diff --git a/audio/2.0/default/Device.cpp b/audio/2.0/default/Device.cpp
index 5ced0bc..b696d94 100644
--- a/audio/2.0/default/Device.cpp
+++ b/audio/2.0/default/Device.cpp
@@ -225,7 +225,7 @@
     if (version() >= AUDIO_DEVICE_API_VERSION_3_0) {
         std::unique_ptr<audio_port_config[]> halSources(HidlUtils::audioPortConfigsToHal(sources));
         std::unique_ptr<audio_port_config[]> halSinks(HidlUtils::audioPortConfigsToHal(sinks));
-        audio_patch_handle_t halPatch;
+        audio_patch_handle_t halPatch = AUDIO_PATCH_HANDLE_NONE;
         retval = analyzeStatus(
                 "create_audio_patch",
                 mDevice->create_audio_patch(
@@ -292,7 +292,7 @@
 }
 
 Return<void> Device::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         analyzeStatus("dump", mDevice->dump(mDevice, fd->data[0]));
     }
     return Void();
diff --git a/audio/2.0/default/Stream.cpp b/audio/2.0/default/Stream.cpp
index 29946fe..671f171 100644
--- a/audio/2.0/default/Stream.cpp
+++ b/audio/2.0/default/Stream.cpp
@@ -226,7 +226,7 @@
 }
 
 Return<void> Stream::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         analyzeStatus("dump", mStream->dump(mStream, fd->data[0]));
     }
     return Void();
diff --git a/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp b/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
index 4b00f35..711a8d9 100644
--- a/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
+++ b/audio/2.0/vts/functional/AudioPrimaryHidlHalTest.cpp
@@ -498,6 +498,11 @@
     testDebugDump([this](const auto& handle){ return device->debugDump(handle); });
 }
 
+TEST_F(AudioPrimaryHidlTest, debugDumpInvalidArguments) {
+    doc::test("Check that the hal dump doesn't crash on invalid arguments");
+    ASSERT_OK(device->debugDump(hidl_handle()));
+}
+
 //////////////////////////////////////////////////////////////////////////////
 ////////////////////////// open{Output,Input}Stream //////////////////////////
 //////////////////////////////////////////////////////////////////////////////
@@ -809,6 +814,10 @@
                "Check that a stream can dump its state without error",
                testDebugDump([this](const auto& handle){ return stream->debugDump(handle); }))
 
+TEST_IO_STREAM(DebugDumpInvalidArguments,
+               "Check that the stream dump doesn't crash on invalid arguments",
+               ASSERT_OK(stream->debugDump(hidl_handle())))
+
 //////////////////////////////////////////////////////////////////////////////
 ////////////////////////////// addRemoveEffect ///////////////////////////////
 //////////////////////////////////////////////////////////////////////////////
diff --git a/audio/effect/2.0/IDownmixEffect.hal b/audio/effect/2.0/IDownmixEffect.hal
index 06409a3..1232095 100644
--- a/audio/effect/2.0/IDownmixEffect.hal
+++ b/audio/effect/2.0/IDownmixEffect.hal
@@ -25,7 +25,13 @@
         FOLD   // mix the extra channels with FL/FR
     };
 
+    /**
+     * Sets the current downmix preset.
+     */
     setType(Type preset) generates (Result retval);
 
+    /**
+     * Gets the current downmix preset.
+     */
     getType() generates (Result retval, Type preset);
 };
diff --git a/audio/effect/2.0/IEnvironmentalReverbEffect.hal b/audio/effect/2.0/IEnvironmentalReverbEffect.hal
index dca89f9..58d6d97 100644
--- a/audio/effect/2.0/IEnvironmentalReverbEffect.hal
+++ b/audio/effect/2.0/IEnvironmentalReverbEffect.hal
@@ -64,12 +64,12 @@
     getRoomLevel() generates (Result retval, int16_t roomLevel);
 
     /**
-     * Sets the room high frequences level.
+     * Sets the room high frequencies level.
      */
     setRoomHfLevel(int16_t roomHfLevel) generates (Result retval);
 
     /**
-     * Gets the room high frequences level.
+     * Gets the room high frequencies level.
      */
     getRoomHfLevel() generates (Result retval, int16_t roomHfLevel);
 
@@ -84,12 +84,12 @@
     getDecayTime() generates (Result retval, uint32_t decayTime);
 
     /**
-     * Sets the ratio of high frequences decay.
+     * Sets the ratio of high frequencies decay.
      */
     setDecayHfRatio(int16_t decayHfRatio) generates (Result retval);
 
     /**
-     * Gets the ratio of high frequences decay.
+     * Gets the ratio of high frequencies decay.
      */
     getDecayHfRatio() generates (Result retval, int16_t decayHfRatio);
 
diff --git a/audio/effect/2.0/IPresetReverbEffect.hal b/audio/effect/2.0/IPresetReverbEffect.hal
index 2237bc4..f37e56a 100644
--- a/audio/effect/2.0/IPresetReverbEffect.hal
+++ b/audio/effect/2.0/IPresetReverbEffect.hal
@@ -31,7 +31,13 @@
         LAST = PLATE
     };
 
+    /**
+     * Sets the current preset.
+     */
     setPreset(Preset preset) generates (Result retval);
 
+    /**
+     * Gets the current preset.
+     */
     getPreset() generates (Result retval, Preset preset);
 };
diff --git a/audio/effect/2.0/IVisualizerEffect.hal b/audio/effect/2.0/IVisualizerEffect.hal
index fd3edbd..fffc70b 100644
--- a/audio/effect/2.0/IVisualizerEffect.hal
+++ b/audio/effect/2.0/IVisualizerEffect.hal
@@ -100,7 +100,7 @@
         } value;
     };
     /**
-     * Retrieves the lastest measurements. The measurements to be made
+     * Retrieves the latest measurements. The measurements to be made
      * are specified by 'setMeasurementMode' parameter.
      *
      * @return retval operation completion status.
diff --git a/audio/effect/2.0/default/EffectsFactory.cpp b/audio/effect/2.0/default/EffectsFactory.cpp
index 08d92bd..922a922 100644
--- a/audio/effect/2.0/default/EffectsFactory.cpp
+++ b/audio/effect/2.0/default/EffectsFactory.cpp
@@ -186,7 +186,7 @@
 }
 
 Return<void> EffectsFactory::debugDump(const hidl_handle& fd)  {
-    if (fd->numFds == 1) {
+    if (fd.getNativeHandle() != nullptr && fd->numFds == 1) {
         EffectDumpEffects(fd->data[0]);
     }
     return Void();
diff --git a/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp b/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
index 15a564a..18e9862 100644
--- a/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
+++ b/audio/effect/2.0/vts/functional/VtsHalAudioEffectV2_0TargetTest.cpp
@@ -47,6 +47,7 @@
 using android::hardware::MQDescriptorSync;
 using android::hardware::Return;
 using android::hardware::Void;
+using android::hardware::hidl_handle;
 using android::hardware::hidl_memory;
 using android::hardware::hidl_string;
 using android::hardware::hidl_vec;
@@ -142,6 +143,12 @@
   EXPECT_TRUE(ret.isOk());
 }
 
