diff --git a/audio/aidl/android/hardware/audio/core/IModule.aidl b/audio/aidl/android/hardware/audio/core/IModule.aidl
index 7622d9a..e736c32 100644
--- a/audio/aidl/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/android/hardware/audio/core/IModule.aidl
@@ -234,6 +234,12 @@
      * instance previously instantiated using the 'connectExternalDevice'
      * method.
      *
+     * The framework will call this method before closing streams and resetting
+     * patches. This call can be used by the HAL module to prepare itself to
+     * device disconnection. If the HAL module indicates an error after the first
+     * call, the framework will call this method once again after closing associated
+     * streams and patches.
+     *
      * @throws EX_ILLEGAL_ARGUMENT In the following cases:
      *                             - If the port can not be found by the ID.
      *                             - If this is not a connected device port.
diff --git a/biometrics/OWNERS b/biometrics/OWNERS
new file mode 100644
index 0000000..58998c1
--- /dev/null
+++ b/biometrics/OWNERS
@@ -0,0 +1,8 @@
+ilyamaty@google.com
+jeffpu@google.com
+jbolinger@google.com
+joshmccloskey@google.com
+diyab@google.com
+austindelgado@google.com
+spdonghao@google.com
+wenhuiy@google.com
diff --git a/bluetooth/aidl/TEST_MAPPING b/bluetooth/aidl/TEST_MAPPING
index d1de251..18958d2 100644
--- a/bluetooth/aidl/TEST_MAPPING
+++ b/bluetooth/aidl/TEST_MAPPING
@@ -1,24 +1,12 @@
 {
   "presubmit" : [
     {
-      "name" : "VtsHalBluetoothTargetTest",
-      "options": [
-        {
-          // TODO(b/275847929)
-          "exclude-filter": "VtsHalBluetoothTargetTest.PerInstance/BluetoothAidlTest#Cdd_C_12_1_Bluetooth5Requirements/0_android_hardware_bluetooth_IBluetoothHci_default"
-        }
-      ]
+      "name" : "VtsHalBluetoothTargetTest"
     }
   ],
   "hwasan-presubmit" : [
     {
-      "name" : "VtsHalBluetoothTargetTest",
-      "options": [
-        {
-          // TODO(b/275847929)
-          "exclude-filter": "VtsHalBluetoothTargetTest.PerInstance/BluetoothAidlTest#Cdd_C_12_1_Bluetooth5Requirements/0_android_hardware_bluetooth_IBluetoothHci_default"
-        }
-      ]
+      "name" : "VtsHalBluetoothTargetTest"
     }
   ]
 }
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index d4e4b34..18a371d 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -117,11 +117,9 @@
           strerror(errno));
     return fd;
   }
-  if (int ret = SetTerminalRaw(mFd) < 0) {
-    ALOGE("Could not make %s a raw terminal %d(%s)", mDevPath.c_str(), ret,
+  if (int ret = SetTerminalRaw(fd) < 0) {
+    ALOGI("Could not make %s a raw terminal %d(%s)", mDevPath.c_str(), ret,
           strerror(errno));
-    ::close(fd);
-    return -1;
   }
   return fd;
 }
@@ -176,7 +174,10 @@
   mFdWatcher.WatchFdForNonBlockingReads(mFd,
                                         [this](int) { mH4->OnDataReady(); });
 
-  send(PacketType::COMMAND, reset);
+  ndk::ScopedAStatus result = send(PacketType::COMMAND, reset);
+  if (!result.isOk()) {
+    ALOGE("Error sending reset command");
+  }
   auto status = resetFuture.wait_for(std::chrono::seconds(1));
   mFdWatcher.StopWatchingFileDescriptors();
   if (status == std::future_status::ready) {
@@ -303,30 +304,35 @@
 
 ndk::ScopedAStatus BluetoothHci::sendHciCommand(
     const std::vector<uint8_t>& packet) {
-  send(PacketType::COMMAND, packet);
-  return ndk::ScopedAStatus::ok();
+  return send(PacketType::COMMAND, packet);
 }
 
 ndk::ScopedAStatus BluetoothHci::sendAclData(
     const std::vector<uint8_t>& packet) {
-  send(PacketType::ACL_DATA, packet);
-  return ndk::ScopedAStatus::ok();
+  return send(PacketType::ACL_DATA, packet);
 }
 
 ndk::ScopedAStatus BluetoothHci::sendScoData(
     const std::vector<uint8_t>& packet) {
-  send(PacketType::SCO_DATA, packet);
-  return ndk::ScopedAStatus::ok();
+  return send(PacketType::SCO_DATA, packet);
 }
 
 ndk::ScopedAStatus BluetoothHci::sendIsoData(
     const std::vector<uint8_t>& packet) {
-  send(PacketType::ISO_DATA, packet);
-  return ndk::ScopedAStatus::ok();
+  return send(PacketType::ISO_DATA, packet);
 }
 
-void BluetoothHci::send(PacketType type, const std::vector<uint8_t>& v) {
+ndk::ScopedAStatus BluetoothHci::send(PacketType type,
+    const std::vector<uint8_t>& v) {
+  if (mH4 == nullptr) {
+    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+  }
+  if (v.empty()) {
+    ALOGE("Packet is empty, no data was found to be sent");
+    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+  }
   mH4->Send(type, v);
+  return ndk::ScopedAStatus::ok();
 }
 
 }  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/BluetoothHci.h b/bluetooth/aidl/default/BluetoothHci.h
index 85aafc8..477cc5c 100644
--- a/bluetooth/aidl/default/BluetoothHci.h
+++ b/bluetooth/aidl/default/BluetoothHci.h
@@ -66,8 +66,9 @@
   ::android::hardware::bluetooth::async::AsyncFdWatcher mFdWatcher;
 
   int getFdFromDevPath();
-  void send(::android::hardware::bluetooth::hci::PacketType type,
-            const std::vector<uint8_t>& packet);
+  [[nodiscard]] ndk::ScopedAStatus send(
+      ::android::hardware::bluetooth::hci::PacketType type,
+      const std::vector<uint8_t>& packet);
   std::unique_ptr<NetBluetoothMgmt> management_{};
 
   // Send a reset command and discard all packets until a reset is received.
diff --git a/bluetooth/aidl/default/service.cpp b/bluetooth/aidl/default/service.cpp
index 9af2a08..ef4b884 100644
--- a/bluetooth/aidl/default/service.cpp
+++ b/bluetooth/aidl/default/service.cpp
@@ -30,7 +30,7 @@
 
 int main(int /* argc */, char** /* argv */) {
   ALOGI("Bluetooth HAL starting");
-  if (!ABinderProcess_setThreadPoolMaxThreadCount(1)) {
+  if (!ABinderProcess_setThreadPoolMaxThreadCount(0)) {
     ALOGI("failed to set thread pool max thread count");
     return 1;
   }
diff --git a/bluetooth/hci/h4_protocol.cc b/bluetooth/hci/h4_protocol.cc
index 51a624f..5f6d86e 100644
--- a/bluetooth/hci/h4_protocol.cc
+++ b/bluetooth/hci/h4_protocol.cc
@@ -105,15 +105,12 @@
       buffer_offset += 1;
     } else {
       bool packet_ready = hci_packetizer_.OnDataReady(
-          hci_packet_type_, input_buffer, buffer_offset);
+          hci_packet_type_, input_buffer, &buffer_offset);
       if (packet_ready) {
-        // Call packet callback and move offset.
-        buffer_offset += OnPacketReady(hci_packetizer_.GetPacket());
+        // Call packet callback.
+        OnPacketReady(hci_packetizer_.GetPacket());
         // Get ready for the next type byte.
         hci_packet_type_ = PacketType::UNKNOWN;
-      } else {
-        // The data was consumed, but there wasn't a packet.
-        buffer_offset = input_buffer.size();
       }
     }
   }
diff --git a/bluetooth/hci/hci_packetizer.cc b/bluetooth/hci/hci_packetizer.cc
index 5b6c443..4135920 100644
--- a/bluetooth/hci/hci_packetizer.cc
+++ b/bluetooth/hci/hci_packetizer.cc
@@ -51,9 +51,10 @@
 
