+
+TEST_P(GraphicsComposerAidlTest, SetHdrConversionStrategy_Force) {
+    if (!hasCapability(Capability::HDR_OUTPUT_CONVERSION_CONFIG)) {
+        GTEST_SUCCEED() << "HDR output conversion not supported";
+        return;
+    }
+    const auto& [status, conversionCapabilities] = mComposerClient->getHdrConversionCapabilities();
+    for (auto conversionCapability : conversionCapabilities) {
+        if (conversionCapability.outputType) {
+            common::HdrConversionStrategy hdrConversionStrategy;
+            hdrConversionStrategy.set<common::HdrConversionStrategy::Tag::forceHdrConversion>(
+                    conversionCapability.outputType->hdr);
+            const auto& statusSet =
+                    mComposerClient->setHdrConversionStrategy(hdrConversionStrategy);
+            EXPECT_TRUE(status.isOk());
+        }
+    }
+}
+
+TEST_P(GraphicsComposerAidlTest, SetHdrConversionStrategy_Auto) {
+    if (!hasCapability(Capability::HDR_OUTPUT_CONVERSION_CONFIG)) {
+        GTEST_SUCCEED() << "HDR output conversion not supported";
+        return;
+    }
+    const auto& [status, conversionCapabilities] = mComposerClient->getHdrConversionCapabilities();
+    std::vector<aidl::android::hardware::graphics::common::Hdr> autoHdrTypes;
+    for (auto conversionCapability : conversionCapabilities) {
+        if (conversionCapability.outputType) {
+            autoHdrTypes.push_back(conversionCapability.outputType->hdr);
+        }
+    }
+    common::HdrConversionStrategy hdrConversionStrategy;
+    hdrConversionStrategy.set<common::HdrConversionStrategy::Tag::autoAllowedHdrTypes>(
+            autoHdrTypes);
+    const auto& statusSet = mComposerClient->setHdrConversionStrategy(hdrConversionStrategy);
+    EXPECT_TRUE(status.isOk());
+}
+
 TEST_P(GraphicsComposerAidlTest, SetAutoLowLatencyMode_BadDisplay) {
     auto status = mComposerClient->setAutoLowLatencyMode(getInvalidDisplayId(), /*isEnabled*/ true);
     EXPECT_FALSE(status.isOk());
@@ -812,7 +869,7 @@
 }
 
 TEST_P(GraphicsComposerAidlTest, GetOverlaySupport) {
-    const auto& [status, _] = mComposerClient->getOverlaySupport();
+    const auto& [status, properties] = mComposerClient->getOverlaySupport();
     if (!status.isOk() && status.getExceptionCode() == EX_SERVICE_SPECIFIC &&
         status.getServiceSpecificError() == IComposerClient::EX_UNSUPPORTED) {
         GTEST_SUCCEED() << "getOverlaySupport is not supported";
@@ -820,6 +877,23 @@
     }
 
     ASSERT_TRUE(status.isOk());
+    for (const auto& i : properties.combinations) {
+        for (const auto standard : i.standards) {
+            const auto val = static_cast<int32_t>(standard) &
+                             static_cast<int32_t>(common::Dataspace::STANDARD_MASK);
+            ASSERT_TRUE(val == static_cast<int32_t>(standard));
+        }
+        for (const auto transfer : i.transfers) {
+            const auto val = static_cast<int32_t>(transfer) &
+                             static_cast<int32_t>(common::Dataspace::TRANSFER_MASK);
+            ASSERT_TRUE(val == static_cast<int32_t>(transfer));
+        }
+        for (const auto range : i.ranges) {
+            const auto val = static_cast<int32_t>(range) &
+                             static_cast<int32_t>(common::Dataspace::RANGE_MASK);
+            ASSERT_TRUE(val == static_cast<int32_t>(range));
+        }
+    }
 }
 
 TEST_P(GraphicsComposerAidlTest, GetDisplayPhysicalOrientation_BadDisplay) {
@@ -1131,19 +1205,15 @@
         }
     }
 
-    sp<GraphicBuffer> allocate(uint32_t width, uint32_t height,
-                               ::android::PixelFormat pixelFormat) {
-        return sp<GraphicBuffer>::make(
-                width, height, pixelFormat, /*layerCount*/ 1U,
-                static_cast<uint64_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
-                        static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
-                        static_cast<uint64_t>(common::BufferUsage::COMPOSER_OVERLAY),
-                "VtsHalGraphicsComposer3_TargetTest");
-    }
-
     sp<GraphicBuffer> allocate(::android::PixelFormat pixelFormat) {
-        return allocate(static_cast<uint32_t>(getPrimaryDisplay().getDisplayWidth()),
-                        static_cast<uint32_t>(getPrimaryDisplay().getDisplayHeight()), pixelFormat);
+        return sp<GraphicBuffer>::make(
+                static_cast<uint32_t>(getPrimaryDisplay().getDisplayWidth()),
+                static_cast<uint32_t>(getPrimaryDisplay().getDisplayHeight()), pixelFormat,
+                /*layerCount*/ 1U,
+                (static_cast<uint64_t>(common::BufferUsage::CPU_WRITE_OFTEN) |
+                 static_cast<uint64_t>(common::BufferUsage::CPU_READ_OFTEN) |
+                 static_cast<uint64_t>(common::BufferUsage::COMPOSER_OVERLAY)),
+                "VtsHalGraphicsComposer3_TargetTest");
     }
 
     void sendRefreshFrame(const VtsDisplay& display, const VsyncPeriodChangeTimeline* timeline) {
@@ -1646,90 +1716,6 @@
     execute();
 }
 
-TEST_P(GraphicsComposerAidlCommandTest, SetLayerBufferWithSlotsToClear) {
-    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
-    ASSERT_TRUE(versionStatus.isOk());
-    if (version == 1) {
-        GTEST_SUCCEED() << "Device does not support the new API for clearing buffer slots";
-        return;
-    }
-
-    const auto& [layerStatus, layer] =
-            mComposerClient->createLayer(getPrimaryDisplayId(), kBufferSlotCount);
-    EXPECT_TRUE(layerStatus.isOk());
-
-    auto& writer = getWriter(getPrimaryDisplayId());
-
-    const auto buffer1 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer1);
-    const auto handle1 = buffer1->handle;
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 0, handle1, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-
-    const auto buffer2 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer2);
-    const auto handle2 = buffer2->handle;
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 1, handle2, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-
-    // Ensure we can clear the buffer slots and then set the active slot with a new buffer
-    const auto buffer3 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer3);
-    const auto handle3 = buffer3->handle;
-    writer.setLayerBufferSlotsToClear(getPrimaryDisplayId(), layer, /*slotsToClear*/ {0, 1});
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 1, handle3, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-}
-
-TEST_P(GraphicsComposerAidlCommandTest, SetLayerBufferWithSlotsToClear_backwardsCompatible) {
-    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
-    ASSERT_TRUE(versionStatus.isOk());
-    if (version > 1) {
-        GTEST_SUCCEED() << "Device does not need a backwards compatible way to clear buffer slots";
-        return;
-    }
-
-    auto clearSlotBuffer = allocate(1u, 1u, ::android::PIXEL_FORMAT_RGB_888);
-    ASSERT_NE(nullptr, clearSlotBuffer);
-    auto clearSlotBufferHandle = clearSlotBuffer->handle;
-
-    const auto& [layerStatus, layer] =
-            mComposerClient->createLayer(getPrimaryDisplayId(), kBufferSlotCount);
-    EXPECT_TRUE(layerStatus.isOk());
-
-    auto& writer = getWriter(getPrimaryDisplayId());
-
-    const auto buffer1 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer1);
-    const auto handle1 = buffer1->handle;
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 0, handle1, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-
-    const auto buffer2 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer2);
-    const auto handle2 = buffer2->handle;
-    EXPECT_TRUE(layerStatus.isOk());
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 1, handle2, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-
-    // Ensure we can clear a buffer slot and then set that same slot with a new buffer
-    const auto buffer3 = allocate(::android::PIXEL_FORMAT_RGBA_8888);
-    ASSERT_NE(nullptr, buffer3);
-    const auto handle3 = buffer2->handle;
-    // SurfaceFlinger will never clear the active buffer, instead it will clear non-active buffers
-    // and then re-use the active buffer's slot for the new buffer
-    writer.setLayerBufferWithNewCommand(getPrimaryDisplayId(), layer, /*slot*/ 0,
-                                        clearSlotBufferHandle, /*acquireFence*/ -1);
-    writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 1, handle3, /*acquireFence*/ -1);
-    execute();
-    ASSERT_TRUE(mReader.takeErrors().empty());
-}
-
 TEST_P(GraphicsComposerAidlCommandTest, SetLayerSurfaceDamage) {
     const auto& [layerStatus, layer] =
             mComposerClient->createLayer(getPrimaryDisplayId(), kBufferSlotCount);
@@ -2319,6 +2305,22 @@
     // TODO(b/251842321): Try to present on multiple threads.
 }
 
+/**
+ * Test Capability::SKIP_VALIDATE
+ *
+ * Capability::SKIP_VALIDATE has been deprecated and should not be enabled.
+ */
+TEST_P(GraphicsComposerAidlCommandTest, SkipValidateDeprecatedTest) {
+    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
+    ASSERT_TRUE(versionStatus.isOk());
+    if (version <= 1) {
+        GTEST_SUCCEED() << "HAL at version 1 or lower can contain Capability::SKIP_VALIDATE.";
+        return;
+    }
+    ASSERT_FALSE(hasCapability(Capability::SKIP_VALIDATE))
+            << "Found Capability::SKIP_VALIDATE capability.";
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(GraphicsComposerAidlCommandTest);
 INSTANTIATE_TEST_SUITE_P(
         PerInstance, GraphicsComposerAidlCommandTest,
@@ -2378,4 +2380,4 @@
     }
 
     return RUN_ALL_TESTS();
-}
+}
\ No newline at end of file
diff --git a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
index 5a450e3..1e7cb8e 100644
--- a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
+++ b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
@@ -952,7 +952,6 @@
     EXPECT_EQ(PlaneLayoutComponentType::RAW,
               static_cast<PlaneLayoutComponentType>(planeLayoutComponent.type.value));
     EXPECT_EQ(0, planeLayoutComponent.offsetInBits % 8);
-    EXPECT_EQ(-1, planeLayoutComponent.sizeInBits);
 
     ASSERT_NO_FATAL_FAILURE(fence.reset(mGralloc->unlock(bufferHandle)));
 }
@@ -994,7 +993,6 @@
     EXPECT_EQ(PlaneLayoutComponentType::RAW,
               static_cast<PlaneLayoutComponentType>(planeLayoutComponent.type.value));
     EXPECT_EQ(0, planeLayoutComponent.offsetInBits % 8);
-    EXPECT_EQ(-1, planeLayoutComponent.sizeInBits);
 
     ASSERT_NO_FATAL_FAILURE(fence.reset(mGralloc->unlock(bufferHandle)));
 }
diff --git a/graphics/mapper/stable-c/README.md b/graphics/mapper/stable-c/README.md
index 30f3ccc..0b9b499 100644
--- a/graphics/mapper/stable-c/README.md
+++ b/graphics/mapper/stable-c/README.md
@@ -15,7 +15,6 @@
         <name>mapper</name>
         <version>5.0</version>
         <interface>
-            <name>I</name>
             <instance>minigbm</instance>
         </interface>
     </hal>
diff --git a/graphics/mapper/stable-c/implutils/impltests.cpp b/graphics/mapper/stable-c/implutils/impltests.cpp
index f12b069..01a1db9 100644
--- a/graphics/mapper/stable-c/implutils/impltests.cpp
+++ b/graphics/mapper/stable-c/implutils/impltests.cpp
@@ -359,35 +359,35 @@
     auto mpbuf = encode<StandardMetadataType::BUFFER_ID>(42);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeBufferId(42, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Name) {
     auto mpbuf = encode<StandardMetadataType::NAME>("Hello, Interop!");
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeName("Hello, Interop!", &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Width) {
     auto mpbuf = encode<StandardMetadataType::WIDTH>(128);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeWidth(128, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Height) {
     auto mpbuf = encode<StandardMetadataType::HEIGHT>(64);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeHeight(64, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, LayerCount) {
     auto mpbuf = encode<StandardMetadataType::LAYER_COUNT>(3);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeLayerCount(3, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatRequested) {
@@ -395,21 +395,21 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatRequested(
                                 hardware::graphics::common::V1_2::PixelFormat::RGBX_8888, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatFourcc) {
     auto mpbuf = encode<StandardMetadataType::PIXEL_FORMAT_FOURCC>(DRM_FORMAT_ABGR8888);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatFourCC(DRM_FORMAT_ABGR8888, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatModifier) {
     auto mpbuf = encode<StandardMetadataType::PIXEL_FORMAT_MODIFIER>(123456);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatModifier(123456, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Usage) {
@@ -420,21 +420,21 @@
                       static_cast<uint64_t>(
                               hardware::graphics::common::V1_2::BufferUsage::COMPOSER_OVERLAY),
                       &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, AllocationSize) {
     auto mpbuf = encode<StandardMetadataType::ALLOCATION_SIZE>(10200);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeAllocationSize(10200, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, ProtectedContent) {
     auto mpbuf = encode<StandardMetadataType::PROTECTED_CONTENT>(1);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeProtectedContent(1, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Compression) {
@@ -443,14 +443,14 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR,
               gralloc4::encodeCompression(gralloc4::Compression_DisplayStreamCompression, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Interlaced) {
     auto mpbuf = encode<StandardMetadataType::INTERLACED>(gralloc4::Interlaced_TopBottom);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeInterlaced(gralloc4::Interlaced_TopBottom, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, ChromeSitting) {
@@ -459,14 +459,14 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR,
               gralloc4::encodeChromaSiting(gralloc4::ChromaSiting_SitedInterstitial, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PlaneLayouts) {
     auto mpbuf = encode<StandardMetadataType::PLANE_LAYOUTS>(fakePlaneLayouts());
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePlaneLayouts(fakePlaneLayouts(), &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Crop) {
@@ -474,21 +474,21 @@
     auto mpbuf = encode<StandardMetadataType::CROP>(cropRects);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeCrop(cropRects, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Dataspace) {
     auto mpbuf = encode<StandardMetadataType::DATASPACE>(Dataspace::DISPLAY_P3);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeDataspace(Dataspace::DISPLAY_P3, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, BlendMode) {
     auto mpbuf = encode<StandardMetadataType::BLEND_MODE>(BlendMode::PREMULTIPLIED);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeBlendMode(BlendMode::PREMULTIPLIED, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2086) {
@@ -498,7 +498,7 @@
     auto mpbuf = encode<StandardMetadataType::SMPTE2086>(hdrdata);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2086(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Cta861_3) {
@@ -506,29 +506,29 @@
     auto mpbuf = encode<StandardMetadataType::CTA861_3>(hdrdata);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeCta861_3(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2094_10) {
     auto mpbuf = encode<StandardMetadataType::SMPTE2094_10>(std::nullopt);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_10(std::nullopt, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 
     std::vector<uint8_t> hdrdata{1, 2, 3, 4, 5, 6};
     mpbuf = encode<StandardMetadataType::SMPTE2094_10>(hdrdata);
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_10(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2094_40) {
     auto mpbuf = encode<StandardMetadataType::SMPTE2094_40>(std::nullopt);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_40(std::nullopt, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 
     std::vector<uint8_t> hdrdata{1, 2, 3, 4, 5, 6};
     mpbuf = encode<StandardMetadataType::SMPTE2094_40>(hdrdata);
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_40(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
diff --git a/health/aidl/Android.bp b/health/aidl/Android.bp
index 64d83f3..6d4f914 100644
--- a/health/aidl/Android.bp
+++ b/health/aidl/Android.bp
@@ -74,7 +74,7 @@
     name: "android.hardware.health-translate-ndk",
     defaults: ["android.hardware.health-translate-ndk_defaults"],
     shared_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
     ],
 }
 
@@ -91,7 +91,7 @@
     name: "android.hardware.health-translate-java",
     srcs: ["android/hardware/health/Translate.java"],
     libs: [
-        "android.hardware.health-V1-java",
+        "android.hardware.health-V2-java",
         "android.hardware.health-V2.0-java",
         "android.hardware.health-V2.1-java",
     ],
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
index 711ac19..42fbf95 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.health;
+@Backing(type="int") @VintfStability
+enum BatteryChargingPolicy {
+  INVALID = 0,
+  DEFAULT = 1,
+  LONG_LIFE = 2,
+  ADAPTIVE = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
similarity index 86%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
index 711ac19..e21eb28 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.health;
+@Backing(type="int") @VintfStability
+enum BatteryChargingState {
+  INVALID = 0,
+  NORMAL = 1,
+  TOO_COLD = 2,
+  TOO_HOT = 3,
+  LONG_LIFE = 4,
+  ADAPTIVE = 5,
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
index 4ce7952..8d13198 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
@@ -41,4 +41,7 @@
   OVER_VOLTAGE = 5,
   UNSPECIFIED_FAILURE = 6,
   COLD = 7,
+  FAIR = 8,
+  NOT_AVAILABLE = 11,
+  INCONSISTENT = 12,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
index 711ac19..d523fad 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.health;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable BatteryHealthData {
+  long batteryManufacturingDateSeconds;
+  long batteryFirstUsageSeconds;
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
index 97d9e84..664cc70 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
@@ -57,5 +57,9 @@
   android.hardware.health.BatteryCapacityLevel batteryCapacityLevel;
   long batteryChargeTimeToFullNowSeconds;
   int batteryFullChargeDesignCapacityUah;
+  int batteryStateOfHealth;
+  android.hardware.health.BatteryChargingState chargingState;
+  android.hardware.health.BatteryChargingPolicy chargingPolicy;
+  @nullable android.hardware.health.BatteryHealthData batteryHealthData;
   const int BATTERY_CHARGE_TIME_TO_FULL_NOW_SECONDS_UNSUPPORTED = -1;
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
index 7016ae4..b49dfff 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
@@ -46,6 +46,9 @@
   android.hardware.health.StorageInfo[] getStorageInfo();
   android.hardware.health.DiskStats[] getDiskStats();
   android.hardware.health.HealthInfo getHealthInfo();
+  void setChargingPolicy(android.hardware.health.BatteryChargingPolicy in_value);
+  android.hardware.health.BatteryChargingPolicy getChargingPolicy();
+  android.hardware.health.BatteryHealthData getBatteryHealthData();
   const int STATUS_UNKNOWN = 2;
   const int STATUS_CALLBACK_DIED = 4;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/health/aidl/android/hardware/health/BatteryChargingPolicy.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to health/aidl/android/hardware/health/BatteryChargingPolicy.aidl
index 61239d0..0aeee41 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/health/aidl/android/hardware/health/BatteryChargingPolicy.aidl
@@ -14,15 +14,25 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.health;
 
+/**
+ * Battery charging policy.
+ */
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+@Backing(type="int")
+enum BatteryChargingPolicy {
+    INVALID = 0,
+    /**
+     * default policy
+     */
+    DEFAULT = 1,
+    /**
+     * @see BatteryChargingState.LONG_LIFE
+     */
+    LONG_LIFE = 2,
+    /**
+     * @see BatteryChargingState.ADAPTIVE
+     */
+    ADAPTIVE = 3,
 }
diff --git a/health/aidl/android/hardware/health/BatteryChargingState.aidl b/health/aidl/android/hardware/health/BatteryChargingState.aidl
new file mode 100644
index 0000000..af62077
--- /dev/null
+++ b/health/aidl/android/hardware/health/BatteryChargingState.aidl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.health;
+
+/**
+ * Possible values for Battery Health.
+ * Note: These are currently in sync with BatteryManager and must not
+ * be extended / altered.
+ */
+@VintfStability
+@Backing(type="int")
+enum BatteryChargingState {
+    INVALID = 0,
+    /**
+     * Default state.
+     */
+    NORMAL = 1,
+    /**
+     * Reported when the battery is too cold to charge at a normal
+     * rate or stopped charging due to low temperature.
+     */
+    TOO_COLD = 2,
+    /**
+     * Reported when the battery is too hot to charge at a normal
+     * rate or stopped charging due to hot temperature.
+     */
+    TOO_HOT = 3,
+    /**
+     * The device is using a special charging profile that designed
+     * to prevent accelerated aging.
+     */
+    LONG_LIFE = 4,
+    /**
+     * The device is using a special charging profile designed to
+     * improve battery cycle life, performances or both.
+     */
+    ADAPTIVE = 5,
+}
diff --git a/health/aidl/android/hardware/health/BatteryHealth.aidl b/health/aidl/android/hardware/health/BatteryHealth.aidl
index 2b6e51f..65abdc2 100644
--- a/health/aidl/android/hardware/health/BatteryHealth.aidl
+++ b/health/aidl/android/hardware/health/BatteryHealth.aidl
@@ -24,8 +24,15 @@
 @VintfStability
 @Backing(type="int")
 enum BatteryHealth {
+    /**
+     * Battery health is not supported from the device.
+     */
     UNKNOWN = 1,
     GOOD = 2,
+    /**
+     * Must be consistent with BatteryChargingState.
+     * If BatteryHealth is OVERHEAT, then BatteryChargingState must be TOO_HOT.
+     */
     OVERHEAT = 3,
     DEAD = 4,
     OVER_VOLTAGE = 5,
@@ -33,5 +40,28 @@
      * Battery experienced an unknown/unspecified failure.
      */
     UNSPECIFIED_FAILURE = 6,
+    /**
+     * Must be consistent with BatteryChargingState.
+     * If BatteryHealth is COLD, then BatteryChargingState must be TOO_COLD.
+     */
     COLD = 7,
+    /**
+     * Battery health is marginal.
+     */
+    FAIR = 8,
+    /**
+     * The reserve data below 10 are used to recognize the battery real health.
+     */
+    /**
+     * There is not enough information to determine an accurate
+     * value. The value might become UNSPECIFIED_FAILURE, DEAD
+     * or any other state except for UNKNOWN later.
+     */
+    NOT_AVAILABLE = 11,
+    /**
+     * The internal data is inconsistent and the battery needs to
+     * go through a recalibration process. The value might become
+     * UNSPECIFIED_FAILURE, DEAD or any other state except for UNKNOWN later.
+     */
+    INCONSISTENT = 12,
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/health/aidl/android/hardware/health/BatteryHealthData.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to health/aidl/android/hardware/health/BatteryHealthData.aidl
index 61239d0..fb17f63 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/health/aidl/android/hardware/health/BatteryHealthData.aidl
@@ -14,15 +14,19 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.health;
 
+/*
+ * Battery health data
+ */
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+parcelable BatteryHealthData {
+    /**
+     * Battery manufacturing date is reported in epoch.
+     */
+    long batteryManufacturingDateSeconds;
+    /**
+     * The date of first usage is reported in epoch.
+     */
+    long batteryFirstUsageSeconds;
 }
diff --git a/health/aidl/android/hardware/health/HealthInfo.aidl b/health/aidl/android/hardware/health/HealthInfo.aidl
index 5b98baf..238f524 100644
--- a/health/aidl/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/android/hardware/health/HealthInfo.aidl
@@ -17,7 +17,10 @@
 package android.hardware.health;
 
 import android.hardware.health.BatteryCapacityLevel;
+import android.hardware.health.BatteryChargingPolicy;
+import android.hardware.health.BatteryChargingState;
 import android.hardware.health.BatteryHealth;
+import android.hardware.health.BatteryHealthData;
 import android.hardware.health.BatteryStatus;
 import android.hardware.health.DiskStats;
 import android.hardware.health.StorageInfo;
@@ -133,4 +136,23 @@
      * Value must be less than 100 000 000 µAh if known.
      */
     int batteryFullChargeDesignCapacityUah;
+    /**
+     * Measured battery state of health (remaining estimate full charge capacity
+     * relative to the rated capacity in %).
+     * Value must be 0 if batteryStatus is UNKNOWN.
+     * Otherwise, value must be in the range 0 to 100.
+     */
+    int batteryStateOfHealth;
+    /**
+     * Battery charging state
+     */
+    BatteryChargingState chargingState;
+    /**
+     * Battery charging policy. See {@link BatteryChargingPolicy} for more details.
+     */
+    BatteryChargingPolicy chargingPolicy;
+    /**
+     * Battery health data
+     */
+    @nullable BatteryHealthData batteryHealthData;
 }
diff --git a/health/aidl/android/hardware/health/IHealth.aidl b/health/aidl/android/hardware/health/IHealth.aidl
index d541eca..bdfe07a 100644
--- a/health/aidl/android/hardware/health/IHealth.aidl
+++ b/health/aidl/android/hardware/health/IHealth.aidl
@@ -16,6 +16,8 @@
 
 package android.hardware.health;
 
+import android.hardware.health.BatteryChargingPolicy;
+import android.hardware.health.BatteryHealthData;
 import android.hardware.health.BatteryStatus;
 import android.hardware.health.DiskStats;
 import android.hardware.health.HealthInfo;
@@ -102,7 +104,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCurrentNowMicroamps();
 
@@ -120,7 +122,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCurrentAverageMicroamps();
 
@@ -134,7 +136,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCapacity();
 
@@ -146,7 +148,7 @@
      *         - Return exception with code EX_UNSUPPORTED_OPERATION
      *           if this property is not supported,
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     long getEnergyCounterNwh();
 
@@ -197,7 +199,47 @@
      *         - Return exception with code EX_UNSUPPORTED_OPERATION
      *           if this API is not supported,
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     HealthInfo getHealthInfo();
+
+    /**
+     * Set battery charging policy
+     *
+     * @return If error, return service specific error with code:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return status with code INVALID_OPERATION
+     *           if the operation failed.
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    void setChargingPolicy(BatteryChargingPolicy in_value);
+
+    /**
+     * Get current battery charging policy
+     *
+     * @return current battery charging policy if successful.
+     *         If error:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    BatteryChargingPolicy getChargingPolicy();
+
+    /**
+     * Get battery health data
+     *
+     * @return Battery health data if successful.
+     *         If error:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    BatteryHealthData getBatteryHealthData();
 }
diff --git a/health/aidl/default/Android.bp b/health/aidl/default/Android.bp
index 4eb3cb1..b51e4f3 100644
--- a/health/aidl/default/Android.bp
+++ b/health/aidl/default/Android.bp
@@ -29,7 +29,7 @@
         "libcutils",
         "liblog",
         "libutils",
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
 
         // TODO(b/177269435): remove when BatteryMonitor works with AIDL HealthInfo.
         "libhidlbase",
@@ -48,7 +48,7 @@
     name: "libhealth_aidl_charger_defaults",
     shared_libs: [
         // common
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libbase",
         "libcutils",
         "liblog",
@@ -195,7 +195,7 @@
         "service_fuzzer_defaults",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libbase",
         "liblog",
         "fuzz_libhealth_aidl_impl",
diff --git a/health/aidl/default/Health.cpp b/health/aidl/default/Health.cpp
index d41d01a..15a3dbc 100644
--- a/health/aidl/default/Health.cpp
+++ b/health/aidl/default/Health.cpp
@@ -115,6 +115,42 @@
                        BatteryStatus::UNKNOWN, out);
 }
 
+ndk::ScopedAStatus Health::setChargingPolicy(BatteryChargingPolicy in_value) {
+    ::android::status_t err = battery_monitor_.setChargingPolicy(static_cast<int>(in_value));
+
+    switch (err) {
+        case ::android::OK:
+            return ndk::ScopedAStatus::ok();
+        case ::android::NAME_NOT_FOUND:
+            return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+        case ::android::BAD_VALUE:
+            return ndk::ScopedAStatus::fromStatus(::android::INVALID_OPERATION);
+        default:
+            return ndk::ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    IHealth::STATUS_UNKNOWN, ::android::statusToString(err).c_str());
+    }
+}
+
+ndk::ScopedAStatus Health::getChargingPolicy(BatteryChargingPolicy* out) {
+    return GetProperty(&battery_monitor_, ::android::BATTERY_PROP_CHARGING_POLICY,
+                       BatteryChargingPolicy::DEFAULT, out);
+}
+
+ndk::ScopedAStatus Health::getBatteryHealthData(BatteryHealthData* out) {
+    if (auto res =
+                GetProperty<int64_t>(&battery_monitor_, ::android::BATTERY_PROP_MANUFACTURING_DATE,
+                                     0, &out->batteryManufacturingDateSeconds);
+        !res.isOk()) {
+        LOG(WARNING) << "Cannot get Manufacturing_date: " << res.getDescription();
+    }
+    if (auto res = GetProperty<int64_t>(&battery_monitor_, ::android::BATTERY_PROP_FIRST_USAGE_DATE,
+                                        0, &out->batteryFirstUsageSeconds);
+        !res.isOk()) {
+        LOG(WARNING) << "Cannot get First_usage_date: " << res.getDescription();
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus Health::getDiskStats(std::vector<DiskStats>*) {
     // This implementation does not support DiskStats. An implementation may extend this
     // class and override this function to support disk stats.
diff --git a/health/aidl/default/android.hardware.health-service.example.xml b/health/aidl/default/android.hardware.health-service.example.xml
index 98026cb..1fe9b8d 100644
--- a/health/aidl/default/android.hardware.health-service.example.xml
+++ b/health/aidl/default/android.hardware.health-service.example.xml
@@ -1,7 +1,7 @@
 <manifest version="1.0" type="device">
     <hal format="aidl">
         <name>android.hardware.health</name>
-        <version>1</version>
+        <version>2</version>
         <fqname>IHealth/default</fqname>
     </hal>
 </manifest>
diff --git a/health/aidl/default/include/health-impl/Health.h b/health/aidl/default/include/health-impl/Health.h
index 6bd4946..dc3a0ef 100644
--- a/health/aidl/default/include/health-impl/Health.h
+++ b/health/aidl/default/include/health-impl/Health.h
@@ -72,6 +72,10 @@
     ndk::ScopedAStatus getDiskStats(std::vector<DiskStats>* out) override;
     ndk::ScopedAStatus getStorageInfo(std::vector<StorageInfo>* out) override;
 
+    ndk::ScopedAStatus setChargingPolicy(BatteryChargingPolicy in_value) override;
+    ndk::ScopedAStatus getChargingPolicy(BatteryChargingPolicy* out) override;
+    ndk::ScopedAStatus getBatteryHealthData(BatteryHealthData* out) override;
+
     // A subclass may override these to provide a different implementation.
     binder_status_t dump(int fd, const char** args, uint32_t num_args) override;
 
diff --git a/health/aidl/vts/functional/Android.bp b/health/aidl/vts/functional/Android.bp
index f9da79f..b735a87 100644
--- a/health/aidl/vts/functional/Android.bp
+++ b/health/aidl/vts/functional/Android.bp
@@ -39,7 +39,7 @@
         "libbinder_ndk",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libgmock",
     ],
     header_libs: [
diff --git a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
index 3e07188..dd0bd81 100644
--- a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
+++ b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
@@ -225,6 +225,61 @@
     ASSERT_THAT(value, IsValidEnum<BatteryStatus>());
 }
 
+/*
+ * Tests the values returned by getChargingPolicy() from interface IHealth.
+ */
+TEST_P(HealthAidl, getChargingPolicy) {
+    BatteryChargingPolicy value;
+    auto status = health->getChargingPolicy(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(value, IsValidEnum<BatteryChargingPolicy>());
+}
+
+/*
+ * Tests that setChargingPolicy() writes the value and compared the returned
+ * value by getChargingPolicy() from interface IHealth.
+ */
+TEST_P(HealthAidl, setChargingPolicy) {
+    BatteryChargingPolicy value;
+
+    /* set ChargingPolicy*/
+    auto status = health->setChargingPolicy(static_cast<BatteryChargingPolicy>(2));  // LONG_LIFE
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+
+    /* get ChargingPolicy*/
+    status = health->getChargingPolicy(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(static_cast<int>(value), Eq(2));
+}
+
+MATCHER(IsValidHealthData, "") {
+    *result_listener << "value is " << arg.toString() << ".";
+    if (!ExplainMatchResult(Ge(-1), arg.batteryManufacturingDateSeconds, result_listener)) {
+        *result_listener << " for batteryManufacturingDateSeconds.";
+        return false;
+    }
+    if (!ExplainMatchResult(Ge(-1), arg.batteryFirstUsageSeconds, result_listener)) {
+        *result_listener << " for batteryFirstUsageSeconds.";
+        return false;
+    }
+
+    return true;
+}
+
+/*
+ * Tests the values returned by getBatteryHealthData() from interface IHealth.
+ */
+TEST_P(HealthAidl, getBatteryHealthData) {
+    BatteryHealthData value;
+    auto status = health->getBatteryHealthData(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(value, IsValidHealthData());
+}
+
 MATCHER(IsValidStorageInfo, "") {
     *result_listener << "value is " << arg.toString() << ".";
     if (!ExplainMatchResult(InClosedRange(0, 3), arg.eol, result_listener)) {
diff --git a/health/utils/libhealthshim/Android.bp b/health/utils/libhealthshim/Android.bp
index 3a1415f..14c32ae 100644
--- a/health/utils/libhealthshim/Android.bp
+++ b/health/utils/libhealthshim/Android.bp
@@ -34,7 +34,7 @@
         "-Werror",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "android.hardware.health-translate-ndk",
         "android.hardware.health@1.0",
         "android.hardware.health@2.0",
diff --git a/health/utils/libhealthshim/include/health-shim/shim.h b/health/utils/libhealthshim/include/health-shim/shim.h
index f36fa5d..ff6849b 100644
--- a/health/utils/libhealthshim/include/health-shim/shim.h
+++ b/health/utils/libhealthshim/include/health-shim/shim.h
@@ -45,6 +45,9 @@
     ndk::ScopedAStatus getStorageInfo(std::vector<StorageInfo>* _aidl_return) override;
     ndk::ScopedAStatus getDiskStats(std::vector<DiskStats>* _aidl_return) override;
     ndk::ScopedAStatus getHealthInfo(HealthInfo* _aidl_return) override;
+    ndk::ScopedAStatus setChargingPolicy(BatteryChargingPolicy in_value) override;
+    ndk::ScopedAStatus getChargingPolicy(BatteryChargingPolicy* _aidl_return) override;
+    ndk::ScopedAStatus getBatteryHealthData(BatteryHealthData* _aidl_return) override;
 
   private:
     ::android::sp<HidlHealth> service_;
diff --git a/health/utils/libhealthshim/shim.cpp b/health/utils/libhealthshim/shim.cpp
index 1329679..6a5f512 100644
--- a/health/utils/libhealthshim/shim.cpp
+++ b/health/utils/libhealthshim/shim.cpp
@@ -217,4 +217,20 @@
     return ReturnAndResultToStatus(ret, out_result);
 }
 
+ScopedAStatus HealthShim::setChargingPolicy(BatteryChargingPolicy in_value) {
+    in_value = static_cast<BatteryChargingPolicy>(0);
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
+ScopedAStatus HealthShim::getChargingPolicy(BatteryChargingPolicy* out) {
+    *out = static_cast<BatteryChargingPolicy>(0);
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
+ScopedAStatus HealthShim::getBatteryHealthData(BatteryHealthData* out) {
+    out->batteryManufacturingDateSeconds = 0;
+    out->batteryFirstUsageSeconds = 0;
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
 }  // namespace aidl::android::hardware::health
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index fb5048a..728cc91 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -4866,6 +4866,11 @@
     if (vsr_api_level < 33) {
         GTEST_SKIP() << "Applies only to VSR API level 33, this device is: " << vsr_api_level;
     }
+    char soc_model[PROPERTY_VALUE_MAX] = {};
+    property_get("ro.soc.model", soc_model, "");
+    if (!strcmp(soc_model, "SM8550")) {
+        GTEST_SKIP() << "Skip QTI SM8550 chipset, the SOC model of this device is: " << soc_model;
+    }
     FAIL() << "VSR 13+ requires KeyMint version 2";
 }
 