+TEST_F(AudioEffectsFactoryHidlTest, DebugDumpInvalidArgument) {
+    description("Verify that debugDump doesn't crash on invalid arguments");
+    Return<void> ret = effectsFactory->debugDump(hidl_handle());
+    ASSERT_TRUE(ret.isOk());
+}
+
 // Equalizer effect is required by CDD, but only the type is fixed.
 // This is the same UUID as AudioEffect.EFFECT_TYPE_EQUALIZER in Java.
 static const Uuid EQUALIZER_EFFECT_TYPE = {
diff --git a/automotive/evs/1.0/default/EvsCamera.cpp b/automotive/evs/1.0/default/EvsCamera.cpp
index 148b796..e0782ec 100644
--- a/automotive/evs/1.0/default/EvsCamera.cpp
+++ b/automotive/evs/1.0/default/EvsCamera.cpp
@@ -311,9 +311,7 @@
 
     while (added < numToAdd) {
         buffer_handle_t memHandle = nullptr;
-        status_t result = alloc.allocate(mWidth, mHeight,
-                                         mFormat, 1,
-                                         mUsage, mUsage,
+        status_t result = alloc.allocate(mWidth, mHeight, mFormat, 1, mUsage,
                                          &memHandle, &mStride, 0, "EvsCamera");
         if (result != NO_ERROR) {
             ALOGE("Error %d allocating %d x %d graphics buffer", result, mWidth, mHeight);
diff --git a/automotive/evs/1.0/default/EvsDisplay.cpp b/automotive/evs/1.0/default/EvsDisplay.cpp
index 9ad332a..9dd546d 100644
--- a/automotive/evs/1.0/default/EvsDisplay.cpp
+++ b/automotive/evs/1.0/default/EvsDisplay.cpp
@@ -166,11 +166,9 @@
         // Allocate the buffer that will hold our displayable image
         buffer_handle_t handle = nullptr;
         GraphicBufferAllocator& alloc(GraphicBufferAllocator::get());
-        status_t result = alloc.allocate(mBuffer.width, mBuffer.height,
-                                         mBuffer.format, 1, mBuffer.usage,
-                                         mBuffer.usage, &handle,
-                                         &mBuffer.stride,
-                                         0, "EvsDisplay");
+        status_t result = alloc.allocate(
+            mBuffer.width, mBuffer.height, mBuffer.format, 1, mBuffer.usage,
+            &handle, &mBuffer.stride, 0, "EvsDisplay");
         if (result != NO_ERROR) {
             ALOGE("Error %d allocating %d x %d graphics buffer",
                   result, mBuffer.width, mBuffer.height);
diff --git a/automotive/vehicle/2.0/default/VehicleService.cpp b/automotive/vehicle/2.0/default/VehicleService.cpp
index e6d292e..ff112c6 100644
--- a/automotive/vehicle/2.0/default/VehicleService.cpp
+++ b/automotive/vehicle/2.0/default/VehicleService.cpp
@@ -33,7 +33,7 @@
     auto emulator = std::make_unique<impl::VehicleEmulator>(hal.get());
     auto service = std::make_unique<VehicleHalManager>(hal.get());
 
-    configureRpcThreadpool(1, true /* callerWillJoin */);
+    configureRpcThreadpool(4, true /* callerWillJoin */);
 
     ALOGI("Registering as service...");
     service->registerAsService();
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
index c4f935b..4835288 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/DefaultConfig.h
@@ -77,6 +77,8 @@
             .prop = toInt(VehicleProperty::PERF_VEHICLE_SPEED),
             .access = VehiclePropertyAccess::READ,
             .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+            .minSampleRate = 1.0f,
+            .maxSampleRate = 1000.0f,
         },
         .initialValue = { .floatValues = {0.0f} }
     },
@@ -95,8 +97,10 @@
             .prop = toInt(VehicleProperty::ENGINE_RPM),
             .access = VehiclePropertyAccess::READ,
             .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+            .minSampleRate = 1.0f,
+            .maxSampleRate = 1000.0f,
         },
-        .initialValue = { .floatValues = {0.0f} }
+        .initialValue = { .floatValues = {0.0f} },
     },
 
     {
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
index c8bcd60..1a8cfe2 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/VehicleEmulator.h
@@ -52,8 +52,7 @@
 protected:
     VehicleEmulator* getEmulatorOrDie() {
         std::lock_guard<std::mutex> g(mEmulatorLock);
-        ALOGI("%s, emulator: %p", __func__, mEmulator);
-        assert(mEmulator != nullptr);
+        if (mEmulator == nullptr) abort();
         return mEmulator;
     }
 
diff --git a/automotive/vehicle/2.1/default/impl/vhal_v2_1/DefaultConfig.h b/automotive/vehicle/2.1/default/impl/vhal_v2_1/DefaultConfig.h
index aa9aa3c..0f10086 100644
--- a/automotive/vehicle/2.1/default/impl/vhal_v2_1/DefaultConfig.h
+++ b/automotive/vehicle/2.1/default/impl/vhal_v2_1/DefaultConfig.h
@@ -42,6 +42,8 @@
         .prop = WHEEL_TICK,
         .access = V2_0::VehiclePropertyAccess::READ,
         .changeMode = V2_0::VehiclePropertyChangeMode::CONTINUOUS,
+        .minSampleRate = 1.0f,
+        .maxSampleRate = 100.0f,
     },
 
     {
diff --git a/bluetooth/1.0/default/Android.bp b/bluetooth/1.0/default/Android.bp
index fec2264..46a4987 100644
--- a/bluetooth/1.0/default/Android.bp
+++ b/bluetooth/1.0/default/Android.bp
@@ -24,6 +24,7 @@
         "vendor_interface.cc",
     ],
     shared_libs: [
+        "android.frameworks.schedulerservice@1.0",
         "android.hardware.bluetooth@1.0",
         "libbase",
         "libcutils",
@@ -48,6 +49,7 @@
     ],
     export_include_dirs: ["."],
     shared_libs: [
+        "android.frameworks.schedulerservice@1.0",
         "liblog",
     ],
 }
@@ -84,9 +86,11 @@
         "test",
     ],
     shared_libs: [
+        "android.frameworks.schedulerservice@1.0",
         "libbase",
         "libhidlbase",
         "liblog",
+        "libutils",
     ],
     static_libs: [
         "android.hardware.bluetooth-async",
diff --git a/bluetooth/1.0/default/Android.mk b/bluetooth/1.0/default/Android.mk
index 38294c7..2dcb067 100644
--- a/bluetooth/1.0/default/Android.mk
+++ b/bluetooth/1.0/default/Android.mk
@@ -35,5 +35,6 @@
   libhidlbase \
   libhidltransport \
   android.hardware.bluetooth@1.0 \
+  android.frameworks.schedulerservice@1.0\
 
 include $(BUILD_EXECUTABLE)
diff --git a/bluetooth/1.0/default/async_fd_watcher.cc b/bluetooth/1.0/default/async_fd_watcher.cc
index 05ac537..ab8d555 100644
--- a/bluetooth/1.0/default/async_fd_watcher.cc
+++ b/bluetooth/1.0/default/async_fd_watcher.cc
@@ -14,6 +14,8 @@
 // limitations under the License.
 //
 