 bool HciPacketizer::OnDataReady(PacketType packet_type,
                                 const std::vector<uint8_t>& buffer,
-                                size_t offset) {
+                                size_t* offset) {
   bool packet_completed = false;
-  size_t bytes_available = buffer.size() - offset;
+  size_t bytes_available = buffer.size() - *offset;
+
   switch (state_) {
     case HCI_HEADER: {
       size_t header_size =
@@ -62,18 +63,20 @@
         bytes_remaining_ = header_size;
         packet_.clear();
       }
+
       size_t bytes_to_copy = std::min(bytes_remaining_, bytes_available);
-      packet_.insert(packet_.end(), buffer.begin() + offset,
-                     buffer.begin() + offset + bytes_to_copy);
+      packet_.insert(packet_.end(), buffer.begin() + *offset,
+                     buffer.begin() + *offset + bytes_to_copy);
       bytes_remaining_ -= bytes_to_copy;
       bytes_available -= bytes_to_copy;
+      *offset += bytes_to_copy;
+
       if (bytes_remaining_ == 0) {
         bytes_remaining_ = HciGetPacketLengthForType(packet_type, packet_);
         if (bytes_remaining_ > 0) {
           state_ = HCI_PAYLOAD;
           if (bytes_available > 0) {
-            packet_completed =
-                OnDataReady(packet_type, buffer, offset + bytes_to_copy);
+            packet_completed = OnDataReady(packet_type, buffer, offset);
           }
         } else {
           packet_completed = true;
@@ -84,9 +87,10 @@
 
     case HCI_PAYLOAD: {
       size_t bytes_to_copy = std::min(bytes_remaining_, bytes_available);
-      packet_.insert(packet_.end(), buffer.begin() + offset,
-                     buffer.begin() + offset + bytes_to_copy);
+      packet_.insert(packet_.end(), buffer.begin() + *offset,
+                     buffer.begin() + *offset + bytes_to_copy);
       bytes_remaining_ -= bytes_to_copy;
+      *offset += bytes_to_copy;
       if (bytes_remaining_ == 0) {
         state_ = HCI_HEADER;
         packet_completed = true;
@@ -94,6 +98,7 @@
       break;
     }
   }
+
   return packet_completed;
 }
 
diff --git a/bluetooth/hci/hci_packetizer.h b/bluetooth/hci/hci_packetizer.h
index ba3e841..0d9319f 100644
--- a/bluetooth/hci/hci_packetizer.h
+++ b/bluetooth/hci/hci_packetizer.h
@@ -28,7 +28,7 @@
  public:
   HciPacketizer() = default;
   bool OnDataReady(PacketType packet_type, const std::vector<uint8_t>& data,
-                   size_t offset);
+                   size_t* offset);
   const std::vector<uint8_t>& GetPacket() const;
 
  protected:
diff --git a/bluetooth/hci/test/h4_protocol_unittest.cc b/bluetooth/hci/test/h4_protocol_unittest.cc
index d3fab61..f0c49b5 100644
--- a/bluetooth/hci/test/h4_protocol_unittest.cc
+++ b/bluetooth/hci/test/h4_protocol_unittest.cc
@@ -31,7 +31,6 @@
 #include <vector>
 
 #include "async_fd_watcher.h"
-#include "log/log.h"
 
 using android::hardware::bluetooth::async::AsyncFdWatcher;
 using namespace android::hardware::bluetooth::hci;
@@ -49,6 +48,7 @@
 static char event_data[100] = "The edges of a surface are lines.";
 static char iso_data[100] =
     "A plane angle is the inclination to one another of two lines in a ...";
+static char short_payload[10] = "12345";
 
 // 5 seconds.  Just don't hang.
 static constexpr size_t kTimeoutMs = 5000;
@@ -225,6 +225,49 @@
     CallDataReady();
   }
 
+  void WriteAndExpectManyAclDataPacketsDifferentOffsetsShort() {
+    std::promise<void> last_packet_promise;
+    size_t kNumPackets = 30;
+    // h4 type[1] + handle[2] + size[2]
+    char preamble[5] = {static_cast<uint8_t>(PacketType::ACL_DATA), 19, 92, 0,
+                        0};
+    int length = strlen(short_payload);
+    preamble[3] = length & 0xFF;
+    preamble[4] = 0;
+
+    EXPECT_CALL(acl_cb_, Call(PacketMatches(preamble + 1, kAclHeaderSize,
+                                            short_payload)))
+        .Times(kNumPackets);
+    ExpectInboundEvent(event_data, &last_packet_promise);
+
+    char all_packets[kNumPackets * 10];
+    size_t total_bytes = 0;
+
+    for (size_t packet = 0; packet < kNumPackets; packet++) {
+      for (size_t i = 0; i < sizeof(preamble); i++) {
+        all_packets[total_bytes++] = preamble[i];
+      }
+      for (size_t i = 0; i < length; i++) {
+        all_packets[total_bytes++] = short_payload[i];
+      }
+    }
+
+    size_t written_bytes = 0;
+    size_t partial_size = 1;
+    while (written_bytes < total_bytes) {
+      size_t to_write = std::min(partial_size, total_bytes - written_bytes);
+      TEMP_FAILURE_RETRY(
+          write(chip_uart_fd_, all_packets + written_bytes, to_write));
+      written_bytes += to_write;
+      CallDataReady();
+      partial_size++;
+      partial_size = partial_size % 5 + 1;
+    }
+    WriteInboundEvent(event_data);
+    CallDataReady();
+    WaitForTimeout(&last_packet_promise);
+  }
+
   testing::MockFunction<void(const std::vector<uint8_t>&)> cmd_cb_;
   testing::MockFunction<void(const std::vector<uint8_t>&)> event_cb_;
   testing::MockFunction<void(const std::vector<uint8_t>&)> acl_cb_;
@@ -276,6 +319,10 @@
   WriteAndExpectManyInboundAclDataPackets(sco_data);
 }
 
+TEST_F(H4ProtocolTest, TestMultipleWritesPacketsShortWrites) {
+  WriteAndExpectManyAclDataPacketsDifferentOffsetsShort();
+}
+
 TEST_F(H4ProtocolTest, TestDisconnect) {
   EXPECT_CALL(disconnect_cb_, Call());
   close(chip_uart_fd_);
@@ -332,10 +379,8 @@
 
   void TearDown() override { fd_watcher_.StopWatchingFileDescriptors(); }
 
-  void CallDataReady() override {
-    // The Async test can't call data ready.
-    FAIL();
-  }
+  // Calling CallDataReady() has no effect in the AsyncTest
+  void CallDataReady() override {}
 
   void SendAndReadUartOutbound(PacketType type, char* data) {
     ALOGD("%s sending", __func__);
@@ -434,6 +479,10 @@
   WriteAndExpectManyInboundAclDataPackets(sco_data);
 }
 
