diff --git a/CleanSpec.mk b/CleanSpec.mk
index f04a390..00d0aa5 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -63,3 +63,4 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/android.hardware.tests*)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk/android.hardware.tests*)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp/android.hardware.graphics.allocator*)
+$(call add-clean-step, find $(PRODUCT_OUT)/system $(PRODUCT_OUT)/vendor -type f -name "android\.hardware\.configstore\@1\.1*" -print0 | xargs -0 rm -f)
diff --git a/automotive/audiocontrol/1.0/Android.bp b/automotive/audiocontrol/1.0/Android.bp
new file mode 100644
index 0000000..a967049
--- /dev/null
+++ b/automotive/audiocontrol/1.0/Android.bp
@@ -0,0 +1,23 @@
+// This file is autogenerated by hidl-gen -Landroidbp.
+
+hidl_interface {
+    name: "android.hardware.automotive.audiocontrol@1.0",
+    root: "android.hardware",
+    vndk: {
+        enabled: true,
+    },
+    srcs: [
+        "types.hal",
+        "IAudioControl.hal",
+        "IAudioControlCallback.hal",
+    ],
+    interfaces: [
+        "android.hidl.base@1.0",
+    ],
+    types: [
+        "AudioResult",
+        "ContextNumber",
+    ],
+    gen_java: true,
+}
+
diff --git a/automotive/audiocontrol/1.0/IAudioControl.hal b/automotive/audiocontrol/1.0/IAudioControl.hal
new file mode 100644
index 0000000..fe9ea8e
--- /dev/null
+++ b/automotive/audiocontrol/1.0/IAudioControl.hal
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.audiocontrol@1.0;
+
+import IAudioControlCallback;
+
+
+/**
+ * Interacts with the car's audio subsystem to manage audio sources and volumes
+ */
+interface IAudioControl {
+
+    /**
+     * Registers the required callback object so that we can be notified when the state
+     * of the car's audio system changes. This call must be made when the interface is
+     * initialized.
+     */
+    setCallback(IAudioControlCallback notificationObject)
+        generates (AudioResult result);
+
+
+    /**
+     * Called at startup once per context to get the mapping from ContextNumber to
+     * busAddress. This lets the car tell the framework to which physical output stream
+     * each context should be routed.
+     *
+     * For every context, a valid bus number (0 - num busses-1) must be returned. If an
+     * unrecognized contextNumber is encountered, then -1 shall be returned.
+     *
+     * Any context for which an invalid busNumber is returned must be routed to bus 0.
+     */
+    getBusForContext(uint32_t contextNumber)
+        generates (int32_t busNumber);
+
+
+    /**
+     * Control the right/left balance setting of the car speakers.
+     *
+     * This is intended to shift the speaker volume toward the right (+) or left (-) side of
+     * the car. 0.0 means "centered". +1.0 means fully right. -1.0 means fully left.
+     *
+     * A value outside the range -1 to 1 must be clamped by the implementation to the -1 to 1
+     * range.
+     */
+    oneway setBalanceTowardRight(float value);
+
+
+    /**
+     * Control the fore/aft fade setting of the car speakers.
+     *
+     * This is intended to shift the speaker volume toward the front (+) or back (-) of the car.
+     * 0.0 means "centered". +1.0 means fully forward. -1.0 means fully rearward.
+     *
+     * A value outside the range -1 to 1 must be clamped by the implementation to the -1 to 1
+     * range.
+     */
+    oneway setFadeTowardFront(float value);
+};
+
diff --git a/automotive/audiocontrol/1.0/IAudioControlCallback.hal b/automotive/audiocontrol/1.0/IAudioControlCallback.hal
new file mode 100644
index 0000000..f5c227e
--- /dev/null
+++ b/automotive/audiocontrol/1.0/IAudioControlCallback.hal
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.audiocontrol@1.0;
+
+
+/**
+ * Implemented on client (framework) side to receive asynchronous updates from the car.
+ */
+interface IAudioControlCallback {
+
+    /**
+     * When the HAL makes this call, any apps currently playing must be asked to
+     * temporarily suspend playback (via an AudioManager::AUDIOFOCUS_LOSS_TRANSIENT event).