+#define LOG_TAG "android.hardware.bluetooth@1.0-impl"
+
 #include "async_fd_watcher.h"
 
 #include <algorithm>
@@ -22,13 +24,18 @@
 #include <map>
 #include <mutex>
 #include <thread>
+#include <utils/Log.h>
 #include <vector>
 #include "fcntl.h"
 #include "sys/select.h"
 #include "unistd.h"
 
+#include <android/frameworks/schedulerservice/1.0/ISchedulingPolicyService.h>
+
 static const int INVALID_FD = -1;
 
+static const int BT_RT_PRIORITY = 1;
+
 namespace android {
 namespace hardware {
 namespace bluetooth {
@@ -112,6 +119,21 @@
 }
 
 void AsyncFdWatcher::ThreadRoutine() {
+  using ::android::frameworks::schedulerservice::V1_0::ISchedulingPolicyService;
+  using ::android::hardware::Return;
+  sp<ISchedulingPolicyService> manager = ISchedulingPolicyService::getService();
+  if (manager == nullptr) {
+    ALOGE("%s: Couldn't get scheduler manager to set SCHED_FIFO.", __func__);
+  } else {
+    Return<bool> ret = manager->requestPriority(getpid(),
+                                                gettid(),
+                                                BT_RT_PRIORITY);
+    if (!ret.isOk() || !ret) {
+      ALOGE("%s unable to set SCHED_FIFO for pid %d, tid %d", __func__,
+            getpid(), gettid());
+    }
+  }
+
   while (running_) {
     fd_set read_fds;
     FD_ZERO(&read_fds);
diff --git a/boot/1.0/default/android.hardware.boot@1.0-service.rc b/boot/1.0/default/android.hardware.boot@1.0-service.rc
index ef5dd91..68e7c22 100644
--- a/boot/1.0/default/android.hardware.boot@1.0-service.rc
+++ b/boot/1.0/default/android.hardware.boot@1.0-service.rc
@@ -1,4 +1,4 @@
 service boot-hal-1-0 /vendor/bin/hw/android.hardware.boot@1.0-service
-    class hal
+    class early_hal
     user root
     group root
diff --git a/camera/provider/2.4/vts/functional/Android.bp b/camera/provider/2.4/vts/functional/Android.bp
index a0be5cb..85312c1 100644
--- a/camera/provider/2.4/vts/functional/Android.bp
+++ b/camera/provider/2.4/vts/functional/Android.bp
@@ -33,7 +33,7 @@
         "libgui",
         "libui"
     ],
-    static_libs: ["VtsHalHidlTargetTestBase"],
+    static_libs: ["VtsHalHidlTargetTestBase", "libgrallocusage"],
     cflags: [
         "-O0",
         "-g",
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index b7ce858..c8e44d3 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -15,28 +15,29 @@
  */
 
 #define LOG_TAG "camera_hidl_hal_test"
-#include <android/hardware/camera/provider/2.4/ICameraProvider.h>
-#include <android/hardware/camera/device/3.2/ICameraDevice.h>
-#include <android/hardware/camera/device/1.0/ICameraDevice.h>
-#include "CameraParameters.h"
-#include <system/camera.h>
-#include <android/log.h>
-#include <ui/GraphicBuffer.h>
 #include <VtsHalHidlTargetTestBase.h>
+#include <android/hardware/camera/device/1.0/ICameraDevice.h>
+#include <android/hardware/camera/device/3.2/ICameraDevice.h>
+#include <android/hardware/camera/provider/2.4/ICameraProvider.h>
+#include <android/log.h>
+#include <binder/MemoryHeapBase.h>
+#include <grallocusage/GrallocUsageConversion.h>
+#include <gui/BufferItemConsumer.h>
 #include <gui/BufferQueue.h>
 #include <gui/Surface.h>
-#include <gui/BufferItemConsumer.h>
-#include <binder/MemoryHeapBase.h>
-#include <regex>
-#include "system/camera_metadata.h"
 #include <hardware/gralloc.h>
 #include <hardware/gralloc1.h>
-#include <unordered_map>
-#include <mutex>
-#include <condition_variable>
-#include <chrono>
 #include <inttypes.h>
+#include <system/camera.h>
+#include <ui/GraphicBuffer.h>
 #include <utils/Errors.h>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+#include <regex>
+#include <unordered_map>
+#include "CameraParameters.h"
+#include "system/camera_metadata.h"
 
 using ::android::hardware::Return;
 using ::android::hardware::Void;
@@ -2480,11 +2481,12 @@
                     settings = req; });
             ASSERT_TRUE(ret.isOk());
 
-            sp<GraphicBuffer> gb = new GraphicBuffer(previewStream.width,
-                    previewStream.height,
-                    static_cast<int32_t> (halStreamConfig.streams[0].overrideFormat),
-                    1, halStreamConfig.streams[0].producerUsage,
-                    halStreamConfig.streams[0].consumerUsage);
+            sp<GraphicBuffer> gb = new GraphicBuffer(
+                previewStream.width, previewStream.height,
+                static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat),
+                1, android_convertGralloc1To0Usage(
+                       halStreamConfig.streams[0].producerUsage,
+                       halStreamConfig.streams[0].consumerUsage));
             ASSERT_NE(nullptr, gb.get());
             StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                     bufferId, hidl_handle(gb->getNativeBuffer()->handle),
@@ -2586,11 +2588,12 @@
                     &session /*out*/, &previewStream /*out*/,
                     &halStreamConfig /*out*/);
 
-            sp<GraphicBuffer> gb = new GraphicBuffer(previewStream.width,
-                    previewStream.height,
-                    static_cast<int32_t> (halStreamConfig.streams[0].overrideFormat),
-                    1, halStreamConfig.streams[0].producerUsage,
-                    halStreamConfig.streams[0].consumerUsage);
+            sp<GraphicBuffer> gb = new GraphicBuffer(
+                previewStream.width, previewStream.height,
+                static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat),
+                1, android_convertGralloc1To0Usage(
+                       halStreamConfig.streams[0].producerUsage,
+                       halStreamConfig.streams[0].consumerUsage));
 
             StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                     bufferId, hidl_handle(gb->getNativeBuffer()->handle),
@@ -2706,11 +2709,12 @@
                     settings = req; });
             ASSERT_TRUE(ret.isOk());
 
