diff --git a/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp b/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
index c709d40..7fcac38 100644
--- a/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
+++ b/automotive/evs/aidl/vts/VtsHalEvsTargetTest.cpp
@@ -430,8 +430,8 @@
         mActiveCameras.push_back(pCam);
 
         // Set up a frame receiver object which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, nullptr, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start the camera's video stream
@@ -529,8 +529,8 @@
         ASSERT_TRUE(pCam->setMaxFramesInFlight(kBuffersToHold).isOk());
 
         // Set up a frame receiver object which will fire up its own thread.
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, nullptr, FrameHandler::eNoAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, nullptr, FrameHandler::eNoAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start the camera's video stream
@@ -619,8 +619,8 @@
         mActiveCameras.push_back(pCam);
 
         // Set up a frame receiver object which will fire up its own thread.
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, pDisplay, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, pDisplay, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Activate the display
@@ -697,10 +697,10 @@
         mActiveCameras.push_back(pCam1);
 
         // Set up per-client frame receiver objects which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandler0 =
-                std::make_shared<FrameHandler>(pCam0, cam, nullptr, FrameHandler::eAutoReturn);
-        std::shared_ptr<FrameHandler> frameHandler1 =
-                std::make_shared<FrameHandler>(pCam1, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler0 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam0, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler1 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam1, cam, nullptr, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler0, nullptr);
         EXPECT_NE(frameHandler1, nullptr);
 
@@ -803,8 +803,8 @@
         }
 
         // Set up per-client frame receiver objects which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, nullptr, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start the camera's video stream
@@ -903,10 +903,11 @@
         mActiveCameras.push_back(pSecondaryCam);
 
         // Set up per-client frame receiver objects which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandlerPrimary = std::make_shared<FrameHandler>(
+        std::shared_ptr<FrameHandler> frameHandlerPrimary = ndk::SharedRefBase::make<FrameHandler>(
                 pPrimaryCam, cam, nullptr, FrameHandler::eAutoReturn);
-        std::shared_ptr<FrameHandler> frameHandlerSecondary = std::make_shared<FrameHandler>(
-                pSecondaryCam, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandlerSecondary =
+                ndk::SharedRefBase::make<FrameHandler>(pSecondaryCam, cam, nullptr,
+                                                       FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandlerPrimary, nullptr);
         EXPECT_NE(frameHandlerSecondary, nullptr);
 
@@ -1075,10 +1076,11 @@
         }
 
         // Set up per-client frame receiver objects which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandlerPrimary = std::make_shared<FrameHandler>(
+        std::shared_ptr<FrameHandler> frameHandlerPrimary = ndk::SharedRefBase::make<FrameHandler>(
                 pPrimaryCam, cam, nullptr, FrameHandler::eAutoReturn);
-        std::shared_ptr<FrameHandler> frameHandlerSecondary = std::make_shared<FrameHandler>(
-                pSecondaryCam, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandlerSecondary =
+                ndk::SharedRefBase::make<FrameHandler>(pSecondaryCam, cam, nullptr,
+                                                       FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandlerPrimary, nullptr);
         EXPECT_NE(frameHandlerSecondary, nullptr);
 
@@ -1418,10 +1420,10 @@
         }
 
         // Set up a frame receiver object which will fire up its own thread.
-        std::shared_ptr<FrameHandler> frameHandler0 =
-                std::make_shared<FrameHandler>(pCam0, cam, nullptr, FrameHandler::eAutoReturn);
-        std::shared_ptr<FrameHandler> frameHandler1 =
-                std::make_shared<FrameHandler>(pCam1, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler0 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam0, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler1 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam1, cam, nullptr, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler0, nullptr);
         EXPECT_NE(frameHandler1, nullptr);
 
@@ -1733,8 +1735,8 @@
         mActiveCameras.push_back(pCam);
 
         // Set up a frame receiver object which will fire up its own thread.
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, pDisplay, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, pDisplay, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Activate the display
@@ -1843,10 +1845,10 @@
         EXPECT_NE(pCam1, nullptr);
 
         // Set up per-client frame receiver objects which will fire up its own thread
-        std::shared_ptr<FrameHandler> frameHandler0 =
-                std::make_shared<FrameHandler>(pCam0, cam, nullptr, FrameHandler::eAutoReturn);
-        std::shared_ptr<FrameHandler> frameHandler1 =
-                std::make_shared<FrameHandler>(pCam1, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler0 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam0, cam, nullptr, FrameHandler::eAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler1 = ndk::SharedRefBase::make<FrameHandler>(
+                pCam1, cam, nullptr, FrameHandler::eAutoReturn);
         EXPECT_NE(frameHandler0, nullptr);
         EXPECT_NE(frameHandler1, nullptr);
 
@@ -2008,8 +2010,8 @@
         EXPECT_GE(delta, kBuffersToHold);
 
         // Set up a frame receiver object which will fire up its own thread.
-        std::shared_ptr<FrameHandler> frameHandler =
-                std::make_shared<FrameHandler>(pCam, cam, nullptr, FrameHandler::eNoAutoReturn);
+        std::shared_ptr<FrameHandler> frameHandler = ndk::SharedRefBase::make<FrameHandler>(
+                pCam, cam, nullptr, FrameHandler::eNoAutoReturn);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start the camera's video stream
@@ -2101,7 +2103,7 @@
         EXPECT_NE(pUltrasonicsArray, nullptr);
 
         std::shared_ptr<FrameHandlerUltrasonics> frameHandler =
-                std::make_shared<FrameHandlerUltrasonics>(pUltrasonicsArray);
+                ndk::SharedRefBase::make<FrameHandlerUltrasonics>(pUltrasonicsArray);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start stream.
@@ -2141,7 +2143,7 @@
         ASSERT_TRUE(pUltrasonicsArray->setMaxFramesInFlight(10).isOk());
 
         std::shared_ptr<FrameHandlerUltrasonics> frameHandler =
-                std::make_shared<FrameHandlerUltrasonics>(pUltrasonicsArray);
+                ndk::SharedRefBase::make<FrameHandlerUltrasonics>(pUltrasonicsArray);
         EXPECT_NE(frameHandler, nullptr);
 
         // Start stream.
diff --git a/automotive/vehicle/aidl/impl/default_config/include/DefaultConfig.h b/automotive/vehicle/aidl/impl/default_config/include/DefaultConfig.h
index 6ecac70..fda0da9 100644
--- a/automotive/vehicle/aidl/impl/default_config/include/DefaultConfig.h
+++ b/automotive/vehicle/aidl/impl/default_config/include/DefaultConfig.h
@@ -289,6 +289,71 @@
 
         {.config =
                  {
+                         .prop = toInt(VehicleProperty::EV_CHARGE_CURRENT_DRAW_LIMIT),
+                         .access = VehiclePropertyAccess::READ_WRITE,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.floatValues = {(float)VehicleUnit::AMPERE}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::EV_CHARGE_PERCENT_LIMIT),
+                         .access = VehiclePropertyAccess::READ_WRITE,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                         .configArray = {20, 40, 60, 80, 100},
+                 },
+         .initialValue = {.floatValues = {40}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::EV_CHARGE_STATE),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {2}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::EV_CHARGE_SWITCH),
+                         .access = VehiclePropertyAccess::READ_WRITE,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {0 /* false */}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::EV_CHARGE_TIME_REMAINING),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
+                 },
+         .initialValue = {.int32Values = {20}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::EV_REGENERATIVE_BRAKING_STATE),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {2}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::TRAILER_PRESENT),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {2}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::VEHICLE_CURB_WEIGHT),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::STATIC,
+                 },
+         .initialValue = {.int32Values = {30}}},
+
+        {.config =
+                 {
                          .prop = toInt(VehicleProperty::RANGE_REMAINING),
                          .access = VehiclePropertyAccess::READ_WRITE,
                          .changeMode = VehiclePropertyChangeMode::CONTINUOUS,
@@ -820,6 +885,22 @@
 
         {.config =
                  {
+                         .prop = toInt(VehicleProperty::FRONT_FOG_LIGHTS_STATE),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::REAR_FOG_LIGHTS_STATE),
+                         .access = VehiclePropertyAccess::READ,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {LIGHT_STATE_ON}}},
+
+        {.config =
+                 {
                          .prop = toInt(VehicleProperty::HAZARD_LIGHTS_STATE),
                          .access = VehiclePropertyAccess::READ,
                          .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
@@ -852,6 +933,22 @@
 