+TEST_F(H4ProtocolAsyncTest, TestMultipleWritesPacketsShortWrites) {
+  WriteAndExpectManyAclDataPacketsDifferentOffsetsShort();
+}
+
 TEST_F(H4ProtocolAsyncTest, TestDisconnect) {
   std::promise<void> promise;
   EXPECT_CALL(disconnect_cb_, Call()).WillOnce(Notify(&promise));
diff --git a/camera/provider/aidl/vts/camera_aidl_test.cpp b/camera/provider/aidl/vts/camera_aidl_test.cpp
index 137c521..ef3ce4f 100644
--- a/camera/provider/aidl/vts/camera_aidl_test.cpp
+++ b/camera/provider/aidl/vts/camera_aidl_test.cpp
@@ -148,7 +148,7 @@
         const native_handle_t* releaseFenceHandle = bufferAndTimestamp.buffer.releaseFence;
         if (releaseFenceHandle != nullptr && releaseFenceHandle->numFds == 1 &&
             releaseFenceHandle->data[0] >= 0) {
-            releaseFence = new android::Fence(releaseFenceHandle->data[0]);
+            releaseFence = new android::Fence(dup(releaseFenceHandle->data[0]));
         }
         if (releaseFence && releaseFence->isValid()) {
             releaseFence->wait(/*ms*/ 300);
diff --git a/camera/provider/aidl/vts/camera_aidl_test.h b/camera/provider/aidl/vts/camera_aidl_test.h
index d4d9bdd..fdf312e 100644
--- a/camera/provider/aidl/vts/camera_aidl_test.h
+++ b/camera/provider/aidl/vts/camera_aidl_test.h
@@ -481,6 +481,20 @@
               hasInputBuffer(hasInput),
               collectedResult(1, 10),
               expectedPhysicalResults(extraPhysicalResult) {}
+
+        ~InFlightRequest() {
+            for (auto& buffer : resultOutputBuffers) {
+                native_handle_t* acquireFenceHandle = const_cast<native_handle_t*>(
+                        buffer.buffer.acquireFence);
+                native_handle_close(acquireFenceHandle);
+                native_handle_delete(acquireFenceHandle);
+
+                native_handle_t* releaseFenceHandle = const_cast<native_handle_t*>(
+                        buffer.buffer.releaseFence);
+                native_handle_close(releaseFenceHandle);
+                native_handle_delete(releaseFenceHandle);
+            }
+        }
     };
 
     static bool matchDeviceName(const std::string& deviceName, const std::string& providerType,
diff --git a/camera/provider/aidl/vts/device_cb.cpp b/camera/provider/aidl/vts/device_cb.cpp
index ca2f904..7e0969a 100644
--- a/camera/provider/aidl/vts/device_cb.cpp
+++ b/camera/provider/aidl/vts/device_cb.cpp
@@ -428,8 +428,8 @@
                                            bufferId,
                                            outputBuffer,
                                            buffer.status,
-                                           ::android::makeFromAidl(buffer.acquireFence),
-                                           ::android::makeFromAidl(buffer.releaseFence)};
+                                           ::android::dupFromAidl(buffer.acquireFence),
+                                           ::android::dupFromAidl(buffer.releaseFence)};
         streamBufferAndTimestamp.timeStamp = systemTime();
         request->resultOutputBuffers.push_back(streamBufferAndTimestamp);
     }
diff --git a/compatibility_matrices/compatibility_matrix.9.xml b/compatibility_matrices/compatibility_matrix.9.xml
index 1906325..9b9506d 100644
--- a/compatibility_matrices/compatibility_matrix.9.xml
+++ b/compatibility_matrices/compatibility_matrix.9.xml
@@ -587,14 +587,6 @@
             <instance>slot1</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.renderscript</name>
-        <version>1.0</version>
-        <interface>
-            <name>IDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.rebootescrow</name>
         <version>1</version>
diff --git a/drm/1.3/vts/OWNERS b/drm/1.3/vts/OWNERS
index 3a0672e..744827c 100644
--- a/drm/1.3/vts/OWNERS
+++ b/drm/1.3/vts/OWNERS
@@ -1,9 +1,11 @@
+# Bug component: 49079
 conglin@google.com
-edwinwong@google.com
 fredgc@google.com
-jtinker@google.com
 juce@google.com
+kelzhan@google.com
 kylealexander@google.com
+mattfedd@google.com
 rfrias@google.com
 robertshih@google.com
 sigquit@google.com
+vickymin@google.com
\ No newline at end of file
diff --git a/health/storage/aidl/vts/functional/OWNERS b/health/storage/aidl/vts/functional/OWNERS
new file mode 100644
index 0000000..a15ed7c
--- /dev/null
+++ b/health/storage/aidl/vts/functional/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 30545
+file:platform/hardware/interfaces:/health/aidl/OWNERS
\ No newline at end of file
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_data.cpp b/radio/1.0/vts/functional/radio_hidl_hal_data.cpp
index 655b869..38cb33b 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_data.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_data.cpp
@@ -87,12 +87,19 @@
                                                  cellIdentities.cellIdentityTdscdma.size());
 
         if (checkMccMnc) {
-            // 32 bit system gets result: "\xff\xff\xff..." from RIL, which is not testable. Only
-            // test for 64 bit here. TODO: remove this limit after b/113181277 being fixed.
-            if (hidl_mcc.size() < 4 && hidl_mnc.size() < 4) {
+            // 32 bit system gets result: "\xff\xff\xff..." from RIL, which is not testable.
+            // Only test for 64 bit here. TODO: remove this limit after b/113181277 being fixed.
+            int mccSize = hidl_mcc.size();
+            EXPECT_TRUE(mccSize == 0 || mccSize == 3);
+            if (mccSize > 0) {
                 int mcc = stoi(hidl_mcc);
-                int mnc = stoi(hidl_mnc);
                 EXPECT_TRUE(mcc >= 0 && mcc <= 999);
+            }
+
+            int mncSize = hidl_mnc.size();
+            EXPECT_TRUE(mncSize == 0 || mncSize == 2 || mncSize == 3);
+            if (mncSize > 0) {
+                int mnc = stoi(hidl_mnc);
                 EXPECT_TRUE(mnc >= 0 && mnc <= 999);
             }
         }
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
index 624d003..ee8b4dc 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
@@ -654,6 +654,8 @@
         ASSERT_TRUE(CheckAnyOfErrors(radioRsp->rspInfo.error,
                                      {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
     }
+    // wait until modem reset finishes
+    sleep(10);
     LOG(DEBUG) << "nvResetConfig finished";
 }
 
diff --git a/radio/1.0/vts/functional/vts_hal_radio_target_test.xml b/radio/1.0/vts/functional/vts_hal_radio_target_test.xml
index 82af2ee..7aaadff 100644
--- a/radio/1.0/vts/functional/vts_hal_radio_target_test.xml
+++ b/radio/1.0/vts/functional/vts_hal_radio_target_test.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioV1_0TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <!-- TODO: b/154638140, b/152655658: bad interactions -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
diff --git a/radio/1.1/vts/functional/AndroidTest.xml b/radio/1.1/vts/functional/AndroidTest.xml
index f1bc7a8..90428f4 100644
--- a/radio/1.1/vts/functional/AndroidTest.xml
+++ b/radio/1.1/vts/functional/AndroidTest.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioV1_1TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <!-- TODO: b/154638140, b/152655658: bad interactions -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
diff --git a/radio/1.2/vts/functional/AndroidTest.xml b/radio/1.2/vts/functional/AndroidTest.xml
index 9904760..e25249b 100644
--- a/radio/1.2/vts/functional/AndroidTest.xml
+++ b/radio/1.2/vts/functional/AndroidTest.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioV1_2TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <!-- TODO: b/154638140, b/152655658: bad interactions -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
diff --git a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
index 2400bde..2bce2f9 100644
--- a/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.2/vts/functional/radio_hidl_hal_api.cpp
@@ -120,7 +120,7 @@
     serial = GetRandomSerialNumber();
 
     ::android::hardware::radio::V1_2::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 4,
             .specifiers = {::GERAN_SPECIFIER_P900, ::GERAN_SPECIFIER_850},
             .maxSearchTime = 60,
@@ -155,7 +155,7 @@
     serial = GetRandomSerialNumber();
 
     ::android::hardware::radio::V1_2::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 301,
             .specifiers = {::GERAN_SPECIFIER_P900, ::GERAN_SPECIFIER_850},
             .maxSearchTime = 60,
@@ -821,11 +821,20 @@
                   cellIdentities.cellIdentityTdscdma.size());
 
