diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/1/.hash b/audio/aidl/aidl_api/android.hardware.audio.effect/1/.hash
index 9914460..b71ab29 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/1/.hash
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/1/.hash
@@ -1 +1 @@
-504db4349f884424a8acc3f2fc0f6bb74dbfcdf0
+34b618a587cb9977ee0cd13b173e699d2dcdb320
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/1/android/hardware/audio/effect/Descriptor.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/1/android/hardware/audio/effect/Descriptor.aidl
index 82dae97..115da1d 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/1/android/hardware/audio/effect/Descriptor.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/1/android/hardware/audio/effect/Descriptor.aidl
@@ -50,8 +50,8 @@
   const String EFFECT_TYPE_UUID_PRESET_REVERB = "47382d60-ddd8-11db-bf3a-0002a5d5c51b";
   const String EFFECT_TYPE_UUID_SPATIALIZER = "ccd4cf09-a79d-46c2-9aae-06a1698d6c8f";
   const String EFFECT_TYPE_UUID_VIRTUALIZER = "37cc2c00-dddd-11db-8577-0002a5d5c51b";
-  const String EFFECT_TYPE_UUID_VISUALIZER = "d069d9e0-8329-11df-9168-0002a5d5c51b";
-  const String EFFECT_TYPE_UUID_VOLUME = "fa81a2b8-588b-11ed-9b6a-0242ac120002";
+  const String EFFECT_TYPE_UUID_VISUALIZER = "e46b26a0-dddd-11db-8afd-0002a5d5c51b";
+  const String EFFECT_TYPE_UUID_VOLUME = "09e8ede0-ddde-11db-b4f6-0002a5d5c51b";
   @VintfStability
   parcelable Identity {
     android.media.audio.common.AudioUuid type;
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Descriptor.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Descriptor.aidl
index 82dae97..115da1d 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Descriptor.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Descriptor.aidl
@@ -50,8 +50,8 @@
   const String EFFECT_TYPE_UUID_PRESET_REVERB = "47382d60-ddd8-11db-bf3a-0002a5d5c51b";
   const String EFFECT_TYPE_UUID_SPATIALIZER = "ccd4cf09-a79d-46c2-9aae-06a1698d6c8f";
   const String EFFECT_TYPE_UUID_VIRTUALIZER = "37cc2c00-dddd-11db-8577-0002a5d5c51b";
-  const String EFFECT_TYPE_UUID_VISUALIZER = "d069d9e0-8329-11df-9168-0002a5d5c51b";
-  const String EFFECT_TYPE_UUID_VOLUME = "fa81a2b8-588b-11ed-9b6a-0242ac120002";
+  const String EFFECT_TYPE_UUID_VISUALIZER = "e46b26a0-dddd-11db-8afd-0002a5d5c51b";
+  const String EFFECT_TYPE_UUID_VOLUME = "09e8ede0-ddde-11db-b4f6-0002a5d5c51b";
   @VintfStability
   parcelable Identity {
     android.media.audio.common.AudioUuid type;
diff --git a/audio/aidl/android/hardware/audio/effect/Descriptor.aidl b/audio/aidl/android/hardware/audio/effect/Descriptor.aidl
index 2fbc401..b152f76 100644
--- a/audio/aidl/android/hardware/audio/effect/Descriptor.aidl
+++ b/audio/aidl/android/hardware/audio/effect/Descriptor.aidl
@@ -96,11 +96,11 @@
     /**
      * UUID for visualizer effect type.
      */
-    const String EFFECT_TYPE_UUID_VISUALIZER = "d069d9e0-8329-11df-9168-0002a5d5c51b";
+    const String EFFECT_TYPE_UUID_VISUALIZER = "e46b26a0-dddd-11db-8afd-0002a5d5c51b";
     /**
      * UUID for Volume effect type.
      */
-    const String EFFECT_TYPE_UUID_VOLUME = "fa81a2b8-588b-11ed-9b6a-0242ac120002";
+    const String EFFECT_TYPE_UUID_VOLUME = "09e8ede0-ddde-11db-b4f6-0002a5d5c51b";
 