         {.config =
                  {
+                         .prop = toInt(VehicleProperty::FRONT_FOG_LIGHTS_SWITCH),
+                         .access = VehiclePropertyAccess::READ_WRITE,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
+        {.config =
+                 {
+                         .prop = toInt(VehicleProperty::REAR_FOG_LIGHTS_SWITCH),
+                         .access = VehiclePropertyAccess::READ_WRITE,
+                         .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                 },
+         .initialValue = {.int32Values = {LIGHT_SWITCH_AUTO}}},
+
+        {.config =
+                 {
                          .prop = toInt(VehicleProperty::HAZARD_LIGHTS_SWITCH),
                          .access = VehiclePropertyAccess::READ_WRITE,
                          .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
@@ -1124,6 +1221,14 @@
                         },
                 .initialValue = {.stringValue = {"Test"}},
         },
+        {
+                .config =
+                        {
+                                .prop = ECHO_REVERSE_BYTES,
+                                .access = VehiclePropertyAccess::READ_WRITE,
+                                .changeMode = VehiclePropertyChangeMode::ON_CHANGE,
+                        },
+        },
 #ifdef ENABLE_VENDOR_CLUSTER_PROPERTY_FOR_TESTING
         // Vendor propetry for E2E ClusterHomeService testing.
         {
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
index 1c076d3..e799a28 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
@@ -131,6 +131,8 @@
             const aidl::android::hardware::automotive::vehicle::VehiclePropValue& value);
     ValueResultType getUserHalProp(
             const aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
+    ValueResultType getEchoReverseBytes(
+            const aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
     bool isHvacPropAndHvacNotAvailable(int32_t propId);
 
     std::string dumpAllProperties();
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
index 462506d..f8b64f2 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
@@ -23,6 +23,7 @@
 #include <FakeObd2Frame.h>
 #include <JsonFakeValueGenerator.h>
 #include <PropertyUtils.h>
+#include <TestPropertyUtils.h>
 #include <VehicleHalTypes.h>
 #include <VehicleUtils.h>
 #include <android-base/parsedouble.h>
@@ -335,6 +336,9 @@
                 result.value()->timestamp = elapsedRealtimeNano();
             }
             return result;
+        case ECHO_REVERSE_BYTES:
+            *isSpecialValue = true;
+            return getEchoReverseBytes(value);
         default:
             // Do nothing.
             break;
@@ -343,6 +347,22 @@
     return nullptr;
 }
 
+FakeVehicleHardware::ValueResultType FakeVehicleHardware::getEchoReverseBytes(
+        const VehiclePropValue& value) const {
+    auto readResult = mServerSidePropStore->readValue(value);
+    if (!readResult.ok()) {
+        return readResult;
+    }
+    auto& gotValue = readResult.value();
+    gotValue->timestamp = elapsedRealtimeNano();
+    std::vector<uint8_t> byteValues = gotValue->value.byteValues;
+    size_t byteSize = byteValues.size();
+    for (size_t i = 0; i < byteSize; i++) {
+        gotValue->value.byteValues[i] = byteValues[byteSize - 1 - i];
+    }
+    return std::move(gotValue);
+}
+
 VhalResult<void> FakeVehicleHardware::maybeSetSpecialValue(const VehiclePropValue& value,
                                                            bool* isSpecialValue) {
     *isSpecialValue = false;
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
index 6259f96..7a7fb37 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
@@ -276,6 +276,11 @@
             continue;
         }
 
+        if (config.config.prop == ECHO_REVERSE_BYTES) {
+            // Ignore ECHO_REVERSE_BYTES, it has special logic.
+            continue;
+        }
+
         int propId = config.config.prop;
         if (isGlobalProp(propId)) {
             if (config.initialValue == RawPropValues{}) {
@@ -1487,6 +1492,24 @@
     ASSERT_EQ(3.402823466E+38f, value.value.floatValues[2]);
 }
 
+TEST_F(FakeVehicleHardwareTest, testGetEchoReverseBytes) {
+    ASSERT_EQ(setValue(VehiclePropValue{
+                      .prop = ECHO_REVERSE_BYTES,
+                      .value =
+                              {
+                                      .byteValues = {0x01, 0x02, 0x03, 0x04},
+                              },
+              }),
+              StatusCode::OK);
+
+    auto result = getValue(VehiclePropValue{
+            .prop = ECHO_REVERSE_BYTES,
+    });
+
+    ASSERT_TRUE(result.ok()) << "failed to get ECHO_REVERSE_BYTES value: " << getStatus(result);
+    ASSERT_EQ(result.value().value.byteValues, std::vector<uint8_t>({0x04, 0x03, 0x02, 0x01}));
+}
+
 }  // namespace fake
 }  // namespace vehicle
 }  // namespace automotive
diff --git a/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h b/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
index 4213501..d512713 100644
--- a/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
+++ b/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
@@ -76,6 +76,16 @@
         toInt(testpropertyutils_impl::VehicleArea::GLOBAL) |
         toInt(testpropertyutils_impl::VehiclePropertyType::STRING);
 
+// This property is used for testing LargeParcelable marshalling/unmarhsalling end to end.
+// It acts as an regular property that stores the property value when setting and return the value
+// when getting, except that all the byteValues used in the setValue response would be filled in
+// the reverse order.
+// 0x21702a12
+constexpr int32_t ECHO_REVERSE_BYTES = 0x2a12 |
+                                       toInt(testpropertyutils_impl::VehiclePropertyGroup::VENDOR) |
+                                       toInt(testpropertyutils_impl::VehicleArea::GLOBAL) |
+                                       toInt(testpropertyutils_impl::VehiclePropertyType::BYTES);
+
 // This property is used for test purpose. End to end tests use this property to test set and get
 // method for MIXED type properties.
 constexpr int32_t kMixedTypePropertyForTest =
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/SessionType.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/SessionType.aidl
index baec9c2..33a3187 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/SessionType.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/SessionType.aidl
@@ -44,4 +44,6 @@
   LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH = 7,
   LE_AUDIO_BROADCAST_SOFTWARE_ENCODING_DATAPATH = 8,
   LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH = 9,
+  A2DP_SOFTWARE_DECODING_DATAPATH = 10,
+  A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH = 11,
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/SessionType.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/SessionType.aidl
index 95beee7..7acb5c6 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/SessionType.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/SessionType.aidl
@@ -62,4 +62,12 @@
      * Audio broadcast channels. This is a control path only.
      */
     LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
+    /**
+     * A2DP legacy that AVDTP media is decoded by Bluetooth Stack
+     */
+    A2DP_SOFTWARE_DECODING_DATAPATH,
+    /**
+     * The decoding of AVDTP media is done by HW and there is control only
+     */
+    A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH,
 }
diff --git a/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.cpp b/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.cpp
index 4b4713d..2d0d8c9 100644
--- a/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.cpp
@@ -28,10 +28,18 @@
 namespace bluetooth {
 namespace audio {
 
-A2dpOffloadAudioProvider::A2dpOffloadAudioProvider() {
+A2dpOffloadEncodingAudioProvider::A2dpOffloadEncodingAudioProvider()
+    : A2dpOffloadAudioProvider() {
   session_type_ = SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH;
 }
 
+A2dpOffloadDecodingAudioProvider::A2dpOffloadDecodingAudioProvider()
+    : A2dpOffloadAudioProvider() {
+  session_type_ = SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH;
+}
+
+A2dpOffloadAudioProvider::A2dpOffloadAudioProvider() {}
+
 bool A2dpOffloadAudioProvider::isValid(const SessionType& session_type) {
   return (session_type == session_type_);
 }
diff --git a/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.h b/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.h
index 4621e85..e6f188b 100644
--- a/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.h
+++ b/bluetooth/audio/aidl/default/A2dpOffloadAudioProvider.h
@@ -40,6 +40,16 @@
   ndk::ScopedAStatus onSessionReady(DataMQDesc* _aidl_return) override;
 };
 