diff --git a/radio/aidl/Android.bp b/radio/aidl/Android.bp
index e8cebd7..dfccb4c 100644
--- a/radio/aidl/Android.bp
+++ b/radio/aidl/Android.bp
@@ -262,3 +262,19 @@
         },
     },
 }
+
+aidl_interface {
+    name: "android.hardware.radio.satellite",
+    vendor_available: true,
+    srcs: ["android/hardware/radio/satellite/*.aidl"],
+    stability: "vintf",
+    imports: ["android.hardware.radio-V2"],
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+        },
+    },
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/MultipleEnabledProfilesMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/MultipleEnabledProfilesMode.aidl
index fad767c..74017e4 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/MultipleEnabledProfilesMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/MultipleEnabledProfilesMode.aidl
@@ -34,8 +34,8 @@
 package android.hardware.radio.config;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum MultipleEnabledProfilesMode {
-  NONE = 0,
-  MEP_A1 = 1,
-  MEP_A2 = 2,
-  MEP_B = 3,
+  NONE,
+  MEP_A1,
+  MEP_A2,
+  MEP_B,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnAuthType.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnAuthType.aidl
index 86272c2..a33ad6e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnAuthType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnAuthType.aidl
@@ -34,8 +34,8 @@
 package android.hardware.radio.data;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ApnAuthType {
-  NO_PAP_NO_CHAP = 0,
-  PAP_NO_CHAP = 1,
-  NO_PAP_CHAP = 2,
-  PAP_CHAP = 3,
+  NO_PAP_NO_CHAP,
+  PAP_NO_CHAP,
+  NO_PAP_CHAP,
+  PAP_CHAP,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnTypes.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnTypes.aidl
index 1518a57..45d22c8 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnTypes.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/ApnTypes.aidl
@@ -35,19 +35,19 @@
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ApnTypes {
   NONE = 0,
-  DEFAULT = 1,
-  MMS = 2,
-  SUPL = 4,
-  DUN = 8,
-  HIPRI = 16,
-  FOTA = 32,
-  IMS = 64,
-  CBS = 128,
-  IA = 256,
-  EMERGENCY = 512,
-  MCX = 1024,
-  XCAP = 2048,
-  VSIM = 4096,
-  BIP = 8192,
-  ENTERPRISE = 16384,
+  DEFAULT = (1 << 0),
+  MMS = (1 << 1),
+  SUPL = (1 << 2),
+  DUN = (1 << 3),
+  HIPRI = (1 << 4),
+  FOTA = (1 << 5),
+  IMS = (1 << 6),
+  CBS = (1 << 7),
+  IA = (1 << 8),
+  EMERGENCY = (1 << 9),
+  MCX = (1 << 10),
+  XCAP = (1 << 11),
+  VSIM = (1 << 12),
+  BIP = (1 << 13),
+  ENTERPRISE = (1 << 14),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
index d7d6983..8a3fd4f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
@@ -35,343 +35,347 @@
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum DataCallFailCause {
   NONE = 0,
-  OPERATOR_BARRED = 8,
-  NAS_SIGNALLING = 14,
-  INSUFFICIENT_RESOURCES = 26,
-  MISSING_UNKNOWN_APN = 27,
-  UNKNOWN_PDP_ADDRESS_TYPE = 28,
-  USER_AUTHENTICATION = 29,
-  ACTIVATION_REJECT_GGSN = 30,
-  ACTIVATION_REJECT_UNSPECIFIED = 31,
-  SERVICE_OPTION_NOT_SUPPORTED = 32,
-  SERVICE_OPTION_NOT_SUBSCRIBED = 33,
-  SERVICE_OPTION_OUT_OF_ORDER = 34,
-  NSAPI_IN_USE = 35,
-  REGULAR_DEACTIVATION = 36,
-  QOS_NOT_ACCEPTED = 37,
-  NETWORK_FAILURE = 38,
-  UMTS_REACTIVATION_REQ = 39,
-  FEATURE_NOT_SUPP = 40,
-  TFT_SEMANTIC_ERROR = 41,
-  TFT_SYTAX_ERROR = 42,
-  UNKNOWN_PDP_CONTEXT = 43,
-  FILTER_SEMANTIC_ERROR = 44,
-  FILTER_SYTAX_ERROR = 45,
-  PDP_WITHOUT_ACTIVE_TFT = 46,
-  ONLY_IPV4_ALLOWED = 50,
-  ONLY_IPV6_ALLOWED = 51,
-  ONLY_SINGLE_BEARER_ALLOWED = 52,
-  ESM_INFO_NOT_RECEIVED = 53,
-  PDN_CONN_DOES_NOT_EXIST = 54,
-  MULTI_CONN_TO_SAME_PDN_NOT_ALLOWED = 55,
-  MAX_ACTIVE_PDP_CONTEXT_REACHED = 65,
-  UNSUPPORTED_APN_IN_CURRENT_PLMN = 66,
-  INVALID_TRANSACTION_ID = 81,
-  MESSAGE_INCORRECT_SEMANTIC = 95,
-  INVALID_MANDATORY_INFO = 96,
-  MESSAGE_TYPE_UNSUPPORTED = 97,
-  MSG_TYPE_NONCOMPATIBLE_STATE = 98,
-  UNKNOWN_INFO_ELEMENT = 99,
-  CONDITIONAL_IE_ERROR = 100,
-  MSG_AND_PROTOCOL_STATE_UNCOMPATIBLE = 101,
-  PROTOCOL_ERRORS = 111,
-  APN_TYPE_CONFLICT = 112,
-  INVALID_PCSCF_ADDR = 113,
-  INTERNAL_CALL_PREEMPT_BY_HIGH_PRIO_APN = 114,
-  EMM_ACCESS_BARRED = 115,
-  EMERGENCY_IFACE_ONLY = 116,
-  IFACE_MISMATCH = 117,
-  COMPANION_IFACE_IN_USE = 118,
-  IP_ADDRESS_MISMATCH = 119,
-  IFACE_AND_POL_FAMILY_MISMATCH = 120,
-  EMM_ACCESS_BARRED_INFINITE_RETRY = 121,
-  AUTH_FAILURE_ON_EMERGENCY_CALL = 122,
-  OEM_DCFAILCAUSE_1 = 4097,
-  OEM_DCFAILCAUSE_2 = 4098,
-  OEM_DCFAILCAUSE_3 = 4099,
-  OEM_DCFAILCAUSE_4 = 4100,
-  OEM_DCFAILCAUSE_5 = 4101,
-  OEM_DCFAILCAUSE_6 = 4102,
-  OEM_DCFAILCAUSE_7 = 4103,
-  OEM_DCFAILCAUSE_8 = 4104,
-  OEM_DCFAILCAUSE_9 = 4105,
-  OEM_DCFAILCAUSE_10 = 4106,
-  OEM_DCFAILCAUSE_11 = 4107,
-  OEM_DCFAILCAUSE_12 = 4108,
-  OEM_DCFAILCAUSE_13 = 4109,
-  OEM_DCFAILCAUSE_14 = 4110,
-  OEM_DCFAILCAUSE_15 = 4111,
-  VOICE_REGISTRATION_FAIL = -1,
-  DATA_REGISTRATION_FAIL = -2,
-  SIGNAL_LOST = -3,
-  PREF_RADIO_TECH_CHANGED = -4,
-  RADIO_POWER_OFF = -5,
-  TETHERED_CALL_ACTIVE = -6,
-  ERROR_UNSPECIFIED = 65535,
-  LLC_SNDCP = 25,
-  ACTIVATION_REJECTED_BCM_VIOLATION = 48,
-  COLLISION_WITH_NETWORK_INITIATED_REQUEST = 56,
-  ONLY_IPV4V6_ALLOWED = 57,
-  ONLY_NON_IP_ALLOWED = 58,
-  UNSUPPORTED_QCI_VALUE = 59,
-  BEARER_HANDLING_NOT_SUPPORTED = 60,
-  INVALID_DNS_ADDR = 123,
-  INVALID_PCSCF_OR_DNS_ADDRESS = 124,
-  CALL_PREEMPT_BY_EMERGENCY_APN = 127,
-  UE_INITIATED_DETACH_OR_DISCONNECT = 128,
-  MIP_FA_REASON_UNSPECIFIED = 2000,
-  MIP_FA_ADMIN_PROHIBITED = 2001,
-  MIP_FA_INSUFFICIENT_RESOURCES = 2002,
-  MIP_FA_MOBILE_NODE_AUTHENTICATION_FAILURE = 2003,
-  MIP_FA_HOME_AGENT_AUTHENTICATION_FAILURE = 2004,
-  MIP_FA_REQUESTED_LIFETIME_TOO_LONG = 2005,
-  MIP_FA_MALFORMED_REQUEST = 2006,
-  MIP_FA_MALFORMED_REPLY = 2007,
-  MIP_FA_ENCAPSULATION_UNAVAILABLE = 2008,
-  MIP_FA_VJ_HEADER_COMPRESSION_UNAVAILABLE = 2009,
-  MIP_FA_REVERSE_TUNNEL_UNAVAILABLE = 2010,
-  MIP_FA_REVERSE_TUNNEL_IS_MANDATORY = 2011,
-  MIP_FA_DELIVERY_STYLE_NOT_SUPPORTED = 2012,
-  MIP_FA_MISSING_NAI = 2013,
-  MIP_FA_MISSING_HOME_AGENT = 2014,
-  MIP_FA_MISSING_HOME_ADDRESS = 2015,
-  MIP_FA_UNKNOWN_CHALLENGE = 2016,
-  MIP_FA_MISSING_CHALLENGE = 2017,
-  MIP_FA_STALE_CHALLENGE = 2018,
-  MIP_HA_REASON_UNSPECIFIED = 2019,
-  MIP_HA_ADMIN_PROHIBITED = 2020,
-  MIP_HA_INSUFFICIENT_RESOURCES = 2021,
-  MIP_HA_MOBILE_NODE_AUTHENTICATION_FAILURE = 2022,
-  MIP_HA_FOREIGN_AGENT_AUTHENTICATION_FAILURE = 2023,
-  MIP_HA_REGISTRATION_ID_MISMATCH = 2024,
-  MIP_HA_MALFORMED_REQUEST = 2025,
-  MIP_HA_UNKNOWN_HOME_AGENT_ADDRESS = 2026,
-  MIP_HA_REVERSE_TUNNEL_UNAVAILABLE = 2027,
-  MIP_HA_REVERSE_TUNNEL_IS_MANDATORY = 2028,
-  MIP_HA_ENCAPSULATION_UNAVAILABLE = 2029,
-  CLOSE_IN_PROGRESS = 2030,
-  NETWORK_INITIATED_TERMINATION = 2031,
-  MODEM_APP_PREEMPTED = 2032,
-  PDN_IPV4_CALL_DISALLOWED = 2033,
-  PDN_IPV4_CALL_THROTTLED = 2034,
-  PDN_IPV6_CALL_DISALLOWED = 2035,
-  PDN_IPV6_CALL_THROTTLED = 2036,
-  MODEM_RESTART = 2037,
-  PDP_PPP_NOT_SUPPORTED = 2038,
-  UNPREFERRED_RAT = 2039,
-  PHYSICAL_LINK_CLOSE_IN_PROGRESS = 2040,
-  APN_PENDING_HANDOVER = 2041,
-  PROFILE_BEARER_INCOMPATIBLE = 2042,
-  SIM_CARD_CHANGED = 2043,
-  LOW_POWER_MODE_OR_POWERING_DOWN = 2044,
-  APN_DISABLED = 2045,
-  MAX_PPP_INACTIVITY_TIMER_EXPIRED = 2046,
-  IPV6_ADDRESS_TRANSFER_FAILED = 2047,
-  TRAT_SWAP_FAILED = 2048,
-  EHRPD_TO_HRPD_FALLBACK = 2049,
-  MIP_CONFIG_FAILURE = 2050,
-  PDN_INACTIVITY_TIMER_EXPIRED = 2051,
-  MAX_IPV4_CONNECTIONS = 2052,
-  MAX_IPV6_CONNECTIONS = 2053,
-  APN_MISMATCH = 2054,
-  IP_VERSION_MISMATCH = 2055,
-  DUN_CALL_DISALLOWED = 2056,
-  INTERNAL_EPC_NONEPC_TRANSITION = 2057,
-  INTERFACE_IN_USE = 2058,
-  APN_DISALLOWED_ON_ROAMING = 2059,
-  APN_PARAMETERS_CHANGED = 2060,
-  NULL_APN_DISALLOWED = 2061,
-  THERMAL_MITIGATION = 2062,
-  DATA_SETTINGS_DISABLED = 2063,
-  DATA_ROAMING_SETTINGS_DISABLED = 2064,
-  DDS_SWITCHED = 2065,
-  FORBIDDEN_APN_NAME = 2066,
-  DDS_SWITCH_IN_PROGRESS = 2067,
-  CALL_DISALLOWED_IN_ROAMING = 2068,
-  NON_IP_NOT_SUPPORTED = 2069,
-  PDN_NON_IP_CALL_THROTTLED = 2070,
-  PDN_NON_IP_CALL_DISALLOWED = 2071,
-  CDMA_LOCK = 2072,
-  CDMA_INTERCEPT = 2073,
-  CDMA_REORDER = 2074,
-  CDMA_RELEASE_DUE_TO_SO_REJECTION = 2075,
-  CDMA_INCOMING_CALL = 2076,
-  CDMA_ALERT_STOP = 2077,
-  CHANNEL_ACQUISITION_FAILURE = 2078,
-  MAX_ACCESS_PROBE = 2079,
-  CONCURRENT_SERVICE_NOT_SUPPORTED_BY_BASE_STATION = 2080,
-  NO_RESPONSE_FROM_BASE_STATION = 2081,
-  REJECTED_BY_BASE_STATION = 2082,
-  CONCURRENT_SERVICES_INCOMPATIBLE = 2083,
-  NO_CDMA_SERVICE = 2084,
-  RUIM_NOT_PRESENT = 2085,
-  CDMA_RETRY_ORDER = 2086,
-  ACCESS_BLOCK = 2087,
-  ACCESS_BLOCK_ALL = 2088,
-  IS707B_MAX_ACCESS_PROBES = 2089,
-  THERMAL_EMERGENCY = 2090,
-  CONCURRENT_SERVICES_NOT_ALLOWED = 2091,
-  INCOMING_CALL_REJECTED = 2092,
-  NO_SERVICE_ON_GATEWAY = 2093,
-  NO_GPRS_CONTEXT = 2094,
-  ILLEGAL_MS = 2095,
-  ILLEGAL_ME = 2096,
-  GPRS_SERVICES_AND_NON_GPRS_SERVICES_NOT_ALLOWED = 2097,
-  GPRS_SERVICES_NOT_ALLOWED = 2098,
-  MS_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK = 2099,
-  IMPLICITLY_DETACHED = 2100,
-  PLMN_NOT_ALLOWED = 2101,
-  LOCATION_AREA_NOT_ALLOWED = 2102,
-  GPRS_SERVICES_NOT_ALLOWED_IN_THIS_PLMN = 2103,
-  PDP_DUPLICATE = 2104,
-  UE_RAT_CHANGE = 2105,
-  CONGESTION = 2106,
-  NO_PDP_CONTEXT_ACTIVATED = 2107,
-  ACCESS_CLASS_DSAC_REJECTION = 2108,
-  PDP_ACTIVATE_MAX_RETRY_FAILED = 2109,
-  RADIO_ACCESS_BEARER_FAILURE = 2110,
-  ESM_UNKNOWN_EPS_BEARER_CONTEXT = 2111,
-  DRB_RELEASED_BY_RRC = 2112,
-  CONNECTION_RELEASED = 2113,
-  EMM_DETACHED = 2114,
-  EMM_ATTACH_FAILED = 2115,
-  EMM_ATTACH_STARTED = 2116,
-  LTE_NAS_SERVICE_REQUEST_FAILED = 2117,
-  DUPLICATE_BEARER_ID = 2118,
-  ESM_COLLISION_SCENARIOS = 2119,
-  ESM_BEARER_DEACTIVATED_TO_SYNC_WITH_NETWORK = 2120,
-  ESM_NW_ACTIVATED_DED_BEARER_WITH_ID_OF_DEF_BEARER = 2121,
-  ESM_BAD_OTA_MESSAGE = 2122,
-  ESM_DOWNLOAD_SERVER_REJECTED_THE_CALL = 2123,
-  ESM_CONTEXT_TRANSFERRED_DUE_TO_IRAT = 2124,
-  DS_EXPLICIT_DEACTIVATION = 2125,
-  ESM_LOCAL_CAUSE_NONE = 2126,
-  LTE_THROTTLING_NOT_REQUIRED = 2127,
-  ACCESS_CONTROL_LIST_CHECK_FAILURE = 2128,
-  SERVICE_NOT_ALLOWED_ON_PLMN = 2129,
-  EMM_T3417_EXPIRED = 2130,
-  EMM_T3417_EXT_EXPIRED = 2131,
-  RRC_UPLINK_DATA_TRANSMISSION_FAILURE = 2132,
-  RRC_UPLINK_DELIVERY_FAILED_DUE_TO_HANDOVER = 2133,
-  RRC_UPLINK_CONNECTION_RELEASE = 2134,
-  RRC_UPLINK_RADIO_LINK_FAILURE = 2135,
-  RRC_UPLINK_ERROR_REQUEST_FROM_NAS = 2136,
-  RRC_CONNECTION_ACCESS_STRATUM_FAILURE = 2137,
-  RRC_CONNECTION_ANOTHER_PROCEDURE_IN_PROGRESS = 2138,
-  RRC_CONNECTION_ACCESS_BARRED = 2139,
-  RRC_CONNECTION_CELL_RESELECTION = 2140,
-  RRC_CONNECTION_CONFIG_FAILURE = 2141,
-  RRC_CONNECTION_TIMER_EXPIRED = 2142,
-  RRC_CONNECTION_LINK_FAILURE = 2143,
-  RRC_CONNECTION_CELL_NOT_CAMPED = 2144,
-  RRC_CONNECTION_SYSTEM_INTERVAL_FAILURE = 2145,
-  RRC_CONNECTION_REJECT_BY_NETWORK = 2146,
-  RRC_CONNECTION_NORMAL_RELEASE = 2147,
-  RRC_CONNECTION_RADIO_LINK_FAILURE = 2148,
-  RRC_CONNECTION_REESTABLISHMENT_FAILURE = 2149,
-  RRC_CONNECTION_OUT_OF_SERVICE_DURING_CELL_REGISTER = 2150,
-  RRC_CONNECTION_ABORT_REQUEST = 2151,
-  RRC_CONNECTION_SYSTEM_INFORMATION_BLOCK_READ_ERROR = 2152,
-  NETWORK_INITIATED_DETACH_WITH_AUTO_REATTACH = 2153,
-  NETWORK_INITIATED_DETACH_NO_AUTO_REATTACH = 2154,
-  ESM_PROCEDURE_TIME_OUT = 2155,
-  INVALID_CONNECTION_ID = 2156,
-  MAXIMIUM_NSAPIS_EXCEEDED = 2157,
-  INVALID_PRIMARY_NSAPI = 2158,
-  CANNOT_ENCODE_OTA_MESSAGE = 2159,
-  RADIO_ACCESS_BEARER_SETUP_FAILURE = 2160,
-  PDP_ESTABLISH_TIMEOUT_EXPIRED = 2161,
-  PDP_MODIFY_TIMEOUT_EXPIRED = 2162,
-  PDP_INACTIVE_TIMEOUT_EXPIRED = 2163,
-  PDP_LOWERLAYER_ERROR = 2164,
-  PDP_MODIFY_COLLISION = 2165,
-  MAXINUM_SIZE_OF_L2_MESSAGE_EXCEEDED = 2166,
-  NAS_REQUEST_REJECTED_BY_NETWORK = 2167,
-  RRC_CONNECTION_INVALID_REQUEST = 2168,
-  RRC_CONNECTION_TRACKING_AREA_ID_CHANGED = 2169,
-  RRC_CONNECTION_RF_UNAVAILABLE = 2170,
-  RRC_CONNECTION_ABORTED_DUE_TO_IRAT_CHANGE = 2171,
-  RRC_CONNECTION_RELEASED_SECURITY_NOT_ACTIVE = 2172,
-  RRC_CONNECTION_ABORTED_AFTER_HANDOVER = 2173,
-  RRC_CONNECTION_ABORTED_AFTER_IRAT_CELL_CHANGE = 2174,
-  RRC_CONNECTION_ABORTED_DURING_IRAT_CELL_CHANGE = 2175,
-  IMSI_UNKNOWN_IN_HOME_SUBSCRIBER_SERVER = 2176,
-  IMEI_NOT_ACCEPTED = 2177,
-  EPS_SERVICES_AND_NON_EPS_SERVICES_NOT_ALLOWED = 2178,
-  EPS_SERVICES_NOT_ALLOWED_IN_PLMN = 2179,
-  MSC_TEMPORARILY_NOT_REACHABLE = 2180,
-  CS_DOMAIN_NOT_AVAILABLE = 2181,
-  ESM_FAILURE = 2182,
-  MAC_FAILURE = 2183,
-  SYNCHRONIZATION_FAILURE = 2184,
-  UE_SECURITY_CAPABILITIES_MISMATCH = 2185,
-  SECURITY_MODE_REJECTED = 2186,
-  UNACCEPTABLE_NON_EPS_AUTHENTICATION = 2187,
-  CS_FALLBACK_CALL_ESTABLISHMENT_NOT_ALLOWED = 2188,
-  NO_EPS_BEARER_CONTEXT_ACTIVATED = 2189,
-  INVALID_EMM_STATE = 2190,
-  NAS_LAYER_FAILURE = 2191,
-  MULTIPLE_PDP_CALL_NOT_ALLOWED = 2192,
-  EMBMS_NOT_ENABLED = 2193,
-  IRAT_HANDOVER_FAILED = 2194,
-  EMBMS_REGULAR_DEACTIVATION = 2195,
-  TEST_LOOPBACK_REGULAR_DEACTIVATION = 2196,
-  LOWER_LAYER_REGISTRATION_FAILURE = 2197,
-  DATA_PLAN_EXPIRED = 2198,
-  UMTS_HANDOVER_TO_IWLAN = 2199,
-  EVDO_CONNECTION_DENY_BY_GENERAL_OR_NETWORK_BUSY = 2200,
-  EVDO_CONNECTION_DENY_BY_BILLING_OR_AUTHENTICATION_FAILURE = 2201,
-  EVDO_HDR_CHANGED = 2202,
-  EVDO_HDR_EXITED = 2203,
-  EVDO_HDR_NO_SESSION = 2204,
-  EVDO_USING_GPS_FIX_INSTEAD_OF_HDR_CALL = 2205,
-  EVDO_HDR_CONNECTION_SETUP_TIMEOUT = 2206,
-  FAILED_TO_ACQUIRE_COLOCATED_HDR = 2207,
-  OTASP_COMMIT_IN_PROGRESS = 2208,
-  NO_HYBRID_HDR_SERVICE = 2209,
-  HDR_NO_LOCK_GRANTED = 2210,
-  DBM_OR_SMS_IN_PROGRESS = 2211,
-  HDR_FADE = 2212,
-  HDR_ACCESS_FAILURE = 2213,
-  UNSUPPORTED_1X_PREV = 2214,
-  LOCAL_END = 2215,
-  NO_SERVICE = 2216,
-  FADE = 2217,
-  NORMAL_RELEASE = 2218,
-  ACCESS_ATTEMPT_ALREADY_IN_PROGRESS = 2219,
-  REDIRECTION_OR_HANDOFF_IN_PROGRESS = 2220,
-  EMERGENCY_MODE = 2221,
-  PHONE_IN_USE = 2222,
-  INVALID_MODE = 2223,
-  INVALID_SIM_STATE = 2224,
-  NO_COLLOCATED_HDR = 2225,
-  UE_IS_ENTERING_POWERSAVE_MODE = 2226,
-  DUAL_SWITCH = 2227,
-  PPP_TIMEOUT = 2228,
-  PPP_AUTH_FAILURE = 2229,
-  PPP_OPTION_MISMATCH = 2230,
-  PPP_PAP_FAILURE = 2231,
-  PPP_CHAP_FAILURE = 2232,
-  PPP_CLOSE_IN_PROGRESS = 2233,
-  LIMITED_TO_IPV4 = 2234,
-  LIMITED_TO_IPV6 = 2235,
-  VSNCP_TIMEOUT = 2236,
-  VSNCP_GEN_ERROR = 2237,
-  VSNCP_APN_UNAUTHORIZED = 2238,
-  VSNCP_PDN_LIMIT_EXCEEDED = 2239,
-  VSNCP_NO_PDN_GATEWAY_ADDRESS = 2240,
-  VSNCP_PDN_GATEWAY_UNREACHABLE = 2241,
-  VSNCP_PDN_GATEWAY_REJECT = 2242,
-  VSNCP_INSUFFICIENT_PARAMETERS = 2243,
-  VSNCP_RESOURCE_UNAVAILABLE = 2244,
-  VSNCP_ADMINISTRATIVELY_PROHIBITED = 2245,
-  VSNCP_PDN_ID_IN_USE = 2246,
-  VSNCP_SUBSCRIBER_LIMITATION = 2247,
-  VSNCP_PDN_EXISTS_FOR_THIS_APN = 2248,
-  VSNCP_RECONNECT_NOT_ALLOWED = 2249,
-  IPV6_PREFIX_UNAVAILABLE = 2250,
-  HANDOFF_PREFERENCE_CHANGED = 2251,
-  SLICE_REJECTED = 2252,
-  MATCH_ALL_RULE_NOT_ALLOWED = 2253,
-  ALL_MATCHING_RULES_FAILED = 2254,
+  OPERATOR_BARRED = 0x08,
+  NAS_SIGNALLING = 0x0E,
+  INSUFFICIENT_RESOURCES = 0x1A,
+  MISSING_UNKNOWN_APN = 0x1B,
+  UNKNOWN_PDP_ADDRESS_TYPE = 0x1C,
+  USER_AUTHENTICATION = 0x1D,
+  ACTIVATION_REJECT_GGSN = 0x1E,
+  ACTIVATION_REJECT_UNSPECIFIED = 0x1F,
+  SERVICE_OPTION_NOT_SUPPORTED = 0x20,
+  SERVICE_OPTION_NOT_SUBSCRIBED = 0x21,
+  SERVICE_OPTION_OUT_OF_ORDER = 0x22,
+  NSAPI_IN_USE = 0x23,
+  REGULAR_DEACTIVATION = 0x24,
+  QOS_NOT_ACCEPTED = 0x25,
+  NETWORK_FAILURE = 0x26,
+  UMTS_REACTIVATION_REQ = 0x27,
+  FEATURE_NOT_SUPP = 0x28,
+  TFT_SEMANTIC_ERROR = 0x29,
+  TFT_SYTAX_ERROR = 0x2A,
+  UNKNOWN_PDP_CONTEXT = 0x2B,
+  FILTER_SEMANTIC_ERROR = 0x2C,
+  FILTER_SYTAX_ERROR = 0x2D,
+  PDP_WITHOUT_ACTIVE_TFT = 0x2E,
+  ONLY_IPV4_ALLOWED = 0x32,
+  ONLY_IPV6_ALLOWED = 0x33,
+  ONLY_SINGLE_BEARER_ALLOWED = 0x34,
+  ESM_INFO_NOT_RECEIVED = 0x35,
+  PDN_CONN_DOES_NOT_EXIST = 0x36,
+  MULTI_CONN_TO_SAME_PDN_NOT_ALLOWED = 0x37,
+  MAX_ACTIVE_PDP_CONTEXT_REACHED = 0x41,
+  UNSUPPORTED_APN_IN_CURRENT_PLMN = 0x42,
+  INVALID_TRANSACTION_ID = 0x51,
+  MESSAGE_INCORRECT_SEMANTIC = 0x5F,
+  INVALID_MANDATORY_INFO = 0x60,
+  MESSAGE_TYPE_UNSUPPORTED = 0x61,
+  MSG_TYPE_NONCOMPATIBLE_STATE = 0x62,
+  UNKNOWN_INFO_ELEMENT = 0x63,
+  CONDITIONAL_IE_ERROR = 0x64,
+  MSG_AND_PROTOCOL_STATE_UNCOMPATIBLE = 0x65,
+  PROTOCOL_ERRORS = 0x6F,
+  APN_TYPE_CONFLICT = 0x70,
+  INVALID_PCSCF_ADDR = 0x71,
+  INTERNAL_CALL_PREEMPT_BY_HIGH_PRIO_APN = 0x72,
+  EMM_ACCESS_BARRED = 0x73,
+  EMERGENCY_IFACE_ONLY = 0x74,
+  IFACE_MISMATCH = 0x75,
+  COMPANION_IFACE_IN_USE = 0x76,
+  IP_ADDRESS_MISMATCH = 0x77,
+  IFACE_AND_POL_FAMILY_MISMATCH = 0x78,
+  EMM_ACCESS_BARRED_INFINITE_RETRY = 0x79,
+  AUTH_FAILURE_ON_EMERGENCY_CALL = 0x7A,
+  OEM_DCFAILCAUSE_1 = 0x1001,
+  OEM_DCFAILCAUSE_2 = 0x1002,
+  OEM_DCFAILCAUSE_3 = 0x1003,
+  OEM_DCFAILCAUSE_4 = 0x1004,
+  OEM_DCFAILCAUSE_5 = 0x1005,
+  OEM_DCFAILCAUSE_6 = 0x1006,
+  OEM_DCFAILCAUSE_7 = 0x1007,
+  OEM_DCFAILCAUSE_8 = 0x1008,
+  OEM_DCFAILCAUSE_9 = 0x1009,
+  OEM_DCFAILCAUSE_10 = 0x100A,
+  OEM_DCFAILCAUSE_11 = 0x100B,
+  OEM_DCFAILCAUSE_12 = 0x100C,
+  OEM_DCFAILCAUSE_13 = 0x100D,
+  OEM_DCFAILCAUSE_14 = 0x100E,
+  OEM_DCFAILCAUSE_15 = 0x100F,
+  VOICE_REGISTRATION_FAIL = (-1),
+  DATA_REGISTRATION_FAIL = (-2),
+  SIGNAL_LOST = (-3),
+  PREF_RADIO_TECH_CHANGED = (-4),
+  RADIO_POWER_OFF = (-5),
+  TETHERED_CALL_ACTIVE = (-6),
+  ERROR_UNSPECIFIED = 0xffff,
+  LLC_SNDCP = 0x19,
+  ACTIVATION_REJECTED_BCM_VIOLATION = 0x30,
+  COLLISION_WITH_NETWORK_INITIATED_REQUEST = 0x38,
+  ONLY_IPV4V6_ALLOWED = 0x39,
+  ONLY_NON_IP_ALLOWED = 0x3A,
+  UNSUPPORTED_QCI_VALUE = 0x3B,
+  BEARER_HANDLING_NOT_SUPPORTED = 0x3C,
+  INVALID_DNS_ADDR = 0x7B,
+  INVALID_PCSCF_OR_DNS_ADDRESS = 0x7C,
+  CALL_PREEMPT_BY_EMERGENCY_APN = 0x7F,
+  UE_INITIATED_DETACH_OR_DISCONNECT = 0x80,
+  MIP_FA_REASON_UNSPECIFIED = 0x7D0,
+  MIP_FA_ADMIN_PROHIBITED = 0x7D1,
+  MIP_FA_INSUFFICIENT_RESOURCES = 0x7D2,
+  MIP_FA_MOBILE_NODE_AUTHENTICATION_FAILURE = 0x7D3,
+  MIP_FA_HOME_AGENT_AUTHENTICATION_FAILURE = 0x7D4,
+  MIP_FA_REQUESTED_LIFETIME_TOO_LONG = 0x7D5,
+  MIP_FA_MALFORMED_REQUEST = 0x7D6,
+  MIP_FA_MALFORMED_REPLY = 0x7D7,
+  MIP_FA_ENCAPSULATION_UNAVAILABLE = 0x7D8,
+  MIP_FA_VJ_HEADER_COMPRESSION_UNAVAILABLE = 0x7D9,
+  MIP_FA_REVERSE_TUNNEL_UNAVAILABLE = 0x7DA,
+  MIP_FA_REVERSE_TUNNEL_IS_MANDATORY = 0x7DB,
+  MIP_FA_DELIVERY_STYLE_NOT_SUPPORTED = 0x7DC,
+  MIP_FA_MISSING_NAI = 0x7DD,
+  MIP_FA_MISSING_HOME_AGENT = 0x7DE,
+  MIP_FA_MISSING_HOME_ADDRESS = 0x7DF,
+  MIP_FA_UNKNOWN_CHALLENGE = 0x7E0,
+  MIP_FA_MISSING_CHALLENGE = 0x7E1,
+  MIP_FA_STALE_CHALLENGE = 0x7E2,
+  MIP_HA_REASON_UNSPECIFIED = 0x7E3,
+  MIP_HA_ADMIN_PROHIBITED = 0x7E4,
+  MIP_HA_INSUFFICIENT_RESOURCES = 0x7E5,
+  MIP_HA_MOBILE_NODE_AUTHENTICATION_FAILURE = 0x7E6,
+  MIP_HA_FOREIGN_AGENT_AUTHENTICATION_FAILURE = 0x7E7,
+  MIP_HA_REGISTRATION_ID_MISMATCH = 0x7E8,
+  MIP_HA_MALFORMED_REQUEST = 0x7E9,
+  MIP_HA_UNKNOWN_HOME_AGENT_ADDRESS = 0x7EA,
+  MIP_HA_REVERSE_TUNNEL_UNAVAILABLE = 0x7EB,
+  MIP_HA_REVERSE_TUNNEL_IS_MANDATORY = 0x7EC,
+  MIP_HA_ENCAPSULATION_UNAVAILABLE = 0x7ED,
+  CLOSE_IN_PROGRESS = 0x7EE,
+  NETWORK_INITIATED_TERMINATION = 0x7EF,
+  MODEM_APP_PREEMPTED = 0x7F0,
+  PDN_IPV4_CALL_DISALLOWED = 0x7F1,
+  PDN_IPV4_CALL_THROTTLED = 0x7F2,
+  PDN_IPV6_CALL_DISALLOWED = 0x7F3,
+  PDN_IPV6_CALL_THROTTLED = 0x7F4,
+  MODEM_RESTART = 0x7F5,
+  PDP_PPP_NOT_SUPPORTED = 0x7F6,
+  UNPREFERRED_RAT = 0x7F7,
+  PHYSICAL_LINK_CLOSE_IN_PROGRESS = 0x7F8,
+  APN_PENDING_HANDOVER = 0x7F9,
+  PROFILE_BEARER_INCOMPATIBLE = 0x7FA,
+  SIM_CARD_CHANGED = 0x7FB,
+  LOW_POWER_MODE_OR_POWERING_DOWN = 0x7FC,
+  APN_DISABLED = 0x7FD,
+  MAX_PPP_INACTIVITY_TIMER_EXPIRED = 0x7FE,
+  IPV6_ADDRESS_TRANSFER_FAILED = 0x7FF,
+  TRAT_SWAP_FAILED = 0x800,
+  EHRPD_TO_HRPD_FALLBACK = 0x801,
+  MIP_CONFIG_FAILURE = 0x802,
+  PDN_INACTIVITY_TIMER_EXPIRED = 0x803,
+  MAX_IPV4_CONNECTIONS = 0x804,
+  MAX_IPV6_CONNECTIONS = 0x805,
+  APN_MISMATCH = 0x806,
+  IP_VERSION_MISMATCH = 0x807,
+  DUN_CALL_DISALLOWED = 0x808,
+  INTERNAL_EPC_NONEPC_TRANSITION = 0x809,
+  INTERFACE_IN_USE = 0x80A,
+  APN_DISALLOWED_ON_ROAMING = 0x80B,
+  APN_PARAMETERS_CHANGED = 0x80C,
+  NULL_APN_DISALLOWED = 0x80D,
+  THERMAL_MITIGATION = 0x80E,
+  DATA_SETTINGS_DISABLED = 0x80F,
+  DATA_ROAMING_SETTINGS_DISABLED = 0x810,
+  DDS_SWITCHED = 0x811,
+  FORBIDDEN_APN_NAME = 0x812,
+  DDS_SWITCH_IN_PROGRESS = 0x813,
+  CALL_DISALLOWED_IN_ROAMING = 0x814,
+  NON_IP_NOT_SUPPORTED = 0x815,
+  PDN_NON_IP_CALL_THROTTLED = 0x816,
+  PDN_NON_IP_CALL_DISALLOWED = 0x817,
+  CDMA_LOCK = 0x818,
+  CDMA_INTERCEPT = 0x819,
+  CDMA_REORDER = 0x81A,
+  CDMA_RELEASE_DUE_TO_SO_REJECTION = 0x81B,
+  CDMA_INCOMING_CALL = 0x81C,
+  CDMA_ALERT_STOP = 0x81D,
+  CHANNEL_ACQUISITION_FAILURE = 0x81E,
+  MAX_ACCESS_PROBE = 0x81F,
+  CONCURRENT_SERVICE_NOT_SUPPORTED_BY_BASE_STATION = 0x820,
+  NO_RESPONSE_FROM_BASE_STATION = 0x821,
+  REJECTED_BY_BASE_STATION = 0x822,
+  CONCURRENT_SERVICES_INCOMPATIBLE = 0x823,
+  NO_CDMA_SERVICE = 0x824,
+  RUIM_NOT_PRESENT = 0x825,
+  CDMA_RETRY_ORDER = 0x826,
+  ACCESS_BLOCK = 0x827,
+  ACCESS_BLOCK_ALL = 0x828,
+  IS707B_MAX_ACCESS_PROBES = 0x829,
+  THERMAL_EMERGENCY = 0x82A,
+  CONCURRENT_SERVICES_NOT_ALLOWED = 0x82B,
+  INCOMING_CALL_REJECTED = 0x82C,
+  NO_SERVICE_ON_GATEWAY = 0x82D,
+  NO_GPRS_CONTEXT = 0x82E,
+  ILLEGAL_MS = 0x82F,
+  ILLEGAL_ME = 0x830,
+  GPRS_SERVICES_AND_NON_GPRS_SERVICES_NOT_ALLOWED = 0x831,
+  GPRS_SERVICES_NOT_ALLOWED = 0x832,
+  MS_IDENTITY_CANNOT_BE_DERIVED_BY_THE_NETWORK = 0x833,
+  IMPLICITLY_DETACHED = 0x834,
+  PLMN_NOT_ALLOWED = 0x835,
+  LOCATION_AREA_NOT_ALLOWED = 0x836,
+  GPRS_SERVICES_NOT_ALLOWED_IN_THIS_PLMN = 0x837,
+  PDP_DUPLICATE = 0x838,
+  UE_RAT_CHANGE = 0x839,
+  CONGESTION = 0x83A,
+  NO_PDP_CONTEXT_ACTIVATED = 0x83B,
+  ACCESS_CLASS_DSAC_REJECTION = 0x83C,
+  PDP_ACTIVATE_MAX_RETRY_FAILED = 0x83D,
+  RADIO_ACCESS_BEARER_FAILURE = 0x83E,
+  ESM_UNKNOWN_EPS_BEARER_CONTEXT = 0x83F,
+  DRB_RELEASED_BY_RRC = 0x840,
+  CONNECTION_RELEASED = 0x841,
+  EMM_DETACHED = 0x842,
+  EMM_ATTACH_FAILED = 0x843,
+  EMM_ATTACH_STARTED = 0x844,
+  LTE_NAS_SERVICE_REQUEST_FAILED = 0x845,
+  DUPLICATE_BEARER_ID = 0x846,
+  ESM_COLLISION_SCENARIOS = 0x847,
+  ESM_BEARER_DEACTIVATED_TO_SYNC_WITH_NETWORK = 0x848,
+  ESM_NW_ACTIVATED_DED_BEARER_WITH_ID_OF_DEF_BEARER = 0x849,
+  ESM_BAD_OTA_MESSAGE = 0x84A,
+  ESM_DOWNLOAD_SERVER_REJECTED_THE_CALL = 0x84B,
+  ESM_CONTEXT_TRANSFERRED_DUE_TO_IRAT = 0x84C,
+  DS_EXPLICIT_DEACTIVATION = 0x84D,
+  ESM_LOCAL_CAUSE_NONE = 0x84E,
+  LTE_THROTTLING_NOT_REQUIRED = 0x84F,
+  ACCESS_CONTROL_LIST_CHECK_FAILURE = 0x850,
+  SERVICE_NOT_ALLOWED_ON_PLMN = 0x851,
+  EMM_T3417_EXPIRED = 0x852,
+  EMM_T3417_EXT_EXPIRED = 0x853,
+  RRC_UPLINK_DATA_TRANSMISSION_FAILURE = 0x854,
+  RRC_UPLINK_DELIVERY_FAILED_DUE_TO_HANDOVER = 0x855,
+  RRC_UPLINK_CONNECTION_RELEASE = 0x856,
+  RRC_UPLINK_RADIO_LINK_FAILURE = 0x857,
+  RRC_UPLINK_ERROR_REQUEST_FROM_NAS = 0x858,
+  RRC_CONNECTION_ACCESS_STRATUM_FAILURE = 0x859,
+  RRC_CONNECTION_ANOTHER_PROCEDURE_IN_PROGRESS = 0x85A,
+  RRC_CONNECTION_ACCESS_BARRED = 0x85B,
+  RRC_CONNECTION_CELL_RESELECTION = 0x85C,
+  RRC_CONNECTION_CONFIG_FAILURE = 0x85D,
+  RRC_CONNECTION_TIMER_EXPIRED = 0x85E,
+  RRC_CONNECTION_LINK_FAILURE = 0x85F,
+  RRC_CONNECTION_CELL_NOT_CAMPED = 0x860,
+  RRC_CONNECTION_SYSTEM_INTERVAL_FAILURE = 0x861,
+  RRC_CONNECTION_REJECT_BY_NETWORK = 0x862,
+  RRC_CONNECTION_NORMAL_RELEASE = 0x863,
+  RRC_CONNECTION_RADIO_LINK_FAILURE = 0x864,
+  RRC_CONNECTION_REESTABLISHMENT_FAILURE = 0x865,
+  RRC_CONNECTION_OUT_OF_SERVICE_DURING_CELL_REGISTER = 0x866,
+  RRC_CONNECTION_ABORT_REQUEST = 0x867,
+  RRC_CONNECTION_SYSTEM_INFORMATION_BLOCK_READ_ERROR = 0x868,
+  NETWORK_INITIATED_DETACH_WITH_AUTO_REATTACH = 0x869,
+  NETWORK_INITIATED_DETACH_NO_AUTO_REATTACH = 0x86A,
+  ESM_PROCEDURE_TIME_OUT = 0x86B,
+  INVALID_CONNECTION_ID = 0x86C,
+  MAXIMIUM_NSAPIS_EXCEEDED = 0x86D,
+  INVALID_PRIMARY_NSAPI = 0x86E,
+  CANNOT_ENCODE_OTA_MESSAGE = 0x86F,
+  RADIO_ACCESS_BEARER_SETUP_FAILURE = 0x870,
+  PDP_ESTABLISH_TIMEOUT_EXPIRED = 0x871,
+  PDP_MODIFY_TIMEOUT_EXPIRED = 0x872,
+  PDP_INACTIVE_TIMEOUT_EXPIRED = 0x873,
+  PDP_LOWERLAYER_ERROR = 0x874,
+  PDP_MODIFY_COLLISION = 0x875,
+  /**
+   * @deprecated use MAXIMUM_SIZE_OF_L2_MESSAGE_EXCEEDED instead.
+   */
+  MAXINUM_SIZE_OF_L2_MESSAGE_EXCEEDED = 0x876,
+  MAXIMUM_SIZE_OF_L2_MESSAGE_EXCEEDED = 0x876,
+  NAS_REQUEST_REJECTED_BY_NETWORK = 0x877,
+  RRC_CONNECTION_INVALID_REQUEST = 0x878,
+  RRC_CONNECTION_TRACKING_AREA_ID_CHANGED = 0x879,
+  RRC_CONNECTION_RF_UNAVAILABLE = 0x87A,
+  RRC_CONNECTION_ABORTED_DUE_TO_IRAT_CHANGE = 0x87B,
+  RRC_CONNECTION_RELEASED_SECURITY_NOT_ACTIVE = 0x87C,
+  RRC_CONNECTION_ABORTED_AFTER_HANDOVER = 0x87D,
+  RRC_CONNECTION_ABORTED_AFTER_IRAT_CELL_CHANGE = 0x87E,
+  RRC_CONNECTION_ABORTED_DURING_IRAT_CELL_CHANGE = 0x87F,
+  IMSI_UNKNOWN_IN_HOME_SUBSCRIBER_SERVER = 0x880,
+  IMEI_NOT_ACCEPTED = 0x881,
+  EPS_SERVICES_AND_NON_EPS_SERVICES_NOT_ALLOWED = 0x882,
+  EPS_SERVICES_NOT_ALLOWED_IN_PLMN = 0x883,
+  MSC_TEMPORARILY_NOT_REACHABLE = 0x884,
+  CS_DOMAIN_NOT_AVAILABLE = 0x885,
+  ESM_FAILURE = 0x886,
+  MAC_FAILURE = 0x887,
+  SYNCHRONIZATION_FAILURE = 0x888,
+  UE_SECURITY_CAPABILITIES_MISMATCH = 0x889,
+  SECURITY_MODE_REJECTED = 0x88A,
+  UNACCEPTABLE_NON_EPS_AUTHENTICATION = 0x88B,
+  CS_FALLBACK_CALL_ESTABLISHMENT_NOT_ALLOWED = 0x88C,
+  NO_EPS_BEARER_CONTEXT_ACTIVATED = 0x88D,
+  INVALID_EMM_STATE = 0x88E,
+  NAS_LAYER_FAILURE = 0x88F,
+  MULTIPLE_PDP_CALL_NOT_ALLOWED = 0x890,
+  EMBMS_NOT_ENABLED = 0x891,
+  IRAT_HANDOVER_FAILED = 0x892,
+  EMBMS_REGULAR_DEACTIVATION = 0x893,
+  TEST_LOOPBACK_REGULAR_DEACTIVATION = 0x894,
+  LOWER_LAYER_REGISTRATION_FAILURE = 0x895,
+  DATA_PLAN_EXPIRED = 0x896,
+  UMTS_HANDOVER_TO_IWLAN = 0x897,
+  EVDO_CONNECTION_DENY_BY_GENERAL_OR_NETWORK_BUSY = 0x898,
+  EVDO_CONNECTION_DENY_BY_BILLING_OR_AUTHENTICATION_FAILURE = 0x899,
+  EVDO_HDR_CHANGED = 0x89A,
+  EVDO_HDR_EXITED = 0x89B,
+  EVDO_HDR_NO_SESSION = 0x89C,
+  EVDO_USING_GPS_FIX_INSTEAD_OF_HDR_CALL = 0x89D,
+  EVDO_HDR_CONNECTION_SETUP_TIMEOUT = 0x89E,
+  FAILED_TO_ACQUIRE_COLOCATED_HDR = 0x89F,
+  OTASP_COMMIT_IN_PROGRESS = 0x8A0,
+  NO_HYBRID_HDR_SERVICE = 0x8A1,
+  HDR_NO_LOCK_GRANTED = 0x8A2,
+  DBM_OR_SMS_IN_PROGRESS = 0x8A3,
+  HDR_FADE = 0x8A4,
+  HDR_ACCESS_FAILURE = 0x8A5,
+  UNSUPPORTED_1X_PREV = 0x8A6,
+  LOCAL_END = 0x8A7,
+  NO_SERVICE = 0x8A8,
+  FADE = 0x8A9,
+  NORMAL_RELEASE = 0x8AA,
+  ACCESS_ATTEMPT_ALREADY_IN_PROGRESS = 0x8AB,
+  REDIRECTION_OR_HANDOFF_IN_PROGRESS = 0x8AC,
+  EMERGENCY_MODE = 0x8AD,
+  PHONE_IN_USE = 0x8AE,
+  INVALID_MODE = 0x8AF,
+  INVALID_SIM_STATE = 0x8B0,
+  NO_COLLOCATED_HDR = 0x8B1,
+  UE_IS_ENTERING_POWERSAVE_MODE = 0x8B2,
+  DUAL_SWITCH = 0x8B3,
+  PPP_TIMEOUT = 0x8B4,
+  PPP_AUTH_FAILURE = 0x8B5,
+  PPP_OPTION_MISMATCH = 0x8B6,
+  PPP_PAP_FAILURE = 0x8B7,
+  PPP_CHAP_FAILURE = 0x8B8,
+  PPP_CLOSE_IN_PROGRESS = 0x8B9,
+  LIMITED_TO_IPV4 = 0x8BA,
+  LIMITED_TO_IPV6 = 0x8BB,
+  VSNCP_TIMEOUT = 0x8BC,
+  VSNCP_GEN_ERROR = 0x8BD,
+  VSNCP_APN_UNAUTHORIZED = 0x8BE,
+  VSNCP_PDN_LIMIT_EXCEEDED = 0x8BF,
+  VSNCP_NO_PDN_GATEWAY_ADDRESS = 0x8C0,
+  VSNCP_PDN_GATEWAY_UNREACHABLE = 0x8C1,
+  VSNCP_PDN_GATEWAY_REJECT = 0x8C2,
+  VSNCP_INSUFFICIENT_PARAMETERS = 0x8C3,
+  VSNCP_RESOURCE_UNAVAILABLE = 0x8C4,
+  VSNCP_ADMINISTRATIVELY_PROHIBITED = 0x8C5,
+  VSNCP_PDN_ID_IN_USE = 0x8C6,
+  VSNCP_SUBSCRIBER_LIMITATION = 0x8C7,
+  VSNCP_PDN_EXISTS_FOR_THIS_APN = 0x8C8,
+  VSNCP_RECONNECT_NOT_ALLOWED = 0x8C9,
+  IPV6_PREFIX_UNAVAILABLE = 0x8CA,
+  HANDOFF_PREFERENCE_CHANGED = 0x8CB,
+  SLICE_REJECTED = 0x8CC,
+  MATCH_ALL_RULE_NOT_ALLOWED = 0x8CD,
+  ALL_MATCHING_RULES_FAILED = 0x8CE,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
index 16fada1..0136fa4 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
@@ -60,7 +60,7 @@
   const int ID_FOTA = 3;
   const int ID_CBS = 4;
   const int ID_OEM_BASE = 1000;
-  const int ID_INVALID = -1;
+  const int ID_INVALID = 0xFFFFFFFF;
   const int TYPE_COMMON = 0;
   const int TYPE_3GPP = 1;
   const int TYPE_3GPP2 = 2;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
index 4f976cd..e80a764 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
@@ -34,8 +34,8 @@
 package android.hardware.radio.data;
 @Backing(type="byte") @JavaDerive(toString=true) @VintfStability
 enum DataThrottlingAction {
-  NO_DATA_THROTTLING = 0,
-  THROTTLE_SECONDARY_CARRIER = 1,
-  THROTTLE_ANCHOR_CARRIER = 2,
-  HOLD = 3,
+  NO_DATA_THROTTLING,
+  THROTTLE_SECONDARY_CARRIER,
+  THROTTLE_ANCHOR_CARRIER,
+  HOLD,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
index 48e646e..77d637b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
@@ -39,5 +39,5 @@
   long deprecationTime;
   long expirationTime;
   const int ADDRESS_PROPERTY_NONE = 0;
-  const int ADDRESS_PROPERTY_DEPRECATED = 32;
+  const int ADDRESS_PROPERTY_DEPRECATED = 0x20;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/NrQos.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/NrQos.aidl
index a0792c3..be859b7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/NrQos.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/NrQos.aidl
@@ -37,12 +37,13 @@
   int fiveQi;
   android.hardware.radio.data.QosBandwidth downlink;
   android.hardware.radio.data.QosBandwidth uplink;
-  /**
-   * @deprecated use qosFlowIdentifier.
-   */
   byte qfi;
+  /**
+   * @deprecated use averagingWindowMillis;
+   */
   char averagingWindowMs;
-  int qosFlowIdentifier;
+  int averagingWindowMillis = AVERAGING_WINDOW_UNKNOWN;
   const byte FLOW_ID_RANGE_MIN = 1;
   const byte FLOW_ID_RANGE_MAX = 63;
+  const int AVERAGING_WINDOW_UNKNOWN = (-1);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PdpProtocolType.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PdpProtocolType.aidl
index 9771e5c..d1c4a62 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PdpProtocolType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PdpProtocolType.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.data;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum PdpProtocolType {
-  UNKNOWN = -1,
+  UNKNOWN = (-1),
   IP = 0,
   IPV6 = 1,
   IPV4V6 = 2,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/QosFilter.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/QosFilter.aidl
index e22b359..de45cc5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/QosFilter.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/QosFilter.aidl
@@ -47,7 +47,7 @@
   const byte DIRECTION_DOWNLINK = 0;
   const byte DIRECTION_UPLINK = 1;
   const byte DIRECTION_BIDIRECTIONAL = 2;
-  const byte PROTOCOL_UNSPECIFIED = -1;
+  const byte PROTOCOL_UNSPECIFIED = (-1);
   const byte PROTOCOL_TCP = 6;
   const byte PROTOCOL_UDP = 17;
   const byte PROTOCOL_ESP = 50;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
index 434ee7d..d83df81 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
@@ -39,7 +39,7 @@
   byte sscMode;
   android.hardware.radio.data.SliceInfo[] sliceInfo;
   String[] dnn;
-  const byte SSC_MODE_UNKNOWN = -1;
+  const byte SSC_MODE_UNKNOWN = (-1);
   const byte SSC_MODE_1 = 1;
   const byte SSC_MODE_2 = 2;
   const byte SSC_MODE_3 = 3;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
index 5179169..84376b7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
@@ -34,13 +34,13 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum AmrMode {
-  AMR_MODE_0 = 1 << 0,
-  AMR_MODE_1 = 1 << 1,
-  AMR_MODE_2 = 1 << 2,
-  AMR_MODE_3 = 1 << 3,
-  AMR_MODE_4 = 1 << 4,
-  AMR_MODE_5 = 1 << 5,
-  AMR_MODE_6 = 1 << 6,
-  AMR_MODE_7 = 1 << 7,
-  AMR_MODE_8 = 1 << 8,
+  AMR_MODE_0 = (1 << 0),
+  AMR_MODE_1 = (1 << 1),
+  AMR_MODE_2 = (1 << 2),
+  AMR_MODE_3 = (1 << 3),
+  AMR_MODE_4 = (1 << 4),
+  AMR_MODE_5 = (1 << 5),
+  AMR_MODE_6 = (1 << 6),
+  AMR_MODE_7 = (1 << 7),
+  AMR_MODE_8 = (1 << 8),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrMode.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrMode.aidl
index 711ac19..c108c07 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrMode.aidl
@@ -32,9 +32,8 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+@JavaDerive(toString=true) @VintfStability
+parcelable AnbrMode {
+  android.hardware.radio.ims.media.CodecMode anbrUplinkMode;
+  android.hardware.radio.ims.media.CodecMode anbrDownlinkMode;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecMode.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecMode.aidl
index 711ac19..0e9140f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecMode.aidl
@@ -32,9 +32,9 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+@JavaDerive(toString=true) @VintfStability
+union CodecMode {
+  boolean noinit;
+  android.hardware.radio.ims.media.AmrMode amr;
+  android.hardware.radio.ims.media.EvsMode evs;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
index 56d2800..9eaf129 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
@@ -34,9 +34,9 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum CodecType {
-  AMR = 1,
-  AMR_WB = 2,
-  EVS = 4,
-  PCMA = 8,
-  PCMU = 16,
+  AMR = (1 << 0),
+  AMR_WB = (1 << 1),
+  EVS = (1 << 2),
+  PCMA = (1 << 3),
+  PCMU = (1 << 4),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
index eb31175..5e80f91 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
@@ -35,8 +35,8 @@
 @Backing(type="int") @VintfStability
 enum EvsBandwidth {
   NONE = 0,
-  NARROW_BAND = 1,
-  WIDE_BAND = 2,
-  SUPER_WIDE_BAND = 4,
-  FULL_BAND = 8,
+  NARROW_BAND = (1 << 0),
+  WIDE_BAND = (1 << 1),
+  SUPER_WIDE_BAND = (1 << 2),
+  FULL_BAND = (1 << 3),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
index a067357..a530a8d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
@@ -34,25 +34,25 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum EvsMode {
-  EVS_MODE_0 = 1 << 0,
-  EVS_MODE_1 = 1 << 1,
-  EVS_MODE_2 = 1 << 2,
-  EVS_MODE_3 = 1 << 3,
-  EVS_MODE_4 = 1 << 4,
-  EVS_MODE_5 = 1 << 5,
-  EVS_MODE_6 = 1 << 6,
-  EVS_MODE_7 = 1 << 7,
-  EVS_MODE_8 = 1 << 8,
-  EVS_MODE_9 = 1 << 9,
-  EVS_MODE_10 = 1 << 10,
-  EVS_MODE_11 = 1 << 11,
-  EVS_MODE_12 = 1 << 12,
-  EVS_MODE_13 = 1 << 13,
-  EVS_MODE_14 = 1 << 14,
-  EVS_MODE_15 = 1 << 15,
-  EVS_MODE_16 = 1 << 16,
-  EVS_MODE_17 = 1 << 17,
-  EVS_MODE_18 = 1 << 18,
-  EVS_MODE_19 = 1 << 19,
-  EVS_MODE_20 = 1 << 20,
+  EVS_MODE_0 = (1 << 0),
+  EVS_MODE_1 = (1 << 1),
+  EVS_MODE_2 = (1 << 2),
+  EVS_MODE_3 = (1 << 3),
+  EVS_MODE_4 = (1 << 4),
+  EVS_MODE_5 = (1 << 5),
+  EVS_MODE_6 = (1 << 6),
+  EVS_MODE_7 = (1 << 7),
+  EVS_MODE_8 = (1 << 8),
+  EVS_MODE_9 = (1 << 9),
+  EVS_MODE_10 = (1 << 10),
+  EVS_MODE_11 = (1 << 11),
+  EVS_MODE_12 = (1 << 12),
+  EVS_MODE_13 = (1 << 13),
+  EVS_MODE_14 = (1 << 14),
+  EVS_MODE_15 = (1 << 15),
+  EVS_MODE_16 = (1 << 16),
+  EVS_MODE_17 = (1 << 17),
+  EVS_MODE_18 = (1 << 18),
+  EVS_MODE_19 = (1 << 19),
+  EVS_MODE_20 = (1 << 20),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
index 2eefe6f..0663754 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
@@ -35,11 +35,11 @@
 @Backing(type="int") @VintfStability
 enum RtcpXrReportBlockType {
   RTCPXR_NONE = 0,
-  RTCPXR_LOSS_RLE_REPORT_BLOCK = 1,
-  RTCPXR_DUPLICATE_RLE_REPORT_BLOCK = 2,
-  RTCPXR_PACKET_RECEIPT_TIMES_REPORT_BLOCK = 4,
-  RTCPXR_RECEIVER_REFERENCE_TIME_REPORT_BLOCK = 8,
-  RTCPXR_DLRR_REPORT_BLOCK = 16,
-  RTCPXR_STATISTICS_SUMMARY_REPORT_BLOCK = 32,
-  RTCPXR_VOIP_METRICS_REPORT_BLOCK = 64,
+  RTCPXR_LOSS_RLE_REPORT_BLOCK = (1 << 0),
+  RTCPXR_DUPLICATE_RLE_REPORT_BLOCK = (1 << 1),
+  RTCPXR_PACKET_RECEIPT_TIMES_REPORT_BLOCK = (1 << 2),
+  RTCPXR_RECEIVER_REFERENCE_TIME_REPORT_BLOCK = (1 << 3),
+  RTCPXR_DLRR_REPORT_BLOCK = (1 << 4),
+  RTCPXR_STATISTICS_SUMMARY_REPORT_BLOCK = (1 << 5),
+  RTCPXR_VOIP_METRICS_REPORT_BLOCK = (1 << 6),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
index ad8b86c..1a8921e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -39,5 +39,5 @@
   android.hardware.radio.ims.media.RtpAddress remoteAddress;
   android.hardware.radio.ims.media.RtpSessionParams sessionParams;
   android.hardware.radio.ims.media.RtcpConfig rtcpConfig;
-  android.hardware.radio.ims.media.AnbrBitrate anbrBitrateParams;
+  android.hardware.radio.ims.media.AnbrMode anbrModeParams;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
index 030479f..90e75f9 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
@@ -48,6 +48,6 @@
     REASON_NO_SERVICE = 7,
     REASON_PDN_NOT_AVAILABLE = 8,
     REASON_RF_BUSY = 9,
-    REASON_UNSPECIFIED = 65535,
+    REASON_UNSPECIFIED = 0xFFFF,
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
index e48653b..6e14830 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
@@ -42,23 +42,23 @@
   boolean isHeldByRemote;
   @Backing(type="int")
   enum CallType {
-    NORMAL = 0,
-    EMERGENCY = 1,
+    NORMAL,
+    EMERGENCY,
   }
   @Backing(type="int")
   enum CallState {
-    ACTIVE = 0,
-    HOLDING = 1,
-    DIALING = 2,
-    ALERTING = 3,
-    INCOMING = 4,
-    WAITING = 5,
-    DISCONNECTING = 6,
-    DISCONNECTED = 7,
+    ACTIVE,
+    HOLDING,
+    DIALING,
+    ALERTING,
+    INCOMING,
+    WAITING,
+    DISCONNECTING,
+    DISCONNECTED,
   }
   @Backing(type="int")
   enum Direction {
-    INCOMING = 0,
-    OUTGOING = 1,
+    INCOMING,
+    OUTGOING,
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
index 1c4c12a..be5e004 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
@@ -39,8 +39,8 @@
   android.hardware.radio.ims.SuggestedAction suggestedAction;
   int capabilities;
   const int IMS_MMTEL_CAPABILITY_NONE = 0;
-  const int IMS_MMTEL_CAPABILITY_VOICE = 1;
-  const int IMS_MMTEL_CAPABILITY_VIDEO = 2;
-  const int IMS_MMTEL_CAPABILITY_SMS = 4;
-  const int IMS_RCS_CAPABILITIES = 8;
+  const int IMS_MMTEL_CAPABILITY_VOICE = (1 << 0);
+  const int IMS_MMTEL_CAPABILITY_VIDEO = (1 << 1);
+  const int IMS_MMTEL_CAPABILITY_SMS = (1 << 2);
+  const int IMS_RCS_CAPABILITIES = (1 << 3);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistrationState.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistrationState.aidl
index 664f561..6302b47 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistrationState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistrationState.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.ims;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ImsRegistrationState {
-  NOT_REGISTERED = 0,
-  REGISTERED = 1,
+  NOT_REGISTERED,
+  REGISTERED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsTrafficType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsTrafficType.aidl
index f7654b4..b1a0b77 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsTrafficType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsTrafficType.aidl
@@ -34,11 +34,11 @@
 package android.hardware.radio.ims;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ImsTrafficType {
-  EMERGENCY = 0,
-  EMERGENCY_SMS = 1,
-  VOICE = 2,
-  VIDEO = 3,
-  SMS = 4,
-  REGISTRATION = 5,
-  UT_XCAP = 6,
+  EMERGENCY,
+  EMERGENCY_SMS,
+  VOICE,
+  VIDEO,
+  SMS,
+  REGISTRATION,
+  UT_XCAP,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
index a8b7cfc..5119b0f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
@@ -47,18 +47,18 @@
   int namePresentation;
   @Backing(type="int") @VintfStability
   enum CallType {
-    NORMAL = 0,
-    EMERGENCY = 1,
+    NORMAL,
+    EMERGENCY,
   }
   @Backing(type="int") @VintfStability
   enum CallSubState {
-    NONE = 0,
-    PREALERTING = 1,
+    NONE,
+    PREALERTING,
   }
   @Backing(type="int") @VintfStability
   enum ToneType {
-    NONE = 0,
-    LOCAL = 1,
-    NETWORK = 2,
+    NONE,
+    LOCAL,
+    NETWORK,
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SuggestedAction.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SuggestedAction.aidl
index da19774..bbe170e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SuggestedAction.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SuggestedAction.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.ims;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum SuggestedAction {
-  NONE = 0,
-  TRIGGER_PLMN_BLOCK = 1,
-  TRIGGER_PLMN_BLOCK_WITH_TIMEOUT = 2,
+  NONE,
+  TRIGGER_PLMN_BLOCK,
+  TRIGGER_PLMN_BLOCK_WITH_TIMEOUT,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/SmsAcknowledgeFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/SmsAcknowledgeFailCause.aidl
index 019b185..d061c9e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/SmsAcknowledgeFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/SmsAcknowledgeFailCause.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.messaging;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum SmsAcknowledgeFailCause {
-  MEMORY_CAPACITY_EXCEEDED = 211,
-  UNSPECIFIED_ERROR = 255,
+  MEMORY_CAPACITY_EXCEEDED = 0xD3,
+  UNSPECIFIED_ERROR = 0XFF,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/DeviceStateType.aidl b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/DeviceStateType.aidl
index 4e8c6d7..acc0b22 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/DeviceStateType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/DeviceStateType.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.modem;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum DeviceStateType {
-  POWER_SAVE_MODE = 0,
-  CHARGING_STATE = 1,
-  LOW_DATA_EXPECTED = 2,
+  POWER_SAVE_MODE,
+  CHARGING_STATE,
+  LOW_DATA_EXPECTED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ImeiInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ImeiInfo.aidl
index dda7062..f8776ec 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ImeiInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ImeiInfo.aidl
@@ -34,12 +34,12 @@
 package android.hardware.radio.modem;
 @JavaDerive(toString=true) @VintfStability
 parcelable ImeiInfo {
+  android.hardware.radio.modem.ImeiInfo.ImeiType type;
+  String imei;
+  String svn;
   @Backing(type="int") @VintfStability
   enum ImeiType {
     PRIMARY = 1,
     SECONDARY = 2,
   }
-  ImeiType type;
-  String imei;
-  String svn;
-}
\ No newline at end of file
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ResetNvType.aidl b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ResetNvType.aidl
index e3b5796..37622b1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ResetNvType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.modem/current/android/hardware/radio/modem/ResetNvType.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.modem;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ResetNvType {
-  RELOAD = 0,
-  ERASE = 1,
-  FACTORY_RESET = 2,
+  RELOAD,
+  ERASE,
+  FACTORY_RESET,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Cdma2000RegistrationInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Cdma2000RegistrationInfo.aidl
index 74c4e29..927f9ac 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Cdma2000RegistrationInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Cdma2000RegistrationInfo.aidl
@@ -38,7 +38,7 @@
   int roamingIndicator;
   int systemIsInPrl;
   int defaultRoamingIndicator;
-  const int PRL_INDICATOR_NOT_REGISTERED = -1;
+  const int PRL_INDICATOR_NOT_REGISTERED = (-1);
   const int PRL_INDICATOR_NOT_IN_PRL = 0;
   const int PRL_INDICATOR_IN_PRL = 1;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CdmaRoamingType.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CdmaRoamingType.aidl
index 24ec26b..2a4db70 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CdmaRoamingType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CdmaRoamingType.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.network;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CdmaRoamingType {
-  HOME_NETWORK = 0,
-  AFFILIATED_ROAM = 1,
-  ANY_ROAM = 2,
+  HOME_NETWORK,
+  AFFILIATED_ROAM,
+  ANY_ROAM,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellConnectionStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellConnectionStatus.aidl
index 8986d71..5ce3b3e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellConnectionStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellConnectionStatus.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.network;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CellConnectionStatus {
-  NONE = 0,
-  PRIMARY_SERVING = 1,
-  SECONDARY_SERVING = 2,
+  NONE,
+  PRIMARY_SERVING,
+  SECONDARY_SERVING,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
index 209cf5e..6b022b6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.network;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum Domain {
-  CS = 1,
-  PS = 2,
+  CS = (1 << 0),
+  PS = (1 << 1),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
index 93df3a4..90e342a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
@@ -38,11 +38,11 @@
   android.hardware.radio.network.NrIndicators nrIndicators;
   android.hardware.radio.network.EutranRegistrationInfo.AttachResultType lteAttachResultType;
   int extraInfo;
-  const int EXTRA_CSFB_NOT_PREFERRED = 1;
-  const int EXTRA_SMS_ONLY = 2;
+  const int EXTRA_CSFB_NOT_PREFERRED = (1 << 0);
+  const int EXTRA_SMS_ONLY = (1 << 1);
   enum AttachResultType {
-    NONE = 0,
-    EPS_ONLY = 1,
-    COMBINED = 2,
+    NONE,
+    EPS_ONLY,
+    COMBINED,
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/IndicationFilter.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/IndicationFilter.aidl
index d9ed68e..00ba346 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/IndicationFilter.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/IndicationFilter.aidl
@@ -35,12 +35,12 @@
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum IndicationFilter {
   NONE = 0,
-  ALL = -1,
-  SIGNAL_STRENGTH = 1,
-  FULL_NETWORK_STATE = 2,
-  DATA_CALL_DORMANCY_CHANGED = 4,
-  LINK_CAPACITY_ESTIMATE = 8,
-  PHYSICAL_CHANNEL_CONFIG = 16,
-  REGISTRATION_FAILURE = 32,
-  BARRING_INFO = 64,
+  ALL = (~0),
+  SIGNAL_STRENGTH = (1 << 0),
+  FULL_NETWORK_STATE = (1 << 1),
+  DATA_CALL_DORMANCY_CHANGED = (1 << 2),
+  LINK_CAPACITY_ESTIMATE = (1 << 3),
+  PHYSICAL_CHANNEL_CONFIG = (1 << 4),
+  REGISTRATION_FAILURE = (1 << 5),
+  BARRING_INFO = (1 << 6),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhoneRestrictedState.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhoneRestrictedState.aidl
index 41555f9..4e3e39e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhoneRestrictedState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhoneRestrictedState.aidl
@@ -34,9 +34,9 @@
 package android.hardware.radio.network;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum PhoneRestrictedState {
-  NONE = 0,
-  CS_EMERGENCY = 1,
-  CS_NORMAL = 2,
-  CS_ALL = 4,
-  PS_ALL = 16,
+  NONE = 0x00,
+  CS_EMERGENCY = 0x01,
+  CS_NORMAL = 0x02,
+  CS_ALL = 0x04,
+  PS_ALL = 0x10,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
index e9a9f60..74696fb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
@@ -34,23 +34,23 @@
 package android.hardware.radio.network;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioBandMode {
-  BAND_MODE_UNSPECIFIED = 0,
-  BAND_MODE_EURO = 1,
-  BAND_MODE_USA = 2,
-  BAND_MODE_JPN = 3,
-  BAND_MODE_AUS = 4,
-  BAND_MODE_AUS_2 = 5,
-  BAND_MODE_CELL_800 = 6,
-  BAND_MODE_PCS = 7,
-  BAND_MODE_JTACS = 8,
-  BAND_MODE_KOREA_PCS = 9,
-  BAND_MODE_5_450M = 10,
-  BAND_MODE_IMT2000 = 11,
-  BAND_MODE_7_700M_2 = 12,
-  BAND_MODE_8_1800M = 13,
-  BAND_MODE_9_900M = 14,
-  BAND_MODE_10_800M_2 = 15,
-  BAND_MODE_EURO_PAMR_400M = 16,
-  BAND_MODE_AWS = 17,
-  BAND_MODE_USA_2500M = 18,
+  BAND_MODE_UNSPECIFIED,
+  BAND_MODE_EURO,
+  BAND_MODE_USA,
+  BAND_MODE_JPN,
+  BAND_MODE_AUS,
+  BAND_MODE_AUS_2,
+  BAND_MODE_CELL_800,
+  BAND_MODE_PCS,
+  BAND_MODE_JTACS,
+  BAND_MODE_KOREA_PCS,
+  BAND_MODE_5_450M,
+  BAND_MODE_IMT2000,
+  BAND_MODE_7_700M_2,
+  BAND_MODE_8_1800M,
+  BAND_MODE_9_900M,
+  BAND_MODE_10_800M_2,
+  BAND_MODE_EURO_PAMR_400M,
+  BAND_MODE_AWS,
+  BAND_MODE_USA_2500M,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegistrationFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegistrationFailCause.aidl
index e2cd44c..8acf8ab 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegistrationFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegistrationFailCause.aidl
@@ -56,7 +56,7 @@
   CONGESTION = 22,
   GSM_AUTHENTICATION_UNACCEPTABLE = 23,
   NOT_AUTHORIZED_FOR_THIS_CSG = 25,
-  SMS_PROVIDED_BY_GPRS_IN_ROUTING_AREA = 26,
+  SMS_PROVIDED_BY_GPRS_IN_ROUTING_AREA,
   SERVICE_OPTION_NOT_SUPPORTED = 32,
   SERVICE_OPTION_NOT_SUBSCRIBED = 33,
   SERVICE_OPTION_TEMPORARILY_OUT_OF_ORDER = 34,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapApduType.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapApduType.aidl
index e0e2a03..6cef92b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapApduType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapApduType.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapApduType {
-  APDU = 0,
-  APDU7816 = 1,
+  APDU,
+  APDU7816,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapConnectRsp.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapConnectRsp.aidl
index aceac37..841dfe3 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapConnectRsp.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapConnectRsp.aidl
@@ -34,9 +34,9 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapConnectRsp {
-  SUCCESS = 0,
-  CONNECT_FAILURE = 1,
-  MSG_SIZE_TOO_LARGE = 2,
-  MSG_SIZE_TOO_SMALL = 3,
-  CONNECT_OK_CALL_ONGOING = 4,
+  SUCCESS,
+  CONNECT_FAILURE,
+  MSG_SIZE_TOO_LARGE,
+  MSG_SIZE_TOO_SMALL,
+  CONNECT_OK_CALL_ONGOING,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapDisconnectType.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapDisconnectType.aidl
index 0447f9b..dace1e1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapDisconnectType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapDisconnectType.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapDisconnectType {
-  GRACEFUL = 0,
-  IMMEDIATE = 1,
+  GRACEFUL,
+  IMMEDIATE,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapResultCode.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapResultCode.aidl
index 1db226b..a2a6df0 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapResultCode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapResultCode.aidl
@@ -34,12 +34,12 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapResultCode {
-  SUCCESS = 0,
-  GENERIC_FAILURE = 1,
-  CARD_NOT_ACCESSSIBLE = 2,
-  CARD_ALREADY_POWERED_OFF = 3,
-  CARD_REMOVED = 4,
-  CARD_ALREADY_POWERED_ON = 5,
-  DATA_NOT_AVAILABLE = 6,
-  NOT_SUPPORTED = 7,
+  SUCCESS,
+  GENERIC_FAILURE,
+  CARD_NOT_ACCESSSIBLE,
+  CARD_ALREADY_POWERED_OFF,
+  CARD_REMOVED,
+  CARD_ALREADY_POWERED_ON,
+  DATA_NOT_AVAILABLE,
+  NOT_SUPPORTED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapStatus.aidl
index 32f71c2..6988c99 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapStatus.aidl
@@ -34,10 +34,10 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapStatus {
-  UNKNOWN_ERROR = 0,
-  CARD_RESET = 1,
-  CARD_NOT_ACCESSIBLE = 2,
-  CARD_REMOVED = 3,
-  CARD_INSERTED = 4,
-  RECOVERED = 5,
+  UNKNOWN_ERROR,
+  CARD_RESET,
+  CARD_NOT_ACCESSIBLE,
+  CARD_REMOVED,
+  CARD_INSERTED,
+  RECOVERED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapTransferProtocol.aidl b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapTransferProtocol.aidl
index e3ffdb0..3c6852e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapTransferProtocol.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sap/current/android/hardware/radio/sap/SapTransferProtocol.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.sap;
 @Backing(type="int") @VintfStability
 enum SapTransferProtocol {
-  T0 = 0,
-  T1 = 1,
+  T0,
+  T1,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatellite.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatellite.aidl
new file mode 100644
index 0000000..a00e4f5
--- /dev/null
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatellite.aidl
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.radio.satellite;
+@VintfStability
+interface IRadioSatellite {
+  oneway void addAllowedSatelliteContacts(in int serial, in String[] contacts);
+  oneway void getCapabilities(in int serial);
+  oneway void getMaxCharactersPerTextMessage(in int serial);
+  oneway void getPendingMessages(in int serial);
+  oneway void getPowerState(in int serial);
+  oneway void getSatelliteMode(in int serial);
+  oneway void getTimeForNextSatelliteVisibility(in int serial);
+  oneway void provisionService(in int serial, in String imei, in String msisdn, in String imsi, in android.hardware.radio.satellite.SatelliteFeature[] features);
+  oneway void removeAllowedSatelliteContacts(in int serial, in String[] contacts);
+  oneway void responseAcknowledgement();
+  oneway void sendMessages(in int serial, in String[] messages, in String destination, in double latitude, in double longitude);
+  oneway void setIndicationFilter(in int serial, in int filterBitmask);
+  oneway void setPower(in int serial, in boolean on);
+  oneway void setResponseFunctions(in android.hardware.radio.satellite.IRadioSatelliteResponse satelliteResponse, in android.hardware.radio.satellite.IRadioSatelliteIndication satelliteIndication);
+  oneway void startSendingSatellitePointingInfo(in int serial);
+  oneway void stopSendingSatellitePointingInfo(in int serial);
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl
similarity index 61%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl
index 711ac19..6a03f26 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl
@@ -31,10 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.radio.satellite;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+interface IRadioSatelliteIndication {
+  oneway void onMessagesTransferComplete(in android.hardware.radio.RadioIndicationType type, in boolean complete);
+  oneway void onNewMessages(in android.hardware.radio.RadioIndicationType type, in String[] messages);
+  oneway void onPendingMessageCount(in android.hardware.radio.RadioIndicationType type, in int count);
+  oneway void onProvisionStateChanged(in android.hardware.radio.RadioIndicationType type, boolean provisioned, in android.hardware.radio.satellite.SatelliteFeature[] features);
+  oneway void onSatelliteModeChanged(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.satellite.SatelliteMode mode);
+  oneway void onSatellitePointingInfoChanged(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.satellite.PointingInfo pointingInfo);
+  oneway void onSatelliteRadioTechnologyChanged(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.satellite.NTRadioTechnology technology);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl
new file mode 100644
index 0000000..f6614b1
--- /dev/null
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.radio.satellite;
+@VintfStability
+interface IRadioSatelliteResponse {
+  oneway void acknowledgeRequest(in int serial);
+  oneway void addAllowedSatelliteContactsResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void getCapabilitiesResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.satellite.SatelliteCapabilities capabilities);
+  oneway void getMaxCharactersPerTextMessageResponse(in android.hardware.radio.RadioResponseInfo info, in int charLimit);
+  oneway void getPendingMessagesResponse(in android.hardware.radio.RadioResponseInfo info, in String[] messages);
+  oneway void getPowerStateResponse(in android.hardware.radio.RadioResponseInfo info, in boolean on);
+  oneway void getSatelliteModeResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.satellite.SatelliteMode mode, in android.hardware.radio.satellite.NTRadioTechnology technology);
+  oneway void getTimeForNextSatelliteVisibilityResponse(in android.hardware.radio.RadioResponseInfo info, in int timeInSeconds);
+  oneway void provisionServiceResponse(in android.hardware.radio.RadioResponseInfo info, in boolean provisioned);
+  oneway void removeAllowedSatelliteContactsResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void sendMessagesResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void setIndicationFilterResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void setPowerResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void startSendingSatellitePointingInfoResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void stopSendingSatellitePointingInfoResponse(in android.hardware.radio.RadioResponseInfo info);
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IndicationFilter.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IndicationFilter.aidl
index 711ac19..5aa5739 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/IndicationFilter.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+enum IndicationFilter {
+  NONE = 0,
+  SATELLITE_MODE = 1,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/NTRadioTechnology.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/NTRadioTechnology.aidl
index 711ac19..29de55f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/NTRadioTechnology.aidl
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+enum NTRadioTechnology {
+  NB_IOT_NTN = 0,
+  NR_NTN = 1,
+  EMTC_NTN = 2,
+  PROPRIETARY = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/PointingInfo.aidl
similarity index 85%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/PointingInfo.aidl
index 711ac19..dcfce34 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/PointingInfo.aidl
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@JavaDerive(toString=true) @VintfStability
+parcelable PointingInfo {
+  float satelliteAzimuthDegrees;
+  float satelliteElevationDegrees;
+  float antennaAzimuthDegrees;
+  float antennaPitchDegrees;
+  float antennaRollDegrees;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteCapabilities.aidl
similarity index 81%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteCapabilities.aidl
index 711ac19..407a9d1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteCapabilities.aidl
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@JavaDerive(toString=true) @VintfStability
+parcelable SatelliteCapabilities {
+  android.hardware.radio.satellite.NTRadioTechnology[] supportedRadioTechnologies;
+  boolean isAlwaysOn;
+  boolean needsPointingToSatellite;
+  android.hardware.radio.satellite.SatelliteFeature[] supportedFeatures;
+  boolean needsSeparateSimProfile;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteFeature.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteFeature.aidl
index 711ac19..315359d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteFeature.aidl
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+enum SatelliteFeature {
+  SOS_SMS = 0,
+  EMERGENCY_SMS = 1,
+  SMS = 2,
+  LOCATION_SHARING = 3,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteMode.aidl
similarity index 86%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteMode.aidl
index 711ac19..1cf6a2c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.satellite/current/android/hardware/radio/satellite/SatelliteMode.aidl
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.radio.satellite;
+@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+enum SatelliteMode {
+  POWERED_OFF = 0,
+  OUT_OF_SERVICE_NOT_SEARCHING = 1,
+  OUT_OF_SERVICE_SEARCHING = 2,
+  ACQUIRED = 3,
+  MESSAGE_TRANSFERRING = 4,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
index 05bc13a..6bc3919 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.sim;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CardPowerState {
-  POWER_DOWN = 0,
-  POWER_UP = 1,
-  POWER_UP_PASS_THROUGH = 2,
+  POWER_DOWN,
+  POWER_UP,
+  POWER_UP_PASS_THROUGH,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
index 8a61dca..3700de3 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -34,15 +34,14 @@
 package android.hardware.radio.sim;
 @JavaDerive(toString=true) @VintfStability
 parcelable CarrierRestrictions {
-    @Backing(type="int") @VintfStability
-    enum CarrierRestrictionStatus {
-        UNKNOWN = 0,
-        NOT_RESTRICTED = 1,
-        RESTRICTED = 2,
-    }
-    android.hardware.radio.sim.Carrier[] allowedCarriers;
-    android.hardware.radio.sim.Carrier[] excludedCarriers;
-    boolean allowedCarriersPrioritized;
-    CarrierRestrictionStatus status;
-    int carrierId;
+  android.hardware.radio.sim.Carrier[] allowedCarriers;
+  android.hardware.radio.sim.Carrier[] excludedCarriers;
+  boolean allowedCarriersPrioritized;
+  android.hardware.radio.sim.CarrierRestrictions.CarrierRestrictionStatus status;
+  @Backing(type="int") @VintfStability
+  enum CarrierRestrictionStatus {
+    UNKNOWN = 0,
+    NOT_RESTRICTED = 1,
+    RESTRICTED = 2,
+  }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CdmaSubscriptionSource.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CdmaSubscriptionSource.aidl
index 13469f3..080aa5e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CdmaSubscriptionSource.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CdmaSubscriptionSource.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.sim;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CdmaSubscriptionSource {
-  RUIM_SIM = 0,
-  NV = 1,
+  RUIM_SIM,
+  NV,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PersoSubstate.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PersoSubstate.aidl
index e33769e..dc1d960 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PersoSubstate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PersoSubstate.aidl
@@ -34,39 +34,39 @@
 package android.hardware.radio.sim;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum PersoSubstate {
-  UNKNOWN = 0,
-  IN_PROGRESS = 1,
-  READY = 2,
-  SIM_NETWORK = 3,
-  SIM_NETWORK_SUBSET = 4,
-  SIM_CORPORATE = 5,
-  SIM_SERVICE_PROVIDER = 6,
-  SIM_SIM = 7,
-  SIM_NETWORK_PUK = 8,
-  SIM_NETWORK_SUBSET_PUK = 9,
-  SIM_CORPORATE_PUK = 10,
-  SIM_SERVICE_PROVIDER_PUK = 11,
-  SIM_SIM_PUK = 12,
-  RUIM_NETWORK1 = 13,
-  RUIM_NETWORK2 = 14,
-  RUIM_HRPD = 15,
-  RUIM_CORPORATE = 16,
-  RUIM_SERVICE_PROVIDER = 17,
-  RUIM_RUIM = 18,
-  RUIM_NETWORK1_PUK = 19,
-  RUIM_NETWORK2_PUK = 20,
-  RUIM_HRPD_PUK = 21,
-  RUIM_CORPORATE_PUK = 22,
-  RUIM_SERVICE_PROVIDER_PUK = 23,
-  RUIM_RUIM_PUK = 24,
-  SIM_SPN = 25,
-  SIM_SPN_PUK = 26,
-  SIM_SP_EHPLMN = 27,
-  SIM_SP_EHPLMN_PUK = 28,
-  SIM_ICCID = 29,
-  SIM_ICCID_PUK = 30,
-  SIM_IMPI = 31,
-  SIM_IMPI_PUK = 32,
-  SIM_NS_SP = 33,
-  SIM_NS_SP_PUK = 34,
+  UNKNOWN,
+  IN_PROGRESS,
+  READY,
+  SIM_NETWORK,
+  SIM_NETWORK_SUBSET,
+  SIM_CORPORATE,
+  SIM_SERVICE_PROVIDER,
+  SIM_SIM,
+  SIM_NETWORK_PUK,
+  SIM_NETWORK_SUBSET_PUK,
+  SIM_CORPORATE_PUK,
+  SIM_SERVICE_PROVIDER_PUK,
+  SIM_SIM_PUK,
+  RUIM_NETWORK1,
+  RUIM_NETWORK2,
+  RUIM_HRPD,
+  RUIM_CORPORATE,
+  RUIM_SERVICE_PROVIDER,
+  RUIM_RUIM,
+  RUIM_NETWORK1_PUK,
+  RUIM_NETWORK2_PUK,
+  RUIM_HRPD_PUK,
+  RUIM_CORPORATE_PUK,
+  RUIM_SERVICE_PROVIDER_PUK,
+  RUIM_RUIM_PUK,
+  SIM_SPN,
+  SIM_SPN_PUK,
+  SIM_SP_EHPLMN,
+  SIM_SP_EHPLMN_PUK,
+  SIM_ICCID,
+  SIM_ICCID_PUK,
+  SIM_IMPI,
+  SIM_IMPI_PUK,
+  SIM_NS_SP,
+  SIM_NS_SP_PUK,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PinState.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PinState.aidl
index 5cdc6d1..663ea73 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PinState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PinState.aidl
@@ -34,10 +34,10 @@
 package android.hardware.radio.sim;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum PinState {
-  UNKNOWN = 0,
-  ENABLED_NOT_VERIFIED = 1,
-  ENABLED_VERIFIED = 2,
-  DISABLED = 3,
-  ENABLED_BLOCKED = 4,
-  ENABLED_PERM_BLOCKED = 5,
+  UNKNOWN,
+  ENABLED_NOT_VERIFIED,
+  ENABLED_VERIFIED,
+  DISABLED,
+  ENABLED_BLOCKED,
+  ENABLED_PERM_BLOCKED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
index 4ded3e9..d59fcab 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio.sim;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum SimLockMultiSimPolicy {
-  NO_MULTISIM_POLICY = 0,
-  ONE_VALID_SIM_MUST_BE_PRESENT = 1,
+  NO_MULTISIM_POLICY,
+  ONE_VALID_SIM_MUST_BE_PRESENT,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/AudioQuality.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/AudioQuality.aidl
index 15669ac..1ab2902 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/AudioQuality.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/AudioQuality.aidl
@@ -34,14 +34,14 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum AudioQuality {
-  UNSPECIFIED = 0,
-  AMR = 1,
-  AMR_WB = 2,
-  GSM_EFR = 3,
-  GSM_FR = 4,
-  GSM_HR = 5,
-  EVRC = 6,
-  EVRC_B = 7,
-  EVRC_WB = 8,
-  EVRC_NW = 9,
+  UNSPECIFIED,
+  AMR,
+  AMR_WB,
+  GSM_EFR,
+  GSM_FR,
+  GSM_HR,
+  EVRC,
+  EVRC_B,
+  EVRC_WB,
+  EVRC_NW,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaOtaProvisionStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaOtaProvisionStatus.aidl
index 7877fda..fad3841 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaOtaProvisionStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaOtaProvisionStatus.aidl
@@ -34,16 +34,16 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CdmaOtaProvisionStatus {
-  SPL_UNLOCKED = 0,
-  SPC_RETRIES_EXCEEDED = 1,
-  A_KEY_EXCHANGED = 2,
-  SSD_UPDATED = 3,
-  NAM_DOWNLOADED = 4,
-  MDN_DOWNLOADED = 5,
-  IMSI_DOWNLOADED = 6,
-  PRL_DOWNLOADED = 7,
-  COMMITTED = 8,
-  OTAPA_STARTED = 9,
-  OTAPA_STOPPED = 10,
-  OTAPA_ABORTED = 11,
+  SPL_UNLOCKED,
+  SPC_RETRIES_EXCEEDED,
+  A_KEY_EXCHANGED,
+  SSD_UPDATED,
+  NAM_DOWNLOADED,
+  MDN_DOWNLOADED,
+  IMSI_DOWNLOADED,
+  PRL_DOWNLOADED,
+  COMMITTED,
+  OTAPA_STARTED,
+  OTAPA_STOPPED,
+  OTAPA_ABORTED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
index 3fbb0d8..a34149a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum ClipStatus {
-  CLIP_PROVISIONED = 0,
-  CLIP_UNPROVISIONED = 1,
-  UNKNOWN = 2,
+  CLIP_PROVISIONED,
+  CLIP_UNPROVISIONED,
+  UNKNOWN,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
index 07f011d..4e1dfc0 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum EmergencyCallRouting {
-  UNKNOWN = 0,
-  EMERGENCY = 1,
-  NORMAL = 2,
+  UNKNOWN,
+  EMERGENCY,
+  NORMAL,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyNumber.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyNumber.aidl
index 98df8cd..ac3867e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyNumber.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyNumber.aidl
@@ -40,8 +40,8 @@
   int categories;
   String[] urns;
   int sources;
-  const int SOURCE_NETWORK_SIGNALING = 1;
-  const int SOURCE_SIM = 2;
-  const int SOURCE_MODEM_CONFIG = 4;
-  const int SOURCE_DEFAULT = 8;
+  const int SOURCE_NETWORK_SIGNALING = (1 << 0);
+  const int SOURCE_SIM = (1 << 1);
+  const int SOURCE_MODEM_CONFIG = (1 << 2);
+  const int SOURCE_DEFAULT = (1 << 3);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyServiceCategory.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyServiceCategory.aidl
index 042dd61..0a70d2d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyServiceCategory.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyServiceCategory.aidl
@@ -35,11 +35,11 @@
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum EmergencyServiceCategory {
   UNSPECIFIED = 0,
-  POLICE = 1,
-  AMBULANCE = 2,
-  FIRE_BRIGADE = 4,
-  MARINE_GUARD = 8,
-  MOUNTAIN_RESCUE = 16,
-  MIEC = 32,
-  AIEC = 64,
+  POLICE = (1 << 0),
+  AMBULANCE = (1 << 1),
+  FIRE_BRIGADE = (1 << 2),
+  MARINE_GUARD = (1 << 3),
+  MOUNTAIN_RESCUE = (1 << 4),
+  MIEC = (1 << 5),
+  AIEC = (1 << 6),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
index 1740134..7d54623 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
@@ -114,20 +114,20 @@
   CDMA_PREEMPTED = 1007,
   CDMA_NOT_EMERGENCY = 1008,
   CDMA_ACCESS_BLOCKED = 1009,
-  OEM_CAUSE_1 = 61441,
-  OEM_CAUSE_2 = 61442,
-  OEM_CAUSE_3 = 61443,
-  OEM_CAUSE_4 = 61444,
-  OEM_CAUSE_5 = 61445,
-  OEM_CAUSE_6 = 61446,
-  OEM_CAUSE_7 = 61447,
-  OEM_CAUSE_8 = 61448,
-  OEM_CAUSE_9 = 61449,
-  OEM_CAUSE_10 = 61450,
-  OEM_CAUSE_11 = 61451,
-  OEM_CAUSE_12 = 61452,
-  OEM_CAUSE_13 = 61453,
-  OEM_CAUSE_14 = 61454,
-  OEM_CAUSE_15 = 61455,
-  ERROR_UNSPECIFIED = 65535,
+  OEM_CAUSE_1 = 0xf001,
+  OEM_CAUSE_2 = 0xf002,
+  OEM_CAUSE_3 = 0xf003,
+  OEM_CAUSE_4 = 0xf004,
+  OEM_CAUSE_5 = 0xf005,
+  OEM_CAUSE_6 = 0xf006,
+  OEM_CAUSE_7 = 0xf007,
+  OEM_CAUSE_8 = 0xf008,
+  OEM_CAUSE_9 = 0xf009,
+  OEM_CAUSE_10 = 0xf00a,
+  OEM_CAUSE_11 = 0xf00b,
+  OEM_CAUSE_12 = 0xf00c,
+  OEM_CAUSE_13 = 0xf00d,
+  OEM_CAUSE_14 = 0xf00e,
+  OEM_CAUSE_15 = 0xf00f,
+  ERROR_UNSPECIFIED = 0xffff,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SrvccState.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SrvccState.aidl
index 864374b..4b5c216 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SrvccState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SrvccState.aidl
@@ -34,8 +34,8 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum SrvccState {
-  HANDOVER_STARTED = 0,
-  HANDOVER_COMPLETED = 1,
-  HANDOVER_FAILED = 2,
-  HANDOVER_CANCELED = 3,
+  HANDOVER_STARTED,
+  HANDOVER_COMPLETED,
+  HANDOVER_FAILED,
+  HANDOVER_CANCELED,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
index 50bb1fd..75f3de5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
@@ -72,13 +72,13 @@
   const int TELESERVICE_TYPE_SMS_SERVICES = 4;
   const int TELESERVICE_TYPE_ALL_TELESERVICES_EXCEPT_SMS = 5;
   const int SUPP_SERVICE_CLASS_NONE = 0;
-  const int SUPP_SERVICE_CLASS_VOICE = 1;
-  const int SUPP_SERVICE_CLASS_DATA = 2;
-  const int SUPP_SERVICE_CLASS_FAX = 4;
-  const int SUPP_SERVICE_CLASS_SMS = 8;
-  const int SUPP_SERVICE_CLASS_DATA_SYNC = 16;
-  const int SUPP_SERVICE_CLASS_DATA_ASYNC = 32;
-  const int SUPP_SERVICE_CLASS_PACKET = 64;
-  const int SUPP_SERVICE_CLASS_PAD = 128;
-  const int SUPP_SERVICE_CLASS_MAX = 128;
+  const int SUPP_SERVICE_CLASS_VOICE = (1 << 0);
+  const int SUPP_SERVICE_CLASS_DATA = (1 << 1);
+  const int SUPP_SERVICE_CLASS_FAX = (1 << 2);
+  const int SUPP_SERVICE_CLASS_SMS = (1 << 3);
+  const int SUPP_SERVICE_CLASS_DATA_SYNC = (1 << 4);
+  const int SUPP_SERVICE_CLASS_DATA_ASYNC = (1 << 5);
+  const int SUPP_SERVICE_CLASS_PACKET = (1 << 6);
+  const int SUPP_SERVICE_CLASS_PAD = (1 << 7);
+  const int SUPP_SERVICE_CLASS_MAX = (1 << 7);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/TtyMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/TtyMode.aidl
index 77417e8..e432e65 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/TtyMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/TtyMode.aidl
@@ -34,8 +34,8 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum TtyMode {
-  OFF = 0,
-  FULL = 1,
-  HCO = 2,
-  VCO = 3,
+  OFF,
+  FULL,
+  HCO,
+  VCO,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
index ad243d2..424e73f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
@@ -34,10 +34,10 @@
 package android.hardware.radio.voice;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum UssdModeType {
-  NOTIFY = 0,
-  REQUEST = 1,
-  NW_RELEASE = 2,
-  LOCAL_CLIENT = 3,
-  NOT_SUPPORTED = 4,
-  NW_TIMEOUT = 5,
+  NOTIFY,
+  REQUEST,
+  NW_RELEASE,
+  LOCAL_CLIENT,
+  NOT_SUPPORTED,
+  NW_TIMEOUT,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/AccessNetwork.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/AccessNetwork.aidl
index 8ce689f..9641651 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/AccessNetwork.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/AccessNetwork.aidl
@@ -34,11 +34,11 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum AccessNetwork {
-  UNKNOWN = 0,
-  GERAN = 1,
-  UTRAN = 2,
-  EUTRAN = 3,
-  CDMA2000 = 4,
-  IWLAN = 5,
-  NGRAN = 6,
+  UNKNOWN,
+  GERAN,
+  UTRAN,
+  EUTRAN,
+  CDMA2000,
+  IWLAN,
+  NGRAN,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioAccessFamily.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioAccessFamily.aidl
index afc4f4e..aa55cd7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioAccessFamily.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioAccessFamily.aidl
@@ -34,28 +34,28 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioAccessFamily {
-  UNKNOWN = 1,
-  GPRS = 2,
-  EDGE = 4,
-  UMTS = 8,
-  IS95A = 16,
-  IS95B = 32,
-  ONE_X_RTT = 64,
-  EVDO_0 = 128,
-  EVDO_A = 256,
-  HSDPA = 512,
-  HSUPA = 1024,
-  HSPA = 2048,
-  EVDO_B = 4096,
-  EHRPD = 8192,
-  LTE = 16384,
-  HSPAP = 32768,
-  GSM = 65536,
-  TD_SCDMA = 131072,
-  IWLAN = 262144,
+  UNKNOWN = (1 << android.hardware.radio.RadioTechnology.UNKNOWN),
+  GPRS = (1 << android.hardware.radio.RadioTechnology.GPRS),
+  EDGE = (1 << android.hardware.radio.RadioTechnology.EDGE),
+  UMTS = (1 << android.hardware.radio.RadioTechnology.UMTS),
+  IS95A = (1 << android.hardware.radio.RadioTechnology.IS95A),
+  IS95B = (1 << android.hardware.radio.RadioTechnology.IS95B),
+  ONE_X_RTT = (1 << android.hardware.radio.RadioTechnology.ONE_X_RTT),
+  EVDO_0 = (1 << android.hardware.radio.RadioTechnology.EVDO_0),
+  EVDO_A = (1 << android.hardware.radio.RadioTechnology.EVDO_A),
+  HSDPA = (1 << android.hardware.radio.RadioTechnology.HSDPA),
+  HSUPA = (1 << android.hardware.radio.RadioTechnology.HSUPA),
+  HSPA = (1 << android.hardware.radio.RadioTechnology.HSPA),
+  EVDO_B = (1 << android.hardware.radio.RadioTechnology.EVDO_B),
+  EHRPD = (1 << android.hardware.radio.RadioTechnology.EHRPD),
+  LTE = (1 << android.hardware.radio.RadioTechnology.LTE),
+  HSPAP = (1 << android.hardware.radio.RadioTechnology.HSPAP),
+  GSM = (1 << android.hardware.radio.RadioTechnology.GSM),
+  TD_SCDMA = (1 << android.hardware.radio.RadioTechnology.TD_SCDMA),
+  IWLAN = (1 << android.hardware.radio.RadioTechnology.IWLAN),
   /**
    * @deprecated use LTE instead.
    */
-  LTE_CA = 524288,
-  NR = 1048576,
+  LTE_CA = (1 << android.hardware.radio.RadioTechnology.LTE_CA),
+  NR = (1 << android.hardware.radio.RadioTechnology.NR),
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioConst.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioConst.aidl
index b91bf03..448c0bb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioConst.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioConst.aidl
@@ -37,5 +37,5 @@
   const int MAX_RILDS = 3;
   const int MAX_UUID_LENGTH = 64;
   const int CARD_MAX_APPS = 8;
-  const int P2_CONSTANT_NO_P2 = -1;
+  const int P2_CONSTANT_NO_P2 = (-1);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
index 98606e5..b9db56c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
@@ -123,4 +123,15 @@
   BLOCKED_DUE_TO_CALL = 69,
   RF_HARDWARE_ISSUE = 70,
   NO_RF_CALIBRATION_INFO = 71,
+  ENCODING_NOT_SUPPORTED = 72,
+  FEATURE_NOT_SUPPORTED = 73,
+  INVALID_CONTACT = 74,
+  MODEM_INCOMPATIBLE = 75,
+  NETWORK_TIMEOUT = 76,
+  NO_SATELLITE_SIGNAL = 77,
+  NOT_SUFFICIENT_ACCOUNT_BALANCE = 78,
+  RADIO_TECHNOLOGY_NOT_SUPPORTED = 79,
+  SUBSCRIBER_NOT_AUTHORIZED = 80,
+  SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL = 81,
+  UNIDENTIFIED_SUBSCRIBER = 82,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioIndicationType.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioIndicationType.aidl
index 54ea3a4..58b35a5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioIndicationType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioIndicationType.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioIndicationType {
-  UNSOLICITED = 0,
-  UNSOLICITED_ACK_EXP = 1,
+  UNSOLICITED,
+  UNSOLICITED_ACK_EXP,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseType.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseType.aidl
index 5cd99c4..1ee62bd 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseType.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioResponseType {
-  SOLICITED = 0,
-  SOLICITED_ACK = 1,
-  SOLICITED_ACK_EXP = 2,
+  SOLICITED,
+  SOLICITED_ACK,
+  SOLICITED_ACK_EXP,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnology.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnology.aidl
index 7060469..b6af5aa 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnology.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnology.aidl
@@ -34,28 +34,28 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioTechnology {
-  UNKNOWN = 0,
-  GPRS = 1,
-  EDGE = 2,
-  UMTS = 3,
-  IS95A = 4,
-  IS95B = 5,
-  ONE_X_RTT = 6,
-  EVDO_0 = 7,
-  EVDO_A = 8,
-  HSDPA = 9,
-  HSUPA = 10,
-  HSPA = 11,
-  EVDO_B = 12,
-  EHRPD = 13,
-  LTE = 14,
-  HSPAP = 15,
-  GSM = 16,
-  TD_SCDMA = 17,
-  IWLAN = 18,
+  UNKNOWN,
+  GPRS,
+  EDGE,
+  UMTS,
+  IS95A,
+  IS95B,
+  ONE_X_RTT,
+  EVDO_0,
+  EVDO_A,
+  HSDPA,
+  HSUPA,
+  HSPA,
+  EVDO_B,
+  EHRPD,
+  LTE,
+  HSPAP,
+  GSM,
+  TD_SCDMA,
+  IWLAN,
   /**
    * @deprecated use LTE instead and indicate carrier aggregation through multiple physical channel configurations in IRadioNetwork::currentPhysicalChannelConfigs.
    */
-  LTE_CA = 19,
-  NR = 20,
+  LTE_CA,
+  NR,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnologyFamily.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnologyFamily.aidl
index e6fdce2..2af7e53 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnologyFamily.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioTechnologyFamily.aidl
@@ -34,6 +34,6 @@
 package android.hardware.radio;
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum RadioTechnologyFamily {
-  THREE_GPP = 0,
-  THREE_GPP2 = 1,
+  THREE_GPP,
+  THREE_GPP2,
 }
diff --git a/radio/aidl/android/hardware/radio/RadioError.aidl b/radio/aidl/android/hardware/radio/RadioError.aidl
index 61d5a77..4d44559 100644
--- a/radio/aidl/android/hardware/radio/RadioError.aidl
+++ b/radio/aidl/android/hardware/radio/RadioError.aidl
@@ -180,7 +180,8 @@
      */
     NO_SMS_TO_ACK = 48,
     /**
-     * Received error from network
+     * Received error from network. This generic error code should be used only when the error
+     * cannot be mapped to other specific network error codes.
      */
     NETWORK_ERR = 49,
     /**
@@ -300,4 +301,51 @@
      * Unlike RF_HARDWARE_ISSUE, this is a SW problem and no HW repair is needed.
      */
     NO_RF_CALIBRATION_INFO = 71,
+    /**
+     * The encoding scheme is not supported by either the network or the MS.
+     */
+    ENCODING_NOT_SUPPORTED = 72,
+    /**
+     * The requesting feature is not supported by the service provider/operator.
+     */
+    FEATURE_NOT_SUPPORTED = 73,
+    /**
+     * The contact to be added is either not existing or not valid.
+     */
+    INVALID_CONTACT = 74,
+    /**
+     * The modem of the MS is not compatible with the service provider/operator. This generic error
+     * should be used only when there are some mimatches in the capabilities between the MS and
+     * the operator and the error cannot be mapped properly to other specific network errors.
+     */
+    MODEM_INCOMPATIBLE = 75,
+    /**
+     * Modem timeout to receive ACK or response from network after sending a request to the network.
+     */
+    NETWORK_TIMEOUT = 76,
+    /**
+     * Modem fails to communicate with the satellite network since there is no satellite signal.
+     */
+    NO_SATELLITE_SIGNAL = 77,
+    /**
+     * The request cannot be performed since the subscriber's account balance is not sufficient.
+     */
+    NOT_SUFFICIENT_ACCOUNT_BALANCE = 78,
+    /**
+     * The radio technology is not supported by the service provider/operator.
+     */
+    RADIO_TECHNOLOGY_NOT_SUPPORTED = 79,
+    /**
+     * The subscription is not authorized to register with the service provider/operator.
+     */
+    SUBSCRIBER_NOT_AUTHORIZED = 80,
+    /**
+     * While processing a request from the Framework, the satellite modem detects terrestrial
+     * signal, aborts the request, and switches to the terrestrial network.
+     */
+    SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL = 81,
+    /**
+     * The subscriber is not registered in the service provider.
+     */
+    UNIDENTIFIED_SUBSCRIBER = 82
 }
diff --git a/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl b/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
index 29ece76..071ce55 100644
--- a/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
@@ -911,10 +911,14 @@
      */
     PDP_MODIFY_COLLISION = 0x875,
     /**
-     * Maximum size of the L2 message was exceeded.
+     * @deprecated use MAXIMUM_SIZE_OF_L2_MESSAGE_EXCEEDED instead.
      */
     MAXINUM_SIZE_OF_L2_MESSAGE_EXCEEDED = 0x876,
     /**
+     * Maximum size of the L2 message was exceeded.
+     */
+    MAXIMUM_SIZE_OF_L2_MESSAGE_EXCEEDED = 0x876,
+    /**
      * Non-access stratum (NAS) request was rejected by the network.
      */
     NAS_REQUEST_REJECTED_BY_NETWORK = 0x877,
diff --git a/radio/aidl/android/hardware/radio/data/NrQos.aidl b/radio/aidl/android/hardware/radio/data/NrQos.aidl
index 28b4a7f..4078fdc 100644
--- a/radio/aidl/android/hardware/radio/data/NrQos.aidl
+++ b/radio/aidl/android/hardware/radio/data/NrQos.aidl
@@ -27,6 +27,8 @@
     const byte FLOW_ID_RANGE_MIN = 1;
     const byte FLOW_ID_RANGE_MAX = 63;
 