     /**
      * This structure completely identifies an effect implementation.
diff --git a/automotive/ivn_android_device/impl/default/Android.bp b/automotive/ivn_android_device/impl/default/Android.bp
new file mode 100644
index 0000000..98c1f58
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/Android.bp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "IvnAndroidDeviceService",
+    vendor_available: true,
+    local_include_dirs: ["include"],
+    export_include_dirs: ["include"],
+    srcs: [
+        "src/IvnAndroidDeviceService.cpp",
+    ],
+    whole_static_libs: [
+        "android.hardware.automotive.ivn-V1-ndk",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libjsoncpp",
+        "liblog",
+        "libutils",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.automotive.ivn@V1-default-service",
+    vendor: true,
+    relative_install_path: "hw",
+    local_include_dirs: ["include"],
+    srcs: ["src/IvnAndroidDeviceImpl.cpp"],
+    whole_static_libs: ["IvnAndroidDeviceService"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libjsoncpp",
+        "liblog",
+        "libutils",
+    ],
+    required: ["Prebuilt_IvnAndroidDeviceServiceDefaultConfig_JSON"],
+    vintf_fragments: ["ivn-default-service.xml"],
+    init_rc: ["ivn-default-service.rc"],
+}
diff --git a/automotive/ivn_android_device/impl/default/config/Android.bp b/automotive/ivn_android_device/impl/default/config/Android.bp
new file mode 100644
index 0000000..03c4d1b
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/config/Android.bp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+filegroup {
+    name: "IvnAndroidDeviceServiceDefaultConfig_Json",
+    srcs: ["DefaultConfig.json"],
+}
+
+prebuilt_etc {
+    name: "Prebuilt_IvnAndroidDeviceServiceDefaultConfig_JSON",
+    filename_from_src: true,
+    src: "DefaultConfig.json",
+    sub_dir: "automotive/IvnConfig/",
+    vendor: true,
+}
diff --git a/automotive/ivn_android_device/impl/default/config/DefaultConfig.json b/automotive/ivn_android_device/impl/default/config/DefaultConfig.json
new file mode 100644
index 0000000..45663e2
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/config/DefaultConfig.json
@@ -0,0 +1,61 @@
+{
+    "MyDeviceId": 0,
+    "Devices": [
+        {
+            "DeviceId": 0,
+            "OccupantZones": [
+                {
+                    "ZoneId": 0,
+                    "OccupantType": "DRIVER",
+                    "Seat": 1,
+                    "Comments": "Occupant zone for driver and FRONT_LEFT seat"
+                },
+                {
+                    "ZoneId": 1,
+                    "OccupantType": "FRONT_PASSENGER",
+                    "Seat": 4,
+                    "Comments": "Occupant zone for FRONT_RIGHT passenger"
+                }
+            ],
+            "EndpointInfo": {
+                "IpAddress": "10.10.10.1",
+                "PortNumber": 1234,
+                "BrandName": "MyBrand",
+                "DeviceName": "MyDevice",
+                "ProductName": "MyProduct",
+                "ManufacturerName": "MyCompany",
+                "ModelName": "MyModel",
+                "SerialNumber": "Serial1234"
+            },
+            "Comments": "Device for front row"
+        },
+        {
+            "DeviceId": 1,
+            "OccupantZones": [
+                {
+                    "ZoneId": 2,
+                    "OccupantType": "REAR_PASSENGER",
+                    "Seat": 16
+                },
+                {
+                    "ZoneId": 3,
+                    "OccupantType": "REAR_PASSENGER",
+                    "Seat": 64
+                }
+            ],
+            "EndpointInfo": {
+                "IpAddress": "10.10.10.2",
+                "PortNumber": 2345,
+                "BrandName": "MyBrand",
+                "DeviceName": "MyDevice",
+                "ProductName": "MyProduct",
+                "ManufacturerName": "MyCompany",
+                "ModelName": "MyModel",
+                "SerialNumber": "Serial2345"
+            },
+            "Comments": "Device for back row"
+        }
+    ],
+    "Comment":
+            "This simulates a vehicle with two Android devices, one for front row, one for back row"
+}
diff --git a/automotive/ivn_android_device/impl/default/include/IvnAndroidDeviceService.h b/automotive/ivn_android_device/impl/default/include/IvnAndroidDeviceService.h
new file mode 100644
index 0000000..c0cc9fe
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/include/IvnAndroidDeviceService.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/automotive/ivn/BnIvnAndroidDevice.h>
+#include <aidl/android/hardware/automotive/ivn/EndpointInfo.h>
+#include <aidl/android/hardware/automotive/ivn/OccupantZoneInfo.h>
+#include <android/binder_auto_utils.h>
+#include <vector>
+
+#include <unordered_map>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace ivn {
+
+struct DeviceInfo {
+    std::vector<aidl::android::hardware::automotive::ivn::OccupantZoneInfo> occupantZones;
+    aidl::android::hardware::automotive::ivn::EndpointInfo endpointInfo;
+};
+
+class IvnAndroidDeviceService
+    : public aidl::android::hardware::automotive::ivn::BnIvnAndroidDevice {
+  public:
+    explicit IvnAndroidDeviceService(std::string_view configPath);
+
+    // Initialize the service, returns true on success.
+    bool init();
+
+    ndk::ScopedAStatus getMyDeviceId(int* deviceId) override;
+
+    ndk::ScopedAStatus getOtherDeviceIds(std::vector<int>* deviceIds) override;
+
+    ndk::ScopedAStatus getDeviceIdForOccupantZone(int zoneId, int* deviceId) override;
+
+    ndk::ScopedAStatus getOccupantZonesForDevice(
+            int androidDeviceId,
+            std::vector<aidl::android::hardware::automotive::ivn::OccupantZoneInfo>* occupantZones)
+            override;
+
+    ndk::ScopedAStatus getMyEndpointInfo(
+            aidl::android::hardware::automotive::ivn::EndpointInfo* endpointInfo) override;
+
+    ndk::ScopedAStatus getEndpointInfoForDevice(
+            int androidDeviceId,
+            aidl::android::hardware::automotive::ivn::EndpointInfo* endpointInfo) override;
+
+  private:
+    int mMyDeviceId;
+    std::unordered_map<int, DeviceInfo> mDeviceInfoById;
+    std::string_view mConfigPath;
+};
+
+}  // namespace ivn
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/ivn_android_device/impl/default/ivn-default-service.rc b/automotive/ivn_android_device/impl/default/ivn-default-service.rc
new file mode 100644
index 0000000..070b259
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/ivn-default-service.rc
@@ -0,0 +1,4 @@
+service vendor.ivn-default /vendor/bin/hw/android.hardware.automotive.ivn@V1-default-service
+    class hal
+    user vehicle_network
+    group system inet
diff --git a/automotive/ivn_android_device/impl/default/ivn-default-service.xml b/automotive/ivn_android_device/impl/default/ivn-default-service.xml
new file mode 100644
index 0000000..481bc0a
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/ivn-default-service.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.automotive.ivn</name>
+        <version>1</version>
+        <fqname>IIvnAndroidDevice/default</fqname>
+    </hal>
+</manifest>