     // 32 bit system might return invalid mcc and mnc hidl string "\xff\xff..."
-    if (checkMccMnc && hidl_mcc.size() < 4 && hidl_mnc.size() < 4) {
-        int mcc = stoi(hidl_mcc);
-        int mnc = stoi(hidl_mnc);
-        EXPECT_TRUE(mcc >= 0 && mcc <= 999);
-        EXPECT_TRUE(mnc >= 0 && mnc <= 999);
+    if (checkMccMnc) {
+        int mccSize = hidl_mcc.size();
+        EXPECT_TRUE(mccSize == 0 || mccSize == 3);
+        if (mccSize > 0) {
+            int mcc = stoi(hidl_mcc);
+            EXPECT_TRUE(mcc >= 0 && mcc <= 999);
+        }
+
+        int mncSize = hidl_mnc.size();
+        EXPECT_TRUE(mncSize == 0 || mncSize == 2 || mncSize == 3);
+        if (mncSize > 0) {
+            int mnc = stoi(hidl_mnc);
+            EXPECT_TRUE(mnc >= 0 && mnc <= 999);
+        }
     }
 }
 
diff --git a/radio/1.3/vts/functional/AndroidTest.xml b/radio/1.3/vts/functional/AndroidTest.xml
index 9df8f9c..44b7419 100644
--- a/radio/1.3/vts/functional/AndroidTest.xml
+++ b/radio/1.3/vts/functional/AndroidTest.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioV1_3TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <!-- TODO: b/154638140, b/152655658: bad interactions -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
diff --git a/radio/1.4/vts/functional/AndroidTest.xml b/radio/1.4/vts/functional/AndroidTest.xml
index 469e103..d0843e6 100644
--- a/radio/1.4/vts/functional/AndroidTest.xml
+++ b/radio/1.4/vts/functional/AndroidTest.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioV1_4TargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <!-- TODO: b/154638140, b/152655658: bad interactions -->
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
diff --git a/radio/1.4/vts/functional/radio_hidl_hal_api.cpp b/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
index 8f357a0..744af75 100644
--- a/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
@@ -335,7 +335,7 @@
     serial = GetRandomSerialNumber();
 
     ::android::hardware::radio::V1_2::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 4,
             .specifiers = {::GERAN_SPECIFIER_P900, ::GERAN_SPECIFIER_850},
             .maxSearchTime = 60,
@@ -368,7 +368,7 @@
     serial = GetRandomSerialNumber();
 
     ::android::hardware::radio::V1_2::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 301,
             .specifiers = {::GERAN_SPECIFIER_P900, ::GERAN_SPECIFIER_850},
             .maxSearchTime = 60,
diff --git a/radio/1.5/vts/functional/radio_hidl_hal_api.cpp b/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
index 316c308..fd44e93 100644
--- a/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
@@ -661,7 +661,7 @@
             .channels = {128, 129}};
 
     ::android::hardware::radio::V1_5::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 4,
             .specifiers = {specifierP900, specifier850},
             .maxSearchTime = 60,
@@ -705,7 +705,7 @@
             .channels = {128, 129}};
 
     ::android::hardware::radio::V1_5::NetworkScanRequest request = {
-            .type = ScanType::ONE_SHOT,
+            .type = ScanType::PERIODIC,
             .interval = 301,
             .specifiers = {specifierP900, specifier850},
             .maxSearchTime = 60,
diff --git a/radio/aidl/vts/AndroidTest.xml b/radio/aidl/vts/AndroidTest.xml
index 36381d1..7edc072 100644
--- a/radio/aidl/vts/AndroidTest.xml
+++ b/radio/aidl/vts/AndroidTest.xml
@@ -16,6 +16,7 @@
 <configuration description="Runs VtsHalRadioTargetTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
+    <option name="config-descriptor:metadata" key="token" value="SIM_CARD" />
 
     <target_preparer class="com.android.tradefed.targetprep.MultiSimPreparer" />
     <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
@@ -31,4 +32,4 @@
         <option name="native-test-timeout" value="300000" /> <!-- 5 min -->
         <option name="module-name" value="VtsHalRadioTargetTest" />
     </test>
-</configuration>
\ No newline at end of file
+</configuration>
diff --git a/radio/aidl/vts/radio_aidl_hal_utils.cpp b/radio/aidl/vts/radio_aidl_hal_utils.cpp
index 6ed8e7d..f18da55 100644
--- a/radio/aidl/vts/radio_aidl_hal_utils.cpp
+++ b/radio/aidl/vts/radio_aidl_hal_utils.cpp
@@ -85,7 +85,7 @@
     // Do not use checkSubstringInCommandOutput("getprop persist.radio.multisim.config", "")
     // until b/148904287 is fixed. We need exact matching instead of partial matching. (i.e.
     // by definition the empty string "" is a substring of any string).
-    return !isDsDsEnabled() && !isTsTsEnabled();
+    return !isDsDsEnabled() && !isTsTsEnabled() && !isDsDaEnabled();
 }
 
 bool isDsDsEnabled() {
@@ -125,8 +125,8 @@
             ALOGI("%s instance is not valid for SSSS device.", serviceName.c_str());
             return false;
         }
-    } else if (isDsDsEnabled()) {
-        // Device is configured as DSDS.
+    } else if (isDsDsEnabled() || isDsDaEnabled()) {
+        // Device is configured as DSDS or DSDA.
         if (!stringEndsWith(serviceName, RADIO_SERVICE_SLOT1_NAME) &&
             !stringEndsWith(serviceName, RADIO_SERVICE_SLOT2_NAME)) {
             ALOGI("%s instance is not valid for DSDS device.", serviceName.c_str());
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index aa6ac88..3eedc14 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -531,8 +531,7 @@
 
         ASSERT_TRUE(CheckAnyOfErrors(
                 radioRsp_data->rspInfo.error,
-                {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE, RadioError::INVALID_ARGUMENTS,
-                 RadioError::REQUEST_NOT_SUPPORTED}));
+                {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
     }
 }
 
@@ -549,8 +548,7 @@
 
     ASSERT_TRUE(
             CheckAnyOfErrors(radioRsp_data->rspInfo.error,
-                             {RadioError::NONE, RadioError::RADIO_NOT_AVAILABLE,
-                              RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
+                             {RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED}));
 }
 
 /*
diff --git a/radio/aidl/vts/radio_modem_test.cpp b/radio/aidl/vts/radio_modem_test.cpp
index f88da13..e867378 100644
--- a/radio/aidl/vts/radio_modem_test.cpp
+++ b/radio/aidl/vts/radio_modem_test.cpp
@@ -264,6 +264,8 @@
         ASSERT_TRUE(CheckAnyOfErrors(radioRsp_modem->rspInfo.error,
                                      {RadioError::NONE, RadioError::REQUEST_NOT_SUPPORTED}));
     }
+    // wait until modem reset finishes
+    sleep(10);
     LOG(DEBUG) << "nvResetConfig finished";
 }
 
diff --git a/radio/aidl/vts/radio_network_test.cpp b/radio/aidl/vts/radio_network_test.cpp
index 61b34d7..95ab2b1 100644
--- a/radio/aidl/vts/radio_network_test.cpp
+++ b/radio/aidl/vts/radio_network_test.cpp
@@ -66,12 +66,20 @@
 }
 
 /*
- * Test IRadioNetwork.setAllowedNetworkTypesBitmap for the response returned.
+ * Test IRadioNetwork.setAllowedNetworkTypesBitmap and IRadioNetwork.getAllowedNetworkTypesBitmap
+ * for the response returned.
  */
-TEST_P(RadioNetworkTest, setAllowedNetworkTypesBitmap) {
+TEST_P(RadioNetworkTest, setGetAllowedNetworkTypesBitmap) {
     serial = GetRandomSerialNumber();
-    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
 
+    // save current value
+    radio_network->getAllowedNetworkTypesBitmap(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    int32_t currentAllowedNetworkTypesBitmap = radioRsp_network->networkTypeBitmapResponse;
+
+    // set new value
+    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
+    serial = GetRandomSerialNumber();
     radio_network->setAllowedNetworkTypesBitmap(serial, allowedNetworkTypesBitmap);
 
