diff --git a/automotive/vehicle/2.0/Android.bp b/automotive/vehicle/2.0/Android.bp
index 902a4e8..4b93008 100644
--- a/automotive/vehicle/2.0/Android.bp
+++ b/automotive/vehicle/2.0/Android.bp
@@ -26,14 +26,15 @@
         "Obd2IgnitionMonitorKind",
         "Obd2SecondaryAirStatus",
         "Obd2SparkIgnitionMonitors",
+        "PortLocationType",
         "StatusCode",
         "SubscribeFlags",
         "SubscribeOptions",
         "VehicleApPowerBootupReason",
-        "VehicleApPowerSetState",
-        "VehicleApPowerState",
         "VehicleApPowerStateConfigFlag",
-        "VehicleApPowerStateIndex",
+        "VehicleApPowerStateReq",
+        "VehicleApPowerStateReqIndex",
+        "VehicleApPowerStateReport",
         "VehicleApPowerStateShutdownParam",
         "VehicleArea",
         "VehicleAreaConfig",
@@ -41,13 +42,13 @@
         "VehicleAreaMirror",
         "VehicleAreaSeat",
         "VehicleAreaWindow",
-        "VehicleAreaZone",
         "VehicleDisplay",
-        "VehicleDrivingStatus",
         "VehicleGear",
         "VehicleHvacFanDirection",
         "VehicleHwKeyInputAction",
         "VehicleIgnitionState",
+        "VehicleLightState",
+        "VehicleLightSwitch",
         "VehicleOilLevel",
         "VehiclePropConfig",
         "VehiclePropValue",
@@ -55,10 +56,8 @@
         "VehiclePropertyAccess",
         "VehiclePropertyChangeMode",
         "VehiclePropertyGroup",
-        "VehiclePropertyOperation",
         "VehiclePropertyStatus",
         "VehiclePropertyType",
-        "VehicleRadioConstants",
         "VehicleTurnSignal",
         "VehicleUnit",
         "VmsAvailabilityStateIntegerValuesIndex",
diff --git a/automotive/vehicle/2.0/IVehicleCallback.hal b/automotive/vehicle/2.0/IVehicleCallback.hal
index 7060418..c4a756a 100644
--- a/automotive/vehicle/2.0/IVehicleCallback.hal
+++ b/automotive/vehicle/2.0/IVehicleCallback.hal
@@ -33,7 +33,7 @@
 
     /**
      * This method gets called if the client was subscribed to a property using
-     * SubscribeFlags::SET_CALL flag and IVehicle#set(...) method was called.
+     * SubscribeFlags::EVENTS_FROM_ANDROID flag and IVehicle#set(...) method was called.
      *
      * These events must be delivered to subscriber immediately without any
      * batching.
diff --git a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehicleObjectPool.h b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehicleObjectPool.h
index 359bb6d..946e74d 100644
--- a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehicleObjectPool.h
+++ b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehicleObjectPool.h
@@ -152,7 +152,7 @@
  *   VehiclePropValuePool pool;
  *   auto v = pool.obtain(VehiclePropertyType::INT32);
  *   v->propId = VehicleProperty::HVAC_FAN_SPEED;
- *   v->areaId = VehicleAreaZone::ROW_1_LEFT;
+ *   v->areaId = VehicleAreaSeat::ROW_1_LEFT;
  *   v->timestamp = elapsedRealtimeNano();
  *   v->value->int32Values[0] = 42;
  *
diff --git a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehiclePropertyStore.h b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehiclePropertyStore.h
index eda94b7..0a243fe 100644
--- a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehiclePropertyStore.h
+++ b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VehiclePropertyStore.h
@@ -67,7 +67,7 @@
 
     /* Stores provided value. Returns true if value was written returns false if config for
      * example wasn't registered. */
-    bool writeValue(const VehiclePropValue& propValue);
+    bool writeValue(const VehiclePropValue& propValue, bool updateStatus);
 
     void removeValue(const VehiclePropValue& propValue);
     void removeValuesForProperty(int32_t propId);
diff --git a/automotive/vehicle/2.0/default/common/src/SubscriptionManager.cpp b/automotive/vehicle/2.0/default/common/src/SubscriptionManager.cpp
index a7d5f50..97aeca6 100644
--- a/automotive/vehicle/2.0/default/common/src/SubscriptionManager.cpp
+++ b/automotive/vehicle/2.0/default/common/src/SubscriptionManager.cpp
@@ -106,7 +106,7 @@
 
         addClientToPropMapLocked(opts.propId, client);
 
-        if (SubscribeFlags::HAL_EVENT & opts.flags) {
+        if (SubscribeFlags::EVENTS_FROM_CAR & opts.flags) {
             SubscribeOptions updated;
             if (updateHalEventSubscriptionLocked(opts, &updated)) {
                 outUpdatedSubscriptions->push_back(updated);
diff --git a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
index 1918421..b5de262 100644
--- a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
@@ -216,7 +216,7 @@
                                               int32_t property,
                                               int32_t areaId) {
     const auto& clients =
-        mSubscriptionManager.getSubscribedClients(property, SubscribeFlags::HAL_EVENT);
+        mSubscriptionManager.getSubscribedClients(property, SubscribeFlags::EVENTS_FROM_CAR);
 
     for (auto client : clients) {
         client->getCallback()->onPropertySetError(errorCode, property, areaId);
@@ -224,8 +224,8 @@
 }
 
 void VehicleHalManager::onBatchHalEvent(const std::vector<VehiclePropValuePtr>& values) {
-    const auto& clientValues = mSubscriptionManager.distributeValuesToClients(
-            values, SubscribeFlags::HAL_EVENT);
+    const auto& clientValues =
+        mSubscriptionManager.distributeValuesToClients(values, SubscribeFlags::EVENTS_FROM_CAR);
 
     for (const HalClientValues& cv : clientValues) {
         auto vecSize = cv.values.size();
@@ -250,8 +250,7 @@
 }
 
 bool VehicleHalManager::isSampleRateFixed(VehiclePropertyChangeMode mode) {
-    return (mode & VehiclePropertyChangeMode::ON_SET)
-           || (mode & VehiclePropertyChangeMode::ON_CHANGE);
+    return (mode & VehiclePropertyChangeMode::ON_CHANGE);
 }
 
 float VehicleHalManager::checkSampleRate(const VehiclePropConfig &config,
@@ -281,7 +280,7 @@
                                        SubscribeFlags flags) {
     bool isReadable = config.access & VehiclePropertyAccess::READ;
 
-    if (!isReadable && (SubscribeFlags::HAL_EVENT & flags)) {
+    if (!isReadable && (SubscribeFlags::EVENTS_FROM_CAR & flags)) {
         ALOGW("Cannot subscribe, property 0x%x is not readable", config.prop);
         return false;
     }
@@ -289,12 +288,6 @@
         ALOGW("Cannot subscribe, property 0x%x is static", config.prop);
         return false;
     }
-
-    //TODO: extend to support event notification for set from android
-    if (config.changeMode == VehiclePropertyChangeMode::POLL) {
-        ALOGW("Cannot subscribe, property 0x%x is poll only", config.prop);
-        return false;
-    }
     return true;
 }
 
@@ -317,7 +310,8 @@
 }
 
 void VehicleHalManager::handlePropertySetEvent(const VehiclePropValue& value) {
-    auto clients = mSubscriptionManager.getSubscribedClients(value.prop, SubscribeFlags::SET_CALL);
+    auto clients =
+        mSubscriptionManager.getSubscribedClients(value.prop, SubscribeFlags::EVENTS_FROM_ANDROID);
     for (auto client : clients) {
         client->getCallback()->onPropertySet(value);
     }
diff --git a/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp b/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
index f2aa421..94ace45 100644
--- a/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehiclePropertyStore.cpp
@@ -41,7 +41,8 @@
     mConfigs.insert({ config.prop, RecordConfig { config, tokenFunc } });
 }
 
-bool VehiclePropertyStore::writeValue(const VehiclePropValue& propValue) {
+bool VehiclePropertyStore::writeValue(const VehiclePropValue& propValue,
+                                        bool updateStatus) {
     MuxGuard g(mLock);
     if (!mConfigs.count(propValue.prop)) return false;
 
@@ -52,7 +53,9 @@
     } else {
         valueToUpdate->timestamp = propValue.timestamp;
         valueToUpdate->value = propValue.value;
-        valueToUpdate->status = propValue.status;
+        if (updateStatus) {
+            valueToUpdate->status = propValue.status;
+        }
     }
     return true;
 }
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
index e05b333..56813ce 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
@@ -30,7 +30,8 @@
 //
 // Some handy constants to avoid conversions from enum to int.
 constexpr int ABS_ACTIVE = (int)VehicleProperty::ABS_ACTIVE;
-constexpr int AP_POWER_STATE = (int)VehicleProperty::AP_POWER_STATE;
+constexpr int AP_POWER_STATE_REQ = (int)VehicleProperty::AP_POWER_STATE_REQ;
+constexpr int AP_POWER_STATE_REPORT = (int)VehicleProperty::AP_POWER_STATE_REPORT;
 constexpr int OBD2_LIVE_FRAME = (int)VehicleProperty::OBD2_LIVE_FRAME;
 constexpr int OBD2_FREEZE_FRAME = (int)VehicleProperty::OBD2_FREEZE_FRAME;
 constexpr int OBD2_FREEZE_FRAME_INFO = (int)VehicleProperty::OBD2_FREEZE_FRAME_INFO;
@@ -149,14 +150,6 @@
          },
      .initialValue = {.floatValues = {0.0f}}},
 
-    {.config =
-         {
-             .prop = toInt(VehicleProperty::ENGINE_ON),
-             .access = VehiclePropertyAccess::READ,
-             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-         },
-     .initialValue = {.int32Values = {0}}},
-
     {
         .config =
             {
@@ -255,7 +248,7 @@
              .access = VehiclePropertyAccess::READ_WRITE,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
              .areaConfigs = {VehicleAreaConfig{
-                 .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT)}},
+                 .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT)}},
              // TODO(bryaneyler): Ideally, this is generated dynamically from
              // kHvacPowerProperties.
              .configString = "0x12400500,0x12400501"  // HVAC_FAN_SPEED,HVAC_FAN_DIRECTION
@@ -276,28 +269,28 @@
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                    .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT)}}},
+                    .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT)}}},
      .initialValue = {.int32Values = {1}}},
 
     {.config = {.prop = toInt(VehicleProperty::HVAC_AC_ON),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                    .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT)}}},
+                    .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT)}}},
      .initialValue = {.int32Values = {1}}},
 
     {.config = {.prop = toInt(VehicleProperty::HVAC_AUTO_ON),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                    .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT)}}},
+                    .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT)}}},
      .initialValue = {.int32Values = {1}}},
 
     {.config = {.prop = toInt(VehicleProperty::HVAC_FAN_SPEED),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                    .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT),
+                    .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT),
                     .minInt32Value = 1,
                     .maxInt32Value = 7}}},
      .initialValue = {.int32Values = {3}}},
@@ -306,24 +299,24 @@
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                    .areaId = (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT)}}},
+                    .areaId = (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT)}}},
      .initialValue = {.int32Values = {toInt(VehicleHvacFanDirection::FACE)}}},
 
     {.config = {.prop = toInt(VehicleProperty::HVAC_TEMPERATURE_SET),
                 .access = VehiclePropertyAccess::READ_WRITE,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .areaConfigs = {VehicleAreaConfig{
-                                    .areaId = toInt(VehicleAreaZone::ROW_1_LEFT),
+                                    .areaId = toInt(VehicleAreaSeat::ROW_1_LEFT),
                                     .minFloatValue = 16,
                                     .maxFloatValue = 32,
                                 },
                                 VehicleAreaConfig{
-                                    .areaId = toInt(VehicleAreaZone::ROW_1_RIGHT),
+                                    .areaId = toInt(VehicleAreaSeat::ROW_1_RIGHT),
                                     .minFloatValue = 16,
                                     .maxFloatValue = 32,
                                 }}},
-     .initialAreaValues = {{toInt(VehicleAreaZone::ROW_1_LEFT), {.floatValues = {16}}},
-                           {toInt(VehicleAreaZone::ROW_1_RIGHT), {.floatValues = {20}}}}},
+     .initialAreaValues = {{toInt(VehicleAreaSeat::ROW_1_LEFT), {.floatValues = {16}}},
+                           {toInt(VehicleAreaSeat::ROW_1_RIGHT), {.floatValues = {20}}}}},
 
     {.config =
          {
@@ -346,14 +339,6 @@
 
     {.config =
          {
-             .prop = toInt(VehicleProperty::DRIVING_STATUS),
-             .access = VehiclePropertyAccess::READ,
-             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-         },
-     .initialValue = {.int32Values = {toInt(VehicleDrivingStatus::UNRESTRICTED)}}},
-
-    {.config =
-         {
              .prop = toInt(VehicleProperty::GEAR_SELECTION),
              .access = VehiclePropertyAccess::READ,
              .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
@@ -432,11 +417,17 @@
             },
     },
 
-    {.config = {.prop = toInt(VehicleProperty::AP_POWER_STATE),
-                .access = VehiclePropertyAccess::READ_WRITE,
+    {.config = {.prop = toInt(VehicleProperty::AP_POWER_STATE_REQ),
+                .access = VehiclePropertyAccess::READ,
                 .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
                 .configArray = {3}},
-     .initialValue = {.int32Values = {toInt(VehicleApPowerState::ON_FULL), 0}}},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReq::ON_FULL), 0}}},
+
+    {.config = {.prop = toInt(VehicleProperty::AP_POWER_STATE_REPORT),
+                .access = VehiclePropertyAccess::WRITE,
+                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                .configArray = {3}},
+     .initialValue = {.int32Values = {toInt(VehicleApPowerStateReport::BOOT_COMPLETE), 0}}},
 
     {.config = {.prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
                 .access = VehiclePropertyAccess::READ_WRITE,
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
index d51576e..2eb905d 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
@@ -127,6 +127,8 @@
 }
 
 StatusCode EmulatedVehicleHal::set(const VehiclePropValue& propValue) {
+    static constexpr bool shouldUpdateStatus = false;
+
     if (propValue.prop == kGenerateFakeDataControllingProperty) {
         StatusCode status = handleGenerateFakeDataRequest(propValue);
         if (status != StatusCode::OK) {
@@ -136,7 +138,7 @@
         // TODO(75328113): this should be handled by property status
         auto hvacPowerOn = mPropStore->readValueOrNull(
             toInt(VehicleProperty::HVAC_POWER_ON),
-            (VehicleAreaZone::ROW_1_LEFT | VehicleAreaZone::ROW_1_RIGHT));
+            (VehicleAreaSeat::ROW_1_LEFT | VehicleAreaSeat::ROW_1_RIGHT));
 
         if (hvacPowerOn && hvacPowerOn->value.int32Values.size() == 1
                 && hvacPowerOn->value.int32Values[0] == 0) {
@@ -151,7 +153,7 @@
                 // Placeholder for future implementation of VMS property in the default hal. For
                 // now, just returns OK; otherwise, hal clients crash with property not supported.
                 return StatusCode::OK;
-            case AP_POWER_STATE:
+            case AP_POWER_STATE_REPORT:
                 // This property has different behavior between get/set.  When it is set, the value
                 //  goes to the vehicle but is NOT updated in the property store back to Android.
                 // Commented out for now, because it may mess up automated testing that use the
@@ -177,7 +179,7 @@
         return StatusCode::NOT_AVAILABLE;
     }
 
-    if (!mPropStore->writeValue(propValue)) {
+    if (!mPropStore->writeValue(propValue, shouldUpdateStatus)) {
         return StatusCode::INVALID_ARG;
     }
 
@@ -199,6 +201,8 @@
 
 // Parse supported properties list and generate vector of property values to hold current values.
 void EmulatedVehicleHal::onCreate() {
+    static constexpr bool shouldUpdateStatus = true;
+
     for (auto& it : kVehicleProperties) {
         VehiclePropConfig cfg = it.config;
         int32_t numAreas = cfg.areaConfigs.size();
@@ -240,7 +244,7 @@
             } else {
                 prop.value = it.initialValue;
             }
-            mPropStore->writeValue(prop);
+            mPropStore->writeValue(prop, shouldUpdateStatus);
         }
     }
     initObd2LiveFrame(*mPropStore->getConfigOrDie(OBD2_LIVE_FRAME));
@@ -300,6 +304,8 @@
 }
 
 bool EmulatedVehicleHal::setPropertyFromVehicle(const VehiclePropValue& propValue) {
+    static constexpr bool shouldUpdateStatus = true;
+
     if (propValue.prop == kGenerateFakeDataControllingProperty) {
         StatusCode status = handleGenerateFakeDataRequest(propValue);
         if (status != StatusCode::OK) {
@@ -307,7 +313,7 @@
         }
     }
 
-    if (mPropStore->writeValue(propValue)) {
+    if (mPropStore->writeValue(propValue, shouldUpdateStatus)) {
         doHalEvent(getValuePool()->obtain(propValue));
         return true;
     } else {
@@ -391,6 +397,8 @@
 }
 
 void EmulatedVehicleHal::onFakeValueGenerated(int32_t propId, float value) {
+    static constexpr bool shouldUpdateStatus = false;
+
     VehiclePropValuePtr updatedPropValue {};
     switch (getPropType(propId)) {
         case VehiclePropertyType::FLOAT:
@@ -410,7 +418,7 @@
         updatedPropValue->areaId = 0;  // Add area support if necessary.
         updatedPropValue->timestamp = elapsedRealtimeNano();
         updatedPropValue->status = VehiclePropertyStatus::AVAILABLE;
-        mPropStore->writeValue(*updatedPropValue);
+        mPropStore->writeValue(*updatedPropValue, shouldUpdateStatus);
         auto changeMode = mPropStore->getConfigOrDie(propId)->changeMode;
         if (VehiclePropertyChangeMode::ON_CHANGE == changeMode) {
             doHalEvent(move(updatedPropValue));
@@ -439,16 +447,20 @@
 }
 
 void EmulatedVehicleHal::initObd2LiveFrame(const VehiclePropConfig& propConfig) {
+    static constexpr bool shouldUpdateStatus = true;
+
     auto liveObd2Frame = createVehiclePropValue(VehiclePropertyType::MIXED, 0);
     auto sensorStore = fillDefaultObd2Frame(static_cast<size_t>(propConfig.configArray[0]),
                                             static_cast<size_t>(propConfig.configArray[1]));
     sensorStore->fillPropValue("", liveObd2Frame.get());
     liveObd2Frame->prop = OBD2_LIVE_FRAME;
 
-    mPropStore->writeValue(*liveObd2Frame);
+    mPropStore->writeValue(*liveObd2Frame, shouldUpdateStatus);
 }
 
 void EmulatedVehicleHal::initObd2FreezeFrame(const VehiclePropConfig& propConfig) {
+    static constexpr bool shouldUpdateStatus = true;
+
     auto sensorStore = fillDefaultObd2Frame(static_cast<size_t>(propConfig.configArray[0]),
                                             static_cast<size_t>(propConfig.configArray[1]));
 
@@ -460,7 +472,7 @@
         sensorStore->fillPropValue(dtc, freezeFrame.get());
         freezeFrame->prop = OBD2_FREEZE_FRAME;
 
-        mPropStore->writeValue(*freezeFrame);
+        mPropStore->writeValue(*freezeFrame, shouldUpdateStatus);
     }
 }
 
diff --git a/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp b/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
index 4865e9e..ab2013d 100644
--- a/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
@@ -51,19 +51,16 @@
     }
 
     hidl_vec<SubscribeOptions> subscrToProp1 = {
-        SubscribeOptions{.propId = PROP1, .flags = SubscribeFlags::HAL_EVENT},
+        SubscribeOptions{.propId = PROP1, .flags = SubscribeFlags::EVENTS_FROM_CAR},
     };
 
     hidl_vec<SubscribeOptions> subscrToProp2 = {
-        SubscribeOptions {
-            .propId = PROP2,
-            .flags = SubscribeFlags::HAL_EVENT
-        },
+        SubscribeOptions{.propId = PROP2, .flags = SubscribeFlags::EVENTS_FROM_CAR},
     };
 
     hidl_vec<SubscribeOptions> subscrToProp1and2 = {
-        SubscribeOptions{.propId = PROP1, .flags = SubscribeFlags::HAL_EVENT},
-        SubscribeOptions{.propId = PROP2, .flags = SubscribeFlags::HAL_EVENT},
+        SubscribeOptions{.propId = PROP1, .flags = SubscribeFlags::EVENTS_FROM_CAR},
+        SubscribeOptions{.propId = PROP2, .flags = SubscribeFlags::EVENTS_FROM_CAR},
     };
 
     static std::list<sp<IVehicleCallback>> extractCallbacks(
@@ -76,11 +73,11 @@
     }
 
     std::list<sp<HalClient>> clientsToProp1() {
-        return manager.getSubscribedClients(PROP1, SubscribeFlags::DEFAULT);
+        return manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_CAR);
     }
 
     std::list<sp<HalClient>> clientsToProp2() {
-        return manager.getSubscribedClients(PROP2, SubscribeFlags::DEFAULT);
+        return manager.getSubscribedClients(PROP2, SubscribeFlags::EVENTS_FROM_CAR);
     }
 
     void onPropertyUnsubscribed(int propertyId) {
@@ -110,9 +107,7 @@
     ASSERT_EQ(StatusCode::OK,
               manager.addOrUpdateSubscription(2, cb2, subscrToProp1, &updatedOptions));
 
-    auto clients = manager.getSubscribedClients(
-            PROP1,
-            SubscribeFlags::HAL_EVENT);
+    auto clients = manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_CAR);
 
     ASSERT_ALL_EXISTS({cb1, cb2}, extractCallbacks(clients));
 }
@@ -124,13 +119,11 @@
 
     // Wrong prop
     auto clients = manager.getSubscribedClients(toInt(VehicleProperty::AP_POWER_BOOTUP_REASON),
-                                                SubscribeFlags::HAL_EVENT);
+                                                SubscribeFlags::EVENTS_FROM_CAR);
     ASSERT_TRUE(clients.empty());
 
     // Wrong flag
-    clients = manager.getSubscribedClients(
-            PROP1,
-            SubscribeFlags::SET_CALL);
+    clients = manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_ANDROID);
     ASSERT_TRUE(clients.empty());
 }
 
@@ -139,27 +132,22 @@
     ASSERT_EQ(StatusCode::OK, manager.addOrUpdateSubscription(1, cb1, subscrToProp1,
                                                               &updatedOptions));
 
-    auto clients = manager.getSubscribedClients(
-            PROP1,
-            SubscribeFlags::DEFAULT);
+    auto clients = manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_CAR);
     ASSERT_EQ((size_t) 1, clients.size());
     ASSERT_EQ(cb1, clients.front()->getCallback());
 
     // Same property, but different zone, to make sure we didn't unsubscribe
     // from previous zone.
-    ASSERT_EQ(StatusCode::OK, manager.addOrUpdateSubscription(1, cb1, {
-        SubscribeOptions {
-                .propId = PROP1,
-                .flags = SubscribeFlags::DEFAULT
-            }
-        }, &updatedOptions));
+    ASSERT_EQ(
+        StatusCode::OK,
+        manager.addOrUpdateSubscription(
+            1, cb1, {SubscribeOptions{.propId = PROP1, .flags = SubscribeFlags::EVENTS_FROM_CAR}},
+            &updatedOptions));
 
-    clients = manager.getSubscribedClients(PROP1,
-                                           SubscribeFlags::DEFAULT);
+    clients = manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_CAR);
     ASSERT_ALL_EXISTS({cb1}, extractCallbacks(clients));
 
-    clients = manager.getSubscribedClients(PROP1,
-                                           SubscribeFlags::DEFAULT);
+    clients = manager.getSubscribedClients(PROP1, SubscribeFlags::EVENTS_FROM_CAR);
     ASSERT_ALL_EXISTS({cb1}, extractCallbacks(clients));
 }
 
diff --git a/automotive/vehicle/2.0/default/tests/VehicleHalManager_test.cpp b/automotive/vehicle/2.0/default/tests/VehicleHalManager_test.cpp
index 5b195db..f64eab5 100644
--- a/automotive/vehicle/2.0/default/tests/VehicleHalManager_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/VehicleHalManager_test.cpp
@@ -241,10 +241,7 @@
     sp<MockedVehicleCallback> cb = new MockedVehicleCallback();
 
     hidl_vec<SubscribeOptions> options = {
-        SubscribeOptions {
-            .propId = PROP,
-            .flags = SubscribeFlags::DEFAULT
-        },
+        SubscribeOptions{.propId = PROP, .flags = SubscribeFlags::EVENTS_FROM_CAR},
     };
 
     StatusCode res = manager->subscribe(cb, options);
@@ -259,11 +256,7 @@
     sp<MockedVehicleCallback> cb = new MockedVehicleCallback();
 
     hidl_vec<SubscribeOptions> options = {
-        SubscribeOptions {
-            .propId = PROP,
-            .flags = SubscribeFlags::DEFAULT
-        }
-    };
+        SubscribeOptions{.propId = PROP, .flags = SubscribeFlags::EVENTS_FROM_CAR}};
 
     StatusCode res = manager->subscribe(cb, options);
     ASSERT_EQ(StatusCode::OK, res);
@@ -301,18 +294,14 @@
     sp<MockedVehicleCallback> cb = new MockedVehicleCallback();
 
     hidl_vec<SubscribeOptions> options = {
-        SubscribeOptions {
-            .propId = PROP,
-            .flags = SubscribeFlags::HAL_EVENT
-        },
+        SubscribeOptions{.propId = PROP, .flags = SubscribeFlags::EVENTS_FROM_CAR},
     };
 
     StatusCode res = manager->subscribe(cb, options);
     // Unable to subscribe on Hal Events for write-only properties.
     ASSERT_EQ(StatusCode::INVALID_ARG, res);
 
-
-    options[0].flags = SubscribeFlags::SET_CALL;
+    options[0].flags = SubscribeFlags::EVENTS_FROM_ANDROID;
 
     res = manager->subscribe(cb, options);
     // OK to subscribe on SET method call for write-only properties.
@@ -396,8 +385,8 @@
     const auto PROP = toInt(VehicleProperty::HVAC_FAN_SPEED);
     const auto VAL1 = 1;
     const auto VAL2 = 2;
-    const auto AREA1 = toInt(VehicleAreaZone::ROW_1_LEFT);
-    const auto AREA2 = toInt(VehicleAreaZone::ROW_1_RIGHT);
+    const auto AREA1 = toInt(VehicleAreaSeat::ROW_1_LEFT);
+    const auto AREA2 = toInt(VehicleAreaSeat::ROW_1_RIGHT);
 
     {
         auto expectedValue1 = hal->getValuePool()->obtainInt32(VAL1);
diff --git a/automotive/vehicle/2.0/default/tests/VehicleHalTestUtils.h b/automotive/vehicle/2.0/default/tests/VehicleHalTestUtils.h
index 3cabcf2..108e32f 100644
--- a/automotive/vehicle/2.0/default/tests/VehicleHalTestUtils.h
+++ b/automotive/vehicle/2.0/default/tests/VehicleHalTestUtils.h
@@ -40,64 +40,38 @@
         .configString = "Some=config,options=if,you=have_any",
     },
 
-    {
-        .prop = toInt(VehicleProperty::HVAC_FAN_SPEED),
-        .access = VehiclePropertyAccess::READ_WRITE,
-        .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .areaConfigs = {
-            VehicleAreaConfig {
-                .areaId = toInt(VehicleAreaZone::ROW_1_LEFT),
-                .minInt32Value = 1,
-                .maxInt32Value = 7},
-            VehicleAreaConfig {
-                .areaId = toInt(VehicleAreaZone::ROW_1_RIGHT),
-                .minInt32Value = 1,
-                .maxInt32Value = 5,
-            }
-        }
-    },
+    {.prop = toInt(VehicleProperty::HVAC_FAN_SPEED),
+     .access = VehiclePropertyAccess::READ_WRITE,
+     .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+     .areaConfigs =
+         {VehicleAreaConfig{
+              .areaId = toInt(VehicleAreaSeat::ROW_1_LEFT), .minInt32Value = 1, .maxInt32Value = 7},
+          VehicleAreaConfig{
+              .areaId = toInt(VehicleAreaSeat::ROW_1_RIGHT), .minInt32Value = 1, .maxInt32Value = 5,
+          }}},
 
     // Write-only property
-    {
-        .prop = toInt(VehicleProperty::HVAC_SEAT_TEMPERATURE),
-        .access = VehiclePropertyAccess::WRITE,
-        .changeMode = VehiclePropertyChangeMode::ON_SET,
-        .areaConfigs = {
-            VehicleAreaConfig {
-                .areaId = toInt(VehicleAreaZone::ROW_1_LEFT),
-                .minInt32Value = 64,
-                .maxInt32Value = 80},
-            VehicleAreaConfig {
-                .areaId = toInt(VehicleAreaZone::ROW_1_RIGHT),
-                .minInt32Value = 64,
-                .maxInt32Value = 80,
-            }
-        }
-    },
+    {.prop = toInt(VehicleProperty::HVAC_SEAT_TEMPERATURE),
+     .access = VehiclePropertyAccess::WRITE,
+     .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+     .areaConfigs = {VehicleAreaConfig{.areaId = toInt(VehicleAreaSeat::ROW_1_LEFT),
+                                       .minInt32Value = 64,
+                                       .maxInt32Value = 80},
+                     VehicleAreaConfig{
+                         .areaId = toInt(VehicleAreaSeat::ROW_1_RIGHT),
+                         .minInt32Value = 64,
+                         .maxInt32Value = 80,
+                     }}},
 
-    {
-        .prop = toInt(VehicleProperty::INFO_FUEL_CAPACITY),
-        .access = VehiclePropertyAccess::READ,
-        .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .areaConfigs = {
-            VehicleAreaConfig {
-                .minFloatValue = 0,
-                .maxFloatValue = 1.0
-            }
-        }
-    },
+    {.prop = toInt(VehicleProperty::INFO_FUEL_CAPACITY),
+     .access = VehiclePropertyAccess::READ,
+     .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+     .areaConfigs = {VehicleAreaConfig{.minFloatValue = 0, .maxFloatValue = 1.0}}},
 
-    {
-        .prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
-        .access = VehiclePropertyAccess::READ_WRITE,
-        .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
-        .areaConfigs = {
-            VehicleAreaConfig {
-                .minInt32Value = 0,
-                .maxInt32Value = 10
-            }
-        }
-    },
+    {.prop = toInt(VehicleProperty::DISPLAY_BRIGHTNESS),
+     .access = VehiclePropertyAccess::READ_WRITE,
+     .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+     .areaConfigs = {VehicleAreaConfig{.minInt32Value = 0, .maxInt32Value = 10}}},
 
     {
         .prop = toInt(VehicleProperty::MIRROR_FOLD),
@@ -107,12 +81,9 @@
     },
 