diff --git a/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceImpl.cpp b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceImpl.cpp
new file mode 100644
index 0000000..fdf6776
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceImpl.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "IvnAndroidDeviceImpl"
+
+#include "IvnAndroidDeviceService.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <stdlib.h>
+
+constexpr char SERVICE_NAME[] = "android.hardware.automotive.ivn.IIvnAndroidDevice/default";
+constexpr char DEFAULT_CONFIG_DIR[] = "/vendor/etc/automotive/IvnConfig/DefaultConfig.json";
+
+int main(int /* argc */, char* /* argv */[]) {
+    LOG(INFO) << "Registering IvnAndroidDeviceService as service...";
+    auto service =
+            ndk::SharedRefBase::make<android::hardware::automotive::ivn::IvnAndroidDeviceService>(
+                    DEFAULT_CONFIG_DIR);
+    if (!service->init()) {
+        LOG(ERROR) << "Failed to init IvnAndroidDeviceService";
+        exit(1);
+    }
+
+    binder_exception_t err = AServiceManager_addService(service->asBinder().get(), SERVICE_NAME);
+    if (err != EX_NONE) {
+        LOG(ERROR) << "Failed to register IvnAndroidDeviceService service, exception: " << err;
+        exit(1);
+    }
+
+    if (!ABinderProcess_setThreadPoolMaxThreadCount(1)) {
+        LOG(ERROR) << "Failed to set thread pool max thread count";
+        exit(1);
+    }
+    ABinderProcess_startThreadPool();
+
+    LOG(INFO) << "IvnAndroidDeviceService Ready";
+
+    ABinderProcess_joinThreadPool();
+
+    LOG(ERROR) << "IvnAndroidDeviceService init failed! Should not reach here";
+
+    return 0;
+}
diff --git a/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp
new file mode 100644
index 0000000..71454d5
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/src/IvnAndroidDeviceService.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "IvnAndroidDeviceService.h"
+
+#include <aidl/android/hardware/automotive/ivn/ConnectProtocol.h>
+#include <aidl/android/hardware/automotive/ivn/HardwareIdentifiers.h>
+#include <aidl/android/hardware/automotive/ivn/OccupantType.h>
+#include <android-base/logging.h>
+#include <android/binder_status.h>
+#include <json/json.h>
+
+#include <fstream>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace ivn {
+
+namespace {
+
+using ::aidl::android::hardware::automotive::ivn::ConnectProtocol;
+using ::aidl::android::hardware::automotive::ivn::EndpointInfo;
+using ::aidl::android::hardware::automotive::ivn::HardwareIdentifiers;
+using ::aidl::android::hardware::automotive::ivn::OccupantType;
+using ::aidl::android::hardware::automotive::ivn::OccupantZoneInfo;
+using ::ndk::ScopedAStatus;
+
+constexpr int IVN_ERROR_GENERIC = -1;
+
+}  // namespace
+
+IvnAndroidDeviceService::IvnAndroidDeviceService(std::string_view configPath) {
+    mConfigPath = configPath;
+}
+
+bool IvnAndroidDeviceService::init() {
+    std::ifstream configStream(mConfigPath);
+    if (!configStream) {
+        LOG(ERROR) << "couldn't open " << mConfigPath << " for parsing.";
+        return false;
+    }
+    Json::CharReaderBuilder builder;
+    Json::Value root;
+    std::string errs;
+    if (!Json::parseFromStream(builder, configStream, &root, &errs)) {
+        LOG(ERROR) << "Failed to parse config JSON stream, error: " << errs;
+        return false;
+    }
+    if (!root.isObject()) {
+        LOG(ERROR) << "Root must be an object";
+        return false;
+    }
+    if (!root.isMember("MyDeviceId")) {
+        LOG(ERROR) << "Must contain 'MyDeviceId' field";
+        return false;
+    }
+    mMyDeviceId = root["MyDeviceId"].asInt();
+    if (!root.isMember("Devices") || !root["Devices"].isArray()) {
+        LOG(ERROR) << "Must contain 'Devices' field as array";
+        return false;
+    }
+    Json::Value& devices = root["Devices"];
+    for (unsigned int i = 0; i < devices.size(); i++) {
+        Json::Value& device = devices[i];
+        int deviceId = device["DeviceId"].asInt();
+        DeviceInfo deviceInfo = {};
+        Json::Value& occupantZones = device["OccupantZones"];
+        for (unsigned int j = 0; j < occupantZones.size(); j++) {
+            Json::Value& occupantZone = occupantZones[j];
+            int zoneId = occupantZone["ZoneId"].asInt();
+            std::string occupantTypeStr = occupantZone["OccupantType"].asString();
+            int seat = occupantZone["Seat"].asInt();
+            OccupantType occupantType;
+            if (occupantTypeStr == "DRIVER") {
+                occupantType = OccupantType::DRIVER;
+            } else if (occupantTypeStr == "FRONT_PASSENGER") {
+                occupantType = OccupantType::FRONT_PASSENGER;
+            } else if (occupantTypeStr == "REAR_PASSENGER") {
+                occupantType = OccupantType::REAR_PASSENGER;
+            } else {
+                LOG(ERROR) << "Unknown occupant type: " << occupantTypeStr;
+                return false;
+            }
+            OccupantZoneInfo occupantZoneInfo = {
+                    .zoneId = zoneId, .occupantType = occupantType, .seat = seat};
+            deviceInfo.occupantZones.push_back(std::move(occupantZoneInfo));
+        }
+        Json::Value& ep = device["EndpointInfo"];
+        EndpointInfo endpointInfo = {};
+        endpointInfo.connectProtocol = ConnectProtocol::TCP_IP;
+        endpointInfo.ipAddress = ep["IpAddress"].asString();
+        endpointInfo.portNumber = ep["PortNumber"].asInt();
+        HardwareIdentifiers hardwareId = {};
+        if (ep.isMember("BrandName")) {
+            hardwareId.brandName = ep["BrandName"].asString();
+        }
+        if (ep.isMember("DeviceName")) {
+            hardwareId.deviceName = ep["DeviceName"].asString();
+        }
+        if (ep.isMember("ProductName")) {
+            hardwareId.productName = ep["ProductName"].asString();
+        }
+        if (ep.isMember("ManufacturerName")) {
+            hardwareId.manufacturerName = ep["ManufacturerName"].asString();
+        }
+        if (ep.isMember("ModelName")) {
+            hardwareId.modelName = ep["ModelName"].asString();
+        }
+        if (ep.isMember("SerialNumber")) {
+            hardwareId.serialNumber = ep["SerialNumber"].asString();
+        }
+        endpointInfo.hardwareId = hardwareId;
+        deviceInfo.endpointInfo = endpointInfo;
+        mDeviceInfoById[deviceId] = deviceInfo;
+    }
+    if (mDeviceInfoById.find(mMyDeviceId) == mDeviceInfoById.end()) {
+        LOG(ERROR) << "My device ID is not in the device info list";
+        return false;
+    }
+    return true;
+}
+
+ScopedAStatus IvnAndroidDeviceService::getMyDeviceId(int* deviceId) {
+    *deviceId = mMyDeviceId;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus IvnAndroidDeviceService::getOtherDeviceIds(std::vector<int>* deviceIds) {
+    deviceIds->clear();
+    for (const auto& [deviceId, _] : mDeviceInfoById) {
+        if (deviceId == mMyDeviceId) {
+            continue;
+        }
+        deviceIds->push_back(deviceId);
+    }
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus IvnAndroidDeviceService::getDeviceIdForOccupantZone(int zoneId, int* outDeviceId) {
+    for (const auto& [deviceId, deviceInfo] : mDeviceInfoById) {