+class A2dpOffloadEncodingAudioProvider : public A2dpOffloadAudioProvider {
+ public:
+  A2dpOffloadEncodingAudioProvider();
+};
+
+class A2dpOffloadDecodingAudioProvider : public A2dpOffloadAudioProvider {
+ public:
+  A2dpOffloadDecodingAudioProvider();
+};
+
 }  // namespace audio
 }  // namespace bluetooth
 }  // namespace hardware
diff --git a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
index 59df3a9..bd2da95 100644
--- a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
@@ -40,6 +40,16 @@
 static constexpr uint32_t kBufferCount = 2;  // double buffer
 static constexpr uint32_t kDataMqSize = kBufferSize * kBufferCount;
 
+A2dpSoftwareEncodingAudioProvider::A2dpSoftwareEncodingAudioProvider()
+    : A2dpSoftwareAudioProvider() {
+  session_type_ = SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH;
+}
+
+A2dpSoftwareDecodingAudioProvider::A2dpSoftwareDecodingAudioProvider()
+    : A2dpSoftwareAudioProvider() {
+  session_type_ = SessionType::A2DP_SOFTWARE_DECODING_DATAPATH;
+}
+
 A2dpSoftwareAudioProvider::A2dpSoftwareAudioProvider()
     : BluetoothAudioProvider(), data_mq_(nullptr) {
   LOG(INFO) << __func__ << " - size of audio buffer " << kDataMqSize
@@ -48,7 +58,6 @@
       new DataMQ(kDataMqSize, /* EventFlag */ true));
   if (data_mq && data_mq->isValid()) {
     data_mq_ = std::move(data_mq);
-    session_type_ = SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH;
   } else {
     ALOGE_IF(!data_mq, "failed to allocate data MQ");
     ALOGE_IF(data_mq && !data_mq->isValid(), "data MQ is invalid");
diff --git a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.h b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.h
index 10f533a..3ebecf2 100644
--- a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.h
+++ b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.h
@@ -43,6 +43,16 @@
   ndk::ScopedAStatus onSessionReady(DataMQDesc* _aidl_return) override;
 };
 
+class A2dpSoftwareEncodingAudioProvider : public A2dpSoftwareAudioProvider {
+ public:
+  A2dpSoftwareEncodingAudioProvider();
+};
+
+class A2dpSoftwareDecodingAudioProvider : public A2dpSoftwareAudioProvider {
+ public:
+  A2dpSoftwareDecodingAudioProvider();
+};
+
 }  // namespace audio
 }  // namespace bluetooth
 }  // namespace hardware
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
index 1e1680a..91731d4 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
@@ -44,10 +44,10 @@
 
   switch (session_type) {
     case SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH:
-      provider = ndk::SharedRefBase::make<A2dpSoftwareAudioProvider>();
+      provider = ndk::SharedRefBase::make<A2dpSoftwareEncodingAudioProvider>();
       break;
     case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
-      provider = ndk::SharedRefBase::make<A2dpOffloadAudioProvider>();
+      provider = ndk::SharedRefBase::make<A2dpOffloadEncodingAudioProvider>();
       break;
     case SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH:
       provider = ndk::SharedRefBase::make<HearingAidAudioProvider>();
@@ -72,6 +72,12 @@
       provider =
           ndk::SharedRefBase::make<LeAudioOffloadBroadcastAudioProvider>();
       break;
+    case SessionType::A2DP_SOFTWARE_DECODING_DATAPATH:
+      provider = ndk::SharedRefBase::make<A2dpSoftwareDecodingAudioProvider>();
+      break;
+    case SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH:
+      provider = ndk::SharedRefBase::make<A2dpOffloadDecodingAudioProvider>();
+      break;
     default:
       provider = nullptr;
       break;
@@ -90,7 +96,8 @@
 ndk::ScopedAStatus BluetoothAudioProviderFactory::getProviderCapabilities(
     const SessionType session_type,
     std::vector<AudioCapabilities>* _aidl_return) {
-  if (session_type == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+  if (session_type == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+      session_type == SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
     auto codec_capabilities =
         BluetoothAudioCodecs::GetA2dpOffloadCodecCapabilities(session_type);
     _aidl_return->resize(codec_capabilities.size());
diff --git a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
index 18352a0..b599365 100644
--- a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
+++ b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
@@ -201,7 +201,8 @@
         ASSERT_EQ(temp_provider_capabilities_[0].getTag(),
                   AudioCapabilities::pcmCapabilities);
       } break;
-      case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH: {
+      case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+      case SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH: {
         std::unordered_set<CodecType> codec_types;
         // empty capability means offload is unsupported
         for (auto& audio_capability : temp_provider_capabilities_) {
@@ -250,6 +251,16 @@
                     AudioCapabilities::leAudioCapabilities);
         }
       } break;
+      case SessionType::A2DP_SOFTWARE_DECODING_DATAPATH: {
+        if (!temp_provider_capabilities_.empty()) {
+          ASSERT_EQ(temp_provider_capabilities_.size(), 1);
+          ASSERT_EQ(temp_provider_capabilities_[0].getTag(),
+                    AudioCapabilities::pcmCapabilities);
+        }
+      } break;
+      default: {
+        ASSERT_TRUE(temp_provider_capabilities_.empty());
+      }
     }
   }
 
@@ -266,7 +277,7 @@
       ASSERT_NE(audio_provider_, nullptr);
       audio_port_ = ndk::SharedRefBase::make<BluetoothAudioPort>();
     } else {
-      // Hardware offloading is optional
+      // optional session type
       ASSERT_TRUE(
           session_type == SessionType::UNKNOWN ||
           session_type ==
@@ -277,147 +288,14 @@
               SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
           session_type ==
               SessionType::
-                  LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
+                  LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+          session_type ==
+              SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
+          session_type == SessionType::A2DP_SOFTWARE_DECODING_DATAPATH);
       ASSERT_EQ(audio_provider_, nullptr);
     }
   }
 