-            sp<GraphicBuffer> gb = new GraphicBuffer(previewStream.width,
-                    previewStream.height,
-                    static_cast<int32_t> (halStreamConfig.streams[0].overrideFormat),
-                    1, halStreamConfig.streams[0].producerUsage,
-                    halStreamConfig.streams[0].consumerUsage);
+            sp<GraphicBuffer> gb = new GraphicBuffer(
+                previewStream.width, previewStream.height,
+                static_cast<int32_t>(halStreamConfig.streams[0].overrideFormat),
+                1, android_convertGralloc1To0Usage(
+                       halStreamConfig.streams[0].producerUsage,
+                       halStreamConfig.streams[0].consumerUsage));
             ASSERT_NE(nullptr, gb.get());
             StreamBuffer outputBuffer = {halStreamConfig.streams[0].id,
                     bufferId, hidl_handle(gb->getNativeBuffer()->handle),
diff --git a/current.txt b/current.txt
index 1d2801e..8a2a56a 100644
--- a/current.txt
+++ b/current.txt
@@ -15,17 +15,17 @@
 fa8fbae3d1da3c264e4f3110728076abc09b4e65f12af6ae136367328de988ab android.hardware.audio.effect@2.0::IAcousticEchoCancelerEffect
 ca4752545d54547ff069eae161af7550cb5f5a7e8b60316ddd132a30906a68e7 android.hardware.audio.effect@2.0::IAutomaticGainControlEffect
 d2b8af988dc66f514d886bcee44b440d8034bc2a762f7161717ef3c956073067 android.hardware.audio.effect@2.0::IBassBoostEffect
-7649e7c3646e49141ef3b7edd89f87dd68b43a1dc3d3a918c5e1a859b87a738b android.hardware.audio.effect@2.0::IDownmixEffect
+611bc09c75e796f3512b1ca6be508b0a9ba996759b8a2c60507784ff58076229 android.hardware.audio.effect@2.0::IDownmixEffect
 36a57369dfdc75180e8b64ae80b1970db8f6d9085dbff6ca931715038cc056e1 android.hardware.audio.effect@2.0::IEffect
 d2aa2df6d189c580f5be8460fa0ff4134d9c05a383f3204659baee426a6f0edf android.hardware.audio.effect@2.0::IEffectBufferProviderCallback
 217f9161983a48d3bf3faeb158f868aa8bf0ce25889e4ee3d2bab1a2e8d33e77 android.hardware.audio.effect@2.0::IEffectsFactory
-21ca8a2316e36fb55028c5b9e1bf2436beb48e386258eaaa62f8141d2838361f android.hardware.audio.effect@2.0::IEnvironmentalReverbEffect
+c2b38bc07991e880c83ca8cb88181411eeef708b8b936aedd2f2e0acade7df69 android.hardware.audio.effect@2.0::IEnvironmentalReverbEffect
 2ff9f9704be5f167745b4de790e9dafc3cc4719e2f6e2e5497085e679853cfe7 android.hardware.audio.effect@2.0::IEqualizerEffect
 c31447fb02dbc8b56c359941dad22f416511860173c5c5fd278d1bf2312b13de android.hardware.audio.effect@2.0::ILoudnessEnhancerEffect
 804831ca258802eb3eb65a0a7b5d5e3d37d4a15ba8c2836b4276eda98b47e1d0 android.hardware.audio.effect@2.0::INoiseSuppressionEffect
-ff74e984b37275bb1deaee13d7c0b3c6b4d976009f09b53a4973772140f12cb0 android.hardware.audio.effect@2.0::IPresetReverbEffect
+778fd5b9837f481d8e47425b3e2a3bd0c6362a0b6870291518e2d863530fdb61 android.hardware.audio.effect@2.0::IPresetReverbEffect
 c93cb25a1a92d07aa80a617c01e8d22fc97bf8cefd3962b6a5be386ad4704d89 android.hardware.audio.effect@2.0::IVirtualizerEffect
-4aac97e196cb27e61adfe2e57107bde5a1af213325bf858992b906e6669166a4 android.hardware.audio.effect@2.0::IVisualizerEffect
+918f331780c9c7b04f2151a2e563aab088198ede8e6f865302ebaa13905bd9ce android.hardware.audio.effect@2.0::IVisualizerEffect
 4caad099f8fc00262b6c03ba41271808b37cea90ac98b534299bbf4ee823af02 android.hardware.audio.effect@2.0::types
 f2904a4c108ad1b93eb2fa4e43b82bd01ce1ff26156316e49d1d9fc80dfecaad android.hardware.automotive.evs@1.0::IEvsCamera
 94cba6ad04c83aa840de2ed52b74ba2126a26dd960225e61ac36703315279a80 android.hardware.automotive.evs@1.0::IEvsCameraStream
@@ -76,7 +76,7 @@
 da13bd69282fb275767abb18704c57ff8038e6c139ad17157dc702810f70d06a android.hardware.gatekeeper@1.0::types
 37c7da4f823ec958dfa9c960e2d341c48f877e0bfa758f3fa9e2d9c1e1bd66d9 android.hardware.gnss@1.0::IAGnss
 7ec9afdb964bfb8369866913caf018f2636592885bcb558a65de2c5436ab4f60 android.hardware.gnss@1.0::IAGnssCallback
-f3219d8f33d5186a01f617bb7812b64620f9f28b65758ede939423ab0ba798fa android.hardware.gnss@1.0::IAGnssRil
+d16e6a359be6963ea753d7138e84ecf2b93052097938938c4d36d7a47ea2e2ae android.hardware.gnss@1.0::IAGnssRil
 2f907708d74d94b1e121ed27651c9c72af65952d347b58ff07dac5d5d7a7f678 android.hardware.gnss@1.0::IAGnssRilCallback
 5ac7edad06d76064b882be161f3f9d9692a997ec72e9f36addb7fe8918f49992 android.hardware.gnss@1.0::IGnss
 b05c983c87c3376e145223688c3b541b5e11b827f211e38d5a31af1ca3a2e222 android.hardware.gnss@1.0::IGnssBatching
@@ -89,9 +89,9 @@
 9ea8987bb1089c8c5d7b67866575b866ef516045021d9efcc37c6352bce072a3 android.hardware.gnss@1.0::IGnssMeasurement
 d6a00007b30f0e3ed196df677f311b3e25b15082c5e82756f392677d3b66ec0a android.hardware.gnss@1.0::IGnssMeasurementCallback
 af85aa0f48ae99a39f4688c344e4419304f681f9af818a5c8d759286fc4418de android.hardware.gnss@1.0::IGnssNavigationMessage
-8afadd3b15858bba57cfc2a1093e3704cf687245d8267f59604a48ac9d889973 android.hardware.gnss@1.0::IGnssNavigationMessageCallback
+649b1b0fb98bdd3a1ace84f4e08bfa2df813afdd4862856693f107c281a929ba android.hardware.gnss@1.0::IGnssNavigationMessageCallback
 248bcf51da4273d64f367bf6877baef2feeaca365459842fd3c214a2dc6e0224 android.hardware.gnss@1.0::IGnssNi
-e4f2c1b80172a73e2e743fba3ddc24ef58bc42d40bdb8f7352c9e19440b220eb android.hardware.gnss@1.0::IGnssNiCallback