+        for (const auto& occupantZoneInfo : deviceInfo.occupantZones) {
+            if (occupantZoneInfo.zoneId == zoneId) {
+                *outDeviceId = deviceId;
+                return ScopedAStatus::ok();
+            }
+        }
+    }
+    return ScopedAStatus::fromServiceSpecificErrorWithMessage(IVN_ERROR_GENERIC,
+                                                              "Occupant zone not found");
+}
+
+ScopedAStatus IvnAndroidDeviceService::getOccupantZonesForDevice(
+        int androidDeviceId, std::vector<OccupantZoneInfo>* occupantZones) {
+    if (mDeviceInfoById.find(androidDeviceId) == mDeviceInfoById.end()) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(IVN_ERROR_GENERIC,
+                                                                  "Android device ID not found");
+    }
+    for (const auto& occupantZoneInfo : mDeviceInfoById[androidDeviceId].occupantZones) {
+        occupantZones->push_back(occupantZoneInfo);
+    }
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus IvnAndroidDeviceService::getMyEndpointInfo(EndpointInfo* endpointInfo) {
+    *endpointInfo = mDeviceInfoById[mMyDeviceId].endpointInfo;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus IvnAndroidDeviceService::getEndpointInfoForDevice(int androidDeviceId,
+                                                                EndpointInfo* endpointInfo) {
+    if (mDeviceInfoById.find(androidDeviceId) == mDeviceInfoById.end()) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(IVN_ERROR_GENERIC,
+                                                                  "Android device ID not found");
+    }
+    *endpointInfo = mDeviceInfoById[androidDeviceId].endpointInfo;
+    return ScopedAStatus::ok();
+}
+
+}  // namespace ivn
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/ivn_android_device/impl/default/test/Android.bp b/automotive/ivn_android_device/impl/default/test/Android.bp
new file mode 100644
index 0000000..a100575
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/test/Android.bp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "IvnAndroidDeviceServiceUnitTest",
+    vendor: true,
+    srcs: ["*.cpp"],
+    whole_static_libs: [
+        "IvnAndroidDeviceService",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libjsoncpp",
+        "liblog",
+        "libutils",
+    ],
+    static_libs: [
+        "libgtest",
+    ],
+    data: [
+        ":IvnAndroidDeviceServiceDefaultConfig_Json",
+    ],
+    test_suites: ["device-tests"],
+}
diff --git a/automotive/ivn_android_device/impl/default/test/IvnAndroidDeviceServiceUnittest.cpp b/automotive/ivn_android_device/impl/default/test/IvnAndroidDeviceServiceUnittest.cpp
new file mode 100644
index 0000000..bc8e69f
--- /dev/null
+++ b/automotive/ivn_android_device/impl/default/test/IvnAndroidDeviceServiceUnittest.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "IvnAndroidDeviceService.h"
+
+#include <aidl/android/hardware/automotive/ivn/OccupantType.h>
+#include <aidl/android/hardware/automotive/ivn/OccupantZoneInfo.h>
+#include <android-base/file.h>
+#include <gtest/gtest.h>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace ivn {
+
+using ::aidl::android::hardware::automotive::ivn::OccupantType;
+using ::aidl::android::hardware::automotive::ivn::OccupantZoneInfo;
+using ::ndk::ScopedAStatus;
+
+class IvnAndroidDeviceServiceUnitTest : public ::testing::Test {
+  public:
+    virtual void SetUp() override {
+        mService = ndk::SharedRefBase::make<IvnAndroidDeviceService>(
+                android::base::GetExecutableDirectory() + "/DefaultConfig.json");
+        mService->init();
+    }
+
+    std::shared_ptr<IvnAndroidDeviceService> mService;
+};
+
+TEST_F(IvnAndroidDeviceServiceUnitTest, TestGetMyDeviceId) {
+    int deviceId = -1;
+
+    ScopedAStatus status = mService->getMyDeviceId(&deviceId);
+
+    ASSERT_TRUE(status.isOk());
+    ASSERT_EQ(deviceId, 0);
+}
+
+TEST_F(IvnAndroidDeviceServiceUnitTest, TestGetOtherDeviceIds) {
+    std::vector<int> deviceIds;
+
+    ScopedAStatus status = mService->getOtherDeviceIds(&deviceIds);
+
+    ASSERT_TRUE(status.isOk());
+    ASSERT_EQ(deviceIds, std::vector<int>({1}));
+}
+
+TEST_F(IvnAndroidDeviceServiceUnitTest, TestGetDeviceIdForOccupantZone) {
+    int deviceId = -1;
+
+    ScopedAStatus status = mService->getDeviceIdForOccupantZone(/*zoneId=*/0, &deviceId);
+
+    ASSERT_TRUE(status.isOk());
+    EXPECT_EQ(deviceId, 0);
+
+    status = mService->getDeviceIdForOccupantZone(/*zoneId=*/1, &deviceId);
+
+    ASSERT_TRUE(status.isOk());
+    EXPECT_EQ(deviceId, 0);
+
+    status = mService->getDeviceIdForOccupantZone(/*zoneId=*/2, &deviceId);
+
+    ASSERT_TRUE(status.isOk());
+    EXPECT_EQ(deviceId, 1);
+
+    status = mService->getDeviceIdForOccupantZone(/*zoneId=*/3, &deviceId);
+
+    ASSERT_TRUE(status.isOk());
+    EXPECT_EQ(deviceId, 1);
+
+    status = mService->getDeviceIdForOccupantZone(/*zoneId=*/4, &deviceId);
+
+    ASSERT_FALSE(status.isOk());
+}
+
+TEST_F(IvnAndroidDeviceServiceUnitTest, TestGetOccupantZonesForDevice) {
+    std::vector<OccupantZoneInfo> occupantZones;
+
+    ScopedAStatus status =
+            mService->getOccupantZonesForDevice(/*androidDeviceId=*/0, &occupantZones);
+    ASSERT_TRUE(status.isOk());
+    EXPECT_EQ(occupantZones.size(), 2);
+    if (occupantZones.size() == 2) {
+        EXPECT_EQ(occupantZones[0].zoneId, 0);
+        EXPECT_EQ(occupantZones[0].occupantType, OccupantType::DRIVER);
+        EXPECT_EQ(occupantZones[0].seat, 1);
+        EXPECT_EQ(occupantZones[1].zoneId, 1);
+        EXPECT_EQ(occupantZones[1].occupantType, OccupantType::FRONT_PASSENGER);
+        EXPECT_EQ(occupantZones[1].seat, 4);
+    }
+}
+
+}  // namespace ivn
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
index ec0d310..0a1f904 100644
--- a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
+++ b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
@@ -113,6 +113,7 @@
         {"WHEEL_FRONT_LEFT", WHEEL_FRONT_LEFT},
         {"CHARGE_PORT_FRONT_LEFT", CHARGE_PORT_FRONT_LEFT},
         {"CHARGE_PORT_REAR_LEFT", CHARGE_PORT_REAR_LEFT},
+        {"FAN_DIRECTION_UNKNOWN", toInt(VehicleHvacFanDirection::UNKNOWN)},
         {"FAN_DIRECTION_FLOOR", FAN_DIRECTION_FLOOR},
         {"FAN_DIRECTION_FACE", FAN_DIRECTION_FACE},
         {"FAN_DIRECTION_DEFROST", FAN_DIRECTION_DEFROST},
diff --git a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
index 84edeed..5503de2 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
+++ b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
@@ -2164,6 +2164,7 @@
             "property": "VehicleProperty::HVAC_FAN_DIRECTION_AVAILABLE",
             "defaultValue": {
                 "int32Values": [
+                    "Constants::FAN_DIRECTION_UNKNOWN",
                     "Constants::FAN_DIRECTION_FACE",
                     "Constants::FAN_DIRECTION_FLOOR",
                     "Constants::FAN_DIRECTION_FACE_FLOOR",
diff --git a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
index f544d83..89a9e23 100644
--- a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
+++ b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
@@ -133,10 +133,6 @@
     ASSERT_TRUE(contextHub->registerCallback(getHubId(), cb).isOk());
 }
 