+    const int AVERAGING_WINDOW_UNKNOWN = -1;
+
     /**
      * 5G QOS Identifier (5QI), see 3GPP TS 24.501 and 23.501. The allowed values are standard
      * values (1-9, 65-68, 69-70, 75, 79-80, 82-85) defined in the spec and operator specific values
@@ -36,13 +38,16 @@
     QosBandwidth downlink;
     QosBandwidth uplink;
     /**
-     * @deprecated use qosFlowIdentifier.
-     */
-    byte qfi;
-    char averagingWindowMs;
-    /**
      * QOS flow identifier of the QOS flow description in the range
      * (FLOW_ID_RANGE_MIN, FLOW_ID_RANGE_MAX).
-     **/
-    int qosFlowIdentifier;
+     */
+    byte qfi;
+    /**
+     * @deprecated use averagingWindowMillis;
+     */
+    char averagingWindowMs;
+    /**
+     * The duration over which flow rates are calculated.
+     */
+    int averagingWindowMillis = AVERAGING_WINDOW_UNKNOWN;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/IRadioImsResponse.aidl b/radio/aidl/android/hardware/radio/ims/IRadioImsResponse.aidl
index 241c342..ff516cc 100644
--- a/radio/aidl/android/hardware/radio/ims/IRadioImsResponse.aidl
+++ b/radio/aidl/android/hardware/radio/ims/IRadioImsResponse.aidl
@@ -58,8 +58,9 @@
     void updateImsRegistrationInfoResponse(in RadioResponseInfo info);
 