     EXPECT_EQ(std::cv_status::no_timeout, wait());
@@ -83,20 +91,6 @@
              RadioError::MODE_NOT_SUPPORTED, RadioError::INTERNAL_ERR, RadioError::MODEM_ERR,
              RadioError::INVALID_ARGUMENTS, RadioError::REQUEST_NOT_SUPPORTED,
              RadioError::NO_RESOURCES}));
-}
-
-/*
- * Test IRadioNetwork.getAllowedNetworkTypesBitmap for the response returned.
- */
-TEST_P(RadioNetworkTest, getAllowedNetworkTypesBitmap) {
-    serial = GetRandomSerialNumber();
-    int32_t allowedNetworkTypesBitmap = static_cast<int32_t>(RadioAccessFamily::LTE);
-
-    radio_network->setAllowedNetworkTypesBitmap(serial, allowedNetworkTypesBitmap);
-
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
 
     if (radioRsp_network->rspInfo.error == RadioError::NONE) {
         sleep(3);  // wait for modem
@@ -112,7 +106,16 @@
                  RadioError::OPERATION_NOT_ALLOWED, RadioError::MODE_NOT_SUPPORTED,
                  RadioError::INVALID_ARGUMENTS, RadioError::MODEM_ERR,
                  RadioError::REQUEST_NOT_SUPPORTED, RadioError::NO_RESOURCES}));
+        if (radioRsp_network->rspInfo.error == RadioError::NONE) {
+            // verify we get the value we set
+            ASSERT_EQ(radioRsp_network->networkTypeBitmapResponse, allowedNetworkTypesBitmap);
+        }
     }
+
+    // reset value to previous
+    serial = GetRandomSerialNumber();
+    radio_network->setAllowedNetworkTypesBitmap(serial, currentAllowedNetworkTypesBitmap);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
 }
 
 /*
@@ -920,7 +923,7 @@
     RadioAccessSpecifier specifier850 = {
             .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
 
-    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_PERIODIC,
                                   .interval = 4,
                                   .specifiers = {specifierP900, specifier850},
                                   .maxSearchTime = 60,
@@ -961,7 +964,7 @@
     RadioAccessSpecifier specifier850 = {
             .accessNetwork = AccessNetwork::GERAN, .bands = band850, .channels = {128, 129}};
 
-    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_ONE_SHOT,
+    NetworkScanRequest request = {.type = NetworkScanRequest::SCAN_TYPE_PERIODIC,
                                   .interval = 301,
                                   .specifiers = {specifierP900, specifier850},
                                   .maxSearchTime = 60,
@@ -1494,11 +1497,20 @@
     }
 
     // 32 bit system might return invalid mcc and mnc string "\xff\xff..."
-    if (checkMccMnc && mcc.size() < 4 && mnc.size() < 4) {
-        int mcc_int = stoi(mcc);
-        int mnc_int = stoi(mnc);
-        EXPECT_TRUE(mcc_int >= 0 && mcc_int <= 999);
-        EXPECT_TRUE(mnc_int >= 0 && mnc_int <= 999);
+    if (checkMccMnc) {
+        int mccSize = mcc.size();
+        EXPECT_TRUE(mccSize == 0 || mccSize == 3);
+        if (mccSize > 0) {
+            int mcc_int = stoi(mcc);
+            EXPECT_TRUE(mcc_int >= 0 && mcc_int <= 999);
+        }
+
+        int mncSize = mnc.size();
+        EXPECT_TRUE(mncSize == 0 || mncSize == 2 || mncSize == 3);
+        if (mncSize > 0) {
+            int mnc_int = stoi(mnc);
+            EXPECT_TRUE(mnc_int >= 0 && mnc_int <= 999);
+        }
     }
 
     // Check for access technology specific info
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index e99149b..bdec4d3 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -3119,7 +3119,7 @@
  */
 TEST_P(SigningOperationsTest, NoUserConfirmation) {
     ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                                 .RsaSigningKey(1024, 65537)
+                                                 .RsaSigningKey(2048, 65537)
                                                  .Digest(Digest::NONE)
                                                  .Padding(PaddingMode::NONE)
                                                  .Authorization(TAG_NO_AUTH_REQUIRED)
diff --git a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index 461357d..2a4cba1 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -134,6 +134,10 @@
      *        are marked (see the definition of PublicKey in the MacedPublicKey structure) to
      *        prevent them from being confused with production keys.
      *
+     *        This parameter has been deprecated since version 3 of the HAL and will always be
+     *        false. From v3, if this parameter is true, the method must raise a
+     *        ServiceSpecificException with an error of code of STATUS_REMOVED.
+     *
      * @param out MacedPublicKey macedPublicKey contains the public key of the generated key pair,
      *        MACed so that generateCertificateRequest can easily verify, without the
      *        privateKeyHandle, that the contained public key is for remote certification.
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 94bfbb4..62463eb 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -47,7 +47,11 @@
 namespace {
 
 constexpr int32_t VERSION_WITH_UNIQUE_ID_SUPPORT = 2;
+
+constexpr int32_t VERSION_WITHOUT_EEK = 3;
 constexpr int32_t VERSION_WITHOUT_TEST_MODE = 3;
+constexpr int32_t VERSION_WITH_CERTIFICATE_REQUEST_V2 = 3;
+constexpr int32_t VERSION_WITH_SUPPORTED_NUM_KEYS_IN_CSR = 3;
 
 constexpr uint8_t MIN_CHALLENGE_SIZE = 0;
 constexpr uint8_t MAX_CHALLENGE_SIZE = 64;
@@ -226,21 +230,13 @@
     RpcHardwareInfo hwInfo;
     ASSERT_TRUE(provisionable_->getHardwareInfo(&hwInfo).isOk());
 
-    const std::set<int> validCurves = {RpcHardwareInfo::CURVE_P256, RpcHardwareInfo::CURVE_25519};
-    // First check for the implementations that supports only IRPC V3+.
-    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
-        bytevec keysToSignMac;
-        DeviceInfo deviceInfo;
-        ProtectedData protectedData;
-        auto status = provisionable_->generateCertificateRequest(false, {}, {}, {}, &deviceInfo,
-                                                                 &protectedData, &keysToSignMac);
-        if (!status.isOk() &&
-            (status.getServiceSpecificError() == BnRemotelyProvisionedComponent::STATUS_REMOVED)) {
-            ASSERT_EQ(hwInfo.supportedEekCurve, RpcHardwareInfo::CURVE_NONE)
-                    << "Invalid curve: " << hwInfo.supportedEekCurve;
-            return;
-        }
+    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_EEK) {
+        ASSERT_EQ(hwInfo.supportedEekCurve, RpcHardwareInfo::CURVE_NONE)
+                << "Invalid curve: " << hwInfo.supportedEekCurve;
+        return;
     }
+
+    const std::set<int> validCurves = {RpcHardwareInfo::CURVE_P256, RpcHardwareInfo::CURVE_25519};
     ASSERT_EQ(validCurves.count(hwInfo.supportedEekCurve), 1)
             << "Invalid curve: " << hwInfo.supportedEekCurve;
 }
@@ -264,7 +260,7 @@
  * Verify implementation supports at least MIN_SUPPORTED_NUM_KEYS_IN_CSR keys in a CSR.
  */
 TEST_P(GetHardwareInfoTests, supportedNumKeysInCsr) {
-    if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
+    if (rpcHardwareInfo.versionNumber < VERSION_WITH_SUPPORTED_NUM_KEYS_IN_CSR) {
         return;
     }
 
@@ -365,6 +361,13 @@
     bytevec privateKeyBlob;
     bool testMode = true;
     auto status = provisionable_->generateEcdsaP256KeyPair(testMode, &macedPubKey, &privateKeyBlob);
+
+    if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
+        ASSERT_FALSE(status.isOk());
+        EXPECT_EQ(status.getServiceSpecificError(), BnRemotelyProvisionedComponent::STATUS_REMOVED);
+        return;
+    }
+
     ASSERT_TRUE(status.isOk());
     check_maced_pubkey(macedPubKey, testMode, nullptr);
 }
@@ -410,7 +413,7 @@
         CertificateRequestTestBase::SetUp();
         ASSERT_FALSE(HasFatalFailure());
 
-        if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
+        if (rpcHardwareInfo.versionNumber >= VERSION_WITH_CERTIFICATE_REQUEST_V2) {
             GTEST_SKIP() << "This test case only applies to RKP v1 and v2. "
                          << "RKP version discovered: " << rpcHardwareInfo.versionNumber;
         }
@@ -688,7 +691,7 @@
         CertificateRequestTestBase::SetUp();
         ASSERT_FALSE(HasFatalFailure());
 