-TEST_P(ContextHubAidl, TestRegisterNullCallback) {
-    ASSERT_TRUE(contextHub->registerCallback(getHubId(), nullptr).isOk());
-}
-
 // Helper callback that puts the async appInfo callback data into a promise
 class QueryAppsCallback : public android::hardware::contexthub::BnContextHubCallback {
   public:
@@ -195,7 +191,6 @@
         GTEST_SKIP() << "Not supported -> old API; or not implemented";
     } else {
         ASSERT_TRUE(status.isOk());
-        ASSERT_FALSE(preloadedNanoappIds.empty());
     }
 }
 
@@ -323,8 +318,6 @@
 
     ASSERT_TRUE(contextHub->onSettingChanged(setting, true /* enabled */).isOk());
     ASSERT_TRUE(contextHub->onSettingChanged(setting, false /* enabled */).isOk());
-
-    ASSERT_TRUE(contextHub->registerCallback(getHubId(), nullptr).isOk());
 }
 
 TEST_P(ContextHubAidl, TestOnLocationSettingChanged) {
diff --git a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
index 4a5ac69..2e902e5 100644
--- a/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
+++ b/graphics/composer/aidl/include/android/hardware/graphics/composer3/ComposerClientWriter.h
@@ -70,12 +70,6 @@
     ComposerClientWriter(const ComposerClientWriter&) = delete;
     ComposerClientWriter& operator=(const ComposerClientWriter&) = delete;
 
-    void reset() {
-        mDisplayCommand.reset();
-        mLayerCommand.reset();
-        mCommands.clear();
-    }
-
     void setColorTransform(int64_t display, const float* matrix) {
         std::vector<float> matVec;
         matVec.reserve(16);
@@ -235,10 +229,12 @@
         getLayerCommand(display, layer).blockingRegion.emplace(blocking.begin(), blocking.end());
     }
 
-    const std::vector<DisplayCommand>& getPendingCommands() {
+    std::vector<DisplayCommand> takePendingCommands() {
         flushLayerCommand();
         flushDisplayCommand();
-        return mCommands;
+        std::vector<DisplayCommand> moved = std::move(mCommands);
+        mCommands.clear();
+        return moved;
     }
 
   private:
@@ -289,6 +285,12 @@
         }
         return *mLayerCommand;
     }
+
+    void reset() {
+        mDisplayCommand.reset();
+        mLayerCommand.reset();
+        mCommands.clear();
+    }
 };
 
 }  // namespace aidl::android::hardware::graphics::composer3
diff --git a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
index 6fa3392..b047220 100644
--- a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
+++ b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_ReadbackTest.cpp
@@ -207,9 +207,8 @@
     }
 
     void execute() {
-        const auto& commands = mWriter->getPendingCommands();
+        auto commands = mWriter->takePendingCommands();
         if (commands.empty()) {
-            mWriter->reset();
             return;
         }
 
@@ -217,7 +216,6 @@
         ASSERT_TRUE(status.isOk()) << "executeCommands failed " << status.getDescription();
 
         mReader.parse(std::move(results));
-        mWriter->reset();
     }
 
     bool getHasReadbackBuffer() {
diff --git a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
index 3ea5bf5..ed4f28c 100644
--- a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
+++ b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
@@ -1171,15 +1171,13 @@
     void execute() {
         std::vector<CommandResultPayload> payloads;
         for (auto& [_, writer] : mWriters) {
-            const auto& commands = writer.getPendingCommands();
+            auto commands = writer.takePendingCommands();
             if (commands.empty()) {
-                writer.reset();
                 continue;
             }
 
             auto [status, results] = mComposerClient->executeCommands(commands);
             ASSERT_TRUE(status.isOk()) << "executeCommands failed " << status.getDescription();
-            writer.reset();
 
             payloads.reserve(payloads.size() + results.size());
             payloads.insert(payloads.end(), std::make_move_iterator(results.begin()),
diff --git a/input/classifier/1.0/vts/functional/Android.bp b/input/classifier/1.0/vts/functional/Android.bp
index 5ff1457..22346ed 100644
--- a/input/classifier/1.0/vts/functional/Android.bp
+++ b/input/classifier/1.0/vts/functional/Android.bp
@@ -25,6 +25,7 @@
 
 cc_test {
     name: "VtsHalInputClassifierV1_0TargetTest",
+    cpp_std: "c++20",
     defaults: ["VtsHalTargetTestDefaults"],
     srcs: [
         ":inputconstants_aidl",
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
index 624d003..ee8b4dc 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
@@ -654,6 +654,8 @@
         ASSERT_TRUE(CheckAnyOfErrors(radioRsp->rspInfo.error,
                                      {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
     }
+    // wait until modem reset finishes
+    sleep(10);
     LOG(DEBUG) << "nvResetConfig finished";
 }
 