+c781b7b125f68be5db8a8c3d412d526acdbdf77dcc592a4c0ed70b8ce4fe6c49 android.hardware.gnss@1.0::IGnssNiCallback
 c1142657de16fdb292a502372fe938614d65270ab8359217d6e13604fe4dbca4 android.hardware.gnss@1.0::IGnssXtra
 bd366b83d8d565d0e8bfabff3adfcab0259d75b4e2a9f8e1b91e11d1593a2ffb android.hardware.gnss@1.0::IGnssXtraCallback
 881bc2f94026784d194cffbff166c6e8bf911de4e02abe96fc7d89ec75b0574a android.hardware.gnss@1.0::types
@@ -103,7 +103,7 @@
 b19d00eb8a8b3b0034a0321f22e8f32162bf4c2aebbce6da22c025f56e459ea2 android.hardware.graphics.composer@2.1::IComposerCallback
 e992684e690dfe67a8cbeab5005bfa3fa9c2bf3d4b0b75657fb1f0c2d5dd2bae android.hardware.graphics.composer@2.1::IComposerClient
 1c98c2f5154345312ec054871792a2982ec5f3e2bc2abfb61a10c0b517978e20 android.hardware.graphics.composer@2.1::types
-04fbe91f2a860d463fa6287fbcfa05a8cc4f17848cabcd2aa9eef0f2aa1fedc0 android.hardware.graphics.mapper@2.0::IMapper
+a695898589e1ef15b2b2510f11edd6aafac9918d9cf8d74b4b6143b309dee542 android.hardware.graphics.mapper@2.0::IMapper
 28507d385a3dd224bf3c32f1bfd9f96092c4701b9c1cc66caa578fc3efc97877 android.hardware.graphics.mapper@2.0::types
 91e2ba3805c923f01fc1231ec9ff838942aee3346f2d7614ecc0caeadbe57ed4 android.hardware.health@1.0::IHealth
 1275aa2e8732909101b26aec49ed2285489e89d97b8610a8908b7868e35a3cc5 android.hardware.health@1.0::types
@@ -114,7 +114,7 @@
 d4ed2f0e14f9e914d0b1275d2e0363192fe30aca9059c84edb5fad15995f9ec4 android.hardware.light@2.0::ILight
 d9584bfcaedd6e62cf337881748246b23e36cbc2bc3aa84c01b6a1e622061400 android.hardware.light@2.0::types
 16c0cf0f73de1e5208a95020c6c6474903e7094f76b2d782651afaca0e5fd86f android.hardware.media@1.0::types
-f65c927479a4cde505326773681217cde4ebe9191b66d8b7a422e463bee24161 android.hardware.media.omx@1.0::IGraphicBufferSource
+8bc2f5fdcad68856eb61a62fe4cc043fa064bb7f1dab95a71d1918ec1eef7b55 android.hardware.media.omx@1.0::IGraphicBufferSource
 0d3de9cd89d4718ea3b772f2d8b93be004feb3abb7e7dc5402e37047cc730d05 android.hardware.media.omx@1.0::IOmx
 32002e1c358c64de106c977a6dc6af7da27be4803a5bb66fd6f891a5ba0a1617 android.hardware.media.omx@1.0::IOmxBufferSource
 81ad8d8bb1cf6f41923cf11dd39354a8fe433db284a234cc675de7e75a82224c android.hardware.media.omx@1.0::IOmxNode
@@ -177,12 +177,12 @@
 56b5c7267cb3d3337f44eb8b0b38ff4c6260dcc70e07687fcab94b1ccea8d159 android.hardware.wifi.supplicant@1.0::ISupplicantCallback
 35ba7bcdf18f24a866a7e5429548f06768bb20a257f75b10a397c4d825ef8438 android.hardware.wifi.supplicant@1.0::ISupplicantIface
 cda01008c06922fa37c1213e9bb831a109b3174532805616fb7161edc403866f android.hardware.wifi.supplicant@1.0::ISupplicantNetwork
-f41e9e2a8f9eb9196b829cc9442c279a0135ddb0937e7b0c01d2d25b3d593c3d android.hardware.wifi.supplicant@1.0::ISupplicantP2pIface
+4907410338c5e8dbeec4b5edc2608ea323f5561945f8810af81810c47b019184 android.hardware.wifi.supplicant@1.0::ISupplicantP2pIface
 8b63f5efa2e3be3a7cb8a428760d82285a4ab79bcbdea6ef90aa547555e582d4 android.hardware.wifi.supplicant@1.0::ISupplicantP2pIfaceCallback
 56128f74560571b6777d59453f35c6b35693ee377e2a23c807708906928f09de android.hardware.wifi.supplicant@1.0::ISupplicantP2pNetwork
 2067c22197bca9743dab66a6f561a8a8375c67b4f76aed05f776839499bd4c8f android.hardware.wifi.supplicant@1.0::ISupplicantP2pNetworkCallback
 7752e1de93aaf5fed37011c219ac247069f6af320b0810daa98510584a10e7b4 android.hardware.wifi.supplicant@1.0::ISupplicantStaIface
 d781c8d7e7b3fe5cca8cf6e1d8806e770982ae5358c7816ed51b0f0ec272e70d android.hardware.wifi.supplicant@1.0::ISupplicantStaIfaceCallback
-5da0aa908aae85e8d81a5e393390030024a30b499f8a48b3dac67358b4752ca6 android.hardware.wifi.supplicant@1.0::ISupplicantStaNetwork
+b12ef0bdd8a4d247a8a6e960b227ed32383f2b0241f55d67fcea6eff6a6737fa android.hardware.wifi.supplicant@1.0::ISupplicantStaNetwork
 d8f0877ae1d321c1d884c7631dfe36cab0ec8a4b2863d4b687f85d3549a63bcc android.hardware.wifi.supplicant@1.0::ISupplicantStaNetworkCallback
 fe3c3c2f572b72f15f8594c538b0577bd5c28722c31879cfe6231330cddb6747 android.hardware.wifi.supplicant@1.0::types
diff --git a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
index 71b893a..04f2658 100644
--- a/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_clearkey_test.cpp
@@ -129,6 +129,7 @@
  */
 TEST_F(DrmHalClearkeyFactoryTest, EmptyPluginUUIDNotSupported) {
     hidl_array<uint8_t, 16> emptyUUID;
+    memset(emptyUUID.data(), 0, 16);
     EXPECT_FALSE(drmFactory->isCryptoSchemeSupported(emptyUUID));
     EXPECT_FALSE(cryptoFactory->isCryptoSchemeSupported(emptyUUID));
 }
diff --git a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
index ec73a7d..33fb6fb 100644
--- a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
@@ -190,6 +190,7 @@
  */
 TEST_P(DrmHalVendorFactoryTest, EmptyPluginUUIDNotSupported) {
     hidl_array<uint8_t, 16> emptyUUID;
+    memset(emptyUUID.data(), 0, 16);
     EXPECT_FALSE(drmFactory->isCryptoSchemeSupported(emptyUUID));
     EXPECT_FALSE(cryptoFactory->isCryptoSchemeSupported(emptyUUID));
 }
diff --git a/gnss/1.0/IAGnssRil.hal b/gnss/1.0/IAGnssRil.hal
index 6f91f7f..12289f6 100644
--- a/gnss/1.0/IAGnssRil.hal
+++ b/gnss/1.0/IAGnssRil.hal
@@ -131,14 +131,13 @@
         generates (bool success);
 