     // Complex data type.
-    {
-        .prop = kCustomComplexProperty,
-        .access = VehiclePropertyAccess::READ_WRITE,
-        .changeMode = VehiclePropertyChangeMode::ON_CHANGE
-    }
-};
+    {.prop = kCustomComplexProperty,
+     .access = VehiclePropertyAccess::READ_WRITE,
+     .changeMode = VehiclePropertyChangeMode::ON_CHANGE}};
 
 constexpr auto kTimeout = std::chrono::milliseconds(500);
 
diff --git a/automotive/vehicle/2.0/types.hal b/automotive/vehicle/2.0/types.hal
index 87daedc..15ba494 100644
--- a/automotive/vehicle/2.0/types.hal
+++ b/automotive/vehicle/2.0/types.hal
@@ -17,28 +17,28 @@
 package android.hardware.automotive.vehicle@2.0;
 
 /**
- * Enumerates supported data types for VehicleProperty.
+ * Enumerates supported data type for VehicleProperty.
  *
- * This is a bitwise flag that supposed to be used in VehicleProperty enum.
+ * Used to create property ID in VehicleProperty enum.
  */
 enum VehiclePropertyType : int32_t {
-    STRING         = 0x00100000,
-    BOOLEAN        = 0x00200000,
-    INT32          = 0x00400000,
-    INT32_VEC      = 0x00410000,
-    INT64          = 0x00500000,
-    INT64_VEC      = 0x00510000,
-    FLOAT          = 0x00600000,
-    FLOAT_VEC      = 0x00610000,
-    BYTES          = 0x00700000,
+    STRING          = 0x00100000,
+    BOOLEAN         = 0x00200000,
+    INT32           = 0x00400000,
+    INT32_VEC       = 0x00410000,
+    INT64           = 0x00500000,
+    INT64_VEC       = 0x00510000,
+    FLOAT           = 0x00600000,
+    FLOAT_VEC       = 0x00610000,
+    BYTES           = 0x00700000,
 
     /**
      * Any combination of scalar or vector types. The exact format must be
      * provided in the description of the property.
      */
-    MIXED          = 0x00e00000,
+    MIXED           = 0x00e00000,
 
-    MASK           = 0x00ff0000
+    MASK            = 0x00ff0000
 };
 
 /**
@@ -50,51 +50,60 @@
  * Other properties may not be associated with particular vehicle area,
  * these kind of properties must have VehicleArea:GLOBAL flag.
  *
- * This is a bitwise flag that supposed to be used in VehicleProperty enum.
+ * Used to create property ID in VehicleProperty enum.
  */
 enum VehicleArea : int32_t {
-      GLOBAL       = 0x01000000,
-      ZONE         = 0x02000000,
-      WINDOW       = 0x03000000,
-      MIRROR       = 0x04000000,
-      SEAT         = 0x05000000,
-      DOOR         = 0x06000000,
+    GLOBAL      = 0x01000000,
+    /** WINDOW maps to enum VehicleAreaWindow */
+    WINDOW      = 0x03000000,
+    /** MIRROR maps to enum VehicleAreaMirror */
+    MIRROR      = 0x04000000,
+    /** SEAT maps to enum VehicleAreaSeat */
+    SEAT        = 0x05000000,
+    /** DOOR maps to enum VehicleAreaDoor */
+    DOOR        = 0x06000000,
+    /** WHEEL maps to enum Wheel */
+    WHEEL       = 0x07000000,
 
-      MASK         = 0x0f000000,
+    MASK        = 0x0f000000,
 };
 
 /**
  * Enumerates property groups.
  *
- * This is a bitwise flag that supposed to be used in VehicleProperty enum.
+ * Used to create property ID in VehicleProperty enum.
  */
 enum VehiclePropertyGroup : int32_t {
     /**
-     * Properties declared in AOSP must have this flag.
+     * Properties declared in AOSP must use this flag.
      */
-    SYSTEM         = 0x10000000,
+    SYSTEM      = 0x10000000,
 
     /**
-     * Properties declared by vendors must have this flag.
+     * Properties declared by vendors must use this flag.
      */
-    VENDOR         = 0x20000000,
+    VENDOR      = 0x20000000,
 
-    MASK           = 0xf0000000,
+    MASK        = 0xf0000000,
 };
 
 /**
  * Declares all vehicle properties. VehicleProperty has a bitwise structure.
  * Each property must have:
- *   - an unique id from range 0x0100 - 0xffff
- *   - associated data type using VehiclePropertyType
- *   - property group (VehiclePropertyGroup)
- *   - vehicle area (VehicleArea)
+ *  - a unique id from range 0x0100 - 0xffff
+ *  - associated data type using VehiclePropertyType
+ *  - property group (VehiclePropertyGroup)
+ *  - vehicle area (VehicleArea)
  *
  * Vendors are allowed to extend this enum with their own properties. In this
  * case they must use VehiclePropertyGroup:VENDOR flag when property is
  * declared.
+ *
+ * When a property's status field is not set to AVAILABLE:
+ *  - IVehicle#set may return StatusCode::NOT_AVAILABLE.
+ *  - IVehicle#get is not guaranteed to work.
  */
-enum VehicleProperty: int32_t {
+enum VehicleProperty : int32_t {
 
     /** Undefined property. */
     INVALID = 0x00000000,
@@ -105,14 +114,14 @@
      * @change_mode VehiclePropertyChangeMode:STATIC
      * @access VehiclePropertyAccess:READ
      */
-    INFO_VIN= (
+    INFO_VIN = (
         0x0100
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:STRING
         | VehicleArea:GLOBAL),
 
     /**
-     * Maker name of vehicle
+     * Manufacturer of vehicle
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
      * @access VehiclePropertyAccess:READ
@@ -162,11 +171,11 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * List of fuels the vehicle may use.  Uses enum FuelType
+     * List of fuels the vehicle may use
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
      * @access VehiclePropertyAccess:READ
-     * @unit VehicleUnit:MILLILITERS
+     * @data_enum FuelType
      */
     INFO_FUEL_TYPE = (
         0x0105
@@ -189,9 +198,10 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * List of connectors this EV may use.  Uses enum EvConnectorType
+     * List of connectors this EV may use
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
+     * @data_enum EvConnectorType
      * @access VehiclePropertyAccess:READ
      */
     INFO_EV_CONNECTOR_TYPE = (
@@ -201,9 +211,49 @@
         | VehicleArea:GLOBAL),
 
     /**
+     * Fuel door location
+     *
+     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @data_enum FuelDoorLocationType
+     * @access VehiclePropertyAccess:READ
+     */
+    INFO_FUEL_DOOR_LOCATION = (
+        0x0108
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * EV port location
+     *
+     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @access VehiclePropertyAccess:READ
+     * @data_enum PortLocationType
+     */
+    INFO_EV_PORT_LOCATION = (
+        0x0109
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Driver's seat location
+     *
+     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @data_enum VehicleAreaSeat
+     * @access VehiclePropertyAccess:READ
+     */
+    INFO_DRIVER_SEAT = (
+        0x010A
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:SEAT),
+
+
+    /**
      * Current odometer value of the vehicle
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE | VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:KILOMETER
      */
@@ -216,7 +266,7 @@
     /**
      * Speed of the vehicle
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:METER_PER_SEC
      */
@@ -227,22 +277,9 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * Engine on
-     *
-     * @change_mode VehiclePropertyChangeMode:STATIC
-     * @access VehiclePropertyAccess:READ
-     */
-    ENGINE_ON = (
-        0x0300
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:BOOLEAN
-        | VehicleArea:GLOBAL),
-
-
-    /**
      * Temperature of engine coolant
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:CELSIUS
      */
@@ -268,7 +305,7 @@
     /**
      * Temperature of engine oil
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:CELSIUS
      */
@@ -281,7 +318,7 @@
     /**
      * Engine rpm
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:RPM
      */
@@ -310,7 +347,7 @@
      *  int64Values[3] = rear right ticks
      *  int64Values[4] = rear left ticks
      *
-     * configArray is used to indicate the micrometers-per-wheel-tick value as well as
+     * configArray is used to indicate the micrometers-per-wheel-tick value and
      * which wheels are supported.  configArray is set as follows:
      *
      *  configArray[0], bits [0:3] = supported wheels.  Uses enum Wheel.
@@ -327,10 +364,10 @@
      * @access VehiclePropertyAccess:READ
      */
     WHEEL_TICK = (
-      0x0306
-      | VehiclePropertyGroup:SYSTEM
-      | VehiclePropertyType:MIXED
-      | VehicleArea:GLOBAL),
+        0x0306
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT64_VEC
+        | VehicleArea:GLOBAL),
 
 
     /**
@@ -338,7 +375,7 @@
      *
      * Value may not exceed INFO_FUEL_CAPACITY
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:MILLILITER
      */
@@ -351,8 +388,8 @@
     /**
      * Fuel door open
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
-     * @access VehiclePropertyAccess:READ
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
      */
     FUEL_DOOR_OPEN = (
         0x0308
@@ -365,7 +402,7 @@
      *
      * Value may not exceed INFO_EV_BATTERY_CAPACITY
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:WH
      */
@@ -378,8 +415,8 @@
     /**
      * EV charge port open
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
-     * @access VehiclePropertyAccess:READ
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
      */
     EV_CHARGE_PORT_OPEN = (
         0x030A
@@ -390,7 +427,7 @@
     /**
      * EV charge port connected
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      */
     EV_CHARGE_PORT_CONNECTED = (
@@ -405,7 +442,7 @@
      * Positive value indicates battery is being charged.
      * Negative value indicates battery being discharged.
      *
-     * @change_mode VehiclePropertyChangeMode:STATIC
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:MW
      */
@@ -416,8 +453,42 @@
         | VehicleArea:GLOBAL),
 
     /**
+     * Range remaining
+     *
+     * Meters remaining of fuel and charge.  Range remaining shall account for
+     * all energy sources in a vehicle.  For example, a hybrid car's range will
+     * be the sum of the ranges based on fuel and battery.
+     *
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @unit VehicleUnit:METER
+     */
+    RANGE_REMAINING = (
+        0x0308
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:FLOAT
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Tire pressure
+     *
+     * The min/max range is used to indicate the recommended tire pressure.
+     *
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
+     * @access VehiclePropertyAccess:READ
+     * @unit VehicleUnit:KILOPASCAL
+     */
+    TIRE_PRESSURE = (
+        0x0309
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:MIXED
+        | VehicleArea:WHEEL),
+
+    /**
      * Currently selected gear
      *
+     * This is the gear selected by the user.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      * @data_enum VehicleGear
@@ -467,21 +538,12 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * Driving status policy.
-     *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ
-     * @data_enum VehicleDrivingStatus
-     */
-    DRIVING_STATUS = (
-        0x0404
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32
-        | VehicleArea:GLOBAL),
-
-    /**
      * Warning for fuel low level.
      *
+     * This property corresponds to the low fuel warning on the dashboard.
+     * Once FUEL_LEVEL_LOW is set, it should not be cleared until more fuel is
+     * added to the vehicle.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      */
@@ -492,7 +554,9 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * Night mode or not.
+     * Night mode
+     *
+     * True indicates that night mode is currently enabled.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
@@ -506,8 +570,6 @@
     /**
      * State of the vehicles turn signals
      *
-     * Values from VehicleTurnSignal
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      * @data_enum VehicleTurnSignal
@@ -527,12 +589,16 @@
      */
     IGNITION_STATE = (
         0x0409
-            | VehiclePropertyGroup:SYSTEM
-            | VehiclePropertyType:INT32
-            | VehicleArea:GLOBAL),
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
 
     /**
-     * ABS is active.  Set to true whenever ABS is activated.  Reset to false when ABS is off.
+     * ABS is active
+     *
+     * Set to true when ABS is active.  Reset to false when ABS is off.  This
+     * property may be intermittently set (pulsing) based on the real-time
+     * state of the ABS system.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
@@ -544,7 +610,11 @@
         | VehicleArea:GLOBAL),
 
     /**
-     * Traction Control is active.
+     * Traction Control is active
+     *
+     * Set to true when traction control (TC) is active.  Reset to false when
+     * TC is off.  This property may be intermittently set (pulsing) based on
+     * the real-time state of the TC system.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
@@ -558,10 +628,6 @@
     /**
      * Fan speed setting
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -569,15 +635,11 @@
         0x0500
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * Fan direction setting
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      * @data_enum VehicleHvacFanDirection
@@ -586,15 +648,11 @@
         0x0501
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * HVAC current temperature.
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -602,15 +660,11 @@
         0x0502
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:FLOAT
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * HVAC, target temperature set.
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -618,14 +672,10 @@
         0x0503
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:FLOAT
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
-     * On/off defrost
-     *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * On/off defrost for designated window
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -637,28 +687,25 @@
         | VehicleArea:WINDOW),
 
     /**
-     * On/off AC
-     *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * On/off AC for designated areaId
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
-     * @config_flags Supported zones
+     * @config_flags Supported areaIds
      */
     HVAC_AC_ON = (
         0x0505
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * On/off max AC
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * When MAX AC is on, the ECU may adjust the vent position, fan speed,
+     * temperature, etc as necessary to cool the vehicle as quickly as possible.
+     * Any parameters modified as a side effect of turning on/off the MAX AC
+     * parameter shall generate onPropertyEvent() callbacks to the VHAL.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -667,14 +714,16 @@
         0x0506
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * On/off max defrost
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * When MAX DEFROST is on, the ECU may adjust the vent position, fan speed,
+     * temperature, etc as necessary to defrost the windows as quickly as
+     * possible.  Any parameters modified as a side effect of turning on/off
+     * the MAX DEFROST parameter shall generate onPropertyEvent() callbacks to
+     * the VHAL.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -683,14 +732,15 @@
         0x0507
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
-     * On/off re-circulation
+     * Recirculation on/off
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * Controls the supply of exterior air to the cabin.  Recirc “on” means the
+     * majority of the airflow into the cabin is originating in the cabin.
+     * Recirc “off” means the majority of the airflow into the cabin is coming
+     * from outside the car.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -699,14 +749,25 @@
         0x0508
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
-     * On/off dual. This must be defined per each row.
+     * Enable temperature coupling between zones.
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * The areaId for this property must include the zones that are coupled
+     * together.  Typically, the front two zones (ROW_1_LEFT and ROW_1_RIGHT)
+     * are coupled together when this property is enabled.  Thus, the areaId
+     * shall be (ROW_1_LEFT | ROW_1_RIGHT).  When the property is enabled, the
+     * ECU may synchronize the temperature for the affected zones.  Any
+     * parameters modified as a side effect of turning on/off the DUAL_ON
+     * parameter shall generate onPropertyEvent() callbacks to the VHAL.  In
+     * addition, if setting a temperature (i.e. driver's temp) changes another
+     * temperature (i.e. front passenger's temp), then the appropriate
+     * onPropertyEvent() callbacks must be generated.  If a user changes a
+     * temperature that breaks the coupling (e.g. setting the passenger
+     * temperature independently) then the VHAL must send the appropriate
+     * onPropertyEvent() callbacks (i.e. HVAC_DUAL_ON = false,
+     * HVAC_TEMPERATURE_SET[zone] = xxx, etc).
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -715,15 +776,11 @@
         0x0509
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * On/off automatic mode
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -731,7 +788,7 @@
         0x050A
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * Seat temperature
@@ -744,10 +801,6 @@
      * min/max range defines the allowable range and number of steps in each
      * direction.
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -760,12 +813,9 @@
     /**
      * Side Mirror Heat
      *
-     * Increase values denote higher heating levels for side mirrors.
-     * 0 indicates heating is turned off.
-     *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
+     * Increasing values denote higher heating levels for side mirrors.
+     * The Max value in the config data represents the highest heating level.
+     * The Min value in the config data MUST be zero and indicates no heating.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -777,51 +827,42 @@
         | VehicleArea:MIRROR),
 
     /**
-     * Steering Wheel Temperature
+     * Steering Wheel Heating/Cooling
      *
-     * Sets the temperature for the steering wheel
+     * Sets the amount of heating/cooling for the steering wheel
+     * config data Min and Max MUST be set appropriately.
      * Positive value indicates heating.
      * Negative value indicates cooling.
      * 0 indicates temperature control is off.
      *
-     * IVehicle#set may return StatusCode::NOT_AVAILABLE and IVehicle#get is not
-     * guaranteed to work if HVAC unit is off.  See HVAC_POWER_ON property for
-     * details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
-    HVAC_STEERING_WHEEL_TEMP = (
+    HVAC_STEERING_WHEEL_HEAT = (
         0x050D
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32
         | VehicleArea:GLOBAL),
 
     /**
-     * Temperature units
+     * Temperature units for display
      *
      * Indicates whether the temperature is in Celsius, Fahrenheit, or a
-     * different unit from VehicleUnit enum.
-     * This parameter affects all HVAC temperatures in the system.
-     *
-     * IVehicle#get is not guaranteed to work if HVAC unit is off.  See
-     * HVAC_POWER_ON property for details.
+     * different unit from VehicleUnit enum.  This parameter MAY be used for
+     * displaying any HVAC temperature in the system.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ
+     * @access VehiclePropertyAccess:READ_WRITE
      */
-    HVAC_TEMPERATURE_UNITS = (
+    HVAC_TEMPERATURE_DISPLAY_UNITS = (
         0x050E
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32
-        | VehicleArea:ZONE),
+        | VehicleArea:GLOBAL),
 
     /**
      * Actual fan speed
      *
-     * IVehicle#get is not guaranteed to work if HVAC unit is off.  See
-     * HVAC_POWER_ON property for details.
-     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      */
@@ -829,37 +870,38 @@
         0x050F
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
-     * Represents power state for HVAC. Some HVAC properties must require
-     * matching power to be turned on to get out of OFF state. For non-zoned
-     * HVAC properties, VEHICLE_ALL_ZONE corresponds to global power state.
+     * Represents global power state for HVAC.  Setting this property to false
+     * MAY mark some properties that control individual HVAC features/subsystems
+     * to UNAVAILABLE state. Setting this property to true MAY mark some
+     * properties that control individual HVAC features/subsystems to AVAILABLE
+     * state (unless any/all of them are UNAVAILABLE on their own individual
+     * merits).  The list of properties affected by HVAC_POWER_ON must be set
+     * in the VehiclePropConfig.configArray.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
-     * @config_string list of HVAC properties whose power is controlled by this
-     *                property. Format is hexa-decimal number (0x...) separated
-     *                by comma like "0x500,0x503". All zones defined in these
-     *                affected properties must be available in the property.
      */
     HVAC_POWER_ON = (
         0x0510
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
      * Fan Positions Available
      *
-     * This is a bit mask of fan positions available for the zone.  Each available fan direction is
-     * denoted by a separate entry in the vector.  A fan direction may have multiple bits from
-     * vehicle_hvac_fan_direction set.  For instance, a typical car may have the following setting:
-     *   - [0] = FAN_DIRECTION_FACE (0x1)
-     *   - [1] = FAN_DIRECTION_FLOOR (0x2)
-     *   - [2] = FAN_DIRECTION_FACE | FAN_DIRECTION_FLOOR (0x3)
-     *   - [3] = FAN_DIRECTION_DEFROST (0x4)
-     *   - [4] = FAN_DIRECTION_FLOOR | FAN_DIRECTION_DEFROST (0x6)
+     * This is a bit mask of fan positions available for the zone.  Each
+     * available fan direction is denoted by a separate entry in the vector.  A
+     * fan direction may have multiple bits from vehicle_hvac_fan_direction set.
+     * For instance, a typical car may have the following fan positions:
+     *   - FAN_DIRECTION_FACE (0x1)
+     *   - FAN_DIRECTION_FLOOR (0x2)
+     *   - FAN_DIRECTION_FACE | FAN_DIRECTION_FLOOR (0x3)
+     *   - FAN_DIRECTION_DEFROST (0x4)
+     *   - FAN_DIRECTION_FLOOR | FAN_DIRECTION_DEFROST (0x6)
      *
      * @change_mode VehiclePropertyChangeMode:STATIC
      * @access VehiclePropertyAccess:READ
@@ -868,13 +910,14 @@
         0x0511
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32_VEC
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
 
     /**
-     * Automatic re-circulation on/off
+     * Automatic recirculation on/off
      *
-     * IVehicle#set and IVehicle#get must return StatusCode::NOT_AVAILABLE when HVAC unit is off.
-     * See HVAC_POWER_ON property for details.
+     * When automatic recirculation is ON, the HVAC system may automatically
+     * switch to recirculation mode if the vehicle detects poor incoming air
+     * quality.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
@@ -883,12 +926,32 @@
         0x0512
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:BOOLEAN
-        | VehicleArea:ZONE),
+        | VehicleArea:SEAT),
+
+    /**
+     * Seat ventilation
+     *
+     * 0 indicates off.
+     * Positive values indicates ventilation level.
+     *
+     * Used by HVAC apps and Assistant to enable, change, or read state of seat
+     * ventilation.  This is different than seating cooling. It can be on at the
+     * same time as cooling, or not.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     */
+    HVAC_SEAT_VENTILATION = (
+        0x0513
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:SEAT),
+
 
     /**
      * Outside temperature
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:CELSIUS
      */
@@ -901,7 +964,7 @@
     /**
      * Cabin temperature
      *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE|VehiclePropertyChangeMode:CONTINUOUS
+     * @change_mode VehiclePropertyChangeMode:CONTINUOUS
      * @access VehiclePropertyAccess:READ
      * @unit VehicleUnit:CELSIUS
      */
@@ -909,31 +972,7 @@
         0x0704
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:FLOAT
-        | VehicleArea:GLOBAL),
-
-    /**
-     * Radio presets stored on the Car radio module. The data type used is int32
-     * array with the following fields:
-     * <ul>
-     *    <li> int32Values[0]: Preset number </li>
-     *    <li> int32Values[1]: Band type (see #RADIO_BAND_FM in
-     *    system/core/include/system/radio.h).
-     *    <li> int32Values[2]: Channel number </li>
-     *    <li> int32Values[3]: Sub channel number </li>
-     * </ul>
-     *
-     * NOTE: When getting a current preset config ONLY set preset number (i.e.
-     * int32Values[0]). For setting a preset other fields are required.
-     *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ_WRITE
-     * @config_flags Number of presets supported
-     */
-    RADIO_PRESET = (
-        0x0801
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32_VEC
-        | VehicleArea:GLOBAL),
+        | VehicleArea:SEAT),
 
     /**
      * Property to control power state of application processor
@@ -944,40 +983,36 @@
      * For configuration information, VehiclePropConfig.configFlags can
      * have bit flag combining values in VehicleApPowerStateConfigFlag.
      *
-     * Value format for IVehicle#get / IVehicle#subscribe:
-     *   int32Values[0] : vehicle_ap_power_state_type
+     *   int32Values[0] : VehicleApPowerStateReq enum value
      *   int32Values[1] : additional parameter relevant for each state,
      *                    0 if not used.
-     * Value format for IVehicle#set:
-     *   int32Values[0] : vehicle_ap_power_state_set_type
-     *   int32Values[1] : additional parameter relevant for each request. should be 0 if not used.
      *
-     * @change_mode VEHICLE_PROP_CHANGE_MODE_ON_CHANGE
-     * @access VEHICLE_PROP_ACCESS_READ_WRITE
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VEHICLE_PROP_ACCESS_READ
      */
-    AP_POWER_STATE = (
+    AP_POWER_STATE_REQ = (
         0x0A00
         | VehiclePropertyGroup:SYSTEM
         | VehiclePropertyType:INT32_VEC
         | VehicleArea:GLOBAL),
 
     /**
-     * Property to represent brightness of the display. Some cars have single
-     * control for the brightness of all displays and this property is to share
-     * change in that control.
+     * Property to report power state of application processor
      *
-     * If this is writable, android side can set this value when user changes
-     * display brightness from Settings. If this is read only, user may still
-     * change display brightness from Settings, but that will not be reflected
-     * to other displays.
+     * It is assumed that AP's power state is controller by separate power
+     * controller.
+     *
+     *   int32Values[0] : VehicleApPowerStateReport enum value
+     *   int32Values[1] : Time in ms to wake up, if necessary.  Otherwise 0.
+
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ_WRITE
+     * @access VEHICLE_PROP_ACCESS_WRITE
      */
-    DISPLAY_BRIGHTNESS = (
+    AP_POWER_STATE_REPORT = (
         0x0A01
         | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32
+        | VehiclePropertyType:INT32_VEC
         | VehicleArea:GLOBAL),
 
     /**
@@ -999,6 +1034,25 @@
         | VehicleArea:GLOBAL),
 
     /**
+     * Property to represent brightness of the display. Some cars have single
+     * control for the brightness of all displays and this property is to share
+     * change in that control.
+     *
+     * If this is writable, android side can set this value when user changes
+     * display brightness from Settings. If this is read only, user may still
+     * change display brightness from Settings, but that must not be reflected
+     * to other displays.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     */
+    DISPLAY_BRIGHTNESS = (
+        0x0A03
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
      * Property to feed H/W input events to android
      *
      * int32Values[0] : action defined by VehicleHwKeyInputAction
@@ -1006,6 +1060,7 @@
      * int32Values[2] : target display defined in VehicleDisplay. Events not
      *                  tied to specific display must be sent to
      *                  VehicleDisplay#MAIN.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ
      * @config_flags
@@ -1016,36 +1071,23 @@
         | VehiclePropertyType:INT32_VEC
         | VehicleArea:GLOBAL),
 
-    /**
-     * Current date and time, encoded as Unix time.
-     * This value denotes the number of seconds that have elapsed since
-     * 1/1/1970.
+    /***************************************************************************
+     * Most Car Cabin properties have both a POSition and MOVE parameter.  These
+     * are used to control the various movements for seats, doors, and windows
+     * in a vehicle.
      *
-     * @change_mode VehiclePropertyChangeMode:ON_SET
-     * @access VehiclePropertyAccess:READ_WRITE
-     * @unit VehicleUnit:SECS
-     */
-    UNIX_TIME = (
-        0x0A30
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT64
-        | VehicleArea:GLOBAL),
-
-    /**
-     * Current time only.
-     * Some vehicles may not keep track of date.  This property only affects
-     * the current time, in seconds during the day.  Thus, the max value for
-     * this parameter is 86,400 (24 * 60 * 60)
+     * A POS parameter allows the user to set the absolution position.  For
+     * instance, for a door, 0 indicates fully closed and max value indicates
+     * fully open.  Thus, a value halfway between min and max must indicate
+     * the door is halfway open.
      *
-     * @change_mode VehiclePropertyChangeMode:ON_SET
-     * @access VehiclePropertyAccess:READ_WRITE
-     * @unit VehicleUnit:SECS
-     */
-    CURRENT_TIME_IN_SECONDS = (
-        0x0A31
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32
-        | VehicleArea:GLOBAL),
+     * A MOVE parameter moves the device in a particular direction.  The sign
+     * indicates direction, and the magnitude indicates speed (if multiple
+     * speeds are available).  For a door, a move of -1 will close the door, and
+     * a move of +1 will open it.  Once a door reaches the limit of open/close,
+     * the door should automatically stop moving.  The user must NOT need to
+     * send a MOVE(0) command to stop the door at the end of its range.
+     **************************************************************************/
 
     /**
      * Door position
@@ -1200,7 +1242,7 @@
      *
      * This setting allows the user to save the current seat position settings
      * into the selected preset slot.  The maxValue for each seat position
-     * shall match the maxValue for SEAT_MEMORY_SELECT.
+     * must match the maxValue for SEAT_MEMORY_SELECT.
      *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:WRITE
@@ -1590,6 +1632,14 @@
      * Max = window up / closed
      * Min = window down / open
      *
+     * For a window that may open out of plane (i.e. vent mode of sunroof) this
+     * parameter will work with negative values as follows:
+     *  Max = sunroof completely open
+     *  0 = sunroof closed.
+     *  Min = sunroof vent completely open
+     *
+     *  Note that in this mode, 0 indicates the window is closed.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -1607,6 +1657,21 @@
      * Magnitude denotes relative speed.  I.e. +2 is faster than +1 in raising
      * the window.
      *
+     * For a window that may open out of plane (i.e. vent mode of sunroof) this
+     * parameter will work as follows:
+     *
+     *  If sunroof is open:
+     *    Max = open the sunroof further, automatically stop when fully open.
+     *    Min = close the sunroof, automatically stop when sunroof is closed.
+     *
+     * If vent is open:
+     *  Max = close the vent, automatically stop when vent is closed.
+     *  Min = open the vent further, automatically stop when vent is fully open.
+     *
+     * If window is in the closed position:
+     *  Max = open the sunroof, automatically stop when sunroof is fully open.
+     *  Min = open the vent, automatically stop when vent is fully open.
+     *
      * @change_mode VehiclePropertyChangeMode:ON_CHANGE
      * @access VehiclePropertyAccess:READ_WRITE
      */
@@ -1617,40 +1682,6 @@
         | VehicleArea:WINDOW),
 
     /**
-     * Window Vent Position
-     *
-     * This feature is used to control the vent feature on a sunroof.
-     *
-     * Max = vent open
-     * Min = vent closed
-     *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ_WRITE
-     */
-    WINDOW_VENT_POS = (
-        0x0BC2
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32
-        | VehicleArea:WINDOW),
-
-    /**
-     * Window Vent Move
-     *
-     * This feature is used to control the vent feature on a sunroof.
-     *
-     * Max = vent open
-     * Min = vent closed
-     *
-     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
-     * @access VehiclePropertyAccess:READ_WRITE
-     */
-    WINDOW_VENT_MOVE = (
-        0x0BC3
-        | VehiclePropertyGroup:SYSTEM
-        | VehiclePropertyType:INT32
-        | VehicleArea:WINDOW),
-
-    /**
      * Window Lock
      *
      * True indicates windows are locked and can't be moved.
@@ -1729,10 +1760,10 @@
      * @access VehiclePropertyAccess:READ
      */
     OBD2_LIVE_FRAME = (
-      0x0D00
-      | VehiclePropertyGroup:SYSTEM
-      | VehiclePropertyType:MIXED
-      | VehicleArea:GLOBAL),
+        0x0D00
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:MIXED
+        | VehicleArea:GLOBAL),
 
     /**
      * OBD2 Freeze Frame Sensor Data
@@ -1759,10 +1790,10 @@
      * @access VehiclePropertyAccess:READ
      */
     OBD2_FREEZE_FRAME = (
-      0x0D01
-      | VehiclePropertyGroup:SYSTEM
-      | VehiclePropertyType:MIXED
-      | VehicleArea:GLOBAL),
+        0x0D01
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:MIXED
+        | VehicleArea:GLOBAL),
 
     /**
      * OBD2 Freeze Frame Information
@@ -1780,10 +1811,10 @@
      * @access VehiclePropertyAccess:READ
      */
     OBD2_FREEZE_FRAME_INFO = (
-      0x0D02
-      | VehiclePropertyGroup:SYSTEM
-      | VehiclePropertyType:MIXED
-      | VehicleArea:GLOBAL),
+        0x0D02
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:MIXED
+        | VehicleArea:GLOBAL),
 