-  bool IsPcmConfigSupported(const PcmConfiguration& pcm_config) {
-    if (temp_provider_capabilities_.size() != 1 ||
-        temp_provider_capabilities_[0].getTag() !=
-            AudioCapabilities::pcmCapabilities) {
-      return false;
-    }
-    auto pcm_capability = temp_provider_capabilities_[0]
-                              .get<AudioCapabilities::pcmCapabilities>();
-    return (contained_in_vector(pcm_capability.channelMode,
-                                pcm_config.channelMode) &&
-            contained_in_vector(pcm_capability.sampleRateHz,
-                                pcm_config.sampleRateHz) &&
-            contained_in_vector(pcm_capability.bitsPerSample,
-                                pcm_config.bitsPerSample));
-  }
-
-  std::shared_ptr<IBluetoothAudioProviderFactory> provider_factory_;
-  std::shared_ptr<IBluetoothAudioProvider> audio_provider_;
-  std::shared_ptr<IBluetoothAudioPort> audio_port_;
-  std::vector<AudioCapabilities> temp_provider_capabilities_;
-
-  static constexpr SessionType kSessionTypes[] = {
-      SessionType::UNKNOWN,
-      SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH,
-      SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
-      SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
-      SessionType::LE_AUDIO_SOFTWARE_ENCODING_DATAPATH,
-      SessionType::LE_AUDIO_SOFTWARE_DECODING_DATAPATH,
-      SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
-      SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH,
-      SessionType::LE_AUDIO_BROADCAST_SOFTWARE_ENCODING_DATAPATH,
-      SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
-  };
-};
-
-/**
- * Test whether we can get the FactoryService from HIDL
- */
-TEST_P(BluetoothAudioProviderFactoryAidl, GetProviderFactoryService) {}
-
-/**
- * Test whether we can open a provider for each provider returned by
- * getProviderCapabilities() with non-empty capabalities
- */
-TEST_P(BluetoothAudioProviderFactoryAidl,
-       OpenProviderAndCheckCapabilitiesBySession) {
-  for (auto session_type : kSessionTypes) {
-    GetProviderCapabilitiesHelper(session_type);
-    OpenProviderHelper(session_type);
-    // We must be able to open a provider if its getProviderCapabilities()
-    // returns non-empty list.
-    EXPECT_TRUE(temp_provider_capabilities_.empty() ||
-                audio_provider_ != nullptr);
-  }
-}
-
-/**
- * openProvider A2DP_SOFTWARE_ENCODING_DATAPATH
- */
-class BluetoothAudioProviderA2dpSoftwareAidl
-    : public BluetoothAudioProviderFactoryAidl {
- public:
-  virtual void SetUp() override {
-    BluetoothAudioProviderFactoryAidl::SetUp();
-    GetProviderCapabilitiesHelper(SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH);
-    OpenProviderHelper(SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH);
-    ASSERT_NE(audio_provider_, nullptr);
-  }
-
-  virtual void TearDown() override {
-    audio_port_ = nullptr;
-    audio_provider_ = nullptr;
-    BluetoothAudioProviderFactoryAidl::TearDown();
-  }
-};
-
-/**
- * Test whether we can open a provider of type
- */
-TEST_P(BluetoothAudioProviderA2dpSoftwareAidl, OpenA2dpSoftwareProvider) {}
-
-/**
- * Test whether each provider of type
- * SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH can be started and stopped with
- * different PCM config
- */
-TEST_P(BluetoothAudioProviderA2dpSoftwareAidl,
-       StartAndEndA2dpSoftwareSessionWithPossiblePcmConfig) {
-  for (auto sample_rate : a2dp_sample_rates) {
-    for (auto bits_per_sample : a2dp_bits_per_samples) {
-      for (auto channel_mode : a2dp_channel_modes) {
-        PcmConfiguration pcm_config{
-            .sampleRateHz = sample_rate,
-            .bitsPerSample = bits_per_sample,
-            .channelMode = channel_mode,
-        };
-        bool is_codec_config_valid = IsPcmConfigSupported(pcm_config);
-        DataMQDesc mq_desc;
-        auto aidl_retval = audio_provider_->startSession(
-            audio_port_, AudioConfiguration(pcm_config), latency_modes,
-            &mq_desc);
-        DataMQ data_mq(mq_desc);
-
-        EXPECT_EQ(aidl_retval.isOk(), is_codec_config_valid);
-        if (is_codec_config_valid) {
-          EXPECT_TRUE(data_mq.isValid());
-        }
-        EXPECT_TRUE(audio_provider_->endSession().isOk());
-      }
-    }
-  }
-}
-
-/**
- * openProvider A2DP_HARDWARE_OFFLOAD_DATAPATH
- */
-class BluetoothAudioProviderA2dpHardwareAidl
-    : public BluetoothAudioProviderFactoryAidl {
- public:
-  virtual void SetUp() override {
-    BluetoothAudioProviderFactoryAidl::SetUp();
-    GetProviderCapabilitiesHelper(
-        SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
-    OpenProviderHelper(SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
-    ASSERT_TRUE(temp_provider_capabilities_.empty() ||
-                audio_provider_ != nullptr);
-  }
-
-  virtual void TearDown() override {
-    audio_port_ = nullptr;
-    audio_provider_ = nullptr;
-    BluetoothAudioProviderFactoryAidl::TearDown();
-  }
-
-  bool IsOffloadSupported() { return (temp_provider_capabilities_.size() > 0); }
-
   void GetA2dpOffloadCapabilityHelper(const CodecType& codec_type) {
     temp_codec_capabilities_ = nullptr;
     for (auto& codec_capability : temp_provider_capabilities_) {
@@ -641,23 +519,163 @@
     return lc3_codec_specifics;
   }
 
+  bool IsPcmConfigSupported(const PcmConfiguration& pcm_config) {
+    if (temp_provider_capabilities_.size() != 1 ||
+        temp_provider_capabilities_[0].getTag() !=
+            AudioCapabilities::pcmCapabilities) {
+      return false;
+    }
+    auto pcm_capability = temp_provider_capabilities_[0]
+                              .get<AudioCapabilities::pcmCapabilities>();
+    return (contained_in_vector(pcm_capability.channelMode,
+                                pcm_config.channelMode) &&
+            contained_in_vector(pcm_capability.sampleRateHz,
+                                pcm_config.sampleRateHz) &&
+            contained_in_vector(pcm_capability.bitsPerSample,
+                                pcm_config.bitsPerSample));
+  }
+
+  std::shared_ptr<IBluetoothAudioProviderFactory> provider_factory_;
+  std::shared_ptr<IBluetoothAudioProvider> audio_provider_;
+  std::shared_ptr<IBluetoothAudioPort> audio_port_;
+  std::vector<AudioCapabilities> temp_provider_capabilities_;
+
   // temp storage saves the specified codec capability by
   // GetOffloadCodecCapabilityHelper()
   CodecCapabilities* temp_codec_capabilities_;
+
+  static constexpr SessionType kSessionTypes[] = {
+      SessionType::UNKNOWN,
+      SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH,
+      SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
+      SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
+      SessionType::LE_AUDIO_SOFTWARE_ENCODING_DATAPATH,
+      SessionType::LE_AUDIO_SOFTWARE_DECODING_DATAPATH,
+      SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
+      SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH,
+      SessionType::LE_AUDIO_BROADCAST_SOFTWARE_ENCODING_DATAPATH,
+      SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH,
+      SessionType::A2DP_SOFTWARE_DECODING_DATAPATH,
+      SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH,
+  };
+};
+
+/**
+ * Test whether we can get the FactoryService from HIDL
+ */
+TEST_P(BluetoothAudioProviderFactoryAidl, GetProviderFactoryService) {}
+
+/**
+ * Test whether we can open a provider for each provider returned by
+ * getProviderCapabilities() with non-empty capabalities
+ */
+TEST_P(BluetoothAudioProviderFactoryAidl,
+       OpenProviderAndCheckCapabilitiesBySession) {
+  for (auto session_type : kSessionTypes) {
+    GetProviderCapabilitiesHelper(session_type);
+    OpenProviderHelper(session_type);
+    // We must be able to open a provider if its getProviderCapabilities()
+    // returns non-empty list.
+    EXPECT_TRUE(temp_provider_capabilities_.empty() ||
+                audio_provider_ != nullptr);
+  }
+}
+
+/**
+ * openProvider A2DP_SOFTWARE_ENCODING_DATAPATH
+ */
+class BluetoothAudioProviderA2dpEncodingSoftwareAidl
+    : public BluetoothAudioProviderFactoryAidl {
+ public:
+  virtual void SetUp() override {
+    BluetoothAudioProviderFactoryAidl::SetUp();
+    GetProviderCapabilitiesHelper(SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH);
+    OpenProviderHelper(SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH);
+    ASSERT_NE(audio_provider_, nullptr);
+  }
+
+  virtual void TearDown() override {
+    audio_port_ = nullptr;
+    audio_provider_ = nullptr;
+    BluetoothAudioProviderFactoryAidl::TearDown();
+  }
 };
 
 /**
  * Test whether we can open a provider of type
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl, OpenA2dpHardwareProvider) {}
+TEST_P(BluetoothAudioProviderA2dpEncodingSoftwareAidl,
+       OpenA2dpEncodingSoftwareProvider) {}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH can be started and stopped with
+ * different PCM config
+ */
+TEST_P(BluetoothAudioProviderA2dpEncodingSoftwareAidl,
+       StartAndEndA2dpEncodingSoftwareSessionWithPossiblePcmConfig) {
+  for (auto sample_rate : a2dp_sample_rates) {
+    for (auto bits_per_sample : a2dp_bits_per_samples) {
+      for (auto channel_mode : a2dp_channel_modes) {
+        PcmConfiguration pcm_config{
+            .sampleRateHz = sample_rate,
+            .bitsPerSample = bits_per_sample,
+            .channelMode = channel_mode,
+        };
+        bool is_codec_config_valid = IsPcmConfigSupported(pcm_config);
+        DataMQDesc mq_desc;
+        auto aidl_retval = audio_provider_->startSession(
+            audio_port_, AudioConfiguration(pcm_config), latency_modes,
+            &mq_desc);
+        DataMQ data_mq(mq_desc);
+
+        EXPECT_EQ(aidl_retval.isOk(), is_codec_config_valid);
+        if (is_codec_config_valid) {
+          EXPECT_TRUE(data_mq.isValid());
+        }
+        EXPECT_TRUE(audio_provider_->endSession().isOk());
+      }
+    }
+  }
+}
+
+/**
+ * openProvider A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH
+ */
+class BluetoothAudioProviderA2dpEncodingHardwareAidl
+    : public BluetoothAudioProviderFactoryAidl {
+ public:
+  virtual void SetUp() override {
+    BluetoothAudioProviderFactoryAidl::SetUp();
+    GetProviderCapabilitiesHelper(
+        SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
+    OpenProviderHelper(SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
+    ASSERT_TRUE(temp_provider_capabilities_.empty() ||
+                audio_provider_ != nullptr);
+  }
+
+  virtual void TearDown() override {
+    audio_port_ = nullptr;
+    audio_provider_ = nullptr;
+    BluetoothAudioProviderFactoryAidl::TearDown();
+  }
+
+  bool IsOffloadSupported() { return (temp_provider_capabilities_.size() > 0); }
+};
+
+/**
+ * Test whether we can open a provider of type
+ */
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       OpenA2dpEncodingHardwareProvider) {}
 