+     *
+     * This is only a suggestion. Apps may be slow to react or even ignore this message
+     * entirely. Enforcement, if necessary, must be done at the AudioHAL level as the
+     * samples are delivered. In most instances, this is the way a car should ask for
+     * quiet if it needs it for some important situation, such as warning alarms or chimes.
+     */
+    oneway suggestPausePlayers();
+
+
+    /**
+     * When the HAL makes this case, any apps currently playing must be asked to stop
+     * playing (via an AudioManager::AUDIOFOCUS_LOSS event). Once stopped, the apps must
+     * not resume their playback.
+     *
+     * It should be noted that not all apps or sound sources honor this request, but this
+     * at least gives an app the chance to do the right thing.
+     * Because it premanently stops media, this call is expected to be used only rarely.
+     * Perhaps in the event of an E-call, where resuming music might be undesirable assuming
+     * the driver is now dealing with whatever the emergency is?
+     */
+    oneway suggestStopPlayers();
+
+
+    /**
+     * Receives calls from the HAL when Android should resume normal operations. If the previous
+     * action was a requestPausePlayers, then things that were paused must be told they may
+     * resume.
+     */
+    oneway resumePlayers();
+};
diff --git a/automotive/audiocontrol/1.0/default/Android.bp b/automotive/audiocontrol/1.0/default/Android.bp
new file mode 100644
index 0000000..614c58b
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/Android.bp
@@ -0,0 +1,40 @@
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary {
+    name: "android.hardware.automotive.audiocontrol@1.0-service",
+    defaults: ["hidl_defaults"],
+    vendor: true,
+    relative_install_path: "hw",
+    srcs: [
+        "AudioControl.cpp",
+        "AudioControlCallback.cpp",
+        "service.cpp"
+    ],
+    init_rc: ["android.hardware.automotive.audiocontrol@1.0-service.rc"],
+
+    shared_libs: [
+        "android.hardware.automotive.audiocontrol@1.0",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libutils",
+    ],
+
+    cflags: [
+        "-DLOG_TAG=\"AudCntrlDrv\"",
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/automotive/audiocontrol/1.0/default/AudioControl.cpp b/automotive/audiocontrol/1.0/default/AudioControl.cpp
new file mode 100644
index 0000000..419225d
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/AudioControl.cpp
@@ -0,0 +1,86 @@
+#include "AudioControl.h"
+
+#include <hidl/HidlTransportSupport.h>
+#include <log/log.h>
+
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace audiocontrol {
+namespace V1_0 {
+namespace implementation {
+
+
+// This is the static map we're using to associate a ContextNumber with a
+// bus number from the audio_policy_configuration.xml setup.  Every valid context needs
+// to be mapped to a bus address that actually exists in the platforms configuration.
+#define ARRAY_SIZE(a) (sizeof(a) / sizeof(*a))  // Would be nice if this were common...
+static int sContextToBusMap[] = {
+    -1,     // INVALID
+     0,     // MUSIC_CONTEXT
+     1,     // NAVIGATION_CONTEXT
+     2,     // VOICE_COMMAND_CONTEXT
+     3,     // CALL_RING_CONTEXT
+     4,     // CALL_CONTEXT
+     5,     // ALARM_CONTEXT
+     6,     // NOTIFICATION_CONTEXT
+     7,     // SYSTEM_SOUND_CONTEXT
+};
+static const unsigned sContextMapSize = ARRAY_SIZE(sContextToBusMap);
+static const unsigned sContextCount = sContextMapSize - 1;  // Less one for the INVALID entry
+static const unsigned sContextNumberMax = sContextCount;    // contextNumber is counted from 1
+
+
+AudioControl::AudioControl() {
+};
+
+
+// Methods from ::android::hardware::automotive::audiocontrol::V1_0::IAudioControl follow.
+Return<AudioResult> AudioControl::setCallback(const sp<IAudioControlCallback>& notificationObject) {
+    // Hang onto the provided callback object for future use
+    callback = notificationObject;
+
+    return AudioResult::OK;
+}
+
+
+Return<int32_t> AudioControl::getBusForContext(uint32_t contextNumber) {
+    if (contextNumber > sContextNumberMax) {
+        ALOGE("Unexpected context number %d (max expected is %d)", contextNumber, sContextCount);
+        return -1;
+    } else {
+        return sContextToBusMap[contextNumber];
+    }
+}
+
+
+Return<void> AudioControl::setBalanceTowardRight(float value) {
+    // For completeness, lets bounds check the input...