     /**
      * OBD2 Freeze Frame Clear
@@ -1806,10 +1837,164 @@
      * @access VehiclePropertyAccess:WRITE
      */
     OBD2_FREEZE_FRAME_CLEAR = (
-      0x0D03
-      | VehiclePropertyGroup:SYSTEM
-      | VehiclePropertyType:MIXED
-      | VehicleArea:GLOBAL),
+        0x0D03
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:MIXED
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Headlights State
+     *
+     * Return the current state of headlights.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    HEADLIGHTS_STATE = (
+        0x0E00
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * High beam lights state
+     *
+     * Return the current state of high beam lights.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    HIGH_BEAM_LIGHTS_STATE = (
+        0x0E01
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Fog light state
+     *
+     * Return the current state of fog lights.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    FOG_LIGHTS_STATE = (
+        0x0E02
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Hazard light status
+     *
+     * Return the current status of hazard lights.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ
+     * @data_enum VehicleLightState
+     */
+    HAZARD_LIGHTS_STATE = (
+        0x0E03
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Headlight switch
+     *
+     * The setting that the user wants.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    HEADLIGHTS_SWITCH = (
+        0x0E10
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * High beam light switch
+     *
+     * The setting that the user wants.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    HIGH_BEAM_LIGHTS_SWITCH = (
+        0x0E11
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Fog light switch
+     *
+     * The setting that the user wants.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    FOG_LIGHTS_SWITCH = (
+        0x0E12
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+
+    /**
+     * Hazard light switch
+     *
+     * The setting that the user wants.
+     *
+     * @change_mode VehiclePropertyChangeMode:ON_CHANGE
+     * @access VehiclePropertyAccess:READ_WRITE
+     * @data_enum VehicleLightSwitch
+     */
+    HAZARD_LIGHTS_SWITCH = (
+        0x0E13
+        | VehiclePropertyGroup:SYSTEM
+        | VehiclePropertyType:INT32
+        | VehicleArea:GLOBAL),
+};
+
+/**
+ * Used by lights state properties to enumerate the current state of the lights.
+ *
+ * Most XXX_LIGHTS_STATE properties will only report ON and OFF states.  Only
+ * the HEADLIGHTS_STATE property will report DAYTIME_RUNNING.
+ */
+enum  VehicleLightState : int32_t {
+
+    OFF = 0,
+    ON = 1,
+    DAYTIME_RUNNING = 2
+};
+
+/**
+ * Used by lights switch properties to enumerate user selected switch setting.
+ *
+ * XXX_LIGHTS_SWITCH properties report the switch settings that the user
+ * selects.  The switch setting may be decoupled from the state reported if the
+ * user selects AUTOMATIC.
+ */
+enum VehicleLightSwitch : int32_t {
+    OFF = 0,
+    ON = 1,
+    /**
+     * Daytime running lights mode.  Most cars automatically use DRL but some
+     * cars allow the user to activate them manually.
+     */
+    DAYTIME_RUNNING = 2,
+    /**
+     * Allows the vehicle ECU to set the lights automatically
+     */
+    AUTOMATIC = 0x100,
 };
 
 /**
@@ -1841,6 +2026,24 @@
 };
 
 /**
+ * Used by INFO_FUEL_DOOR_LOCATION/INFO_CHARGE_PORT_LOCATION to enumerate fuel door or
+ * ev port location.
+ */
+enum PortLocationType : int32_t {
+    /**
+     * Default type if the vehicle does not know or report the Fuel door
+     * and ev port location.
+     */
+    UNKNOWN = 0,
+    FRONT_LEFT = 1,
+    FRONT_RIGHT = 2,
+    REAR_RIGHT = 3,
+    REAR_LEFT = 4,
+    FRONT = 5,
+    REAR = 6,
+};
+
+/**
  * Used by INFO_FUEL_TYPE to enumerate the type of fuels this vehicle uses.
  * Consistent with projection protocol.
  */
@@ -1899,14 +2102,6 @@
     ERROR = 4,
 };
 
-/**
- * Constants relevant to radio.
- */
-enum VehicleRadioConstants : int32_t {
-    /** Minimum value for the radio preset */
-    VEHICLE_RADIO_PRESET_MIN_VALUE = 1,
-};
-
 enum VehicleApPowerStateConfigFlag : int32_t /* NOTE: type is guessed */ {
     /**
      * AP can enter deep sleep state. If not set, AP will always shutdown from
@@ -1921,7 +2116,7 @@
     CONFIG_SUPPORT_TIMER_POWER_ON_FLAG = 0x2,
 };
 
-enum VehicleApPowerState : int32_t /* NOTE: type is guessed */ {
+enum VehicleApPowerStateReq : int32_t {
     /** vehicle HAL will never publish this state to AP */
     OFF = 0,
 
@@ -1946,6 +2141,16 @@
     SHUTDOWN_PREPARE = 4,
 };
 
+/**
+ * Index in int32Values for VehicleProperty#AP_POWER_STATE_REQ property.
+ */
+enum VehicleApPowerStateReqIndex : int32_t {
+    STATE = 0,
+    ADDITIONAL = 1,
+};
+
+
+
 enum VehicleApPowerStateShutdownParam : int32_t {
     /** AP must shutdown immediately. Postponing is not allowed. */
     SHUTDOWN_IMMEDIATELY = 1,
@@ -1957,7 +2162,7 @@
     SHUTDOWN_ONLY = 3,
 };
 
-enum VehicleApPowerSetState : int32_t /* NOTE: type is guessed */ {
+enum VehicleApPowerStateReport : int32_t {
     /**
      * AP has finished boot up, and can start shutdown if requested by power
      * controller.
@@ -2022,14 +2227,6 @@
 };
 
 /**
- * Index in int32Values for VehicleProperty#AP_POWER_STATE property.
- */
-enum VehicleApPowerStateIndex : int32_t {
-    STATE = 0,
-    ADDITIONAL = 1,
-};
-
-/**
  * Enum to represent bootup reason.
  */
 enum VehicleApPowerBootupReason : int32_t {
@@ -2063,7 +2260,7 @@
 };
 
 enum VehicleDisplay : int32_t {
-    /** center console */
+    /** The primary Android display (for example, center console) */
     MAIN = 0,
 
     INSTRUMENT_CLUSTER = 1,
@@ -2089,6 +2286,7 @@
     NANO_SECS      = 0x50,
     SECS           = 0x53,
     YEAR           = 0x59,
+    KILOPASCAL     = 0x70,
 
     // Electrical Units
     WATT_HOUR      = 0x60,
@@ -2097,46 +2295,33 @@
     MILLIWATTS     = 0x63,
 };
 
-  /**
-   * This describes how value of property can change.
-   */
+/**
+ * This describes how value of property can change.
+ */
 enum VehiclePropertyChangeMode : int32_t {
-  /**
-   * Property of this type must never be changed. Subscription is not supported
-   * for these properties.
-   */
-  STATIC = 0x00,
+    /**
+     * Property of this type must never be changed. Subscription is not supported
+     * for these properties.
+     */
+    STATIC = 0x00,
 
-  /**
-   * Property of this type must be reported when there is a change.
-   * IVehicle#get call must return the current value.
-   * Set operation for this property is assumed to be asynchronous. When the
-   * property is read (using IVehicle#get) after IVehicle#set, it may still
-   * return old value until underlying H/W backing this property has actually
-   * changed the state. Once state is changed, the property must dispatch
-   * changed value as event.
-   */
-  ON_CHANGE = 0x01,
+    /**
+     * Properties of this type must report when there is a change.
+     * IVehicle#get call must return the current value.
+     * Set operation for this property is assumed to be asynchronous. When the
+     * property is read (using IVehicle#get) after IVehicle#set, it may still
+     * return old value until underlying H/W backing this property has actually
+     * changed the state. Once state is changed, the property must dispatch
+     * changed value as event.
+     */
+    ON_CHANGE = 0x01,
 
-  /**
-   * Property of this type change continuously and requires fixed rate of
-   * sampling to retrieve the data.
-   */
-  CONTINUOUS = 0x02,
-
-  /**
-   * Property of this type may be polled to get the current value.
-   */
-  POLL = 0x03,
-
-  /**
-   * This is for property where change event must be sent only when the
-   * value is set from external component. Normal value change must not trigger
-   * event. For example, clock property can send change event only when it is
-   * set, outside android, for case like user setting time or time getting
-   * update. There is no need to send it per every value change.
-   */
-  ON_SET = 0x04,
+    /**
+     * Properties of this type change continuously and require a fixed rate of
+     * sampling to retrieve the data.  Implementers may choose to send extra
+     * notifications on significant value changes.
+     */
+    CONTINUOUS = 0x02,
 };
 
 /**
@@ -2160,8 +2345,15 @@
     /** Property is available and behaving normally */
     AVAILABLE   = 0x00,
     /**
-     * Property is not available, for read and/or write.  This is a transient state, as the
-     *  property is expected to be available at a later time.
+     * A property in this state is not available for reading and writing.  This
+     * is a transient state that depends on the availability of the underlying
+     * implementation (e.g. hardware or driver). It MUST NOT be used to
+     * represent features that this vehicle is always incapable of.  A get() of
+     * a property in this state MAY return an undefined value, but MUST
+     * correctly describe its status as UNAVAILABLE A set() of a property in
+     * this state MAY return NOT_AVAILABLE. The HAL implementation MUST ignore
+     * the value of the status field when writing a property value coming from
+     * Android.
      */
     UNAVAILABLE = 0x01,
     /** There is an error with this property. */
@@ -2169,28 +2361,13 @@
 };
 
 /**
- * Car states.
- *
- * The driving states determine what features of the UI will be accessible.
- */
-enum VehicleDrivingStatus : int32_t {
-    UNRESTRICTED = 0x00,
-    NO_VIDEO = 0x01,
-    NO_KEYBOARD_INPUT = 0x02,
-    NO_VOICE_INPUT = 0x04,
-    NO_CONFIG = 0x08,
-    LIMIT_MESSAGE_LEN = 0x10,
-};
-
-/**
  * Various gears which can be selected by user and chosen in system.
  */
-enum VehicleGear: int32_t {
+enum VehicleGear : int32_t {
     GEAR_NEUTRAL = 0x0001,
     GEAR_REVERSE = 0x0002,
     GEAR_PARK = 0x0004,
     GEAR_DRIVE = 0x0008,
-    GEAR_LOW = 0x0010,
     GEAR_1 = 0x0010,
     GEAR_2 = 0x0020,
     GEAR_3 = 0x0040,
@@ -2203,27 +2380,6 @@
 };
 
 /**
- * Various zones in the car.
- *
- * Zones are used for Air Conditioning purposes and divide the car into physical
- * area zones.
- */
-enum VehicleAreaZone : int32_t {
-  ROW_1_LEFT = 0x00000001,
-  ROW_1_CENTER = 0x00000002,
-  ROW_1_RIGHT = 0x00000004,
-  ROW_2_LEFT = 0x00000010,
-  ROW_2_CENTER = 0x00000020,
-  ROW_2_RIGHT = 0x00000040,
-  ROW_3_LEFT = 0x00000100,
-  ROW_3_CENTER = 0x00000200,
-  ROW_3_RIGHT = 0x00000400,
-  ROW_4_LEFT = 0x00001000,
-  ROW_4_CENTER = 0x00002000,
-  ROW_4_RIGHT = 0x00004000,
-};
-
-/**
  * Various Seats in the car.
  */
 enum VehicleAreaSeat : int32_t {
@@ -2242,15 +2398,18 @@
  * Various windshields/windows in the car.
  */
 enum VehicleAreaWindow : int32_t {
-    FRONT_WINDSHIELD = 0x0001,
-    REAR_WINDSHIELD = 0x0002,
-    ROOF_TOP = 0x0004,
-    ROW_1_LEFT = 0x0010,
-    ROW_1_RIGHT = 0x0020,
-    ROW_2_LEFT = 0x0100,
-    ROW_2_RIGHT = 0x0200,
-    ROW_3_LEFT = 0x1000,
-    ROW_3_RIGHT = 0x2000,
+    FRONT_WINDSHIELD  = 0x00000001,
+    REAR_WINDSHIELD   = 0x00000002,
+    ROW_1_LEFT        = 0x00000010,
+    ROW_1_RIGHT       = 0x00000040,
+    ROW_2_LEFT        = 0x00000100,
+    ROW_2_RIGHT       = 0x00000400,
+    ROW_3_LEFT        = 0x00001000,
+    ROW_3_RIGHT       = 0x00004000,
+
+    ROOF_TOP_1        = 0x00010000,
+    ROOF_TOP_2        = 0x00020000,
+
 };
 
 enum VehicleAreaDoor : int32_t {
@@ -2274,7 +2433,6 @@
     NONE = 0x00,
     RIGHT = 0x01,
     LEFT = 0x02,
-    EMERGENCY = 0x04,
 };
 
 struct VehicleAreaConfig {
@@ -2348,9 +2506,6 @@
  * events.
  */
 struct VehiclePropValue {
-    /** Property identifier */
-    int32_t prop;
-
     /** Time is elapsed nanoseconds since boot */
     int64_t timestamp;
 
@@ -2360,6 +2515,9 @@
      */
     int32_t areaId;
 
+    /** Property identifier */
+    int32_t prop;
+
     /** Status of the property */
     VehiclePropertyStatus status;
 
@@ -2399,11 +2557,11 @@
     /** Steering wheel is locked */
     LOCK = 1,
 
-     /**
-      * Steering wheel is not locked, engine and all accessories are OFF. If
-      * car can be in LOCK and OFF state at the same time than HAL must report
-      * LOCK state.
-      */
+    /**
+     * Steering wheel is not locked, engine and all accessories are OFF. If
+     * car can be in LOCK and OFF state at the same time than HAL must report
+     * LOCK state.
+     */
     OFF,
 
     /**
@@ -2422,33 +2580,6 @@
     START
 };
 
-
-/**
- * Represent the operation where the current error has happened.
- */
-enum VehiclePropertyOperation : int32_t {
-    /**
-     * Generic error to this property which is not tied to any operation.
-     */
-    GENERIC = 0,
-
-    /**
-     * Error happened while handling property set.
-     */
-    SET = 1,
-
-    /**
-     * Error happened while handling property get.
-     */
-    GET = 2,
-
-    /**
-     * Error happened while handling property subscription.
-     */
-    SUBSCRIBE = 3,
-};
-
-
 enum SubscribeFlags : int32_t {
     UNDEFINED = 0x0,
 
@@ -2456,15 +2587,13 @@
      * Subscribe to event that was originated in vehicle HAL
      * (most likely this event came from the vehicle itself).
      */
-    HAL_EVENT = 0x1,
+    EVENTS_FROM_CAR = 0x1,
 
     /**
      * Use this flag to subscribe on events when IVehicle#set(...) was called by
      * vehicle HAL's client (e.g. Car Service).
      */
-    SET_CALL = 0x2,
-
-    DEFAULT = HAL_EVENT,
+    EVENTS_FROM_ANDROID = 0x2,
 };
 
 /**
@@ -2485,7 +2614,7 @@
      */
     float sampleRate;
 
-    /** Flags that indicate what kind of events listen to. */
+    /** Flags that indicate to which event sources to listen. */
     SubscribeFlags flags;
 };
 
@@ -2775,11 +2904,11 @@
     ACCELERATOR_PEDAL_POSITION_E = 54, /* PID 0x4A */
     ACCELERATOR_PEDAL_POSITION_F = 55, /* PID 0x4B */
     COMMANDED_THROTTLE_ACTUATOR = 56, /* PID 0x4C */
-    ETHANOL_FUEL_PERCENTAGE = 57,/* PID 0x52 */
+    ETHANOL_FUEL_PERCENTAGE = 57, /* PID 0x52 */
     ABSOLUTE_EVAPORATION_SYSTEM_VAPOR_PRESSURE = 58, /* PID 0x53 */
     SHORT_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK1 = 59, /* PID 0x55 */
     SHORT_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK2 = 60, /* PID 0x57 */
-    SHORT_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK3 = 61,/* PID 0x55 */
+    SHORT_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK3 = 61, /* PID 0x55 */
     SHORT_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK4 = 62, /* PID 0x57 */
     LONG_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK1 = 63, /* PID 0x56 */
     LONG_TERM_SECONDARY_OXYGEN_SENSOR_TRIM_BANK2 = 64, /* PID 0x58 */
@@ -3005,7 +3134,7 @@
  * - Layer version
  * - Number of publisher IDs (N)
  * - N x publisher ID
-*/
+ */
 enum VmsAvailabilityStateIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
     SEQUENCE_NUMBER = 1,
     NUMBER_OF_ASSOCIATED_LAYERS = 2,
diff --git a/broadcastradio/2.0/ITunerCallback.hal b/broadcastradio/2.0/ITunerCallback.hal
index ede8350..b20a0b2 100644
--- a/broadcastradio/2.0/ITunerCallback.hal
+++ b/broadcastradio/2.0/ITunerCallback.hal
@@ -17,12 +17,14 @@
 
 interface ITunerCallback {
     /**
-     * Method called by the HAL when a tuning operation fails
+     * Method called by the HAL when a tuning operation fails asynchronously
      * following a step(), scan() or tune() command.
      *
-     * @param result OK if tune succeeded;
-     *               TIMEOUT in case of time out.
-     * @param selector A ProgramSelector structure passed from tune(),
+     * This callback is only called when the step(), scan() or tune() command
+     * returned OK at first.
+     *
+     * @param result TIMEOUT in case of time out.
+     * @param selector A ProgramSelector structure passed from tune() call;
      *                 empty for step() and scan().
      */
     oneway onTuneFailed(Result result, ProgramSelector selector);
diff --git a/broadcastradio/2.0/types.hal b/broadcastradio/2.0/types.hal
index a9b9600..1ce61df 100644
--- a/broadcastradio/2.0/types.hal
+++ b/broadcastradio/2.0/types.hal
@@ -351,10 +351,16 @@
      * related content (i.e. DAB soft-links). This field is a list of pointers
      * to other programs on the program list.
      *
-     * Please note, that these identifiers does not have to exist on the program
+     * This is not a list of programs that carry the same content (i.e.
+     * DAB hard-links, RDS AF). Switching to programs from this list usually
+     * require user action.
+     *
+     * Please note, that these identifiers do not have to exist on the program
      * list - i.e. DAB tuner may provide information on FM RDS alternatives
      * despite not supporting FM RDS. If the system has multiple tuners, another
      * one may have it on its list.
+     *
+     * This field is optional (can be empty).
      */
     vec<ProgramIdentifier> relatedContent;
 
diff --git a/camera/device/3.2/default/CameraDeviceSession.cpp b/camera/device/3.2/default/CameraDeviceSession.cpp
index 5f89cde..60a57cd 100644
--- a/camera/device/3.2/default/CameraDeviceSession.cpp
+++ b/camera/device/3.2/default/CameraDeviceSession.cpp
@@ -645,7 +645,10 @@
                     result.fmqResultSize = result.result.size();
                     result.result.resize(0);
                 } else {
-                    ALOGW("%s: couldn't utilize fmq, fall back to hwbinder", __FUNCTION__);
+                    ALOGW("%s: couldn't utilize fmq, fall back to hwbinder, result size: %zu,"
+                    "shared message queue available size: %zu",
+                        __FUNCTION__, result.result.size(),
+                        mResultMetadataQueue->availableToWrite());
                     result.fmqResultSize = 0;
                 }
             }
diff --git a/camera/device/3.4/default/CameraDeviceSession.cpp b/camera/device/3.4/default/CameraDeviceSession.cpp
index ad7f6f5..550d65a 100644
--- a/camera/device/3.4/default/CameraDeviceSession.cpp
+++ b/camera/device/3.4/default/CameraDeviceSession.cpp
@@ -51,6 +51,32 @@
             }
         }
     }
+
+    camera_metadata_entry_t capabilities =
+            mDeviceInfo.find(ANDROID_REQUEST_AVAILABLE_CAPABILITIES);
+    bool isLogicalMultiCamera = false;
+    for (size_t i = 0; i < capabilities.count; i++) {
+        if (capabilities.data.u8[i] ==
+                ANDROID_REQUEST_AVAILABLE_CAPABILITIES_LOGICAL_MULTI_CAMERA) {
+            isLogicalMultiCamera = true;
+            break;
+        }
+    }
+    if (isLogicalMultiCamera) {
+        camera_metadata_entry entry =
+                mDeviceInfo.find(ANDROID_LOGICAL_MULTI_CAMERA_PHYSICAL_IDS);
+        const uint8_t* ids = entry.data.u8;
+        size_t start = 0;
+        for (size_t i = 0; i < entry.count; ++i) {
+            if (ids[i] == '\0') {
+                if (start != i) {
+                    const char* physicalId = reinterpret_cast<const char*>(ids+start);
+                    mPhysicalCameraIds.emplace(physicalId);
+                }
+                start = i + 1;
+            }
+        }
+    }
 }
 
 CameraDeviceSession::~CameraDeviceSession() {
@@ -456,9 +482,19 @@
         return;
     }
 
+    if (hal_result->num_physcam_metadata > d->mPhysicalCameraIds.size()) {
+        ALOGE("%s: Fatal: Invalid num_physcam_metadata %u", __FUNCTION__,
+                hal_result->num_physcam_metadata);
+        return;
+    }
     result.physicalCameraMetadata.resize(hal_result->num_physcam_metadata);
     for (uint32_t i = 0; i < hal_result->num_physcam_metadata; i++) {
         std::string physicalId = hal_result->physcam_ids[i];
+        if (d->mPhysicalCameraIds.find(physicalId) == d->mPhysicalCameraIds.end()) {
+            ALOGE("%s: Fatal: Invalid physcam_ids[%u]: %s", __FUNCTION__,
+                  i, hal_result->physcam_ids[i]);
+            return;
+        }
         V3_2::CameraMetadata physicalMetadata;
         V3_2::implementation::convertToHidl(hal_result->physcam_metadata[i], &physicalMetadata);
         PhysicalCameraMetadata physicalCameraMetadata = {
diff --git a/camera/device/3.4/default/ExternalCameraDevice.cpp b/camera/device/3.4/default/ExternalCameraDevice.cpp
index 6b05d4a..ee7ffaa 100644
--- a/camera/device/3.4/default/ExternalCameraDevice.cpp
+++ b/camera/device/3.4/default/ExternalCameraDevice.cpp
@@ -42,6 +42,9 @@
     V4L2_PIX_FMT_MJPEG
 }}; // double braces required in C++11
 
+constexpr int MAX_RETRY = 5; // Allow retry v4l2 open failures a few times.
+constexpr int OPEN_RETRY_SLEEP_US = 100000; // 100ms * MAX_RETRY = 0.5 seconds
+
 } // anonymous namespace
 
 ExternalCameraDevice::ExternalCameraDevice(
@@ -122,11 +125,22 @@
 
     unique_fd fd(::open(mCameraId.c_str(), O_RDWR));
     if (fd.get() < 0) {
-        ALOGE("%s: v4l2 device open %s failed: %s",
-                __FUNCTION__, mCameraId.c_str(), strerror(errno));
-        mLock.unlock();
-        _hidl_cb(Status::INTERNAL_ERROR, nullptr);
-        return Void();
+        int numAttempt = 0;
+        do {
+            ALOGW("%s: v4l2 device %s open failed, wait 33ms and try again",
+                    __FUNCTION__, mCameraId.c_str());
+            usleep(OPEN_RETRY_SLEEP_US); // sleep and try again
+            fd.reset(::open(mCameraId.c_str(), O_RDWR));
+            numAttempt++;
+        } while (fd.get() < 0 && numAttempt <= MAX_RETRY);
+
+        if (fd.get() < 0) {
+            ALOGE("%s: v4l2 device open %s failed: %s",
+                    __FUNCTION__, mCameraId.c_str(), strerror(errno));
+            mLock.unlock();
+            _hidl_cb(Status::INTERNAL_ERROR, nullptr);
+            return Void();
+        }
     }
 
     session = new ExternalCameraDeviceSession(
diff --git a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
index 7015bcb..1af3f39 100644
--- a/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/3.4/default/ExternalCameraDeviceSession.cpp
@@ -49,12 +49,14 @@
                                        // method
 constexpr int MAX_RETRY = 15; // Allow retry some ioctl failures a few times to account for some
                              // webcam showing temporarily ioctl failures.
-constexpr int IOCTL_RETRY_SLEEP_US = 33000; // 33ms * MAX_RETRY = 5 seconds
+constexpr int IOCTL_RETRY_SLEEP_US = 33000; // 33ms * MAX_RETRY = 0.5 seconds
+
+// Constants for tryLock during dumpstate
+static constexpr int kDumpLockRetries = 50;
+static constexpr int kDumpLockSleep = 60000;
 
 bool tryLock(Mutex& mutex)
 {
-    static const int kDumpLockRetries = 50;
-    static const int kDumpLockSleep = 60000;
     bool locked = false;
     for (int i = 0; i < kDumpLockRetries; ++i) {
         if (mutex.tryLock() == NO_ERROR) {
@@ -66,6 +68,19 @@
     return locked;
 }
 
+bool tryLock(std::mutex& mutex)
+{
+    bool locked = false;
+    for (int i = 0; i < kDumpLockRetries; ++i) {
+        if (mutex.try_lock()) {
+            locked = true;
+            break;
+        }
+        usleep(kDumpLockSleep);
+    }
+    return locked;
+}
+
 } // Anonymous namespace
 
 // Static instances
@@ -100,6 +115,35 @@
         return true;
     }
 
+    struct v4l2_capability capability;
+    int ret = ioctl(mV4l2Fd.get(), VIDIOC_QUERYCAP, &capability);
+    std::string make, model;
+    if (ret < 0) {
+        ALOGW("%s v4l2 QUERYCAP failed", __FUNCTION__);
+        make = "Generic UVC webcam";
+        model = "Generic UVC webcam";
+    } else {
+        // capability.card is UTF-8 encoded
+        char card[32];
+        int j = 0;
+        for (int i = 0; i < 32; i++) {
+            if (capability.card[i] < 128) {
+                card[j++] = capability.card[i];
+            }
+            if (capability.card[i] == '\0') {
+                break;
+            }
+        }
+        if (j == 0 || card[j - 1] != '\0') {
+            make = "Generic UVC webcam";
+            model = "Generic UVC webcam";
+        } else {
+            make = card;
+            model = card;
+        }
+    }
+    mOutputThread->setExifMakeModel(make, model);
+
     status_t status = initDefaultRequests();
     if (status != OK) {
         ALOGE("%s: init default requests failed!", __FUNCTION__);
@@ -163,7 +207,6 @@
     bool streaming = false;
     size_t v4L2BufferCount = 0;
     SupportedV4L2Format streamingFmt;
-    std::unordered_set<uint32_t>  inflightFrames;
     {
         bool sessionLocked = tryLock(mLock);
         if (!sessionLocked) {
@@ -172,12 +215,25 @@
         streaming = mV4l2Streaming;
         streamingFmt = mV4l2StreamingFmt;
         v4L2BufferCount = mV4L2BufferCount;
-        inflightFrames = mInflightFrames;
+
         if (sessionLocked) {
             mLock.unlock();
         }
     }
 
+    std::unordered_set<uint32_t>  inflightFrames;
+    {
+        bool iffLocked = tryLock(mInflightFramesLock);
+        if (!iffLocked) {
+            dprintf(fd,
+                    "!! ExternalCameraDeviceSession mInflightFramesLock may be deadlocked !!\n");
+        }
+        inflightFrames = mInflightFrames;
+        if (iffLocked) {
+            mInflightFramesLock.unlock();
+        }
+    }
+
     dprintf(fd, "External camera %s V4L2 FD %d, cropping type %s, %s\n",
             mCameraId.c_str(), mV4l2Fd.get(),
             (mCroppingType == VERTICAL) ? "vertical" : "horizontal",
@@ -457,6 +513,7 @@
 }
 
 int ExternalCameraDeviceSession::waitForV4L2BufferReturnLocked(std::unique_lock<std::mutex>& lk) {
+    ATRACE_CALL();
     std::chrono::seconds timeout = std::chrono::seconds(kBufferWaitTimeoutSec);
     mLock.unlock();
     auto st = mV4L2BufferReturned.wait_for(lk, timeout);
@@ -612,7 +669,10 @@
         halBuf.acquireFence = allFences[i];
         halBuf.fenceTimeout = false;
     }
-    mInflightFrames.insert(halReq->frameNumber);
+    {
+        std::lock_guard<std::mutex> lk(mInflightFramesLock);
+        mInflightFrames.insert(halReq->frameNumber);
+    }
     // Send request to OutputThread for the rest of processing
     mOutputThread->submitRequest(halReq);
     mFirstRequest = false;
@@ -670,7 +730,7 @@
 
     // update inflight records
     {
-        Mutex::Autolock _l(mLock);
+        std::lock_guard<std::mutex> lk(mInflightFramesLock);
         mInflightFrames.erase(req->frameNumber);
     }
 
@@ -724,7 +784,7 @@
 
     // update inflight records
     {
-        Mutex::Autolock _l(mLock);
+        std::lock_guard<std::mutex> lk(mInflightFramesLock);
         mInflightFrames.erase(req->frameNumber);
     }
 
@@ -795,6 +855,12 @@
 
 ExternalCameraDeviceSession::OutputThread::~OutputThread() {}
 
+void ExternalCameraDeviceSession::OutputThread::setExifMakeModel(
+        const std::string& make, const std::string& model) {
+    mExifMake = make;
+    mExifModel = model;
+}
+
 uint32_t ExternalCameraDeviceSession::OutputThread::getFourCcFromLayout(
         const YCbCrLayout& layout) {
     intptr_t cb = reinterpret_cast<intptr_t>(layout.cb);
@@ -1580,6 +1646,8 @@
     utils->initialize();
 
     utils->setFromMetadata(meta, jpegSize.width, jpegSize.height);
+    utils->setMake(mExifMake);
+    utils->setModel(mExifModel);
 
     ret = utils->generateApp1(outputThumbnail ? &thumbCode[0] : 0, thumbCodeSize);
 
@@ -2119,7 +2187,7 @@
         int numAttempt = 0;
         while (ret < 0) {
             ALOGW("%s: VIDIOC_S_FMT failed, wait 33ms and try again", __FUNCTION__);
-            usleep(IOCTL_RETRY_SLEEP_US); // sleep 100 ms and try again
+            usleep(IOCTL_RETRY_SLEEP_US); // sleep and try again
             ret = TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_S_FMT, &fmt));
             if (numAttempt == MAX_RETRY) {
                 break;
@@ -2149,6 +2217,13 @@
     }
     uint32_t bufferSize = fmt.fmt.pix.sizeimage;
     ALOGI("%s: V4L2 buffer size is %d", __FUNCTION__, bufferSize);
+    uint32_t expectedMaxBufferSize = kMaxBytesPerPixel * fmt.fmt.pix.width * fmt.fmt.pix.height;
+    if ((bufferSize == 0) || (bufferSize > expectedMaxBufferSize)) {
+        ALOGE("%s: V4L2 buffer size: %u looks invalid. Expected maximum size: %u", __FUNCTION__,
+                bufferSize, expectedMaxBufferSize);
+        return -EINVAL;
+    }
+    mMaxV4L2BufferSize = bufferSize;
 
     const double kDefaultFps = 30.0;
     double fps = 1000.0;
@@ -2278,6 +2353,7 @@
         }
     }
 