     /**
-     * Notify GNSS of network status changes.
+     * Notify GNSS of network status changes and current APN.
      *
      * @param available Indicates whether network connectivity is available.
-     * @param apn String containing the Access Point Name.
+     * @param apn String containing the telephony preferred Access Point Name.
      *
      * @return success True if all parameters were valid and the operation was
      * successful.
-     * TODO(b/32022567): Add VTS test to validate the format of APN.
      */
     updateNetworkAvailability(bool available, string apn) generates (bool success);
 
diff --git a/gnss/1.0/IGnssNavigationMessageCallback.hal b/gnss/1.0/IGnssNavigationMessageCallback.hal
index 714351b..e18f7e2 100644
--- a/gnss/1.0/IGnssNavigationMessageCallback.hal
+++ b/gnss/1.0/IGnssNavigationMessageCallback.hal
@@ -51,11 +51,11 @@
     /**
      * Status of Navigation Message
      * When a message is received properly without any parity error in its
-     * navigation words, the status must be set to PARITY_PASSED. But if a message is
-     * received with words that failed parity check, but GNSS is able to correct
-     * those words, the status must be set to PARITY_REBUILT.
-     * No need to send any navigation message that contains words with parity error
-     * and cannot be corrected.
+     * navigation words, the status must be set to PARITY_PASSED.
+     * If a message is received with words that failed a parity check, but the GNSS
+     * receiver has corrected those words, the status must be set to PARITY_REBUILT.
+     * Do not send any navigation message that contains words with parity errors
+     * that cannot be corrected.
      */
     @export(name="navigation_message_status", value_prefix="NAV_MESSAGE_STATUS_")
     enum NavigationMessageStatus : uint16_t {
@@ -80,7 +80,7 @@
         /**
          * The status of the received navigation message.
          * No need to send any navigation message that contains words with parity
-         * error and cannot be corrected.
+         * errors that cannot be corrected.
          */
         bitfield<NavigationMessageStatus> status;
 
@@ -125,8 +125,7 @@
 
         /**
          * The data of the reported GNSS message. The bytes (or words) are specified
-         * using big endian format (MSB first). The data is stored and decoded
-         * in a server for research purposes.
+         * using big endian format (MSB first).
          *
          * - For GNSS L1 C/A, Beidou D1 & Beidou D2, each subframe contains 10 30-bit
          *   words. Each word (30 bits) must fit into the last 30 bits in a
@@ -150,10 +149,9 @@
          *   into 29 bytes, with MSB first (skip B229-B232). The standard followed
          *   is same as above.
          *
-         * TODO(b/32022567): Describe this relationship with data to the VTS
-         * via custom annotations and plug in a VTS test to verify that the data
-         * correctly follows the standard.
-         *
+         * The data reported here must be the raw data as demodulated by the GNSS
+         * receiver, not data received from an external source (i.e. not from a server
+         * download.)
          */
         vec<uint8_t> data;
     };
diff --git a/gnss/1.0/IGnssNiCallback.hal b/gnss/1.0/IGnssNiCallback.hal
index 163ba25..3e3071a 100644
--- a/gnss/1.0/IGnssNiCallback.hal
+++ b/gnss/1.0/IGnssNiCallback.hal
@@ -25,7 +25,8 @@
     enum GnssNiType : uint8_t {
         VOICE           = 1,
         UMTS_SUPL       = 2,
-        UMTS_CTRL_PLANE = 3
+        UMTS_CTRL_PLANE = 3,
+        EMERGENCY_SUPL  = 4
     };
 
     /**
diff --git a/graphics/composer/2.1/default/Android.bp b/graphics/composer/2.1/default/Android.bp
index fb75beb..037f810 100644
--- a/graphics/composer/2.1/default/Android.bp
+++ b/graphics/composer/2.1/default/Android.bp
@@ -5,8 +5,8 @@
     export_include_dirs: ["."],
     srcs: ["ComposerClient.cpp"],
     shared_libs: [
-        "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.mapper@2.0",
         "libbase",
         "libcutils",
         "libfmq",
@@ -27,8 +27,8 @@
     srcs: ["Hwc.cpp"],
     static_libs: ["libhwcomposer-client"],
     shared_libs: [
-        "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.mapper@2.0",
         "libbase",
         "libcutils",
         "libfmq",
@@ -51,7 +51,6 @@
     init_rc: ["android.hardware.graphics.composer@2.1-service.rc"],
     static_libs: ["libhwcomposer-client"],
     shared_libs: [
-        "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.composer@2.1",
         "libbase",
         "libbinder",
diff --git a/graphics/composer/2.1/default/ComposerClient.cpp b/graphics/composer/2.1/default/ComposerClient.cpp
index d599b44..87e4d3b 100644
--- a/graphics/composer/2.1/default/ComposerClient.cpp
+++ b/graphics/composer/2.1/default/ComposerClient.cpp
@@ -16,8 +16,7 @@
 
 #define LOG_TAG "HwcPassthrough"
 
-#include <hardware/gralloc.h>
-#include <hardware/gralloc1.h>
+#include <android/hardware/graphics/mapper/2.0/IMapper.h>
 #include <log/log.h>
 
 #include "ComposerClient.h"
@@ -33,10 +32,11 @@
 
 namespace {
 
+using MapperError = android::hardware::graphics::mapper::V2_0::Error;
+using android::hardware::graphics::mapper::V2_0::IMapper;
+
 class HandleImporter {
 public:
-    HandleImporter() : mInitialized(false) {}
-
     bool initialize()
     {
         // allow only one client
@@ -44,9 +44,7 @@
             return false;
         }
 
-        if (!openGralloc()) {
-            return false;
-        }
+        mMapper = IMapper::getService();
 
         mInitialized = true;
         return true;
@@ -54,11 +52,7 @@
 
     void cleanup()
     {
-        if (!mInitialized) {
-            return;
-        }
-
-        closeGralloc();
+        mMapper.clear();
         mInitialized = false;
     }
 
@@ -76,12 +70,20 @@
             return true;
         }
 
-        buffer_handle_t clone = cloneBuffer(handle);
-        if (!clone) {
+        MapperError error;
+        buffer_handle_t importedHandle;
+        mMapper->importBuffer(
+            hidl_handle(handle),
+            [&](const auto& tmpError, const auto& tmpBufferHandle) {
+                error = tmpError;
+                importedHandle = static_cast<buffer_handle_t>(tmpBufferHandle);
+            });
+        if (error != MapperError::NONE) {
             return false;
         }
 