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index aa6ac88..3eedc14 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -531,8 +531,7 @@
 
         ASSERT_TRUE(CheckAnyOfErrors(
                 radioRsp_data->rspInfo.error,
-                {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INVALID_ARGUMENTS,
-                 RadioError::REQUEST_NOT_SUPPORTED}));
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
     }
 }
 
@@ -549,8 +548,7 @@
 
     ASSERT_TRUE(
             CheckAnyOfErrors(radioRsp_data->rspInfo.error,
-                             {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
-                              RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+                             {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
 }
 
 /*
diff --git a/radio/aidl/vts/radio_modem_test.cpp b/radio/aidl/vts/radio_modem_test.cpp
index 3454f33..67747a8 100644
--- a/radio/aidl/vts/radio_modem_test.cpp
+++ b/radio/aidl/vts/radio_modem_test.cpp
@@ -290,6 +290,8 @@
         ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
                                      {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
     }
+    // wait until modem reset finishes
+    sleep(10);
     LOG(DEBUG) << "nvResetConfig finished";
 }
 
diff --git a/radio/aidl/vts/radio_network_test.cpp b/radio/aidl/vts/radio_network_test.cpp
index 57bd4fb..0b7c16e 100644
--- a/radio/aidl/vts/radio_network_test.cpp
+++ b/radio/aidl/vts/radio_network_test.cpp
@@ -66,12 +66,20 @@
 }
 
 /*
- * Test IRadioNetwork.setAllowedNetworkTypesBitmap for the response returned.
+ * Test IRadioNetwork.setAllowedNetworkTypesBitmap and IRadioNetwork.getAllowedNetworkTypesBitmap
+ * for the response returned.
  */
-TEST_P(RadioNetworkTest, setAllowedNetworkTypesBitmap) {
+TEST_P(RadioNetworkTest, setGetAllowedNetworkTypesBitmap) {
     serial = GetRandomSerialNumber();
-    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
 
+    // save current value
+    radio_network->getAllowedNetworkTypesBitmap(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    int32_t currentAllowedNetworkTypesBitmap = radioRsp_network->networkTypeBitmapResponse;
+
+    // set new value
+    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
+    serial = GetRandomSerialNumber();
     radio_network->setAllowedNetworkTypesBitmap(serial, allowedNetworkTypesBitmap);
 
     EXPECT_EQ(std::cv_status::no_timeout, wait());
@@ -83,20 +91,6 @@
              RadioError::MODE_NOT_SUPPORTED, RadioError::INTERNAL_ERR, RadioError::MODEM_ERR,
              RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED,
              RadioError::NO_RESOURCES}));
-}
-
-/*
- * Test IRadioNetwork.getAllowedNetworkTypesBitmap for the response returned.
- */
-TEST_P(RadioNetworkTest, getAllowedNetworkTypesBitmap) {
-    serial = GetRandomSerialNumber();
-    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
-
-    radio_network->setAllowedNetworkTypesBitmap(serial, allowedNetworkTypesBitmap);
-
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
 
     if (radioRsp_network->rspInfo.error == RadioError::NONE) {
         sleep(3);  // wait for modem
@@ -112,7 +106,16 @@
                  RadioError::OPERATION_NOT_ALLOWED, RadioError::MODE_NOT_SUPPORTED,
                  RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR,
                  RadioError::REQUEST_NOT_SUPPORTED, RadioError::NO_RESOURCES}));
+        if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+            // verify we get the value we set
+            ASSERT_EQ(radioRsp_network->networkTypeBitmapResponse, allowedNetworkTypesBitmap);
+        }
     }
+
+    // reset value to previous
+    serial = GetRandomSerialNumber();
+    radio_network->setAllowedNetworkTypesBitmap(serial, currentAllowedNetworkTypesBitmap);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
 }
 
 /*
@@ -947,7 +950,7 @@
     RadioAccessSpecifier specifier850 = {
             .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
 
-    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_PERIODIC,
                                   .interval = 4,
                                   .specifiers = {specifierP900, specifier850},
                                   .maxSearchTime = 60,
@@ -988,7 +991,7 @@
     RadioAccessSpecifier specifier850 = {
             .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
 
-    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_PERIODIC,
                                   .interval = 301,
                                   .specifiers = {specifierP900, specifier850},
                                   .maxSearchTime = 60,
@@ -1521,7 +1524,7 @@
     }
 
     // 32 bit system might return invalid mcc and mnc string "\xff\xff..."
-    if (checkMccMnc && mcc.size() < 4 && mnc.size() < 4) {
+    if (checkMccMnc && mcc.size() == 3 && (mnc.size() == 2 || mnc.size() == 3)) {
         int mcc_int = stoi(mcc);
         int mnc_int = stoi(mnc);
         EXPECT_TRUE(mcc_int >= 0 && mcc_int <= 999);
diff --git a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index 461357d..2a4cba1 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -134,6 +134,10 @@
      *        are marked (see the definition of PublicKey in the MacedPublicKey structure) to
      *        prevent them from being confused with production keys.
      *
+     *        This parameter has been deprecated since version 3 of the HAL and will always be
+     *        false. From v3, if this parameter is true, the method must raise a
+     *        ServiceSpecificException with an error of code of STATUS_REMOVED.
+     *
      * @param out MacedPublicKey macedPublicKey contains the public key of the generated key pair,
      *        MACed so that generateCertificateRequest can easily verify, without the
      *        privateKeyHandle, that the contained public key is for remote certification.
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 94bfbb4..8906543 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -47,7 +47,11 @@
 namespace {
 
 constexpr int32_t VERSION_WITH_UNIQUE_ID_SUPPORT = 2;
+
+constexpr int32_t VERSION_WITHOUT_EEK = 3;
 constexpr int32_t VERSION_WITHOUT_TEST_MODE = 3;
+constexpr int32_t VERSION_WITH_CERTIFICATE_REQUEST_V2 = 3;
+constexpr int32_t VERSION_WITH_SUPPORTED_NUM_KEYS_IN_CSR = 3;
 
 constexpr uint8_t MIN_CHALLENGE_SIZE = 0;
 constexpr uint8_t MAX_CHALLENGE_SIZE = 64;
@@ -226,21 +230,13 @@
     RpcHardwareInfo hwInfo;
     ASSERT_TRUE(provisionable_->getHardwareInfo(&hwInfo).isOk());
 