+    ATRACE_BEGIN("VIDIOC_DQBUF");
     v4l2_buffer buffer{};
     buffer.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
     buffer.memory = V4L2_MEMORY_MMAP;
@@ -2285,6 +2361,7 @@
         ALOGE("%s: DQBUF fails: %s", __FUNCTION__, strerror(errno));
         return ret;
     }
+    ATRACE_END();
 
     if (buffer.index >= mV4L2BufferCount) {
         ALOGE("%s: Invalid buffer id: %d", __FUNCTION__, buffer.index);
@@ -2296,6 +2373,12 @@
         // TODO: try to dequeue again
     }
 
+    if (buffer.bytesused > mMaxV4L2BufferSize) {
+        ALOGE("%s: v4l2 buffer bytes used: %u maximum %u", __FUNCTION__, buffer.bytesused,
+                mMaxV4L2BufferSize);
+        return ret;
+    }
+
     if (buffer.flags & V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC) {
         // Ideally we should also check for V4L2_BUF_FLAG_TSTAMP_SRC_SOE, but
         // even V4L2_BUF_FLAG_TSTAMP_SRC_EOF is better than capture a timestamp now
@@ -2316,21 +2399,18 @@
 
 void ExternalCameraDeviceSession::enqueueV4l2Frame(const sp<V4L2Frame>& frame) {
     ATRACE_CALL();
-    {
-        // Release mLock before acquiring mV4l2BufferLock to avoid potential
-        // deadlock
-        Mutex::Autolock _l(mLock);
-        frame->unmap();
-        v4l2_buffer buffer{};
-        buffer.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-        buffer.memory = V4L2_MEMORY_MMAP;
-        buffer.index = frame->mBufferIndex;
-        if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_QBUF, &buffer)) < 0) {
-            ALOGE("%s: QBUF index %d fails: %s", __FUNCTION__,
-                    frame->mBufferIndex, strerror(errno));
-            return;
-        }
+    frame->unmap();
+    ATRACE_BEGIN("VIDIOC_QBUF");
+    v4l2_buffer buffer{};
+    buffer.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+    buffer.memory = V4L2_MEMORY_MMAP;
+    buffer.index = frame->mBufferIndex;
+    if (TEMP_FAILURE_RETRY(ioctl(mV4l2Fd.get(), VIDIOC_QBUF, &buffer)) < 0) {
+        ALOGE("%s: QBUF index %d fails: %s", __FUNCTION__,
+                frame->mBufferIndex, strerror(errno));
+        return;
     }
+    ATRACE_END();
 
     {
         std::lock_guard<std::mutex> lk(mV4l2BufferLock);
@@ -2383,13 +2463,17 @@
         return status;
     }
 
-    Mutex::Autolock _l(mLock);
-    if (!mInflightFrames.empty()) {
-        ALOGE("%s: trying to configureStreams while there are still %zu inflight frames!",
-                __FUNCTION__, mInflightFrames.size());
-        return Status::INTERNAL_ERROR;
+
+    {
+        std::lock_guard<std::mutex> lk(mInflightFramesLock);
+        if (!mInflightFrames.empty()) {
+            ALOGE("%s: trying to configureStreams while there are still %zu inflight frames!",
+                    __FUNCTION__, mInflightFrames.size());
+            return Status::INTERNAL_ERROR;
+        }
     }
 
+    Mutex::Autolock _l(mLock);
     // Add new streams
     for (const auto& stream : config.streams) {
         if (mStreamMap.count(stream.id) == 0) {
@@ -2689,14 +2773,17 @@
     const uint8_t ae_lock = ANDROID_CONTROL_AE_LOCK_OFF;
     UPDATE(md, ANDROID_CONTROL_AE_LOCK, &ae_lock, 1);
 
-    bool afTrigger = mAfTrigger;
-    if (md.exists(ANDROID_CONTROL_AF_TRIGGER)) {
-        Mutex::Autolock _l(mLock);
-        camera_metadata_entry entry = md.find(ANDROID_CONTROL_AF_TRIGGER);
-        if (entry.data.u8[0] == ANDROID_CONTROL_AF_TRIGGER_START) {
-            mAfTrigger = afTrigger = true;
-        } else if (entry.data.u8[0] == ANDROID_CONTROL_AF_TRIGGER_CANCEL) {
-            mAfTrigger = afTrigger = false;
+    bool afTrigger = false;
+    {
+        std::lock_guard<std::mutex> lk(mAfTriggerLock);
+        afTrigger = mAfTrigger;
+        if (md.exists(ANDROID_CONTROL_AF_TRIGGER)) {
+            camera_metadata_entry entry = md.find(ANDROID_CONTROL_AF_TRIGGER);
+            if (entry.data.u8[0] == ANDROID_CONTROL_AF_TRIGGER_START) {
+                mAfTrigger = afTrigger = true;
+            } else if (entry.data.u8[0] == ANDROID_CONTROL_AF_TRIGGER_CANCEL) {
+                mAfTrigger = afTrigger = false;
+            }
         }
     }
 
diff --git a/camera/device/3.4/default/include/device_v3_4_impl/CameraDeviceSession.h b/camera/device/3.4/default/include/device_v3_4_impl/CameraDeviceSession.h
index 6e90ed4..5d6a112 100644
--- a/camera/device/3.4/default/include/device_v3_4_impl/CameraDeviceSession.h
+++ b/camera/device/3.4/default/include/device_v3_4_impl/CameraDeviceSession.h
@@ -27,6 +27,7 @@
 #include <hidl/Status.h>
 #include <deque>
 #include <map>
+#include <unordered_set>
 #include <unordered_map>
 #include "CameraMetadata.h"
 #include "HandleImporter.h"
@@ -110,6 +111,10 @@
 
     // Whether this camera device session is created with version 3.4 callback.
     bool mHasCallback_3_4;
+
+    // Physical camera ids for the logical multi-camera. Empty if this
+    // is not a logical multi-camera.
+    std::unordered_set<std::string> mPhysicalCameraIds;
 private:
 
     struct TrampolineSessionInterface_3_4 : public ICameraDeviceSession {
diff --git a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
index 5315097..0b94c11 100644
--- a/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
+++ b/camera/device/3.4/default/include/ext_device_v3_4_impl/ExternalCameraDeviceSession.h
@@ -108,6 +108,7 @@
 
     static const int kMaxProcessedStream = 2;
     static const int kMaxStallStream = 1;
+    static const uint32_t kMaxBytesPerPixel = 2;
 
 protected:
 
@@ -230,6 +231,7 @@
         void dump(int fd);
         virtual bool threadLoop() override;
 
+        void setExifMakeModel(const std::string& make, const std::string& model);
     private:
         static const uint32_t FLEX_YUV_GENERIC = static_cast<uint32_t>('F') |
                 static_cast<uint32_t>('L') << 8 | static_cast<uint32_t>('E') << 16 |
@@ -287,6 +289,9 @@
         std::unordered_map<Size, sp<AllocatedFrame>, SizeHasher> mScaledYu12Frames;
         YCbCrLayout mYu12FrameLayout;
         YCbCrLayout mYu12ThumbFrameLayout;
+
+        std::string mExifMake;
+        std::string mExifModel;
     };
 
     // Protect (most of) HIDL interface methods from synchronized-entering
@@ -299,6 +304,9 @@
     const std::vector<SupportedV4L2Format> mSupportedFormats;
     const CroppingType mCroppingType;
     const std::string& mCameraId;
+
+    // Not protected by mLock, this is almost a const.
+    // Setup in constructor, reset in close() after OutputThread is joined
     unique_fd mV4l2Fd;
 
     // device is closed either
@@ -319,12 +327,15 @@
     std::mutex mV4l2BufferLock; // protect the buffer count and condition below
     std::condition_variable mV4L2BufferReturned;
     size_t mNumDequeuedV4l2Buffers = 0;
+    uint32_t mMaxV4L2BufferSize = 0;
 
     // Not protected by mLock (but might be used when mLock is locked)
     sp<OutputThread> mOutputThread;
 
     // Stream ID -> Camera3Stream cache
     std::unordered_map<int, Stream> mStreamMap;
+
+    std::mutex mInflightFramesLock; // protect mInflightFrames
     std::unordered_set<uint32_t>  mInflightFrames;
 
     // buffers currently circulating between HAL and camera service
@@ -336,6 +347,7 @@
     // Stream ID -> circulating buffers map
     std::map<int, CirculatingBuffers> mCirculatingBuffers;
 
+    std::mutex mAfTriggerLock; // protect mAfTrigger
     bool mAfTrigger = false;
 
     static HandleImporter sHandleImporter;
diff --git a/camera/provider/2.4/default/ExternalCameraProvider.cpp b/camera/provider/2.4/default/ExternalCameraProvider.cpp
index 285e96b..a4046d0 100644
--- a/camera/provider/2.4/default/ExternalCameraProvider.cpp
+++ b/camera/provider/2.4/default/ExternalCameraProvider.cpp
@@ -164,29 +164,35 @@
 }
 
 void ExternalCameraProvider::deviceAdded(const char* devName) {
-    int fd = -1;
-    if ((fd = ::open(devName, O_RDWR)) < 0) {
-        ALOGE("%s open v4l2 device %s failed:%s", __FUNCTION__, devName, strerror(errno));
-        return;
-    }
+    {
+        base::unique_fd fd(::open(devName, O_RDWR));
+        if (fd.get() < 0) {
+            ALOGE("%s open v4l2 device %s failed:%s", __FUNCTION__, devName, strerror(errno));
+            return;
+        }
 
-    do {
         struct v4l2_capability capability;
-        int ret = ioctl(fd, VIDIOC_QUERYCAP, &capability);
+        int ret = ioctl(fd.get(), VIDIOC_QUERYCAP, &capability);
         if (ret < 0) {
             ALOGE("%s v4l2 QUERYCAP %s failed", __FUNCTION__, devName);
-            break;
+            return;
         }
 
         if (!(capability.device_caps & V4L2_CAP_VIDEO_CAPTURE)) {
             ALOGW("%s device %s does not support VIDEO_CAPTURE", __FUNCTION__, devName);
-            break;
+            return;
         }
+    }
+    // See if we can initialize ExternalCameraDevice correctly
+    sp<device::V3_4::implementation::ExternalCameraDevice> deviceImpl =
+            new device::V3_4::implementation::ExternalCameraDevice(devName, mCfg);
+    if (deviceImpl == nullptr || deviceImpl->isInitFailed()) {
+        ALOGW("%s: Attempt to init camera device %s failed!", __FUNCTION__, devName);
+        return;
+    }
+    deviceImpl.clear();
 
-        addExternalCamera(devName);
-    } while (0);
-
-    close(fd);
+    addExternalCamera(devName);
     return;
 }
 
diff --git a/camera/provider/2.4/vts/functional/Android.bp b/camera/provider/2.4/vts/functional/Android.bp
index 08b9222..ead4083 100644
--- a/camera/provider/2.4/vts/functional/Android.bp
+++ b/camera/provider/2.4/vts/functional/Android.bp
@@ -38,8 +38,11 @@
         "android.hardware.camera.device@3.3",
         "android.hardware.camera.device@3.4",
         "android.hardware.camera.provider@2.4",
+        "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.common@1.0",
         "android.hardware.graphics.mapper@2.0",
+        "android.hidl.allocator@1.0",
         "libgrallocusage",
+        "libhidlmemory",
     ],
 }
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index 5feec87..637e280 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -48,6 +48,13 @@
 #include <system/camera_metadata.h>
 #include <ui/GraphicBuffer.h>
 
+#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
+#include <android/hardware/graphics/mapper/2.0/IMapper.h>
+#include <android/hardware/graphics/mapper/2.0/types.h>
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <android/hidl/memory/1.0/IMapper.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+
 #include <VtsHalHidlTargetTestBase.h>
 #include <VtsHalHidlTargetTestEnvBase.h>
 
@@ -105,6 +112,9 @@
 using ::android::hardware::camera::device::V1_0::HandleTimestampMessage;
 using ::android::hardware::MessageQueue;
 using ::android::hardware::kSynchronizedReadWrite;
+using ::android::hidl::allocator::V1_0::IAllocator;
+using ::android::hidl::memory::V1_0::IMemory;
+using ::android::hidl::memory::V1_0::IMapper;
 using ResultMetadataQueue = MessageQueue<uint8_t, kSynchronizedReadWrite>;
 using ::android::hidl::manager::V1_0::IServiceManager;
 
@@ -621,6 +631,8 @@
     void setParameters(
             const sp<::android::hardware::camera::device::V1_0::ICameraDevice> &device,
             const CameraParameters &cameraParams);
+    void allocateGraphicBuffer(uint32_t width, uint32_t height, uint64_t usage,
+            PixelFormat format, hidl_handle *buffer_handle /*out*/);
     void waitForFrameLocked(DataCallbackMsg msgFrame,
             std::unique_lock<std::mutex> &l);
     void openEmptyDeviceSession(const std::string &name,
@@ -3297,15 +3309,15 @@
                                                        });
         ASSERT_TRUE(ret.isOk());
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
-        ASSERT_NE(nullptr, gb.get());
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
+
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -3497,20 +3509,20 @@
         InFlightRequest inflightReq = {static_cast<ssize_t> (halStreamConfig.streams.size()), false,
             supportsPartialResults, partialResultCount, resultQueue};
 
-        std::vector<sp<GraphicBuffer>> graphicBuffers;
+        std::vector<hidl_handle> graphicBuffers;
         graphicBuffers.reserve(halStreamConfig.streams.size());
         ::android::hardware::hidl_vec<StreamBuffer> outputBuffers;
         outputBuffers.resize(halStreamConfig.streams.size());
         size_t k = 0;
         for (const auto& halStream : halStreamConfig.streams) {
-            sp<GraphicBuffer> gb = new GraphicBuffer(previewStream.width, previewStream.height,
-                    static_cast<int32_t>(halStream.v3_3.v3_2.overrideFormat), 1,
-                    android_convertGralloc1To0Usage(
-                        halStream.v3_3.v3_2.producerUsage, halStream.v3_3.v3_2.consumerUsage));
-            ASSERT_NE(nullptr, gb.get());
-            graphicBuffers.push_back(gb);
-            outputBuffers[k] = {halStream.v3_3.v3_2.id, bufferId,
-                hidl_handle(gb->getNativeBuffer()->handle), BufferStatus::OK, nullptr, nullptr};
+            hidl_handle buffer_handle;
+            allocateGraphicBuffer(previewStream.width, previewStream.height,
+                    android_convertGralloc1To0Usage(halStream.v3_3.v3_2.producerUsage,
+                        halStream.v3_3.v3_2.consumerUsage),
+                    halStream.v3_3.v3_2.overrideFormat, &buffer_handle);
+            graphicBuffers.push_back(buffer_handle);
+            outputBuffers[k] = {halStream.v3_3.v3_2.id, bufferId, buffer_handle,
+                BufferStatus::OK, nullptr, nullptr};
             bufferId++;
             k++;
         }
@@ -3689,7 +3701,7 @@
 
         ::android::hardware::camera::common::V1_0::helper::CameraMetadata requestMeta;
         StreamBuffer emptyInputBuffer = {-1, 0, nullptr, BufferStatus::ERROR, nullptr, nullptr};
-        sp<GraphicBuffer> buffers[kBurstFrameCount];
+        hidl_handle buffers[kBurstFrameCount];
         StreamBuffer outputBuffers[kBurstFrameCount];
         CaptureRequest requests[kBurstFrameCount];
         InFlightRequest inflightReqs[kBurstFrameCount];
@@ -3699,15 +3711,13 @@
             std::unique_lock<std::mutex> l(mLock);
 
             isoValues[i] = ((i % 2) == 0) ? isoRange.data.i32[0] : isoRange.data.i32[1];
-            buffers[i] = new GraphicBuffer( previewStream.width, previewStream.height,
-                static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-                android_convertGralloc1To0Usage( halStreamConfig.streams[0].producerUsage,
-                    halStreamConfig.streams[0].consumerUsage));
-            ASSERT_NE(nullptr, buffers[i].get());
+            allocateGraphicBuffer(previewStream.width, previewStream.height,
+                    android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                        halStreamConfig.streams[0].consumerUsage),
+                    halStreamConfig.streams[0].overrideFormat, &buffers[i]);
 
             outputBuffers[i] = {halStreamConfig.streams[0].id, bufferId + i,
-                hidl_handle( buffers[i]->getNativeBuffer()->handle), BufferStatus::OK, nullptr,
-                nullptr};
+                buffers[i], BufferStatus::OK, nullptr, nullptr};
             requestMeta.append(reinterpret_cast<camera_metadata_t *> (settings.data()));
 
             // Disable all 3A routines
@@ -3795,15 +3805,15 @@
                 &supportsPartialResults /*out*/,
                 &partialResultCount /*out*/);
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
 
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -3953,15 +3963,15 @@
                                                        });
         ASSERT_TRUE(ret.isOk());
 
-        sp<GraphicBuffer> gb = new GraphicBuffer(
-            previewStream.width, previewStream.height,
-            static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat), 1,
-            android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
-                                            halStreamConfig.streams[0].consumerUsage));
-        ASSERT_NE(nullptr, gb.get());
+        hidl_handle buffer_handle;
+        allocateGraphicBuffer(previewStream.width, previewStream.height,
+                android_convertGralloc1To0Usage(halStreamConfig.streams[0].producerUsage,
+                    halStreamConfig.streams[0].consumerUsage),
+                halStreamConfig.streams[0].overrideFormat, &buffer_handle);
+
         StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                                      bufferId,
-                                     hidl_handle(gb->getNativeBuffer()->handle),
+                                     buffer_handle,
                                      BufferStatus::OK,
                                      nullptr,
                                      nullptr};
@@ -4794,6 +4804,44 @@
     ASSERT_EQ(Status::OK, returnStatus);
 }
 
+void CameraHidlTest::allocateGraphicBuffer(uint32_t width, uint32_t height, uint64_t usage,
+        PixelFormat format, hidl_handle *buffer_handle /*out*/) {
+    ASSERT_NE(buffer_handle, nullptr);
+
+    sp<android::hardware::graphics::allocator::V2_0::IAllocator> allocator =
+        android::hardware::graphics::allocator::V2_0::IAllocator::getService();
+    ASSERT_NE(nullptr, allocator.get());
+
+    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper =
+        android::hardware::graphics::mapper::V2_0::IMapper::getService();
+    ASSERT_NE(mapper.get(), nullptr);
+
+    android::hardware::graphics::mapper::V2_0::IMapper::BufferDescriptorInfo descriptorInfo {};
+    descriptorInfo.width = width;
+    descriptorInfo.height = height;
+    descriptorInfo.layerCount = 1;
+    descriptorInfo.format = format;
+    descriptorInfo.usage = usage;
+
+    ::android::hardware::hidl_vec<uint32_t> descriptor;
+    auto ret = mapper->createDescriptor(
+        descriptorInfo, [&descriptor](android::hardware::graphics::mapper::V2_0::Error err,
+                            ::android::hardware::hidl_vec<uint32_t> desc) {
+            ASSERT_EQ(err, android::hardware::graphics::mapper::V2_0::Error::NONE);
+            descriptor = desc;
+        });
+    ASSERT_TRUE(ret.isOk());
+
+    ret = allocator->allocate(descriptor, 1u,
+        [&](android::hardware::graphics::mapper::V2_0::Error err, uint32_t /*stride*/,
+            const ::android::hardware::hidl_vec<::android::hardware::hidl_handle>& buffers) {
+            ASSERT_EQ(android::hardware::graphics::mapper::V2_0::Error::NONE, err);
+            ASSERT_EQ(buffers.size(), 1u);
+            *buffer_handle = buffers[0];
+        });
+    ASSERT_TRUE(ret.isOk());
+}
+
 int main(int argc, char **argv) {
   ::testing::AddGlobalTestEnvironment(CameraHidlEnvironment::Instance());
   ::testing::InitGoogleTest(&argc, argv);
diff --git a/cas/1.0/default/CasImpl.cpp b/cas/1.0/default/CasImpl.cpp
index 2ac1c4f..178020e 100644
--- a/cas/1.0/default/CasImpl.cpp
+++ b/cas/1.0/default/CasImpl.cpp
@@ -31,19 +31,8 @@
 namespace V1_0 {
 namespace implementation {
 
-struct CasImpl::PluginHolder : public RefBase {
-public:
-    explicit PluginHolder(CasPlugin *plugin) : mPlugin(plugin) {}
-    ~PluginHolder() { if (mPlugin != NULL) delete mPlugin; }
-    CasPlugin* get() { return mPlugin; }
-
-private:
-    CasPlugin *mPlugin;
-    DISALLOW_EVIL_CONSTRUCTORS(PluginHolder);
-};
-
 CasImpl::CasImpl(const sp<ICasListener> &listener)
-    : mPluginHolder(NULL), mListener(listener) {
+    : mListener(listener) {
     ALOGV("CTOR");
 }
 
@@ -69,7 +58,8 @@
 
 void CasImpl::init(const sp<SharedLibrary>& library, CasPlugin *plugin) {
     mLibrary = library;
-    mPluginHolder = new PluginHolder(plugin);
+    std::shared_ptr<CasPlugin> holder(plugin);
+    std::atomic_store(&mPluginHolder, holder);
 }
 
 void CasImpl::onEvent(
@@ -88,22 +78,22 @@
 
 Return<Status> CasImpl::setPrivateData(const HidlCasData& pvtData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->setPrivateData(pvtData));
+    return toStatus(holder->setPrivateData(pvtData));
 }
 
 Return<void> CasImpl::openSession(openSession_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
     CasSessionId sessionId;
 
-    sp<PluginHolder> holder = mPluginHolder;
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
     status_t err = INVALID_OPERATION;
-    if (holder != NULL) {
-        err = holder->get()->openSession(&sessionId);
-        holder.clear();
+    if (holder.get() != nullptr) {
+        err = holder->openSession(&sessionId);
+        holder.reset();
     }
 
     _hidl_cb(toStatus(err), sessionId);
@@ -115,87 +105,87 @@
         const HidlCasSessionId &sessionId, const HidlCasData& pvtData) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(
-            holder->get()->setSessionPrivateData(
-                    sessionId, pvtData));
+    return toStatus(holder->setSessionPrivateData(sessionId, pvtData));
 }
 
 Return<Status> CasImpl::closeSession(const HidlCasSessionId &sessionId) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
-    return toStatus(holder->get()->closeSession(sessionId));
+    return toStatus(holder->closeSession(sessionId));
 }
 
 Return<Status> CasImpl::processEcm(
         const HidlCasSessionId &sessionId, const HidlCasData& ecm) {
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEcm(sessionId, ecm));
+    return toStatus(holder->processEcm(sessionId, ecm));
 }
 
 Return<Status> CasImpl::processEmm(const HidlCasData& emm) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->processEmm(emm));
+    return toStatus(holder->processEmm(emm));
 }
 
 Return<Status> CasImpl::sendEvent(
         int32_t event, int32_t arg,
         const HidlCasData& eventData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->sendEvent(event, arg, eventData);
+    status_t err = holder->sendEvent(event, arg, eventData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::provision(const hidl_string& provisionString) {
     ALOGV("%s: provisionString=%s", __FUNCTION__, provisionString.c_str());
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    return toStatus(holder->get()->provision(String8(provisionString.c_str())));
+    return toStatus(holder->provision(String8(provisionString.c_str())));
 }
 
 Return<Status> CasImpl::refreshEntitlements(
         int32_t refreshType,
         const HidlCasData& refreshData) {
     ALOGV("%s", __FUNCTION__);
-    sp<PluginHolder> holder = mPluginHolder;
-    if (holder == NULL) {
+    std::shared_ptr<CasPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
         return toStatus(INVALID_OPERATION);
     }
 
-    status_t err = holder->get()->refreshEntitlements(refreshType, refreshData);
+    status_t err = holder->refreshEntitlements(refreshType, refreshData);
     return toStatus(err);
 }
 
 Return<Status> CasImpl::release() {
-    ALOGV("%s: plugin=%p", __FUNCTION__,
-            mPluginHolder != NULL ? mPluginHolder->get() : NULL);
-    mPluginHolder.clear();
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
+
+    std::shared_ptr<CasPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
+
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/CasImpl.h b/cas/1.0/default/CasImpl.h
index 841d64e..d792838 100644
--- a/cas/1.0/default/CasImpl.h
+++ b/cas/1.0/default/CasImpl.h
@@ -88,7 +88,7 @@
 private:
     struct PluginHolder;
     sp<SharedLibrary> mLibrary;
-    sp<PluginHolder> mPluginHolder;
+    std::shared_ptr<CasPlugin> mPluginHolder;
     sp<ICasListener> mListener;
 
     DISALLOW_EVIL_CONSTRUCTORS(CasImpl);
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp
index 36699ba..1f89933 100644
--- a/cas/1.0/default/DescramblerImpl.cpp
+++ b/cas/1.0/default/DescramblerImpl.cpp
@@ -50,12 +50,12 @@
 
 DescramblerImpl::DescramblerImpl(
         const sp<SharedLibrary>& library, DescramblerPlugin *plugin) :
-        mLibrary(library), mPlugin(plugin) {
-    ALOGV("CTOR: mPlugin=%p", mPlugin);
+        mLibrary(library), mPluginHolder(plugin) {
+    ALOGV("CTOR: plugin=%p", mPluginHolder.get());
 }
 
 DescramblerImpl::~DescramblerImpl() {
-    ALOGV("DTOR: mPlugin=%p", mPlugin);
+    ALOGV("DTOR: plugin=%p", mPluginHolder.get());
     release();
 }
 
@@ -63,12 +63,22 @@
     ALOGV("%s: sessionId=%s", __FUNCTION__,
             sessionIdToString(sessionId).string());
 
-    return toStatus(mPlugin->setMediaCasSession(sessionId));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->setMediaCasSession(sessionId));
 }
 
 Return<bool> DescramblerImpl::requiresSecureDecoderComponent(
         const hidl_string& mime) {
-    return mPlugin->requiresSecureDecoderComponent(String8(mime.c_str()));
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        return false;
+    }
+
+    return holder->requiresSecureDecoderComponent(String8(mime.c_str()));
 }
 
 static inline bool validateRangeForSize(
@@ -86,12 +96,23 @@
         descramble_cb _hidl_cb) {
     ALOGV("%s", __FUNCTION__);
 
+    // Get a local copy of the shared_ptr for the plugin. Note that before
+    // calling the HIDL callback, this shared_ptr must be manually reset,
+    // since the client side could proceed as soon as the callback is called
+    // without waiting for this method to go out of scope.
+    std::shared_ptr<DescramblerPlugin> holder = std::atomic_load(&mPluginHolder);
+    if (holder.get() == nullptr) {
+        _hidl_cb(toStatus(INVALID_OPERATION), 0, NULL);
+        return Void();
+    }
+
     sp<IMemory> srcMem = mapMemory(srcBuffer.heapBase);
 
     // Validate if the offset and size in the SharedBuffer is consistent with the
     // mapped ashmem, since the offset and size is controlled by client.
     if (srcMem == NULL) {
         ALOGE("Failed to map src buffer.");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -100,6 +121,7 @@
         ALOGE("Invalid src buffer range: offset %llu, size %llu, srcMem size %llu",
                 srcBuffer.offset, srcBuffer.size, (uint64_t)srcMem->getSize());
         android_errorWriteLog(0x534e4554, "67962232");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -117,6 +139,7 @@
                 "srcOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu",
                 srcOffset, totalBytesInSubSamples, srcBuffer.size);
         android_errorWriteLog(0x534e4554, "67962232");
+        holder.reset();
         _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
         return Void();
     }
@@ -135,6 +158,7 @@
                     "dstOffset %llu, totalBytesInSubSamples %llu, srcBuffer size %llu",
                     dstOffset, totalBytesInSubSamples, srcBuffer.size);
             android_errorWriteLog(0x534e4554, "67962232");
+            holder.reset();
             _hidl_cb(toStatus(BAD_VALUE), 0, NULL);
             return Void();
         }
@@ -146,7 +170,7 @@
     // Casting hidl SubSample to DescramblerPlugin::SubSample, but need
     // to ensure structs are actually idential
 
-    int32_t result = mPlugin->descramble(
+    int32_t result = holder->descramble(
             dstBuffer.type != BufferType::SHARED_MEMORY,
             (DescramblerPlugin::ScramblingControl)scramblingControl,
             subSamples.size(),
@@ -157,17 +181,17 @@
             dstOffset,
             NULL);
 
+    holder.reset();
     _hidl_cb(toStatus(result >= 0 ? OK : result), result, NULL);
     return Void();
 }
 
 Return<Status> DescramblerImpl::release() {
-    ALOGV("%s: mPlugin=%p", __FUNCTION__, mPlugin);
+    ALOGV("%s: plugin=%p", __FUNCTION__, mPluginHolder.get());
 
-    if (mPlugin != NULL) {
-        delete mPlugin;
-        mPlugin = NULL;
-    }
+    std::shared_ptr<DescramblerPlugin> holder(nullptr);
+    std::atomic_store(&mPluginHolder, holder);
+
     return Status::OK;
 }
 
diff --git a/cas/1.0/default/DescramblerImpl.h b/cas/1.0/default/DescramblerImpl.h
index d3b146e..305f115 100644
--- a/cas/1.0/default/DescramblerImpl.h
+++ b/cas/1.0/default/DescramblerImpl.h
@@ -55,7 +55,7 @@
 
 private:
     sp<SharedLibrary> mLibrary;
-    DescramblerPlugin *mPlugin;
+    std::shared_ptr<DescramblerPlugin> mPluginHolder;
 
     DISALLOW_EVIL_CONSTRUCTORS(DescramblerImpl);
 };
diff --git a/cas/1.0/default/MediaCasService.cpp b/cas/1.0/default/MediaCasService.cpp
index ca43224..dbdd008 100644
--- a/cas/1.0/default/MediaCasService.cpp
+++ b/cas/1.0/default/MediaCasService.cpp
@@ -69,7 +69,7 @@
     if (mCasLoader.findFactoryForScheme(CA_system_id, &library, &factory)) {
         CasPlugin *plugin = NULL;
         sp<CasImpl> casImpl = new CasImpl(listener);
-        if (factory->createPlugin(CA_system_id, (uint64_t)casImpl.get(),
+        if (factory->createPlugin(CA_system_id, casImpl.get(),
                 &CasImpl::OnEvent, &plugin) == OK && plugin != NULL) {
             casImpl->init(library, plugin);
             result = casImpl;
diff --git a/compatibility_matrices/Android.mk b/compatibility_matrices/Android.mk
index a10d808..948b4fe 100644
--- a/compatibility_matrices/Android.mk
+++ b/compatibility_matrices/Android.mk
@@ -21,8 +21,9 @@
 # Clear potential input variables to BUILD_FRAMEWORK_COMPATIBILITY_MATRIX
 LOCAL_ADD_VBMETA_VERSION :=
 LOCAL_ASSEMBLE_VINTF_ENV_VARS :=
+LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE :=
+LOCAL_ASSEMBLE_VINTF_ERROR_MESSAGE :=
 LOCAL_ASSEMBLE_VINTF_FLAGS :=
-LOCAL_WARN_REQUIRED_HALS :=
 LOCAL_KERNEL_VERSIONS :=
 LOCAL_GEN_FILE_DEPENDENCIES :=
 