-        handle = clone;
+        handle = importedHandle;
+
         return true;
     }
 
@@ -91,102 +93,12 @@
             return;
         }
 
-        releaseBuffer(handle);
+        mMapper->freeBuffer(const_cast<native_handle_t*>(handle));
     }
 
 private:
-    bool mInitialized;
-
-    // Some existing gralloc drivers do not support retaining more than once,
-    // when we are in passthrough mode.
-    bool openGralloc()
-    {
-        const hw_module_t* module = nullptr;
-        int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
-        if (err) {
-            ALOGE("failed to get gralloc module");
-            return false;
-        }
-
-        uint8_t major = (module->module_api_version >> 8) & 0xff;
-        if (major > 1) {
-            ALOGE("unknown gralloc module major version %d", major);
-            return false;
-        }
-
-        if (major == 1) {
-            err = gralloc1_open(module, &mDevice);
-            if (err) {
-                ALOGE("failed to open gralloc1 device");
-                return false;
-            }
-
-            mRetain = reinterpret_cast<GRALLOC1_PFN_RETAIN>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RETAIN));
-            mRelease = reinterpret_cast<GRALLOC1_PFN_RELEASE>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RELEASE));
-            if (!mRetain || !mRelease) {
-                ALOGE("invalid gralloc1 device");
-                gralloc1_close(mDevice);
-                return false;
-            }
-        } else {
-            mModule = reinterpret_cast<const gralloc_module_t*>(module);
-        }
-
-        return true;
-    }
-
-    void closeGralloc()
-    {
-        if (mDevice) {
-            gralloc1_close(mDevice);
-        }
-    }
-
-    buffer_handle_t cloneBuffer(buffer_handle_t handle)
-    {
-        native_handle_t* clone = native_handle_clone(handle);
-        if (!clone) {
-            ALOGE("failed to clone buffer %p", handle);
-            return nullptr;
-        }
-
-        bool err;
-        if (mDevice) {
-            err = (mRetain(mDevice, clone) != GRALLOC1_ERROR_NONE);
-        } else {
-            err = (mModule->registerBuffer(mModule, clone) != 0);
-        }
-
-        if (err) {
-            ALOGE("failed to retain/register buffer %p", clone);
-            native_handle_close(clone);
-            native_handle_delete(clone);
-            return nullptr;
-        }
-
-        return clone;
-    }
-
-    void releaseBuffer(buffer_handle_t handle)
-    {
-        if (mDevice) {
-            mRelease(mDevice, handle);
-        } else {
-            mModule->unregisterBuffer(mModule, handle);
-        }
-        native_handle_close(handle);
-        native_handle_delete(const_cast<native_handle_t*>(handle));
-    }
-
-    // gralloc1
-    gralloc1_device_t* mDevice;
-    GRALLOC1_PFN_RETAIN mRetain;
-    GRALLOC1_PFN_RELEASE mRelease;
-
-    // gralloc0
-    const gralloc_module_t* mModule;
+ bool mInitialized = false;
+ sp<IMapper> mMapper;
 };
 
 HandleImporter sHandleImporter;
diff --git a/graphics/mapper/2.0/IMapper.hal b/graphics/mapper/2.0/IMapper.hal
index 246be24..4ee206b 100644
--- a/graphics/mapper/2.0/IMapper.hal
+++ b/graphics/mapper/2.0/IMapper.hal
@@ -85,10 +85,11 @@
      * Imports a raw buffer handle to create an imported buffer handle for use
      * with the rest of the mapper or with other in-process libraries.
      *
-     * A buffer handle is considered raw when it is cloned or when it is
-     * received from another HAL or another process. A raw buffer handle must
-     * not be used to access the underlying graphics buffer. It must be
-     * imported to create an imported handle first.
+     * A buffer handle is considered raw when it is cloned (e.g., with
+     * native_handle_clone) from another buffer handle locally, or when it is
+     * received from another HAL server/client or another process. A raw
+     * buffer handle must not be used to access the underlying graphics
+     * buffer. It must be imported to create an imported handle first.
      *
      * This function must at least validate the raw handle before creating the
      * imported handle. It must also support importing the same raw handle
@@ -96,6 +97,12 @@
      * must be considered valid everywhere in the process, including in
      * another instance of the mapper.
      *
+     * Because of passthrough HALs, a raw buffer handle received from a HAL
+     * may actually have been imported in the process. importBuffer must treat
+     * such a handle as if it is raw and must not return BAD_BUFFER. The
+     * returned handle is independent from the input handle as usual, and
+     * freeBuffer must be called on it when it is no longer needed.
+     *
      * @param rawHandle is the raw buffer handle to import.
      * @return error is NONE upon success. Otherwise,
      *                  BAD_BUFFER when the raw handle is invalid.
diff --git a/graphics/mapper/2.0/default/GrallocMapper.cpp b/graphics/mapper/2.0/default/GrallocMapper.cpp
index 6441af6..d16143d 100644
--- a/graphics/mapper/2.0/default/GrallocMapper.cpp
+++ b/graphics/mapper/2.0/default/GrallocMapper.cpp
@@ -125,11 +125,8 @@
 
 Return<void> GrallocMapper::importBuffer(const hidl_handle& rawHandle,
                                          importBuffer_cb hidl_cb) {
-    // importing an already imported handle rather than a raw handle
-    if (gRegisteredHandles->get(rawHandle.getNativeHandle())) {
-        hidl_cb(Error::BAD_BUFFER, nullptr);
-        return Void();
-    }
+    // because of passthrough HALs, we must not generate an error when
+    // rawHandle has been imported
 
     if (!rawHandle.getNativeHandle()) {
         hidl_cb(Error::BAD_BUFFER, nullptr);
diff --git a/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp b/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
index f066a1e..c74013b 100644
--- a/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
+++ b/graphics/mapper/2.0/vts/functional/VtsHalGraphicsMapperV2_0TargetTest.cpp
@@ -216,18 +216,6 @@
             << "importBuffer with invalid handle did not fail with BAD_BUFFER";
     });
     native_handle_delete(invalidHandle);
-
-    const native_handle_t* importedHandle;
-    ASSERT_NO_FATAL_FAILURE(importedHandle =
-                                mGralloc->allocate(mDummyDescriptorInfo, true));
-    mGralloc->getMapper()->importBuffer(
-        importedHandle, [&](const auto& tmpError, const auto&) {
-            EXPECT_EQ(Error::BAD_BUFFER, tmpError)
-                << "importBuffer with an "
-                   "already imported handle did "
-                   "not fail with BAD_BUFFER";
-        });
-    mGralloc->freeBuffer(importedHandle);
 }
 