     /**
-     * @param info Response info struct containing response type, serial no. and error
-     * @param failureInfo Information about failure in detail
+     * @param info Response info struct containing response type, serial no. and error.
+     * @param failureInfo Information about failure in detail. If there is no error,
+     *        it should be {@code null}.
      *
      * Valid errors returned:
      *   RadioError:NONE
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/android/hardware/radio/ims/media/AnbrMode.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/android/hardware/radio/ims/media/AnbrMode.aidl
index 61239d0..f758cd4 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/AnbrMode.aidl
@@ -16,13 +16,19 @@
 
 package android.hardware.radio.ims.media;
 
-@VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
+import android.hardware.radio.ims.media.CodecMode;
 
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+@VintfStability
+@JavaDerive(toString=true)
+parcelable AnbrMode {
+    /**
+     * Codec mode converted from bitrate received for uplink
+     * from network or peer UE for ANBR
+     */
+    CodecMode anbrUplinkMode;
+    /**
+     * Codec mode converted from bitrate received for downlink
+     * from network or peer UE for ANBR
+     */
+    CodecMode anbrDownlinkMode;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/android/hardware/radio/ims/media/CodecMode.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/android/hardware/radio/ims/media/CodecMode.aidl
index 61239d0..aa1b3a4 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/CodecMode.aidl
@@ -16,13 +16,16 @@
 
 package android.hardware.radio.ims.media;
 
-@VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
+import android.hardware.radio.ims.media.AmrMode;
+import android.hardware.radio.ims.media.EvsMode;
 
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+@VintfStability
+@JavaDerive(toString=true)
+union CodecMode {
+    /** Default value */
+    boolean noinit;
+    /** AMR codec mode to represent the bit rate. See 3ggp Specs 26.976 & 26.071 */
+    AmrMode amr;
+    /** EVS codec mode to represent the bit rate. See 3ggp Spec 26.952 Table 5.1 */
+    EvsMode evs;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
index d0d849e..f6696f7 100644
--- a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -17,7 +17,7 @@
 package android.hardware.radio.ims.media;
 
 import android.hardware.radio.AccessNetwork;
-import android.hardware.radio.ims.media.AnbrBitrate;
+import android.hardware.radio.ims.media.AnbrMode;
 import android.hardware.radio.ims.media.MediaDirection;
 import android.hardware.radio.ims.media.RtcpConfig;
 import android.hardware.radio.ims.media.RtpAddress;
@@ -36,13 +36,14 @@
     /** RTCP configuration */
     RtcpConfig rtcpConfig;
     /**
-     * ANBR Bitrate parameters. This is set to valid only when its triggered,
+     * ANBR Mode parameters. This is set to valid only when its triggered,
      * otherwise it shall be set to NULL.
      *
      * This would be used in the following two cases
      * - IImsMediaSession#modifySession(RtpConfig) - When RAN wants to change the bit
-     *   rate via ANBR MAC layer signaling, ImsStack would set the values and direction
-     *   and pass it in the modifySession(). The underlying RTP stack shall adapt to
+     *   rate via ANBR MAC layer signaling, ImsStack converts the received bitrate
+     *   to the codec mode appropriately and passes the codec mode and direction
+     *   using modifySession(). The underlying RTP stack shall adapt to
      *   the changed bitrate.
      *
      * - IImsMediaSessionListener#triggerAnbrQuery(RtpConfig) - When the vendor RTP
@@ -50,5 +51,5 @@
      *   RTCP-APP or TMMBR, it triggers ANBRQ by setting the desired bitrate and the
      *   direction of the stream.
      */
-    AnbrBitrate anbrBitrateParams;
+    AnbrMode anbrModeParams;
 }
diff --git a/radio/aidl/android/hardware/radio/satellite/IRadioSatellite.aidl b/radio/aidl/android/hardware/radio/satellite/IRadioSatellite.aidl
new file mode 100644
index 0000000..87f13a6
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/IRadioSatellite.aidl
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+import android.hardware.radio.satellite.IRadioSatelliteIndication;
+import android.hardware.radio.satellite.IRadioSatelliteResponse;
+import android.hardware.radio.satellite.IndicationFilter;
+import android.hardware.radio.satellite.SatelliteFeature;
+
+/**
+ * This interface is used by telephony to send commands to and query info from satellite modem.
+ * All the functions have minimum one parameter:
+ * serial: which corresponds to serial no. of request. Serial numbers must only be memorized for the
+ * duration of a method call. If clients provide colliding serials (including passing the same
+ * serial to different methods), multiple responses (one for each method call) must still be served.
+ */
+@VintfStability
+oneway interface IRadioSatellite {
+    /**
+     * Add contacts that are allowed to be used for satellite communication. This is applicable for
+     * incoming messages as well.
+     *
+     * @param serial Serial number of request.
+     * @param contacts List of allowed contacts to be added.
+     */
+    void addAllowedSatelliteContacts(in int serial, in String[] contacts);
+
+    /**
+     * Get feature capabilities supported by satellite.
+     *
+     * @param serial Serial number of request.
+     */
+    void getCapabilities(in int serial);
+
+    /**
+     * Get max number of characters per text message.
+     *
+     * @param serial Serial number of request.
+     */
+    void getMaxCharactersPerTextMessage(in int serial);
+
+    /**
+     * Get pending messages.
+     *
+     * @param serial Serial number of request.
+     */
+    void getPendingMessages(in int serial);
+
+    /**
+     * Get satellite modem state.
+     *
+     * @param serial Serial number of request.
+     */
+    void getPowerState(in int serial);
+
+    /**
+     * Get current satellite registration mode, which is defined in {@link #SatelliteMode}.
+     *
+     * @param serial Serial number of request.
+     */
+    void getSatelliteMode(in int serial);
+
+    /**
+     * Get time for next visibility of satellite.
+     *
+     * @param serial Serial number of request.
+     */
+    void getTimeForNextSatelliteVisibility(in int serial);
+
+    /**
+     * Provision the subscription with a satellite provider. This is needed to register the
+     * subscription if the provider allows dynamic registration.
+     *
+     * @param serial Serial number of request.
+     * @param imei IMEI of the SIM associated with the satellite modem.
+     * @param msisdn MSISDN of the SIM associated with the satellite modem.
+     * @param imsi IMSI of the SIM associated with the satellite modem.
+     * @param features List of features to be provisioned.
+     */
+    void provisionService(in int serial, in String imei, in String msisdn, in String imsi,
+            in SatelliteFeature[] features);
+
+    /**
+     * Remove contacts that are allowed to be used for satellite communication. This is applicable
+     * for incoming messages as well.
+     *
+     * @param serial Serial number of request.
+     * @param contacts List of allowed contacts to be removed.
+     */
+    void removeAllowedSatelliteContacts(in int serial, in String[] contacts);
+
+    /**
+     * When response type received from a radio indication or radio response is
+     * RadioIndicationType:UNSOLICITED_ACK_EXP or RadioResponseType:SOLICITED_ACK_EXP respectively,
+     * acknowledge the receipt of those messages by sending responseAcknowledgement().
+     */
+    void responseAcknowledgement();
+
+    /**
+     * Send text messages.
+     *
+     * @param serial Serial number of request.
+     * @param messages List of messages in text format to be sent.
+     * @param destination The recipient of the message.
+     * @param latitude The current latitude of the device.
+     * @param longitude The current longitude of the device. The location (i.e., latitude and
+     *        longitude) of the device will be filled for emergency messages.
+     */
+    void sendMessages(in int serial, in String[] messages, in String destination,
+            in double latitude, in double longitude);
+
+    /**
+     * Set the filter for what type of indication framework want to receive from modem.
+     *
+     * @param serial Serial number of request.
+     * @param filterBitmask The filter bitmask identifying what type of indication Telephony
+     *                      framework wants to receive from modem. This bitmask is the 'or'
+     *                      combination of the enum values defined in {@link #IndicationFilter}.
+     */
+    void setIndicationFilter(in int serial, in int filterBitmask);
+
+    /**
+     * Turn satellite modem on/off.
+     *
+     * @param serial Serial number of request.
+     * @param on True for turning on.
+     *           False for turning off.
+     */
+    void setPower(in int serial, in boolean on);
+
+    /**
+     * Set response functions for Satellite requests and indications.
+     *
+     * @param satelliteResponse Object containing response functions
+     * @param satelliteIndication Object containing radio indications
+     */
+    void setResponseFunctions(in IRadioSatelliteResponse satelliteResponse,
+            in IRadioSatelliteIndication satelliteIndication);
+
+    /**
+     * User started pointing to the satellite. Modem should continue to update the pointing input
+     * as user device/satellite moves.
+     *
+     * @param serial Serial number of request.
+     */
+    void startSendingSatellitePointingInfo(in int serial);
+
+    /**
+     * Stop sending satellite pointing info to the framework.
+     *
+     * @param serial Serial number of request.
+     */
+    void stopSendingSatellitePointingInfo(in int serial);
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl b/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl
new file mode 100644
index 0000000..f1d9747
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteIndication.aidl
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+import android.hardware.radio.RadioIndicationType;
+import android.hardware.radio.satellite.NTRadioTechnology;
+import android.hardware.radio.satellite.PointingInfo;
+import android.hardware.radio.satellite.SatelliteFeature;
+import android.hardware.radio.satellite.SatelliteMode;
+
+/**
+ * Interface declaring unsolicited radio indications for satellite APIs.
+ */
+@VintfStability
+oneway interface IRadioSatelliteIndication {
+    /**
+     * Confirms that ongoing message transfer is complete.
+     *
+     * @param type Type of radio indication
+     * @param complete True mean the transfer is complete.
+     *                 False means the transfer is not complete.
+     */
+    void onMessagesTransferComplete(in RadioIndicationType type, in boolean complete);
+
+    /**
+     * Indicates new message received on device.
+     *
+     * @param type Type of radio indication
+     * @param messages List of new messages received.
+     */
+    void onNewMessages(in RadioIndicationType type, in String[] messages);
+
+    /**
+     * Indicates that satellite has pending messages for the device to be pulled.
+     *
+     * @param type Type of radio indication
+     * @param count Number of pending messages.
+     */
+    void onPendingMessageCount(in RadioIndicationType type, in int count);
+
+    /**
+     * Indicate that satellite provision state has changed.
+     *
+     * @param type Type of radio indication
+     * @param provisioned True means the service is provisioned.
+     *                    False means the service is not provisioned.
+     * @param features List of Feature whose provision state has changed.
+     */
+    void onProvisionStateChanged(
+            in RadioIndicationType type, boolean provisioned, in SatelliteFeature[] features);
+
+    /**
+     * Indicate that satellite mode has changed.
+     *
+     * @param type Type of radio indication
+     * @param mode The current mode of the satellite modem.
+     */
+    void onSatelliteModeChanged(in RadioIndicationType type, in SatelliteMode mode);
+
+    /**
+     * Indicate that satellite Pointing input has changed.
+     *
+     * @param type Type of radio indication
+     * @param pointingInfo The current pointing info.
+     */
+    void onSatellitePointingInfoChanged(in RadioIndicationType type, in PointingInfo pointingInfo);
+
+    /**
+     * Indicate that satellite radio technology has changed.
+     *
+     * @param type Type of radio indication
+     * @param technology The current technology of the satellite modem.
+     */
+    void onSatelliteRadioTechnologyChanged(
+            in RadioIndicationType type, in NTRadioTechnology technology);
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl b/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl
new file mode 100644
index 0000000..e81edaa
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/IRadioSatelliteResponse.aidl
@@ -0,0 +1,461 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+import android.hardware.radio.RadioResponseInfo;
+import android.hardware.radio.satellite.NTRadioTechnology;
+import android.hardware.radio.satellite.SatelliteCapabilities;
+import android.hardware.radio.satellite.SatelliteMode;
+
+/**
+ * Interface declaring response functions to solicited radio requests for satellite APIs.
+ */
+@VintfStability
+oneway interface IRadioSatelliteResponse {
+    /**
+     * Acknowledge the receipt of radio request sent to the vendor. This must be sent only for
+     * radio request which take long time to respond. For more details, refer
+     * https://source.android.com/devices/tech/connect/ril.html
+     *
+     * @param serial Serial no. of the request whose acknowledgement is sent.
+     */
+    void acknowledgeRequest(in int serial);
+
+    /**
+     * Response of the request addAllowedSatelliteContacts.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:ABORTED
+     *   RadioError:ACCESS_BARRED
+     *   RadioError:CANCELLED
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_CONTACT
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NETWORK_ERR
+     *   RadioError:NETWORK_NOT_READY
+     *   RadioError:NETWORK_REJECT
+     *   RadioError:NETWORK_TIMEOUT
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_NETWORK_FOUND
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_SATELLITE_SIGNAL
+     *   RadioError:NO_SUBSCRIPTION
+     *   RadioError:NOT_SUFFICIENT_ACCOUNT_BALANCE
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SIM_ABSENT
+     *   RadioError:SIM_BUSY
+     *   RadioError:SIM_ERR
+     *   RadioError:SIM_FULL
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:UNIDENTIFIED_SUBSCRIBER
+     */
+    void addAllowedSatelliteContactsResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request getCapabilities.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param capabilities List of capabilities that the satellite modem supports.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void getCapabilitiesResponse(in RadioResponseInfo info, in SatelliteCapabilities capabilities);
+
+    /**
+     * Response of the request getMaxCharactersPerTextMessage.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param charLimit Maximum number of characters in a text message that can be sent.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void getMaxCharactersPerTextMessageResponse(in RadioResponseInfo info, in int charLimit);
+
+    /**
+     * Response of the request getPendingMessages.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param messages List of pending messages received.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:ABORTED
+     *   RadioError:ACCESS_BARRED
+     *   RadioError:BLOCKED_DUE_TO_CALL
+     *   RadioError:CANCELLED
+     *   RadioError:ENCODING_ERR
+     *   RadioError:ENCODING_NOT_SUPPORTED
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_SMS_FORMAT
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NETWORK_ERR
+     *   RadioError:NETWORK_NOT_READY
+     *   RadioError:NETWORK_REJECT
+     *   RadioError:NETWORK_TIMEOUT
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_NETWORK_FOUND
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_SMS_TO_ACK
+     *   RadioError:NO_SATELLITE_SIGNAL
+     *   RadioError:NO_SUBSCRIPTION
+     *   RadioError:NOT_SUFFICIENT_ACCOUNT_BALANCE
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SIM_ABSENT
+     *   RadioError:SIM_BUSY
+     *   RadioError:SIM_ERR
+     *   RadioError:SIM_FULL
+     *   RadioError:SIMULTANEOUS_SMS_AND_CALL_NOT_ALLOWED
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL
+     */
+    void getPendingMessagesResponse(in RadioResponseInfo info, in String[] messages);
+
+    /**
+     * Response of the request getPowerSate.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param on True means the modem is ON.
+     *           False means the modem is OFF.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void getPowerStateResponse(in RadioResponseInfo info, in boolean on);
+
+    /**
+     * Response of the request getSatelliteMode.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param mode Current Mode of the satellite modem.
+     * @param technology The current technology of the satellite modem.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void getSatelliteModeResponse(
+            in RadioResponseInfo info, in SatelliteMode mode, in NTRadioTechnology technology);
+
+    /**
+     * Response of the request getTimeForNextSatelliteVisibility.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param timeInSeconds The duration in seconds after which the satellite will be visible.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void getTimeForNextSatelliteVisibilityResponse(in RadioResponseInfo info, in int timeInSeconds);
+
+    /**
+     * Response of the request provisionService.
+     *
+     * @param info Response info struct containing serial no. and error
+     * @param provisioned True means the service is provisioned.
+     *                    False means the service is not provisioned.
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:ABORTED
+     *   RadioError:ACCESS_BARRED
+     *   RadioError:CANCELLED
+     *   RadioError:FEATURE_NOT_SUPPORTED
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:MODEM_INCOMPATIBLE
+     *   RadioError:NETWORK_ERR
+     *   RadioError:NETWORK_NOT_READY
+     *   RadioError:NETWORK_REJECT
+     *   RadioError:NETWORK_TIMEOUT
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_NETWORK_FOUND
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_SATELLITE_SIGNAL
+     *   RadioError:NO_SUBSCRIPTION
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:RADIO_TECHNOLOGY_NOT_SUPPORTED
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SIM_ABSENT
+     *   RadioError:SIM_BUSY
+     *   RadioError:SIM_ERR
+     *   RadioError:SIM_FULL
+     *   RadioError:SUBSCRIBER_NOT_AUTHORIZED
+     *   RadioError:SYSTEM_ERR
+     */
+    void provisionServiceResponse(in RadioResponseInfo info, in boolean provisioned);
+
+    /**
+     * Response of the request removeAllowedSatelliteContacts.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:ABORTED
+     *   RadioError:ACCESS_BARRED
+     *   RadioError:CANCELLED
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_CONTACT
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NETWORK_ERR
+     *   RadioError:NETWORK_NOT_READY
+     *   RadioError:NETWORK_REJECT
+     *   RadioError:NETWORK_TIMEOUT
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_NETWORK_FOUND
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_SATELLITE_SIGNAL
+     *   RadioError:NO_SUBSCRIPTION
+     *   RadioError:NOT_SUFFICIENT_ACCOUNT_BALANCE
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SIM_ABSENT
+     *   RadioError:SIM_BUSY
+     *   RadioError:SIM_ERR
+     *   RadioError:SIM_FULL
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:UNIDENTIFIED_SUBSCRIBER
+     */
+    void removeAllowedSatelliteContactsResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request sendMessages.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:ABORTED
+     *   RadioError:ACCESS_BARRED
+     *   RadioError:BLOCKED_DUE_TO_CALL
+     *   RadioError:CANCELLED
+     *   RadioError:ENCODING_ERR
+     *   RadioError:ENCODING_NOT_SUPPORTED
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_SMS_FORMAT
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NETWORK_ERR
+     *   RadioError:NETWORK_NOT_READY
+     *   RadioError:NETWORK_REJECT
+     *   RadioError:NETWORK_TIMEOUT
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_NETWORK_FOUND
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_SMS_TO_ACK
+     *   RadioError:NO_SATELLITE_SIGNAL
+     *   RadioError:NO_SUBSCRIPTION
+     *   RadioError:NOT_SUFFICIENT_ACCOUNT_BALANCE
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SIM_ABSENT
+     *   RadioError:SIM_BUSY
+     *   RadioError:SIM_ERR
+     *   RadioError:SIM_FULL
+     *   RadioError:SIMULTANEOUS_SMS_AND_CALL_NOT_ALLOWED
+     *   RadioError:SMS_SEND_FAIL_RETRY
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL
+     *   RadioError:UNIDENTIFIED_SUBSCRIBER
+     */
+    void sendMessagesResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request setIndicationFilter.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void setIndicationFilterResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request setPower.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:NO_RF_CALIBRATION_INFO
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:RF_HARDWARE_ISSUE
+     *   RadioError:SYSTEM_ERR
+     */
+    void setPowerResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request startSendingSatellitePointingInfo.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void startSendingSatellitePointingInfoResponse(in RadioResponseInfo info);
+
+    /**
+     * Response of the request stopSendingSatellitePointingInfo.
+     *
+     * @param info Response info struct containing serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:INVALID_SIM_STATE
+     *   RadioError:INVALID_STATE
+     *   RadioError:MODEM_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:NO_RESOURCES
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:REQUEST_RATE_LIMITED
+     *   RadioError:SYSTEM_ERR
+     */
+    void stopSendingSatellitePointingInfoResponse(in RadioResponseInfo info);
+}
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/radio/aidl/android/hardware/radio/satellite/IndicationFilter.aidl
similarity index 64%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to radio/aidl/android/hardware/radio/satellite/IndicationFilter.aidl
index 61239d0..1a65bee 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/radio/aidl/android/hardware/radio/satellite/IndicationFilter.aidl
@@ -14,15 +14,12 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.radio.satellite;
 
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+@Backing(type="int")
+@JavaDerive(toString=true)
+enum IndicationFilter {
+    NONE = 0,
+    SATELLITE_MODE = 1
 }
diff --git a/radio/aidl/android/hardware/radio/satellite/NTRadioTechnology.aidl b/radio/aidl/android/hardware/radio/satellite/NTRadioTechnology.aidl
new file mode 100644
index 0000000..39b2b00
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/NTRadioTechnology.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+@VintfStability
+@Backing(type="int")
+@JavaDerive(toString=true)
+enum NTRadioTechnology {
+    /* 3GPP NB-IoT (Narrowband Internet of Things) over Non-Terrestrial-Networks technology */
+    NB_IOT_NTN = 0,
+    /* 3GPP 5G NR over Non-Terrestrial-Networks technology */
+    NR_NTN = 1,
+    /* 3GPP eMTC (enhanced Machine-Type Communication) over Non-Terrestrial-Networks technology */
+    EMTC_NTN = 2,
+    /* Proprietary technology like Iridium or Bullitt */
+    PROPRIETARY = 3
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/PointingInfo.aidl b/radio/aidl/android/hardware/radio/satellite/PointingInfo.aidl
new file mode 100644
index 0000000..8496a59
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/PointingInfo.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+@VintfStability
+@JavaDerive(toString=true)
+parcelable PointingInfo {
+    /* Satellite azimuth in degrees */
+    float satelliteAzimuthDegrees;
+
+    /* Satellite elevation in degrees */
+    float satelliteElevationDegrees;
+
+    /* Antenna azimuth in degrees */
+    float antennaAzimuthDegrees;
+
+    /**
+     * Angle of rotation about the x axis. This value represents the angle between a plane
+     * parallel to the device's screen and a plane parallel to the ground.
+     */
+    float antennaPitchDegrees;
+
+    /**
+     * Angle of rotation about the y axis. This value represents the angle between a plane
+     * perpendicular to the device's screen and a plane parallel to the ground.
+     */
+    float antennaRollDegrees;
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/SatelliteCapabilities.aidl b/radio/aidl/android/hardware/radio/satellite/SatelliteCapabilities.aidl
new file mode 100644
index 0000000..01e64aa
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/SatelliteCapabilities.aidl
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+import android.hardware.radio.satellite.NTRadioTechnology;
+import android.hardware.radio.satellite.SatelliteFeature;
+
+@VintfStability
+@JavaDerive(toString=true)
+parcelable SatelliteCapabilities {
+    /**
+     * List of technologies supported by the satellite modem.
+     */
+    NTRadioTechnology[] supportedRadioTechnologies;
+
+    /**
+     * Whether satellite mode is always on (this indicates the power impact of keeping it on is
+     * very minimal).
+     */
+    boolean isAlwaysOn;
+
+    /**
+     * Whether UE needs to point to a satellite to send and receive data.
+     */
+    boolean needsPointingToSatellite;
+
+    /**
+     * List of features supported by the satellite modem.
+     */
+    SatelliteFeature[] supportedFeatures;
+
+    /**
+     * Whether UE needs a separate SIM profile to communicate with satellite network.
+     */
+    boolean needsSeparateSimProfile;
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/SatelliteFeature.aidl b/radio/aidl/android/hardware/radio/satellite/SatelliteFeature.aidl
new file mode 100644
index 0000000..0e33998
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/SatelliteFeature.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+@VintfStability
+@Backing(type="int")
+@JavaDerive(toString=true)
+enum SatelliteFeature {
+    /* Able to send and receive SMS messages to/from SOS numbers like call/service centers */
+    SOS_SMS = 0,
+    /* Able to send and receive SMS messages to/from emergency numbers like 911 */
+    EMERGENCY_SMS = 1,
+    /* Able to send and receive SMS messages to/from any allowed contacts */
+    SMS = 2,
+    /* Able to send device location to allowed contacts */
+    LOCATION_SHARING = 3
+}
diff --git a/radio/aidl/android/hardware/radio/satellite/SatelliteMode.aidl b/radio/aidl/android/hardware/radio/satellite/SatelliteMode.aidl
new file mode 100644
index 0000000..349fd9e
--- /dev/null
+++ b/radio/aidl/android/hardware/radio/satellite/SatelliteMode.aidl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.radio.satellite;
+
+@VintfStability
+@Backing(type="int")
+@JavaDerive(toString=true)
+enum SatelliteMode {
+    /* Satellite modem is powered off */
+    POWERED_OFF = 0,
+    /* Satellite modem is in out of service state and not searching for satellite signal */
+    OUT_OF_SERVICE_NOT_SEARCHING = 1,
+    /* Satellite modem is in out of service state and searching for satellite signal */
+    OUT_OF_SERVICE_SEARCHING = 2,
+    /* Satellite modem has found satellite signal and gets connected to the satellite network */
+    ACQUIRED = 3,
+    /* Satellite modem is sending and/or receiving messages */
+    MESSAGE_TRANSFERRING = 4
+}
diff --git a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
index 5a79f0f..edbec2c 100644
--- a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -58,9 +58,4 @@
     boolean allowedCarriersPrioritized;
     /** Current restriction status as defined in CarrierRestrictionStatus enum */
     CarrierRestrictionStatus status;
-    /**
-    * Android carrier ID of the locked carrier.
-    * see https://source.android.com/docs/core/connect/carrierid
-    */
-    int carrierId;
 }
diff --git a/radio/aidl/compat/libradiocompat/Android.bp b/radio/aidl/compat/libradiocompat/Android.bp
index 95953ac..6bbc9fe 100644
--- a/radio/aidl/compat/libradiocompat/Android.bp
+++ b/radio/aidl/compat/libradiocompat/Android.bp
@@ -42,6 +42,7 @@
         "android.hardware.radio.modem-V2-ndk",
         "android.hardware.radio.network-V2-ndk",
         "android.hardware.radio.sap-V1-ndk",
+        "android.hardware.radio.satellite-V1-ndk",
         "android.hardware.radio.sim-V2-ndk",
         "android.hardware.radio.voice-V2-ndk",
         "android.hardware.radio@1.0",
@@ -90,6 +91,9 @@
         "sap/Sap.cpp",
         "sap/SapCallback.cpp",
         "sap/structs.cpp",
+        "satellite/RadioIndication-satellite.cpp",
+        "satellite/RadioResponse-satellite.cpp",
+        "satellite/RadioSatellite.cpp",
         "sim/RadioIndication-sim.cpp",
         "sim/RadioResponse-sim.cpp",
         "sim/RadioSim.cpp",
diff --git a/radio/aidl/compat/libradiocompat/data/structs.cpp b/radio/aidl/compat/libradiocompat/data/structs.cpp
index 22cde6b..47f1f86 100644
--- a/radio/aidl/compat/libradiocompat/data/structs.cpp
+++ b/radio/aidl/compat/libradiocompat/data/structs.cpp
@@ -136,8 +136,8 @@
             .fiveQi = qos.fiveQi,
             .downlink = toAidl(qos.downlink),
             .uplink = toAidl(qos.uplink),
-            .qosFlowIdentifier = static_cast<int8_t>(qos.qfi),
-            .averagingWindowMs = qos.averagingWindowMs,
+            .qfi = static_cast<int8_t>(qos.qfi),
+            .averagingWindowMillis = qos.averagingWindowMs,
     };
 }
 
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioIndication.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioIndication.h
index f042456..ad9127e 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioIndication.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioIndication.h
@@ -23,6 +23,7 @@
 #include <aidl/android/hardware/radio/messaging/IRadioMessagingIndication.h>
 #include <aidl/android/hardware/radio/modem/IRadioModemIndication.h>
 #include <aidl/android/hardware/radio/network/IRadioNetworkIndication.h>
+#include <aidl/android/hardware/radio/satellite/IRadioSatelliteIndication.h>
 #include <aidl/android/hardware/radio/sim/IRadioSimIndication.h>
 #include <aidl/android/hardware/radio/voice/IRadioVoiceIndication.h>
 #include <android/hardware/radio/1.6/IRadioIndication.h>
@@ -60,6 +61,10 @@
             ::aidl::android::hardware::radio::ims::IRadioImsIndication,
             ::aidl::android::hardware::radio::ims::IRadioImsIndicationDefault, true>
             mImsCb;
+    GuaranteedCallback<  //
+            ::aidl::android::hardware::radio::satellite::IRadioSatelliteIndication,
+            ::aidl::android::hardware::radio::satellite::IRadioSatelliteIndicationDefault, true>
+            mSatelliteCb;
 
     // IRadioIndication @ 1.0
     Return<void> radioStateChanged(V1_0::RadioIndicationType type,
@@ -227,6 +232,9 @@
             std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceIndication> voicCb);
     void setResponseFunction(
             std::shared_ptr<::aidl::android::hardware::radio::ims::IRadioImsIndication> imsCb);
+    void setResponseFunction(
+            std::shared_ptr<::aidl::android::hardware::radio::satellite::IRadioSatelliteIndication>
+                    satelliteCb);
 
     std::shared_ptr<::aidl::android::hardware::radio::data::IRadioDataIndication> dataCb();
     std::shared_ptr<::aidl::android::hardware::radio::messaging::IRadioMessagingIndication>
@@ -236,6 +244,8 @@
     std::shared_ptr<::aidl::android::hardware::radio::sim::IRadioSimIndication> simCb();
     std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceIndication> voiceCb();
     std::shared_ptr<::aidl::android::hardware::radio::ims::IRadioImsIndication> imsCb();
+    std::shared_ptr<::aidl::android::hardware::radio::satellite::IRadioSatelliteIndication>
+    satelliteCb();
 };
 
 }  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioResponse.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioResponse.h
index 22451ae..636c1a4 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioResponse.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioResponse.h
@@ -23,6 +23,7 @@
 #include <aidl/android/hardware/radio/messaging/IRadioMessagingResponse.h>
 #include <aidl/android/hardware/radio/modem/IRadioModemResponse.h>
 #include <aidl/android/hardware/radio/network/IRadioNetworkResponse.h>
+#include <aidl/android/hardware/radio/satellite/IRadioSatelliteResponse.h>
 #include <aidl/android/hardware/radio/sim/IRadioSimResponse.h>
 #include <aidl/android/hardware/radio/voice/IRadioVoiceResponse.h>
 #include <android/hardware/radio/1.6/IRadioResponse.h>
@@ -53,6 +54,9 @@
     GuaranteedCallback<::aidl::android::hardware::radio::ims::IRadioImsResponse,
                        ::aidl::android::hardware::radio::ims::IRadioImsResponseDefault>
             mImsCb;
+    GuaranteedCallback<::aidl::android::hardware::radio::satellite::IRadioSatelliteResponse,
+                       ::aidl::android::hardware::radio::satellite::IRadioSatelliteResponseDefault>
+            mSatelliteCb;
 
     // IRadioResponse @ 1.0
     Return<void> getIccCardStatusResponse(const V1_0::RadioResponseInfo& info,
@@ -446,6 +450,9 @@
             std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceResponse> voiceCb);
     void setResponseFunction(
             std::shared_ptr<::aidl::android::hardware::radio::ims::IRadioImsResponse> imsCb);
+    void setResponseFunction(
+            std::shared_ptr<::aidl::android::hardware::radio::satellite::IRadioSatelliteResponse>
+                    satelliteCb);
 
     std::shared_ptr<::aidl::android::hardware::radio::data::IRadioDataResponse> dataCb();
     std::shared_ptr<::aidl::android::hardware::radio::messaging::IRadioMessagingResponse>
@@ -455,6 +462,8 @@
     std::shared_ptr<::aidl::android::hardware::radio::sim::IRadioSimResponse> simCb();
     std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceResponse> voiceCb();
     std::shared_ptr<::aidl::android::hardware::radio::ims::IRadioImsResponse> imsCb();
+    std::shared_ptr<::aidl::android::hardware::radio::satellite::IRadioSatelliteResponse>
+    satelliteCb();
 };
 
 }  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioSatellite.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioSatellite.h
new file mode 100644
index 0000000..3ee6db2
--- /dev/null
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioSatellite.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "RadioCompatBase.h"
+
+#include <aidl/android/hardware/radio/satellite/BnRadioSatellite.h>
+
+namespace android::hardware::radio::compat {
+
+class RadioSatellite : public RadioCompatBase,
+                       public aidl::android::hardware::radio::satellite::BnRadioSatellite {
+    ::ndk::ScopedAStatus responseAcknowledgement() override;
+    ::ndk::ScopedAStatus getCapabilities(int32_t serial) override;
+    ::ndk::ScopedAStatus setPower(int32_t serial, bool on) override;
+    ::ndk::ScopedAStatus getPowerState(int32_t serial) override;
+    ::ndk::ScopedAStatus provisionService(
+            int32_t serial, const std::string& imei, const std::string& msisdn,
+            const std::string& imsi,
+            const std::vector<::aidl::android::hardware::radio::satellite::SatelliteFeature>&
+                    features) override;
+    ::ndk::ScopedAStatus addAllowedSatelliteContacts(
+            int32_t serial, const std::vector<std::string>& contacts) override;
+    ::ndk::ScopedAStatus removeAllowedSatelliteContacts(
+            int32_t serial, const std::vector<std::string>& contacts) override;
+    ::ndk::ScopedAStatus sendMessages(int32_t serial, const std::vector<std::string>& messages,
+                                      const std::string& destination, double latitude,
+                                      double longitude) override;
+    ::ndk::ScopedAStatus getPendingMessages(int32_t serial) override;
+    ::ndk::ScopedAStatus getSatelliteMode(int32_t serial) override;
+    ::ndk::ScopedAStatus setIndicationFilter(int32_t serial, int32_t filterBitmask) override;
+    ::ndk::ScopedAStatus startSendingSatellitePointingInfo(int32_t serial) override;
+    ::ndk::ScopedAStatus stopSendingSatellitePointingInfo(int32_t serial) override;
+    ::ndk::ScopedAStatus getMaxCharactersPerTextMessage(int32_t serial) override;
+    ::ndk::ScopedAStatus getTimeForNextSatelliteVisibility(int32_t serial) override;
+
+    ::ndk::ScopedAStatus setResponseFunctions(
+            const std::shared_ptr<
+                    ::aidl::android::hardware::radio::satellite::IRadioSatelliteResponse>&
+                    radioSatelliteResponse,
+            const std::shared_ptr<
+                    ::aidl::android::hardware::radio::satellite::IRadioSatelliteIndication>&
+                    radioSatelliteIndication) override;
+
+  protected:
+    std::shared_ptr<::aidl::android::hardware::radio::satellite::IRadioSatelliteResponse> respond();
+
+  public:
+    using RadioCompatBase::RadioCompatBase;
+};
+
+}  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/satellite/RadioIndication-satellite.cpp b/radio/aidl/compat/libradiocompat/satellite/RadioIndication-satellite.cpp
new file mode 100644
index 0000000..39da43d
--- /dev/null
+++ b/radio/aidl/compat/libradiocompat/satellite/RadioIndication-satellite.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <libradiocompat/RadioIndication.h>
+
+#include "commonStructs.h"
+#include "debug.h"
+
+#include "collections.h"
+
+#define RADIO_MODULE "RadioSatelliteIndication"
+
+namespace android::hardware::radio::compat {
+
+namespace aidl = ::aidl::android::hardware::radio::satellite;
+
+void RadioIndication::setResponseFunction(
+        std::shared_ptr<aidl::IRadioSatelliteIndication> satelliteCb) {
+    mSatelliteCb = satelliteCb;
+}
+
+std::shared_ptr<aidl::IRadioSatelliteIndication> RadioIndication::satelliteCb() {
+    return mSatelliteCb.get();
+}
+
+}  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/satellite/RadioResponse-satellite.cpp b/radio/aidl/compat/libradiocompat/satellite/RadioResponse-satellite.cpp
new file mode 100644
index 0000000..2209c93
--- /dev/null
+++ b/radio/aidl/compat/libradiocompat/satellite/RadioResponse-satellite.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <libradiocompat/RadioResponse.h>
+
+#include "commonStructs.h"
+#include "debug.h"
+
+#include "collections.h"
+
+#define RADIO_MODULE "RadioSatelliteResponse"
+
+namespace android::hardware::radio::compat {
+
+namespace aidl = ::aidl::android::hardware::radio::satellite;
+
+void RadioResponse::setResponseFunction(
+        std::shared_ptr<aidl::IRadioSatelliteResponse> satelliteCb) {
+    mSatelliteCb = satelliteCb;
+}
+
+std::shared_ptr<aidl::IRadioSatelliteResponse> RadioResponse::satelliteCb() {
+    return mSatelliteCb.get();
+}
+
+}  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/satellite/RadioSatellite.cpp b/radio/aidl/compat/libradiocompat/satellite/RadioSatellite.cpp
new file mode 100644
index 0000000..16a3167
--- /dev/null
+++ b/radio/aidl/compat/libradiocompat/satellite/RadioSatellite.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <libradiocompat/RadioSatellite.h>
+
+#include "commonStructs.h"
+#include "debug.h"
+
+#include "collections.h"
+
+#define RADIO_MODULE "RadioSatellite"
+
+namespace android::hardware::radio::compat {
+
+using ::ndk::ScopedAStatus;
+namespace aidl = ::aidl::android::hardware::radio::satellite;
+constexpr auto ok = &ScopedAStatus::ok;
+
+std::shared_ptr<aidl::IRadioSatelliteResponse> RadioSatellite::respond() {
+    return mCallbackManager->response().satelliteCb();
+}
+
+ScopedAStatus RadioSatellite::responseAcknowledgement() {
+    LOG(ERROR) << " responseAcknowledgement is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getCapabilities(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getCapabilities is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::setPower(int32_t serial, bool /*on*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " setPower is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getPowerState(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getPowerSate is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::provisionService(
+        int32_t serial, const std::string& /*imei*/, const std::string& /*msisdn*/,
+        const std::string& /*imsi*/,
+        const std::vector<
+                ::aidl::android::hardware::radio::satellite::SatelliteFeature>& /*features*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " provisionService is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::addAllowedSatelliteContacts(
+        int32_t serial, const std::vector<std::string>& /*contacts*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " addAllowedSatelliteContacts is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::removeAllowedSatelliteContacts(
+        int32_t serial, const std::vector<std::string>& /*contacts*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " removeAllowedSatelliteContacts is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::sendMessages(int32_t serial,
+                                           const std::vector<std::string>& /*messages*/,
+                                           const std::string& /*destination*/, double /*latitude*/,
+                                           double /*longitude*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " sendMessage is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getPendingMessages(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getPendingMessages is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getSatelliteMode(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getSatelliteMode is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::setIndicationFilter(int32_t serial, int32_t /*filterBitmask*/) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " setIndicationFilter is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::startSendingSatellitePointingInfo(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " startSendingSatellitePointingInfo is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::stopSendingSatellitePointingInfo(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " stopSendingSatellitePointingInfo is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getMaxCharactersPerTextMessage(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getMaxCharactersPerTextMessage is unsupported by HIDL HALs";
+    return ok();
+}
+ScopedAStatus RadioSatellite::getTimeForNextSatelliteVisibility(int32_t serial) {
+    LOG_CALL << serial;
+    LOG(ERROR) << " getTimeForNextSatelliteVisibility is unsupported by HIDL HALs";
+    return ok();
+}
+
+ScopedAStatus RadioSatellite::setResponseFunctions(
+        const std::shared_ptr<aidl::IRadioSatelliteResponse>& response,
+        const std::shared_ptr<aidl::IRadioSatelliteIndication>& indication) {
+    LOG_CALL << response << ' ' << indication;
+    mCallbackManager->setResponseFunctions(response, indication);
+    return ok();
+}
+
+}  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/service/Android.bp b/radio/aidl/compat/service/Android.bp
index 56674c1..a3717b4 100644
--- a/radio/aidl/compat/service/Android.bp
+++ b/radio/aidl/compat/service/Android.bp
@@ -45,6 +45,7 @@
         "android.hardware.radio.modem-V2-ndk",
         "android.hardware.radio.network-V2-ndk",
         "android.hardware.radio.sap-V1-ndk",
+        "android.hardware.radio.satellite-V1-ndk",
         "android.hardware.radio.sim-V2-ndk",
         "android.hardware.radio.voice-V2-ndk",
         "android.hardware.radio@1.0",
diff --git a/radio/aidl/vts/Android.bp b/radio/aidl/vts/Android.bp
index 99c3d71..518dfd4 100644
--- a/radio/aidl/vts/Android.bp
+++ b/radio/aidl/vts/Android.bp
@@ -55,6 +55,9 @@
         "radio_network_test.cpp",
         "radio_sap_callback.cpp",
         "radio_sap_test.cpp",
+        "radio_satellite_indication.cpp",
+        "radio_satellite_response.cpp",
+        "radio_satellite_test.cpp",
         "radio_sim_indication.cpp",
         "radio_sim_response.cpp",
         "radio_sim_test.cpp",
@@ -76,6 +79,7 @@
         "android.hardware.radio.modem-V2-ndk",
         "android.hardware.radio.network-V2-ndk",
         "android.hardware.radio.sap-V1-ndk",
+        "android.hardware.radio.satellite-V1-ndk",
         "android.hardware.radio.sim-V2-ndk",
         "android.hardware.radio.voice-V2-ndk",
     ],
diff --git a/radio/aidl/vts/VtsHalRadioTargetTest.cpp b/radio/aidl/vts/VtsHalRadioTargetTest.cpp
index 33a0d7d..f718e57 100644
--- a/radio/aidl/vts/VtsHalRadioTargetTest.cpp
+++ b/radio/aidl/vts/VtsHalRadioTargetTest.cpp
@@ -23,6 +23,7 @@
 #include "radio_modem_utils.h"
 #include "radio_network_utils.h"
 #include "radio_sap_utils.h"
+#include "radio_satellite_utils.h"
 #include "radio_sim_utils.h"
 #include "radio_voice_utils.h"
 
@@ -78,6 +79,12 @@
         testing::ValuesIn(android::getAidlHalInstanceNames(IRadioIms::descriptor)),
         android::PrintInstanceNameToString);
 
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(RadioSatelliteTest);
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, RadioSatelliteTest,
+        testing::ValuesIn(android::getAidlHalInstanceNames(IRadioSatellite::descriptor)),
+        android::PrintInstanceNameToString);
+
 int main(int argc, char** argv) {
     ::testing::InitGoogleTest(&argc, argv);
     ABinderProcess_setThreadPoolMaxThreadCount(1);
diff --git a/radio/aidl/vts/radio_aidl_hal_utils.h b/radio/aidl/vts/radio_aidl_hal_utils.h
index d515e1a..2e6c49c 100644
--- a/radio/aidl/vts/radio_aidl_hal_utils.h
+++ b/radio/aidl/vts/radio_aidl_hal_utils.h
@@ -69,6 +69,8 @@
 
 static constexpr const char* FEATURE_TELEPHONY_IMS = "android.hardware.telephony.ims";
 
+static constexpr const char* FEATURE_TELEPHONY_SATELLITE = "android.hardware.telephony.satellite";
+
 #define MODEM_EMERGENCY_CALL_ESTABLISH_TIME 3
 #define MODEM_EMERGENCY_CALL_DISCONNECT_TIME 3
 #define MODEM_SET_SIM_POWER_DELAY_IN_SECONDS 2
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index f38a958..1cc6a36 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -143,9 +143,20 @@
 
     TrafficDescriptor trafficDescriptor;
     OsAppId osAppId;
-    std::string osAppIdString("osAppId");
-    std::vector<unsigned char> osAppIdVec(osAppIdString.begin(), osAppIdString.end());
-    osAppId.osAppId = osAppIdVec;
+    osAppId.osAppId = {static_cast<unsigned char>(-105), static_cast<unsigned char>(-92),
+                       static_cast<unsigned char>(-104), static_cast<unsigned char>(-29),
+                       static_cast<unsigned char>(-4),   static_cast<unsigned char>(-110),
+                       static_cast<unsigned char>(92),   static_cast<unsigned char>(-108),
+                       static_cast<unsigned char>(-119), static_cast<unsigned char>(-122),
+                       static_cast<unsigned char>(3),    static_cast<unsigned char>(51),
+                       static_cast<unsigned char>(-48),  static_cast<unsigned char>(110),
+                       static_cast<unsigned char>(78),   static_cast<unsigned char>(71),
+                       static_cast<unsigned char>(10),   static_cast<unsigned char>(69),
+                       static_cast<unsigned char>(78),   static_cast<unsigned char>(84),
+                       static_cast<unsigned char>(69),   static_cast<unsigned char>(82),
+                       static_cast<unsigned char>(80),   static_cast<unsigned char>(82),
+                       static_cast<unsigned char>(73),   static_cast<unsigned char>(83),
+                       static_cast<unsigned char>(69)};
     trafficDescriptor.osAppId = osAppId;
 