@@ -30,18 +31,21 @@
 
 
 include $(CLEAR_VARS)
+LOCAL_MODULE := framework_compatibility_matrix.legacy.xml
 LOCAL_MODULE_STEM := compatibility_matrix.legacy.xml
 LOCAL_SRC_FILES := $(LOCAL_MODULE_STEM)
 LOCAL_KERNEL_VERSIONS := 3.18.0 4.4.0 4.9.0
 include $(BUILD_FRAMEWORK_COMPATIBILITY_MATRIX)
 
 include $(CLEAR_VARS)
+LOCAL_MODULE := framework_compatibility_matrix.1.xml
 LOCAL_MODULE_STEM := compatibility_matrix.1.xml
 LOCAL_SRC_FILES := $(LOCAL_MODULE_STEM)
 LOCAL_KERNEL_VERSIONS := 3.18.0 4.4.0 4.9.0
 include $(BUILD_FRAMEWORK_COMPATIBILITY_MATRIX)
 
 include $(CLEAR_VARS)
+LOCAL_MODULE := framework_compatibility_matrix.2.xml
 LOCAL_MODULE_STEM := compatibility_matrix.2.xml
 LOCAL_SRC_FILES := $(LOCAL_MODULE_STEM)
 LOCAL_KERNEL_VERSIONS := 3.18.0 4.4.0 4.9.0
@@ -50,7 +54,8 @@
 # TODO(b/72409164): STOPSHIP: update kernel version requirements
 
 include $(CLEAR_VARS)
-LOCAL_MODULE_STEM := compatibility_matrix.current.xml
+LOCAL_MODULE := framework_compatibility_matrix.3.xml
+LOCAL_MODULE_STEM := compatibility_matrix.3.xml
 LOCAL_SRC_FILES := $(LOCAL_MODULE_STEM)
 LOCAL_KERNEL_VERSIONS := 4.4.0 4.9.0
 include $(BUILD_FRAMEWORK_COMPATIBILITY_MATRIX)
@@ -58,9 +63,9 @@
 # Framework Compatibility Matrix (common to all FCM versions)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE_STEM := compatibility_matrix.device.xml
-# define LOCAL_MODULE and LOCAL_MODULE_CLASS for local-generated-sources-dir.
 LOCAL_MODULE := framework_compatibility_matrix.device.xml
+LOCAL_MODULE_STEM := compatibility_matrix.device.xml
+# define LOCAL_MODULE_CLASS for local-generated-sources-dir.
 LOCAL_MODULE_CLASS := ETC
 
 ifndef DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE
@@ -78,7 +83,7 @@
 $(my_gen_check_manifest): PRIVATE_SRC_FILE := $(my_manifest_src_file)
 $(my_gen_check_manifest): $(my_manifest_src_file) $(HOST_OUT_EXECUTABLES)/assemble_vintf
 	BOARD_SEPOLICY_VERS=$(BOARD_SEPOLICY_VERS) \
-	IGNORE_TARGET_FCM_VERSION=true \
+	VINTF_IGNORE_TARGET_FCM_VERSION=true \
 		$(HOST_OUT_EXECUTABLES)/assemble_vintf -i $(PRIVATE_SRC_FILE) -o $@
 
 LOCAL_GEN_FILE_DEPENDENCIES += $(my_gen_check_manifest)
@@ -95,7 +100,8 @@
     PLATFORM_SEPOLICY_VERSION \
     PLATFORM_SEPOLICY_COMPAT_VERSIONS
 
-LOCAL_WARN_REQUIRED_HALS := \
+LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE := PRODUCT_ENFORCE_VINTF_MANIFEST=true
+LOCAL_ASSEMBLE_VINTF_ERROR_MESSAGE := \
     "Error: DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX cannot contain required HALs."
 
 include $(BUILD_FRAMEWORK_COMPATIBILITY_MATRIX)
@@ -110,7 +116,7 @@
     framework_compatibility_matrix.legacy.xml \
     framework_compatibility_matrix.1.xml \
     framework_compatibility_matrix.2.xml \
-    framework_compatibility_matrix.current.xml \
+    framework_compatibility_matrix.3.xml \
     framework_compatibility_matrix.device.xml
 LOCAL_GENERATED_SOURCES := $(call module-installed-files,$(LOCAL_REQUIRED_MODULES))
 
@@ -121,6 +127,14 @@
 
 LOCAL_ASSEMBLE_VINTF_ENV_VARS := PRODUCT_ENFORCE_VINTF_MANIFEST
 
+# TODO(b/65028233): Enforce no "unused HALs" for devices that does not define
+# DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE as well
+ifeq (true,$(strip $(PRODUCT_ENFORCE_VINTF_MANIFEST)))
+ifdef DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE
+LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE := VINTF_ENFORCE_NO_UNUSED_HALS=true
+endif
+endif
+
 include $(BUILD_FRAMEWORK_COMPATIBILITY_MATRIX)
 BUILT_SYSTEM_COMPATIBILITY_MATRIX := $(LOCAL_BUILT_MODULE)
 
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.3.xml
similarity index 90%
rename from compatibility_matrices/compatibility_matrix.current.xml
rename to compatibility_matrices/compatibility_matrix.3.xml
index 486c548..6aa5fc5 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.3.xml
@@ -24,6 +24,14 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.automotive.audiocontrol</name>
+        <version>1.0</version>
+        <interface>
+            <name>IAudioControl</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.automotive.evs</name>
         <version>1.0</version>
         <interface>
@@ -56,6 +64,14 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.bluetooth.a2dp</name>
+        <version>1.0</version>
+        <interface>
+            <name>IBluetoothAudioOffload</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.boot</name>
         <version>1.0</version>
         <interface>
@@ -96,6 +112,14 @@
         </interface>
     </hal>
     <hal format="hidl" optional="true">
+        <name>android.hardware.confirmationui</name>
+        <version>1.0</version>
+        <interface>
+            <name>IConfirmationUI</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
         <name>android.hardware.contexthub</name>
         <version>1.0</version>
         <interface>
@@ -145,7 +169,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.gnss</name>
-        <version>1.0</version>
+        <version>1.0-1</version>
         <interface>
             <name>IGnss</name>
             <instance>default</instance>
@@ -242,7 +266,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.nfc</name>
-        <version>1.0</version>
+        <version>1.0-1</version>
         <interface>
             <name>INfc</name>
             <instance>default</instance>
@@ -266,14 +290,24 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.radio</name>
-        <version>1.0-1</version>
+        <version>1.0-2</version>
         <interface>
             <name>IRadio</name>
-            <regex-instance>slot[0-9]+</regex-instance>
+            <instance>slot1</instance>
+            <instance>slot2</instance>
+            <instance>slot3</instance>
         </interface>
         <interface>
             <name>ISap</name>
-            <regex-instance>slot[0-9]+</regex-instance>
+            <instance>slot1</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="true">
+        <name>android.hardware.radio.config</name>
+        <version>1.0</version>
+        <interface>
+            <name>IRadioConfig</name>
+            <instance>default</instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
@@ -289,7 +323,8 @@
         <version>1.0</version>
         <interface>
             <name>ISecureElement</name>
-            <instance>eSE1</instance>
+            <regex-instance>eSE[1-9][0-9]*</regex-instance>
+            <regex-instance>SIM[1-9][0-9]*</regex-instance>
         </interface>
     </hal>
     <hal format="hidl" optional="true">
diff --git a/compatibility_matrices/compatibility_matrix.mk b/compatibility_matrices/compatibility_matrix.mk
index abc6796..6dc2b4f 100644
--- a/compatibility_matrices/compatibility_matrix.mk
+++ b/compatibility_matrices/compatibility_matrix.mk
@@ -25,12 +25,33 @@
 
 # $(warning $(call remove-minor-revision,3.18.0))
 
-ifndef LOCAL_MODULE_STEM
-$(error LOCAL_MODULE_STEM must be defined.)
-endif
+##### Input Variables:
+# LOCAL_MODULE: required. Module name for the build system.
+# LOCAL_MODULE_CLASS: optional. Default is ETC.
+# LOCAL_MODULE_PATH: optional. Path of output file. Default is $(TARGET_OUT)/etc/vintf.
+# LOCAL_MODULE_STEM: optional. Name of output file. Default is $(LOCAL_MODULE).
+# LOCAL_SRC_FILES: required. Local source files provided to assemble_vintf
+#       (command line argument -i).
+# LOCAL_GENERATED_SOURCES: optional. Global source files provided to assemble_vintf
+#       (command line argument -i).
+#
+# LOCAL_ADD_VBMETA_VERSION: Use AVBTOOL to add avb version to the output matrix
+#       (corresponds to <avb><vbmeta-version> tag)
+# LOCAL_ASSEMBLE_VINTF_ENV_VARS: Add a list of environment variable names from global variables in
+#       the build system that is lazily evaluated (e.g. PRODUCT_ENFORCE_VINTF_MANIFEST).
+# LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE: Add a list of environment variables that is local to
+#       assemble_vintf invocation. Format is "VINTF_ENFORCE_NO_UNUSED_HALS=true".
+# LOCAL_ASSEMBLE_VINTF_FLAGS: Add additional command line arguments to assemble_vintf invocation.
+# LOCAL_KERNEL_VERSIONS: Parse kernel configurations and add to the output matrix
+#       (corresponds to <kernel> tags.)
+# LOCAL_GEN_FILE_DEPENDENCIES: A list of additional dependencies for the generated file.
 
 ifndef LOCAL_MODULE
-LOCAL_MODULE := framework_$(LOCAL_MODULE_STEM)
+$(error LOCAL_MODULE must be defined.)
+endif
+
+ifndef LOCAL_MODULE_STEM
+LOCAL_MODULE_STEM := $(LOCAL_MODULE)
 endif
 
 ifndef LOCAL_MODULE_CLASS
@@ -81,13 +102,17 @@
 	$(addprefix $(LOCAL_PATH)/,$(LOCAL_SRC_FILES)) \
 	$(LOCAL_GENERATED_SOURCES)
 
-ifneq (,$(strip $(LOCAL_WARN_REQUIRED_HALS)))
-$(GEN): PRIVATE_ADDITIONAL_ENV_VARS += PRODUCT_ENFORCE_VINTF_MANIFEST=true
-$(GEN): PRIVATE_COMMAND_TAIL := || (echo $(strip $(LOCAL_WARN_REQUIRED_HALS)) && false)
+$(GEN): PRIVATE_ADDITIONAL_ENV_VARS := $(LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE)
+
+ifneq (,$(strip $(LOCAL_ASSEMBLE_VINTF_ERROR_MESSAGE)))
+$(GEN): PRIVATE_COMMAND_TAIL := || (echo $(strip $(LOCAL_ASSEMBLE_VINTF_ERROR_MESSAGE)) && false)
 endif
 
 $(GEN): PRIVATE_SRC_FILES := $(my_matrix_src_files)
 $(GEN): $(my_matrix_src_files) $(HOST_OUT_EXECUTABLES)/assemble_vintf
+	$(foreach varname,$(PRIVATE_ENV_VARS),\
+		$(if $(findstring $(varname),$(PRIVATE_ADDITIONAL_ENV_VARS)),\
+			$(error $(varname) should not be overridden by LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE.)))
 	$(foreach varname,$(PRIVATE_ENV_VARS),$(varname)="$($(varname))") \
 		$(PRIVATE_ADDITIONAL_ENV_VARS) \
 		$(HOST_OUT_EXECUTABLES)/assemble_vintf \
@@ -101,8 +126,9 @@
 
 LOCAL_ADD_VBMETA_VERSION :=
 LOCAL_ASSEMBLE_VINTF_ENV_VARS :=
+LOCAL_ASSEMBLE_VINTF_ENV_VARS_OVERRIDE :=
+LOCAL_ASSEMBLE_VINTF_ERROR_MESSAGE :=
 LOCAL_ASSEMBLE_VINTF_FLAGS :=
-LOCAL_WARN_REQUIRED_HALS :=
 LOCAL_KERNEL_VERSIONS :=
 LOCAL_GEN_FILE_DEPENDENCIES :=
 my_matrix_src_files :=
diff --git a/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy b/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
index f2dd892..d523a1a 100644
--- a/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
+++ b/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
@@ -42,6 +42,7 @@
 rt_sigreturn: 1
 getrlimit: 1
 madvise: 1
+getdents64: 1
 clock_gettime: 1
 
 # used during process crash by crash_dump to dump process info
diff --git a/current.txt b/current.txt
index 7771fe8..0d79272 100644
--- a/current.txt
+++ b/current.txt
@@ -250,13 +250,15 @@
 c8bc853546dd55584611def2a9fa1d99f657e3366c976d2f60fe6b8aa6d2cb87 android.hardware.thermal@1.1::IThermalCallback
 
 # ABI preserving changes to HALs during Android P
+eaeb3e4f3237430a7fdc206bffdf844713f5682990b2d49ea24392e15b5d343f android.hardware.broadcastradio@2.0::ITunerCallback
+2804120c1f8522ad15feb7695fe5eece527d399b406c671ea99618194118c316 android.hardware.broadcastradio@2.0::types
 cf72ff5a52bfa4d08e9e1000cf3ab5952a2d280c7f13cdad5ab7905c08050766 android.hardware.camera.metadata@3.2::types
 3902efc42097cba55f0655aa389e052ea70164e99ced1a6d1ef53dafc13f7650 android.hardware.camera.provider@2.4::ICameraProvider
 6fa9804a17a8bb7923a56bd10493a5483c20007e4c9026fd04287bee7c945a8c android.hardware.gnss@1.0::IGnssCallback
 fb92e2b40f8e9d494e8fd3b4ac18499a3216342e7cff160714c3bbf3660b6e79 android.hardware.gnss@1.0::IGnssConfiguration
 251594ea9b27447bfa005ebd806e58fb0ae4aad84a69938129c9800ec0c64eda android.hardware.gnss@1.0::IGnssMeasurementCallback
 4e7169919d24fbe5573e5bcd683d0bd7abf553a4e6c34c41f9dfc1e12050db07 android.hardware.gnss@1.0::IGnssNavigationMessageCallback
-08ae9fc24f21f809e9b8501dfbc803662fcd6a8d8e1fb71d9dd7c0c4c6f5d556 android.hardware.neuralnetworks@1.0::types
+1488db5ffb8a7979488d1084761aab8bca2f59bc9a02d75cdefc296afeaf591b android.hardware.neuralnetworks@1.0::types
 d4840db8efabdf1e4b344fc981cd36e5fe81a39aff6e199f6d06c1c8da413efd android.hardware.radio@1.0::types
 b280c4704dfcc548a9bf127b59b7c3578f460c50cce70a06b66fe0df8b27cff0 android.hardware.wifi@1.0::types
 
@@ -294,8 +296,8 @@
 14ef8e993a4a7c899b19bb5e39b5b0cafd28312ea2b127e35b3be8f08e23fe8e android.hardware.automotive.evs@1.0::IEvsEnumerator
 3b17c1fdfc389e0abe626c37054954b07201127d890c2bc05d47613ec1f4de4f android.hardware.automotive.evs@1.0::types
 b3caf524c46a47d67e6453a34419e1881942d059e146cda740502670e9a752c3 android.hardware.automotive.vehicle@2.0::IVehicle
-80fb4156fa91ce86e49bd2cabe215078f6b69591d416a09e914532eae6712052 android.hardware.automotive.vehicle@2.0::IVehicleCallback
-4ff0dcfb938a5df283eef47de33b4e1284fab73f584cfc0c94e97317bdb7bf26 android.hardware.automotive.vehicle@2.0::types
+7ce8728b27600e840cacf0a832f6942819fe535f9d3797ae052d5eef5065921c android.hardware.automotive.vehicle@2.0::IVehicleCallback
+848fb32d5ca79dd527d966e67c0af5874b6d7b361246b491e315cf7dea7888ab android.hardware.automotive.vehicle@2.0::types
 32cc50cc2a7658ec613c0c2dd2accbf6a05113b749852879e818b8b7b438db19 android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioHost
 ff4be64d7992f8bec97dff37f35450e79b3430c61f85f54322ce45bef229dc3b android.hardware.bluetooth.a2dp@1.0::IBluetoothAudioOffload
 27f22d2e873e6201f9620cf4d8e2facb25bd0dd30a2b911e441b4600d560fa62 android.hardware.bluetooth.a2dp@1.0::types
@@ -316,14 +318,14 @@
 7877ff8e4c1e48b825e6e5e66d050288e5656ed535c61cc7830a92ed4a9e1990 android.hardware.drm@1.1::IDrmFactory
 fef2f0ebde7704548fb203df46673ceb342272fc4fa9d0af25a980d2584a36e7 android.hardware.drm@1.1::IDrmPlugin
 5047a346ecce239404b9020959f60dd467318e9c17b290a6386bc3894df62c3c android.hardware.drm@1.1::types
-be794f5df97f134d6dcabb866b250d1305100e7ae07fb253b7841df890b931bb android.hardware.gnss@1.1::IGnss
+a830336ac8627d6432cfafb1b884343ad9f885dee0a5323e380e6d3c519156b8 android.hardware.gnss@1.1::IGnss
 8ad55bc35bb3a83e65c018bdfde7ae5ebc749ff2bf6b79412ded0bc6c89b97d8 android.hardware.gnss@1.1::IGnssCallback
 3c5183d7506010be57e0f748e3640fc2ded1ba955784b6256ba427f4c399591c android.hardware.gnss@1.1::IGnssConfiguration
-b054af24fbb70d54cde1fb5cba126809e7c4e863e8f9115dc492321dfbcbc993 android.hardware.gnss@1.1::IGnssMeasurement
+1a07d1383e847c3deb696ec7a2c9e33b9683772945660448a010b18063da67a4 android.hardware.gnss@1.1::IGnssMeasurement
 83e7a10ff3702147bd7ffa04567b20d407a3b16bbb7705644af44d919afe9103 android.hardware.gnss@1.1::IGnssMeasurementCallback
-82da7e7624f72ff1927f48738913e20bee3a513adfe5dc7c4f888176e20376e6 android.hardware.graphics.common@1.1::types
+0b96e0254e2168cfecb30c1ed5fb42681652cc00faa68c6e07568fafe64d1d50 android.hardware.graphics.common@1.1::types
 d9b40a5b09962a5a0780b10fe33a4e607e69e2e088fc83de88a584115b7cb1c0 android.hardware.graphics.composer@2.2::IComposer
-d6ce042995239712bc1d0970fa9d512c15c0b1ac9bcb048bd8b69f617b45c25e android.hardware.graphics.composer@2.2::IComposerClient
+c3cd2a3e245ffefae859c9a3d31382a9421be95cfa6bc1231571eb3533049b54 android.hardware.graphics.composer@2.2::IComposerClient
 dd83be076b6b3f10ed62ab34d8c8b95f2415961fb785200eb842e7bfb2b0ee92 android.hardware.graphics.mapper@2.1::IMapper
 675682dd3007805c985eaaec91612abc88f4c25b3431fb84070b7584a1a741fb android.hardware.health@2.0::IHealth
 434c4c32c00b0e54bb05e40c79503208b40f786a318029a2a4f66e34f10f2a76 android.hardware.health@2.0::IHealthInfoCallback
@@ -338,14 +340,14 @@
 e808a6f61cd7b47887c599d8843e67a2dcbf4ec5aadd5d22fdce93020070ef1b android.hardware.neuralnetworks@1.1::types
 8d3d86da0bfa4bf070970d8303c659f67f35d670c287d45a3f542e4fedadd578 android.hardware.nfc@1.1::INfc
 e85f566698d2a2c28100e264fcf2c691a066756ddf8dd341d009ff50cfe10614 android.hardware.nfc@1.1::INfcClientCallback
-2b8f6165b3d350485eb89eb6e931cf876688cde9155f7b31a8d8fe7abdfe5b95 android.hardware.nfc@1.1::types
+5e278fcaa3287d397d8eebe1c22aaa28150f5caae1cf9381cd6dc32cb37899c5 android.hardware.nfc@1.1::types
 163e115e833fc1d77cdd4a8cf0c833bb8b8d74fe35c880fe693101d17774926f android.hardware.power@1.2::IPower
 7899b9305587b2d5cd74a3cc87e9090f58bf4ae74256ce3ee36e7ec011822840 android.hardware.power@1.2::types
 ab132c990a62f0aca35871c092c22fb9c85d478e22124ef6a4d0a2302da76a9f android.hardware.radio@1.2::IRadio
 cda752aeabaabc20486a82ac57a3dd107785c006094a349bc5e224e8aa22a17c android.hardware.radio@1.2::IRadioIndication
-c38b7e1f808565a535ff19fd4c1b512b22dfa0b58ec91dce03f72a8f1eaf6957 android.hardware.radio@1.2::IRadioResponse
+da8c6ae991c6a4b284cc6e445332e064e28ee8a09482ed5afff9d159ec6694b7 android.hardware.radio@1.2::IRadioResponse
 b65332996eb39ba63300a1011404141fa59ce5c252bc17afae637be6eeca5f55 android.hardware.radio@1.2::ISap
-508ace7d4023b865b8b77c3ca3c86cc9525ef3803dc9c6b461b7c1f91b0fec00 android.hardware.radio@1.2::types
+a9361522cc97ef66209d39ba324095b2f08344054bb4d3481e803eee0480623a android.hardware.radio@1.2::types
 87385469cf4409f0f33b01508e7a477cf71f2a11e466dd7e3ab5971a1baaa72b android.hardware.radio.config@1.0::IRadioConfig
 228b2ee3c8c276c9f0afad2dc313ca3d6bbd9e482ddf313c7204c60ad9b636ab android.hardware.radio.config@1.0::IRadioConfigIndication
 a2e9b7aa09f79426f765838174e04b6f9a3e6c8b76b923fc1705632207bad44b android.hardware.radio.config@1.0::IRadioConfigResponse
@@ -365,7 +367,7 @@
 167af870fdb87e1cbbaa0fa62ef35e1031caad20dd1ba695983dedb1e9993486 android.hardware.wifi@1.2::IWifiChipEventCallback
 8c7ef32fc78d5ec6e6956de3784cc2c6f42614b5272d2e461f6d60534ba38ec2 android.hardware.wifi@1.2::IWifiNanIface
 1e6074efad9da333803fb7c1acdb719d51c30b2e1e92087b0420341631c30b60 android.hardware.wifi@1.2::IWifiNanIfaceEventCallback
-a9d733eb0d555f2a6cb79a212810e81b56ecba0e31a8ffe0916de086a29e4f88 android.hardware.wifi@1.2::IWifiStaIface
+f5682dbf19f712bef9cc3faa5fe3dc670b6ffbcb62a147a1d86b9d43574cd83f android.hardware.wifi@1.2::IWifiStaIface
 6db2e7d274be2dca9bf3087afd1f774a68c99d2b4dc7eeaf41690e5cebcbef7a android.hardware.wifi@1.2::types
 ee08280de21cb41e3ec26d6ed636c701b7f70516e71fb22f4fe60a13e603f406 android.hardware.wifi.hostapd@1.0::IHostapd
 b2479cd7a417a1cf4f3a22db4e4579e21bac38fdcaf381e2bf10176d05397e01 android.hardware.wifi.hostapd@1.0::types
diff --git a/gnss/1.1/IGnss.hal b/gnss/1.1/IGnss.hal
index 096f251..672f742 100644
--- a/gnss/1.1/IGnss.hal
+++ b/gnss/1.1/IGnss.hal
@@ -46,15 +46,17 @@
      * @param minIntervalMs Represents the time between fixes in milliseconds.
      * @param preferredAccuracyMeters Represents the requested fix accuracy in meters.
      * @param preferredTimeMs Represents the requested time to first fix in milliseconds.
-     * @param lowPowerMode When true, HAL must make strong tradeoffs to substantially restrict power
-     *     use. Specifically, in the case of a several second long minIntervalMs, the GNSS chipset
-     *     must not, on average, run power hungry operations like RF and signal searches for more
-     *     than one second per interval, and must make exactly one call to gnssSvStatusCb(), and
-     *     either zero or one call to GnssLocationCb() at each interval. When false, HAL must
-     *     operate in the nominal mode (similar to V1.0 where this flag wasn't present) and is
-     *     expected to make power and performance tradoffs such as duty-cycling when signal
-     *     conditions are good and more active searches to reacquire GNSS signals when no signals
-     *     are present.
+     * @param lowPowerMode When true, and IGnss.hal is the only client to the GNSS hardware, the
+     *     GNSS hardware must make strong tradeoffs to substantially restrict power use.
+     *     Specifically, in the case of a several second long minIntervalMs, the GNSS hardware must
+     *     not, on average, run power hungry operations like RF and signal searches for more than
+     *     one second per interval, and must make exactly one call to gnssSvStatusCb(), and either
+     *     zero or one call to GnssLocationCb() at each interval. When false, HAL must operate in
+     *     the nominal mode (similar to V1.0 where this flag wasn't present) and is expected to make
+     *     power and performance tradoffs such as duty-cycling when signal conditions are good and
+     *     more active searches to reacquire GNSS signals when no signals are present.
+     *     When there are additional clients using the GNSS hardware other than IGnss.hal, the GNSS
+     *     hardware may operate in a higher power mode, on behalf of those clients.
      *
      * @return success Returns true if successful.
      */
diff --git a/gnss/1.1/IGnssMeasurement.hal b/gnss/1.1/IGnssMeasurement.hal
index cd83ae3..6ed8e53 100644
--- a/gnss/1.1/IGnssMeasurement.hal
+++ b/gnss/1.1/IGnssMeasurement.hal
@@ -33,10 +33,11 @@
      * @param callback Handle to GnssMeasurement callback interface.
      * @param enableFullTracking If true, GNSS chipset must switch off duty cycling. In such mode
      *     no clock discontinuities are expected and, when supported, carrier phase should be
-     *     continuous in good signal conditions. All constellations and frequency bands that the
-     *     chipset supports must be reported in this mode. The GNSS chipset is allowed to consume
-     *     more power in this mode. If false, API must behave as in HAL V1_0, optimizing power via
-     *     duty cycling, constellations and frequency limits, etc.
+     *     continuous in good signal conditions. All non-blacklisted, healthy constellations,
+     *     satellites and frequency bands that the chipset supports must be reported in this mode.
+     *     The GNSS chipset is allowed to consume more power in this mode. If false, API must behave
+     *     as in HAL V1_0, optimizing power via duty cycling, constellations and frequency limits,
+     *     etc.
      *
      * @return initRet Returns SUCCESS if successful. Returns ERROR_ALREADY_INIT if a callback has
      *     already been registered without a corresponding call to 'close'. Returns ERROR_GENERIC
diff --git a/graphics/common/1.1/Android.bp b/graphics/common/1.1/Android.bp
index c319d80..8bc68f5 100644
--- a/graphics/common/1.1/Android.bp
+++ b/graphics/common/1.1/Android.bp
@@ -15,8 +15,10 @@
     ],
     types: [
         "BufferUsage",
+        "ColorMode",
         "Dataspace",
         "PixelFormat",
+        "RenderIntent",
     ],
     gen_java: true,
     gen_java_constants: true,
diff --git a/graphics/common/1.1/types.hal b/graphics/common/1.1/types.hal
index b917d5e..5dca482 100644
--- a/graphics/common/1.1/types.hal
+++ b/graphics/common/1.1/types.hal
@@ -16,9 +16,10 @@
 
 package android.hardware.graphics.common@1.1;
 
-import @1.0::PixelFormat;
 import @1.0::BufferUsage;
+import @1.0::ColorMode;
 import @1.0::Dataspace;
+import @1.0::PixelFormat;
 
 /**
  * Pixel formats for graphics buffers.
@@ -129,15 +130,165 @@
 @export(name="android_dataspace_v1_1_t", value_prefix="HAL_DATASPACE_",
         export_parent="false")
 enum Dataspace : @1.0::Dataspace {
+    /*
+     * @1.0::Dataspace defines six legacy dataspaces
+     *
+     *   SRGB_LINEAR = 0x200, // deprecated, use V0_SRGB_LINEAR
+     *   SRGB = 0x201, // deprecated, use V0_SRGB
+     *   JFIF = 0x101, // deprecated, use V0_JFIF
+     *   BT601_625 = 0x102, // deprecated, use V0_BT601_625
+     *   BT601_525 = 0x103, // deprecated, use V0_BT601_525
+     *   BT709 = 0x104, // deprecated, use V0_BT709
+     *
+     * The difference between the legacy dataspaces and their modern
+     * counterparts is that, with legacy dataspaces, the pixel values may have
+     * been desaturated by the content creator in an unspecified way.
+     *
+     * When colorimetric mapping is required, the legacy dataspaces must be
+     * treated as their modern counterparts (e.g., SRGB must be treated as
+     * V0_SRGB) and no re-saturation is allowed. When non-colorimetric mapping
+     * is allowed, the pixel values can be interpreted freely by
+     * implementations for the purpose of re-saturation, and the re-saturated
+     * pixel values are in the respective modern dataspaces.
+     *
+     * This is also true when UNKNOWN is treated as a legacy dataspace.
+     */
+
     /**
      * ITU-R Recommendation 2020 (BT.2020)
      *
      * Ultra High-definition television
      *
-     * Use limited range, SMPTE 2084 (PQ) transfer and BT2020 standard
-     * limited range is the preferred / normative definition for BT.2020
+     * Use limited range, BT.709 transfer and BT2020 standard
      */
     BT2020_ITU = STANDARD_BT2020 | TRANSFER_SMPTE_170M | RANGE_LIMITED,
 