 /**
  * Test whether each provider of type
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * SBC hardware encoding config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpSbcHardwareSession) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpSbcEncodingHardwareSession) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -686,8 +704,8 @@
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * AAC hardware encoding config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpAacHardwareSession) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpAacEncodingHardwareSession) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -716,8 +734,8 @@
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * LDAC hardware encoding config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpLdacHardwareSession) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpLdacEncodingHardwareSession) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -746,8 +764,8 @@
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * LDAC hardware encoding config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpLc3HardwareSession) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpLc3EncodingHardwareSession) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -776,8 +794,8 @@
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * AptX hardware encoding config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpAptxHardwareSession) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpAptxEncodingHardwareSession) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -812,8 +830,8 @@
  * SessionType::A2DP_HARDWARE_ENCODING_DATAPATH can be started and stopped with
  * an invalid codec config
  */
-TEST_P(BluetoothAudioProviderA2dpHardwareAidl,
-       StartAndEndA2dpHardwareSessionInvalidCodecConfig) {
+TEST_P(BluetoothAudioProviderA2dpEncodingHardwareAidl,
+       StartAndEndA2dpEncodingHardwareSessionInvalidCodecConfig) {
   if (!IsOffloadSupported()) {
     return;
   }
@@ -1588,6 +1606,314 @@
   }
 }
 
+/**
+ * openProvider A2DP_SOFTWARE_DECODING_DATAPATH
+ */
+class BluetoothAudioProviderA2dpDecodingSoftwareAidl
+    : public BluetoothAudioProviderFactoryAidl {
+ public:
+  virtual void SetUp() override {
+    BluetoothAudioProviderFactoryAidl::SetUp();
+    GetProviderCapabilitiesHelper(SessionType::A2DP_SOFTWARE_DECODING_DATAPATH);
+    OpenProviderHelper(SessionType::A2DP_SOFTWARE_DECODING_DATAPATH);
+    ASSERT_TRUE(temp_provider_capabilities_.empty() ||
+                audio_provider_ != nullptr);
+  }
+
+  virtual void TearDown() override {
+    audio_port_ = nullptr;
+    audio_provider_ = nullptr;
+    BluetoothAudioProviderFactoryAidl::TearDown();
+  }
+};
+
+/**
+ * Test whether we can open a provider of type
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingSoftwareAidl,
+       OpenA2dpDecodingSoftwareProvider) {}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_SOFTWARE_DECODING_DATAPATH can be started and stopped with
+ * different PCM config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingSoftwareAidl,
+       StartAndEndA2dpDecodingSoftwareSessionWithPossiblePcmConfig) {
+  for (auto sample_rate : a2dp_sample_rates) {
+    for (auto bits_per_sample : a2dp_bits_per_samples) {
+      for (auto channel_mode : a2dp_channel_modes) {
+        PcmConfiguration pcm_config{
+            .sampleRateHz = sample_rate,
+            .bitsPerSample = bits_per_sample,
+            .channelMode = channel_mode,
+        };
+        bool is_codec_config_valid = IsPcmConfigSupported(pcm_config);
+        DataMQDesc mq_desc;
+        auto aidl_retval = audio_provider_->startSession(
+            audio_port_, AudioConfiguration(pcm_config), latency_modes,
+            &mq_desc);
+        DataMQ data_mq(mq_desc);
+
+        EXPECT_EQ(aidl_retval.isOk(), is_codec_config_valid);
+        if (is_codec_config_valid) {
+          EXPECT_TRUE(data_mq.isValid());
+        }
+        EXPECT_TRUE(audio_provider_->endSession().isOk());
+      }
+    }
+  }
+}
+
+/**
+ * openProvider A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH
+ */
+class BluetoothAudioProviderA2dpDecodingHardwareAidl
+    : public BluetoothAudioProviderFactoryAidl {
+ public:
+  virtual void SetUp() override {
+    BluetoothAudioProviderFactoryAidl::SetUp();
+    GetProviderCapabilitiesHelper(
+        SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH);
+    OpenProviderHelper(SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH);
+    ASSERT_TRUE(temp_provider_capabilities_.empty() ||
+                audio_provider_ != nullptr);
+  }
+
+  virtual void TearDown() override {
+    audio_port_ = nullptr;
+    audio_provider_ = nullptr;
+    BluetoothAudioProviderFactoryAidl::TearDown();
+  }
+
+  bool IsOffloadSupported() { return (temp_provider_capabilities_.size() > 0); }
+};
+
+/**
+ * Test whether we can open a provider of type
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       OpenA2dpDecodingHardwareProvider) {}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * SBC hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpSbcDecodingHardwareSession) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+
+  CodecConfiguration codec_config = {
+      .codecType = CodecType::SBC,
+      .encodedAudioBitrate = 328000,
+      .peerMtu = 1005,
+      .isScmstEnabled = false,
+  };
+  auto sbc_codec_specifics = GetSbcCodecSpecificSupportedList(true);
+
+  for (auto& codec_specific : sbc_codec_specifics) {
+    copy_codec_specific(codec_config.config, codec_specific);
+    DataMQDesc mq_desc;
+    auto aidl_retval = audio_provider_->startSession(
+        audio_port_, AudioConfiguration(codec_config), latency_modes, &mq_desc);
+
+    ASSERT_TRUE(aidl_retval.isOk());
+    EXPECT_TRUE(audio_provider_->endSession().isOk());
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * AAC hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpAacDecodingHardwareSession) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+
+  CodecConfiguration codec_config = {
+      .codecType = CodecType::AAC,
+      .encodedAudioBitrate = 320000,
+      .peerMtu = 1005,
+      .isScmstEnabled = false,
+  };
+  auto aac_codec_specifics = GetAacCodecSpecificSupportedList(true);
+
+  for (auto& codec_specific : aac_codec_specifics) {
+    copy_codec_specific(codec_config.config, codec_specific);
+    DataMQDesc mq_desc;
+    auto aidl_retval = audio_provider_->startSession(
+        audio_port_, AudioConfiguration(codec_config), latency_modes, &mq_desc);
+
+    ASSERT_TRUE(aidl_retval.isOk());
+    EXPECT_TRUE(audio_provider_->endSession().isOk());
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * LDAC hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpLdacDecodingHardwareSession) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+
+  CodecConfiguration codec_config = {
+      .codecType = CodecType::LDAC,
+      .encodedAudioBitrate = 990000,
+      .peerMtu = 1005,
+      .isScmstEnabled = false,
+  };
+  auto ldac_codec_specifics = GetLdacCodecSpecificSupportedList(true);
+
+  for (auto& codec_specific : ldac_codec_specifics) {
+    copy_codec_specific(codec_config.config, codec_specific);
+    DataMQDesc mq_desc;
+    auto aidl_retval = audio_provider_->startSession(
+        audio_port_, AudioConfiguration(codec_config), latency_modes, &mq_desc);
+
+    ASSERT_TRUE(aidl_retval.isOk());
+    EXPECT_TRUE(audio_provider_->endSession().isOk());
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * LDAC hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpLc3DecodingHardwareSession) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+
+  CodecConfiguration codec_config = {
+      .codecType = CodecType::LC3,
+      .encodedAudioBitrate = 990000,
+      .peerMtu = 1005,
+      .isScmstEnabled = false,
+  };
+  auto lc3_codec_specifics = GetLc3CodecSpecificSupportedList(true);
+
+  for (auto& codec_specific : lc3_codec_specifics) {
+    copy_codec_specific(codec_config.config, codec_specific);
+    DataMQDesc mq_desc;
+    auto aidl_retval = audio_provider_->startSession(
+        audio_port_, AudioConfiguration(codec_config), latency_modes, &mq_desc);
+
+    ASSERT_TRUE(aidl_retval.isOk());
+    EXPECT_TRUE(audio_provider_->endSession().isOk());
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * AptX hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpAptxDecodingHardwareSession) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+
+  for (auto codec_type : {CodecType::APTX, CodecType::APTX_HD}) {
+    CodecConfiguration codec_config = {
+        .codecType = codec_type,
+        .encodedAudioBitrate =
+            (codec_type == CodecType::APTX ? 352000 : 576000),
+        .peerMtu = 1005,
+        .isScmstEnabled = false,
+    };
+
+    auto aptx_codec_specifics = GetAptxCodecSpecificSupportedList(
+        (codec_type == CodecType::APTX_HD ? true : false), true);
+
+    for (auto& codec_specific : aptx_codec_specifics) {
+      copy_codec_specific(codec_config.config, codec_specific);
+      DataMQDesc mq_desc;
+      auto aidl_retval = audio_provider_->startSession(
+          audio_port_, AudioConfiguration(codec_config), latency_modes,
+          &mq_desc);
+
+      ASSERT_TRUE(aidl_retval.isOk());
+      EXPECT_TRUE(audio_provider_->endSession().isOk());
+    }
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::A2DP_HARDWARE_DECODING_DATAPATH can be started and stopped with
+ * an invalid codec config
+ */
+TEST_P(BluetoothAudioProviderA2dpDecodingHardwareAidl,
+       StartAndEndA2dpDecodingHardwareSessionInvalidCodecConfig) {
+  if (!IsOffloadSupported()) {
+    return;
+  }
+  ASSERT_NE(audio_provider_, nullptr);
+
+  std::vector<CodecConfiguration::CodecSpecific> codec_specifics;
+  for (auto codec_type : a2dp_codec_types) {
+    switch (codec_type) {
+      case CodecType::SBC:
+        codec_specifics = GetSbcCodecSpecificSupportedList(false);
+        break;
+      case CodecType::AAC:
+        codec_specifics = GetAacCodecSpecificSupportedList(false);
+        break;
+      case CodecType::LDAC:
+        codec_specifics = GetLdacCodecSpecificSupportedList(false);
+        break;
+      case CodecType::APTX:
+        codec_specifics = GetAptxCodecSpecificSupportedList(false, false);
+        break;
+      case CodecType::APTX_HD:
+        codec_specifics = GetAptxCodecSpecificSupportedList(true, false);
+        break;
+      case CodecType::LC3:
+        codec_specifics = GetLc3CodecSpecificSupportedList(false);
+        continue;
+      case CodecType::APTX_ADAPTIVE:
+      case CodecType::VENDOR:
+      case CodecType::UNKNOWN:
+        codec_specifics.clear();
+        break;
+    }
+    if (codec_specifics.empty()) {
+      continue;
+    }
+
+    CodecConfiguration codec_config = {
+        .codecType = codec_type,
+        .encodedAudioBitrate = 328000,
+        .peerMtu = 1005,
+        .isScmstEnabled = false,
+    };
+    for (auto codec_specific : codec_specifics) {
+      copy_codec_specific(codec_config.config, codec_specific);
+      DataMQDesc mq_desc;
+      auto aidl_retval = audio_provider_->startSession(
+          audio_port_, AudioConfiguration(codec_config), latency_modes,
+          &mq_desc);
+
+      // AIDL call should fail on invalid codec
+      ASSERT_FALSE(aidl_retval.isOk());
+      EXPECT_TRUE(audio_provider_->endSession().isOk());
+    }
+  }
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(
     BluetoothAudioProviderFactoryAidl);
 INSTANTIATE_TEST_SUITE_P(PerInstance, BluetoothAudioProviderFactoryAidl,
@@ -1596,15 +1922,17 @@
                          android::PrintInstanceNameToString);
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(
-    BluetoothAudioProviderA2dpSoftwareAidl);
-INSTANTIATE_TEST_SUITE_P(PerInstance, BluetoothAudioProviderA2dpSoftwareAidl,
+    BluetoothAudioProviderA2dpEncodingSoftwareAidl);
+INSTANTIATE_TEST_SUITE_P(PerInstance,
+                         BluetoothAudioProviderA2dpEncodingSoftwareAidl,
                          testing::ValuesIn(android::getAidlHalInstanceNames(
                              IBluetoothAudioProviderFactory::descriptor)),
                          android::PrintInstanceNameToString);
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(
-    BluetoothAudioProviderA2dpHardwareAidl);
-INSTANTIATE_TEST_SUITE_P(PerInstance, BluetoothAudioProviderA2dpHardwareAidl,
+    BluetoothAudioProviderA2dpEncodingHardwareAidl);
+INSTANTIATE_TEST_SUITE_P(PerInstance,
+                         BluetoothAudioProviderA2dpEncodingHardwareAidl,
                          testing::ValuesIn(android::getAidlHalInstanceNames(
                              IBluetoothAudioProviderFactory::descriptor)),
                          android::PrintInstanceNameToString);
@@ -1665,6 +1993,22 @@
                              IBluetoothAudioProviderFactory::descriptor)),
                          android::PrintInstanceNameToString);
 