     DataProfileInfo dataProfileInfo;
diff --git a/radio/aidl/vts/radio_satellite_indication.cpp b/radio/aidl/vts/radio_satellite_indication.cpp
new file mode 100644
index 0000000..13e4453
--- /dev/null
+++ b/radio/aidl/vts/radio_satellite_indication.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "radio_satellite_utils.h"
+
+RadioSatelliteIndication::RadioSatelliteIndication(RadioServiceTest& parent)
+    : parent_satellite(parent) {}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onPendingMessageCount(RadioIndicationType /*type*/,
+                                                                   int32_t /*count*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onNewMessages(
+        RadioIndicationType /*type*/, const std::vector<std::string>& /*messages*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onMessagesTransferComplete(
+        RadioIndicationType /*type*/, bool /*complete*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onSatellitePointingInfoChanged(
+        RadioIndicationType /*type*/, const PointingInfo& /*pointingInfo*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onSatelliteModeChanged(RadioIndicationType /*type*/,
+                                                                    SatelliteMode /*mode*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onSatelliteRadioTechnologyChanged(
+        RadioIndicationType /*type*/, NTRadioTechnology /*technology*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteIndication::onProvisionStateChanged(
+        RadioIndicationType /*type*/, bool /*provisioned*/,
+        const std::vector<SatelliteFeature>& /*features*/) {
+    return ndk::ScopedAStatus::ok();
+}
diff --git a/radio/aidl/vts/radio_satellite_response.cpp b/radio/aidl/vts/radio_satellite_response.cpp
new file mode 100644
index 0000000..84d57b2
--- /dev/null
+++ b/radio/aidl/vts/radio_satellite_response.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "radio_satellite_utils.h"
+
+RadioSatelliteResponse::RadioSatelliteResponse(RadioServiceTest& parent)
+    : parent_satellite(parent) {}
+
+ndk::ScopedAStatus RadioSatelliteResponse::acknowledgeRequest(int32_t /*serial*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getCapabilitiesResponse(
+        const RadioResponseInfo& info, const SatelliteCapabilities& /*capabilities*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::setPowerResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getPowerStateResponse(const RadioResponseInfo& info,
+                                                                 bool /*on*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::provisionServiceResponse(const RadioResponseInfo& info,
+                                                                    bool /*provisioned*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::addAllowedSatelliteContactsResponse(
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::removeAllowedSatelliteContactsResponse(
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::sendMessagesResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getPendingMessagesResponse(
+        const RadioResponseInfo& info, const std::vector<std::string>& /*messages*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getSatelliteModeResponse(
+        const RadioResponseInfo& info, SatelliteMode /*mode*/, NTRadioTechnology /*technology*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::setIndicationFilterResponse(
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::startSendingSatellitePointingInfoResponse(
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::stopSendingSatellitePointingInfoResponse(
+        const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getMaxCharactersPerTextMessageResponse(
+        const RadioResponseInfo& info, int32_t /*charLimit*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus RadioSatelliteResponse::getTimeForNextSatelliteVisibilityResponse(
+        const RadioResponseInfo& info, int32_t /*timeInSeconds*/) {
+    rspInfo = info;
+    parent_satellite.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
\ No newline at end of file
diff --git a/radio/aidl/vts/radio_satellite_test.cpp b/radio/aidl/vts/radio_satellite_test.cpp
new file mode 100644
index 0000000..b0358b3
--- /dev/null
+++ b/radio/aidl/vts/radio_satellite_test.cpp
@@ -0,0 +1,626 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <aidl/android/hardware/radio/config/IRadioConfig.h>
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+
+#include "radio_satellite_utils.h"
+
+#define ASSERT_OK(ret) ASSERT_TRUE(((ret).isOk()))
+
+void RadioSatelliteTest::SetUp() {
+    std::string serviceName = GetParam();
+
+    if (!isServiceValidForDeviceConfiguration(serviceName)) {
+        ALOGI("Skipped the radio satellite tests due to device configuration.");
+        GTEST_SKIP();
+    }
+
+    satellite = IRadioSatellite::fromBinder(
+            ndk::SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    ASSERT_NE(nullptr, satellite.get());
+
+    rsp_satellite = ndk::SharedRefBase::make<RadioSatelliteResponse>(*this);
+    ASSERT_NE(nullptr, rsp_satellite.get());
+
+    count_ = 0;
+
+    ind_satellite = ndk::SharedRefBase::make<RadioSatelliteIndication>(*this);
+    ASSERT_NE(nullptr, ind_satellite.get());
+
+    satellite->setResponseFunctions(rsp_satellite, ind_satellite);
+
+    // Assert IRadioConfig exists before testing
+    radio_config = config::IRadioConfig::fromBinder(ndk::SpAIBinder(
+            AServiceManager_waitForService("android.hardware.radio.config.IRadioConfig/default")));
+    ASSERT_NE(nullptr, radio_config.get());
+}
+
+/*
+ * Test IRadioSatellite.getCapabilities() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getCapabilities) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getCapabilities because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running getCapabilities because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getCapabilities(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getCapabilities, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.setPower() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, setPower) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping setPower because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running setPower because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->setPower(serial, true);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("setPower, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.getPowerSate() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getPowerSate) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getPowerSate because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running getPowerSate because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getPowerState(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getPowerSate, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.provisionService() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, provisionService) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping provisionService because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running provisionService because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    std::string imei = "imei";
+    std::string msisdn = "msisdn";
+    std::string imsi = "imsi";
+    const std::vector<SatelliteFeature> features{
+            SatelliteFeature::SOS_SMS, SatelliteFeature::EMERGENCY_SMS, SatelliteFeature::SMS};
+    ndk::ScopedAStatus res = satellite->provisionService(serial, imei, msisdn, imsi, features);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("provisionService, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(rsp_satellite->rspInfo.error,
+                                 {RadioError::NONE,
+                                  RadioError::ABORTED,
+                                  RadioError::ACCESS_BARRED,
+                                  RadioError::CANCELLED,
+                                  RadioError::FEATURE_NOT_SUPPORTED,
+                                  RadioError::INTERNAL_ERR,
+                                  RadioError::INVALID_ARGUMENTS,
+                                  RadioError::INVALID_MODEM_STATE,
+                                  RadioError::INVALID_SIM_STATE,
+                                  RadioError::INVALID_STATE,
+                                  RadioError::MODEM_ERR,
+                                  RadioError::MODEM_INCOMPATIBLE,
+                                  RadioError::NETWORK_ERR,
+                                  RadioError::NETWORK_NOT_READY,
+                                  RadioError::NETWORK_REJECT,
+                                  RadioError::NETWORK_TIMEOUT,
+                                  RadioError::NO_MEMORY,
+                                  RadioError::NO_NETWORK_FOUND,
+                                  RadioError::NO_RESOURCES,
+                                  RadioError::NO_SATELLITE_SIGNAL,
+                                  RadioError::NO_SUBSCRIPTION,
+                                  RadioError::OPERATION_NOT_ALLOWED,
+                                  RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::RADIO_TECHNOLOGY_NOT_SUPPORTED,
+                                  RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::REQUEST_RATE_LIMITED,
+                                  RadioError::SIM_ABSENT,
+                                  RadioError::SIM_BUSY,
+                                  RadioError::SIM_ERR,
+                                  RadioError::SIM_FULL,
+                                  RadioError::SUBSCRIBER_NOT_AUTHORIZED,
+                                  RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.addAllowedSatelliteContacts() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, addAllowedSatelliteContacts) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping addAllowedSatelliteContacts because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running addAllowedSatelliteContacts because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    const std::vector<std::string> contacts = {"contact 1", "contact 2"};
+    ndk::ScopedAStatus res = satellite->addAllowedSatelliteContacts(serial, contacts);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("addAllowedSatelliteContacts, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(rsp_satellite->rspInfo.error,
+                                 {RadioError::NONE,
+                                  RadioError::ABORTED,
+                                  RadioError::ACCESS_BARRED,
+                                  RadioError::CANCELLED,
+                                  RadioError::INTERNAL_ERR,
+                                  RadioError::INVALID_ARGUMENTS,
+                                  RadioError::INVALID_CONTACT,
+                                  RadioError::INVALID_MODEM_STATE,
+                                  RadioError::INVALID_SIM_STATE,
+                                  RadioError::INVALID_STATE,
+                                  RadioError::MODEM_ERR,
+                                  RadioError::NETWORK_ERR,
+                                  RadioError::NETWORK_NOT_READY,
+                                  RadioError::NETWORK_REJECT,
+                                  RadioError::NETWORK_TIMEOUT,
+                                  RadioError::NO_MEMORY,
+                                  RadioError::NO_NETWORK_FOUND,
+                                  RadioError::NO_RESOURCES,
+                                  RadioError::NO_SATELLITE_SIGNAL,
+                                  RadioError::NO_SUBSCRIPTION,
+                                  RadioError::NOT_SUFFICIENT_ACCOUNT_BALANCE,
+                                  RadioError::OPERATION_NOT_ALLOWED,
+                                  RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::REQUEST_RATE_LIMITED,
+                                  RadioError::SIM_ABSENT,
+                                  RadioError::SIM_BUSY,
+                                  RadioError::SIM_ERR,
+                                  RadioError::SIM_FULL,
+                                  RadioError::SYSTEM_ERR,
+                                  RadioError::UNIDENTIFIED_SUBSCRIBER}));
+}
+
+/*
+ * Test IRadioSatellite.removeAllowedSatelliteContacts() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, removeAllowedSatelliteContacts) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping removeAllowedSatelliteContacts because satellite is not supported in "
+              "device");
+        return;
+    } else {
+        ALOGI("Running removeAllowedSatelliteContacts because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    const std::vector<std::string> contacts = {"contact 1", "contact 2"};
+    ndk::ScopedAStatus res = satellite->removeAllowedSatelliteContacts(serial, contacts);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("removeAllowedSatelliteContacts, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(rsp_satellite->rspInfo.error,
+                                 {RadioError::NONE,
+                                  RadioError::ABORTED,
+                                  RadioError::ACCESS_BARRED,
+                                  RadioError::CANCELLED,
+                                  RadioError::INTERNAL_ERR,
+                                  RadioError::INVALID_ARGUMENTS,
+                                  RadioError::INVALID_CONTACT,
+                                  RadioError::INVALID_MODEM_STATE,
+                                  RadioError::INVALID_SIM_STATE,
+                                  RadioError::INVALID_STATE,
+                                  RadioError::MODEM_ERR,
+                                  RadioError::NETWORK_ERR,
+                                  RadioError::NETWORK_NOT_READY,
+                                  RadioError::NETWORK_REJECT,
+                                  RadioError::NETWORK_TIMEOUT,
+                                  RadioError::NO_MEMORY,
+                                  RadioError::NO_NETWORK_FOUND,
+                                  RadioError::NO_RESOURCES,
+                                  RadioError::NO_SATELLITE_SIGNAL,
+                                  RadioError::NO_SUBSCRIPTION,
+                                  RadioError::NOT_SUFFICIENT_ACCOUNT_BALANCE,
+                                  RadioError::OPERATION_NOT_ALLOWED,
+                                  RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::REQUEST_RATE_LIMITED,
+                                  RadioError::SIM_ABSENT,
+                                  RadioError::SIM_BUSY,
+                                  RadioError::SIM_ERR,
+                                  RadioError::SIM_FULL,
+                                  RadioError::SYSTEM_ERR,
+                                  RadioError::UNIDENTIFIED_SUBSCRIBER}));
+}
+
+/*
+ * Test IRadioSatellite.sendMessages() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, sendMessages) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping sendMessages because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running sendMessages because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    const std::vector<std::string> messages = {"message 1", "message 2"};
+    std::string destination = "0123456789";
+    ndk::ScopedAStatus res = satellite->sendMessages(serial, messages, destination, 1.0, 2.0);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("sendMessages, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(rsp_satellite->rspInfo.error,
+                                 {RadioError::NONE,
+                                  RadioError::ABORTED,
+                                  RadioError::ACCESS_BARRED,
+                                  RadioError::BLOCKED_DUE_TO_CALL,
+                                  RadioError::CANCELLED,
+                                  RadioError::ENCODING_ERR,
+                                  RadioError::ENCODING_NOT_SUPPORTED,
+                                  RadioError::INTERNAL_ERR,
+                                  RadioError::INVALID_ARGUMENTS,
+                                  RadioError::INVALID_MODEM_STATE,
+                                  RadioError::INVALID_SIM_STATE,
+                                  RadioError::INVALID_SMS_FORMAT,
+                                  RadioError::INVALID_STATE,
+                                  RadioError::MODEM_ERR,
+                                  RadioError::NETWORK_ERR,
+                                  RadioError::NETWORK_NOT_READY,
+                                  RadioError::NETWORK_REJECT,
+                                  RadioError::NETWORK_TIMEOUT,
+                                  RadioError::NO_MEMORY,
+                                  RadioError::NO_NETWORK_FOUND,
+                                  RadioError::NO_RESOURCES,
+                                  RadioError::NO_SMS_TO_ACK,
+                                  RadioError::NO_SATELLITE_SIGNAL,
+                                  RadioError::NO_SUBSCRIPTION,
+                                  RadioError::NOT_SUFFICIENT_ACCOUNT_BALANCE,
+                                  RadioError::OPERATION_NOT_ALLOWED,
+                                  RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::REQUEST_RATE_LIMITED,
+                                  RadioError::SIM_ABSENT,
+                                  RadioError::SIM_BUSY,
+                                  RadioError::SIM_ERR,
+                                  RadioError::SIM_FULL,
+                                  RadioError::SIMULTANEOUS_SMS_AND_CALL_NOT_ALLOWED,
+                                  RadioError::SMS_SEND_FAIL_RETRY,
+                                  RadioError::SYSTEM_ERR,
+                                  RadioError::SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL,
+                                  RadioError::UNIDENTIFIED_SUBSCRIBER}));
+}
+
+/*
+ * Test IRadioSatellite.getPendingMessages() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getPendingMessages) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getPendingMessages because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running getPendingMessages because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getPendingMessages(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getPendingMessages, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(rsp_satellite->rspInfo.error,
+                                 {RadioError::NONE,
+                                  RadioError::ABORTED,
+                                  RadioError::ACCESS_BARRED,
+                                  RadioError::BLOCKED_DUE_TO_CALL,
+                                  RadioError::CANCELLED,
+                                  RadioError::ENCODING_ERR,
+                                  RadioError::ENCODING_NOT_SUPPORTED,
+                                  RadioError::INTERNAL_ERR,
+                                  RadioError::INVALID_ARGUMENTS,
+                                  RadioError::INVALID_MODEM_STATE,
+                                  RadioError::INVALID_SIM_STATE,
+                                  RadioError::INVALID_SMS_FORMAT,
+                                  RadioError::INVALID_STATE,
+                                  RadioError::MODEM_ERR,
+                                  RadioError::NETWORK_ERR,
+                                  RadioError::NETWORK_NOT_READY,
+                                  RadioError::NETWORK_REJECT,
+                                  RadioError::NETWORK_TIMEOUT,
+                                  RadioError::NO_MEMORY,
+                                  RadioError::NO_NETWORK_FOUND,
+                                  RadioError::NO_RESOURCES,
+                                  RadioError::NO_SMS_TO_ACK,
+                                  RadioError::NO_SATELLITE_SIGNAL,
+                                  RadioError::NO_SUBSCRIPTION,
+                                  RadioError::NOT_SUFFICIENT_ACCOUNT_BALANCE,
+                                  RadioError::OPERATION_NOT_ALLOWED,
+                                  RadioError::RADIO_NOT_AVAILABLE,
+                                  RadioError::REQUEST_NOT_SUPPORTED,
+                                  RadioError::REQUEST_RATE_LIMITED,
+                                  RadioError::SIM_ABSENT,
+                                  RadioError::SIM_BUSY,
+                                  RadioError::SIM_ERR,
+                                  RadioError::SIM_FULL,
+                                  RadioError::SIMULTANEOUS_SMS_AND_CALL_NOT_ALLOWED,
+                                  RadioError::SYSTEM_ERR,
+                                  RadioError::SWITCHED_FROM_SATELLITE_TO_TERRESTRIAL}));
+}
+
+/*
+ * Test IRadioSatellite.getSatelliteMode() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getSatelliteMode) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getSatelliteMode because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running getSatelliteMode because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getSatelliteMode(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getSatelliteMode, rspInfo.error = %s\n", toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.setIndicationFilter() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, setIndicationFilter) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping setIndicationFilter because satellite is not supported in device");
+        return;
+    } else {
+        ALOGI("Running setIndicationFilter because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->setIndicationFilter(serial, 0);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("setIndicationFilter, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.startSendingSatellitePointingInfo() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, startSendingSatellitePointingInfo) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping startSendingSatellitePointingInfo because satellite is not supported in "
+              "device");
+        return;
+    } else {
+        ALOGI("Running startSendingSatellitePointingInfo because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->startSendingSatellitePointingInfo(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("startSendingSatellitePointingInfo, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.stopSatelliteLocationUpdate() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, stopSatelliteLocationUpdate) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping stopSendingSatellitePointingInfo because satellite is not supported in "
+              "device");
+        return;
+    } else {
+        ALOGI("Running stopSendingSatellitePointingInfo because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->stopSendingSatellitePointingInfo(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("stopSendingSatellitePointingInfo, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.getMaxCharactersPerTextMessage() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getMaxCharactersPerTextMessage) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getMaxCharactersPerTextMessage because satellite is not supported in "
+              "device");
+        return;
+    } else {
+        ALOGI("Running getMaxCharactersPerTextMessage because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getMaxCharactersPerTextMessage(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getMaxCharactersPerTextMessage, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
+
+/*
+ * Test IRadioSatellite.getTimeForNextSatelliteVisibility() for the response returned.
+ */
+TEST_P(RadioSatelliteTest, getTimeForNextSatelliteVisibility) {
+    if (!deviceSupportsFeature(FEATURE_TELEPHONY_SATELLITE)) {
+        ALOGI("Skipping getTimeForNextSatelliteVisibility because satellite is not supported in "
+              "device");
+        return;
+    } else {
+        ALOGI("Running getTimeForNextSatelliteVisibility because satellite is supported in device");
+    }
+
+    serial = GetRandomSerialNumber();
+    ndk::ScopedAStatus res = satellite->getTimeForNextSatelliteVisibility(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, rsp_satellite->rspInfo.type);
+    EXPECT_EQ(serial, rsp_satellite->rspInfo.serial);
+
+    ALOGI("getTimeForNextSatelliteVisibility, rspInfo.error = %s\n",
+          toString(rsp_satellite->rspInfo.error).c_str());
+
+    ASSERT_TRUE(CheckAnyOfErrors(
+            rsp_satellite->rspInfo.error,
+            {RadioError::NONE, RadioError::INTERNAL_ERR, RadioError::INVALID_ARGUMENTS,
+             RadioError::INVALID_MODEM_STATE, RadioError::INVALID_SIM_STATE,
+             RadioError::INVALID_STATE, RadioError::MODEM_ERR, RadioError::NO_MEMORY,
+             RadioError::NO_RESOURCES, RadioError::RADIO_NOT_AVAILABLE,
+             RadioError::REQUEST_NOT_SUPPORTED, RadioError::REQUEST_RATE_LIMITED,
+             RadioError::SYSTEM_ERR}));
+}
\ No newline at end of file
diff --git a/radio/aidl/vts/radio_satellite_utils.h b/radio/aidl/vts/radio_satellite_utils.h
new file mode 100644
index 0000000..2b07ec5
--- /dev/null
+++ b/radio/aidl/vts/radio_satellite_utils.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/radio/satellite/BnRadioSatelliteIndication.h>
+#include <aidl/android/hardware/radio/satellite/BnRadioSatelliteResponse.h>
+#include <aidl/android/hardware/radio/satellite/IRadioSatellite.h>
+
+#include "radio_aidl_hal_utils.h"
+
+using namespace aidl::android::hardware::radio::satellite;
+
+class RadioSatelliteTest;
+
+/* Callback class for Satellite response */
+class RadioSatelliteResponse : public BnRadioSatelliteResponse {
+  protected:
+    RadioServiceTest& parent_satellite;
+
+  public:
+    RadioSatelliteResponse(RadioServiceTest& parent_satellite);
+    virtual ~RadioSatelliteResponse() = default;
+
+    RadioResponseInfo rspInfo;
+
+    virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
+
+    virtual ndk::ScopedAStatus getCapabilitiesResponse(
+            const RadioResponseInfo& info, const SatelliteCapabilities& capabilities) override;
+
+    virtual ndk::ScopedAStatus setPowerResponse(const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus getPowerStateResponse(const RadioResponseInfo& info,
+                                                     bool on) override;
+
+    virtual ndk::ScopedAStatus provisionServiceResponse(const RadioResponseInfo& info,
+                                                        bool provisioned) override;
+
+    virtual ndk::ScopedAStatus addAllowedSatelliteContactsResponse(
+            const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus removeAllowedSatelliteContactsResponse(
+            const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus sendMessagesResponse(const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus getPendingMessagesResponse(
+            const RadioResponseInfo& info, const std::vector<std::string>& /*messages*/) override;
+
+    virtual ndk::ScopedAStatus getSatelliteModeResponse(
+            const RadioResponseInfo& info, SatelliteMode mode,
+            satellite::NTRadioTechnology technology) override;
+
+    virtual ndk::ScopedAStatus setIndicationFilterResponse(const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus startSendingSatellitePointingInfoResponse(
+            const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus stopSendingSatellitePointingInfoResponse(
+            const RadioResponseInfo& info) override;
+
+    virtual ndk::ScopedAStatus getMaxCharactersPerTextMessageResponse(const RadioResponseInfo& info,
+                                                                      int32_t charLimit) override;
+
+    virtual ndk::ScopedAStatus getTimeForNextSatelliteVisibilityResponse(
+            const RadioResponseInfo& info, int32_t timeInSeconds) override;
+};
+
+/* Callback class for Satellite indication */
+class RadioSatelliteIndication : public BnRadioSatelliteIndication {
+  protected:
+    RadioServiceTest& parent_satellite;
+
+  public:
+    RadioSatelliteIndication(RadioServiceTest& parent_satellite);
+    virtual ~RadioSatelliteIndication() = default;
+
+    virtual ndk::ScopedAStatus onPendingMessageCount(RadioIndicationType type,
+                                                     int32_t count) override;
+
+    virtual ndk::ScopedAStatus onNewMessages(RadioIndicationType type,
+                                             const std::vector<std::string>& messages) override;
+
+    virtual ndk::ScopedAStatus onMessagesTransferComplete(RadioIndicationType type,
+                                                          bool complete) override;
+
+    virtual ndk::ScopedAStatus onSatellitePointingInfoChanged(
+            RadioIndicationType type, const PointingInfo& pointingInfo) override;
+
+    virtual ndk::ScopedAStatus onSatelliteModeChanged(RadioIndicationType type,
+                                                      SatelliteMode mode) override;
+
+    virtual ndk::ScopedAStatus onSatelliteRadioTechnologyChanged(
+            RadioIndicationType type, satellite::NTRadioTechnology technology) override;
+
+    virtual ndk::ScopedAStatus onProvisionStateChanged(
+            RadioIndicationType type, bool provisioned,
+            const std::vector<SatelliteFeature>& features) override;
+};
+
+// The main test class for AIDL Satellite.
+class RadioSatelliteTest : public ::testing::TestWithParam<std::string>, public RadioServiceTest {
+  public:
+    virtual void SetUp() override;
+
+    /* Radio Satellite service handle */
+    std::shared_ptr<IRadioSatellite> satellite;
+    /* Radio Satellite response handle */
+    std::shared_ptr<RadioSatelliteResponse> rsp_satellite;
+    /* Radio Satellite indication handle */
+    std::shared_ptr<RadioSatelliteIndication> ind_satellite;
+};
diff --git a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
index 7c5a704..b9ce9d1 100644
--- a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
+++ b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
@@ -113,7 +113,8 @@
      * Reset the Secure Element.
      *
      * HAL should trigger reset to the secure element. It could hardware power cycle or
-     * a soft reset depends on the hardware design.
+     * a soft reset depends on the hardware design. All channels opened are
+     * closed by this operation.
      * HAL service must send onStateChange() with connected equal to true
      * after resetting and all the re-initialization has been successfully completed.
      */
diff --git a/secure_element/aidl/default/main.cpp b/secure_element/aidl/default/main.cpp
index 9b5a8fc..6149eae 100644
--- a/secure_element/aidl/default/main.cpp
+++ b/secure_element/aidl/default/main.cpp
@@ -418,29 +418,37 @@
                                      test_applet});
     }
 
-    ScopedAStatus init(const std::shared_ptr<ISecureElementCallback>& clientCallback) override {
-        LOG(INFO) << __func__ << " callback: " << clientCallback.get();
-        if (!clientCallback) {
+    ScopedAStatus init(const std::shared_ptr<ISecureElementCallback>& client_callback) override {
+        LOG(INFO) << __func__ << " callback: " << client_callback.get();
+        if (client_callback == nullptr) {
             return ScopedAStatus::fromExceptionCode(EX_NULL_POINTER);
         }
-        client_callback_ = clientCallback;
+        for (auto& channel : channels_) {
+            channel = Channel();
+        }
+        client_callback_ = client_callback;
         client_callback_->onStateChange(true, "init");
         return ScopedAStatus::ok();
     }
 
     ScopedAStatus getAtr(std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         *aidl_return = atr_;
         return ScopedAStatus::ok();
     }
 
     ScopedAStatus reset() override {
         LOG(INFO) << __func__;
-        CHECK(client_callback_ != nullptr) << " init not invoked";
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         client_callback_->onStateChange(false, "reset");
         client_callback_->onStateChange(true, "reset");
         // All channels are closed after reset.
-        for (auto channel : channels_) {
+        for (auto& channel : channels_) {
             channel = Channel();
         }
         return ScopedAStatus::ok();
@@ -448,6 +456,9 @@
 
     ScopedAStatus isCardPresent(bool* aidl_return) override {
         LOG(INFO) << __func__;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         *aidl_return = true;
         return ScopedAStatus::ok();
     }
@@ -456,6 +467,9 @@
                                    std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__ << " aid: " << HexString(aid.data(), aid.size()) << " (" << aid.size()
                   << ") p2 " << p2;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
 
         std::vector<uint8_t> select_response;
         std::shared_ptr<se::Applet> applet = nullptr;
@@ -508,6 +522,10 @@
         LOG(INFO) << __func__ << " aid: " << HexString(aid.data(), aid.size()) << " (" << aid.size()
                   << ") p2 " << p2;
 
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
+
         size_t channel_number = 1;
         std::vector<uint8_t> select_response;
         std::shared_ptr<se::Applet> applet = nullptr;
@@ -562,6 +580,10 @@
 
     ScopedAStatus closeChannel(int8_t channel_number) override {
         LOG(INFO) << __func__ << " channel number: " << static_cast<int>(channel_number);
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
+
         // The selected basic or logical channel is not opened.
         if (channel_number >= channels_.size() || !channels_[channel_number].opened) {
             return ScopedAStatus::ok();
@@ -580,6 +602,9 @@
                            std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__ << " data: " << HexString(data.data(), data.size()) << " ("
                   << data.size() << ")";
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
 
         se::Apdu apdu(data);
         uint8_t channel_number = apdu.get_channel_number();
@@ -648,7 +673,7 @@
 
     // Channel 0 is the basic channel, channels 1-19 are the logical channels.
     std::array<Channel, 20> channels_{};
-    std::shared_ptr<ISecureElementCallback> client_callback_;
+    std::shared_ptr<ISecureElementCallback> client_callback_{nullptr};
 
     // Secure element abstraction.
 
diff --git a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
index a85a8bc..c265579 100644
--- a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
+++ b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
@@ -18,6 +18,7 @@
 #include <aidl/Vintf.h>
 #include <aidl/android/hardware/secure_element/BnSecureElementCallback.h>
 #include <aidl/android/hardware/secure_element/ISecureElement.h>
+#include <android-base/logging.h>
 #include <android/binder_manager.h>
 #include <android/binder_process.h>
 #include <gmock/gmock.h>
@@ -44,10 +45,29 @@
         EXPECT_TRUE(status_impl.isOk()) << status_impl.getDescription(); \
     } while (false)
 
-static const std::vector<uint8_t> kDataApdu = {0x00, 0x08, 0x00, 0x00, 0x00};
-static const std::vector<uint8_t> kAndroidTestAid = {0xA0, 0x00, 0x00, 0x04, 0x76, 0x41,
-                                                     0x6E, 0x64, 0x72, 0x6F, 0x69, 0x64,
-                                                     0x43, 0x54, 0x53, 0x31};
+#define EXPECT_ERR(status)                                                \
+    do {                                                                  \
+        auto status_impl = (status);                                      \
+        EXPECT_FALSE(status_impl.isOk()) << status_impl.getDescription(); \
+    } while (false)
+
+// APDU defined in CTS tests.
+// The applet selected with kSelectableAid will return 256 bytes of data
+// in response.
+static const std::vector<uint8_t> kDataApdu = {
+        0x00, 0x08, 0x00, 0x00, 0x00,
+};
+
+// Selectable test AID defined in CTS tests.
+static const std::vector<uint8_t> kSelectableAid = {
+        0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64,
+        0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, 0x31,
+};
+// Non-selectable test AID defined in CTS tests.
+static const std::vector<uint8_t> kNonSelectableAid = {
+        0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64,
+        0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, 0xFF,
+};
 
 class MySecureElementCallback : public BnSecureElementCallback {
   public:
@@ -75,91 +95,173 @@
 
 class SecureElementAidl : public ::testing::TestWithParam<std::string> {
   public:
-    virtual void SetUp() override {
+    void SetUp() override {
         SpAIBinder binder = SpAIBinder(AServiceManager_waitForService(GetParam().c_str()));
-        se = ISecureElement::fromBinder(binder);
-        ASSERT_NE(se, nullptr);
 
-        cb = SharedRefBase::make<MySecureElementCallback>();
-        EXPECT_OK(se->init(cb));
+        secure_element_ = ISecureElement::fromBinder(binder);
+        ASSERT_NE(secure_element_, nullptr);
 
-        cb->expectCallbackHistory({true});
+        secure_element_callback_ = SharedRefBase::make<MySecureElementCallback>();
+        ASSERT_NE(secure_element_callback_, nullptr);
+
+        EXPECT_OK(secure_element_->init(secure_element_callback_));
+        secure_element_callback_->expectCallbackHistory({true});
     }
 
-    std::shared_ptr<ISecureElement> se;
-    std::shared_ptr<MySecureElementCallback> cb;
+    void TearDown() override {
+        secure_element_ = nullptr;
+        secure_element_callback_ = nullptr;
+    }
+
+    // Call transmit with kDataApdu and the selected channel number.
+    // Return the response sstatus code.
+    uint16_t transmit(uint8_t channel_number) {
+        std::vector<uint8_t> apdu = kDataApdu;
+        std::vector<uint8_t> response;
+
+        // Edit the channel number into the CLA header byte.
+        if (channel_number < 4) {
+            apdu[0] |= channel_number;
+        } else {
+            apdu[0] |= (channel_number - 4) | 0x40;
+        }
+
+        EXPECT_OK(secure_element_->transmit(apdu, &response));
+        EXPECT_GE(response.size(), 2u);
+        uint16_t status =
+                (response[response.size() - 2] << 8) | (response[response.size() - 1] << 0);
+
+        // When the command is successful the response
+        // must contain 256 bytes of data.
+        if (status == 0x9000) {
+            EXPECT_EQ(response.size(), 258);
+        }
+
+        return status;
+    }
+
+    std::shared_ptr<ISecureElement> secure_element_;
+    std::shared_ptr<MySecureElementCallback> secure_element_callback_;
 };
 
+TEST_P(SecureElementAidl, init) {
+    // init(nullptr) shall fail.
+    EXPECT_ERR(secure_element_->init(nullptr));
+
+    // init with a valid callback pointer shall succeed.
+    EXPECT_OK(secure_element_->init(secure_element_callback_));
+    secure_element_callback_->expectCallbackHistory({true, true});
+}
+
+TEST_P(SecureElementAidl, reset) {
+    std::vector<uint8_t> basic_channel_response;
+    LogicalChannelResponse logical_channel_response;
+
+    // reset called after init shall succeed.
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &basic_channel_response));
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &logical_channel_response));
+
+    EXPECT_OK(secure_element_->reset());
+    secure_element_callback_->expectCallbackHistory({true, false, true});
+
+    // All opened channels must be closed.
+    EXPECT_NE(transmit(0), 0x9000);
+    EXPECT_NE(transmit(logical_channel_response.channelNumber), 0x9000);
+}
+
 TEST_P(SecureElementAidl, isCardPresent) {
     bool res = false;
-    EXPECT_OK(se->isCardPresent(&res));
+
+    // isCardPresent called after init shall succeed.
+    EXPECT_OK(secure_element_->isCardPresent(&res));
     EXPECT_TRUE(res);
 }
 
-TEST_P(SecureElementAidl, transmit) {
-    LogicalChannelResponse response;
-    EXPECT_OK(se->openLogicalChannel(kAndroidTestAid, 0x00, &response));
-
-    EXPECT_GE(response.selectResponse.size(), 2u);
-    EXPECT_GE(response.channelNumber, 1);
-
-    std::vector<uint8_t> command = kDataApdu;
-    command[0] |= response.channelNumber;
-
-    std::vector<uint8_t> transmitResponse;
-    EXPECT_OK(se->transmit(command, &transmitResponse));
-
-    EXPECT_LE(transmitResponse.size(), 3);
-    EXPECT_GE(transmitResponse.size(), 2);
-    EXPECT_EQ(transmitResponse[transmitResponse.size() - 1], 0x00);
-    EXPECT_EQ(transmitResponse[transmitResponse.size() - 2], 0x90);
-
-    EXPECT_OK(se->closeChannel(response.channelNumber));
-}
-
-TEST_P(SecureElementAidl, openBasicChannel) {
-    std::vector<uint8_t> response;
-    auto status = se->openBasicChannel(kAndroidTestAid, 0x00, &response);
-
-    if (!status.isOk()) {
-        EXPECT_EQ(status.getServiceSpecificError(), ISecureElement::CHANNEL_NOT_AVAILABLE)
-                << status.getDescription();
-        return;
-    }
-
-    EXPECT_GE(response.size(), 2u);
-    EXPECT_OK(se->closeChannel(0));
-}
-
 TEST_P(SecureElementAidl, getAtr) {
     std::vector<uint8_t> atr;
-    EXPECT_OK(se->getAtr(&atr));
-    if (atr.size() == 0) {
-        return;
-    }
+
+    // getAtr called after init shall succeed.
+    // The ATR has size between 0 and 32 bytes.
+    EXPECT_OK(secure_element_->getAtr(&atr));
     EXPECT_LE(atr.size(), 32u);
-    EXPECT_GE(atr.size(), 1u);
 }
 
-TEST_P(SecureElementAidl, openCloseLogicalChannel) {
+TEST_P(SecureElementAidl, openBasicChannel) {
+    std::vector<uint8_t> response;
+
+    // openBasicChannel called with an invalid AID shall fail.
+    EXPECT_ERR(secure_element_->openBasicChannel(kNonSelectableAid, 0x00, &response));
+
+    // openBasicChannel called after init shall succeed.
+    // The response size must be larger than 2 bytes as it includes the
+    // status code.
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
+    EXPECT_GE(response.size(), 2u);
+
+    // tramsmit called on the basic channel should succeed.
+    EXPECT_EQ(transmit(0), 0x9000);
+
+    // openBasicChannel called a second time shall fail.
+    // The basic channel can only be opened once.
+    EXPECT_ERR(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
+
+    // openBasicChannel called after closing the basic channel shall succeed.
+    EXPECT_OK(secure_element_->closeChannel(0));
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
+}
+
+TEST_P(SecureElementAidl, openLogicalChannel) {
     LogicalChannelResponse response;
-    EXPECT_OK(se->openLogicalChannel(kAndroidTestAid, 0x00, &response));
+
+    // openLogicalChannel called with an invalid AID shall fail.
+    EXPECT_ERR(secure_element_->openLogicalChannel(kNonSelectableAid, 0x00, &response));
+
+    // openLogicalChannel called after init shall succeed.
+    // The response size must be larger than 2 bytes as it includes the
+    // status code. The channel number must be in the range 1-19.
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &response));
     EXPECT_GE(response.selectResponse.size(), 2u);
-    EXPECT_GE(response.channelNumber, 1);
-    EXPECT_OK(se->closeChannel(response.channelNumber));
+    EXPECT_GE(response.channelNumber, 1u);
+    EXPECT_LE(response.channelNumber, 19u);
+
+    // tramsmit called on the logical channel should succeed.
+    EXPECT_EQ(transmit(response.channelNumber), 0x9000);
 }
 
-TEST_P(SecureElementAidl, openInvalidAid) {
-    LogicalChannelResponse response;
-    auto status = se->openLogicalChannel({0x42}, 0x00, &response);
-    EXPECT_EQ(status.getServiceSpecificError(), ISecureElement::NO_SUCH_ELEMENT_ERROR)
-            << status.getDescription();
+TEST_P(SecureElementAidl, closeChannel) {
+    std::vector<uint8_t> basic_channel_response;
+    LogicalChannelResponse logical_channel_response;
+
+    // closeChannel called on non-existing basic or logical channel is a no-op
+    // and shall succeed.
+    EXPECT_OK(secure_element_->closeChannel(0));
+    EXPECT_OK(secure_element_->closeChannel(1));
+
+    // closeChannel called on basic channel closes the basic channel.
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &basic_channel_response));
+    EXPECT_OK(secure_element_->closeChannel(0));
+
+    // tramsmit called on the basic channel should fail.
+    EXPECT_NE(transmit(0), 0x9000);
+
+    // closeChannel called on logical channel closes the logical channel.
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &logical_channel_response));
+    EXPECT_OK(secure_element_->closeChannel(logical_channel_response.channelNumber));
+
+    // tramsmit called on the basic channel should fail.
+    EXPECT_NE(transmit(logical_channel_response.channelNumber), 0x9000);
 }
 
-TEST_P(SecureElementAidl, Reset) {
-    cb->expectCallbackHistory({true});
-    EXPECT_OK(se->reset());
-    cb->expectCallbackHistory({true, false, true});
+TEST_P(SecureElementAidl, transmit) {
+    std::vector<uint8_t> response;
+
+    // transmit called after init shall succeed.
+    // Note: no channel is opened for this test and the transmit
+    // response will have the status SW_LOGICAL_CHANNEL_NOT_SUPPORTED.
+    // The transmit response shall be larger than 2 bytes as it includes the
+    // status code.
+    EXPECT_OK(secure_element_->transmit(kDataApdu, &response));
+    EXPECT_GE(response.size(), 2u);
 }
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(SecureElementAidl);
diff --git a/security/OWNERS b/security/OWNERS
index fbaf854..619139b 100644
--- a/security/OWNERS
+++ b/security/OWNERS
@@ -6,9 +6,11 @@
 #
 # This will get them auto-assigned to the on-call triage engineer, ensuring quickest response.
 
+ascull@google.com
 drysdale@google.com
 eranm@google.com
 hasinitg@google.com
 jbires@google.com
+sethmo@google.com
 swillden@google.com
 zeuthen@google.com
diff --git a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
index 837fc81..d401247 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
@@ -885,9 +885,9 @@
 
     /**
      * Tag::ATTESTATION_ID_SECOND_IMEI provides an additional IMEI of one of the radios on the
-     * device to attested key generation/import operations. This field MUST be accompanied by
-     * the Tag::ATTESTATION_ID_IMEI tag. It would only be used to convery a second IMEI the device
-     * has, after Tag::ATTESTATION_ID_SECOND_IMEI has been used to convery the first IMEI.
+     * device to attested key generation/import operations. It should be used to convey an
+     * IMEI different to the one conveyed by the Tag::ATTESTATION_ID_IMEI tag. Like all other
+     * ID attestation flags, it may be included independently of other tags.
      *
      * If the device does not support ID attestation (or destroyAttestationIds() was previously
      * called and the device can no longer attest its IDs), any key attestation request that
diff --git a/security/keymint/aidl/vts/functional/Android.bp b/security/keymint/aidl/vts/functional/Android.bp
index 58b0645..26e91bd 100644
--- a/security/keymint/aidl/vts/functional/Android.bp
+++ b/security/keymint/aidl/vts/functional/Android.bp
@@ -34,6 +34,7 @@
         "libbinder",
         "libbinder_ndk",
         "libcrypto",
+        "libbase",
         "packagemanager_aidl-cpp",
     ],
     static_libs: [
diff --git a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
index ea4ba18..970ae67 100644
--- a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
+++ b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
@@ -15,6 +15,8 @@
  */
 
 #define LOG_TAG "keymint_1_attest_key_test"
+#include <android-base/logging.h>
+#include <android-base/strings.h>
 #include <cutils/log.h>
 #include <cutils/properties.h>
 
@@ -26,12 +28,61 @@
 namespace aidl::android::hardware::security::keymint::test {
 
 namespace {
+string TELEPHONY_CMD_GET_IMEI = "cmd phone get-imei ";
 
 bool IsSelfSigned(const vector<Certificate>& chain) {
     if (chain.size() != 1) return false;
     return ChainSignaturesAreValid(chain);
 }
 
+/*
+ * Run a shell command and collect the output of it. If any error, set an empty string as the
+ * output.
+ */
+string exec_command(string command) {
+    char buffer[128];
+    string result = "";
+
+    FILE* pipe = popen(command.c_str(), "r");
+    if (!pipe) {
+        LOG(ERROR) << "popen failed.";
+        return result;
+    }
+
+    // read till end of process:
+    while (!feof(pipe)) {
+        if (fgets(buffer, 128, pipe) != NULL) {
+            result += buffer;
+        }
+    }
+
+    pclose(pipe);
+    return result;
+}
+
+/*
+ * Get IMEI using Telephony service shell command. If any error while executing the command
+ * then empty string will be returned as output.
+ */
+string get_imei(int slot) {
+    string cmd = TELEPHONY_CMD_GET_IMEI + std::to_string(slot);
+    string output = exec_command(cmd);
+
+    if (output.empty()) {
+        LOG(ERROR) << "Command failed. Cmd: " << cmd;
+        return "";
+    }
+
+    vector<string> out = ::android::base::Tokenize(::android::base::Trim(output), "Device IMEI:");
+
+    if (out.size() != 1) {
+        LOG(ERROR) << "Error in parsing the command output. Cmd: " << cmd;
+        return "";
+    }
+
+    return ::android::base::Trim(out[0]);
+}
+
 }  // namespace
 
 class AttestKeyTest : public KeyMintAidlTestBase {
@@ -803,6 +854,11 @@
                       "ro.product.manufacturer");
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
 
+    string imei = get_imei(0);
+    if (!imei.empty()) {
+        attestation_id_tags.Authorization(TAG_ATTESTATION_ID_IMEI, imei.data(), imei.size());
+    }
+
     for (const KeyParameter& tag : attestation_id_tags) {
         SCOPED_TRACE(testing::Message() << "+tag-" << tag);
         // Use attestation key to sign an ECDSA key, but include an attestation ID field.
diff --git a/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp b/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
index c952012..2091b4b 100644
--- a/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
@@ -588,7 +588,7 @@
             ASSERT_EQ(ErrorCode::OK, DeleteKey(&keyblob));
 
             // Remove all files relating to the deleted key.
-            std::cerr << "Deleting files for deleted key '" << name << ";";
+            std::cerr << "Deleting files for deleted key '" << name << "';\n";
             delete_keyblob(subdir, name);
 
             // Attempting to use the keyblob after deletion should fail.
diff --git a/security/keymint/support/Android.bp b/security/keymint/support/Android.bp
index 8d7731c..1a8695b 100644
--- a/security/keymint/support/Android.bp
+++ b/security/keymint/support/Android.bp
@@ -66,6 +66,9 @@
     static_libs: [
         "android.hardware.security.rkp-V3-ndk",
     ],
+    whole_static_libs: [
+        "libhwtrust_cxx",
+    ],
     shared_libs: [
         "libbase",
         "libbinder_ndk",
diff --git a/security/keymint/support/include/remote_prov/remote_prov_utils.h b/security/keymint/support/include/remote_prov/remote_prov_utils.h
index 1b94c62..79189a1 100644
--- a/security/keymint/support/include/remote_prov/remote_prov_utils.h
+++ b/security/keymint/support/include/remote_prov/remote_prov_utils.h
@@ -108,15 +108,6 @@
     bytevec pubKey;
 };
 
-/**
- * Validates the provided CBOR-encoded BCC, returning a vector of BccEntryData
- * structs containing the BCC entry contents.  If an entry contains no firmware
- * digest, the corresponding BccEntryData.firmwareDigest will have length zero
- * (there's no way to distinguish between an empty and missing firmware digest,
- * which seems fine).
- */
-ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc);
-
 struct JsonOutput {
     static JsonOutput Ok(std::string json) { return {std::move(json), ""}; }
     static JsonOutput Error(std::string error) { return {"", std::move(error)}; }
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index ea0fbd8..9620b6a 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -24,6 +24,7 @@
 #include <aidl/android/hardware/security/keymint/RpcHardwareInfo.h>
 #include <android-base/properties.h>
 #include <cppbor.h>
+#include <hwtrust/hwtrust.h>
 #include <json/json.h>
 #include <keymaster/km_openssl/ec_key.h>
 #include <keymaster/km_openssl/ecdsa_operation.h>
@@ -289,129 +290,16 @@
     return chain.encode();
 }
 
-ErrMsgOr<bytevec> validatePayloadAndFetchPubKey(const cppbor::Map* payload) {
-    const auto& issuer = payload->get(kBccPayloadIssuer);
-    if (!issuer || !issuer->asTstr()) return "Issuer is not present or not a tstr.";
-    const auto& subject = payload->get(kBccPayloadSubject);
-    if (!subject || !subject->asTstr()) return "Subject is not present or not a tstr.";
-    const auto& keyUsage = payload->get(kBccPayloadKeyUsage);
-    if (!keyUsage || !keyUsage->asBstr()) return "Key usage is not present or not a bstr.";
-    const auto& serializedKey = payload->get(kBccPayloadSubjPubKey);
-    if (!serializedKey || !serializedKey->asBstr()) return "Key is not present or not a bstr.";
-    return serializedKey->asBstr()->value();
-}
-
-ErrMsgOr<bytevec> verifyAndParseCoseSign1Cwt(const cppbor::Array* coseSign1,
-                                             const bytevec& signingCoseKey, const bytevec& aad) {
-    if (!coseSign1 || coseSign1->size() != kCoseSign1EntryCount) {
-        return "Invalid COSE_Sign1";
-    }
-
-    const cppbor::Bstr* protectedParams = coseSign1->get(kCoseSign1ProtectedParams)->asBstr();
-    const cppbor::Map* unprotectedParams = coseSign1->get(kCoseSign1UnprotectedParams)->asMap();
-    const cppbor::Bstr* payload = coseSign1->get(kCoseSign1Payload)->asBstr();
-    const cppbor::Bstr* signature = coseSign1->get(kCoseSign1Signature)->asBstr();
-
-    if (!protectedParams || !unprotectedParams || !payload || !signature) {
-        return "Invalid COSE_Sign1";
-    }
-
-    auto [parsedProtParams, _, errMsg] = cppbor::parse(protectedParams);
-    if (!parsedProtParams) {
-        return errMsg + " when parsing protected params.";
-    }
-    if (!parsedProtParams->asMap()) {
-        return "Protected params must be a map";
-    }
-
-    auto& algorithm = parsedProtParams->asMap()->get(ALGORITHM);
-    if (!algorithm || !algorithm->asInt() ||
-        (algorithm->asInt()->value() != EDDSA && algorithm->asInt()->value() != ES256)) {
-        return "Unsupported signature algorithm";
-    }
-
-    auto [parsedPayload, __, payloadErrMsg] = cppbor::parse(payload);
-    if (!parsedPayload) return payloadErrMsg + " when parsing key";
-    if (!parsedPayload->asMap()) return "CWT must be a map";
-    auto serializedKey = validatePayloadAndFetchPubKey(parsedPayload->asMap());
-    if (!serializedKey) {
-        return "CWT validation failed: " + serializedKey.moveMessage();
-    }
-
-    bool selfSigned = signingCoseKey.empty();
-    bytevec signatureInput =
-        cppbor::Array().add("Signature1").add(*protectedParams).add(aad).add(*payload).encode();
-
-    if (algorithm->asInt()->value() == EDDSA) {
-        auto key = CoseKey::parseEd25519(selfSigned ? *serializedKey : signingCoseKey);
-
-        if (!key) return "Bad signing key: " + key.moveMessage();
-
-        if (!ED25519_verify(signatureInput.data(), signatureInput.size(), signature->value().data(),
-                            key->getBstrValue(CoseKey::PUBKEY_X)->data())) {
-            return "Signature verification failed";
-        }
-    } else {  // P256
-        auto key = CoseKey::parseP256(selfSigned ? *serializedKey : signingCoseKey);
-        if (!key || key->getBstrValue(CoseKey::PUBKEY_X)->empty() ||
-            key->getBstrValue(CoseKey::PUBKEY_Y)->empty()) {
-            return "Bad signing key: " + key.moveMessage();
-        }
-        auto publicKey = key->getEcPublicKey();
-        if (!publicKey) return publicKey.moveMessage();
-
-        auto ecdsaDerSignature = ecdsaCoseSignatureToDer(signature->value());
-        if (!ecdsaDerSignature) return ecdsaDerSignature.moveMessage();
-
-        // convert public key to uncompressed form.
-        publicKey->insert(publicKey->begin(), 0x04);
-
-        if (!verifyEcdsaDigest(publicKey.moveValue(), sha256(signatureInput), *ecdsaDerSignature)) {
-            return "Signature verification failed";
-        }
-    }
-
-    return serializedKey.moveValue();
-}
-
 ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc) {
-    if (!bcc || bcc->size() == 0) return "Invalid BCC";
-
+    auto encodedBcc = bcc->encode();
+    auto chain = hwtrust::DiceChain::verify(encodedBcc);
+    if (!chain.ok()) return chain.error().message();
+    auto keys = chain->cose_public_keys();
+    if (!keys.ok()) return keys.error().message();
     std::vector<BccEntryData> result;
-
-    const auto& devicePubKey = bcc->get(0);
-    if (!devicePubKey->asMap()) return "Invalid device public key at the 1st entry in the BCC";
-
-    bytevec prevKey;
-
-    for (size_t i = 1; i < bcc->size(); ++i) {
-        const cppbor::Array* entry = bcc->get(i)->asArray();
-        if (!entry || entry->size() != kCoseSign1EntryCount) {
-            return "Invalid BCC entry " + std::to_string(i) + ": " + prettyPrint(entry);
-        }
-        auto payload = verifyAndParseCoseSign1Cwt(entry, std::move(prevKey), bytevec{} /* AAD */);
-        if (!payload) {
-            return "Failed to verify entry " + std::to_string(i) + ": " + payload.moveMessage();
-        }
-
-        auto& certProtParms = entry->get(kCoseSign1ProtectedParams);
-        if (!certProtParms || !certProtParms->asBstr()) return "Invalid prot params";
-        auto [parsedProtParms, _, errMsg] = cppbor::parse(certProtParms->asBstr()->value());
-        if (!parsedProtParms || !parsedProtParms->asMap()) return "Invalid prot params";
-
-        result.push_back(BccEntryData{*payload});
-
-        // This entry's public key is the signing key for the next entry.
-        prevKey = payload.moveValue();
-        if (i == 1) {
-            auto [parsedRootKey, _, errMsg] = cppbor::parse(prevKey);
-            if (!parsedRootKey || !parsedRootKey->asMap()) return "Invalid payload entry in BCC.";
-            if (*parsedRootKey != *devicePubKey) {
-                return "Device public key doesn't match BCC root.";
-            }
-        }
+    for (auto& key : *keys) {
+        result.push_back({std::move(key)});
     }
-
     return result;
 }
 
@@ -685,9 +573,6 @@
     if (!bccContents) {
         return bccContents.message() + "\n" + prettyPrint(bcc.get());
     }
-    if (bccContents->size() == 0U) {
-        return "The BCC is empty. It must contain at least one entry.";
-    }
 
     auto deviceInfoResult =
             parseAndValidateDeviceInfo(deviceInfo.deviceInfo, provisionable, isFactory);
@@ -979,9 +864,6 @@
     if (!diceContents) {
         return diceContents.message() + "\n" + prettyPrint(diceCertChain);
     }
-    if (diceContents->size() == 0U) {
-        return "The DICE chain is empty. It must contain at least one entry.";
-    }
 
     auto& udsPub = diceContents->back().pubKey;
 
diff --git a/security/rkp/CHANGELOG.md b/security/rkp/CHANGELOG.md
index 715cf28..9409a6d 100644
--- a/security/rkp/CHANGELOG.md
+++ b/security/rkp/CHANGELOG.md
@@ -41,6 +41,7 @@
       payload and the implementation-defined payload itself. This is done by creating a typed
       `AuthenticatedRequest<T>` object representing the top level data required to authenticate
       the data provided in the payload, `T`.
+  * The new CSR format supports P-384 signing keys and SHA-384 hashes in the DICE chain.
 * RpcHardwareInfo
   * `supportedNumKeysInCsr` added to report the maximum number of keys supported in a CSR.
   * `supportedEekCurve` is no longer used, due to the removal of the EEK from the scheme.
diff --git a/security/rkp/README.md b/security/rkp/README.md
index 5fb4948..9090ac5 100644
--- a/security/rkp/README.md
+++ b/security/rkp/README.md
@@ -172,31 +172,28 @@
 
 *   ECDSA P-256 for attestation signing keys;
 *   Remote provisioning protocol signing keys:
-  *  Ed25519 / P-256
+  *  Ed25519 / P-256 / P-384
 *   ECDH keys:
   *  X25519 / P-256
 *   AES-GCM for all encryption;
-*   SHA-256 for all message digesting;
-*   HMAC-SHA-256 for all MACing; and
-*   HKDF-SHA-256 for all key derivation.
+*   SHA-256 / SHA-384 / SHA-512 for message digesting;
+*   HMAC with a supported message digest for all MACing; and
+*   HKDF with a supported message digest for all key derivation.
 