+    /**
+     * ITU-R Recommendation 2100 (BT.2100)
+     *
+     * High dynamic range television
+     *
+     * Use limited/full range, PQ/HLG transfer, and BT2020 standard
+     * limited range is the preferred / normative definition for BT.2100
+     */
     BT2020_ITU_PQ = STANDARD_BT2020 | TRANSFER_ST2084 | RANGE_LIMITED,
+    BT2020_ITU_HLG = STANDARD_BT2020 | TRANSFER_HLG | RANGE_LIMITED,
+    BT2020_HLG = STANDARD_BT2020 | TRANSFER_HLG | RANGE_FULL,
+};
+
+@export(name="android_color_mode_v1_1_t", value_prefix="HAL_COLOR_MODE_",
+        export_parent="false")
+enum ColorMode : @1.0::ColorMode {
+    /**
+     * BT2020 corresponds with display settings that implement the ITU-R
+     * Recommendation BT.2020 / Rec. 2020 for UHDTV.
+     *
+     * Primaries:
+     *                  x       y
+     *  green           0.170   0.797
+     *  blue            0.131   0.046
+     *  red             0.708   0.292
+     *  white (D65)     0.3127  0.3290
+     *
+     * Inverse Gamma Correction (IGC): V represents normalized (with [0 to 1]
+     * range) value of R, G, or B.
+     *
+     *  if Vnonlinear < b * 4.5
+     *    Vlinear = Vnonlinear / 4.5
+     *  else
+     *    Vlinear = ((Vnonlinear + (a - 1)) / a) ^ (1/0.45)
+     *
+     * Gamma Correction (GC):
+     *
+     *  if Vlinear < b
+     *    Vnonlinear = 4.5 * Vlinear
+     *  else
+     *    Vnonlinear = a * Vlinear ^ 0.45 - (a - 1)
+     *
+     * where
+     *
+     *   a = 1.09929682680944, b = 0.018053968510807
+     *
+     * For practical purposes, these a/b values can be used instead
+     *
+     *   a = 1.099, b = 0.018 for 10-bit display systems
+     *   a = 1.0993, b = 0.0181 for 12-bit display systems
+     */
+    BT2020 = 10,
+
+    /**
+     * BT2100_PQ and BT2100_HLG correspond with display settings that
+     * implement the ITU-R Recommendation BT.2100 / Rec. 2100 for HDR TV.
+     *
+     * Primaries:
+     *                  x       y
+     *  green           0.170   0.797
+     *  blue            0.131   0.046
+     *  red             0.708   0.292
+     *  white (D65)     0.3127  0.3290
+     *
+     * For BT2100_PQ, the transfer function is Perceptual Quantizer (PQ). For
+     * BT2100_HLG, the transfer function is Hybrid Log-Gamma (HLG).
+     */
+    BT2100_PQ = 11,
+    BT2100_HLG = 12,
+};
+
+/**
+ * RenderIntent defines the mapping from color mode colors to display colors.
+ *
+ * A render intent must not change how it maps colors when the color mode
+ * changes. That is to say that when a render intent maps color C to color C',
+ * the fact that color C can have different pixel values in different color
+ * modes should not affect the mapping.
+ *
+ * RenderIntent overrides the render intents defined for individual color
+ * modes. It is ignored when the color mode is ColorMode::NATIVE, because
+ * ColorMode::NATIVE colors are already display colors.
+ */
+@export(name="android_render_intent_v1_1_t", value_prefix="HAL_RENDER_INTENT_",
+        export_parent="false")
+enum RenderIntent : int32_t {
+    /**
+     * Colors in the display gamut are unchanged. Colors out of the display
+     * gamut are hard-clipped.
+     *
+     * This implies that the display must have been calibrated unless
+     * ColorMode::NATIVE is the only supported color mode.
+     */
+    COLORIMETRIC = 0,
+
+    /**
+     * Enhance colors that are in the display gamut. Colors out of the display
+     * gamut are hard-clipped.
+     *
+     * The enhancement typically picks the biggest standard color space (e.g.
+     * DCI-P3) that is narrower than the display gamut and stretches it to the
+     * display gamut. The stretching is recommended to preserve skin tones.
+     */
+    ENHANCE = 1,
+
+    /**
+     * Tone map high-dynamic-range colors to the display's dynamic range. The
+     * dynamic range of the colors are communicated separately. After tone
+     * mapping, the mapping to the display gamut is as defined in
+     * COLORIMETRIC.
+     */
+    TONE_MAP_COLORIMETRIC = 2,
+
+    /**
+     * Tone map high-dynamic-range colors to the display's dynamic range. The
+     * dynamic range of the colors are communicated separately. After tone
+     * mapping, the mapping to the display gamut is as defined in ENHANCE.
+     *
+     * The tone mapping step and the enhancing step must match
+     * TONE_MAP_COLORIMETRIC and ENHANCE respectively when they are also
+     * supported.
+     */
+    TONE_MAP_ENHANCE = 3,
+
+    /*
+     * Vendors are recommended to use 0x100 - 0x1FF for their own values, and
+     * that must be done with subtypes defined by vendor extensions.
+     */
 };
diff --git a/graphics/composer/2.1/utils/command-buffer/include/composer-command-buffer/2.1/ComposerCommandBuffer.h b/graphics/composer/2.1/utils/command-buffer/include/composer-command-buffer/2.1/ComposerCommandBuffer.h
index df529ec..2742207 100644
--- a/graphics/composer/2.1/utils/command-buffer/include/composer-command-buffer/2.1/ComposerCommandBuffer.h
+++ b/graphics/composer/2.1/utils/command-buffer/include/composer-command-buffer/2.1/ComposerCommandBuffer.h
@@ -247,21 +247,8 @@
 
     void setClientTarget(uint32_t slot, const native_handle_t* target, int acquireFence,
                          Dataspace dataspace, const std::vector<IComposerClient::Rect>& damage) {
-        bool doWrite = (damage.size() <= (kMaxLength - 4) / 4);
-        size_t length = 4 + ((doWrite) ? damage.size() * 4 : 0);
-
-        beginCommand(IComposerClient::Command::SET_CLIENT_TARGET, length);
-        write(slot);
-        writeHandle(target, true);
-        writeFence(acquireFence);
-        writeSigned(static_cast<int32_t>(dataspace));
-        // When there are too many rectangles in the damage region and doWrite
-        // is false, we write no rectangle at all which means the entire
-        // client target is damaged.
-        if (doWrite) {
-            writeRegion(damage);
-        }
-        endCommand();
+        setClientTargetInternal(slot, target, acquireFence, static_cast<int32_t>(dataspace),
+                                damage);
     }
 
     static constexpr uint16_t kSetOutputBufferLength = 3;
@@ -354,9 +341,7 @@
 
     static constexpr uint16_t kSetLayerDataspaceLength = 1;
     void setLayerDataspace(Dataspace dataspace) {
-        beginCommand(IComposerClient::Command::SET_LAYER_DATASPACE, kSetLayerDataspaceLength);
-        writeSigned(static_cast<int32_t>(dataspace));
-        endCommand();
+        setLayerDataspaceInternal(static_cast<int32_t>(dataspace));
     }
 
     static constexpr uint16_t kSetLayerDisplayFrameLength = 4;
@@ -418,6 +403,32 @@
     }
 
    protected:
+    void setClientTargetInternal(uint32_t slot, const native_handle_t* target, int acquireFence,
+                                 int32_t dataspace,
+                                 const std::vector<IComposerClient::Rect>& damage) {
+        bool doWrite = (damage.size() <= (kMaxLength - 4) / 4);
+        size_t length = 4 + ((doWrite) ? damage.size() * 4 : 0);
+
+        beginCommand(IComposerClient::Command::SET_CLIENT_TARGET, length);
+        write(slot);
+        writeHandle(target, true);
+        writeFence(acquireFence);
+        writeSigned(dataspace);
+        // When there are too many rectangles in the damage region and doWrite
+        // is false, we write no rectangle at all which means the entire
+        // client target is damaged.
+        if (doWrite) {
+            writeRegion(damage);
+        }
+        endCommand();
+    }
+
+    void setLayerDataspaceInternal(int32_t dataspace) {
+        beginCommand(IComposerClient::Command::SET_LAYER_DATASPACE, kSetLayerDataspaceLength);
+        writeSigned(dataspace);
+        endCommand();
+    }
+
     void beginCommand(IComposerClient::Command command, uint16_t length) {
         if (mCommandEnd) {
             LOG_FATAL("endCommand was not called before command 0x%x", command);
diff --git a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
index 0d883e4..8d5493e 100644
--- a/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
+++ b/graphics/composer/2.1/utils/vts/include/composer-vts/2.1/ComposerVts.h
@@ -104,9 +104,7 @@
 
     void execute(TestCommandReader* reader, CommandWriterBase* writer);
 
-   private:
-    sp<IComposerClient> mClient;
-
+   protected:
     // Keep track of all virtual displays and layers.  When a test fails with
     // ASSERT_*, the destructor will clean up the resources for the test.
     struct DisplayResource {
@@ -116,6 +114,9 @@
         std::unordered_set<Layer> layers;
     };
     std::unordered_map<Display, DisplayResource> mDisplayResources;
+
+   private:
+    sp<IComposerClient> mClient;
 };
 
 }  // namespace vts
diff --git a/graphics/composer/2.2/Android.bp b/graphics/composer/2.2/Android.bp
index 633a208..fe71e9e 100644
--- a/graphics/composer/2.2/Android.bp
+++ b/graphics/composer/2.2/Android.bp
@@ -12,6 +12,7 @@
     ],
     interfaces: [
         "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
         "android.hardware.graphics.composer@2.1",
         "android.hidl.base@1.0",
     ],
diff --git a/graphics/composer/2.2/IComposerClient.hal b/graphics/composer/2.2/IComposerClient.hal
index dcd9c8d..b7ba6a6 100644
--- a/graphics/composer/2.2/IComposerClient.hal
+++ b/graphics/composer/2.2/IComposerClient.hal
@@ -16,11 +16,14 @@
 
 package android.hardware.graphics.composer@2.2;
 
-import android.hardware.graphics.common@1.0::PixelFormat;
-import android.hardware.graphics.common@1.0::Dataspace;
+import android.hardware.graphics.common@1.1::ColorMode;
+import android.hardware.graphics.common@1.1::Dataspace;
+import android.hardware.graphics.common@1.1::PixelFormat;
+import android.hardware.graphics.common@1.1::RenderIntent;
 import @2.1::IComposerClient;
 import @2.1::Display;
 import @2.1::Error;
+import @2.1::IComposerClient;
 
 interface IComposerClient extends @2.1::IComposerClient {
 
@@ -90,16 +93,20 @@
 
     enum Command : @2.1::IComposerClient.Command {
         /**
-         * setPerFrameMetadata(Display display, vec<PerFrameMetadata> data)
+         * SET_LAYER_PER_FRAME_METADATA has this pseudo prototype
+         *
+         *   setLayerPerFrameMetadata(Display display, Layer layer,
+         *                            vec<PerFrameMetadata> data);
+         *
          * Sets the PerFrameMetadata for the display. This metadata must be used
          * by the implementation to better tone map content to that display.
          *
          * This is a method that may be called every frame. Thus it's
          * implemented using buffered transport.
-         * SET_PER_FRAME_METADATA is the command used by the buffered transport
+         * SET_LAYER_PER_FRAME_METADATA is the command used by the buffered transport
          * mechanism.
          */
-        SET_PER_FRAME_METADATA = 0x207 << @2.1::IComposerClient.Command:OPCODE_SHIFT,
+        SET_LAYER_PER_FRAME_METADATA = 0x303 << @2.1::IComposerClient.Command:OPCODE_SHIFT,
 
         /**
          * SET_LAYER_COLOR has this pseudo prototype
@@ -242,6 +249,65 @@
     setReadbackBuffer(Display display, handle buffer, handle releaseFence) generates (Error error);
 
     /**
+     * createVirtualDisplay_2_2
+     * Creates a new virtual display with the given width and height. The
+     * format passed into this function is the default format requested by the
+     * consumer of the virtual display output buffers.
+     *
+     * The display must be assumed to be on from the time the first frame is
+     * presented until the display is destroyed.
+     *
+     * @param width is the width in pixels.
+     * @param height is the height in pixels.
+     * @param formatHint is the default output buffer format selected by
+     *        the consumer.
+     * @param outputBufferSlotCount is the number of output buffer slots to be
+     *        reserved.
+     * @return error is NONE upon success. Otherwise,
+     *         UNSUPPORTED when the width or height is too large for the
+     *                     device to be able to create a virtual display.
+     *         NO_RESOURCES when the device is unable to create a new virtual
+     *                      display at this time.
+     * @return display is the newly-created virtual display.
+     * @return format is the format of the buffer the device will produce.
+     */
+    @callflow(next="*")
+    createVirtualDisplay_2_2(uint32_t width,
+                             uint32_t height,
+                             PixelFormat formatHint,
+                             uint32_t outputBufferSlotCount)
+                  generates (Error error,
+                             Display display,
+                             PixelFormat format);
+
+    /**
+     * getClientTargetSupport_2_2
+     * Returns whether a client target with the given properties can be
+     * handled by the device.
+     *
+     * This function must return true for a client target with width and
+     * height equal to the active display configuration dimensions,
+     * PixelFormat::RGBA_8888, and Dataspace::UNKNOWN. It is not required to
+     * return true for any other configuration.
+     *
+     * @param display is the display to query.
+     * @param width is the client target width in pixels.
+     * @param height is the client target height in pixels.
+     * @param format is the client target format.
+     * @param dataspace is the client target dataspace, as described in
+     *        setLayerDataspace.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         UNSUPPORTED when the given configuration is not supported.
+     */
+    @callflow(next="*")
+    getClientTargetSupport_2_2(Display display,
+                               uint32_t width,
+                               uint32_t height,
+                               PixelFormat format,
+                               Dataspace dataspace)
+                    generates (Error error);
+    /**
      * setPowerMode_2_2
      * Sets the power mode of the given display. The transition must be
      * complete when this function returns. It is valid to call this function
@@ -260,4 +326,118 @@
      */
     setPowerMode_2_2(Display display, PowerMode mode) generates (Error error);
 
+    /**
+     * Returns the color modes supported on this display.
+     *
+     * All devices must support at least ColorMode::NATIVE.
+     *
+     * @param display is the display to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     * @return modes is an array of color modes.
+     */
+    getColorModes_2_2(Display display)
+           generates (Error error,
+                      vec<ColorMode> modes);
+
+    /**
+     * Returns the render intents supported by the specified display and color
+     * mode.
+     *
+     * RenderIntent::COLORIMETRIC is always supported.
+     *
+     * @param display is the display to query.
+     * @param mode is the color mode to query.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when an invalid color mode was passed in.
+     * @return intents is an array of render intents.
+     */
+    getRenderIntents(Display display, ColorMode mode)
+          generates (Error error,
+                     vec<RenderIntent> intents);
+
+    /**
+     * Sets the color mode and render intent of the given display.
+     *
+     * The color mode and render intent change must take effect on next
+     * presentDisplay.
+     *
+     * All devices must support at least ColorMode::NATIVE and
+     * RenderIntent::COLORIMETRIC, and displays are assumed to be in this mode
+     * upon hotplug.
+     *
+     * @param display is the display to which the color mode is set.
+     * @param mode is the color mode to set to.
+     * @param intent is the render intent to set to.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_DISPLAY when an invalid display handle was passed in.
+     *         BAD_PARAMETER when mode or intent is invalid
+     *         UNSUPPORTED when mode or intent is not supported on this
+     *                     display.
+     */
+    setColorMode_2_2(Display display, ColorMode mode, RenderIntent intent)
+          generates (Error error);
+
+    /*
+     * By default, layer dataspaces are mapped to the current color mode
+     * colorimetrically with a few exceptions.
+     *
+     * When the layer dataspace is a legacy sRGB dataspace
+     * (Dataspace::SRGB_LINEAR, Dataspace::SRGB, or Dataspace::UNKNOWN when
+     * treated as such) and the display render intent is
+     * RenderIntent::ENHANCE, the pixel values can go through an
+     * implementation-defined saturation transform before being mapped to the
+     * current color mode colorimetrically.
+     *
+     * Colors that are out of the gamut of the current color mode are
+     * hard-clipped.
+     */
+
+    /**
+     * Returns the saturation matrix of the specified legacy dataspace.
+     *
+     * The saturation matrix can be used to approximate the legacy dataspace
+     * saturation transform. It is to be applied on linear pixel values like
+     * this:
+     *
+     *   (in GLSL)
+     *   linearSrgb = clamp(saturationMatrix * linearSrgb, 0.0, 1.0);
+     *
+     * @param dataspace must be Dataspace::SRGB_LINEAR.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_PARAMETER when an invalid dataspace was passed in.
+     * @return matrix is the 4x4 column-major matrix used to approximate the
+     *         legacy dataspace saturation operation. The last row must be
+     *         [0.0, 0.0, 0.0, 1.0].
+     */
+    getDataspaceSaturationMatrix(Dataspace dataspace)
+                      generates (Error error,
+                                 float[4][4] matrix);
+
+    /**
+     * Executes commands from the input command message queue. Return values
+     * generated by the input commands are written to the output command
+     * message queue in the form of value commands.
+     *
+     * @param inLength is the length of input commands.
+     * @param inHandles is an array of handles referenced by the input
+     *        commands.
+     * @return error is NONE upon success. Otherwise,
+     *         BAD_PARAMETER when inLength is not equal to the length of
+     *                       commands in the input command message queue.
+     *         NO_RESOURCES when the output command message queue was not
+     *                      properly drained.
+     * @param outQueueChanged indicates whether the output command message
+     *        queue has changed.
+     * @param outLength is the length of output commands.
+     * @param outHandles is an array of handles referenced by the output
+     *        commands.
+     */
+    executeCommands_2_2(uint32_t inLength,
+                        vec<handle> inHandles)
+             generates (Error error,
+                        bool outQueueChanged,
+                        uint32_t outLength,
+                        vec<handle> outHandles);
 };
diff --git a/graphics/composer/2.2/default/Android.bp b/graphics/composer/2.2/default/Android.bp
deleted file mode 100644
index 906479e..0000000
--- a/graphics/composer/2.2/default/Android.bp
+++ /dev/null
@@ -1,31 +0,0 @@
-cc_binary {
-    name: "android.hardware.graphics.composer@2.2-service",
-    defaults: ["hidl_defaults"],
-    vendor: true,
-    relative_install_path: "hw",
-    srcs: ["service.cpp"],
-    init_rc: ["android.hardware.graphics.composer@2.2-service.rc"],
-    header_libs: [
-        "android.hardware.graphics.composer@2.2-passthrough",
-    ],
-    shared_libs: [
-        "android.hardware.graphics.composer@2.1",
-        "android.hardware.graphics.composer@2.2",
-        "android.hardware.graphics.mapper@2.0",
-        "libbase",
-        "libbinder",
-        "libcutils",
-        "libfmq",
-        "libhardware",
-        "libhidlbase",
-        "libhidltransport",
-        "libhwc2on1adapter",
-        "libhwc2onfbadapter",
-        "liblog",
-        "libsync",
-        "libutils",
-    ],
-    cflags: [
-        "-DLOG_TAG=\"ComposerHal\""
-    ],
-}
diff --git a/graphics/composer/2.2/default/Android.mk b/graphics/composer/2.2/default/Android.mk
new file mode 100644
index 0000000..2f80f0c
--- /dev/null
+++ b/graphics/composer/2.2/default/Android.mk
@@ -0,0 +1,32 @@
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := android.hardware.graphics.composer@2.2-service
+LOCAL_VENDOR_MODULE := true
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_CFLAGS := -Wall -Werror -DLOG_TAG=\"ComposerHal\"
+LOCAL_SRC_FILES := service.cpp
+LOCAL_INIT_RC := android.hardware.graphics.composer@2.2-service.rc
+LOCAL_HEADER_LIBRARIES := android.hardware.graphics.composer@2.2-passthrough
+LOCAL_SHARED_LIBRARIES := \
+        android.hardware.graphics.composer@2.1 \
+        android.hardware.graphics.composer@2.2 \
+        android.hardware.graphics.mapper@2.0 \
+        libbase \
+        libbinder \
+        libcutils \
+        libfmq \
+        libhardware \
+        libhidlbase \
+        libhidltransport \
+        libhwc2on1adapter \
+        libhwc2onfbadapter \
+        liblog \
+        libsync \
+        libutils
+
+ifdef TARGET_USES_DISPLAY_RENDER_INTENTS
+LOCAL_CFLAGS += -DUSES_DISPLAY_RENDER_INTENTS
+endif
+
+include $(BUILD_EXECUTABLE)
diff --git a/graphics/composer/2.2/utils/command-buffer/include/composer-command-buffer/2.2/ComposerCommandBuffer.h b/graphics/composer/2.2/utils/command-buffer/include/composer-command-buffer/2.2/ComposerCommandBuffer.h
index c803d3c..138d700 100644
--- a/graphics/composer/2.2/utils/command-buffer/include/composer-command-buffer/2.2/ComposerCommandBuffer.h
+++ b/graphics/composer/2.2/utils/command-buffer/include/composer-command-buffer/2.2/ComposerCommandBuffer.h
@@ -47,8 +47,8 @@
 
 using android::hardware::MessageQueue;
 using android::hardware::graphics::common::V1_0::ColorTransform;
-using android::hardware::graphics::common::V1_0::Dataspace;
 using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::graphics::common::V1_1::Dataspace;
 using android::hardware::graphics::composer::V2_1::Config;
 using android::hardware::graphics::composer::V2_1::Display;
 using android::hardware::graphics::composer::V2_1::Error;
@@ -64,6 +64,16 @@
    public:
     CommandWriterBase(uint32_t initialMaxSize) : V2_1::CommandWriterBase(initialMaxSize) {}
 
+    void setClientTarget(uint32_t slot, const native_handle_t* target, int acquireFence,
+                         Dataspace dataspace, const std::vector<IComposerClient::Rect>& damage) {
+        setClientTargetInternal(slot, target, acquireFence, static_cast<int32_t>(dataspace),
+                                damage);
+    }
+
+    void setLayerDataspace(Dataspace dataspace) {
+        setLayerDataspaceInternal(static_cast<int32_t>(dataspace));
+    }
+
     static constexpr uint16_t kSetLayerFloatColorLength = 4;
     void setLayerFloatColor(IComposerClient::FloatColor color) {
         beginCommand_2_2(IComposerClient::Command::SET_LAYER_FLOAT_COLOR,
@@ -72,8 +82,9 @@
         endCommand();
     }
 
-    void setPerFrameMetadata(const hidl_vec<IComposerClient::PerFrameMetadata>& metadataVec) {
-        beginCommand_2_2(IComposerClient::Command::SET_PER_FRAME_METADATA, metadataVec.size() * 2);
+    void setLayerPerFrameMetadata(const hidl_vec<IComposerClient::PerFrameMetadata>& metadataVec) {
+        beginCommand_2_2(IComposerClient::Command::SET_LAYER_PER_FRAME_METADATA,
+                         metadataVec.size() * 2);
         for (const auto& metadata : metadataVec) {
             writeSigned(static_cast<int32_t>(metadata.key));
             writeFloat(metadata.value);
diff --git a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
index d550f83..a6871fb 100644
--- a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
+++ b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerClient.h
@@ -99,10 +99,87 @@
         return mHal->setReadbackBuffer(display, readbackBuffer, std::move(fenceFd));
     }
 
+    Return<void> createVirtualDisplay_2_2(
+        uint32_t width, uint32_t height, PixelFormat formatHint, uint32_t outputBufferSlotCount,
+        IComposerClient::createVirtualDisplay_2_2_cb hidl_cb) override {
+        Display display = 0;
+        Error err = mHal->createVirtualDisplay_2_2(width, height, &formatHint, &display);
+        if (err == Error::NONE) {
+            mResources->addVirtualDisplay(display, outputBufferSlotCount);
+        }
+
+        hidl_cb(err, display, formatHint);
+        return Void();
+    }
+
+    Return<Error> getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                             PixelFormat format, Dataspace dataspace) override {
+        Error err = mHal->getClientTargetSupport_2_2(display, width, height, format, dataspace);
+        return err;
+    }
+
     Return<Error> setPowerMode_2_2(Display display, IComposerClient::PowerMode mode) override {
         return mHal->setPowerMode_2_2(display, mode);
     }
 
+    Return<void> getColorModes_2_2(Display display,
+                                   IComposerClient::getColorModes_2_2_cb hidl_cb) override {
+        hidl_vec<ColorMode> modes;
+        Error err = mHal->getColorModes_2_2(display, &modes);
+        hidl_cb(err, modes);
+        return Void();
+    }
+
+    Return<void> getRenderIntents(Display display, ColorMode mode,
+                                  IComposerClient::getRenderIntents_cb hidl_cb) override {
+#ifdef USES_DISPLAY_RENDER_INTENTS
+        std::vector<RenderIntent> intents;
+        Error err = mHal->getRenderIntents(display, mode, &intents);
+        hidl_cb(err, intents);
+#else
+        (void)display;
+        (void)mode;
+        hidl_cb(Error::NONE, hidl_vec<RenderIntent>({RenderIntent::COLORIMETRIC}));
+#endif
+        return Void();
+    }
+
+    Return<Error> setColorMode_2_2(Display display, ColorMode mode, RenderIntent intent) override {
+#ifndef USES_DISPLAY_RENDER_INTENTS
+        if (intent != RenderIntent::COLORIMETRIC) {
+            return Error::BAD_PARAMETER;
+        }
+#endif
+        return mHal->setColorMode_2_2(display, mode, intent);
+    }
+
+    Return<void> getDataspaceSaturationMatrix(
+        Dataspace dataspace, IComposerClient::getDataspaceSaturationMatrix_cb hidl_cb) override {
+        if (dataspace != Dataspace::SRGB_LINEAR) {
+            hidl_cb(Error::BAD_PARAMETER, std::array<float, 16>{0.0f}.data());
+            return Void();
+        }
+
+        hidl_cb(Error::NONE, mHal->getDataspaceSaturationMatrix(dataspace).data());
+        return Void();
+    }
+
+    Return<void> executeCommands_2_2(uint32_t inLength, const hidl_vec<hidl_handle>& inHandles,
+                                     IComposerClient::executeCommands_2_2_cb hidl_cb) override {
+        std::lock_guard<std::mutex> lock(mCommandEngineMutex);
+        bool outChanged = false;
+        uint32_t outLength = 0;
+        hidl_vec<hidl_handle> outHandles;
+        Error error =
+            mCommandEngine->execute(inLength, inHandles, &outChanged, &outLength, &outHandles);
+
+        hidl_cb(error, outChanged, outLength, outHandles);
+
+        mCommandEngine->reset();
+
+        return Void();
+    }
+
    protected:
     std::unique_ptr<V2_1::hal::ComposerResources> createResources() override {
         return ComposerResources::create();
@@ -146,6 +223,8 @@
 
    private:
     using BaseType2_1 = V2_1::hal::detail::ComposerClientImpl<Interface, Hal>;
+    using BaseType2_1::mCommandEngine;
+    using BaseType2_1::mCommandEngineMutex;
     using BaseType2_1::mHal;
     using BaseType2_1::mResources;
 };
diff --git a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerCommandEngine.h b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerCommandEngine.h
index adcac46..97e3a9e 100644
--- a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerCommandEngine.h
+++ b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerCommandEngine.h
@@ -40,8 +40,8 @@
    protected:
     bool executeCommand(V2_1::IComposerClient::Command command, uint16_t length) override {
         switch (static_cast<IComposerClient::Command>(command)) {
-            case IComposerClient::Command::SET_PER_FRAME_METADATA:
-                return executeSetPerFrameMetadata(length);
+            case IComposerClient::Command::SET_LAYER_PER_FRAME_METADATA:
+                return executeSetLayerPerFrameMetadata(length);
             case IComposerClient::Command::SET_LAYER_FLOAT_COLOR:
                 return executeSetLayerFloatColor(length);
             default:
@@ -49,7 +49,7 @@
         }
     }
 
-    bool executeSetPerFrameMetadata(uint16_t length) {
+    bool executeSetLayerPerFrameMetadata(uint16_t length) {
         // (key, value) pairs
         if (length % 2 != 0) {
             return false;
@@ -63,7 +63,7 @@
             length -= 2;
         }
 
-        auto err = mHal->setPerFrameMetadata(mCurrentDisplay, metadata);
+        auto err = mHal->setLayerPerFrameMetadata(mCurrentDisplay, mCurrentLayer, metadata);
         if (err != Error::NONE) {
             mWriter.setError(getCommandLoc(), err);
         }
diff --git a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerHal.h b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerHal.h
index 30b3643..335dc24 100644
--- a/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerHal.h
+++ b/graphics/composer/2.2/utils/hal/include/composer-hal/2.2/ComposerHal.h
@@ -28,34 +28,68 @@
 namespace V2_2 {
 namespace hal {
 
-using common::V1_0::Dataspace;
-using common::V1_0::PixelFormat;
+using common::V1_1::ColorMode;
+using common::V1_1::Dataspace;
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
 using V2_1::Display;
 using V2_1::Error;
 using V2_1::Layer;
 
 class ComposerHal : public V2_1::hal::ComposerHal {
    public:
+    Error createVirtualDisplay(uint32_t width, uint32_t height, common::V1_0::PixelFormat* format,
+                               Display* outDisplay) override {
+        return createVirtualDisplay_2_2(width, height, reinterpret_cast<PixelFormat*>(format),
+                                        outDisplay);
+    }
+    Error getClientTargetSupport(Display display, uint32_t width, uint32_t height,
+                                 common::V1_0::PixelFormat format,
+                                 common::V1_0::Dataspace dataspace) override {
+        return getClientTargetSupport_2_2(display, width, height, static_cast<PixelFormat>(format),
+                                          static_cast<Dataspace>(dataspace));
+    }
     // superceded by setPowerMode_2_2
     Error setPowerMode(Display display, V2_1::IComposerClient::PowerMode mode) override {
         return setPowerMode_2_2(display, static_cast<IComposerClient::PowerMode>(mode));
     }
 
+    // superceded by getColorModes_2_2
+    Error getColorModes(Display display, hidl_vec<common::V1_0::ColorMode>* outModes) override {
+        return getColorModes_2_2(display, reinterpret_cast<hidl_vec<ColorMode>*>(outModes));
+    }
+
+    // superceded by setColorMode_2_2
+    Error setColorMode(Display display, common::V1_0::ColorMode mode) override {
+        return setColorMode_2_2(display, static_cast<ColorMode>(mode), RenderIntent::COLORIMETRIC);
+    }
+
     virtual Error getPerFrameMetadataKeys(
         Display display, std::vector<IComposerClient::PerFrameMetadataKey>* outKeys) = 0;
-    virtual Error setPerFrameMetadata(
-        Display display, const std::vector<IComposerClient::PerFrameMetadata>& metadata) = 0;
+    virtual Error setLayerPerFrameMetadata(
+        Display display, Layer layer,
+        const std::vector<IComposerClient::PerFrameMetadata>& metadata) = 0;
 
     virtual Error getReadbackBufferAttributes(Display display, PixelFormat* outFormat,
                                               Dataspace* outDataspace) = 0;
     virtual Error setReadbackBuffer(Display display, const native_handle_t* bufferHandle,
                                     base::unique_fd fenceFd) = 0;
     virtual Error getReadbackBufferFence(Display display, base::unique_fd* outFenceFd) = 0;
-
+    virtual Error createVirtualDisplay_2_2(uint32_t width, uint32_t height, PixelFormat* format,
+                                           Display* outDisplay) = 0;
+    virtual Error getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                             PixelFormat format, Dataspace dataspace) = 0;
     virtual Error setPowerMode_2_2(Display display, IComposerClient::PowerMode mode) = 0;
 
     virtual Error setLayerFloatColor(Display display, Layer layer,
                                      IComposerClient::FloatColor color) = 0;
+
+    virtual Error getColorModes_2_2(Display display, hidl_vec<ColorMode>* outModes) = 0;
+    virtual Error getRenderIntents(Display display, ColorMode mode,
+                                   std::vector<RenderIntent>* outIntents) = 0;
+    virtual Error setColorMode_2_2(Display display, ColorMode mode, RenderIntent intent) = 0;
+
+    virtual std::array<float, 16> getDataspaceSaturationMatrix(Dataspace dataspace) = 0;
 };
 