 /**
diff --git a/keymaster/3.0/default/KeymasterDevice.cpp b/keymaster/3.0/default/KeymasterDevice.cpp
index 58102bb..9c7c860 100644
--- a/keymaster/3.0/default/KeymasterDevice.cpp
+++ b/keymaster/3.0/default/KeymasterDevice.cpp
@@ -528,6 +528,8 @@
         case Tag::ATTESTATION_ID_SERIAL:
         case Tag::ATTESTATION_ID_IMEI:
         case Tag::ATTESTATION_ID_MEID:
+        case Tag::ATTESTATION_ID_MANUFACTURER:
+        case Tag::ATTESTATION_ID_MODEL:
             // Device id attestation may only be supported if the device is able to permanently
             // destroy its knowledge of the ids. This device is unable to do this, so it must
             // never perform any device id attestation.
diff --git a/media/omx/1.0/IGraphicBufferSource.hal b/media/omx/1.0/IGraphicBufferSource.hal
index 62073ad..494d0cb 100644
--- a/media/omx/1.0/IGraphicBufferSource.hal
+++ b/media/omx/1.0/IGraphicBufferSource.hal
@@ -37,12 +37,14 @@
 
     setMaxFps(float maxFps) generates (Status status);
 
-    setTimeLapseConfig(int64_t timePerFrameUs, int64_t timePerCaptureUs) generates (Status status);
+    setTimeLapseConfig(double fps, double captureFps) generates (Status status);
 
     setStartTimeUs(int64_t startTimeUs) generates (Status status);
 
     setStopTimeUs(int64_t stopTimeUs) generates (Status status);
 
+    getStopTimeOffsetUs() generates (Status status, int64_t stopTimeOffsetUs);
+
     setColorAspects(ColorAspects aspects) generates (Status status);
 
     setTimeOffsetUs(int64_t timeOffsetUs) generates (Status status);
diff --git a/wifi/1.0/default/android.hardware.wifi@1.0-service.rc b/wifi/1.0/default/android.hardware.wifi@1.0-service.rc
index 696b1f9..3672423 100644
--- a/wifi/1.0/default/android.hardware.wifi@1.0-service.rc
+++ b/wifi/1.0/default/android.hardware.wifi@1.0-service.rc
@@ -2,3 +2,4 @@
     class hal
     user wifi
     group wifi gps
+    capabilities NET_ADMIN NET_RAW
diff --git a/wifi/1.0/default/wifi_legacy_hal.cpp b/wifi/1.0/default/wifi_legacy_hal.cpp
index ba57ba7..6641be5 100644
--- a/wifi/1.0/default/wifi_legacy_hal.cpp
+++ b/wifi/1.0/default/wifi_legacy_hal.cpp
@@ -581,6 +581,11 @@
   return {status, std::move(freqs)};
 }
 
+wifi_error WifiLegacyHal::setDfsFlag(bool dfs_on) {
+  return global_func_table_.wifi_set_nodfs_flag(
+      wlan_interface_handle_, dfs_on ? 0 : 1);
+}
+
 wifi_error WifiLegacyHal::enableLinkLayerStats(bool debug) {
   wifi_link_layer_params params;
   params.mpdu_size_threshold = kLinkLayerStatsDataMpduSizeThreshold;
diff --git a/wifi/1.0/default/wifi_legacy_hal.h b/wifi/1.0/default/wifi_legacy_hal.h
index 576dfe6..1656f68 100644
--- a/wifi/1.0/default/wifi_legacy_hal.h
+++ b/wifi/1.0/default/wifi_legacy_hal.h
@@ -181,6 +181,7 @@
   wifi_error stopGscan(wifi_request_id id);
   std::pair<wifi_error, std::vector<uint32_t>> getValidFrequenciesForBand(
       wifi_band band);
+  wifi_error setDfsFlag(bool dfs_on);
   // Link layer stats functions.
   wifi_error enableLinkLayerStats(bool debug);
   wifi_error disableLinkLayerStats();
diff --git a/wifi/1.0/default/wifi_sta_iface.cpp b/wifi/1.0/default/wifi_sta_iface.cpp
index 626b195..3c52048 100644
--- a/wifi/1.0/default/wifi_sta_iface.cpp
+++ b/wifi/1.0/default/wifi_sta_iface.cpp
@@ -31,7 +31,14 @@
 WifiStaIface::WifiStaIface(
     const std::string& ifname,
     const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal)
-    : ifname_(ifname), legacy_hal_(legacy_hal), is_valid_(true) {}
+    : ifname_(ifname), legacy_hal_(legacy_hal), is_valid_(true) {
+  // Turn on DFS channel usage for STA iface.
+  legacy_hal::wifi_error legacy_status =
+      legacy_hal_.lock()->setDfsFlag(true);
+  if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+    LOG(ERROR) << "Failed to set DFS flag; DFS channels may be unavailable.";
+  }
+}
 
 void WifiStaIface::invalidate() {
   legacy_hal_.reset();
@@ -309,7 +316,8 @@
   std::tie(legacy_status, legacy_logger_feature_set) =
       legacy_hal_.lock()->getLoggerSupportedFeatureSet();
   if (legacy_status != legacy_hal::WIFI_SUCCESS) {
-    return {createWifiStatusFromLegacyError(legacy_status), 0};
+    // some devices don't support querying logger feature set
+    legacy_logger_feature_set = 0;
   }
   uint32_t hidl_caps;
   if (!hidl_struct_util::convertLegacyFeaturesToHidlStaCapabilities(
diff --git a/wifi/supplicant/1.0/ISupplicantP2pIface.hal b/wifi/supplicant/1.0/ISupplicantP2pIface.hal
index fb4323c..9b6ec5b 100644
--- a/wifi/supplicant/1.0/ISupplicantP2pIface.hal
+++ b/wifi/supplicant/1.0/ISupplicantP2pIface.hal
@@ -154,6 +154,7 @@
    *         |SupplicantStatusCode.SUCCESS|,
    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
    *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+   *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
    */
   find(uint32_t timeoutInSec) generates (SupplicantStatus status);
 
@@ -165,6 +166,7 @@
    *         |SupplicantStatusCode.SUCCESS|,
    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
    *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+   *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
    */
   stopFind() generates (SupplicantStatus status);
 
@@ -292,6 +294,7 @@
    *         |SupplicantStatusCode.SUCCESS|,
    *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
    *         |SupplicantStatusCode.FAILURE_IFACE_INVALID|
+   *         |SupplicantStatusCode.FAILURE_IFACE_DISABLED|
    */
   reject(MacAddress peerAddress) generates (SupplicantStatus status);
 
diff --git a/wifi/supplicant/1.0/ISupplicantStaNetwork.hal b/wifi/supplicant/1.0/ISupplicantStaNetwork.hal
index 7d5159a..269d7ef 100644
--- a/wifi/supplicant/1.0/ISupplicantStaNetwork.hal
+++ b/wifi/supplicant/1.0/ISupplicantStaNetwork.hal
@@ -354,6 +354,8 @@
   /**
    * Set EAP Phase2 Method for this network.
    *
+   * EAP method needs to be set for this to work.
+   *
    * @param method value to set.
    *        Must be one of |EapPhase2Method| values.
    * @return status Status of the operation.