-    const std::set<int> validCurves = {RpcHardwareInfo::CURVE_P256, RpcHardwareInfo::CURVE_25519};
-    // First check for the implementations that supports only IRPC V3+.
-    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
-        bytevec keysToSignMac;
-        DeviceInfo deviceInfo;
-        ProtectedData protectedData;
-        auto status = provisionable_->generateCertificateRequest(false, {}, {}, {}, &deviceInfo,
-                                                                 &protectedData, &keysToSignMac);
-        if (!status.isOk() &&
-            (status.getServiceSpecificError() == BnRemotelyProvisionedComponent::STATUS_REMOVED)) {
-            ASSERT_EQ(hwInfo.supportedEekCurve, RpcHardwareInfo::CURVE_NONE)
-                    << "Invalid curve: " << hwInfo.supportedEekCurve;
-            return;
-        }
+    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_EEK) {
+        ASSERT_EQ(hwInfo.supportedEekCurve, RpcHardwareInfo::CURVE_NONE)
+                << "Invalid curve: " << hwInfo.supportedEekCurve;
+        return;
     }
+
+    const std::set<int> validCurves = {RpcHardwareInfo::CURVE_P256, RpcHardwareInfo::CURVE_25519};
     ASSERT_EQ(validCurves.count(hwInfo.supportedEekCurve), 1)
             << "Invalid curve: " << hwInfo.supportedEekCurve;
 }
@@ -264,7 +260,7 @@
  * Verify implementation supports at least MIN_SUPPORTED_NUM_KEYS_IN_CSR keys in a CSR.
  */
 TEST_P(GetHardwareInfoTests, supportedNumKeysInCsr) {
-    if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
+    if (rpcHardwareInfo.versionNumber < VERSION_WITH_SUPPORTED_NUM_KEYS_IN_CSR) {
         return;
     }
 
@@ -365,6 +361,13 @@
     bytevec privateKeyBlob;
     bool testMode = true;
     auto status = provisionable_->generateEcdsaP256KeyPair(testMode, &macedPubKey, &privateKeyBlob);
+
+    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
+        ASSERT_FALSE(status.isOk());
+        EXPECT_EQ(status.getServiceSpecificError(), BnRemotelyProvisionedComponent::STATUS_REMOVED);
+        return;
+    }
+
     ASSERT_TRUE(status.isOk());
     check_maced_pubkey(macedPubKey, testMode, nullptr);
 }
@@ -410,7 +413,7 @@
         CertificateRequestTestBase::SetUp();
         ASSERT_FALSE(HasFatalFailure());
 
-        if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
+        if (rpcHardwareInfo.versionNumber >= VERSION_WITH_CERTIFICATE_REQUEST_V2) {
             GTEST_SKIP() << "This test case only applies to RKP v1 and v2. "
                          << "RKP version discovered: " << rpcHardwareInfo.versionNumber;
         }
@@ -688,7 +691,7 @@
         CertificateRequestTestBase::SetUp();
         ASSERT_FALSE(HasFatalFailure());
 
-        if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
+        if (rpcHardwareInfo.versionNumber < VERSION_WITH_CERTIFICATE_REQUEST_V2) {
             GTEST_SKIP() << "This test case only applies to RKP v3 and above. "
                          << "RKP version discovered: " << rpcHardwareInfo.versionNumber;
         }
@@ -802,23 +805,23 @@
 }
 
 /**
- * Generate a non-empty certificate request in prod mode, with test keys.  Must fail with
- * STATUS_TEST_KEY_IN_PRODUCTION_REQUEST.
+ * Call generateCertificateRequest(). Make sure it's removed.
  */
-TEST_P(CertificateRequestV2Test, NonEmptyRequest_testKeyInProdCert) {
-    generateKeys(true /* testMode */, 1 /* numKeys */);
-
-    bytevec csr;
-    auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
+TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed_prodMode) {
+    bytevec keysToSignMac;
+    DeviceInfo deviceInfo;
+    ProtectedData protectedData;
+    auto status = provisionable_->generateCertificateRequest(
+            false /* testMode */, {} /* keysToSign */, {} /* EEK chain */, challenge_, &deviceInfo,
+            &protectedData, &keysToSignMac);
     ASSERT_FALSE(status.isOk()) << status.getMessage();
-    ASSERT_EQ(status.getServiceSpecificError(),
-              BnRemotelyProvisionedComponent::STATUS_TEST_KEY_IN_PRODUCTION_REQUEST);
+    EXPECT_EQ(status.getServiceSpecificError(), BnRemotelyProvisionedComponent::STATUS_REMOVED);
 }
 
 /**
- * Call generateCertificateRequest(). Make sure it's removed.
+ * Call generateCertificateRequest() in test mode. Make sure it's removed.
  */
-TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed) {
+TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed_testMode) {
     bytevec keysToSignMac;
     DeviceInfo deviceInfo;
     ProtectedData protectedData;
diff --git a/tetheroffload/aidl/Android.bp b/tetheroffload/aidl/Android.bp
index b3b6ebf..6de27c3 100644
--- a/tetheroffload/aidl/Android.bp
+++ b/tetheroffload/aidl/Android.bp
@@ -4,7 +4,6 @@
 