 }  // namespace hal
diff --git a/graphics/composer/2.2/utils/passthrough/include/composer-passthrough/2.2/HwcHal.h b/graphics/composer/2.2/utils/passthrough/include/composer-passthrough/2.2/HwcHal.h
index b251351..93da0a5 100644
--- a/graphics/composer/2.2/utils/passthrough/include/composer-passthrough/2.2/HwcHal.h
+++ b/graphics/composer/2.2/utils/passthrough/include/composer-passthrough/2.2/HwcHal.h
@@ -34,8 +34,10 @@
 
 namespace detail {
 
-using common::V1_0::Dataspace;
-using common::V1_0::PixelFormat;
+using common::V1_1::ColorMode;
+using common::V1_1::Dataspace;
+using common::V1_1::PixelFormat;
+using common::V1_1::RenderIntent;
 using V2_1::Display;
 using V2_1::Error;
 using V2_1::Layer;
@@ -72,9 +74,10 @@
         return Error::NONE;
     }
 
-    Error setPerFrameMetadata(
-        Display display, const std::vector<IComposerClient::PerFrameMetadata>& metadata) override {
-        if (!mDispatch.setPerFrameMetadata) {
+    Error setLayerPerFrameMetadata(
+        Display display, Layer layer,
+        const std::vector<IComposerClient::PerFrameMetadata>& metadata) override {
+        if (!mDispatch.setLayerPerFrameMetadata) {
             return Error::UNSUPPORTED;
         }
 
@@ -87,8 +90,8 @@
             values.push_back(m.value);
         }
 
-        int32_t error = mDispatch.setPerFrameMetadata(mDevice, display, metadata.size(),
-                                                      keys.data(), values.data());
+        int32_t error = mDispatch.setLayerPerFrameMetadata(mDevice, display, layer, metadata.size(),
+                                                           keys.data(), values.data());
         return static_cast<Error>(error);
     }
 
@@ -131,6 +134,19 @@
         return static_cast<Error>(error);
     }
 
+    Error createVirtualDisplay_2_2(uint32_t width, uint32_t height, PixelFormat* format,
+                                   Display* outDisplay) override {
+        return createVirtualDisplay(
+            width, height, reinterpret_cast<common::V1_0::PixelFormat*>(format), outDisplay);
+    }
+
+    Error getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                     PixelFormat format, Dataspace dataspace) override {
+        return getClientTargetSupport(display, width, height,
+                                      static_cast<common::V1_0::PixelFormat>(format),
+                                      static_cast<common::V1_0::Dataspace>(dataspace));
+    }
+
     Error setPowerMode_2_2(Display display, IComposerClient::PowerMode mode) override {
         if (mode == IComposerClient::PowerMode::ON_SUSPEND) {
             return Error::UNSUPPORTED;
@@ -149,6 +165,69 @@
         return static_cast<Error>(error);
     }
 
+    Error getColorModes_2_2(Display display, hidl_vec<ColorMode>* outModes) override {
+        return getColorModes(display,
+                             reinterpret_cast<hidl_vec<common::V1_0::ColorMode>*>(outModes));
+    }
+
+    Error getRenderIntents(Display display, ColorMode mode,
+                           std::vector<RenderIntent>* outIntents) override {
+        if (!mDispatch.getRenderIntents) {
+            *outIntents = std::vector<RenderIntent>({RenderIntent::COLORIMETRIC});
+            return Error::NONE;
+        }
+
+        uint32_t count = 0;
+        int32_t error =
+            mDispatch.getRenderIntents(mDevice, display, int32_t(mode), &count, nullptr);
+        if (error != HWC2_ERROR_NONE) {
+            return static_cast<Error>(error);
+        }
+
+        std::vector<RenderIntent> intents(count);
+        error = mDispatch.getRenderIntents(
+            mDevice, display, int32_t(mode), &count,
+            reinterpret_cast<std::underlying_type<RenderIntent>::type*>(intents.data()));
+        if (error != HWC2_ERROR_NONE) {
+            return static_cast<Error>(error);
+        }
+        intents.resize(count);
+
+        *outIntents = std::move(intents);
+        return Error::NONE;
+    }
+
+    Error setColorMode_2_2(Display display, ColorMode mode, RenderIntent intent) override {
+        if (!mDispatch.setColorModeWithRenderIntent) {
+            if (intent != RenderIntent::COLORIMETRIC) {
+                return Error::UNSUPPORTED;
+            }
+            return setColorMode(display, static_cast<common::V1_0::ColorMode>(mode));
+        }
+
+        int32_t err = mDispatch.setColorModeWithRenderIntent(
+            mDevice, display, static_cast<int32_t>(mode), static_cast<int32_t>(intent));
+        return static_cast<Error>(err);
+    }
+
+    std::array<float, 16> getDataspaceSaturationMatrix(Dataspace dataspace) override {
+        std::array<float, 16> matrix;
+
+        int32_t error = HWC2_ERROR_UNSUPPORTED;
+        if (mDispatch.getDataspaceSaturationMatrix) {
+            error = mDispatch.getDataspaceSaturationMatrix(mDevice, static_cast<int32_t>(dataspace),
+                                                           matrix.data());
+        }
+        if (error != HWC2_ERROR_NONE) {
+            return std::array<float, 16>{
+                1.0f, 0.0f, 0.0f, 0.0f, 0.0f, 1.0f, 0.0f, 0.0f,
+                0.0f, 0.0f, 1.0f, 0.0f, 0.0f, 0.0f, 0.0f, 1.0f,
+            };
+        }
+
+        return matrix;
+    }
+
    protected:
     template <typename T>
     bool initOptionalDispatch(hwc2_function_descriptor_t desc, T* outPfn) {
@@ -168,7 +247,8 @@
 
         initOptionalDispatch(HWC2_FUNCTION_SET_LAYER_FLOAT_COLOR, &mDispatch.setLayerFloatColor);
 
-        initOptionalDispatch(HWC2_FUNCTION_SET_PER_FRAME_METADATA, &mDispatch.setPerFrameMetadata);
+        initOptionalDispatch(HWC2_FUNCTION_SET_LAYER_PER_FRAME_METADATA,
+                             &mDispatch.setLayerPerFrameMetadata);
         initOptionalDispatch(HWC2_FUNCTION_GET_PER_FRAME_METADATA_KEYS,
                              &mDispatch.getPerFrameMetadataKeys);
 
@@ -178,21 +258,34 @@
         initOptionalDispatch(HWC2_FUNCTION_GET_READBACK_BUFFER_FENCE,
                              &mDispatch.getReadbackBufferFence);
 
+        initOptionalDispatch(HWC2_FUNCTION_GET_RENDER_INTENTS, &mDispatch.getRenderIntents);
+        initOptionalDispatch(HWC2_FUNCTION_SET_COLOR_MODE_WITH_RENDER_INTENT,
+                             &mDispatch.setColorModeWithRenderIntent);
+        initOptionalDispatch(HWC2_FUNCTION_GET_DATASPACE_SATURATION_MATRIX,
+                             &mDispatch.getDataspaceSaturationMatrix);
+
         return true;
     }
 
     struct {
         HWC2_PFN_SET_LAYER_FLOAT_COLOR setLayerFloatColor;
-        HWC2_PFN_SET_PER_FRAME_METADATA setPerFrameMetadata;
+        HWC2_PFN_SET_LAYER_PER_FRAME_METADATA setLayerPerFrameMetadata;
         HWC2_PFN_GET_PER_FRAME_METADATA_KEYS getPerFrameMetadataKeys;
         HWC2_PFN_SET_READBACK_BUFFER setReadbackBuffer;
         HWC2_PFN_GET_READBACK_BUFFER_ATTRIBUTES getReadbackBufferAttributes;
         HWC2_PFN_GET_READBACK_BUFFER_FENCE getReadbackBufferFence;
+        HWC2_PFN_GET_RENDER_INTENTS getRenderIntents;
+        HWC2_PFN_SET_COLOR_MODE_WITH_RENDER_INTENT setColorModeWithRenderIntent;
+        HWC2_PFN_GET_DATASPACE_SATURATION_MATRIX getDataspaceSaturationMatrix;
     } mDispatch = {};
 
    private:
     using BaseType2_1 = V2_1::passthrough::detail::HwcHalImpl<Hal>;
+    using BaseType2_1::getColorModes;
     using BaseType2_1::mDevice;
+    using BaseType2_1::setColorMode;
+    using BaseType2_1::createVirtualDisplay;
+    using BaseType2_1::getClientTargetSupport;
     using BaseType2_1::setPowerMode;
 };
 
diff --git a/graphics/composer/2.2/utils/vts/Android.bp b/graphics/composer/2.2/utils/vts/Android.bp
index 641fdcb..c6b524d 100644
--- a/graphics/composer/2.2/utils/vts/Android.bp
+++ b/graphics/composer/2.2/utils/vts/Android.bp
@@ -26,10 +26,17 @@
         "android.hardware.graphics.composer@2.1-vts",
         "android.hardware.graphics.composer@2.2",
     ],
+    export_static_lib_headers: [
+        "android.hardware.graphics.composer@2.1-vts",
+    ],
     header_libs: [
         "android.hardware.graphics.composer@2.1-command-buffer",
         "android.hardware.graphics.composer@2.2-command-buffer",
     ],
+    export_header_lib_headers: [
+        "android.hardware.graphics.composer@2.1-command-buffer",
+        "android.hardware.graphics.composer@2.2-command-buffer",
+    ],
     cflags: [
         "-O0",
         "-g",
diff --git a/graphics/composer/2.2/utils/vts/ComposerVts.cpp b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
index b536f67..357c772 100644
--- a/graphics/composer/2.2/utils/vts/ComposerVts.cpp
+++ b/graphics/composer/2.2/utils/vts/ComposerVts.cpp
@@ -87,6 +87,33 @@
                                   });
 }
 
+Display ComposerClient_v2_2::createVirtualDisplay_2_2(uint32_t width, uint32_t height,
+                                                      PixelFormat formatHint,
+                                                      uint32_t outputBufferSlotCount,
+                                                      PixelFormat* outFormat) {
+    Display display = 0;
+    mClient_v2_2->createVirtualDisplay_2_2(
+        width, height, formatHint, outputBufferSlotCount,
+        [&](const auto& tmpError, const auto& tmpDisplay, const auto& tmpFormat) {
+            ASSERT_EQ(Error::NONE, tmpError) << "failed to create virtual display";
+            display = tmpDisplay;
+            *outFormat = tmpFormat;
+
+            ASSERT_TRUE(mDisplayResources.insert({display, DisplayResource(true)}).second)
+                << "duplicated virtual display id " << display;
+        });
+
+    return display;
+}
+
+bool ComposerClient_v2_2::getClientTargetSupport_2_2(Display display, uint32_t width,
+                                                     uint32_t height, PixelFormat format,
+                                                     Dataspace dataspace) {
+    Error error =
+        mClient_v2_2->getClientTargetSupport_2_2(display, width, height, format, dataspace);
+    return error == Error::NONE;
+}
+
 void ComposerClient_v2_2::setPowerMode_2_2(Display display, V2_2::IComposerClient::PowerMode mode) {
     Error error = mClient_v2_2->setPowerMode_2_2(display, mode);
     ASSERT_TRUE(error == Error::NONE || error == Error::UNSUPPORTED) << "failed to set power mode";
@@ -119,6 +146,41 @@
     *outFence = 0;
 }
 
+std::vector<ColorMode> ComposerClient_v2_2::getColorModes(Display display) {
+    std::vector<ColorMode> modes;
+    mClient_v2_2->getColorModes_2_2(display, [&](const auto& tmpError, const auto& tmpModes) {
+        ASSERT_EQ(Error::NONE, tmpError) << "failed to get color modes";
+        modes = tmpModes;
+    });
+    return modes;
+}
+
+std::vector<RenderIntent> ComposerClient_v2_2::getRenderIntents(Display display, ColorMode mode) {
+    std::vector<RenderIntent> intents;
+    mClient_v2_2->getRenderIntents(
+        display, mode, [&](const auto& tmpError, const auto& tmpIntents) {
+            ASSERT_EQ(Error::NONE, tmpError) << "failed to get render intents";
+            intents = tmpIntents;
+        });
+    return intents;
+}
+
+void ComposerClient_v2_2::setColorMode(Display display, ColorMode mode, RenderIntent intent) {
+    Error error = mClient_v2_2->setColorMode_2_2(display, mode, intent);
+    ASSERT_TRUE(error == Error::NONE || error == Error::UNSUPPORTED) << "failed to set color mode";
+}
+
+std::array<float, 16> ComposerClient_v2_2::getDataspaceSaturationMatrix(Dataspace dataspace) {
+    std::array<float, 16> matrix;
+    mClient_v2_2->getDataspaceSaturationMatrix(
+        dataspace, [&](const auto& tmpError, const auto& tmpMatrix) {
+            ASSERT_EQ(Error::NONE, tmpError) << "failed to get datasapce saturation matrix";
+            std::copy_n(tmpMatrix.data(), matrix.size(), matrix.begin());
+        });
+
+    return matrix;
+}
+
 }  // namespace vts
 }  // namespace V2_2
 }  // namespace composer
diff --git a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
index eced69f..62ab83f 100644
--- a/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
+++ b/graphics/composer/2.2/utils/vts/include/composer-vts/2.2/ComposerVts.h
@@ -36,10 +36,11 @@
 namespace V2_2 {
 namespace vts {
 
-using android::hardware::graphics::common::V1_0::ColorMode;
-using android::hardware::graphics::common::V1_0::Dataspace;
 using android::hardware::graphics::common::V1_0::Hdr;
-using android::hardware::graphics::common::V1_0::PixelFormat;
+using android::hardware::graphics::common::V1_1::ColorMode;
+using android::hardware::graphics::common::V1_1::Dataspace;
+using android::hardware::graphics::common::V1_1::PixelFormat;
+using android::hardware::graphics::common::V1_1::RenderIntent;
 using android::hardware::graphics::composer::V2_2::IComposer;
 using android::hardware::graphics::composer::V2_2::IComposerClient;
 
@@ -66,12 +67,22 @@
 
     std::vector<IComposerClient::PerFrameMetadataKey> getPerFrameMetadataKeys(Display display);
 
+    Display createVirtualDisplay_2_2(uint32_t width, uint32_t height, PixelFormat formatHint,
+                                     uint32_t outputBufferSlotCount, PixelFormat* outFormat);
+    bool getClientTargetSupport_2_2(Display display, uint32_t width, uint32_t height,
+                                    PixelFormat format, Dataspace dataspace);
     void setPowerMode_2_2(Display display, V2_2::IComposerClient::PowerMode mode);
     void setReadbackBuffer(Display display, const native_handle_t* buffer, int32_t releaseFence);
     void getReadbackBufferAttributes(Display display, PixelFormat* outPixelFormat,
                                      Dataspace* outDataspace);
     void getReadbackBufferFence(Display display, int32_t* outFence);
 
+    std::vector<ColorMode> getColorModes(Display display);
+    std::vector<RenderIntent> getRenderIntents(Display display, ColorMode mode);
+    void setColorMode(Display display, ColorMode mode, RenderIntent intent);
+
+    std::array<float, 16> getDataspaceSaturationMatrix(Dataspace dataspace);
+
    private:
     sp<V2_2::IComposerClient> mClient_v2_2;
 };
diff --git a/graphics/composer/2.2/vts/functional/Android.bp b/graphics/composer/2.2/vts/functional/Android.bp
index 7747900..669fbae 100644
--- a/graphics/composer/2.2/vts/functional/Android.bp
+++ b/graphics/composer/2.2/vts/functional/Android.bp
@@ -27,6 +27,7 @@
     ],
     static_libs: [
         "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.common@1.1",
         "android.hardware.graphics.composer@2.1",
         "android.hardware.graphics.composer@2.1-vts",
         "android.hardware.graphics.composer@2.2",
@@ -34,6 +35,7 @@
         "android.hardware.graphics.mapper@2.0",
         "android.hardware.graphics.mapper@2.0-vts",
         "android.hardware.graphics.mapper@2.1",
+        "android.hardware.graphics.mapper@2.1-vts",
     ],
     header_libs: [
         "android.hardware.graphics.composer@2.1-command-buffer",
diff --git a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
index c494329..4e41333 100644
--- a/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
+++ b/graphics/composer/2.2/vts/functional/VtsHalGraphicsComposerV2_2TargetTest.cpp
@@ -22,7 +22,7 @@
 #include <composer-vts/2.1/GraphicsComposerCallback.h>
 #include <composer-vts/2.1/TestCommandReader.h>
 #include <composer-vts/2.2/ComposerVts.h>
-#include <mapper-vts/2.0/MapperVts.h>
+#include <mapper-vts/2.1/MapperVts.h>
 
 namespace android {
 namespace hardware {
@@ -33,14 +33,15 @@
 namespace {
 
 using android::hardware::graphics::common::V1_0::BufferUsage;
-using android::hardware::graphics::common::V1_0::ColorMode;
 using android::hardware::graphics::common::V1_0::ColorTransform;
-using android::hardware::graphics::common::V1_0::Dataspace;
-using android::hardware::graphics::common::V1_0::PixelFormat;
 using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::graphics::common::V1_1::ColorMode;
+using android::hardware::graphics::common::V1_1::Dataspace;
+using android::hardware::graphics::common::V1_1::PixelFormat;
+using android::hardware::graphics::common::V1_1::RenderIntent;
 using android::hardware::graphics::composer::V2_2::IComposerClient;
-using android::hardware::graphics::mapper::V2_0::IMapper;
-using android::hardware::graphics::mapper::V2_0::vts::Gralloc;
+using android::hardware::graphics::mapper::V2_1::IMapper;
+using android::hardware::graphics::mapper::V2_1::vts::Gralloc;
 using GrallocError = android::hardware::graphics::mapper::V2_0::Error;
 
 // Test environment for graphics.composer
@@ -146,9 +147,9 @@
 };
 
 /**
- * Test IComposerClient::Command::SET_PER_FRAME_METADATA.
+ * Test IComposerClient::Command::SET_LAYER_PER_FRAME_METADATA.
  */
-TEST_F(GraphicsComposerHidlCommandTest, SET_PER_FRAME_METADATA) {
+TEST_F(GraphicsComposerHidlCommandTest, SET_LAYER_PER_FRAME_METADATA) {
     Layer layer;
     ASSERT_NO_FATAL_FAILURE(layer =
                                 mComposerClient->createLayer(mPrimaryDisplay, kBufferSlotCount));
@@ -182,7 +183,7 @@
     hidlMetadata.push_back({IComposerClient::PerFrameMetadataKey::MAX_CONTENT_LIGHT_LEVEL, 78.0});
     hidlMetadata.push_back(
         {IComposerClient::PerFrameMetadataKey::MAX_FRAME_AVERAGE_LIGHT_LEVEL, 62.0});
-    mWriter->setPerFrameMetadata(hidlMetadata);
+    mWriter->setLayerPerFrameMetadata(hidlMetadata);
     execute();
 }
 
@@ -192,6 +193,55 @@
 TEST_F(GraphicsComposerHidlTest, GetPerFrameMetadataKeys) {
     mComposerClient->getPerFrameMetadataKeys(mPrimaryDisplay);
 }
+
+/**
+ * Test IComposerClient::createVirtualDisplay_2_2 and
+ * IComposerClient::destroyVirtualDisplay.
+ *
+ * Test that virtual displays can be created and has the correct display type.
+ */
+TEST_F(GraphicsComposerHidlTest, CreateVirtualDisplay_2_2) {
+    if (mComposerClient->getMaxVirtualDisplayCount() == 0) {
+        GTEST_SUCCEED() << "no virtual display support";
+        return;
+    }
+
+    Display display;
+    PixelFormat format;
+    ASSERT_NO_FATAL_FAILURE(
+        display = mComposerClient->createVirtualDisplay_2_2(
+            64, 64, PixelFormat::IMPLEMENTATION_DEFINED, kBufferSlotCount, &format));
+
+    // test display type
+    IComposerClient::DisplayType type = mComposerClient->getDisplayType(display);
+    EXPECT_EQ(IComposerClient::DisplayType::VIRTUAL, type);
+
+    mComposerClient->destroyVirtualDisplay(display);
+}
+
+/**
+ * Test IComposerClient::getClientTargetSupport_2_2.
+ *
+ * Test that IComposerClient::getClientTargetSupport returns true for the
+ * required client targets.
+ */
+TEST_F(GraphicsComposerHidlTest, GetClientTargetSupport_2_2) {
+    std::vector<Config> configs = mComposerClient->getDisplayConfigs(mPrimaryDisplay);
+    for (auto config : configs) {
+        int32_t width = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                             IComposerClient::Attribute::WIDTH);
+        int32_t height = mComposerClient->getDisplayAttribute(mPrimaryDisplay, config,
+                                                              IComposerClient::Attribute::HEIGHT);
+        ASSERT_LT(0, width);
+        ASSERT_LT(0, height);
+
+        mComposerClient->setActiveConfig(mPrimaryDisplay, config);
+
+        ASSERT_TRUE(mComposerClient->getClientTargetSupport_2_2(
+            mPrimaryDisplay, width, height, PixelFormat::RGBA_8888, Dataspace::UNKNOWN));
+    }
+}
+
 /**
  * Test IComposerClient::setPowerMode_2_2.
  */
@@ -235,6 +285,56 @@
     mWriter->setLayerFloatColor(IComposerClient::FloatColor{0.0, 0.0, 0.0, 0.0});
 }
 
+/**
+ * Test IComposerClient::getDataspaceSaturationMatrix.
+ */
+TEST_F(GraphicsComposerHidlTest, getDataspaceSaturationMatrix) {
+    auto matrix = mComposerClient->getDataspaceSaturationMatrix(Dataspace::SRGB_LINEAR);
+    // the last row is known
+    ASSERT_EQ(0.0f, matrix[12]);
+    ASSERT_EQ(0.0f, matrix[13]);
+    ASSERT_EQ(0.0f, matrix[14]);
+    ASSERT_EQ(1.0f, matrix[15]);
+}
+
+/**
+ * Test IComposerClient::getColorMode_2_2.
+ */
+TEST_F(GraphicsComposerHidlTest, GetColorMode_2_2) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+
+    auto nativeMode = std::find(modes.cbegin(), modes.cend(), ColorMode::NATIVE);
+    EXPECT_NE(modes.cend(), nativeMode);
+}
+
+/**
+ * Test IComposerClient::getRenderIntent.
+ */
+TEST_F(GraphicsComposerHidlTest, GetRenderIntent) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+    for (auto mode : modes) {
+        std::vector<RenderIntent> intents =
+            mComposerClient->getRenderIntents(mPrimaryDisplay, mode);
+        auto colorimetricIntent =
+            std::find(intents.cbegin(), intents.cend(), RenderIntent::COLORIMETRIC);
+        EXPECT_NE(intents.cend(), colorimetricIntent);
+    }
+}
+
+/**
+ * Test IComposerClient::setColorMode_2_2.
+ */
+TEST_F(GraphicsComposerHidlTest, SetColorMode_2_2) {
+    std::vector<ColorMode> modes = mComposerClient->getColorModes(mPrimaryDisplay);
+    for (auto mode : modes) {
+        std::vector<RenderIntent> intents =
+            mComposerClient->getRenderIntents(mPrimaryDisplay, mode);
+        for (auto intent : intents) {
+            mComposerClient->setColorMode(mPrimaryDisplay, mode, intent);
+        }
+    }
+}
+
 }  // namespace
 }  // namespace vts
 }  // namespace V2_2
diff --git a/graphics/mapper/2.1/utils/vts/MapperVts.cpp b/graphics/mapper/2.1/utils/vts/MapperVts.cpp
index 0aaa926..078068e 100644
--- a/graphics/mapper/2.1/utils/vts/MapperVts.cpp
+++ b/graphics/mapper/2.1/utils/vts/MapperVts.cpp
@@ -43,6 +43,13 @@
                       offsetof(IMapper::BufferDescriptorInfo, usage),
               "");
 
+Gralloc::Gralloc() : V2_0::vts::Gralloc() {
+    if (::testing::Test::HasFatalFailure()) {
+        return;
+    }
+    init();
+}
+
 Gralloc::Gralloc(const std::string& allocatorServiceName, const std::string& mapperServiceName)
     : V2_0::vts::Gralloc(allocatorServiceName, mapperServiceName) {
     if (::testing::Test::HasFatalFailure()) {
diff --git a/graphics/mapper/2.1/utils/vts/include/mapper-vts/2.1/MapperVts.h b/graphics/mapper/2.1/utils/vts/include/mapper-vts/2.1/MapperVts.h
index b7fa751..423d4b3 100644
--- a/graphics/mapper/2.1/utils/vts/include/mapper-vts/2.1/MapperVts.h
+++ b/graphics/mapper/2.1/utils/vts/include/mapper-vts/2.1/MapperVts.h
@@ -32,6 +32,7 @@
 // A wrapper to IAllocator and IMapper.
 class Gralloc : public V2_0::vts::Gralloc {
    public:
+    Gralloc();
     Gralloc(const std::string& allocatorServiceName, const std::string& mapperServiceName);
 
     sp<IMapper> getMapper() const;
diff --git a/health/2.0/README b/health/2.0/README
index 49b2b1e..11e6a7a 100644
--- a/health/2.0/README
+++ b/health/2.0/README
@@ -1,11 +1,18 @@
 Upgrading from health@1.0 HAL
 
-0. Remove android.hardware.health@1.0* from PRDOUCT_PACKAGES
+0. Remove android.hardware.health@1.0* from PRODUCT_PACKAGES
    in device/<manufacturer>/<device>/device.mk
 
 1. If the device does not have a vendor-specific libhealthd AND does not
-   implement storage-related APIs, just add the following to PRODUCT_PACKAGES:
-   android.hardware.health@2.0-service
+   implement storage-related APIs, just do the following:
+
+    1.1 (recommended) To remove healthd from the build,
+        PRODUCT_PACKAGES += android.hardware.health@2.0-service.override
+        DEVICE_FRAMEWORK_MANIFEST_FILE += \
+            system/libhidl/vintfdata/manifest_healthd_exclude.xml
+    1.2 To keep healthd in the build,
+        PRODUCT_PACKAGES += android.hardware.health@2.0-service
+
    Otherwise, continue to Step 2.
 
 2. Create directory
@@ -45,14 +52,26 @@
     ],
 
     header_libs: ["libhealthd_headers"],
+
+    // Uncomment the following to remove healthd from the build.
+    // overrides: [
+    //     "healthd",
+    // ],
 }
 
+    3.1 (recommended) To remove healthd from the build, keep "overrides"
+          section, and include the following in device.mk:
+            DEVICE_FRAMEWORK_MANIFEST_FILE += \
+                system/libhidl/vintfdata/manifest_healthd_exclude.xml
+    3.2 To keep healthd in the build, remove "overrides" section.
+
 4. Create device/<manufacturer>/<device>/health/android.hardware.health@2.0-service.<device>.rc
 
 service vendor.health-hal-2-0 /vendor/bin/hw/android.hardware.health@2.0-service.<device>
     class hal
     user system
     group system
+    file /dev/kmsg w
 
 5. Create device/<manufacturer>/<device>/health/HealthService.cpp:
 
diff --git a/health/2.0/default/Health.cpp b/health/2.0/default/Health.cpp
index 7a3e650..6d3be99 100644
--- a/health/2.0/default/Health.cpp
+++ b/health/2.0/default/Health.cpp
@@ -16,6 +16,7 @@
 #define LOG_TAG "android.hardware.health@2.0-impl"
 #include <android-base/logging.h>
 
+#include <android-base/file.h>
 #include <health2/Health.h>
 
 #include <hal_conversion.h>
@@ -189,6 +190,17 @@
     if (handle != nullptr && handle->numFds >= 1) {
         int fd = handle->data[0];
         battery_monitor_->dumpState(fd);
+
+        getHealthInfo([fd](auto res, const auto& info) {
+            android::base::WriteStringToFd("\ngetHealthInfo -> ", fd);
+            if (res == Result::SUCCESS) {
+                android::base::WriteStringToFd(toString(info), fd);
+            } else {
+                android::base::WriteStringToFd(toString(res), fd);
+            }
+            android::base::WriteStringToFd("\n", fd);
+        });
+
         fsync(fd);
     }
     return Void();
diff --git a/keymaster/4.0/support/Keymaster.cpp b/keymaster/4.0/support/Keymaster.cpp
index bf52c47..fac0017 100644
--- a/keymaster/4.0/support/Keymaster.cpp
+++ b/keymaster/4.0/support/Keymaster.cpp
@@ -40,7 +40,7 @@
     serviceManager->listByInterface(descriptor, [&](const hidl_vec<hidl_string>& names) {
         for (auto& name : names) {
             if (name == "default") foundDefault = true;
-            auto device = Wrapper::WrappedIKeymasterDevice::getService();
+            auto device = Wrapper::WrappedIKeymasterDevice::getService(name);
             CHECK(device) << "Failed to get service for " << descriptor << " with interface name "
                           << name;
             result.push_back(std::unique_ptr<Keymaster>(new Wrapper(device, name)));
diff --git a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
index 37d8c42..e266a86 100644
--- a/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
+++ b/keymaster/4.0/vts/functional/KeymasterHidlTest.cpp
@@ -462,6 +462,7 @@
     auto authset = AuthorizationSetBuilder()
                        .TripleDesEncryptionKey(key.size() * 7)
                        .BlockMode(block_mode)
+                       .Authorization(TAG_NO_AUTH_REQUIRED)
                        .Padding(padding_mode);
     if (iv.size()) authset.Authorization(TAG_CALLER_NONCE);
     ASSERT_EQ(ErrorCode::OK, ImportKey(authset, KeyFormat::RAW, key));
@@ -535,7 +536,7 @@
     EXPECT_EQ(1U, out_params.size());
     auto ivVal = out_params.GetTagValue(TAG_NONCE);
     EXPECT_TRUE(ivVal.isOk());
-    *iv_out = ivVal.value();
+    if (ivVal.isOk()) *iv_out = ivVal.value();
     return ciphertext;
 }
 