-        if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
+        if (rpcHardwareInfo.versionNumber < VERSION_WITH_CERTIFICATE_REQUEST_V2) {
             GTEST_SKIP() << "This test case only applies to RKP v3 and above. "
                          << "RKP version discovered: " << rpcHardwareInfo.versionNumber;
         }
@@ -699,6 +702,7 @@
  * Generate an empty certificate request with all possible length of challenge, and decrypt and
  * verify the structure and content.
  */
+// @VsrTest = 3.10-015
 TEST_P(CertificateRequestV2Test, EmptyRequest) {
     bytevec csr;
 
@@ -718,6 +722,7 @@
  * Generate a non-empty certificate request with all possible length of challenge.  Decrypt, parse
  * and validate the contents.
  */
+// @VsrTest = 3.10-015
 TEST_P(CertificateRequestV2Test, NonEmptyRequest) {
     generateKeys(false /* testMode */, 1 /* numKeys */);
 
@@ -750,6 +755,7 @@
  * Generate a non-empty certificate request.  Make sure contents are reproducible but allow for the
  * signature to be different since algorithms including ECDSA P-256 can include a random value.
  */
+// @VsrTest = 3.10-015
 TEST_P(CertificateRequestV2Test, NonEmptyRequestReproducible) {
     generateKeys(false /* testMode */, 1 /* numKeys */);
 
@@ -773,6 +779,7 @@
 /**
  * Generate a non-empty certificate request with multiple keys.
  */
+// @VsrTest = 3.10-015
 TEST_P(CertificateRequestV2Test, NonEmptyRequestMultipleKeys) {
     generateKeys(false /* testMode */, rpcHardwareInfo.supportedNumKeysInCsr /* numKeys */);
 
@@ -802,23 +809,23 @@
 }
 
 /**
- * Generate a non-empty certificate request in prod mode, with test keys.  Must fail with
- * STATUS_TEST_KEY_IN_PRODUCTION_REQUEST.
+ * Call generateCertificateRequest(). Make sure it's removed.
  */
-TEST_P(CertificateRequestV2Test, NonEmptyRequest_testKeyInProdCert) {
-    generateKeys(true /* testMode */, 1 /* numKeys */);
-
-    bytevec csr;
-    auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
+TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed_prodMode) {
+    bytevec keysToSignMac;
+    DeviceInfo deviceInfo;
+    ProtectedData protectedData;
+    auto status = provisionable_->generateCertificateRequest(
+            false /* testMode */, {} /* keysToSign */, {} /* EEK chain */, challenge_, &deviceInfo,
+            &protectedData, &keysToSignMac);
     ASSERT_FALSE(status.isOk()) << status.getMessage();
-    ASSERT_EQ(status.getServiceSpecificError(),
-              BnRemotelyProvisionedComponent::STATUS_TEST_KEY_IN_PRODUCTION_REQUEST);
+    EXPECT_EQ(status.getServiceSpecificError(), BnRemotelyProvisionedComponent::STATUS_REMOVED);
 }
 
 /**
- * Call generateCertificateRequest(). Make sure it's removed.
+ * Call generateCertificateRequest() in test mode. Make sure it's removed.
  */
-TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed) {
+TEST_P(CertificateRequestV2Test, CertificateRequestV1Removed_testMode) {
     bytevec keysToSignMac;
     DeviceInfo deviceInfo;
     ProtectedData protectedData;
@@ -846,6 +853,7 @@
 /**
  * Generate a CSR and verify DeviceInfo against IDs attested by KeyMint.
  */
+// @VsrTest = 3.10-015
 TEST_P(CertificateRequestV2Test, DeviceInfo) {
     // See if there is a matching IKeyMintDevice for this IRemotelyProvisionedComponent.
     std::shared_ptr<IKeyMintDevice> keyMint;
diff --git a/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp b/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
index 7b42689..75c44b7 100644
--- a/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
+++ b/tv/cec/1.0/vts/functional/VtsHalTvCecV1_0TargetTest.cpp
@@ -127,7 +127,15 @@
 
 TEST_P(HdmiCecTest, SendMessage) {
     CecMessage message;
-    message.initiator = CecLogicalAddress::PLAYBACK_1;
+    if (hasDeviceType(CecDeviceType::TV))
+    {
+        hdmiCec->clearLogicalAddress();
+        Return<Result> result = hdmiCec->addLogicalAddress(CecLogicalAddress::TV);
+        EXPECT_EQ(result, Result::SUCCESS);
+        message.initiator = CecLogicalAddress::TV;
+    }
+    else
+        message.initiator = CecLogicalAddress::PLAYBACK_1;
     message.destination = CecLogicalAddress::BROADCAST;
     message.body.resize(1);
     message.body[0] = 131;
diff --git a/tv/cec/OWNERS b/tv/cec/OWNERS
new file mode 100644
index 0000000..71e74c0
--- /dev/null
+++ b/tv/cec/OWNERS
@@ -0,0 +1,2 @@
+# Bug component: 826094
+include platform/frameworks/base:/core/java/android/hardware/hdmi/OWNERS
diff --git a/tv/tuner/1.0/vts/OWNERS b/tv/tuner/1.0/vts/OWNERS
index 1b3d095..9bdafca 100644
--- a/tv/tuner/1.0/vts/OWNERS
+++ b/tv/tuner/1.0/vts/OWNERS
@@ -1,3 +1,4 @@
+# Bug component: 136752
 nchalko@google.com
 amyjojo@google.com
 shubang@google.com
diff --git a/tv/tuner/1.1/vts/OWNERS b/tv/tuner/1.1/vts/OWNERS
index 1b3d095..9bdafca 100644
--- a/tv/tuner/1.1/vts/OWNERS
+++ b/tv/tuner/1.1/vts/OWNERS
@@ -1,3 +1,4 @@
+# Bug component: 136752
 nchalko@google.com
 amyjojo@google.com
 shubang@google.com
diff --git a/uwb/aidl/default/Android.bp b/uwb/aidl/default/Android.bp
index 8c2b60e..9621f2c 100644
--- a/uwb/aidl/default/Android.bp
+++ b/uwb/aidl/default/Android.bp
@@ -7,29 +7,26 @@
     default_applicable_licenses: ["hardware_interfaces_license"],
 }
 