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(
+    BluetoothAudioProviderA2dpDecodingSoftwareAidl);
+INSTANTIATE_TEST_SUITE_P(PerInstance,
+                         BluetoothAudioProviderA2dpDecodingSoftwareAidl,
+                         testing::ValuesIn(android::getAidlHalInstanceNames(
+                             IBluetoothAudioProviderFactory::descriptor)),
+                         android::PrintInstanceNameToString);
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(
+    BluetoothAudioProviderA2dpDecodingHardwareAidl);
+INSTANTIATE_TEST_SUITE_P(PerInstance,
+                         BluetoothAudioProviderA2dpDecodingHardwareAidl,
+                         testing::ValuesIn(android::getAidlHalInstanceNames(
+                             IBluetoothAudioProviderFactory::descriptor)),
+                         android::PrintInstanceNameToString);
+
 int main(int argc, char** argv) {
   ::testing::InitGoogleTest(&argc, argv);
   ABinderProcess_setThreadPoolMaxThreadCount(1);
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
index 8fd1ab5..fc54c70 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
@@ -323,7 +323,8 @@
 std::vector<CodecCapabilities>
 BluetoothAudioCodecs::GetA2dpOffloadCodecCapabilities(
     const SessionType& session_type) {
-  if (session_type != SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+  if (session_type != SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH &&
+      session_type != SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
     return {};
   }
   std::vector<CodecCapabilities> offload_a2dp_codec_capabilities =
@@ -389,7 +390,8 @@
 
 bool BluetoothAudioCodecs::IsOffloadCodecConfigurationValid(
     const SessionType& session_type, const CodecConfiguration& codec_config) {
-  if (session_type != SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+  if (session_type != SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH &&
+      session_type != SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
     LOG(ERROR) << __func__
                << ": Invalid SessionType=" << toString(session_type);
     return false;
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
index cdee520..3214bf2 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
@@ -92,6 +92,7 @@
   if (!IsSessionReady()) {
     switch (session_type_) {
       case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+      case SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH:
         return AudioConfiguration(CodecConfiguration{});
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
@@ -143,6 +144,7 @@
            SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
        session_type_ ==
            SessionType::LE_AUDIO_BROADCAST_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+       session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
        (data_mq_ != nullptr && data_mq_->isValid()));
   return stack_iface_ != nullptr && is_mq_valid && audio_config_ != nullptr;
 }
@@ -267,9 +269,11 @@
        session_type_ == SessionType::LE_AUDIO_SOFTWARE_DECODING_DATAPATH ||
        session_type_ == SessionType::LE_AUDIO_SOFTWARE_ENCODING_DATAPATH ||
        session_type_ ==
-           SessionType::LE_AUDIO_BROADCAST_SOFTWARE_ENCODING_DATAPATH);
+           SessionType::LE_AUDIO_BROADCAST_SOFTWARE_ENCODING_DATAPATH ||
+       session_type_ == SessionType::A2DP_SOFTWARE_DECODING_DATAPATH);
   bool is_offload_a2dp_session =
-      (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH);
+      (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+       session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH);
   bool is_offload_le_audio_session =
       (session_type_ ==
            SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
@@ -468,7 +472,9 @@
   LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_) << ","
             << track_count << " track(s)";
   if (session_type_ == SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH ||
-      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+      session_type_ == SessionType::A2DP_SOFTWARE_DECODING_DATAPATH ||
+      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
     return;
   }
 