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index 602355b..bc33b2b 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -1819,24 +1819,26 @@
 }
 
 auto wrapped_key = hex2str(
-    "30820173020100048201006F5C273914D9E7EAB667FE62456A57DE64BED4A57DB3EFBB77E6907C82CC36B0BD12CB8A"
-    "85F3F8BC08A26C58186DB5C35636063388A04AE5579D3BDC057F9BB0EB6FDDA5E836DBB1F18A4546A64BA06E3D0132"
-    "AAA3306676638C786FAF0722E6E4145E0C91B009C422691F9F42F9F179DA93E16E7793DE5960E77A387433F0B43E49"
-    "3A7CF77ECA25BA724CC02F916D5792CAA76BC0756D3DB5D110D209B8B30285E9653D91FD89E953F351D82ACE1422CC"
-    "A146F8BD0C2F4CC32D1F81D894F4650043DB46109869696319A1A011BB003F2EBD8FA20B4A43F3226C1F182A39AE81"
-    "A35B9B7590A48B6A6874C9CC0EE0CD9528FB908688B4111932DF478CD7A92B50040CD796B02C370F1FA4CC0124F130"
-    "280201033023A1083106020100020101A203020120A30402020100A4053103020101A60531030201400420CCD54085"
-    "5F833A5E1480BFD2D36FAF3AEEE15DF5BEABE2691BC82DDE2A7AA91004107CB81BDDCD09E8F4DF575726279F3229");
+    "3082017902010004820100A0E69B1395D382354FC0E7F74AC068C5818279D76D46745C7274997D045BAA8B9763B3F3"
+    "09E5E59ECA99273AAAE0A37449DA9B1E67B66EC4E42BB62C25346683A43A9F2ACBCA6D350B25551CC53CE0721D29BE"
+    "90F60686877478F82B3BB111C5EAC0BAE9310D7AD11F5A82948B31C322820F24E20DDB0FBD07D1566DAEAA058D4645"
+    "2607352699E1F631D2ABAF60B13E41ED5EDBB90D252331BDB9CDB1B672E871F37CAC009FE9028B3B1E0ACE8F6F0678"
+    "3F581B860620BDD478969EDE3101AAEFF65C6DB03E143E586167DC87D0CCE39E9119782F7B60A7A1CF2B7EE234E013"
+    "E3DE6C56F0D51F30C389D31FA37C5F2875ACB44434E82EF40B316C93DE129BA0040CD796B02C370F1FA4CC0124F130"
+    "2E0201033029A1083106020100020101A203020120A30402020100A4053103020101A6053103020140BF8377020500"
+    "0420CCD540855F833A5E1480BFD2D36FAF3AEEE15DF5BEABE2691BC82DDE2A7AA910041064C9F689C60FF6223AB6E6"
+    "999E0EB6E5");
 
 auto wrapped_key_masked = hex2str(
-    "30820173020100048201009059BB6E48F8036ABE1800D9C74F3DB5F20448F035C2C78AFBCC28AF26581061298CAC78"
-    "A8CA5B79721B60B74490555168488ED696C8930D00463C6FC81BF0B6E4E26C93E018D0E3DC8754C6B261E0A7C3A6DA"
-    "1A223EB59ACA8E13348F14B9E944AF3C224906C1ABFE21ADDEE81FC641D45E092C6B0A75A9BA56C05529AE47ECA0D5"
-    "CD3568501CF04D47391FC695EDE19A3022B347D1BDC6C792A08AA014F87DD4BBD44777B14D7D2273191DDCFE4E8512"
-    "EFA677A14E68E5D820C5513331D687C08B6317FA64D404231D05C74CDD9AEB89D253FBE07154B2080CF4ACA5E1EFCB"
-    "53EB193E8A01DD5F9634B65EF9B49899003E245FDA6A3B137FAC1263E55A6E1D040C6D9721D08589581AB49204A330"
-    "280201033023A1083106020100020101A203020120A30402020100A4053103020101A60531030201400420A61C6E24"
-    "7E25B3E6E69AA78EB03C2D4AC20D1F99A9A024A76F35C8E2CAB9B68D04101FF7A0E793B9EE4AECEBB9AC4C545254");
+    "30820179020100048201001EF5320D3C920D7614688A439409ACE4318C48395ABB7247A68671BD4B7156A7773B31A4"
+    "4459B73858625988A312E4D8855138F555678F525E4C52D91444FDC936BE6AEB63FD73FD84201EF46F88A0B622F528"
+    "956C92C9C731EB65BCBC6A03BEAB45959B54A768E2842D2CE174EE542EF2A15DCAA7542F3574BEEB1A991F95439466"
+    "E1960A9CE9E4CBC77DB23765191E4758C850908BCC74E158B77AB774141F171262C1AC771FDFA2E942F2F7633E97E8"
+    "0BD492C3E821361AC6B4F568DE351C816C8C997212C707F728FB3BCAAA796EA6B8E7A80BE010970B380122940277E9"
+    "4C5E9288F7CB6878A4C4CC1E83AB85A81FD68E43B14F1F81AD21E0D3545D70EE040C6D9721D08589581AB49204A330"
+    "2E0201033029A1083106020100020101A203020120A30402020100A4053103020101A6053103020140BF8377020500"
+    "0420A61C6E247E25B3E6E69AA78EB03C2D4AC20D1F99A9A024A76F35C8E2CAB9B68D04102560C70109AE67C030F00B"
+    "98B512A670");
 
 auto wrapping_key = hex2str(
     "308204be020100300d06092a864886f70d0101010500048204a8308204a40201000282010100aec367931d8900ce56"
@@ -3226,11 +3228,10 @@
  * Verifies that 3DES is basically functional.
  */
 TEST_F(EncryptionOperationsTest, TripleDesEcbRoundTripSuccess) {
-    std::cout << "Hello" << std::endl;
-
     auto auths = AuthorizationSetBuilder()
                      .TripleDesEncryptionKey(168)
                      .BlockMode(BlockMode::ECB)
+                     .Authorization(TAG_NO_AUTH_REQUIRED)
                      .Padding(PaddingMode::NONE);
 
     ASSERT_EQ(ErrorCode::OK, GenerateKey(auths));
@@ -3259,6 +3260,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
 
     auto inParams = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::NONE);
@@ -3274,6 +3276,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::PKCS7)));
 
     for (size_t i = 0; i < 32; ++i) {
@@ -3296,6 +3299,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
     for (size_t i = 0; i < 32; ++i) {
         auto inParams =
@@ -3313,6 +3317,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::PKCS7)));
 
     string message = "a";
@@ -3443,6 +3448,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
     // Two-block message.
     string message = "1234567890123456";
@@ -3471,6 +3477,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Authorization(TAG_CALLER_NONCE)
                                              .Padding(PaddingMode::NONE)));
     string message = "1234567890123456";
@@ -3505,6 +3512,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
 
     string message = "12345678901234567890123456789012";
@@ -3536,6 +3544,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::ECB)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
     // Two-block message.
     string message = "1234567890123456";
@@ -3553,6 +3562,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
     // Message is slightly shorter than two blocks.
     string message = "123456789012345";
@@ -3574,6 +3584,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::PKCS7)));
 
     // Try various message lengths; all should work.
@@ -3596,6 +3607,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
 
     // Try various message lengths; all should fail.
@@ -3615,6 +3627,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::PKCS7)));
 
     string message = "a";
@@ -3645,6 +3658,7 @@
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
                                              .TripleDesEncryptionKey(168)
                                              .BlockMode(BlockMode::CBC)
+                                             .Authorization(TAG_NO_AUTH_REQUIRED)
                                              .Padding(PaddingMode::NONE)));
 
     int increment = 7;
diff --git a/neuralnetworks/1.0/types.hal b/neuralnetworks/1.0/types.hal
index c97a00b..a9c91cd 100644
--- a/neuralnetworks/1.0/types.hal
+++ b/neuralnetworks/1.0/types.hal
@@ -44,7 +44,7 @@
      *
      * Attached to this tensor are two numbers that can be used to convert the
      * 8 bit integer to the real value and vice versa. These two numbers are:
-     * - scale: a 32 bit floating point value
+     * - scale: a 32 bit floating point value greater than zero
      * - zero_value: a 32 bit integer
      *
      * The formula is:
diff --git a/nfc/1.1/types.hal b/nfc/1.1/types.hal
index 469e878..e9ffd16 100644
--- a/nfc/1.1/types.hal
+++ b/nfc/1.1/types.hal
@@ -77,6 +77,9 @@
     /** Default system code route. 0x00 if there aren't any. Refer NCI spec */
     uint8_t defaultSystemCodeRoute;
 
+    /** Default power state for system code route. 0x00 if there aren't any. Refer NCI spec */
+    uint8_t defaultSystemCodePowerState;
+
     /**
      * Default route for all remaining protocols and technology which haven't
      * been configured.
diff --git a/radio/1.2/Android.bp b/radio/1.2/Android.bp
index a9c80b7..c90a03c 100644
--- a/radio/1.2/Android.bp
+++ b/radio/1.2/Android.bp
@@ -24,6 +24,7 @@
         "Call",
         "CardStatus",
         "CellConnectionStatus",
+        "CellIdentity",
         "CellIdentityCdma",
         "CellIdentityGsm",
         "CellIdentityLte",
@@ -36,6 +37,7 @@
         "CellInfoLte",
         "CellInfoTdscdma",
         "CellInfoWcdma",
+        "DataRegStateResult",
         "DataRequestReason",
         "IncrementalResultsPeriodicityRange",
         "IndicationFilter",
@@ -48,6 +50,7 @@
         "ScanIntervalRange",
         "SignalStrength",
         "TdscdmaSignalStrength",
+        "VoiceRegStateResult",
         "WcdmaSignalStrength",
     ],
     gen_java: true,
diff --git a/radio/1.2/IRadioResponse.hal b/radio/1.2/IRadioResponse.hal
index f26c9ec..300aa37 100644
--- a/radio/1.2/IRadioResponse.hal
+++ b/radio/1.2/IRadioResponse.hal
@@ -98,4 +98,31 @@
      *   RadioError:INTERNAL_ERR
      */
     oneway getSignalStrengthResponse_1_2(RadioResponseInfo info, SignalStrength signalStrength);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param voiceRegResponse Current Voice registration response as defined by VoiceRegStateResult
+     *        in types.hal
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     */
+    oneway getVoiceRegistrationStateResponse_1_2(RadioResponseInfo info,
+            VoiceRegStateResult voiceRegResponse);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param dataRegResponse Current Data registration response as defined by DataRegStateResult in
+     *        types.hal
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NOT_PROVISIONED
+     */
+    oneway getDataRegistrationStateResponse_1_2(RadioResponseInfo info,
+            DataRegStateResult dataRegResponse);
 };
diff --git a/radio/1.2/types.hal b/radio/1.2/types.hal
index 5e72b3b..4715fac 100644
--- a/radio/1.2/types.hal
+++ b/radio/1.2/types.hal
@@ -32,6 +32,7 @@
 import @1.0::LteSignalStrength;
 import @1.0::RadioConst;
 import @1.0::RadioError;
+import @1.0::RegState;
 import @1.0::SignalStrength;
 import @1.0::TdScdmaSignalStrength;
 import @1.0::TimeStampType;
@@ -462,3 +463,129 @@
     TdScdmaSignalStrength tdScdma;
     WcdmaSignalStrength wcdma;
 };
+
+struct CellIdentity {
+    /**
+     * Cell type for selecting from union CellInfo.
+     * Only one of the below vectors must be of size 1 based on a
+     * valid CellInfoType and others must be of size 0.
+     * If cell info type is NONE, then all the vectors must be of size 0.
+     */
+    CellInfoType cellInfoType;
+    vec<CellIdentityGsm> cellIdentityGsm;
+    vec<CellIdentityWcdma> cellIdentityWcdma;
+    vec<CellIdentityCdma> cellIdentityCdma;
+    vec<CellIdentityLte> cellIdentityLte;
+    vec<CellIdentityTdscdma> cellIdentityTdscdma;
+};
+
+struct VoiceRegStateResult {
+    /**
+     * Valid reg states are NOT_REG_MT_NOT_SEARCHING_OP,
+     * REG_HOME, NOT_REG_MT_SEARCHING_OP, REG_DENIED,
+     * UNKNOWN, REG_ROAMING defined in RegState
+     */
+    RegState regState;
+    /**
+     * Indicates the available voice radio technology, valid values as
+     * defined by RadioTechnology.
+     */
+    int32_t rat;
+    /**
+     * concurrent services support indicator. if registered on a CDMA system.
+     * false - Concurrent services not supported,
+     * true - Concurrent services supported
+     */
+    bool cssSupported;
+    /**
+     * TSB-58 Roaming Indicator if registered on a CDMA or EVDO system or -1 if not.
+     * Valid values are 0-255.
+     */
+    int32_t roamingIndicator;
+    /**
+     * Indicates whether the current system is in the PRL if registered on a CDMA or EVDO system
+     * or -1 if not. 0=not in the PRL, 1=in the PRL
+     */
+    int32_t systemIsInPrl;
+    /**
+     * Default Roaming Indicator from the PRL if registered on a CDMA or EVDO system or -1 if not.
+     * Valid values are 0-255.
+     */
+    int32_t defaultRoamingIndicator;
+    /**
+     * reasonForDenial if registration state is 3
+     * (Registration denied) this is an enumerated reason why
+     * registration was denied. See 3GPP TS 24.008,
+     * 10.5.3.6 and Annex G.
+     * 0 - General
+     * 1 - Authentication Failure
+     * 2 - IMSI unknown in HLR
+     * 3 - Illegal MS
+     * 4 - Illegal ME
+     * 5 - PLMN not allowed
+     * 6 - Location area not allowed
+     * 7 - Roaming not allowed
+     * 8 - No Suitable Cells in this Location Area
+     * 9 - Network failure
+     * 10 - Persistent location update reject
+     * 11 - PLMN not allowed
+     * 12 - Location area not allowed
+     * 13 - Roaming not allowed in this Location Area
+     * 15 - No Suitable Cells in this Location Area
+     * 17 - Network Failure
+     * 20 - MAC Failure
+     * 21 - Sync Failure
+     * 22 - Congestion
+     * 23 - GSM Authentication unacceptable
+     * 25 - Not Authorized for this CSG
+     * 32 - Service option not supported
+     * 33 - Requested service option not subscribed
+     * 34 - Service option temporarily out of order
+     * 38 - Call cannot be identified
+     * 48-63 - Retry upon entry into a new cell
+     * 95 - Semantically incorrect message
+     * 96 - Invalid mandatory information
+     * 97 - Message type non-existent or not implemented
+     * 98 - Message type not compatible with protocol state
+     * 99 - Information element non-existent or not implemented
+     * 100 - Conditional IE error
+     * 101 - Message not compatible with protocol state
+     * 111 - Protocol error, unspecified
+     */
+    int32_t reasonForDenial;
+
+    CellIdentity cellIdentity;
+};
+
+struct DataRegStateResult {
+    /**
+     * Valid reg states are NOT_REG_MT_NOT_SEARCHING_OP,
+     * REG_HOME, NOT_REG_MT_SEARCHING_OP, REG_DENIED,
+     * UNKNOWN, REG_ROAMING defined in RegState
+     */
+    RegState regState;
+    /**
+     * Indicates the available data radio technology,
+     * valid values as defined by RadioTechnology.
+     */
+    int32_t rat;
+    /**
+     * If registration state is 3 (Registration
+     * denied) this is an enumerated reason why
+     * registration was denied. See 3GPP TS 24.008,
+     * Annex G.6 "Additional cause codes for GMM".
+     * 7 == GPRS services not allowed
+     * 8 == GPRS services and non-GPRS services not allowed
+     * 9 == MS identity cannot be derived by the network
+     * 10 == Implicitly detached
+     * 14 == GPRS services not allowed in this PLMN
+     * 16 == MSC temporarily not reachable
+     * 40 == No PDP context activated
+     */
+    int32_t reasonDataDenied;
+    /**
+     * The maximum number of simultaneous Data Calls must be established using setupDataCall().
+     */
+    int32_t maxDataCalls;
+    CellIdentity cellIdentity;
+};
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
index 34a87e1..ee130f8 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
@@ -673,3 +673,40 @@
     ASSERT_TRUE(CheckAnyOfErrors(radioRsp_v1_2->rspInfo.error,
                                  {RadioError::NONE, RadioError::NO_NETWORK_FOUND}));
 }
+
+/*
+ * Test IRadio.getVoiceRegistrationState() for the response returned.
+ */
+TEST_F(RadioHidlTest_v1_2, getVoiceRegistrationState) {
+    int serial = GetRandomSerialNumber();
+
+    Return<void> res = radio_v1_2->getVoiceRegistrationState(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_2->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_v1_2->rspInfo.serial);
+
+    ALOGI("getVoiceRegistrationStateResponse_1_2, rspInfo.error = %s\n",
+          toString(radioRsp_v1_2->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_v1_2->rspInfo.error,
+                                 {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE}));
+}
+
+/*
+ * Test IRadio.getDataRegistrationState() for the response returned.
+ */
+TEST_F(RadioHidlTest_v1_2, getDataRegistrationState) {
+    int serial = GetRandomSerialNumber();
+
+    Return<void> res = radio_v1_2->getDataRegistrationState(serial);
+    ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_2->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_v1_2->rspInfo.serial);
+
+    ALOGI("getVoiceRegistrationStateResponse_1_2, rspInfo.error = %s\n",
+          toString(radioRsp_v1_2->rspInfo.error).c_str());
+    ASSERT_TRUE(CheckAnyOfErrors(
+        radioRsp_v1_2->rspInfo.error,
+        {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::NOT_PROVISIONED}));
+}
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
index 66d8ca4..c61913c 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
+++ b/radio/1.2/vts/functional/radio_hidl_hal_utils_v1_2.h
@@ -417,6 +417,12 @@
 
     Return<void> getCellInfoListResponse_1_2(
         const RadioResponseInfo& info, const ::android::hardware::hidl_vec<CellInfo>& cellInfo);
+
+    Return<void> getVoiceRegistrationStateResponse_1_2(
+        const RadioResponseInfo& info, const V1_2::VoiceRegStateResult& voiceRegResponse);
+
+    Return<void> getDataRegistrationStateResponse_1_2(
+        const RadioResponseInfo& info, const V1_2::DataRegStateResult& dataRegResponse);
 };
 
 /* Callback class for radio indication */
diff --git a/radio/1.2/vts/functional/radio_response.cpp b/radio/1.2/vts/functional/radio_response.cpp
index d96f76b..9195689 100644
--- a/radio/1.2/vts/functional/radio_response.cpp
+++ b/radio/1.2/vts/functional/radio_response.cpp
@@ -731,4 +731,14 @@
     rspInfo = info;
     parent_v1_2.notify();
     return Void();
-}
\ No newline at end of file
+}
+
+Return<void> RadioResponse_v1_2::getVoiceRegistrationStateResponse_1_2(
+    const RadioResponseInfo& /*info*/, const V1_2::VoiceRegStateResult& /*voiceRegResponse*/) {
+    return Void();
+}
+
+Return<void> RadioResponse_v1_2::getDataRegistrationStateResponse_1_2(
+    const RadioResponseInfo& /*info*/, const V1_2::DataRegStateResult& /*dataRegResponse*/) {
+    return Void();
+}
diff --git a/secure_element/1.0/vts/functional/VtsHalSecureElementV1_0TargetTest.cpp b/secure_element/1.0/vts/functional/VtsHalSecureElementV1_0TargetTest.cpp
index 59c354f..dab81e2 100644
--- a/secure_element/1.0/vts/functional/VtsHalSecureElementV1_0TargetTest.cpp
+++ b/secure_element/1.0/vts/functional/VtsHalSecureElementV1_0TargetTest.cpp
@@ -34,14 +34,13 @@
 using ::android::sp;
 using ::testing::VtsHalHidlTargetTestEnvBase;
 
-#define SELECT_ISD \
-    { 0x00, 0xA4, 0x04, 0x00, 0x00 }
-#define SEQUENCE_COUNTER \
-    { 0x80, 0xCA, 0x00, 0xC1, 0x00 }
-#define MANAGE_SELECT \
-    { 0x00, 0xA4, 0x04, 0x00, 0x00 }
-#define CRS_AID \
-    { 0xA0, 0x00, 0x00, 0x01, 0x51, 0x43, 0x52, 0x53, 0x00 }
+#define DATA_APDU \
+    { 0x00, 0x08, 0x00, 0x00, 0x00 }
+#define ANDROID_TEST_AID                                                                          \
+    {                                                                                             \
+        0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64, 0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, \
+            0x31                                                                                  \
+    }
 
 constexpr char kCallbackNameOnStateChange[] = "onStateChange";
 
@@ -115,7 +114,7 @@
  * Check status word in the response
  */
 TEST_F(SecureElementHidlTest, transmit) {
-    std::vector<uint8_t> aid = CRS_AID;
+    std::vector<uint8_t> aid = ANDROID_TEST_AID;
     SecureElementStatus statusReturned;
     LogicalChannelResponse response;
     se_->openLogicalChannel(
@@ -132,9 +131,9 @@
             }
         });
     EXPECT_EQ(SecureElementStatus::SUCCESS, statusReturned);
-    EXPECT_LE((unsigned int)3, response.selectResponse.size());
+    EXPECT_LE((unsigned int)2, response.selectResponse.size());
     EXPECT_LE(1, response.channelNumber);
-    std::vector<uint8_t> command = SELECT_ISD;
+    std::vector<uint8_t> command = DATA_APDU;
     std::vector<uint8_t> transmitResponse;
     se_->transmit(command, [&transmitResponse](std::vector<uint8_t> res) {
         transmitResponse.resize(res.size());
@@ -145,16 +144,6 @@
     EXPECT_LE((unsigned int)3, transmitResponse.size());
     EXPECT_EQ(0x90, transmitResponse[transmitResponse.size() - 2]);
     EXPECT_EQ(0x00, transmitResponse[transmitResponse.size() - 1]);
-    command = SEQUENCE_COUNTER;
-    se_->transmit(command, [&transmitResponse](std::vector<uint8_t> res) {
-        transmitResponse.resize(res.size());
-        for (size_t i = 0; i < res.size(); i++) {
-            transmitResponse[i] = res[i];
-        }
-    });
-    EXPECT_LE((unsigned int)3, transmitResponse.size());
-    EXPECT_EQ(0x90, transmitResponse[transmitResponse.size() - 2]);
-    EXPECT_EQ(0x00, transmitResponse[transmitResponse.size() - 1]);
     EXPECT_EQ(SecureElementStatus::SUCCESS, se_->closeChannel(response.channelNumber));
 }
 
@@ -164,7 +153,7 @@
  *  open channel, check the length of selectResponse and close the channel
  */
 TEST_F(SecureElementHidlTest, openBasicChannel) {
-    std::vector<uint8_t> aid = CRS_AID;
+    std::vector<uint8_t> aid = ANDROID_TEST_AID;
     SecureElementStatus statusReturned;
     std::vector<uint8_t> response;
     se_->openBasicChannel(aid, 0x00,
@@ -180,17 +169,6 @@
                           });
     if (statusReturned == SecureElementStatus::SUCCESS) {
         EXPECT_LE((unsigned int)3, response.size());
-        std::vector<uint8_t> command = SELECT_ISD;
-        std::vector<uint8_t> transmitResponse;
-        se_->transmit(command, [&transmitResponse](std::vector<uint8_t> res) {
-            transmitResponse.resize(res.size());
-            for (size_t i = 0; i < res.size(); i++) {
-                transmitResponse[i] = res[i];
-            }
-        });
-        EXPECT_LE((unsigned int)3, transmitResponse.size());
-        EXPECT_EQ(0x90, transmitResponse[transmitResponse.size() - 2]);
-        EXPECT_EQ(0x00, transmitResponse[transmitResponse.size() - 1]);
         return;
     }
     EXPECT_EQ(SecureElementStatus::UNSUPPORTED_OPERATION, statusReturned);
@@ -221,7 +199,7 @@
  * Close Channel
  */
 TEST_F(SecureElementHidlTest, openCloseLogicalChannel) {
-    std::vector<uint8_t> aid = CRS_AID;
+    std::vector<uint8_t> aid = ANDROID_TEST_AID;
     SecureElementStatus statusReturned;
     LogicalChannelResponse response;
     se_->openLogicalChannel(
@@ -238,7 +216,7 @@
             }
         });
     EXPECT_EQ(SecureElementStatus::SUCCESS, statusReturned);
-    EXPECT_LE((unsigned int)3, response.selectResponse.size());
+    EXPECT_LE((unsigned int)2, response.selectResponse.size());
     EXPECT_LE(1, response.channelNumber);
     EXPECT_EQ(SecureElementStatus::SUCCESS, se_->closeChannel(response.channelNumber));
 }
diff --git a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
index 0c5bd45..d16f1e7 100644
--- a/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.0/vts/functional/wifi_chip_hidl_test.cpp
@@ -88,7 +88,10 @@
     uint32_t configureChipForStaIfaceAndGetCapabilities() {
         configureChipForIfaceType(IfaceType::STA, true);
         const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
-        EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+        if (status_and_caps.first.code != WifiStatusCode::SUCCESS) {
+            EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status_and_caps.first.code);
+            return 0;
+        }
         return status_and_caps.second;
     }
 
@@ -193,7 +196,10 @@
 TEST_F(WifiChipHidlTest, GetCapabilities) {
     configureChipForIfaceType(IfaceType::STA, true);
     const auto& status_and_caps = HIDL_INVOKE(wifi_chip_, getCapabilities);
-    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_caps.first.code);
+    if (status_and_caps.first.code != WifiStatusCode::SUCCESS) {
+        EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED, status_and_caps.first.code);
+        return;
+    }
     EXPECT_NE(0u, status_and_caps.second);
 }
 
diff --git a/wifi/1.2/IWifiStaIface.hal b/wifi/1.2/IWifiStaIface.hal
index be4e537..3a7f777 100644
--- a/wifi/1.2/IWifiStaIface.hal
+++ b/wifi/1.2/IWifiStaIface.hal
@@ -17,6 +17,7 @@
 package android.hardware.wifi@1.2;
 
 import @1.0::WifiStatus;
+import @1.0::MacAddress;
 import @1.0::IWifiStaIface;
 
 /**
@@ -51,4 +52,17 @@
      * @see installApfPacketFilter()
      */
     readApfPacketFilterData() generates (WifiStatus status, vec<uint8_t> data);
+
+    /**
+     * Changes the MAC address of the Sta Interface to the given
+     * MAC address.
+     *
+     * @param mac MAC address to change into.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    setMacAddress(MacAddress mac) generates (WifiStatus status);
 };
diff --git a/wifi/1.2/default/wifi_sta_iface.cpp b/wifi/1.2/default/wifi_sta_iface.cpp
index ab99daa..daa5610 100644
--- a/wifi/1.2/default/wifi_sta_iface.cpp
+++ b/wifi/1.2/default/wifi_sta_iface.cpp
@@ -241,6 +241,13 @@
                            hidl_status_cb);
 }
 
+Return<void> WifiStaIface::setMacAddress(const hidl_array<uint8_t, 6>& mac,
+                                         setMacAddress_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiStaIface::setMacAddressInternal, hidl_status_cb,
+                           mac);
+}
+
 std::pair<WifiStatus, std::string> WifiStaIface::getNameInternal() {
     return {createWifiStatus(WifiStatusCode::SUCCESS), ifname_};
 }
@@ -594,6 +601,26 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_fates};
 }
 
+WifiStatus WifiStaIface::setMacAddressInternal(
+    const std::array<uint8_t, 6>& mac) {
+    if (!iface_tool_.SetWifiUpState(false)) {
+        LOG(ERROR) << "SetWifiUpState(false) failed.";
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+
+    if (!iface_tool_.SetMacAddress(ifname_.c_str(), mac)) {
+        LOG(ERROR) << "SetMacAddress failed.";
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+
+    if (!iface_tool_.SetWifiUpState(true)) {
+        LOG(ERROR) << "SetWifiUpState(true) failed.";
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    LOG(DEBUG) << "Successfully SetMacAddress.";
+    return createWifiStatus(WifiStatusCode::SUCCESS);
+}
+
 }  // namespace implementation
 }  // namespace V1_2
 }  // namespace wifi
diff --git a/wifi/1.2/default/wifi_sta_iface.h b/wifi/1.2/default/wifi_sta_iface.h
index a212888..71cd17d 100644
--- a/wifi/1.2/default/wifi_sta_iface.h
+++ b/wifi/1.2/default/wifi_sta_iface.h
@@ -21,6 +21,8 @@
 #include <android/hardware/wifi/1.0/IWifiStaIfaceEventCallback.h>
 #include <android/hardware/wifi/1.2/IWifiStaIface.h>
 
+#include <wifi_system/interface_tool.h>
+
 #include "hidl_callback_util.h"
 #include "wifi_legacy_hal.h"
 
@@ -103,6 +105,8 @@
         getDebugTxPacketFates_cb hidl_status_cb) override;
     Return<void> getDebugRxPacketFates(
         getDebugRxPacketFates_cb hidl_status_cb) override;
+    Return<void> setMacAddress(const hidl_array<uint8_t, 6>& mac,
+                               setMacAddress_cb hidl_status_cb) override;
 
    private:
     // Corresponding worker functions for the HIDL methods.
@@ -146,12 +150,14 @@
     getDebugTxPacketFatesInternal();
     std::pair<WifiStatus, std::vector<WifiDebugRxPacketFateReport>>
     getDebugRxPacketFatesInternal();
+    WifiStatus setMacAddressInternal(const std::array<uint8_t, 6>& mac);
 
     std::string ifname_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
     bool is_valid_;
     hidl_callback_util::HidlCallbackHandler<IWifiStaIfaceEventCallback>
         event_cb_handler_;
+    wifi_system::InterfaceTool iface_tool_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiStaIface);
 };
diff --git a/wifi/1.2/vts/functional/Android.bp b/wifi/1.2/vts/functional/Android.bp
index d85d42e..918e4a4 100644
--- a/wifi/1.2/vts/functional/Android.bp
+++ b/wifi/1.2/vts/functional/Android.bp
@@ -20,6 +20,7 @@
     srcs: [
         "VtsHalWifiV1_2TargetTest.cpp",
         "wifi_chip_hidl_test.cpp",
+        "wifi_sta_iface_hidl_test.cpp",
     ],
     static_libs: [
         "VtsHalWifiV1_0TargetTestUtil",
diff --git a/wifi/1.2/vts/functional/wifi_sta_iface_hidl_test.cpp b/wifi/1.2/vts/functional/wifi_sta_iface_hidl_test.cpp
new file mode 100644
index 0000000..fd4a671
--- /dev/null
+++ b/wifi/1.2/vts/functional/wifi_sta_iface_hidl_test.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Staache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+
+#include <android/hardware/wifi/1.2/IWifiStaIface.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+
+#include "wifi_hidl_call_util.h"
+#include "wifi_hidl_test_utils.h"
+
+using ::android::sp;
+using ::android::hardware::wifi::V1_2::IWifiStaIface;
+using ::android::hardware::wifi::V1_0::WifiStatusCode;
+
+/**
+ * Fixture to use for all STA Iface HIDL interface tests.
+ */
+class WifiStaIfaceHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+   public:
+    virtual void SetUp() override {
+        wifi_sta_iface_ = IWifiStaIface::castFrom(getWifiStaIface());
+        ASSERT_NE(nullptr, wifi_sta_iface_.get());
+    }
+
+    virtual void TearDown() override { stopWifi(); }
+
+   protected:
+    sp<IWifiStaIface> wifi_sta_iface_;
+};
+
+/*
+ * SetMacAddress:
+ * Ensures that calls to set MAC address will return a success status
+ * code.
+ */
+TEST_F(WifiStaIfaceHidlTest, SetMacAddress) {
+    const android::hardware::hidl_array<uint8_t, 6> kMac{
+        std::array<uint8_t, 6>{{0x12, 0x22, 0x33, 0x52, 0x10, 0x41}}};
+    EXPECT_EQ(WifiStatusCode::SUCCESS,
+              HIDL_INVOKE(wifi_sta_iface_, setMacAddress, kMac).code);
+}