 We believe that Curve25519 offers the best tradeoff in terms of security,
 efficiency and global trustworthiness, and that it is now sufficiently
 widely-used and widely-implemented to make it a practical choice.
 
-However, since Secure Elements (SE) do not currently offer support for curve
-25519, we are allowing implementations to instead make use of EC P-256 for
-signing and ECDH. To put it simply, the device unique key pair will be a P-256
-key pair for ECDSA instead of Ed25519, and the ProtectedData COSE\_Encrypt
-message will have its payload encrypted with P-256 ECDH key exchange instead of
-X25519.
+However, since hardware such as Secure Elements (SE) do not currently offer
+support for curve 25519, we are allowing implementations to instead make use of
+ECDSA and ECDH.
 
 The CDDL in the rest of the document will use the '/' operator to show areas
-where either curve 25519 or P-256 may be used. Since there is no easy way to
-bind choices across different CDDL groups, it is important that the implementor
-stays consistent in which type is chosen. E.g. taking ES256 as the choice for
-algorithm implies the implementor should also choose the P256 public key group
-further down in the COSE structure.
+where either curve 25519, P-256 or P-384 may be used. Since there is no easy way
+to bind choices across different CDDL groups, it is important that the
+implementor stays consistent in which type is chosen. E.g. taking ES256 as the
+choice for algorithm implies the implementor should also choose the P256 public
+key group further down in the COSE structure.
 
 ### Testability
 
diff --git a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index ff710f1..5bd2145 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -159,18 +159,27 @@
      *        IRemotelyProvisionedComponent must validate the MACs on each key.  If any entry in the
      *        array lacks a valid MAC, the method must return STATUS_INVALID_MAC.
      *
-     *        If testMode is true, the keysToCertify array must contain only keys flagged as test
+     *        If testMode is true, the keysToSign array must contain only keys flagged as test
      *        keys. Otherwise, the method must return STATUS_PRODUCTION_KEY_IN_TEST_REQUEST.
      *
-     *        If testMode is false, the keysToCertify array must not contain any keys flagged as
+     *        If testMode is false, the keysToSign array must not contain any keys flagged as
      *        test keys. Otherwise, the method must return STATUS_TEST_KEY_IN_PRODUCTION_REQUEST.
      *
-     * @param in endpointEncryptionKey contains an X25519 public key which will be used to encrypt
-     *        the BCC. For flexibility, this is represented as a certificate chain, represented as a
-     *        CBOR array of COSE_Sign1 objects, ordered from root to leaf. The leaf contains the
-     *        X25519 encryption key, each other element is an Ed25519 key signing the next in the
-     *        chain. The root is self-signed. An implementor may also choose to use P256 as an
-     *        alternative curve for signing and encryption instead of Curve 25519.
+     * @param in endpointEncryptionKey contains an X25519 or P-256 public key which will be used to
+     *        encrypt the BCC. For flexibility, this is represented as a certificate chain
+     *        in the form of a CBOR array of COSE_Sign1 objects, ordered from root to leaf.  An
+     *        implementor may also choose to use P256 as an alternative curve for signing and
+     *        encryption instead of Curve 25519, as indicated by the supportedEekCurve field in
+     *        RpcHardwareInfo; the contents of the EEK chain will match the specified
+     *        supportedEekCurve.
+     *
+     *        - For CURVE_25519 the leaf contains the X25519 agreement key, each other element is an
+     *          Ed25519 key signing the next in the chain.
+     *
+     *        - For CURVE_P256 the leaf contains the P-256 agreement key, each other element is a
+     *          P-256 key signing the next in the chain.
+     *
+     *        In either case, the root is self-signed.
      *
      *            EekChain = [ + SignedSignatureKey, SignedEek ]
      *
@@ -335,14 +344,14 @@
      *     UdsCerts,
      *     DiceCertChain,
      *     SignedData<[
-     *         challenge: bstr .size (32..64), ; Provided by the method parameters
+     *         challenge: bstr .size (16..64), ; Provided by the method parameters
      *         bstr .cbor T,
      *     ]>,
      * ]
      *
      * ; COSE_Sign1 (untagged)
      * SignedData<Data> = [
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     unprotected: {},
      *     payload: bstr .cbor Data / nil,
      *     signature: bstr      ; PureEd25519(CDI_Leaf_Priv, SignedDataSigStruct<Data>) /
@@ -352,7 +361,7 @@
      * ; Sig_structure for SignedData
      * SignedDataSigStruct<Data> = [
      *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     external_aad: bstr .size 0,
      *     payload: bstr .cbor Data / nil,
      * ]
@@ -384,7 +393,7 @@
      * ; after the first describe a link in the boot chain (e.g. bootloaders: BL1, BL2, ... BLN)
      * ; Note that there is no DiceChainEntry for UDS_pub, only a "bare" COSE_key.
      * DiceCertChain = [
-     *     PubKeyEd25519 / PubKeyECDSA256,  ; UDS_Pub
+     *     PubKeyEd25519 / PubKeyECDSA256 / PubKeyECDSA384,  ; UDS_Pub
      *     + DiceChainEntry,                ; First CDI_Certificate -> Last CDI_Certificate
      *                                      ; Last certificate corresponds to KeyMint's DICE key.
      * ]
@@ -392,16 +401,17 @@
      * ; This is the signed payload for each entry in the DICE chain. Note that the "Configuration
      * ; Input Values" described by the Open Profile are not used here. Instead, the DICE chain
      * ; defines its own configuration values for the Configuration Descriptor field. See
-     * ; the Open Profile for DICE for more details on the fields. SHA256 and SHA512 are acceptable
-     * ; hash algorithms. The digest bstr values in the payload are the digest values without any
-     * ; padding. Note that for SHA256, this implies the digest bstr is 32 bytes. This is an
-     * ; intentional, minor deviation from Open Profile for DICE, which specifies all digests are
-     * ; 64 bytes.
+     * ; the Open Profile for DICE for more details on the fields. SHA256, SHA384 and SHA512 are
+     * ; acceptable hash algorithms. The digest bstr values in the payload are the digest values
+     * ; without any padding. Note that this implies that the digest is a 32-byte bstr for SHA256
+     * ; and a 48-byte bstr for SHA384. This is an intentional, minor deviation from Open Profile
+     * ; for DICE, which specifies all digests are 64 bytes.
      * DiceChainEntryPayload = {                    ; CWT [RFC8392]
      *     1 : tstr,                                ; Issuer
      *     2 : tstr,                                ; Subject
      *     -4670552 : bstr .cbor PubKeyEd25519 /
-     *                bstr .cbor PubKeyECDSA256,    ; Subject Public Key
+     *                bstr .cbor PubKeyECDSA256,
+     *                bstr .cbor PubKeyECDSA384,    ; Subject Public Key
      *     -4670553 : bstr                          ; Key Usage
      *
      *     ; NOTE: All of the following fields may be omitted for a "Degenerate DICE Chain", as
@@ -422,7 +432,7 @@
      * ; Each entry in the DICE chain is a DiceChainEntryPayload signed by the key from the previous
      * ; entry in the DICE chain array.
      * DiceChainEntry = [                            ; COSE_Sign1 (untagged)
-     *     protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     unprotected: {},
      *     payload: bstr .cbor DiceChainEntryPayload,
      *     signature: bstr ; PureEd25519(SigningKey, DiceChainEntryInput) /
@@ -433,7 +443,7 @@
      *
      * DiceChainEntryInput = [
      *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     external_aad: bstr .size 0,
      *     payload: bstr .cbor DiceChainEntryPayload
      * ]
@@ -458,7 +468,16 @@
      *     -3 : bstr                    ; Y coordinate, big-endian
      * }
      *
+     * PubKeyECDSA384 = {               ; COSE_Key
+     *     1 : 2,                       ; Key type : EC2
+     *     3 : AlgorithmES384,          ; Algorithm : ECDSA w/ SHA-384
+     *     -1 : 2,                      ; Curve: P384
+     *     -2 : bstr,                   ; X coordinate
+     *     -3 : bstr                    ; Y coordinate
+     * }
+     *
      * AlgorithmES256 = -7
+     * AlgorithmES384 = -35
      * AlgorithmEdDSA = -8
      */
     byte[] generateCertificateRequestV2(in MacedPublicKey[] keysToSign, in byte[] challenge);
diff --git a/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl b/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
index 3f699bc..57ee8cf 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
@@ -50,6 +50,8 @@
      *                                     ; salt = null
      *                                     ; info = .cbor Context (see below)
      *                                     ; K = HKDF-SHA-256(ikm, salt, info)
+     *                                     ; AAD for the encryption is a CBOR-serialized
+     *                                     ; Enc_structure (RFC 8152 s5.3) with empty external_aad.
      *         recipients : [
      *             [                       ; COSE_Recipient
      *                 protected : bstr .cbor {
@@ -65,7 +67,10 @@
      *     ]
      *
      *     ; The COSE_KDF_Context that is used to derive the ProtectedData encryption key with
-     *     ; HKDF. See details on use in ProtectedData comments above.
+     *     ; HKDF. See details on use in ProtectedData comments above. The public key data
+     *     ; included in the other field of PartyUInfo / PartyVInfo is encoded as:
+     *     ;  - a raw 32-byte public key for X25519
+     *     ;  - uncompressed SEC-1 coordinate data (0x04 || x || y) for P-256
      *     Context = [
      *         AlgorithmID : 3             ; AES-GCM 256
      *         PartyUInfo : [
@@ -134,11 +139,11 @@
      *     ]
      *
      *     SignedMacAad = [
-     *         challenge : bstr .size (32..64),   ; Size between 32 - 64
+     *         challenge : bstr .size (16..64),   ; Size between 16 - 64
      *                                            ; bytes inclusive
      *         VerifiedDeviceInfo,
      *         tag: bstr                 ; This is the tag from COSE_Mac0 of
-     *                                   ; KeysToCertify, to tie the key set to
+     *                                   ; KeysToSign, to tie the key set to
      *                                   ; the signature.
      *     ]
      *
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index bbda56d..573f10b 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -404,6 +404,7 @@
   protected:
     void SetUp() override {
         CertificateRequestTestBase::SetUp();
+        ASSERT_FALSE(HasFatalFailure());
 
         if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
             bytevec keysToSignMac;
@@ -689,6 +690,7 @@
 class CertificateRequestV2Test : public CertificateRequestTestBase {
     void SetUp() override {
         CertificateRequestTestBase::SetUp();
+        ASSERT_FALSE(HasFatalFailure());
 
         if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
             GTEST_SKIP() << "This test case only applies to RKP v3 and above. "
diff --git a/tetheroffload/aidl/Android.bp b/tetheroffload/aidl/Android.bp
new file mode 100644
index 0000000..1d80586
--- /dev/null
+++ b/tetheroffload/aidl/Android.bp
@@ -0,0 +1,27 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+aidl_interface {
+    name: "android.hardware.tetheroffload",
+    vendor_available: true,
+    srcs: ["android/hardware/tetheroffload/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+            apex_available: [
+                "com.android.tethering",
+            ],
+            min_sdk_version: "30",
+            enabled: true,
+        },
+        ndk: {
+            apps_enabled: false,
+        },
+    },
+    frozen: false,
+}
diff --git a/tetheroffload/aidl/TEST_MAPPING b/tetheroffload/aidl/TEST_MAPPING
new file mode 100644
index 0000000..c6d4c07
--- /dev/null
+++ b/tetheroffload/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit" : [
+    {
+      "name": "VtsHalTetheroffloadTargetTest"
+    }
+  ]
+}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
similarity index 91%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
index 711ac19..493a698 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable ForwardedStats {
+  long rxBytes;
+  long txBytes;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
similarity index 70%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
index 711ac19..9a58b1f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
@@ -31,10 +31,16 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+interface IOffload {
+  void initOffload(in ParcelFileDescriptor fd1, in ParcelFileDescriptor fd2, in android.hardware.tetheroffload.ITetheringOffloadCallback cb);
+  void stopOffload();
+  void setLocalPrefixes(in String[] prefixes);
+  android.hardware.tetheroffload.ForwardedStats getForwardedStats(in String upstream);
+  void setDataWarningAndLimit(in String upstream, in long warningBytes, in long limitBytes);
+  void setUpstreamParameters(in String iface, in String v4Addr, in String v4Gw, in String[] v6Gws);
+  void addDownstream(in String iface, in String prefix);
+  void removeDownstream(in String iface, in String prefix);
+  const int ERROR_CODE_UNUSED = 0;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
similarity index 91%
rename from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
rename to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
index 711ac19..2b42f0c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable IPv4AddrPortPair {
+  String addr;
+  int port;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
similarity index 86%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
index 711ac19..4eb7d04 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+interface ITetheringOffloadCallback {
+  oneway void onEvent(in android.hardware.tetheroffload.OffloadCallbackEvent event);
+  oneway void updateTimeout(in android.hardware.tetheroffload.NatTimeoutUpdate params);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
index 711ac19..9eddaa2 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable NatTimeoutUpdate {
+  android.hardware.tetheroffload.IPv4AddrPortPair src;
+  android.hardware.tetheroffload.IPv4AddrPortPair dst;
+  android.hardware.tetheroffload.NetworkProtocol proto;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
similarity index 90%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
index 711ac19..52bd2a6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tetheroffload;
+@Backing(type="int") @VintfStability
+enum NetworkProtocol {
+  TCP = 6,
+  UDP = 17,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
similarity index 84%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
index 711ac19..026e18e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
@@ -31,10 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tetheroffload;
+@Backing(type="int") @VintfStability
+enum OffloadCallbackEvent {
+  OFFLOAD_STARTED = 1,
+  OFFLOAD_STOPPED_ERROR = 2,
+  OFFLOAD_STOPPED_UNSUPPORTED = 3,
+  OFFLOAD_SUPPORT_AVAILABLE = 4,
+  OFFLOAD_STOPPED_LIMIT_REACHED = 5,
+  OFFLOAD_WARNING_REACHED = 6,
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl
index 61239d0..d2fe49b 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl
@@ -14,15 +14,13 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+parcelable ForwardedStats {
+    /**
+     * Tx/Rx forwarded bytes
+     */
+    long rxBytes;
+    long txBytes;
 }
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl
new file mode 100644
index 0000000..30b2c8d
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.ForwardedStats;
+import android.hardware.tetheroffload.ITetheringOffloadCallback;
+
+/**
+ * Interface used to control tethering offload.
+ */
+@VintfStability
+interface IOffload {
+    /**
+     * Error code for all {@code ServiceSpecificException}s thrown by this interface.
+     */
+    const int ERROR_CODE_UNUSED = 0;
+
+    /**
+     * Indicates intent to start offload for tethering in immediate future.
+     *
+     * This API must be called exactly once the first time that Tethering is requested by
+     * the user.
+     *
+     * If this API is called multiple times without first calling stopOffload, then the subsequent
+     * calls must fail without changing the state of the server.
+     *
+     * If for some reason, the hardware is currently unable to support offload, this call must fail.
+     *
+     * @param fd1 A file descriptor bound to the following netlink groups
+     *            (NF_NETLINK_CONNTRACK_NEW | NF_NETLINK_CONNTRACK_DESTROY).
+     * @param fd2 A file descriptor bound to the following netlink groups
+     *            (NF_NETLINK_CONNTRACK_UPDATE | NF_NETLINK_CONNTRACK_DESTROY).
+     * @param cb Assuming success, this callback must provide unsolicited updates of offload status.
+     *           It is assumed to be valid until stopOffload is called.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any file descriptors are invalid.
+     *         - EX_ILLEGAL_STATE if this method previously succeeded and stopOffload() was not
+     *           later called.
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: Initializing offload does not imply that any upstreams or downstreams have yet been,
+     * or even will be, chosen.  This API is symmetrical with stopOffload.
+     */
+    void initOffload(in ParcelFileDescriptor fd1, in ParcelFileDescriptor fd2,
+            in ITetheringOffloadCallback cb);
+
+    /**
+     * Indicate desire to tear down all tethering offload.
+     *
+     * Called after tethering is no longer requested by the user. Any remaining offload must
+     * be subsequently torn down by the management process.  Upon success, the callback registered
+     * in initOffload must be released, and offload must be stopped.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_STATE if initOffload() was not called, or if stopOffload() was already
+     *           called.
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: Statistics must be reset by this API.
+     */
+    void stopOffload();
+
+    /**
+     * Instruct management process not to forward traffic destined to or from the specified
+     * prefixes.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param prefixes List containing fully specified prefixes. For e.g. 192.168.1.0/24
+     * or 2001:4860:684::/64
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if the IP prefixes are invalid.
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: This list overrides any previously specified list
+     */
+    void setLocalPrefixes(in String[] prefixes);
+
+    /**
+     * Query offloaded traffic statistics forwarded to an upstream address.
+     *
+     * Return statistics that have transpired since the last query.  This would include
+     * statistics from all offloaded downstream tether interfaces that have been forwarded to this
+     * upstream interface.  After returning the statistics, the counters are reset to zero.
+     *
+     * Only offloaded statistics must be returned by this API, software stats must not be
+     * returned.
+     *
+     * @param upstream Upstream interface on which traffic exited/entered
+     *
+     * @return ForwardedStats depicting the received and transmitted bytes
+     *
+     * @throws:
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    ForwardedStats getForwardedStats(in String upstream);
+
+    /**
+     * Instruct hardware to send callbacks, and possibly stop offload, after certain number of bytes
+     * have been transferred in either direction on this upstream interface.
+     *
+     * The specified quota bytes must be applied to all traffic on the given upstream interface.
+     * This includes hardware forwarded traffic, software forwarded traffic, and AP-originated
+     * traffic. IPv4 and IPv6 traffic both count towards the same quota. IP headers are included
+     * in the byte count quota, but, link-layer headers are not.
+     *
+     * This API may only be called while offload is occurring on this upstream. The hardware
+     * management process MUST NOT store the values when offload is not started and apply them
+     * once offload is started. This is because the quota values would likely become stale over
+     * time and would not reflect any new traffic that has occurred.
+     *
+     * The specified quota bytes MUST replace any previous quotas set by
+     * {@code setDataWarningAndLimit} specified on the same interface. It may be interpreted as
+     * "tell me when either <warningBytes> or <limitBytes> bytes have been transferred
+     * (in either direction), and stop offload when <limitBytes> bytes have been transferred,
+     * starting now and counting from zero on <upstream>."
+     *
+     * Once the {@code warningBytes} is reached, the callback registered in initOffload must be
+     * called with {@code OFFLOAD_WARNING_REACHED} to indicate this event. Once the event fires
+     * for this upstream, no further {@code OFFLOAD_WARNING_REACHED} event will be fired for this
+     * upstream unless this method is called again with the same interface. Note that there is
+     * no need to call initOffload again to resume offload if stopOffload was not called by the
+     * client.
+     *
+     * Similarly, Once the {@code limitBytes} is reached, the callback registered in initOffload
+     * must be called with {@code OFFLOAD_STOPPED_LIMIT_REACHED} to indicate this event. Once
+     * the event fires for this upstream, no further {@code OFFLOAD_STOPPED_LIMIT_REACHED}
+     * event will be fired for this upstream unless this method is called again with the same
+     * interface. However, unlike {@code warningBytes}, when {@code limitBytes} is reached,
+     * all offload must be stopped. If offload is desired again, the hardware management
+     * process must be completely reprogrammed by calling setUpstreamParameters and
+     * addDownstream again.
+     *
+     * Note that {@code warningBytes} must always be less than or equal to {@code limitBytes},
+     * when {@code warningBytes} is reached, {@code limitBytes} may still valid unless this method
+     * is called again with the same interface.
+     *
+     * @param upstream Upstream interface name that quota must apply to.
+     * @param warningBytes The quota of warning, defined as the number of bytes, starting from
+     *                     zero and counting from now.
+     * @param limitBytes The quota of limit, defined as the number of bytes, starting from zero
+     *                   and counting from now.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid upstream
+     *           or negative number of bytes).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_UNSUPPORTED_OPERATION if it is not supported.
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    void setDataWarningAndLimit(in String upstream, in long warningBytes, in long limitBytes);
+
+    /**
+     * Instruct hardware to start forwarding traffic to the specified upstream.
+     *
+     * When iface, v4Addr, and v4Gw are all non-null, the management process may begin forwarding
+     * any currently configured or future configured IPv4 downstreams to this upstream interface.
+     *
+     * If any of the previously three mentioned parameters are null, then any current IPv4 offload
+     * must be stopped.
+     *
+     * When iface and v6Gws are both non-null, and in the case of v6Gws, are not empty, the
+     * management process may begin forwarding any currently configured or future configured IPv6
+     * downstreams to this upstream interface.
+     *
+     * If either of the two above parameters are null, or no V6 Gateways are provided, then IPv6
+     * offload must be stopped.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Upstream interface name.  Note that only one is needed because IPv4 and IPv6
+     *               interfaces cannot be different (only known that this can occur during software
+     *               xlat, which cannot be offloaded through hardware anyways).  If the iface is
+     *               null, offload must be stopped.
+     * @param v4Addr The local IPv4 address assigned to the provided upstream interface, i.e. the
+     *               IPv4 address the packets are NATed to. For e.g. 192.168.0.12.
+     * @param v4Gw   The IPv4 address of the IPv4 gateway on the upstream interface.
+     *               For e.g. 192.168.1.1
+     * @param v6Gws  A list of IPv6 addresses (for e.g. fe80::97be:9de7:b24b:9194) for possible IPv6
+     *               gateways on the upstream interface.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid upstream
+     *           or IP addresses).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: This overrides any previously configured parameters.
+     */
+    void setUpstreamParameters(
+            in String iface, in String v4Addr, in String v4Gw, in String[] v6Gws);
+
+    /**
+     * Configure a downstream interface and prefix in the hardware management process that may be
+     * forwarded.
+     *
+     * The prefix may be an IPv4 or an IPv6 prefix to signify which family can be offloaded from
+     * the specified tether interface.  The list of IPv4 and IPv6 downstreams that are configured
+     * may differ.
+     *
+     * If the given protocol, as determined by the prefix, has an upstream set,
+     * the hardware may begin forwarding traffic between the upstream and any devices on the
+     * downstream interface that have IP addresses within the specified prefix. Other traffic from
+     * the same downstream interfaces is unaffected and must be forwarded if and only if it was
+     * already being forwarded.
+     *
+     * If no upstream is currently configured, then these downstream interface and prefixes must be
+     * preserved so that offload may begin in the future when an upstream is set.
+     *
+     * This API does not replace any previously configured downstreams and any such downstreams must
+     * be explicitly removed by calling removeDownstream.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Downstream interface
+     * @param prefix Downstream prefix depicting addresses that may be offloaded.
+     *               For e.g. 192.168.1.0/24 or 2001:4860:684::/64)
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid downstream
+     *           or IP prefix).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: The hardware management process may fail this call in a normal situation.  This can
+     *          happen because the hardware cannot support the current number of prefixes, the
+     *          hardware cannot support concurrent offload on multiple interfaces, the hardware
+     *          cannot currently support offload on the tether interface for some reason, or any
+     *          other dynamic configuration issues which may occur.  In this case,
+     *          traffic must remain unaffected and must be forwarded if and only if it was already
+     *          being forwarded.
+     */
+    void addDownstream(in String iface, in String prefix);
+
+    /**
+     * Remove a downstream prefix that may be forwarded from the hardware management process.
+     *
+     * The prefix may be an IPv4 or an IPv6 prefix. If it was not previously configured using
+     * addDownstream, then this must be a no-op.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Downstream interface
+     * @param prefix Downstream prefix depicting address that must no longer be offloaded
+     *               For e.g. 192.168.1.0/24 or 2001:4860:684::/64)
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid downstream
+     *           or IP prefix).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    void removeDownstream(in String iface, in String prefix);
+}
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
index 61239d0..16d7d85 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
@@ -14,15 +14,13 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+parcelable IPv4AddrPortPair {
+    /**
+     * IPv4 Address and Port
+     */
+    String addr;
+    int port;
 }
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
new file mode 100644
index 0000000..5ee819b
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.NatTimeoutUpdate;
+import android.hardware.tetheroffload.OffloadCallbackEvent;
+
+/**
+ * Callback providing information about status of hardware management process
+ * as well as providing a way to keep offloaded connections from timing out.
+ */
+@VintfStability
+oneway interface ITetheringOffloadCallback {
+    /**
+     * Called when an asynchronous event is generated by the hardware
+     * management process.
+     */
+    void onEvent(in OffloadCallbackEvent event);
+
+    /**
+     *  Provide a way for the management process to request that a connections
+     *  timeout be updated in kernel.
+     *
+     *  This is necessary to ensure that offloaded traffic is not cleaned up
+     *  by the kernel connection tracking module for IPv4.
+     */
+    void updateTimeout(in NatTimeoutUpdate params);
+}
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
similarity index 64%
rename from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
rename to tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
index 61239d0..50805ef 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
@@ -14,15 +14,14 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.IPv4AddrPortPair;
+import android.hardware.tetheroffload.NetworkProtocol;
 
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+parcelable NatTimeoutUpdate {
+    IPv4AddrPortPair src;
+    IPv4AddrPortPair dst;
+    NetworkProtocol proto;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl
similarity index 63%
copy from radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl
index 61239d0..cc4f7ac 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl
@@ -14,15 +14,11 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.ims.media;
+package android.hardware.tetheroffload;
 