@@ -509,7 +515,9 @@
   LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_) << ","
             << track_count << " track(s)";
   if (session_type_ == SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH ||
-      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH ||
+      session_type_ == SessionType::A2DP_SOFTWARE_DECODING_DATAPATH ||
+      session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH) {
     return;
   }
 
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
index 5b838b0..0782c82 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
@@ -82,6 +82,7 @@
     }
     switch (session_type) {
       case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+      case SessionType::A2DP_HARDWARE_OFFLOAD_DECODING_DATAPATH:
         return AudioConfiguration(CodecConfiguration{});
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
diff --git a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
index 0bab54c..5cdea93 100644
--- a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
+++ b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
@@ -783,7 +783,7 @@
         vector<Certificate> attested_key_cert_chain;
         auto result = GenerateKey(builder, attest_key, &attested_key_blob,
                                   &attested_key_characteristics, &attested_key_cert_chain);
-        if (result == ErrorCode::CANNOT_ATTEST_IDS) {
+        if (result == ErrorCode::CANNOT_ATTEST_IDS && !isDeviceIdAttestationRequired()) {
             continue;
         }
 
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index f9510d3..943c692 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -207,6 +207,14 @@
     return boot_patch_level(key_characteristics_);
 }
 
+/**
+ * An API to determine device IDs attestation is required or not,
+ * which is mandatory for KeyMint version 2 or first_api_level 33 or greater.
+ */
+bool KeyMintAidlTestBase::isDeviceIdAttestationRequired() {
+    return AidlVersion() >= 2 || property_get_int32("ro.vendor.api_level", 0) >= 33;
+}
+
 bool KeyMintAidlTestBase::Curve25519Supported() {
     // Strongbox never supports curve 25519.
     if (SecLevel() == SecurityLevel::STRONGBOX) {
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
index 602dcaf..7279c95 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
@@ -79,6 +79,7 @@
     uint32_t vendor_patch_level() { return vendor_patch_level_; }
     uint32_t boot_patch_level(const vector<KeyCharacteristics>& key_characteristics);
     uint32_t boot_patch_level();
+    bool isDeviceIdAttestationRequired();
 
     bool Curve25519Supported();
 
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 3aa09fa..e73f46c 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -1986,8 +1986,8 @@
         if (SecLevel() == SecurityLevel::STRONGBOX) {
             if (result == ErrorCode::ATTESTATION_KEYS_NOT_PROVISIONED) return;
         }
-        if (result == ErrorCode::CANNOT_ATTEST_IDS) {
-            // Device ID attestation is optional; KeyMint may not support it at all.
+        if (result == ErrorCode::CANNOT_ATTEST_IDS && !isDeviceIdAttestationRequired()) {
+            // ID attestation was optional till api level 32, from api level 33 it is mandatory.
             continue;
         }
         ASSERT_EQ(result, ErrorCode::OK);
diff --git a/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp b/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
index abb80a2..3841715 100644
--- a/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
+++ b/vibrator/aidl/vts/VtsHalVibratorTargetTest.cpp
@@ -196,7 +196,7 @@
     active.startFrequency = frequencyHz;
     active.endAmplitude = (getAmplitudeMin() + getAmplitudeMax()) / 2;
     active.endFrequency = frequencyHz;
-    active.duration = 1000;
+    vibrator->getPwlePrimitiveDurationMax(&(active.duration));
 
     return active;
 }
@@ -759,7 +759,9 @@
     std::future<void> completionFuture{completionPromise.get_future()};
     sp<CompletionCallback> callback =
         new CompletionCallback([&completionPromise] { completionPromise.set_value(); });
-    uint32_t durationMs = 2100;  // Sum of 2 active and 1 braking below
+    int32_t segmentDurationMaxMs;
+    vibrator->getPwlePrimitiveDurationMax(&segmentDurationMaxMs);
+    uint32_t durationMs = segmentDurationMaxMs * 2 + 100;  // Sum of 2 active and 1 braking below
     //TODO(b/187207798): revert back to conservative timeout values once
     //latencies have been fixed
     std::chrono::milliseconds timeout{durationMs * 4};
@@ -863,7 +865,7 @@
     if (capabilities & IVibrator::CAP_COMPOSE_PWLE_EFFECTS) {
         ActivePwle active = composeValidActivePwle(vibrator, capabilities);
 
-        int segmentDurationMaxMs;
+        int32_t segmentDurationMaxMs;
         vibrator->getPwlePrimitiveDurationMax(&segmentDurationMaxMs);
         active.duration = segmentDurationMaxMs + 10;  // Segment duration greater than allowed
 
diff --git a/wifi/1.6/default/hidl_struct_util.cpp b/wifi/1.6/default/hidl_struct_util.cpp
index 45459e2..2112b26 100644
--- a/wifi/1.6/default/hidl_struct_util.cpp
+++ b/wifi/1.6/default/hidl_struct_util.cpp
@@ -1881,7 +1881,7 @@
                       "ifaceName too long";
         return false;
     }
-    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    strlcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
     legacy_request->ndp_cfg.security_cfg =
             (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
                     ? legacy_hal::NAN_DP_CONFIG_SECURITY
@@ -1958,7 +1958,7 @@
                       "ifaceName too long";
         return false;
     }
-    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    strlcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
     legacy_request->ndp_cfg.security_cfg =
             (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
                     ? legacy_hal::NAN_DP_CONFIG_SECURITY
@@ -2039,7 +2039,7 @@
                       "ifaceName too long";
         return false;
     }
-    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    strlcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
     legacy_request->ndp_cfg.security_cfg =
             (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
                     ? legacy_hal::NAN_DP_CONFIG_SECURITY
@@ -2114,7 +2114,7 @@
                       "ifaceName too long";
         return false;
     }
-    strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
+    strlcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), IFNAMSIZ + 1);
     legacy_request->ndp_cfg.security_cfg =
             (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN)
                     ? legacy_hal::NAN_DP_CONFIG_SECURITY
diff --git a/wifi/1.6/default/wifi_chip.cpp b/wifi/1.6/default/wifi_chip.cpp
index 6cc1235..7f0e97d 100644
--- a/wifi/1.6/default/wifi_chip.cpp
+++ b/wifi/1.6/default/wifi_chip.cpp
@@ -131,7 +131,7 @@
     if (strncmp(buffer.data(), P2P_MGMT_DEVICE_PREFIX, strlen(P2P_MGMT_DEVICE_PREFIX)) == 0) {
         /* Get the p2p parent interface name from p2p device interface name set
          * in property */
-        strncpy(p2pParentIfname, buffer.data() + strlen(P2P_MGMT_DEVICE_PREFIX),
+        strlcpy(p2pParentIfname, buffer.data() + strlen(P2P_MGMT_DEVICE_PREFIX),
                 strlen(buffer.data()) - strlen(P2P_MGMT_DEVICE_PREFIX));
         if (property_get(kActiveWlanIfaceNameProperty, primaryIfaceName.data(), nullptr) == 0) {
             return buffer.data();
@@ -217,14 +217,15 @@
 
 // Helper function for |cpioArchiveFilesInDir|
 bool cpioWriteHeader(int out_fd, struct stat& st, const char* file_name, size_t file_name_len) {
-    std::array<char, 32 * 1024> read_buf;
-    ssize_t llen =
-            sprintf(read_buf.data(), "%s%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X",
-                    kCpioMagic, static_cast<int>(st.st_ino), st.st_mode, st.st_uid, st.st_gid,
-                    static_cast<int>(st.st_nlink), static_cast<int>(st.st_mtime),
-                    static_cast<int>(st.st_size), major(st.st_dev), minor(st.st_dev),
-                    major(st.st_rdev), minor(st.st_rdev), static_cast<uint32_t>(file_name_len), 0);
-    if (write(out_fd, read_buf.data(), llen) == -1) {
+    const int buf_size = 32 * 1024;
+    std::array<char, buf_size> read_buf;
+    ssize_t llen = snprintf(
+            read_buf.data(), buf_size, "%s%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X%08X",
+            kCpioMagic, static_cast<int>(st.st_ino), st.st_mode, st.st_uid, st.st_gid,
+            static_cast<int>(st.st_nlink), static_cast<int>(st.st_mtime),
+            static_cast<int>(st.st_size), major(st.st_dev), minor(st.st_dev), major(st.st_rdev),
+            minor(st.st_rdev), static_cast<uint32_t>(file_name_len), 0);
+    if (write(out_fd, read_buf.data(), llen < buf_size ? llen : buf_size - 1) == -1) {
         PLOG(ERROR) << "Error writing cpio header to file " << file_name;
         return false;
     }
@@ -282,10 +283,11 @@
 