-cc_binary {
+rust_binary {
     name: "android.hardware.uwb-service",
+    crate_name: "uwb_default_hal",
     relative_install_path: "hw",
-    init_rc: ["uwb-service.rc"],
     vintf_fragments: ["uwb-service.xml"],
     vendor: true,
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-g",
+    rustlibs: [
+        "android.hardware.uwb-V1-rust",
+        "liblogger",
+        "liblog_rust",
+        "libbinder_rs",
+        "libbinder_tokio_rs",
+        "libtokio",
+        "libnix",
+        "libanyhow",
     ],
-    shared_libs: [
-        "liblog",
-        "libbinder_ndk",
-    ],
-    static_libs: [
-        "libbase",
-        "libutils",
-        "android.hardware.uwb-V1-ndk",
+    proc_macros: [
+        "libasync_trait",
     ],
     srcs: [
-        "service.cpp",
-        "uwb.cpp",
-        "uwb_chip.cpp",
+        "src/service.rs",
     ],
 }
diff --git a/uwb/aidl/default/service.cpp b/uwb/aidl/default/service.cpp
deleted file mode 100644
index 007637f..0000000
--- a/uwb/aidl/default/service.cpp
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <android-base/logging.h>
-#include <android/binder_manager.h>
-#include <android/binder_process.h>
-#include <utils/StrongPointer.h>
-
-#include "uwb.h"
-
-using ::aidl::android::hardware::uwb::IUwb;
-using ::android::sp;
-using ::android::base::InitLogging;
-using ::android::base::StderrLogger;
-using ::android::hardware::uwb::impl::Uwb;
-
-int main(int /*argc*/, char* argv[]) {
-    InitLogging(argv, StderrLogger);
-    LOG(INFO) << "UWB HAL starting up";
-
-    ABinderProcess_setThreadPoolMaxThreadCount(0);
-    std::shared_ptr<IUwb> uwb = ndk::SharedRefBase::make<Uwb>();
-    const std::string instance = std::string() + IUwb::descriptor + "/default";
-    binder_status_t status = AServiceManager_addService(uwb->asBinder().get(), instance.c_str());
-    CHECK(status == STATUS_OK);
-
-    ABinderProcess_joinThreadPool();
-    return EXIT_FAILURE;  // should not reach
-}
diff --git a/uwb/aidl/default/src/service.rs b/uwb/aidl/default/src/service.rs
new file mode 100644
index 0000000..7d5c073
--- /dev/null
+++ b/uwb/aidl/default/src/service.rs
@@ -0,0 +1,47 @@
+use android_hardware_uwb::aidl::android::hardware::uwb::IUwb::{self, IUwb as _};
+use android_hardware_uwb::binder;
+
+use tokio::runtime::Runtime;
+
+use std::env;
+use std::panic;
+
+use log::Level;
+
+mod uwb;
+mod uwb_chip;
+
+fn main() -> anyhow::Result<()> {
+    logger::init(
+        logger::Config::default()
+            .with_min_level(Level::Debug)
+            .with_tag_on_device("android.hardware.uwb"),
+    );
+
+    // Redirect panic messages to logcat.
+    panic::set_hook(Box::new(|panic_info| {
+        log::error!("{}", panic_info);
+    }));
+
+    log::info!("UWB HAL starting up");
+
+    // Create the tokio runtime
+    let rt = Runtime::new()?;
+
+    let chips = env::args()
+        .skip(1) // Skip binary name
+        .enumerate()
+        .map(|(i, arg)| uwb_chip::UwbChip::new(i.to_string(), arg));
+
+    binder::add_service(
+        &format!("{}/default", IUwb::BpUwb::get_descriptor()),
+        IUwb::BnUwb::new_binder(
+            uwb::Uwb::from_chips(chips, rt.handle().clone()),
+            binder::BinderFeatures::default(),
+        )
+        .as_binder(),
+    )?;
+
+    binder::ProcessState::join_thread_pool();
+    Ok(())
+}
diff --git a/uwb/aidl/default/src/uwb.rs b/uwb/aidl/default/src/uwb.rs
new file mode 100644
index 0000000..428f08f
--- /dev/null
+++ b/uwb/aidl/default/src/uwb.rs
@@ -0,0 +1,53 @@
+use android_hardware_uwb::aidl::android::hardware::uwb::{IUwb, IUwbChip};
+use android_hardware_uwb::binder;
+use binder::{Result, Strong};
+use binder_tokio::TokioRuntime;
+use tokio::runtime::Handle as TokioHandle;
+
+use crate::uwb_chip;
+
+pub struct Uwb {
+    chips: Vec<Strong<dyn IUwbChip::IUwbChip>>,
+}
+
+impl Uwb {
+    pub fn from_chips(
+        chips: impl IntoIterator<Item = uwb_chip::UwbChip>,
+        handle: TokioHandle,
+    ) -> Self {
+        Self {
+            chips: chips
+                .into_iter()
+                .map(|chip| {
+                    IUwbChip::BnUwbChip::new_async_binder(
+                        chip,
+                        TokioRuntime(handle.clone()),
+                        binder::BinderFeatures::default(),
+                    )
+                })
+                .collect(),
+        }
+    }
+}
+
+impl binder::Interface for Uwb {}
+
+impl IUwb::IUwb for Uwb {
+    fn getChips(&self) -> Result<Vec<String>> {
+        log::debug!("getChips");
+        self.chips.iter().map(|chip| chip.getName()).collect()
+    }
+
+    fn getChip(&self, name: &str) -> Result<Strong<dyn IUwbChip::IUwbChip>> {
+        log::debug!("getChip {}", name);
+        let chip = self
+            .chips
+            .iter()
+            .find(|chip| chip.getName().as_deref() == Ok(name));
+        if let Some(chip) = chip {
+            Ok(chip.clone())
+        } else {
+            Err(binder::ExceptionCode::ILLEGAL_ARGUMENT.into())
+        }
+    }
+}
diff --git a/uwb/aidl/default/src/uwb_chip.rs b/uwb/aidl/default/src/uwb_chip.rs
new file mode 100644
index 0000000..7c2c300
--- /dev/null
+++ b/uwb/aidl/default/src/uwb_chip.rs
@@ -0,0 +1,168 @@
+use android_hardware_uwb::aidl::android::hardware::uwb::{
+    IUwbChip::IUwbChipAsyncServer, IUwbClientCallback::IUwbClientCallback, UwbEvent::UwbEvent,
+    UwbStatus::UwbStatus,
+};
+use android_hardware_uwb::binder;
+use async_trait::async_trait;
+use binder::{Result, Strong};
+
+use tokio::fs::File;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::sync::Mutex;
+
+use std::os::fd::AsRawFd;
+
+use std::io;
+
+use nix::sys::termios;
+
+enum State {
+    Closed,
+    Opened {
+        callbacks: Strong<dyn IUwbClientCallback>,
+        #[allow(dead_code)]
+        tasks: tokio::task::JoinSet<()>,
+        write: File,
+    },
+}
+
+pub struct UwbChip {
+    name: String,
+    path: String,
+    state: Mutex<State>,
+}
+
+impl UwbChip {
+    pub fn new(name: String, path: String) -> Self {
+        Self {
+            name,
+            path,
+            state: Mutex::new(State::Closed),
+        }
+    }
+}
+
+pub fn makeraw(file: File) -> io::Result<File> {
+    let fd = file.as_raw_fd();
+
+    let mut attrs = termios::tcgetattr(fd)?;
+
+    termios::cfmakeraw(&mut attrs);
+
+    termios::tcsetattr(fd, termios::SetArg::TCSANOW, &attrs)?;
+
+    Ok(file)
+}
+
+impl binder::Interface for UwbChip {}
+
+#[async_trait]
+impl IUwbChipAsyncServer for UwbChip {
+    async fn getName(&self) -> Result<String> {
+        Ok(self.name.clone())
+    }
+
+    async fn open(&self, callbacks: &Strong<dyn IUwbClientCallback>) -> Result<()> {
+        log::debug!("open: {:?}", &self.path);
+
+        let serial = File::open(&self.path)
+            .await
+            .and_then(makeraw)
+            .map_err(|_| binder::StatusCode::UNKNOWN_ERROR)?;
+
+        let mut read = serial
+            .try_clone()
+            .await
+            .map_err(|_| binder::StatusCode::UNKNOWN_ERROR)?;
+        let write = serial;
+
+        let mut state = self.state.lock().await;
+
+        if let State::Closed = *state {
+            let client_callbacks = callbacks.clone();
+
+            let mut tasks = tokio::task::JoinSet::new();
+
+            tasks.spawn(async move {
+                loop {
+                    const UWB_HEADER_SIZE: usize = 4;
+
+                    let mut buffer = vec![0; UWB_HEADER_SIZE];
+                    read.read_exact(&mut buffer[0..UWB_HEADER_SIZE])
+                        .await
+                        .unwrap();
+
+                    let length = buffer[3] as usize + UWB_HEADER_SIZE;
+
+                    buffer.resize(length, 0);
+                    read.read_exact(&mut buffer[UWB_HEADER_SIZE..length])
+                        .await
+                        .unwrap();
+