 @VintfStability
-parcelable AnbrBitrate {
-    /** default value to represent NOT_SET */
-    const int INVALID_ANBR_BITRATE = -1;
-
-    /** Received bitrate in seconds for Uplink from NW or peer UE for ANBR */
-    int uplinkBps;
-    /** Received bitrate in secondsfor Downlink from NW or peer UE for ANBR */
-    int downlinkBps;
+@Backing(type="int")
+enum NetworkProtocol {
+    TCP = 6,
+    UDP = 17,
 }
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
new file mode 100644
index 0000000..a95f674
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+@VintfStability
+@Backing(type="int")
+enum OffloadCallbackEvent {
+    /**
+     * Indicate that a working configuration has been programmed and the
+     * hardware management process has begun forwarding traffic.
+     */
+    OFFLOAD_STARTED = 1,
+    /**
+     * Indicate that an error has occurred which has disrupted hardware
+     * acceleration.  Software routing may still be attempted; however,
+     * statistics may be temporarily unavailable.  Statistics may be recovered
+     * after OFFLOAD_SUPPORT_AVAILABLE event is fired.
+     */
+    OFFLOAD_STOPPED_ERROR = 2,
+    /**
+     * Indicate that the device has moved to a RAT on which hardware
+     * acceleration is not supported.  Subsequent calls to setUpstreamParameters
+     * and add/removeDownstream will likely fail and cannot be presumed to be
+     * saved inside of the hardware management process.  Upon receiving
+     * OFFLOAD_SUPPORT_AVAILABLE, the client may reprogram the hardware
+     * management process to begin offload again.
+     */
+    OFFLOAD_STOPPED_UNSUPPORTED = 3,
+    /**
+     * Indicate that the hardware management process is willing and able to
+     * provide support for hardware acceleration at this time.  If applicable,
+     * the client may query for statistics.  If offload is desired, the client
+     * must reprogram the hardware management process.
+     */
+    OFFLOAD_SUPPORT_AVAILABLE = 4,
+    /**
+     * Hardware acceleration is no longer in effect and must be reprogrammed
+     * in order to resume.  This event is fired when the limit, applied in
+     * setDataLimit, has expired.  It is recommended that the client query for
+     * statistics immediately after receiving this event.
+     */
+    OFFLOAD_STOPPED_LIMIT_REACHED = 5,
+    /**
+     * This event is fired when the quota, applied in setDataWarning, has expired. It is
+     * recommended that the client query for statistics immediately after receiving this event.
+     * Any offloaded traffic will continue to be offloaded until offload is stopped or
+     * OFFLOAD_STOPPED_LIMIT_REACHED is sent.
+     */
+    OFFLOAD_WARNING_REACHED = 6,
+}
diff --git a/tetheroffload/aidl/default/Android.bp b/tetheroffload/aidl/default/Android.bp
new file mode 100644
index 0000000..8f0739c
--- /dev/null
+++ b/tetheroffload/aidl/default/Android.bp
@@ -0,0 +1,36 @@
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "android.hardware.tetheroffload-service.example",
+    relative_install_path: "hw",
+    init_rc: ["tetheroffload-example.rc"],
+    vintf_fragments: ["tetheroffload-example.xml"],
+    vendor: true,
+    shared_libs: [
+        "android.hardware.tetheroffload-V1-ndk",
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libutils",
+    ],
+    srcs: [
+        "main.cpp",
+        "Offload.cpp",
+    ],
+}
diff --git a/tetheroffload/aidl/default/Offload.cpp b/tetheroffload/aidl/default/Offload.cpp
new file mode 100644
index 0000000..8aa6916
--- /dev/null
+++ b/tetheroffload/aidl/default/Offload.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <numeric>
+#include <string>
+
+#include <android-base/logging.h>
+#include <android-base/strings.h>
+#include <netdb.h>
+
+#include "Offload.h"
+
+namespace aidl::android::hardware::tetheroffload::impl::example {
+
+using ::android::base::Join;
+
+ndk::ScopedAStatus Offload::addDownstream(const std::string& in_iface,
+                                          const std::string& in_prefix) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", Prefix: " << in_prefix;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (!isValidIpPrefix(in_prefix)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid IP prefix");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::getForwardedStats(const std::string& in_upstream,
+                                              ForwardedStats* _aidl_return) {
+    LOG(VERBOSE) << __func__ << " Upstream: " << in_upstream;
+    ForwardedStats stats;
+    stats.rxBytes = 0;
+    stats.txBytes = 0;
+    *_aidl_return = std::move(stats);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::initOffload(const ndk::ScopedFileDescriptor& in_fd1,
+                                        const ndk::ScopedFileDescriptor& in_fd2,
+                                        const std::shared_ptr<ITetheringOffloadCallback>& in_cb) {
+    LOG(VERBOSE) << __func__ << " FileDescriptor1: " << std::to_string(in_fd1.get())
+                 << ", FileDescriptor2: " << std::to_string(in_fd2.get())
+                 << ", ITetheringOffloadCallback: " << in_cb;
+    if (isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL already initialized");
+    }
+    int fd1 = in_fd1.get();
+    int fd2 = in_fd2.get();
+    if (fd1 < 0 || fd2 < 0) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid file descriptors");
+    }
+    mFd1 = ndk::ScopedFileDescriptor(dup(fd1));
+    mFd2 = ndk::ScopedFileDescriptor(dup(fd2));
+    mInitialized = true;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::removeDownstream(const std::string& in_iface,
+                                             const std::string& in_prefix) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", Prefix: " << in_prefix;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidIpPrefix(in_prefix)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid IP prefix");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setDataWarningAndLimit(const std::string& in_upstream,
+                                                   int64_t in_warningBytes, int64_t in_limitBytes) {
+    LOG(VERBOSE) << __func__ << " Upstream: " << in_upstream
+                 << ", WarningBytes: " << in_warningBytes << ", LimitBytes: " << in_limitBytes;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_upstream)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (in_warningBytes < 0 || in_limitBytes < 0) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Threshold must be non-negative");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setLocalPrefixes(const std::vector<std::string>& in_prefixes) {
+    LOG(VERBOSE) << __func__ << " Prefixes: " << Join(in_prefixes, ',');
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (in_prefixes.empty()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "No IP prefix");
+    }
+    for (std::string prefix : in_prefixes) {
+        if (!isValidIpPrefix(prefix)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP prefix");
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setUpstreamParameters(const std::string& in_iface,
+                                                  const std::string& in_v4Addr,
+                                                  const std::string& in_v4Gw,
+                                                  const std::vector<std::string>& in_v6Gws) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", IPv4Address: " << in_v4Addr
+                 << ", IPv4Gateway: " << in_v4Gw << ", IPv6Gateways: " << Join(in_v6Gws, ',');
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (in_v4Addr.empty() && in_v4Gw.empty() && in_v6Gws.empty()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "No upstream IP address");
+    }
+    if (!in_v4Addr.empty() && !in_v4Gw.empty()) {
+        if (!isValidIpv4Address(in_v4Addr) || !isValidIpv4Address(in_v4Gw)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP address");
+        }
+    }
+    for (std::string ip : in_v6Gws) {
+        if (!isValidIpv6Address(ip)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP address");
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::stopOffload() {
+    LOG(VERBOSE) << __func__;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    mInitialized = false;
+    return ndk::ScopedAStatus::ok();
+};
+
+bool Offload::isInitialized() {
+    return (mInitialized == true);
+}
+
+bool Offload::isValidInterface(const std::string& iface) {
+    return !iface.empty() && iface != "invalid";
+}
+
+bool Offload::isValidIpv4Address(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET, false);
+}
+
+bool Offload::isValidIpv4Prefix(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET, true);
+}
+
+bool Offload::isValidIpv6Address(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET6, false);
+}
+
+bool Offload::isValidIpv6Prefix(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET6, true);
+}
+
+bool Offload::isValidIpAddress(const std::string& repr) {
+    return isValidIpv4Address(repr) || isValidIpv6Address(repr);
+}
+
+bool Offload::isValidIpPrefix(const std::string& repr) {
+    return isValidIpv4Prefix(repr) || isValidIpv6Prefix(repr);
+}
+
+// Refer to libnetdutils's IPAddress and IPPrefix classes.
+// Can't use them directly because libnetdutils is not "vendor_available".
+bool Offload::validateIpAddressOrPrefix(const std::string& repr, const int expectedFamily,
+                                        const bool isPrefix) {
+    const addrinfo hints = {
+            .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV,
+    };
+    addrinfo* res;
+    size_t index = repr.find('/');
+    if (isPrefix && index == std::string::npos) return false;
+
+    // Parse the IP address.
+    const std::string ipAddress = isPrefix ? repr.substr(0, index) : repr;
+    const int ret = getaddrinfo(ipAddress.c_str(), nullptr, &hints, &res);
+    if (ret != 0) return false;
+
+    // Check the address family.
+    int family = res[0].ai_family;
+    freeaddrinfo(res);
+    if (family != expectedFamily) return false;
+    if (!isPrefix) return true;
+
+    // Parse the prefix length.
+    const char* prefixString = repr.c_str() + index + 1;
+    if (!isdigit(*prefixString)) return false;
+    char* endptr;
+    unsigned long prefixlen = strtoul(prefixString, &endptr, 10);
+    if (*endptr != '\0') return false;
+
+    uint8_t maxlen = (family == AF_INET) ? 32 : 128;
+    if (prefixlen > maxlen) return false;
+
+    return true;
+}
+
+}  // namespace aidl::android::hardware::tetheroffload::impl::example
diff --git a/tetheroffload/aidl/default/Offload.h b/tetheroffload/aidl/default/Offload.h
new file mode 100644
index 0000000..a1f6bce
--- /dev/null
+++ b/tetheroffload/aidl/default/Offload.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/tetheroffload/BnOffload.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace tetheroffload {
+namespace impl {
+namespace example {
+
+using aidl::android::hardware::tetheroffload::ForwardedStats;
+using aidl::android::hardware::tetheroffload::ITetheringOffloadCallback;
+
+class Offload : public BnOffload {
+  public:
+    ndk::ScopedAStatus addDownstream(const std::string& in_iface,
+                                     const std::string& in_prefix) override;
+    ndk::ScopedAStatus getForwardedStats(const std::string& in_upstream,
+                                         ForwardedStats* _aidl_return) override;
+    ndk::ScopedAStatus initOffload(
+            const ndk::ScopedFileDescriptor& in_fd1, const ndk::ScopedFileDescriptor& in_fd2,
+            const std::shared_ptr<ITetheringOffloadCallback>& in_cb) override;
+    ndk::ScopedAStatus removeDownstream(const std::string& in_iface,
+                                        const std::string& in_prefix) override;
+    ndk::ScopedAStatus setDataWarningAndLimit(const std::string& in_upstream,
+                                              int64_t in_warningBytes,
+                                              int64_t in_limitBytes) override;
+    ndk::ScopedAStatus setLocalPrefixes(const std::vector<std::string>& in_prefixes) override;
+    ndk::ScopedAStatus setUpstreamParameters(const std::string& in_iface,
+                                             const std::string& in_v4Addr,
+                                             const std::string& in_v4Gw,
+                                             const std::vector<std::string>& in_v6Gws) override;
+    ndk::ScopedAStatus stopOffload() override;
+
+  private:
+    bool isInitialized();
+    bool isValidInterface(const std::string& iface);
+    bool isValidIpv4Address(const std::string& repr);
+    bool isValidIpv4Prefix(const std::string& repr);
+    bool isValidIpv6Address(const std::string& repr);
+    bool isValidIpv6Prefix(const std::string& repr);
+    bool isValidIpAddress(const std::string& repr);
+    bool isValidIpPrefix(const std::string& repr);
+    bool validateIpAddressOrPrefix(const std::string& repr, const int expectedFamily,
+                                   const bool isPrefix);
+
+    bool mInitialized = false;
+    ndk::ScopedFileDescriptor mFd1;
+    ndk::ScopedFileDescriptor mFd2;
+};
+
+}  // namespace example
+}  // namespace impl
+}  // namespace tetheroffload
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/tetheroffload/aidl/default/main.cpp b/tetheroffload/aidl/default/main.cpp
new file mode 100644
index 0000000..6633630
--- /dev/null
+++ b/tetheroffload/aidl/default/main.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Offload.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+using aidl::android::hardware::tetheroffload::impl::example::Offload;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<Offload> offload = ndk::SharedRefBase::make<Offload>();
+
+    binder_status_t status = AServiceManager_addService(
+            offload->asBinder().get(), Offload::makeServiceName("default").c_str());
+    CHECK_EQ(status, STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/tetheroffload/aidl/default/tetheroffload-example.rc b/tetheroffload/aidl/default/tetheroffload-example.rc
new file mode 100644
index 0000000..46cda61
--- /dev/null
+++ b/tetheroffload/aidl/default/tetheroffload-example.rc
@@ -0,0 +1,4 @@
+service vendor.tetheroffload-example /vendor/bin/hw/android.hardware.tetheroffload-service.example
+    class hal
+    user nobody
+    group nobody
diff --git a/tetheroffload/aidl/default/tetheroffload-example.xml b/tetheroffload/aidl/default/tetheroffload-example.xml
new file mode 100644
index 0000000..9fe83f6
--- /dev/null
+++ b/tetheroffload/aidl/default/tetheroffload-example.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.tetheroffload</name>
+        <version>1</version>
+        <fqname>IOffload/default</fqname>
+    </hal>
+</manifest>
diff --git a/tetheroffload/aidl/vts/functional/Android.bp b/tetheroffload/aidl/vts/functional/Android.bp
new file mode 100644
index 0000000..74edab0
--- /dev/null
+++ b/tetheroffload/aidl/vts/functional/Android.bp
@@ -0,0 +1,25 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "VtsHalTetheroffloadTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: [
+        "VtsHalTetheroffloadTargetTest.cpp",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.tetheroffload-V1-ndk",
+        "libgmock_ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp b/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp
new file mode 100644
index 0000000..fc8abbd
--- /dev/null
+++ b/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp
@@ -0,0 +1,689 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "tetheroffload_aidl_hal_test"
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/tetheroffload/BnOffload.h>
+#include <aidl/android/hardware/tetheroffload/BnTetheringOffloadCallback.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#include <log/log.h>
+#include <net/if.h>
+#include <sys/socket.h>
+
+namespace aidl::android::hardware::tetheroffload {
+
+namespace {
+
+using ::android::base::unique_fd;
+using android::hardware::tetheroffload::ForwardedStats;
+using android::hardware::tetheroffload::IOffload;
+using android::hardware::tetheroffload::NatTimeoutUpdate;
+using android::hardware::tetheroffload::OffloadCallbackEvent;
+using ::testing::AnyOf;
+using ::testing::Eq;
+
+const std::string TEST_IFACE = "rmnet_data0";
+const unsigned kFd1Groups = NF_NETLINK_CONNTRACK_NEW | NF_NETLINK_CONNTRACK_DESTROY;
+const unsigned kFd2Groups = NF_NETLINK_CONNTRACK_UPDATE | NF_NETLINK_CONNTRACK_DESTROY;
+
+enum class ExpectBoolean {
+    Ignored = -1,
+    False = 0,
+    True = 1,
+};
+
+inline const sockaddr* asSockaddr(const sockaddr_nl* nladdr) {
+    return reinterpret_cast<const sockaddr*>(nladdr);
+}
+
+int netlinkSocket(int protocol, unsigned groups) {
+    unique_fd s(socket(AF_NETLINK, SOCK_DGRAM, protocol));
+    if (s.get() < 0) {
+        return -errno;
+    }
+
+    const struct sockaddr_nl bind_addr = {
+            .nl_family = AF_NETLINK,
+            .nl_pad = 0,
+            .nl_pid = 0,
+            .nl_groups = groups,
+    };
+    if (bind(s.get(), asSockaddr(&bind_addr), sizeof(bind_addr)) != 0) {
+        return -errno;
+    }
+
+    const struct sockaddr_nl kernel_addr = {
+            .nl_family = AF_NETLINK,
+            .nl_pad = 0,
+            .nl_pid = 0,
+            .nl_groups = groups,
+    };
+    if (connect(s.get(), asSockaddr(&kernel_addr), sizeof(kernel_addr)) != 0) {
+        return -errno;
+    }
+
+    return s.release();
+}
+
+int netlinkSocket(unsigned groups) {
+    return netlinkSocket(NETLINK_NETFILTER, groups);
+}
+
+// Check whether the specified interface is up.
+bool interfaceIsUp(const std::string name) {
+    struct ifreq ifr = {};
+    strlcpy(ifr.ifr_name, name.c_str(), sizeof(ifr.ifr_name));
+    int sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    if (sock == -1) return false;
+    int ret = ioctl(sock, SIOCGIFFLAGS, &ifr, sizeof(ifr));
+    close(sock);
+    return (ret == 0) && (ifr.ifr_flags & IFF_UP);
+}
+
+// Callback class for both events and NAT timeout updates.
+class TetheringOffloadCallback : public BnTetheringOffloadCallback {
+  public:
+    ndk::ScopedAStatus onEvent(OffloadCallbackEvent in_event) override {
+        auto lock = std::lock_guard{mMutex};
+        mOnEventInvoked = true;
+        mLastEvent = in_event;
+        mNotifyCv.notify_all();
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus updateTimeout(const NatTimeoutUpdate& in_params) override {
+        auto lock = std::lock_guard{mMutex};
+        mOnUpdateTimeoutInvoked = true;
+        mNatTimeout = in_params;
+        mNotifyCv.notify_all();
+        return ndk::ScopedAStatus::ok();
+    }
+
+  private:
+    std::mutex mMutex;
+    std::condition_variable mNotifyCv;
+    OffloadCallbackEvent mLastEvent;
+    NatTimeoutUpdate mNatTimeout;
+    bool mOnEventInvoked = false;
+    bool mOnUpdateTimeoutInvoked = false;
+};
+
+// The common base class for tetheroffload AIDL HAL tests.
+class TetheroffloadAidlTestBase : public testing::TestWithParam<std::string> {
+  public:
+    virtual void SetUp() override { getService(); }
+    virtual void TearDown() override {
+        // For good measure, the teardown should try stopOffload() once more, since
+        // different HAL call test cycles might enter this function. Also the
+        // return code cannot be actually expected for all cases, hence ignore it.
+        stopOffload(ExpectBoolean::Ignored);
+    };
+
+  protected:
+    void getService() {
+        AIBinder* binder = AServiceManager_waitForService(GetParam().c_str());
+        ASSERT_NE(binder, nullptr);
+        mOffload = IOffload::fromBinder(ndk::SpAIBinder(binder));
+    }
+
+    void initOffload(const bool expectedResult) {
+        unique_fd ufd1(netlinkSocket(kFd1Groups));
+        if (ufd1.get() < 0) {
+            ALOGE("Unable to create conntrack sockets: %d/%s", errno, strerror(errno));
+            FAIL();
+        }
+        ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(ufd1.release());
+
+        unique_fd ufd2(netlinkSocket(kFd2Groups));
+        if (ufd2.get() < 0) {
+            ALOGE("Unable to create conntrack sockets: %d/%s", errno, strerror(errno));
+            FAIL();
+        }
+        ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(ufd2.release());
+
+        mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+        ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+
+        ASSERT_EQ(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                  expectedResult ? EX_NONE : EX_ILLEGAL_STATE);
+    }
+
+    void stopOffload(const ExpectBoolean expectedResult) {
+        ndk::ScopedAStatus status = mOffload->stopOffload();
+        if (expectedResult == ExpectBoolean::Ignored) return;
+        ASSERT_EQ(status.getExceptionCode(),
+                  expectedResult == ExpectBoolean::True ? EX_NONE : EX_ILLEGAL_STATE);
+    }
+
+    std::shared_ptr<IOffload> mOffload;
+    std::shared_ptr<TetheringOffloadCallback> mTetheringOffloadCallback;
+};
+
+// The test class for tetheroffload before initialization.
+class TetheroffloadAidlPreInitTest : public TetheroffloadAidlTestBase {
+  public:
+    virtual void SetUp() override { getService(); }
+};
+
+// The main test class for tetheroffload AIDL HAL.
+class TetheroffloadAidlGeneralTest : public TetheroffloadAidlTestBase {
+  public:
+    virtual void SetUp() override {
+        getService();
+        initOffload(true);
+    }
+};
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when both FDs are empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFdsReturnsError) {
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(-1);
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(-1);
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when FD1 is empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFd1ReturnsError) {
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(-1);
+    unique_fd ufd2(netlinkSocket(kFd2Groups));
+    if (ufd2.get() < 0) {
+        ALOGE("Unable to create conntrack sockets: %d/%s", errno, strerror(errno));
+        FAIL();
+    }
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(ufd2.release());
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when FD2 is empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFd2ReturnsError) {
+    unique_fd ufd1(netlinkSocket(kFd1Groups));
+    if (ufd1.get() < 0) {
+        ALOGE("Unable to create conntrack sockets: %d/%s", errno, strerror(errno));
+        FAIL();
+    }
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(ufd1.release());
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(-1);
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Call initOffload() multiple times. Check that non-first initOffload() calls return error.
+TEST_P(TetheroffloadAidlPreInitTest, AdditionalInitsWithoutStopReturnError) {
+    initOffload(true);
+    initOffload(false);
+    initOffload(false);
+    initOffload(false);
+}
+
+// Check that calling stopOffload() without first having called initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, MultipleStopsWithoutInitReturnError) {
+    stopOffload(ExpectBoolean::False);
+    stopOffload(ExpectBoolean::False);
+    stopOffload(ExpectBoolean::False);
+}
+
+// Check that calling stopOffload() after a complete init/stop cycle returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AdditionalStopsWithInitReturnError) {
+    initOffload(true);
+    // Call setUpstreamParameters() so that "offload" can be reasonably said
+    // to be both requested and operational.
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.0.2");
+    const std::string v4Gw("192.0.0.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    EXPECT_TRUE(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).isOk());
+    if (!interfaceIsUp(TEST_IFACE)) {
+        return;
+    }
+    SCOPED_TRACE("Expecting stopOffload to succeed");
+    stopOffload(ExpectBoolean::True);  // balance out initOffload(true)
+    SCOPED_TRACE("Expecting stopOffload to fail the first time");
+    stopOffload(ExpectBoolean::False);
+    SCOPED_TRACE("Expecting stopOffload to fail the second time");
+    stopOffload(ExpectBoolean::False);
+}
+
+// Check that calling setLocalPrefixes() without first having called initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, SetLocalPrefixesWithoutInitReturnsError) {
+    const std::vector<std::string> prefixes{std::string("2001:db8::/64")};
+    EXPECT_EQ(mOffload->setLocalPrefixes(prefixes).getExceptionCode(), EX_ILLEGAL_STATE);
+}
+
+// Check that calling getForwardedStats() without first having called initOffload()
+// returns zero bytes statistics.
+TEST_P(TetheroffloadAidlPreInitTest, GetForwardedStatsWithoutInitReturnsZeroValues) {
+    const std::string upstream(TEST_IFACE);
+    ForwardedStats stats;
+    EXPECT_TRUE(mOffload->getForwardedStats(upstream, &stats).isOk());
+    EXPECT_EQ(stats.rxBytes, 0ULL);
+    EXPECT_EQ(stats.txBytes, 0ULL);
+}
+
+// Check that calling setDataWarningAndLimit() without first having called initOffload() returns
+// error.
+TEST_P(TetheroffloadAidlPreInitTest, SetDataWarningAndLimitWithoutInitReturnsError) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 5000LL;
+    const int64_t limit = 5000LL;
+    EXPECT_EQ(mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode(),
+              EX_ILLEGAL_STATE);
+}
+
+// Check that calling setUpstreamParameters() without first having called initOffload()
+// returns error.
+TEST_P(TetheroffloadAidlPreInitTest, SetUpstreamParametersWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.0/24");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+              EX_ILLEGAL_STATE);
+}
+
+// Check that calling addDownstream() with an IPv4 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AddIPv4DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("192.0.2.0/24");
+    EXPECT_EQ(mOffload->addDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_STATE);
+}
+
+// Check that calling addDownstream() with an IPv6 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AddIPv6DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("2001:db8::/64");
+    EXPECT_EQ(mOffload->addDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_STATE);
+}
+
+// Check that calling removeDownstream() with an IPv4 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, RemoveIPv4DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("192.0.2.0/24");
+    EXPECT_EQ(mOffload->removeDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_STATE);
+}
+
+// Check that calling removeDownstream() with an IPv6 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, RemoveIPv6DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("2001:db8::/64");
+    EXPECT_EQ(mOffload->removeDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_STATE);
+}
+
+/*
+ * Tests for IOffload::setLocalPrefixes().
+ */
+
+// Test setLocalPrefixes() rejects an IPv4 address.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv4AddressFails) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.1")};
+    EXPECT_EQ(mOffload->setLocalPrefixes(prefixes).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+// Test setLocalPrefixes() rejects an IPv6 address.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv6AddressFails) {
+    const std::vector<std::string> prefixes{std::string("fe80::1")};
+    EXPECT_EQ(mOffload->setLocalPrefixes(prefixes).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+// Test setLocalPrefixes() accepts both IPv4 and IPv6 prefixes.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv4v6PrefixesOk) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.0/24"), std::string("fe80::/64")};
+    EXPECT_TRUE(mOffload->setLocalPrefixes(prefixes).isOk());
+}
+
+// Test that setLocalPrefixes() fails given empty input. There is always
+// a non-empty set of local prefixes; when all networking interfaces are down
+// we still apply {127.0.0.0/8, ::1/128, fe80::/64} here.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesEmptyFails) {
+    const std::vector<std::string> prefixes{};
+    EXPECT_EQ(mOffload->setLocalPrefixes(prefixes).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+// Test setLocalPrefixes() fails on incorrectly formed input strings.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesInvalidFails) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.0/24"), std::string("invalid")};
+    EXPECT_EQ(mOffload->setLocalPrefixes(prefixes).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+/*
+ * Tests for IOffload::getForwardedStats().
+ */
+
+// Test that getForwardedStats() for a non-existent upstream yields zero bytes statistics.
+TEST_P(TetheroffloadAidlGeneralTest, GetForwardedStatsInvalidUpstreamIface) {
+    const std::string upstream("invalid");
+    ForwardedStats stats;
+    EXPECT_TRUE(mOffload->getForwardedStats(upstream, &stats).isOk());
+    EXPECT_EQ(stats.rxBytes, 0ULL);
+    EXPECT_EQ(stats.txBytes, 0ULL);
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, GetForwardedStatsDummyIface) {
+    const std::string upstream(TEST_IFACE);
+    ForwardedStats stats;
+    EXPECT_TRUE(mOffload->getForwardedStats(upstream, &stats).isOk());
+    EXPECT_EQ(stats.rxBytes, 0ULL);
+    EXPECT_EQ(stats.txBytes, 0ULL);
+}
+
+/*
+ * Tests for IOffload::setDataWarningAndLimit().
+ */
+
+// Test that setDataWarningAndLimit() for an empty interface name fails.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitEmptyUpstreamIfaceFails) {
+    const std::string upstream("");
+    const int64_t warning = 12345LL;
+    const int64_t limit = 67890LL;
+    EXPECT_THAT(mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_UNSUPPORTED_OPERATION)));
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitNonZeroOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 4000LL;
+    const int64_t limit = 5000LL;
+    EXPECT_THAT(mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode(),
+                AnyOf(Eq(EX_NONE), Eq(EX_UNSUPPORTED_OPERATION)));
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitZeroOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 0LL;
+    const int64_t limit = 0LL;
+    EXPECT_THAT(mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode(),
+                AnyOf(Eq(EX_NONE), Eq(EX_UNSUPPORTED_OPERATION)));
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitUnlimitedWarningOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = LLONG_MAX;
+    const int64_t limit = 5000LL;
+    EXPECT_TRUE(mOffload->setDataWarningAndLimit(upstream, warning, limit).isOk());
+}
+
+// Test that setDataWarningAndLimit() with negative thresholds fails.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitNegativeFails) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = -1LL;
+    const int64_t limit = -1LL;
+    EXPECT_THAT(mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_UNSUPPORTED_OPERATION)));
+}
+
+/*
+ * Tests for IOffload::setUpstreamParameters().
+ */
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv6OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    EXPECT_TRUE(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).isOk());
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersAlternateIPv6OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:3")};
+    EXPECT_TRUE(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).isOk());
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv4OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{};
+    EXPECT_TRUE(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).isOk());
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv4v6Ok) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    EXPECT_TRUE(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).isOk());
+}
+
+// Test that setUpstreamParameters() fails when all parameters are empty.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersEmptyFails) {
+    const std::string iface("");
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{};
+    EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+              EX_ILLEGAL_ARGUMENT);
+}
+
+// Test that setUpstreamParameters() fails when given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersBogusIfaceFails) {
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "upstream: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv4 addresses.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersInvalidIPv4AddrFails) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"invalid", "192.0.2"}) {
+        SCOPED_TRACE(testing::Message() << "v4addr: " << bogus);
+        const std::string v4Addr(bogus);
+        EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv4 gateways.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersInvalidIPv4GatewayFails) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"invalid", "192.0.2"}) {
+        SCOPED_TRACE(testing::Message() << "v4gateway: " << bogus);
+        const std::string v4Gw(bogus);
+        EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv6 gateways.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersBadIPv6GatewaysFail) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    for (const auto& bogus : {"", "invalid", "fe80::bogus", "192.0.2.66"}) {
+        SCOPED_TRACE(testing::Message() << "v6gateway: " << bogus);
+        const std::vector<std::string> v6Gws{std::string("fe80::1"), std::string(bogus)};
+        EXPECT_EQ(mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+/*
+ * Tests for IOffload::addDownstream().
+ */
+
+// Test addDownstream() works given an IPv4 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamIPv4) {
+    const std::string iface("dummy0");
+    const std::string prefix("192.0.2.0/24");
+    EXPECT_TRUE(mOffload->addDownstream(iface, prefix).isOk());
+}
+
+// Test addDownstream() works given an IPv6 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamIPv6) {
+    const std::string iface("dummy0");
+    const std::string prefix("2001:db8::/64");
+    EXPECT_TRUE(mOffload->addDownstream(iface, prefix).isOk());
+}
+
+// Test addDownstream() fails given all empty parameters.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamEmptyFails) {
+    const std::string iface("");
+    const std::string prefix("");
+    EXPECT_EQ(mOffload->addDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+// Test addDownstream() fails given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamInvalidIfaceFails) {
+    const std::string prefix("192.0.2.0/24");
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "iface: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(mOffload->addDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+// Test addDownstream() fails given unparseable prefix arguments.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamBogusPrefixFails) {
+    const std::string iface("dummy0");
+    for (const auto& bogus : {"", "192.0.2/24", "2001:db8/64"}) {
+        SCOPED_TRACE(testing::Message() << "prefix: " << bogus);
+        const std::string prefix(bogus);
+        EXPECT_EQ(mOffload->addDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+/*
+ * Tests for IOffload::removeDownstream().
+ */
+
+// Test removeDownstream() works given an IPv4 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamIPv4) {
+    const std::string iface("dummy0");
+    const std::string prefix("192.0.2.0/24");
+    // First add the downstream, otherwise removeDownstream logic can reasonably
+    // return error for downstreams not previously added.
+    EXPECT_TRUE(mOffload->addDownstream(iface, prefix).isOk());
+    EXPECT_TRUE(mOffload->removeDownstream(iface, prefix).isOk());
+}
+
+// Test removeDownstream() works given an IPv6 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamIPv6) {
+    const std::string iface("dummy0");
+    const std::string prefix("2001:db8::/64");
+    // First add the downstream, otherwise removeDownstream logic can reasonably
+    // return error for downstreams not previously added.
+    EXPECT_TRUE(mOffload->addDownstream(iface, prefix).isOk());
+    EXPECT_TRUE(mOffload->removeDownstream(iface, prefix).isOk());
+}
+
+// Test removeDownstream() fails given all empty parameters.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamEmptyFails) {
+    const std::string iface("");
+    const std::string prefix("");
+    EXPECT_EQ(mOffload->removeDownstream(iface, prefix).getExceptionCode(), EX_ILLEGAL_ARGUMENT);
+}
+
+// Test removeDownstream() fails given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamBogusIfaceFails) {
+    const std::string prefix("192.0.2.0/24");
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "iface: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(mOffload->removeDownstream(iface, prefix).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+// Test removeDownstream() fails given unparseable prefix arguments.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamBogusPrefixFails) {
+    const std::string iface("dummy0");
+    for (const auto& bogus : {"", "192.0.2/24", "2001:db8/64"}) {
+        SCOPED_TRACE(testing::Message() << "prefix: " << bogus);
+        const std::string prefix(bogus);
+        EXPECT_EQ(mOffload->removeDownstream(iface, prefix).getExceptionCode(),
+                  EX_ILLEGAL_ARGUMENT);
+    }
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlTestBase);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlTestBase,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlPreInitTest);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlPreInitTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlGeneralTest);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlGeneralTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+}  // namespace
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    return RUN_ALL_TESTS();
+}
+
+}  // namespace aidl::android::hardware::tetheroffload
diff --git a/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl b/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
index c8a10d1..1d2ef4a 100644
--- a/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
+++ b/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
@@ -24,7 +24,7 @@
 @VintfStability
 parcelable HdmiPortInfo {
     HdmiPortType type;
-    int portId; // Should start from 1 which corresponds to HDMI "port 1".
+    int portId; // Output ports should start from 1 which corresponds to HDMI "port 1".
     boolean cecSupported;
     boolean arcSupported;
     boolean eArcSupported;
diff --git a/tv/hdmi/connection/aidl/default/HdmiConnectionMock.cpp b/tv/hdmi/connection/aidl/default/HdmiConnectionMock.cpp
index 8e2ac40..ca8c348 100644
--- a/tv/hdmi/connection/aidl/default/HdmiConnectionMock.cpp
+++ b/tv/hdmi/connection/aidl/default/HdmiConnectionMock.cpp
@@ -44,7 +44,7 @@
 ScopedAStatus HdmiConnectionMock::isConnected(int32_t portId, bool* _aidl_return) {
     // Maintain port connection status and update on hotplug event
     if (portId <= mTotalPorts && portId >= 1) {
-        *_aidl_return = mPortConnectionStatus[portId];
+        *_aidl_return = mPortConnectionStatus.at(portId - 1);
     } else {
         *_aidl_return = false;
     }
@@ -130,10 +130,10 @@
 
     ALOGD("[halimp_aidl] hot plug port id %x, is connected %x", (msgBuf[0] & 0xf),
           (msgBuf[3] & 0xf));
-    mPortConnectionStatus[portId] = connected;
-    if (mPortInfos[portId].type == HdmiPortType::OUTPUT) {
+    mPortConnectionStatus.at(portId - 1) = connected;
+    if (mPortInfos.at(portId - 1).type == HdmiPortType::OUTPUT) {
         mPhysicalAddress = (connected ? 0xffff : ((msgBuf[1] << 8) | (msgBuf[2])));
-        mPortInfos[portId].physicalAddress = mPhysicalAddress;
+        mPortInfos.at(portId - 1).physicalAddress = mPhysicalAddress;
         ALOGD("[halimp_aidl] hot plug physical address %x", mPhysicalAddress);
     }
 
diff --git a/tv/hdmi/earc/aidl/default/EArcMock.cpp b/tv/hdmi/earc/aidl/default/EArcMock.cpp
index 99a845e..a3ccabf 100644
--- a/tv/hdmi/earc/aidl/default/EArcMock.cpp
+++ b/tv/hdmi/earc/aidl/default/EArcMock.cpp
@@ -54,7 +54,7 @@
 ScopedAStatus EArcMock::getState(int32_t portId, IEArcStatus* _aidl_return) {
     // Maintain port connection status and update on hotplug event
     if (portId <= mTotalPorts && portId >= 1) {
-        *_aidl_return = mPortStatus[portId];
+        *_aidl_return = mPortStatus.at(portId - 1);
     } else {
         return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
     }
@@ -65,7 +65,7 @@
 ScopedAStatus EArcMock::getLastReportedAudioCapabilities(int32_t portId,
                                                          std::vector<uint8_t>* _aidl_return) {
     if (portId <= mTotalPorts && portId >= 1) {
-        *_aidl_return = mCapabilities[portId];
+        *_aidl_return = mCapabilities.at(portId - 1);
     } else {
         return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
     }
diff --git a/tv/input/OWNERS b/tv/input/OWNERS
index a02291a..ae65f67 100644
--- a/tv/input/OWNERS
+++ b/tv/input/OWNERS
@@ -1,3 +1,4 @@
+# Bug component: 105688
 hgchen@google.com
 shubang@google.com
 quxiangfang@google.com
diff --git a/tv/input/aidl/Android.bp b/tv/input/aidl/Android.bp
index 1987174..2591151 100644
--- a/tv/input/aidl/Android.bp
+++ b/tv/input/aidl/Android.bp
@@ -14,6 +14,7 @@
     imports: [
         "android.hardware.common-V2",
         "android.media.audio.common.types-V1",
+        "android.hardware.common.fmq-V1",
     ],
     stability: "vintf",
     backend: {
diff --git a/tv/input/aidl/TEST_MAPPING b/tv/input/aidl/TEST_MAPPING
new file mode 100644
index 0000000..981e46f
--- /dev/null
+++ b/tv/input/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit": [
+    {
+      "name": "VtsHalTvInputTargetTest"
+    }
+  ]
+}
diff --git a/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInput.aidl b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInput.aidl
index f8d5e05..84fe2fb 100644
--- a/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInput.aidl
+++ b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInput.aidl
@@ -38,6 +38,8 @@
   android.hardware.tv.input.TvStreamConfig[] getStreamConfigurations(in int deviceId);
   android.hardware.common.NativeHandle openStream(in int deviceId, in int streamId);
   void setCallback(in android.hardware.tv.input.ITvInputCallback callback);
+  void setTvMessageEnabled(int deviceId, int streamId, in android.hardware.tv.input.TvMessageEventType type, boolean enabled);
+  void getTvMessageQueueDesc(out android.hardware.common.fmq.MQDescriptor<byte,android.hardware.common.fmq.SynchronizedReadWrite> queue, int deviceId, int streamId);
   const int STATUS_UNKNOWN = 1;
   const int STATUS_NO_RESOURCE = 2;
   const int STATUS_INVALID_ARGUMENTS = 3;
diff --git a/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInputCallback.aidl b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInputCallback.aidl
index 7f2aff6..9747013 100644
--- a/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInputCallback.aidl
+++ b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/ITvInputCallback.aidl
@@ -35,4 +35,5 @@
 @VintfStability
 interface ITvInputCallback {
   void notify(in android.hardware.tv.input.TvInputEvent event);
+  void notifyTvMessageEvent(in android.hardware.tv.input.TvMessageEvent event);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessage.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessage.aidl
index 711ac19..637b01c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessage.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tv.input;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable TvMessage {
+  String subType;
+  long groupId;
+  int dataLengthBytes;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEvent.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEvent.aidl
index 711ac19..94fe665 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEvent.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tv.input;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable TvMessageEvent {
+  android.hardware.tv.input.TvMessageEventType type;
+  int streamId;
+  android.hardware.tv.input.TvMessage[] messages;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEventType.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEventType.aidl
index 711ac19..a033903 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/input/aidl/aidl_api/android.hardware.tv.input/current/android/hardware/tv/input/TvMessageEventType.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tv.input;
+@Backing(type="int") @VintfStability
+enum TvMessageEventType {
+  WATERMARK = 1,
+  CLOSED_CAPTION = 2,
+  OTHER = 3,
 }
diff --git a/tv/input/aidl/android/hardware/tv/input/ITvInput.aidl b/tv/input/aidl/android/hardware/tv/input/ITvInput.aidl
index 31d6586..cbaf066 100644
--- a/tv/input/aidl/android/hardware/tv/input/ITvInput.aidl
+++ b/tv/input/aidl/android/hardware/tv/input/ITvInput.aidl
@@ -17,7 +17,10 @@
 package android.hardware.tv.input;
 
 import android.hardware.common.NativeHandle;
+import android.hardware.common.fmq.MQDescriptor;
+import android.hardware.common.fmq.SynchronizedReadWrite;
 import android.hardware.tv.input.ITvInputCallback;
+import android.hardware.tv.input.TvMessageEventType;
 import android.hardware.tv.input.TvStreamConfig;
 
 @VintfStability
@@ -73,4 +76,32 @@
      * @throws ServiceSpecificException with values from the ITvInput::STATUS_* constants
      */
     void setCallback(in ITvInputCallback callback);
+
+    /**
+     * Enables or disables TV message detection for the specified stream on the device.
+     *
+     * @param deviceId The ID of the device that contains the stream to set the flag for.
+     * @param streamId The ID of the stream to set the flag for.
+     * @param type The type of {@link android.hardware.tv.input.TvMessageEventType}.
+     * @param enabled {@code true} if you want to enable TV message detection
+     *                {@code false} otherwise.
+     */
+    void setTvMessageEnabled(
+            int deviceId, int streamId, in TvMessageEventType type, boolean enabled);
+
+    /**
+     * Gets the TV message queue for the specified stream on the device.
+     *
+     * The FMQ is used to relay events that are parsed from the specified stream to the
+     * app or service responsible for processing the message. The HAL implementation
+     * is expected to parse these messages and add them to the queue as new events are
+     * detected from the stream based on whether or not they are enabled by
+     * {@link #setTvMessageEnabled(int, int, TvMessageEventType, boolean)}.
+     *
+     * @param deviceId The ID of the device that contains the stream to get the queue for.
+     * @param streamId THe ID of the stream to get the queue for.
+     * @return The descriptor of the TV message queue.
+     */
+    void getTvMessageQueueDesc(
+            out MQDescriptor<byte, SynchronizedReadWrite> queue, int deviceId, int streamId);
 }
diff --git a/tv/input/aidl/android/hardware/tv/input/ITvInputCallback.aidl b/tv/input/aidl/android/hardware/tv/input/ITvInputCallback.aidl
index fc7492d..5d47317 100644
--- a/tv/input/aidl/android/hardware/tv/input/ITvInputCallback.aidl
+++ b/tv/input/aidl/android/hardware/tv/input/ITvInputCallback.aidl
@@ -17,6 +17,7 @@
 package android.hardware.tv.input;
 
 import android.hardware.tv.input.TvInputEvent;
+import android.hardware.tv.input.TvMessageEvent;
 
 @VintfStability
 interface ITvInputCallback {
@@ -27,4 +28,11 @@
      * @param event Event passed to the client.
      */
     void notify(in TvInputEvent event);
+    /**
+     * Notifies the client that an TV message event has occurred. For possible event types,
+     * check TvMessageEventType.
+     *
+     * @param event Event passed to the client.
+     */
+    void notifyTvMessageEvent(in TvMessageEvent event);
 }
diff --git a/tv/input/aidl/android/hardware/tv/input/TvMessage.aidl b/tv/input/aidl/android/hardware/tv/input/TvMessage.aidl
new file mode 100644
index 0000000..6df1f9a
--- /dev/null
+++ b/tv/input/aidl/android/hardware/tv/input/TvMessage.aidl
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.input;
+
+@VintfStability
+parcelable TvMessage {
+    /**
+     * Extended data type, like “ATSC A/336 Watermark”, “ATSC_CC”, etc. This is opaque
+     * to the framework.
+     */
+    String subType;
+    /**
+     * This group id is used to optionally identify messages that belong together, such as
+     * headers and bodies of the same event. For messages that do not have a group, this value
+     * should be -1.
+     *
+     * As -1 is a reserved value, -1 should not be used as a valid groupId.
+     */
+    long groupId;
+    int dataLengthBytes;
+}
diff --git a/tv/input/aidl/android/hardware/tv/input/TvMessageEvent.aidl b/tv/input/aidl/android/hardware/tv/input/TvMessageEvent.aidl
new file mode 100644
index 0000000..74a078a
--- /dev/null
+++ b/tv/input/aidl/android/hardware/tv/input/TvMessageEvent.aidl
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.input;
+
+import android.hardware.tv.input.TvMessage;
+import android.hardware.tv.input.TvMessageEventType;
+
+@VintfStability
+parcelable TvMessageEvent {
+    TvMessageEventType type;
+
+    int streamId;
+    TvMessage[] messages;
+}
diff --git a/tv/input/aidl/android/hardware/tv/input/TvMessageEventType.aidl b/tv/input/aidl/android/hardware/tv/input/TvMessageEventType.aidl
new file mode 100644
index 0000000..5a5f472
--- /dev/null
+++ b/tv/input/aidl/android/hardware/tv/input/TvMessageEventType.aidl
@@ -0,0 +1,25 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.input;
+
+@VintfStability
+@Backing(type="int")
+enum TvMessageEventType {
+    WATERMARK = 1,
+    CLOSED_CAPTION = 2,
+    OTHER = 3,
+}
diff --git a/tv/input/aidl/default/Android.bp b/tv/input/aidl/default/Android.bp
index 66148c8..05af6a9 100644
--- a/tv/input/aidl/default/Android.bp
+++ b/tv/input/aidl/default/Android.bp
@@ -13,6 +13,10 @@
     init_rc: ["input-default.rc"],
     vintf_fragments: ["input-default.xml"],
     vendor: true,
+    cflags: [
+        "-Werror",
+        "-Wno-unused-parameter",
+    ],
     srcs: [
         "TvInput.cpp",
         "service.cpp",
@@ -23,9 +27,11 @@
     shared_libs: [
         "libbase",
         "liblog",
+        "libfmq",
         "libutils",
         "libcutils",
         "libbinder_ndk",
         "android.hardware.tv.input-V1-ndk",
+        "android.hardware.common.fmq-V1-ndk",
     ],
 }
diff --git a/tv/input/aidl/default/TvInput.cpp b/tv/input/aidl/default/TvInput.cpp
index ed12cbc..c986ef1 100644
--- a/tv/input/aidl/default/TvInput.cpp
+++ b/tv/input/aidl/default/TvInput.cpp
@@ -65,6 +65,21 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus TvInput::setTvMessageEnabled(int32_t deviceId, int32_t streamId,
+                                                  TvMessageEventType in_type, bool enabled) {
+    ALOGV("%s", __FUNCTION__);
+    // TODO: Implement this
+    return ::ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus TvInput::getTvMessageQueueDesc(
+        MQDescriptor<int8_t, SynchronizedReadWrite>* out_queue, int32_t in_deviceId,
+        int32_t in_streamId) {
+    ALOGV("%s", __FUNCTION__);
+    // TODO: Implement this
+    return ::ndk::ScopedAStatus::ok();
+}
+
 ::ndk::ScopedAStatus TvInput::getStreamConfigurations(int32_t in_deviceId,
                                                       vector<TvStreamConfig>* _aidl_return) {
     ALOGV("%s", __FUNCTION__);
@@ -95,8 +110,8 @@
         return ::ndk::ScopedAStatus::fromServiceSpecificError(STATUS_INVALID_STATE);
     }
     mStreamConfigs[in_deviceId][in_streamId]->handle = createNativeHandle(in_streamId);
-    mStreamConfigs[in_deviceId][in_streamId]->isOpen = true;
     *_aidl_return = makeToAidl(mStreamConfigs[in_deviceId][in_streamId]->handle);
+    mStreamConfigs[in_deviceId][in_streamId]->isOpen = true;
     return ::ndk::ScopedAStatus::ok();
 }
 
@@ -112,27 +127,21 @@
         ALOGW("Stream with device id %d, stream id %d is already closed", in_deviceId, in_streamId);
         return ::ndk::ScopedAStatus::fromServiceSpecificError(STATUS_INVALID_STATE);
     }
-    releaseNativeHandle(mStreamConfigs[in_deviceId][in_streamId]->handle);
+    native_handle_delete(mStreamConfigs[in_deviceId][in_streamId]->handle);
     mStreamConfigs[in_deviceId][in_streamId]->handle = nullptr;
     mStreamConfigs[in_deviceId][in_streamId]->isOpen = false;
     return ::ndk::ScopedAStatus::ok();
 }
 
 native_handle_t* TvInput::createNativeHandle(int fd) {
-    native_handle_t* nativeHandle = native_handle_create(1, 0);
-    if (nativeHandle == nullptr) {
+    native_handle_t* handle = native_handle_create(1, 1);
+    if (handle == nullptr) {
         ALOGE("[TVInput] Failed to create native_handle %d", errno);
         return nullptr;
     }
-    if (nativeHandle->numFds > 0) {
-        nativeHandle->data[0] = dup(fd);
-    }
-    return nativeHandle;
-}
-
-void TvInput::releaseNativeHandle(native_handle_t* handle) {
-    native_handle_close(handle);
-    native_handle_delete(handle);
+    handle->data[0] = dup(0);
+    handle->data[1] = fd;
+    return handle;
 }
 
 }  // namespace input
diff --git a/tv/input/aidl/default/TvInput.h b/tv/input/aidl/default/TvInput.h
index a72bca3..92e7d4c 100644
--- a/tv/input/aidl/default/TvInput.h
+++ b/tv/input/aidl/default/TvInput.h
@@ -19,6 +19,8 @@
 #include <aidl/android/hardware/tv/input/BnTvInput.h>
 #include <utils/KeyedVector.h>
 
+#include <aidl/android/hardware/tv/input/TvMessageEventType.h>
+#include <fmq/AidlMessageQueue.h>
 #include <map>
 #include "TvInputDeviceInfoWrapper.h"
 #include "TvStreamConfigWrapper.h"
@@ -26,6 +28,9 @@
 using namespace android;
 using namespace std;
 using ::aidl::android::hardware::common::NativeHandle;
+using ::aidl::android::hardware::common::fmq::MQDescriptor;
+using ::aidl::android::hardware::common::fmq::SynchronizedReadWrite;
+using ::android::AidlMessageQueue;
 
 namespace aidl {
 namespace android {
@@ -38,6 +43,11 @@
     TvInput();
 
     ::ndk::ScopedAStatus setCallback(const shared_ptr<ITvInputCallback>& in_callback) override;
+    ::ndk::ScopedAStatus setTvMessageEnabled(int32_t deviceId, int32_t streamId,
+                                             TvMessageEventType in_type, bool enabled) override;
+    ::ndk::ScopedAStatus getTvMessageQueueDesc(
+            MQDescriptor<int8_t, SynchronizedReadWrite>* out_queue, int32_t in_deviceId,
+            int32_t in_streamId) override;
     ::ndk::ScopedAStatus getStreamConfigurations(int32_t in_deviceId,
                                                  vector<TvStreamConfig>* _aidl_return) override;
     ::ndk::ScopedAStatus openStream(int32_t in_deviceId, int32_t in_streamId,
@@ -48,7 +58,6 @@
 
   private:
     native_handle_t* createNativeHandle(int fd);
-    void releaseNativeHandle(native_handle_t* handle);
 
     shared_ptr<ITvInputCallback> mCallback;
     map<int32_t, shared_ptr<TvInputDeviceInfoWrapper>> mDeviceInfos;
diff --git a/tv/input/aidl/vts/functional/Android.bp b/tv/input/aidl/vts/functional/Android.bp
index 9829b6d..22487ea 100644
--- a/tv/input/aidl/vts/functional/Android.bp
+++ b/tv/input/aidl/vts/functional/Android.bp
@@ -9,10 +9,16 @@
 
 cc_test {
     name: "VtsHalTvInputTargetTest",
-    defaults: ["VtsHalTargetTestDefaults","use_libaidlvintf_gtest_helper_static",],
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    cflags: [
+        "-Werror",
+        "-Wno-unused-parameter",
+    ],
     srcs: ["VtsHalTvInputTargetTest.cpp"],
     static_libs: [
-        "android.hardware.tv.input-V1-ndk",
         "android.media.audio.common.types-V1-ndk",
         "android.hardware.common-V2-ndk",
         "libaidlcommonsupport",
@@ -24,6 +30,9 @@
     shared_libs: [
         "libbinder_ndk",
         "libvndksupport",
+        "libfmq",
+        "android.hardware.common.fmq-V1-ndk",
+        "android.hardware.tv.input-V1-ndk",
     ],
     require_root: true,
 }
diff --git a/tv/input/aidl/vts/functional/AndroidTest.xml b/tv/input/aidl/vts/functional/AndroidTest.xml
new file mode 100644
index 0000000..5549102
--- /dev/null
+++ b/tv/input/aidl/vts/functional/AndroidTest.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2023 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalTvInputTargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="VtsHalTvInputTargetTest->/data/local/tmp/VtsHalTvInputTargetTest" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsHalTvInputTargetTest" />
+        <option name="native-test-timeout" value="30m" />
+    </test>
+</configuration>
diff --git a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
index ec83e29..a2415b4 100644
--- a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
+++ b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.cpp
@@ -43,6 +43,11 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus TvInputAidlTest::TvInputCallback::notifyTvMessageEvent(
+        const TvMessageEvent& in_event) {
+    return ::ndk::ScopedAStatus::ok();
+}
+
 void TvInputAidlTest::SetUp() {
     if (AServiceManager_isDeclared(GetParam().c_str())) {
         ::ndk::SpAIBinder binder(AServiceManager_waitForService(GetParam().c_str()));
@@ -158,10 +163,11 @@
         int32_t device_id = stream_config_.keyAt(j);
         vector<TvStreamConfig> config = stream_config_.valueAt(j);
         for (size_t i = 0; i < config.size(); i++) {
+            NativeHandle handle;
             int32_t stream_id = config[i].streamId;
             ALOGD("OpenAndCloseStreamTest: open stream, device_id=%d, stream_id=%d", device_id,
                   stream_id);
-            ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle_).isOk());
+            ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).isOk());
             ALOGD("OpenAndCloseStreamTest: close stream, device_id=%d, stream_id=%d", device_id,
                   stream_id);
             ASSERT_TRUE(tv_input_->closeStream(device_id, stream_id).isOk());
@@ -190,9 +196,10 @@
                 ITvInput::STATUS_INVALID_ARGUMENTS);
 
     int32_t stream_id = 0;
+    NativeHandle handle;
 
     ALOGD("InvalidDeviceIdTest: open stream, device_id=%d, stream_id=%d", id, stream_id);
-    ASSERT_TRUE(tv_input_->openStream(id, stream_id, &handle_).getServiceSpecificError() ==
+    ASSERT_TRUE(tv_input_->openStream(id, stream_id, &handle).getServiceSpecificError() ==
                 ITvInput::STATUS_INVALID_ARGUMENTS);
 
     ALOGD("InvalidDeviceIdTest: close stream, device_id=%d, stream_id=%d", id, stream_id);
@@ -226,8 +233,10 @@
         id = getNumNotIn(stream_ids);
     }
 
+    NativeHandle handle;
+
     ALOGD("InvalidStreamIdTest: open stream, device_id=%d, stream_id=%d", device_id, id);
-    ASSERT_TRUE(tv_input_->openStream(device_id, id, &handle_).getServiceSpecificError() ==
+    ASSERT_TRUE(tv_input_->openStream(device_id, id, &handle).getServiceSpecificError() ==
                 ITvInput::STATUS_INVALID_ARGUMENTS);
 
     ALOGD("InvalidStreamIdTest: close stream, device_id=%d, stream_id=%d", device_id, id);
@@ -252,11 +261,13 @@
     int32_t device_id = stream_config_.keyAt(indices[0]);
     int32_t stream_id = stream_config_.valueAt(indices[0])[0].streamId;
 
-    ALOGD("OpenAnOpenedStreamsTest: open stream, device_id=%d, stream_id=%d", device_id, stream_id);
-    ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle_).isOk());
+    NativeHandle handle;
 
     ALOGD("OpenAnOpenedStreamsTest: open stream, device_id=%d, stream_id=%d", device_id, stream_id);
-    ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle_).getServiceSpecificError() ==
+    ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).isOk());
+
+    ALOGD("OpenAnOpenedStreamsTest: open stream, device_id=%d, stream_id=%d", device_id, stream_id);
+    ASSERT_TRUE(tv_input_->openStream(device_id, stream_id, &handle).getServiceSpecificError() ==
                 ITvInput::STATUS_INVALID_STATE);
 
     // close stream as subsequent tests assume no open streams
diff --git a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
index c76e568..20d9227 100644
--- a/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
+++ b/tv/input/aidl/vts/functional/VtsHalTvInputTargetTest.h
@@ -25,15 +25,19 @@
 #include <aidl/android/hardware/tv/input/ITvInput.h>
 #include <aidl/android/hardware/tv/input/TvInputDeviceInfo.h>
 #include <aidl/android/hardware/tv/input/TvInputEvent.h>
+#include <aidl/android/hardware/tv/input/TvMessageEvent.h>
+#include <aidl/android/hardware/tv/input/TvMessageEventType.h>
 #include <aidl/android/hardware/tv/input/TvStreamConfig.h>
+#include <fmq/AidlMessageQueue.h>
 
 #include <log/log.h>
 #include <utils/KeyedVector.h>
 
 using namespace aidl::android::hardware::tv::input;
 using namespace std;
-
 using ::aidl::android::hardware::common::NativeHandle;
+using ::aidl::android::hardware::common::fmq::MQDescriptor;
+using ::android::AidlMessageQueue;
 
 #define WAIT_FOR_EVENT_TIMEOUT 5
 #define DEFAULT_ID INT32_MIN
@@ -46,6 +50,7 @@
       public:
         TvInputCallback(shared_ptr<TvInputAidlTest> parent);
         ::ndk::ScopedAStatus notify(const TvInputEvent& in_event) override;
+        ::ndk::ScopedAStatus notifyTvMessageEvent(const TvMessageEvent& in_event) override;
 
       private:
         shared_ptr<TvInputAidlTest> parent_;
@@ -84,7 +89,6 @@
     android::KeyedVector<int32_t, TvInputDeviceInfo> device_info_;
     android::KeyedVector<int32_t, vector<TvStreamConfig>> stream_config_;
     mutex mutex_;
-    NativeHandle handle_;
 };
 
 }  // namespace VtsHalTvInputTargetTest
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/DemuxInfo.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/DemuxInfo.aidl
index 711ac19..872d963 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/DemuxInfo.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tv.tuner;
+/* @hide */
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable DemuxInfo {
+  int filterTypes = 0;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettings.aidl
similarity index 75%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettings.aidl
index 711ac19..73582f3 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettings.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tv.tuner;
+/* @hide */
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable FrontendIptvSettings {
+  android.hardware.tv.tuner.FrontendIptvSettingsProtocol protocol = android.hardware.tv.tuner.FrontendIptvSettingsProtocol.UNDEFINED;
+  android.hardware.tv.tuner.FrontendIptvSettingsFec fec;
+  android.hardware.tv.tuner.FrontendIptvSettingsIgmp igmp = android.hardware.tv.tuner.FrontendIptvSettingsIgmp.UNDEFINED;
+  long bitrate;
+  android.hardware.tv.tuner.DemuxIpAddress ipAddr;
+  String contentUrl;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl
index 711ac19..c361377 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.tv.tuner;
+/* @hide */
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable FrontendIptvSettingsFec {
+  android.hardware.tv.tuner.FrontendIptvSettingsFecType type;
+  int fecColNum;
+  int fecRowNum;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl
index 711ac19..50a1208 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tv.tuner;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum FrontendIptvSettingsFecType {
+  UNDEFINED = 0,
+  COLUMN = 1,
+  ROW = 2,
+  COLUMN_ROW = 4,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl
index 711ac19..aa08496 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tv.tuner;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum FrontendIptvSettingsIgmp {
+  UNDEFINED = 0,
+  V1 = 1,
+  V2 = 2,
+  V3 = 4,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl
index 711ac19..08a01f1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.tv.tuner;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum FrontendIptvSettingsProtocol {
+  UNDEFINED = 0,
+  UDP = 1,
+  RTP = 2,
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendSettings.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendSettings.aidl
index 7eae9df..9810ba6 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendSettings.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendSettings.aidl
@@ -45,4 +45,5 @@
   android.hardware.tv.tuner.FrontendIsdbs3Settings isdbs3;
   android.hardware.tv.tuner.FrontendIsdbtSettings isdbt;
   android.hardware.tv.tuner.FrontendDtmbSettings dtmb;
+  @nullable android.hardware.tv.tuner.FrontendIptvSettings iptv;
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
index 1e0f5f0..b991ab6 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatus.aidl
@@ -77,4 +77,9 @@
   int[] streamIdList;
   int[] dvbtCellIds;
   android.hardware.tv.tuner.FrontendScanAtsc3PlpInfo[] allPlpInfo;
+  String iptvContentUrl = "";
+  long iptvPacketsReceived;
+  long iptvPacketsLost;
+  int iptvWorstJitterMs;
+  int iptvAverageJitterMs;
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
index cd6ccb3..3791299 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendStatusType.aidl
@@ -77,4 +77,9 @@
   STREAM_ID_LIST = 39,
   DVBT_CELL_IDS = 40,
   ATSC3_ALL_PLP_INFO = 41,
+  IPTV_CONTENT_URL = 42,
+  IPTV_PACKETS_LOST = 43,
+  IPTV_PACKETS_RECEIVED = 44,
+  IPTV_WORST_JITTER_MS = 45,
+  IPTV_AVERAGE_JITTER_MS = 46,
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendType.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendType.aidl
index 99a120b..cbf5b47 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendType.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/FrontendType.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -46,4 +46,5 @@
   ISDBS3 = 8,
   ISDBT = 9,
   DTMB = 10,
+  IPTV = 11,
 }
diff --git a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/ITuner.aidl b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/ITuner.aidl
index 5d1d215..732f3fd 100644
--- a/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/ITuner.aidl
+++ b/tv/tuner/aidl/aidl_api/android.hardware.tv.tuner/current/android/hardware/tv/tuner/ITuner.aidl
@@ -48,4 +48,7 @@
   void setMaxNumberOfFrontends(in android.hardware.tv.tuner.FrontendType frontendType, in int maxNumber);
   int getMaxNumberOfFrontends(in android.hardware.tv.tuner.FrontendType frontendType);
   boolean isLnaSupported();
+  int[] getDemuxIds();
+  android.hardware.tv.tuner.IDemux openDemuxById(in int demuxId);
+  android.hardware.tv.tuner.DemuxInfo getDemuxInfo(in int demuxId);
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/DemuxInfo.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/DemuxInfo.aidl
new file mode 100644
index 0000000..2720e21
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/DemuxInfo.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+import android.hardware.tv.tuner.DemuxFilterMainType;
+
+/**
+ * Information for the Demux.
+ * @hide
+ */
+@VintfStability
+parcelable DemuxInfo {
+    /**
+     * Bitwise OR of DemuxFilterMainTypes
+     */
+    int filterTypes = DemuxFilterMainType.UNDEFINED;
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettings.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettings.aidl
new file mode 100644
index 0000000..782695a
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettings.aidl
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+import android.hardware.tv.tuner.DemuxIpAddress;
+import android.hardware.tv.tuner.FrontendIptvSettingsFec;
+import android.hardware.tv.tuner.FrontendIptvSettingsFecType;
+import android.hardware.tv.tuner.FrontendIptvSettingsIgmp;
+import android.hardware.tv.tuner.FrontendIptvSettingsProtocol;
+
+/**
+ * Frontend Settings for IPTV.
+ * @hide
+ */
+@VintfStability
+parcelable FrontendIptvSettings {
+    FrontendIptvSettingsProtocol protocol = FrontendIptvSettingsProtocol.UNDEFINED;
+
+    FrontendIptvSettingsFec fec;
+
+    FrontendIptvSettingsIgmp igmp = FrontendIptvSettingsIgmp.UNDEFINED;
+
+    long bitrate;
+
+    /**
+     * Source and destination IP Address.
+     */
+    DemuxIpAddress ipAddr;
+
+    String contentUrl;
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl
new file mode 100644
index 0000000..e12f06f
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFec.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+import android.hardware.tv.tuner.FrontendIptvSettingsFecType;
+
+/**
+ * Configuration details for IPTV FEC.
+ * @hide
+ */
+@VintfStability
+parcelable FrontendIptvSettingsFec {
+    FrontendIptvSettingsFecType type;
+
+    /**
+     * The number of columns in the source block as well as the type of the repair packet.
+     */
+    int fecColNum;
+
+    /**
+     * The number of rows in the source block as well as the type of the repair packet.
+     */
+    int fecRowNum;
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl
new file mode 100644
index 0000000..421cbf8
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsFecType.aidl
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+/**
+ * FEC type for IPTV.
+ * TS 102 542-3-2 - V1.3.2
+ * @hide
+ */
+@VintfStability
+@Backing(type="int")
+enum FrontendIptvSettingsFecType {
+    UNDEFINED = 0,
+
+    COLUMN = 1 << 0,
+
+    ROW = 1 << 1,
+
+    COLUMN_ROW = 1 << 2,
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl
new file mode 100644
index 0000000..f6e39c8
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsIgmp.aidl
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+/**
+ * IGMP type for IPTV.
+ * @hide
+ */
+@VintfStability
+@Backing(type="int")
+enum FrontendIptvSettingsIgmp {
+    UNDEFINED = 0,
+
+    V1 = 1 << 0,
+
+    V2 = 1 << 1,
+
+    V3 = 1 << 2,
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl
new file mode 100644
index 0000000..0283445
--- /dev/null
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendIptvSettingsProtocol.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.tuner;
+
+/**
+ * Protocol for IPTV.
+ * @hide
+ */
+@VintfStability
+@Backing(type="int")
+enum FrontendIptvSettingsProtocol {
+    UNDEFINED = 0,
+
+    UDP = 1 << 0,
+
+    RTP = 1 << 1,
+}
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendSettings.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendSettings.aidl
index f78b2ae..e5a99e1 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendSettings.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendSettings.aidl
@@ -19,13 +19,14 @@
 import android.hardware.tv.tuner.FrontendAnalogSettings;
 import android.hardware.tv.tuner.FrontendAtsc3Settings;
 import android.hardware.tv.tuner.FrontendAtscSettings;
+import android.hardware.tv.tuner.FrontendDtmbSettings;
 import android.hardware.tv.tuner.FrontendDvbcSettings;
 import android.hardware.tv.tuner.FrontendDvbsSettings;
 import android.hardware.tv.tuner.FrontendDvbtSettings;
+import android.hardware.tv.tuner.FrontendIptvSettings;
 import android.hardware.tv.tuner.FrontendIsdbs3Settings;
 import android.hardware.tv.tuner.FrontendIsdbsSettings;
 import android.hardware.tv.tuner.FrontendIsdbtSettings;
-import android.hardware.tv.tuner.FrontendDtmbSettings;
 