 // Helper function for |cpioArchiveFilesInDir|
 bool cpioWriteFileTrailer(int out_fd) {
-    std::array<char, 4096> read_buf;
+    const int buf_size = 4096;
+    std::array<char, buf_size> read_buf;
     read_buf.fill(0);
-    if (write(out_fd, read_buf.data(),
-              sprintf(read_buf.data(), "070701%040X%056X%08XTRAILER!!!", 1, 0x0b, 0) + 4) == -1) {
+    ssize_t llen = snprintf(read_buf.data(), 4096, "070701%040X%056X%08XTRAILER!!!", 1, 0x0b, 0);
+    if (write(out_fd, read_buf.data(), (llen < buf_size ? llen : buf_size - 1) + 4) == -1) {
         PLOG(ERROR) << "Error writing trailing bytes";
         return false;
     }
diff --git a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
index c1f2bb7..bd2649f 100644
--- a/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
+++ b/wifi/hostapd/aidl/vts/functional/VtsHalHostapdTargetTest.cpp
@@ -32,6 +32,7 @@
 
 using aidl::android::hardware::wifi::hostapd::BandMask;
 using aidl::android::hardware::wifi::hostapd::BnHostapdCallback;
+using aidl::android::hardware::wifi::hostapd::ChannelBandwidth;
 using aidl::android::hardware::wifi::hostapd::ChannelParams;
 using aidl::android::hardware::wifi::hostapd::DebugLevel;
 using aidl::android::hardware::wifi::hostapd::EncryptionType;
@@ -44,7 +45,6 @@
 
 namespace {
 const unsigned char kNwSsid[] = {'t', 'e', 's', 't', '1', '2', '3', '4', '5'};
-const std::string kIfaceName = "wlan0";
 const std::string kPassphrase = "test12345";
 const std::string kInvalidMinPassphrase = "test";
 const std::string kInvalidMaxPassphrase =
@@ -123,6 +123,7 @@
         iface_params.hwModeParams.enable80211AC = false;
         iface_params.hwModeParams.enable80211AX = false;
         iface_params.hwModeParams.enable6GhzBand = false;
+        iface_params.hwModeParams.maximumChannelBandwidth = ChannelBandwidth::BANDWIDTH_20;
 
         channelParams.enableAcs = false;
         channelParams.acsShouldExcludeDfs = false;
@@ -284,8 +285,8 @@
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithAcs) {
     if (!isAcsSupport) GTEST_SKIP() << "Missing ACS support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(kIfaceName),
-                                          getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(ifname), getPskNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -295,8 +296,9 @@
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithAcsAndFreqRange) {
     if (!isAcsSupport) GTEST_SKIP() << "Missing ACS support";
-    auto status = hostapd->addAccessPoint(
-        getIfaceParamsWithAcsAndFreqRange(kIfaceName), getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithAcsAndFreqRange(ifname), getPskNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -306,8 +308,9 @@
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithAcsAndInvalidFreqRange) {
     if (!isAcsSupport) GTEST_SKIP() << "Missing ACS support";
-    auto status = hostapd->addAccessPoint(
-        getIfaceParamsWithAcsAndInvalidFreqRange(kIfaceName), getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcsAndInvalidFreqRange(ifname),
+                                          getPskNwParams());
     EXPECT_FALSE(status.isOk());
 }
 
@@ -317,8 +320,8 @@
  */
 TEST_P(HostapdAidl, AddOpenAccessPointWithAcs) {
     if (!isAcsSupport) GTEST_SKIP() << "Missing ACS support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(kIfaceName),
-                                          getOpenNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(ifname), getOpenNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -327,8 +330,8 @@
  * Access point creation should pass.
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithoutAcs) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getPskNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -337,7 +340,8 @@
  * Access point creation should pass.
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithoutAcsAndNonMetered) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname),
                                           getPskNwParamsWithNonMetered());
     EXPECT_TRUE(status.isOk());
 }
@@ -347,8 +351,8 @@
  * Access point creation should pass.
  */
 TEST_P(HostapdAidl, AddOpenAccessPointWithoutAcs) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getOpenNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getOpenNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -358,8 +362,9 @@
  */
 TEST_P(HostapdAidl, AddSaeTransitionAccessPointWithoutAcs) {
     if (!isWpa3SaeSupport) GTEST_SKIP() << "Missing SAE support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getSaeTransitionNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getSaeTransitionNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -369,8 +374,8 @@
  */
 TEST_P(HostapdAidl, AddSAEAccessPointWithoutAcs) {
     if (!isWpa3SaeSupport) GTEST_SKIP() << "Missing SAE support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getSaeNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getSaeNwParams());
     EXPECT_TRUE(status.isOk());
 }
 
@@ -380,10 +385,10 @@
  */
 TEST_P(HostapdAidl, RemoveAccessPointWithAcs) {
     if (!isAcsSupport) GTEST_SKIP() << "Missing ACS support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(kIfaceName),
-                                          getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithAcs(ifname), getPskNwParams());
     EXPECT_TRUE(status.isOk());
-    EXPECT_TRUE(hostapd->removeAccessPoint(kIfaceName).isOk());
+    EXPECT_TRUE(hostapd->removeAccessPoint(ifname).isOk());
 }
 
 /**
@@ -391,10 +396,10 @@
  * Access point creation & removal should pass.
  */
 TEST_P(HostapdAidl, RemoveAccessPointWithoutAcs) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getPskNwParams());
     EXPECT_TRUE(status.isOk());
-    EXPECT_TRUE(hostapd->removeAccessPoint(kIfaceName).isOk());
+    EXPECT_TRUE(hostapd->removeAccessPoint(ifname).isOk());
 }
 
 /**
@@ -402,8 +407,9 @@
  * Access point creation should fail.
  */
 TEST_P(HostapdAidl, AddPskAccessPointWithInvalidChannel) {
-    auto status = hostapd->addAccessPoint(
-        getIfaceParamsWithInvalidChannel(kIfaceName), getPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithInvalidChannel(ifname), getPskNwParams());
     EXPECT_FALSE(status.isOk());
 }
 
@@ -412,8 +418,9 @@
  * Access point creation should fail.
  */
 TEST_P(HostapdAidl, AddInvalidPskAccessPointWithoutAcs) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getInvalidPskNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getInvalidPskNwParams());
     EXPECT_FALSE(status.isOk());
 }
 
@@ -422,8 +429,9 @@
  * Access point creation should fail.
  */
 TEST_P(HostapdAidl, AddInvalidSaeTransitionAccessPointWithoutAcs) {
+    std::string ifname = setupApIfaceAndGetName(false);
     if (!isWpa3SaeSupport) GTEST_SKIP() << "Missing SAE support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname),
                                           getInvalidSaeTransitionNwParams());
     EXPECT_FALSE(status.isOk());
 }
@@ -433,9 +441,10 @@
  * Access point creation should fail.
  */
 TEST_P(HostapdAidl, AddInvalidSaeAccessPointWithoutAcs) {
+    std::string ifname = setupApIfaceAndGetName(false);
     if (!isWpa3SaeSupport) GTEST_SKIP() << "Missing SAE support";
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getInvalidSaeNwParams());
+    auto status =
+            hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getInvalidSaeNwParams());
     EXPECT_FALSE(status.isOk());
 }
 
@@ -443,12 +452,11 @@
  * forceClientDisconnect should fail when hotspot interface available.
  */
 TEST_P(HostapdAidl, DisconnectClientWhenIfacAvailable) {
-    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(kIfaceName),
-                                          getOpenNwParams());
+    std::string ifname = setupApIfaceAndGetName(false);
+    auto status = hostapd->addAccessPoint(getIfaceParamsWithoutAcs(ifname), getOpenNwParams());
     EXPECT_TRUE(status.isOk());
 
-    status = hostapd->forceClientDisconnect(kIfaceName, kTestZeroMacAddr,
-                                            kTestDisconnectReasonCode);
+    status = hostapd->forceClientDisconnect(ifname, kTestZeroMacAddr, kTestDisconnectReasonCode);
     EXPECT_FALSE(status.isOk());
 }