+                    client_callbacks.onUciMessage(&buffer[..]).unwrap();
+                }
+            });
+
+            callbacks.onHalEvent(UwbEvent::OPEN_CPLT, UwbStatus::OK)?;
+
+            *state = State::Opened {
+                callbacks: callbacks.clone(),
+                tasks,
+                write,
+            };
+
+            Ok(())
+        } else {
+            Err(binder::ExceptionCode::ILLEGAL_STATE.into())
+        }
+    }
+
+    async fn close(&self) -> Result<()> {
+        log::debug!("close");
+
+        let mut state = self.state.lock().await;
+
+        if let State::Opened { ref callbacks, .. } = *state {
+            callbacks.onHalEvent(UwbEvent::CLOSE_CPLT, UwbStatus::OK)?;
+            *state = State::Closed;
+            Ok(())
+        } else {
+            Err(binder::ExceptionCode::ILLEGAL_STATE.into())
+        }
+    }
+
+    async fn coreInit(&self) -> Result<()> {
+        log::debug!("coreInit");
+
+        if let State::Opened { ref callbacks, .. } = *self.state.lock().await {
+            callbacks.onHalEvent(UwbEvent::POST_INIT_CPLT, UwbStatus::OK)?;
+            Ok(())
+        } else {
+            Err(binder::ExceptionCode::ILLEGAL_STATE.into())
+        }
+    }
+
+    async fn sessionInit(&self, _id: i32) -> Result<()> {
+        log::debug!("sessionInit");
+
+        Ok(())
+    }
+
+    async fn getSupportedAndroidUciVersion(&self) -> Result<i32> {
+        Ok(1)
+    }
+
+    async fn sendUciMessage(&self, data: &[u8]) -> Result<i32> {
+        log::debug!("sendUciMessage");
+
+        if let State::Opened { write, .. } = &mut *self.state.lock().await {
+            write
+                .write(data)
+                .await
+                .map(|written| written as i32)
+                .map_err(|_| binder::StatusCode::UNKNOWN_ERROR.into())
+        } else {
+            Err(binder::ExceptionCode::ILLEGAL_STATE.into())
+        }
+    }
+}
diff --git a/uwb/aidl/default/uwb-service.rc b/uwb/aidl/default/uwb-service.rc
deleted file mode 100644
index e2c3825..0000000
--- a/uwb/aidl/default/uwb-service.rc
+++ /dev/null
@@ -1,3 +0,0 @@
-service vendor.uwb_hal /vendor/bin/hw/android.hardware.uwb-service
-    class hal
-    user uwb
diff --git a/uwb/aidl/default/uwb.cpp b/uwb/aidl/default/uwb.cpp
deleted file mode 100644
index 1e2ef4e..0000000
--- a/uwb/aidl/default/uwb.cpp
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <android-base/logging.h>
-
-#include "uwb.h"
-
-namespace {
-static constexpr char kDefaultChipName[] = "default";
-
-}  // namespace
-
-namespace android {
-namespace hardware {
-namespace uwb {
-namespace impl {
-using namespace ::aidl::android::hardware::uwb;
-
-// The default implementation of the HAL assumes 1 chip on the device.
-Uwb::Uwb() : chips_({{kDefaultChipName, ndk::SharedRefBase::make<UwbChip>(kDefaultChipName)}}) {}
-
-Uwb::~Uwb() {}
-
-::ndk::ScopedAStatus Uwb::getChips(std::vector<std::string>* names) {
-    for (const auto& chip : chips_) {
-        names->push_back(chip.first);
-    }
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus Uwb::getChip(const std::string& name, std::shared_ptr<IUwbChip>* chip) {
-    const auto chip_found = chips_.find(name);
-    if (chip_found == chips_.end()) {
-        LOG(ERROR) << "Unknown chip name" << name;
-        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
-    }
-    *chip = chip_found->second;
-    return ndk::ScopedAStatus::ok();
-}
-}  // namespace impl
-}  // namespace uwb
-}  // namespace hardware
-}  // namespace android
diff --git a/uwb/aidl/default/uwb.h b/uwb/aidl/default/uwb.h
deleted file mode 100644
index ec51fd8..0000000
--- a/uwb/aidl/default/uwb.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef ANDROID_HARDWARE_UWB_UWB
-#define ANDROID_HARDWARE_UWB_UWB
-
-#include <map>
-#include <vector>
-
-#include <aidl/android/hardware/uwb/BnUwb.h>
-#include <aidl/android/hardware/uwb/IUwbChip.h>
-
-#include "uwb_chip.h"
-
-namespace android {
-namespace hardware {
-namespace uwb {
-namespace impl {
-using namespace ::aidl::android::hardware::uwb;
-// Default implementation mean't to be used on simulator targets.
-class Uwb : public BnUwb {
-  public:
-    Uwb();
-    virtual ~Uwb();
-
-    ::ndk::ScopedAStatus getChips(std::vector<std::string>* names) override;
-    ::ndk::ScopedAStatus getChip(const std::string& name, std::shared_ptr<IUwbChip>* chip) override;
-
-  private:
-    std::map<std::string, std::shared_ptr<UwbChip>> chips_;
-};
-}  // namespace impl
-}  // namespace uwb
-}  // namespace hardware
-}  // namespace android
-
-#endif  // ANDROID_HARDWARE_UWB_UWB
\ No newline at end of file
diff --git a/uwb/aidl/default/uwb_chip.cpp b/uwb/aidl/default/uwb_chip.cpp
deleted file mode 100644
index 41f14fd..0000000
--- a/uwb/aidl/default/uwb_chip.cpp
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "uwb.h"
-
-namespace {
-constexpr static int32_t kAndroidUciVersion = 1;
-}
-
-namespace android {
-namespace hardware {
-namespace uwb {
-namespace impl {
-using namespace ::aidl::android::hardware::uwb;
-
-UwbChip::UwbChip(const std::string& name) : name_(name), mClientCallback(nullptr) {}
-UwbChip::~UwbChip() {}
-
-::ndk::ScopedAStatus UwbChip::getName(std::string* name) {
-    *name = name_;
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::open(const std::shared_ptr<IUwbClientCallback>& clientCallback) {
-    mClientCallback = clientCallback;
-    mClientCallback->onHalEvent(UwbEvent::OPEN_CPLT, UwbStatus::OK);
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::close() {
-    mClientCallback->onHalEvent(UwbEvent::CLOSE_CPLT, UwbStatus::OK);
-    mClientCallback = nullptr;
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::coreInit() {
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::sessionInit(int /* sessionId */) {
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::getSupportedAndroidUciVersion(int32_t* version) {
-    *version = kAndroidUciVersion;
-    return ndk::ScopedAStatus::ok();
-}
-
-::ndk::ScopedAStatus UwbChip::sendUciMessage(const std::vector<uint8_t>& /* data */,
-                                             int32_t* /* bytes_written */) {
-    // TODO(b/195992658): Need emulator support for UCI stack.
-    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
-}
-}  // namespace impl
-}  // namespace uwb
-}  // namespace hardware
-}  // namespace android
diff --git a/uwb/aidl/default/uwb_chip.h b/uwb/aidl/default/uwb_chip.h
deleted file mode 100644
index e900cbe..0000000
--- a/uwb/aidl/default/uwb_chip.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_HARDWARE_UWB_UWBCHIP
-#define ANDROID_HARDWARE_UWB_UWBCHIP
-
-#include <vector>
-
-#include <aidl/android/hardware/uwb/BnUwbChip.h>
-#include <aidl/android/hardware/uwb/IUwbClientCallback.h>
-
-namespace android {
-namespace hardware {
-namespace uwb {
-namespace impl {
-using namespace ::aidl::android::hardware::uwb;
-// Default implementation mean't to be used on simulator targets.
-class UwbChip : public BnUwbChip {
-  public:
-    UwbChip(const std::string& name);
-    virtual ~UwbChip();
-
-    ::ndk::ScopedAStatus getName(std::string* name) override;
-    ::ndk::ScopedAStatus open(const std::shared_ptr<IUwbClientCallback>& clientCallback) override;
-    ::ndk::ScopedAStatus close() override;
-    ::ndk::ScopedAStatus coreInit() override;
-    ::ndk::ScopedAStatus sessionInit(int sesionId) override;
-    ::ndk::ScopedAStatus getSupportedAndroidUciVersion(int32_t* version) override;
-    ::ndk::ScopedAStatus sendUciMessage(const std::vector<uint8_t>& data,
-                                        int32_t* bytes_written) override;
-
-  private:
-    std::string name_;
-    std::shared_ptr<IUwbClientCallback> mClientCallback;
-};
-}  // namespace impl
-}  // namespace uwb
-}  // namespace hardware
-}  // namespace android
-
-#endif  // ANDROID_HARDWARE_UWB_UWBCHIP