 /**
  * Signal Settings for Frontend.
@@ -52,4 +53,6 @@
     FrontendIsdbtSettings isdbt;
 
     FrontendDtmbSettings dtmb;
+
+    @nullable FrontendIptvSettings iptv;
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
index b5d0201..391f29b 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatus.aidl
@@ -26,8 +26,8 @@
 import android.hardware.tv.tuner.FrontendModulation;
 import android.hardware.tv.tuner.FrontendModulationStatus;
 import android.hardware.tv.tuner.FrontendRollOff;
-import android.hardware.tv.tuner.FrontendSpectralInversion;
 import android.hardware.tv.tuner.FrontendScanAtsc3PlpInfo;
+import android.hardware.tv.tuner.FrontendSpectralInversion;
 import android.hardware.tv.tuner.FrontendStatusAtsc3PlpInfo;
 import android.hardware.tv.tuner.FrontendTransmissionMode;
 import android.hardware.tv.tuner.LnbVoltage;
@@ -247,4 +247,29 @@
      * and not tuned PLPs for currently watching service.
      */
     FrontendScanAtsc3PlpInfo[] allPlpInfo;
+
+    /**
+     * IPTV Content URL
+     */
+    String iptvContentUrl = "";
+
+    /**
+     * Packets Received (IPTV - UDP/RTP).
+     */
+    long iptvPacketsReceived;
+
+    /**
+     * Packets Lost (IPTV - RTP).
+     */
+    long iptvPacketsLost;
+
+    /**
+     * Worst jitter (milliseconds).
+     */
+    int iptvWorstJitterMs;
+
+    /**
+     * Average jitter (milliseconds).
+     */
+    int iptvAverageJitterMs;
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
index 8f3f2c5..6804b2d 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendStatusType.aidl
@@ -234,4 +234,29 @@
      * and not tuned PLPs for currently watching service.
      */
     ATSC3_ALL_PLP_INFO,
+
+    /**
+     * IPTV Content URL.
+     */
+    IPTV_CONTENT_URL,
+
+    /**
+     * Number of packets lost.
+     */
+    IPTV_PACKETS_LOST,
+
+    /**
+     * Number of packets received.
+     */
+    IPTV_PACKETS_RECEIVED,
+
+    /**
+     * Worst jitter (milliseconds).
+     */
+    IPTV_WORST_JITTER_MS,
+
+    /**
+     * Average jitter (milliseconds).
+     */
+    IPTV_AVERAGE_JITTER_MS,
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendType.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendType.aidl
index 8ade389..e8d343e 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/FrontendType.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/FrontendType.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 The Android Open Source Project
+ * Copyright 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -79,4 +79,9 @@
      * DTMB (Digital Terrestrial Multimedia Broadcast) standard.
      */
     DTMB,
+
+    /**
+     * ITU IPTV (ITU-T FG IPTV)
+     */
+    IPTV,
 }
diff --git a/tv/tuner/aidl/android/hardware/tv/tuner/ITuner.aidl b/tv/tuner/aidl/android/hardware/tv/tuner/ITuner.aidl
index 4a0b7a2..9ead7dd 100644
--- a/tv/tuner/aidl/android/hardware/tv/tuner/ITuner.aidl
+++ b/tv/tuner/aidl/android/hardware/tv/tuner/ITuner.aidl
@@ -17,6 +17,7 @@
 package android.hardware.tv.tuner;
 
 import android.hardware.tv.tuner.DemuxCapabilities;
+import android.hardware.tv.tuner.DemuxInfo;
 import android.hardware.tv.tuner.FrontendInfo;
 import android.hardware.tv.tuner.FrontendType;
 import android.hardware.tv.tuner.IDemux;
@@ -65,7 +66,7 @@
     IDemux openDemux(out int[] demuxId);
 
     /**
-     * Retrieve the Demux's Capabilities.
+     * Retrieve the system wide Demux's Capabilities
      *
      * @return the Demux's Capabilities.
      */
@@ -158,4 +159,32 @@
      * @return true if supported, otherwise false
      */
     boolean isLnaSupported();
+
+    /**
+     * Get Demux IDs
+     *
+     * It is used by the client to get all available demuxes' IDs.
+     *
+     * @return an array of IDs for the available Demuxes.
+     */
+    int[] getDemuxIds();
+
+    /**
+     * Create a new instance of Demux given a demuxId.
+     *
+     * It is used by the client to create a demux instance.
+     *
+     * @param demuxId the id of the demux to be opened.
+     *
+     * @return the newly created demux interface.
+     */
+    IDemux openDemuxById(in int demuxId);
+
+    /**
+     * Retrieve the DemuxInfo of the specified Demux.
+     *
+     * @param demuxId the demux ID to query the DemuxInfo for.
+     * @return the DemuxInfo of the specified Demux by demuxId.
+     */
+    DemuxInfo getDemuxInfo(in int demuxId);
 }
diff --git a/tv/tuner/aidl/default/Demux.cpp b/tv/tuner/aidl/default/Demux.cpp
index 60fd899..11e7131 100644
--- a/tv/tuner/aidl/default/Demux.cpp
+++ b/tv/tuner/aidl/default/Demux.cpp
@@ -31,8 +31,12 @@
 
 #define WAIT_TIMEOUT 3000000000
 
-Demux::Demux(int32_t demuxId, std::shared_ptr<Tuner> tuner) {
+Demux::Demux(int32_t demuxId, uint32_t filterTypes) {
     mDemuxId = demuxId;
+    mFilterTypes = filterTypes;
+}
+
+void Demux::setTunerService(std::shared_ptr<Tuner> tuner) {
     mTuner = tuner;
 }
 
@@ -346,6 +350,22 @@
     return mFilters[filterId]->getTpid();
 }
 
+int32_t Demux::getDemuxId() {
+    return mDemuxId;
+}
+
+bool Demux::isInUse() {
+    return mInUse;
+}
+
+void Demux::setInUse(bool inUse) {
+    mInUse = inUse;
+}
+
+void Demux::getDemuxInfo(DemuxInfo* demuxInfo) {
+    *demuxInfo = {.filterTypes = mFilterTypes};
+}
+
 void Demux::startFrontendInputLoop() {
     ALOGD("[Demux] start frontend on demux");
     // Stop current Frontend thread loop first, in case the user starts a new
diff --git a/tv/tuner/aidl/default/Demux.h b/tv/tuner/aidl/default/Demux.h
index 7f0b0a7..7d7aee4 100644
--- a/tv/tuner/aidl/default/Demux.h
+++ b/tv/tuner/aidl/default/Demux.h
@@ -53,7 +53,7 @@
 
 class Demux : public BnDemux {
   public:
-    Demux(int32_t demuxId, std::shared_ptr<Tuner> tuner);
+    Demux(int32_t demuxId, uint32_t filterTypes);
     ~Demux();
 
     ::ndk::ScopedAStatus setFrontendDataSource(int32_t in_frontendId) override;
@@ -98,6 +98,12 @@
     void sendFrontendInputToRecord(vector<int8_t> data, uint16_t pid, uint64_t pts);
     bool startRecordFilterDispatcher();
 
+    void getDemuxInfo(DemuxInfo* demuxInfo);
+    int32_t getDemuxId();
+    bool isInUse();
+    void setInUse(bool inUse);
+    void setTunerService(std::shared_ptr<Tuner> tuner);
+
   private:
     // Tuner service
     std::shared_ptr<Tuner> mTuner;
@@ -183,6 +189,9 @@
     vector<uint8_t> mPesOutput;
 
     const bool DEBUG_DEMUX = false;
+
+    int32_t mFilterTypes;
+    bool mInUse = false;
 };
 
 }  // namespace tuner
diff --git a/tv/tuner/aidl/default/Frontend.cpp b/tv/tuner/aidl/default/Frontend.cpp
index 997d9de..d140b74 100644
--- a/tv/tuner/aidl/default/Frontend.cpp
+++ b/tv/tuner/aidl/default/Frontend.cpp
@@ -875,6 +875,26 @@
                 status.set<FrontendStatus::allPlpInfo>(infos);
                 break;
             }
+            case FrontendStatusType::IPTV_CONTENT_URL: {
+                status.set<FrontendStatus::iptvContentUrl>("");
+                break;
+            }
+            case FrontendStatusType::IPTV_PACKETS_LOST: {
+                status.set<FrontendStatus::iptvPacketsLost>(5);
+                break;
+            }
+            case FrontendStatusType::IPTV_PACKETS_RECEIVED: {
+                status.set<FrontendStatus::iptvPacketsReceived>(5);
+                break;
+            }
+            case FrontendStatusType::IPTV_WORST_JITTER_MS: {
+                status.set<FrontendStatus::iptvWorstJitterMs>(5);
+                break;
+            }
+            case FrontendStatusType::IPTV_AVERAGE_JITTER_MS: {
+                status.set<FrontendStatus::iptvAverageJitterMs>(5);
+                break;
+            }
             default: {
                 continue;
             }
diff --git a/tv/tuner/aidl/default/Tuner.cpp b/tv/tuner/aidl/default/Tuner.cpp
index 8c715a0..197d866 100644
--- a/tv/tuner/aidl/default/Tuner.cpp
+++ b/tv/tuner/aidl/default/Tuner.cpp
@@ -17,6 +17,7 @@
 //#define LOG_NDEBUG 0
 #define LOG_TAG "android.hardware.tv.tuner-service.example-Tuner"
 
+#include <aidl/android/hardware/tv/tuner/DemuxFilterMainType.h>
 #include <aidl/android/hardware/tv/tuner/Result.h>
 #include <utils/Log.h>
 
@@ -37,7 +38,7 @@
 void Tuner::init() {
     // Static Frontends array to maintain local frontends information
     // Array index matches their FrontendId in the default impl
-    mFrontendSize = 10;
+    mFrontendSize = 11;
     mFrontends[0] = ndk::SharedRefBase::make<Frontend>(FrontendType::ISDBS, 0);
     mFrontends[1] = ndk::SharedRefBase::make<Frontend>(FrontendType::ATSC3, 1);
     mFrontends[2] = ndk::SharedRefBase::make<Frontend>(FrontendType::DVBC, 2);
@@ -48,6 +49,7 @@
     mFrontends[7] = ndk::SharedRefBase::make<Frontend>(FrontendType::ATSC, 7);
     mFrontends[8] = ndk::SharedRefBase::make<Frontend>(FrontendType::ISDBS3, 8);
     mFrontends[9] = ndk::SharedRefBase::make<Frontend>(FrontendType::DTMB, 9);
+    mFrontends[10] = ndk::SharedRefBase::make<Frontend>(FrontendType::IPTV, 10);
 
     mMaxUsableFrontends[FrontendType::ISDBS] = 1;
     mMaxUsableFrontends[FrontendType::ATSC3] = 1;
@@ -59,6 +61,17 @@
     mMaxUsableFrontends[FrontendType::ATSC] = 1;
     mMaxUsableFrontends[FrontendType::ISDBS3] = 1;
     mMaxUsableFrontends[FrontendType::DTMB] = 1;
+    mMaxUsableFrontends[FrontendType::IPTV] = 1;
+
+    mDemuxes[0] =
+            ndk::SharedRefBase::make<Demux>(0, (static_cast<int32_t>(DemuxFilterMainType::TS) |
+                                                static_cast<int32_t>(DemuxFilterMainType::MMTP) |
+                                                static_cast<int32_t>(DemuxFilterMainType::TLV)));
+    mDemuxes[1] =
+            ndk::SharedRefBase::make<Demux>(1, (static_cast<int32_t>(DemuxFilterMainType::MMTP) |
+                                                static_cast<int32_t>(DemuxFilterMainType::TLV)));
+    mDemuxes[2] = ndk::SharedRefBase::make<Demux>(2, static_cast<int32_t>(DemuxFilterMainType::IP));
+    mDemuxes[3] = ndk::SharedRefBase::make<Demux>(3, static_cast<int32_t>(DemuxFilterMainType::TS));
 
     mLnbs.resize(2);
     mLnbs[0] = ndk::SharedRefBase::make<Lnb>(0);
@@ -78,6 +91,28 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus Tuner::getDemuxInfo(int32_t in_demuxId, DemuxInfo* _aidl_return) {
+    if (mDemuxes.find(in_demuxId) == mDemuxes.end()) {
+        return ::ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(Result::INVALID_ARGUMENT));
+    } else {
+        mDemuxes[in_demuxId]->getDemuxInfo(_aidl_return);
+        return ::ndk::ScopedAStatus::ok();
+    }
+}
+
+::ndk::ScopedAStatus Tuner::getDemuxIds(std::vector<int32_t>* _aidl_return) {
+    ALOGV("%s", __FUNCTION__);
+
+    int numOfDemuxes = mDemuxes.size();
+    _aidl_return->resize(numOfDemuxes);
+    int i = 0;
+    for (auto e = mDemuxes.begin(); e != mDemuxes.end(); e++) {
+        (*_aidl_return)[i++] = e->first;
+    }
+    return ::ndk::ScopedAStatus::ok();
+}
+
 ::ndk::ScopedAStatus Tuner::openFrontendById(int32_t in_frontendId,
                                              std::shared_ptr<IFrontend>* _aidl_return) {
     ALOGV("%s", __FUNCTION__);
@@ -94,17 +129,49 @@
     return ::ndk::ScopedAStatus::ok();
 }
 
+::ndk::ScopedAStatus Tuner::openDemuxById(int32_t in_demuxId,
+                                          std::shared_ptr<IDemux>* _aidl_return) {
+    ALOGV("%s", __FUNCTION__);
+
+    if (mDemuxes.find(in_demuxId) == mDemuxes.end()) {
+        ALOGW("[   WARN   ] Demux with id %d isn't available", in_demuxId);
+        *_aidl_return = nullptr;
+        return ::ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(Result::INVALID_ARGUMENT));
+    }
+
+    if (mDemuxes[in_demuxId]->isInUse()) {
+        return ::ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(Result::UNAVAILABLE));
+    } else {
+        mDemuxes[in_demuxId]->setTunerService(this->ref<Tuner>());
+        mDemuxes[in_demuxId]->setInUse(true);
+
+        *_aidl_return = mDemuxes[in_demuxId];
+        return ::ndk::ScopedAStatus::ok();
+    }
+}
+
 ::ndk::ScopedAStatus Tuner::openDemux(std::vector<int32_t>* out_demuxId,
                                       std::shared_ptr<IDemux>* _aidl_return) {
     ALOGV("%s", __FUNCTION__);
 
-    mLastUsedId += 1;
-    mDemuxes[mLastUsedId] = ndk::SharedRefBase::make<Demux>(mLastUsedId, this->ref<Tuner>());
+    bool found = false;
+    int32_t demuxId = 0;
+    for (auto e = mDemuxes.begin(); e != mDemuxes.end(); e++) {
+        if (!e->second->isInUse()) {
+            found = true;
+            demuxId = e->second->getDemuxId();
+        }
+    }
 
-    out_demuxId->push_back(mLastUsedId);
-    *_aidl_return = mDemuxes[mLastUsedId];
-
-    return ::ndk::ScopedAStatus::ok();
+    if (found) {
+        out_demuxId->push_back(demuxId);
+        return openDemuxById(demuxId, _aidl_return);
+    } else {
+        return ::ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(Result::UNAVAILABLE));
+    }
 }
 
 ::ndk::ScopedAStatus Tuner::getDemuxCaps(DemuxCapabilities* _aidl_return) {
@@ -115,6 +182,18 @@
     // Support time filter testing
     _aidl_return->bTimeFilter = true;
 
+    // set filterCaps as the bitwize OR of all the demux' caps
+    std::vector<int32_t> demuxIds;
+    getDemuxIds(&demuxIds);
+    int32_t filterCaps = 0;
+
+    for (int i = 0; i < demuxIds.size(); i++) {
+        DemuxInfo demuxInfo;
+        getDemuxInfo(demuxIds[i], &demuxInfo);
+        filterCaps |= demuxInfo.filterTypes;
+    }
+    _aidl_return->filterCaps = filterCaps;
+
     return ::ndk::ScopedAStatus::ok();
 }
 
@@ -250,13 +329,13 @@
             break;
         }
     }
-    mDemuxes.erase(demuxId);
+    mDemuxes[demuxId]->setInUse(false);
 }
 
 void Tuner::removeFrontend(int32_t frontendId) {
     map<int32_t, int32_t>::iterator it = mFrontendToDemux.find(frontendId);
     if (it != mFrontendToDemux.end()) {
-        mDemuxes.erase(it->second);
+        mDemuxes[it->second]->setInUse(false);
     }
     mFrontendToDemux.erase(frontendId);
 }
diff --git a/tv/tuner/aidl/default/Tuner.h b/tv/tuner/aidl/default/Tuner.h
index a77c930..2656933 100644
--- a/tv/tuner/aidl/default/Tuner.h
+++ b/tv/tuner/aidl/default/Tuner.h
@@ -46,7 +46,11 @@
                                           std::shared_ptr<IFrontend>* _aidl_return) override;
     ::ndk::ScopedAStatus openDemux(std::vector<int32_t>* out_demuxId,
                                    std::shared_ptr<IDemux>* _aidl_return) override;
+    ::ndk::ScopedAStatus openDemuxById(int32_t in_demuxId,
+                                       std::shared_ptr<IDemux>* _aidl_return) override;
     ::ndk::ScopedAStatus getDemuxCaps(DemuxCapabilities* _aidl_return) override;
+    ::ndk::ScopedAStatus getDemuxInfo(int32_t in_demuxId, DemuxInfo* _aidl_return) override;
+    ::ndk::ScopedAStatus getDemuxIds(std::vector<int32_t>* _aidl_return) override;
     ::ndk::ScopedAStatus openDescrambler(std::shared_ptr<IDescrambler>* _aidl_return) override;
     ::ndk::ScopedAStatus getFrontendInfo(int32_t in_frontendId,
                                          FrontendInfo* _aidl_return) override;
@@ -77,12 +81,10 @@
     // Static mFrontends array to maintain local frontends information
     map<int32_t, std::shared_ptr<Frontend>> mFrontends;
     map<int32_t, int32_t> mFrontendToDemux;
-    map<int32_t, std::shared_ptr<Demux>> mDemuxes;
+    map<int32_t, std::shared_ptr<Demux>> mDemuxes;  // use demuxId as the key in
+                                                    // this sample implementation
     // To maintain how many Frontends we have
     int mFrontendSize;
-    // The last used demux id. Initial value is -1.
-    // First used id will be 0.
-    int32_t mLastUsedId = -1;
     vector<std::shared_ptr<Lnb>> mLnbs;
     map<FrontendType, int32_t> mMaxUsableFrontends;
 };
diff --git a/tv/tuner/aidl/vts/functional/DemuxTests.cpp b/tv/tuner/aidl/vts/functional/DemuxTests.cpp
index 9de01e1..b2fca6f 100644
--- a/tv/tuner/aidl/vts/functional/DemuxTests.cpp
+++ b/tv/tuner/aidl/vts/functional/DemuxTests.cpp
@@ -16,6 +16,12 @@
 
 #include "DemuxTests.h"
 
+AssertionResult DemuxTests::getDemuxIds(std::vector<int32_t>& demuxIds) {
+    ndk::ScopedAStatus status;
+    status = mService->getDemuxIds(&demuxIds);
+    return AssertionResult(status.isOk());
+}
+
 AssertionResult DemuxTests::openDemux(std::shared_ptr<IDemux>& demux, int32_t& demuxId) {
     std::vector<int32_t> id;
     auto status = mService->openDemux(&id, &mDemux);
@@ -26,6 +32,14 @@
     return AssertionResult(status.isOk());
 }
 
+AssertionResult DemuxTests::openDemuxById(int32_t demuxId, std::shared_ptr<IDemux>& demux) {
+    auto status = mService->openDemuxById(demuxId, &mDemux);
+    if (status.isOk()) {
+        demux = mDemux;
+    }
+    return AssertionResult(status.isOk());
+}
+
 AssertionResult DemuxTests::setDemuxFrontendDataSource(int32_t frontendId) {
     EXPECT_TRUE(mDemux) << "Test with openDemux first.";
     auto status = mDemux->setFrontendDataSource(frontendId);
@@ -33,14 +47,15 @@
 }
 
 AssertionResult DemuxTests::getDemuxCaps(DemuxCapabilities& demuxCaps) {
-    if (!mDemux) {
-        ALOGW("[vts] Test with openDemux first.");
-        return failure();
-    }
     auto status = mService->getDemuxCaps(&demuxCaps);
     return AssertionResult(status.isOk());
 }
 
+AssertionResult DemuxTests::getDemuxInfo(int32_t demuxId, DemuxInfo& demuxInfo) {
+    auto status = mService->getDemuxInfo(demuxId, &demuxInfo);
+    return AssertionResult(status.isOk());
+}
+
 AssertionResult DemuxTests::getAvSyncId(std::shared_ptr<IFilter> filter, int32_t& avSyncHwId) {
     EXPECT_TRUE(mDemux) << "Demux is not opened yet.";
 
diff --git a/tv/tuner/aidl/vts/functional/DemuxTests.h b/tv/tuner/aidl/vts/functional/DemuxTests.h
index 7698de3..b58cf70 100644
--- a/tv/tuner/aidl/vts/functional/DemuxTests.h
+++ b/tv/tuner/aidl/vts/functional/DemuxTests.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <aidl/android/hardware/tv/tuner/DemuxCapabilities.h>
+#include <aidl/android/hardware/tv/tuner/DemuxInfo.h>
 #include <aidl/android/hardware/tv/tuner/IDemux.h>
 #include <aidl/android/hardware/tv/tuner/IFilter.h>
 #include <aidl/android/hardware/tv/tuner/ITuner.h>
@@ -32,11 +33,14 @@
   public:
     void setService(std::shared_ptr<ITuner> tuner) { mService = tuner; }
 
+    AssertionResult getDemuxIds(std::vector<int32_t>& demuxIds);
     AssertionResult openDemux(std::shared_ptr<IDemux>& demux, int32_t& demuxId);
+    AssertionResult openDemuxById(int32_t demuxId, std::shared_ptr<IDemux>& demux);
     AssertionResult setDemuxFrontendDataSource(int32_t frontendId);
     AssertionResult getAvSyncId(std::shared_ptr<IFilter> filter, int32_t& avSyncHwId);
     AssertionResult getAvSyncTime(int32_t avSyncId);
     AssertionResult getDemuxCaps(DemuxCapabilities& demuxCaps);
+    AssertionResult getDemuxInfo(int32_t demuxId, DemuxInfo& demuxInfo);
     AssertionResult closeDemux();
 
   protected:
diff --git a/tv/tuner/aidl/vts/functional/FrontendTests.cpp b/tv/tuner/aidl/vts/functional/FrontendTests.cpp
index 2ff0c3d..b0f614e 100644
--- a/tv/tuner/aidl/vts/functional/FrontendTests.cpp
+++ b/tv/tuner/aidl/vts/functional/FrontendTests.cpp
@@ -434,6 +434,31 @@
                         expectStatuses[i].get<FrontendStatus::Tag::allPlpInfo>().begin()));
                 break;
             }
+            case FrontendStatusType::IPTV_CONTENT_URL: {
+                ASSERT_TRUE(realStatuses[i].get<FrontendStatus::Tag::iptvContentUrl>() ==
+                            expectStatuses[i].get<FrontendStatus::Tag::iptvContentUrl>());
+                break;
+            }
+            case FrontendStatusType::IPTV_PACKETS_LOST: {
+                ASSERT_TRUE(realStatuses[i].get<FrontendStatus::Tag::iptvPacketsLost>() ==
+                            expectStatuses[i].get<FrontendStatus::Tag::iptvPacketsLost>());
+                break;
+            }
+            case FrontendStatusType::IPTV_PACKETS_RECEIVED: {
+                ASSERT_TRUE(realStatuses[i].get<FrontendStatus::Tag::iptvPacketsReceived>() ==
+                            expectStatuses[i].get<FrontendStatus::Tag::iptvPacketsReceived>());
+                break;
+            }
+            case FrontendStatusType::IPTV_WORST_JITTER_MS: {
+                ASSERT_TRUE(realStatuses[i].get<FrontendStatus::Tag::iptvWorstJitterMs>() ==
+                            expectStatuses[i].get<FrontendStatus::Tag::iptvWorstJitterMs>());
+                break;
+            }
+            case FrontendStatusType::IPTV_AVERAGE_JITTER_MS: {
+                ASSERT_TRUE(realStatuses[i].get<FrontendStatus::Tag::iptvAverageJitterMs>() ==
+                            expectStatuses[i].get<FrontendStatus::Tag::iptvAverageJitterMs>());
+                break;
+            }
             default: {
                 continue;
             }
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
index 6aa1e16..9db82c8 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.cpp
@@ -695,6 +695,34 @@
     }
 }
 
+TEST_P(TunerDemuxAidlTest, openDemuxById) {
+    description("Open (with id) and close a Demux.");
+    std::vector<int32_t> demuxIds;
+    ASSERT_TRUE(mDemuxTests.getDemuxIds(demuxIds));
+    for (int i = 0; i < demuxIds.size(); i++) {
+        std::shared_ptr<IDemux> demux;
+        ASSERT_TRUE(mDemuxTests.openDemuxById(demuxIds[i], demux));
+        ASSERT_TRUE(mDemuxTests.closeDemux());
+    }
+}
+
+TEST_P(TunerDemuxAidlTest, getDemuxInfo) {
+    description("Check getDemuxInfo against demux caps");
+    std::vector<int32_t> demuxIds;
+    ASSERT_TRUE(mDemuxTests.getDemuxIds(demuxIds));
+    int32_t combinedFilterTypes = 0;
+    for (int i = 0; i < demuxIds.size(); i++) {
+        DemuxInfo demuxInfo;
+        ASSERT_TRUE(mDemuxTests.getDemuxInfo(demuxIds[i], demuxInfo));
+        combinedFilterTypes |= demuxInfo.filterTypes;
+    }
+    if (demuxIds.size() > 0) {
+        DemuxCapabilities demuxCaps;
+        ASSERT_TRUE(mDemuxTests.getDemuxCaps(demuxCaps));
+        ASSERT_TRUE(demuxCaps.filterCaps == combinedFilterTypes);
+    }
+}
+
 TEST_P(TunerDemuxAidlTest, getAvSyncTime) {
     description("Get the A/V sync time from a PCR filter.");
     if (!live.hasFrontendConnection) {
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/AltModeData.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/AltModeData.aidl
index 8e9dd00..d25ee84 100644
--- a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/AltModeData.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/AltModeData.aidl
@@ -40,5 +40,7 @@
     android.hardware.usb.DisplayPortAltModeStatus partnerSinkStatus = android.hardware.usb.DisplayPortAltModeStatus.UNKNOWN;
     android.hardware.usb.DisplayPortAltModeStatus cableStatus = android.hardware.usb.DisplayPortAltModeStatus.UNKNOWN;
     android.hardware.usb.DisplayPortAltModePinAssignment pinAssignment = android.hardware.usb.DisplayPortAltModePinAssignment.NONE;
+    boolean hpd = false;
+    android.hardware.usb.LinkTrainingStatus linkTrainingStatus = android.hardware.usb.LinkTrainingStatus.UNKNOWN;
   }
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/LinkTrainingStatus.aidl
similarity index 87%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/LinkTrainingStatus.aidl
index 711ac19..1f0b2dc 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/LinkTrainingStatus.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
-@VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+package android.hardware.usb;
+@Backing(type="int") @VintfStability
+enum LinkTrainingStatus {
+  UNKNOWN = 0,
+  SUCCESS = 1,
+  FAILURE = 2,
 }
diff --git a/usb/aidl/android/hardware/usb/AltModeData.aidl b/usb/aidl/android/hardware/usb/AltModeData.aidl
index e103ff9..0b1e06a 100644
--- a/usb/aidl/android/hardware/usb/AltModeData.aidl
+++ b/usb/aidl/android/hardware/usb/AltModeData.aidl
@@ -18,6 +18,7 @@
 
 import android.hardware.usb.DisplayPortAltModePinAssignment;
 import android.hardware.usb.DisplayPortAltModeStatus;
+import android.hardware.usb.LinkTrainingStatus;
 
 @VintfStability
 union AltModeData {
@@ -42,6 +43,18 @@
          * negotiated between the device, port partner, and cable.
          */
         DisplayPortAltModePinAssignment pinAssignment = DisplayPortAltModePinAssignment.NONE;
+        /**
+         * Indicates DisplayPort Hot Plug Detection (HPD) status for a partner
+         * sink device. If true, then a DisplayPort Alt Mode partner sink is
+         * connected and powered on, and if false, the partner sink is not
+         * powered or no partner sink is connected.
+         */
+        boolean hpd = false;
+        /**
+         * Indicates the current status of DisplayPort link training over USB-C
+         * for the attached DisplayPort Alt Mode partner sink.
+         */
+        LinkTrainingStatus linkTrainingStatus = LinkTrainingStatus.UNKNOWN;
     }
     DisplayPortAltModeData displayPortAltModeData;
 }
diff --git a/usb/aidl/android/hardware/usb/LinkTrainingStatus.aidl b/usb/aidl/android/hardware/usb/LinkTrainingStatus.aidl
new file mode 100644
index 0000000..9f3b3c3
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/LinkTrainingStatus.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+@Backing(type="int")
+/**
+ * Indicates the current status of DisplayPort link training over USB-C for the
+ * attached DisplayPort Alt Mode partner sink as described in DisplayPort
+ * v1.4/2.1.
+ */
+enum LinkTrainingStatus {
+    /*
+     * Indicates the link training result is not available because link training
+     * has not completed or initiated yet.
+     */
+    UNKNOWN = 0,
+    /*
+     * Indicates that link training has completed and optimal settings for data
+     * transmission between the sink and source device have successfully been
+     * negotiated.
+     */
+    SUCCESS = 1,
+    /*
+     * Indicates that link training has failed and the link initialization has
+     * terminated.
+     */
+    FAILURE = 2,
+}
diff --git a/usb/aidl/vts/VtsAidlUsbTargetTest.cpp b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
index 480c826..e9aa65b 100644
--- a/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
+++ b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
@@ -49,6 +49,7 @@
 using ::aidl::android::hardware::usb::DisplayPortAltModeStatus;
 using ::aidl::android::hardware::usb::IUsb;
 using ::aidl::android::hardware::usb::IUsbCallback;
+using ::aidl::android::hardware::usb::LinkTrainingStatus;
 using ::aidl::android::hardware::usb::PlugOrientation;
 using ::aidl::android::hardware::usb::PortDataRole;
 using ::aidl::android::hardware::usb::PortMode;
@@ -724,6 +725,10 @@
                   (int)DisplayPortAltModePinAssignment::NONE);
       EXPECT_TRUE((int)displayPortAltModeData.pinAssignment <=
                   (int)DisplayPortAltModePinAssignment::F);
+
+      EXPECT_TRUE((int)displayPortAltModeData.linkTrainingStatus >=
+                  (int)LinkTrainingStatus::UNKNOWN);
+      EXPECT_TRUE((int)displayPortAltModeData.pinAssignment <= (int)LinkTrainingStatus::FAILURE);
     }
   }
 
diff --git a/usb/gadget/aidl/aidl_api/android.hardware.usb.gadget/current/android/hardware/usb/gadget/UsbSpeed.aidl b/usb/gadget/aidl/aidl_api/android.hardware.usb.gadget/current/android/hardware/usb/gadget/UsbSpeed.aidl
index 0f54ee5..7d4fa17 100644
--- a/usb/gadget/aidl/aidl_api/android.hardware.usb.gadget/current/android/hardware/usb/gadget/UsbSpeed.aidl
+++ b/usb/gadget/aidl/aidl_api/android.hardware.usb.gadget/current/android/hardware/usb/gadget/UsbSpeed.aidl
@@ -34,11 +34,15 @@
 package android.hardware.usb.gadget;
 @Backing(type="int") @VintfStability
 enum UsbSpeed {
-  UNKNOWN = 0,
-  LOWSPEED = 1,
-  FULLSPEED = 2,
-  HIGHSPEED = 3,
-  SUPERSPEED = 4,
-  SUPERSPEED_10Gb = 5,
-  SUPERSPEED_20Gb = 6,
+  UNKNOWN = (-1),
+  LOWSPEED = 0,
+  FULLSPEED = 1,
+  HIGHSPEED = 2,
+  SUPERSPEED = 3,
+  SUPERSPEED_10Gb = 4,
+  SUPERSPEED_20Gb = 5,
+  USB4_GEN2_10Gb = 6,
+  USB4_GEN2_20Gb = 7,
+  USB4_GEN3_20Gb = 8,
+  USB4_GEN3_40Gb = 9,
 }
diff --git a/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadget.aidl b/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadget.aidl
index 24a27c6..9c3f0d4 100644
--- a/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadget.aidl
+++ b/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadget.aidl
@@ -16,7 +16,6 @@
 
 package android.hardware.usb.gadget;
 
-import android.hardware.usb.gadget.GadgetFunction;
 import android.hardware.usb.gadget.IUsbGadgetCallback;
 
 @VintfStability
@@ -35,7 +34,7 @@
      *
      */
     void setCurrentUsbFunctions(in long functions, in IUsbGadgetCallback callback,
-        in long timeoutMs, long transactionId);
+            in long timeoutMs, long transactionId);
 
     /**
      * This function is used to query the USB functions included in the
diff --git a/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadgetCallback.aidl b/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadgetCallback.aidl
index 5a682d6..b4945a0 100644
--- a/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadgetCallback.aidl
+++ b/usb/gadget/aidl/android/hardware/usb/gadget/IUsbGadgetCallback.aidl
@@ -16,7 +16,6 @@
 
 package android.hardware.usb.gadget;
 
-import android.hardware.usb.gadget.GadgetFunction;
 import android.hardware.usb.gadget.Status;
 import android.hardware.usb.gadget.UsbSpeed;
 
diff --git a/usb/gadget/aidl/android/hardware/usb/gadget/UsbSpeed.aidl b/usb/gadget/aidl/android/hardware/usb/gadget/UsbSpeed.aidl
index 0492757..2a3fb93 100644
--- a/usb/gadget/aidl/android/hardware/usb/gadget/UsbSpeed.aidl
+++ b/usb/gadget/aidl/android/hardware/usb/gadget/UsbSpeed.aidl
@@ -22,29 +22,55 @@
     /**
      * UNKNOWN - Not Connected or Unsupported Speed
      */
-    UNKNOWN = 0,
+    UNKNOWN = -1,
+
     /**
      * USB Low Speed
      */
-    LOWSPEED = 1,
+    LOWSPEED = 0,
+
     /**
      * USB Full Speed
      */
-    FULLSPEED = 2,
+    FULLSPEED = 1,
+
     /**
      * USB High Speed
      */
-    HIGHSPEED = 3,
+    HIGHSPEED = 2,
+
     /**
      * USB Super Speed
      */
-    SUPERSPEED = 4,
+    SUPERSPEED = 3,
+
     /**
      * USB Super Speed 10Gbps
      */
-    SUPERSPEED_10Gb = 5,
+    SUPERSPEED_10Gb = 4,
+
     /**
      * USB Super Speed 20Gbps
      */
-    SUPERSPEED_20Gb = 6,
+    SUPERSPEED_20Gb = 5,
+
+    /**
+     * USB4 Gen2 x 1 (10Gbps)
+     */
+    USB4_GEN2_10Gb = 6,
+
+    /**
+     * USB4 Gen2 x 2 (20Gbps)
+     */
+    USB4_GEN2_20Gb = 7,
+
+    /**
+     * USB4 Gen3 x 1 (20Gbps)
+     */
+    USB4_GEN3_20Gb = 8,
+
+    /**
+     * USB4 Gen3 x 2 (40Gbps)
+     */
+    USB4_GEN3_40Gb = 9,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl
similarity index 88%
copy from radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
copy to wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl
index 711ac19..cbea5af 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AnbrBitrate.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.ims.media;
+package android.hardware.wifi;
 @VintfStability
-parcelable AnbrBitrate {
-  int uplinkBps;
-  int downlinkBps;
-  const int INVALID_ANBR_BITRATE = -1;
+parcelable AvailableAfcFrequencyInfo {
+  int startFrequencyMhz;
+  int endFrequencyMhz;
+  int maxPsd;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
index 2ebe145..fd59888 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
@@ -61,6 +61,7 @@
   android.hardware.wifi.WifiRadioCombinationMatrix getSupportedRadioCombinationsMatrix();
   android.hardware.wifi.WifiChipCapabilities getWifiChipCapabilities();
   android.hardware.wifi.WifiUsableChannel[] getUsableChannels(in android.hardware.wifi.WifiBand band, in android.hardware.wifi.WifiIfaceMode ifaceModeMask, in android.hardware.wifi.IWifiChip.UsableChannelFilter filterMask);
+  void setAfcChannelAllowance(in android.hardware.wifi.AvailableAfcFrequencyInfo[] availableAfcFrequencyInfo);
   void registerEventCallback(in android.hardware.wifi.IWifiChipEventCallback callback);
   void removeApIface(in String ifname);
   void removeIfaceInstanceFromBridgedApIface(in String brIfaceName, in String ifaceInstanceName);
@@ -99,6 +100,7 @@
     SET_LATENCY_MODE = (1 << 12),
     P2P_RAND_MAC = (1 << 13),
     WIGIG = (1 << 14),
+    SET_AFC_CHANNEL_ALLOWANCE = (1 << 15),
   }
   @VintfStability
   parcelable ChipConcurrencyCombinationLimit {
diff --git a/wifi/aidl/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl b/wifi/aidl/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl
new file mode 100644
index 0000000..5de360c
--- /dev/null
+++ b/wifi/aidl/android/hardware/wifi/AvailableAfcFrequencyInfo.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi;
+
+/**
+ * Defines the maximum permissible power spectral density on a range of
+ * frequencies to support 6Ghz with standard power for AFC.
+ * The format of the data follows spec from the Wi-Fi Alliance AFC System to
+ * AFC Device Interface Specification: AvailableFrequencyInfo object.
+ */
+@VintfStability
+parcelable AvailableAfcFrequencyInfo {
+    /**
+     * Defines the lowest frequency included in this 6Ghz frequency range.
+     */
+    int startFrequencyMhz;
+    /**
+     * Defines the highest frequency included in this 6Ghz frequency range.
+     */
+    int endFrequencyMhz;
+    /**
+     * The maximum permissible EIRP available in any one MHz bin within the
+     * frequency range specified. The limit is expressed as a power spectral
+     * density with units of dBm per MHz.
+     */
+    int maxPsd;
+}
diff --git a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
index 5ffea56..41ff7e6 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.wifi;
 
+import android.hardware.wifi.AvailableAfcFrequencyInfo;
 import android.hardware.wifi.IWifiApIface;
 import android.hardware.wifi.IWifiChipEventCallback;
 import android.hardware.wifi.IWifiNanIface;
@@ -105,6 +106,11 @@
          * Chip can operate in the 60GHz band (WiGig chip).
          */
         WIGIG = 1 << 14,
+        /**
+         * Chip supports setting allowed channels along with PSD in 6GHz band
+         * for AFC purposes.
+         */
+        SET_AFC_CHANNEL_ALLOWANCE = 1 << 15,
     }
 
     /**
@@ -835,6 +841,18 @@
     WifiUsableChannel[] getUsableChannels(
             in WifiBand band, in WifiIfaceMode ifaceModeMask, in UsableChannelFilter filterMask);
 
+    /*
+     * Set the max power level the chip is allowed to transmit on for 6Ghz AFC
+     * using an array of AvailableAfcFrequencyInfo. The max power for
+     * frequencies not included in the input frequency ranges will be reset to
+     * their respective default values.
+     * @param availableAfcFrequencyInfo The list of frequency ranges and
+     * corresponding max allowed power.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|
+     */
+    void setAfcChannelAllowance(in AvailableAfcFrequencyInfo[] availableAfcFrequencyInfo);
+
     /**
      * Requests notifications of significant events on this chip. Multiple calls
      * to this must register multiple callbacks, each of which must receive all
diff --git a/wifi/aidl/default/wifi_chip.cpp b/wifi/aidl/default/wifi_chip.cpp
index 5597001..6f43e06 100644
--- a/wifi/aidl/default/wifi_chip.cpp
+++ b/wifi/aidl/default/wifi_chip.cpp
@@ -670,6 +670,12 @@
                            in_ifaceModeMask, in_filterMask);
 }
 
+ndk::ScopedAStatus WifiChip::setAfcChannelAllowance(
+        const std::vector<AvailableAfcFrequencyInfo>& availableAfcFrequencyInfo) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::setAfcChannelAllowanceInternal, availableAfcFrequencyInfo);
+}
+
 ndk::ScopedAStatus WifiChip::triggerSubsystemRestart() {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
                            &WifiChip::triggerSubsystemRestartInternal);
@@ -1394,6 +1400,12 @@
     return {aidl_usable_channels, ndk::ScopedAStatus::ok()};
 }
 
+ndk::ScopedAStatus WifiChip::setAfcChannelAllowanceInternal(
+        const std::vector<AvailableAfcFrequencyInfo>& availableAfcFrequencyInfo) {
+    LOG(INFO) << "setAfcChannelAllowance is not yet supported " << availableAfcFrequencyInfo.size();
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
 std::pair<WifiRadioCombinationMatrix, ndk::ScopedAStatus>
 WifiChip::getSupportedRadioCombinationsMatrixInternal() {
     legacy_hal::wifi_error legacy_status;
diff --git a/wifi/aidl/default/wifi_chip.h b/wifi/aidl/default/wifi_chip.h
index c69c7fe..b552c33 100644
--- a/wifi/aidl/default/wifi_chip.h
+++ b/wifi/aidl/default/wifi_chip.h
@@ -141,6 +141,8 @@
     ndk::ScopedAStatus getUsableChannels(WifiBand in_band, WifiIfaceMode in_ifaceModeMask,
                                          UsableChannelFilter in_filterMask,
                                          std::vector<WifiUsableChannel>* _aidl_return) override;
+    ndk::ScopedAStatus setAfcChannelAllowance(
+            const std::vector<AvailableAfcFrequencyInfo>& availableAfcFrequencyInfo) override;
     ndk::ScopedAStatus triggerSubsystemRestart() override;
     ndk::ScopedAStatus getSupportedRadioCombinationsMatrix(
             WifiRadioCombinationMatrix* _aidl_return) override;
@@ -218,6 +220,8 @@
             WifiBand band, WifiIfaceMode ifaceModeMask, UsableChannelFilter filterMask);
     ndk::ScopedAStatus enableStaChannelForPeerNetworkInternal(
             ChannelCategoryMask channelCategoryEnableFlag);
+    ndk::ScopedAStatus setAfcChannelAllowanceInternal(
+            const std::vector<AvailableAfcFrequencyInfo>& availableAfcFrequencyInfo);
     ndk::ScopedAStatus handleChipConfiguration(std::unique_lock<std::recursive_mutex>* lock,
                                                int32_t mode_id);
     ndk::ScopedAStatus registerDebugRingBufferCallback();
diff --git a/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp b/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
index 0806ed2..fec9122 100644
--- a/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
+++ b/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
@@ -583,6 +583,9 @@
  * CreateNanIface
  */
 TEST_P(WifiChipAidlTest, CreateNanIface) {
+    if (!::testing::deviceSupportsFeature("android.hardware.wifi.aware")) {
+        GTEST_SKIP() << "Skipping this test since NAN is not supported.";
+    }
     configureChipForNanAndGetIface();
 }
 
@@ -590,7 +593,7 @@
  * CreateP2pIface
  */
 TEST_P(WifiChipAidlTest, CreateP2pIface) {
-    configureChipForNanAndGetIface();
+    configureChipForP2pAndGetIface();
 }
 
 /*
@@ -672,6 +675,9 @@
  * GetNanIfaceNames
  */
 TEST_P(WifiChipAidlTest, GetNanIfaceNames) {
+    if (!::testing::deviceSupportsFeature("android.hardware.wifi.aware")) {
+        GTEST_SKIP() << "Skipping this test since NAN is not supported.";
+    }
     configureChipForConcurrencyType(IfaceConcurrencyType::NAN_IFACE);
 
     std::vector<std::string> iface_names;
@@ -753,6 +759,9 @@
  * GetNanIface
  */
 TEST_P(WifiChipAidlTest, GetNanIface) {
+    if (!::testing::deviceSupportsFeature("android.hardware.wifi.aware")) {
+        GTEST_SKIP() << "Skipping this test since NAN is not supported.";
+    }
     std::shared_ptr<IWifiNanIface> iface = configureChipForNanAndGetIface();
     std::string iface_name = getNanIfaceName(iface);
 
@@ -822,6 +831,9 @@
  * RemoveNanIface
  */
 TEST_P(WifiChipAidlTest, RemoveNanIface) {
+    if (!::testing::deviceSupportsFeature("android.hardware.wifi.aware")) {
+        GTEST_SKIP() << "Skipping this test since NAN is not supported.";
+    }
     std::shared_ptr<IWifiNanIface> iface = configureChipForNanAndGetIface();
     std::string iface_name = getNanIfaceName(iface);