 aidl_interface {
     name: "android.hardware.tetheroffload",
-    owner: "google",
     vendor_available: true,
     srcs: ["android/hardware/tetheroffload/*.aidl"],
     stability: "vintf",
@@ -24,4 +23,12 @@
             apps_enabled: false,
         },
     },
+    versions_with_info: [
+        {
+            version: "1",
+            imports: [],
+        },
+    ],
+    frozen: true,
+
 }
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/.hash b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/.hash
new file mode 100644
index 0000000..e7b452e
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/.hash
@@ -0,0 +1 @@
+ba3f0342e13af942628a6c00e920d55ce8ad1ea3
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ForwardedStats.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ForwardedStats.aidl
new file mode 100644
index 0000000..493a698
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ForwardedStats.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable ForwardedStats {
+  long rxBytes;
+  long txBytes;
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IOffload.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IOffload.aidl
new file mode 100644
index 0000000..9a58b1f
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IOffload.aidl
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@VintfStability
+interface IOffload {
+  void initOffload(in ParcelFileDescriptor fd1, in ParcelFileDescriptor fd2, in android.hardware.tetheroffload.ITetheringOffloadCallback cb);
+  void stopOffload();
+  void setLocalPrefixes(in String[] prefixes);
+  android.hardware.tetheroffload.ForwardedStats getForwardedStats(in String upstream);
+  void setDataWarningAndLimit(in String upstream, in long warningBytes, in long limitBytes);
+  void setUpstreamParameters(in String iface, in String v4Addr, in String v4Gw, in String[] v6Gws);
+  void addDownstream(in String iface, in String prefix);
+  void removeDownstream(in String iface, in String prefix);
+  const int ERROR_CODE_UNUSED = 0;
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IPv4AddrPortPair.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
new file mode 100644
index 0000000..2b42f0c
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable IPv4AddrPortPair {
+  String addr;
+  int port;
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
new file mode 100644
index 0000000..4eb7d04
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@VintfStability
+interface ITetheringOffloadCallback {
+  oneway void onEvent(in android.hardware.tetheroffload.OffloadCallbackEvent event);
+  oneway void updateTimeout(in android.hardware.tetheroffload.NatTimeoutUpdate params);
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NatTimeoutUpdate.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
new file mode 100644
index 0000000..9eddaa2
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable NatTimeoutUpdate {
+  android.hardware.tetheroffload.IPv4AddrPortPair src;
+  android.hardware.tetheroffload.IPv4AddrPortPair dst;
+  android.hardware.tetheroffload.NetworkProtocol proto;
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NetworkProtocol.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NetworkProtocol.aidl
new file mode 100644
index 0000000..52bd2a6
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/NetworkProtocol.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@Backing(type="int") @VintfStability
+enum NetworkProtocol {
+  TCP = 6,
+  UDP = 17,
+}
diff --git a/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/OffloadCallbackEvent.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
new file mode 100644
index 0000000..026e18e
--- /dev/null
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/1/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tetheroffload;
+@Backing(type="int") @VintfStability
+enum OffloadCallbackEvent {
+  OFFLOAD_STARTED = 1,
+  OFFLOAD_STOPPED_ERROR = 2,
+  OFFLOAD_STOPPED_UNSUPPORTED = 3,
+  OFFLOAD_SUPPORT_AVAILABLE = 4,
+  OFFLOAD_STOPPED_LIMIT_REACHED = 5,
+  OFFLOAD_WARNING_REACHED = 6,
+}
diff --git a/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp b/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
index 7b42689..75c44b7 100644
--- a/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
+++ b/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
@@ -127,7 +127,15 @@
 
 TEST_P(HdmiCecTest, SendMessage) {
     CecMessage message;
-    message.initiator = CecLogicalAddress::PLAYBACK_1;
+    if (hasDeviceType(CecDeviceType::TV))
+    {
+        hdmiCec->clearLogicalAddress();
+        Return<Result> result = hdmiCec->addLogicalAddress(CecLogicalAddress::TV);
+        EXPECT_EQ(result, Result::SUCCESS);
+        message.initiator = CecLogicalAddress::TV;
+    }
+    else
+        message.initiator = CecLogicalAddress::PLAYBACK_1;
     message.destination = CecLogicalAddress::BROADCAST;
     message.body.resize(1);
     message.body[0] = 131;
diff --git a/wifi/aidl/default/aidl_callback_util.h b/wifi/aidl/default/aidl_callback_util.h
index 41d70a5..f8ba53b 100644
--- a/wifi/aidl/default/aidl_callback_util.h
+++ b/wifi/aidl/default/aidl_callback_util.h
@@ -19,11 +19,13 @@
 
 #include <android-base/logging.h>
 
+#include <mutex>
 #include <set>
 #include <unordered_map>
 
 namespace {
 std::unordered_map<void* /* callback */, void* /* handler */> callback_handler_map_;
+std::mutex callback_handler_lock_;
 }
 
 namespace aidl {
@@ -43,6 +45,7 @@
     ~AidlCallbackHandler() { invalidate(); }
 
     bool addCallback(const std::shared_ptr<CallbackType>& cb) {
+        std::unique_lock<std::mutex> lk(callback_handler_lock_);
         void* cbPtr = reinterpret_cast<void*>(cb->asBinder().get());
         const auto& cbPosition = findCbInSet(cbPtr);
         if (cbPosition != cb_set_.end()) {
@@ -58,12 +61,18 @@
 
         callback_handler_map_[cbPtr] = reinterpret_cast<void*>(this);
         cb_set_.insert(cb);
+        // unique_lock unlocked here
         return true;
     }
 
-    const std::set<std::shared_ptr<CallbackType>>& getCallbacks() { return cb_set_; }
+    const std::set<std::shared_ptr<CallbackType>>& getCallbacks() {
+        std::unique_lock<std::mutex> lk(callback_handler_lock_);
+        // unique_lock unlocked here
+        return cb_set_;
+    }
 
     void invalidate() {
+        std::unique_lock<std::mutex> lk(callback_handler_lock_);
         for (auto cb : cb_set_) {
             void* cookie = reinterpret_cast<void*>(cb->asBinder().get());
             if (AIBinder_unlinkToDeath(cb->asBinder().get(), death_handler_, cookie) != STATUS_OK) {
@@ -74,12 +83,14 @@
             }
         }
         cb_set_.clear();
+        // unique_lock unlocked here
     }
 
     // Entry point for the death handling logic. AIBinder_DeathRecipient
     // can only call a static function, so use the cookie to find the
     // proper handler and route the request there.
     static void onCallbackDeath(void* cookie) {
+        std::unique_lock<std::mutex> lk(callback_handler_lock_);
         auto cbQuery = callback_handler_map_.find(cookie);
         if (cbQuery == callback_handler_map_.end()) {
             LOG(ERROR) << "Invalid death cookie received";
@@ -92,6 +103,7 @@
             return;
         }
         cbHandler->handleCallbackDeath(cbQuery->first);
+        // unique_lock unlocked here
     }
 
   private:
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
index 7eeab68..f2cb3f6 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
@@ -64,9 +64,9 @@
 
 void initializeService() {
     if (SupplicantAidlTestUtils::useAidlService()) {
-        SupplicantAidlTestUtils::stopSupplicantService();
+        SupplicantAidlTestUtils::initializeService();
     } else {
-        SupplicantLegacyTestUtils::stopSupplicantService();
+        SupplicantLegacyTestUtils::initializeService();
     }
 }