+    if ((value > 1.0f) || (value < -1.0f)) {
+        ALOGE("Balance value out of range -1 to 1 at %0.2f", value);
+    } else {
+        // Just log in this default mock implementation
+        ALOGI("Balance set to %0.2f", value);
+    }
+    return Void();
+}
+
+
+Return<void> AudioControl::setFadeTowardFront(float value) {
+    // For completeness, lets bounds check the input...
+    if ((value > 1.0f) || (value < -1.0f)) {
+        ALOGE("Fader value out of range -1 to 1 at %0.2f", value);
+    } else {
+        // Just log in this default mock implementation
+        ALOGI("Fader set to %0.2f", value);
+    }
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace audiocontrol
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/audiocontrol/1.0/default/AudioControl.h b/automotive/audiocontrol/1.0/default/AudioControl.h
new file mode 100644
index 0000000..3383875
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/AudioControl.h
@@ -0,0 +1,45 @@
+#ifndef ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROL_H
+#define ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROL_H
+
+#include <android/hardware/automotive/audiocontrol/1.0/IAudioControl.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace audiocontrol {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+struct AudioControl : public IAudioControl {
+public:
+    // Methods from ::android::hardware::automotive::audiocontrol::V1_0::IAudioControl follow.
+    Return<AudioResult> setCallback(const sp<IAudioControlCallback>& notificationObject) override;
+    Return<int32_t> getBusForContext(uint32_t contextNumber) override;
+    Return<void> setBalanceTowardRight(float value) override;
+    Return<void> setFadeTowardFront(float value) override;
+
+    // Implementation details
+    AudioControl();
+
+private:
+    sp<IAudioControlCallback> callback;
+};
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace audiocontrol
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROL_H
diff --git a/automotive/audiocontrol/1.0/default/AudioControlCallback.cpp b/automotive/audiocontrol/1.0/default/AudioControlCallback.cpp
new file mode 100644
index 0000000..ea79cad
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/AudioControlCallback.cpp
@@ -0,0 +1,31 @@
+#include "AudioControlCallback.h"
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace audiocontrol {
+namespace V1_0 {
+namespace implementation {
+
+// Methods from ::android::hardware::automotive::audiocontrol::V1_0::IAudioControlCallback follow.
+Return<void> AudioControlCallback::suggestPausePlayers() {
+    // TODO implement in framework (this is called by the HAL implementation when needed)
+    return Void();
+}
+
+Return<void> AudioControlCallback::suggestStopPlayers() {
+    // TODO implement in framework (this is called by the HAL implementation when needed)
+    return Void();
+}
+
+Return<void> AudioControlCallback::resumePlayers() {
+    // TODO implement in framework (this is called by the HAL implementation when needed)
+    return Void();
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace audiocontrol
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
diff --git a/automotive/audiocontrol/1.0/default/AudioControlCallback.h b/automotive/audiocontrol/1.0/default/AudioControlCallback.h
new file mode 100644
index 0000000..1054548
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/AudioControlCallback.h
@@ -0,0 +1,41 @@
+#ifndef ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROLCALLBACK_H
+#define ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROLCALLBACK_H
+
+#include <android/hardware/automotive/audiocontrol/1.0/IAudioControlCallback.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace automotive {
+namespace audiocontrol {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+// TODO:  Move this into packages/services/Car...
+struct AudioControlCallback : public IAudioControlCallback {
+    // Methods from ::android::hardware::automotive::audiocontrol::V1_0::IAudioControlCallback follow.
+    Return<void> suggestPausePlayers() override;
+    Return<void> suggestStopPlayers() override;
+    Return<void> resumePlayers() override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+
+};
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace audiocontrol
+}  // namespace automotive
+}  // namespace hardware
+}  // namespace android
+
+#endif  // ANDROID_HARDWARE_AUTOMOTIVE_AUDIOCONTROL_V1_0_AUDIOCONTROLCALLBACK_H
diff --git a/automotive/audiocontrol/1.0/default/android.hardware.automotive.audiocontrol@1.0-service.rc b/automotive/audiocontrol/1.0/default/android.hardware.automotive.audiocontrol@1.0-service.rc
new file mode 100644
index 0000000..79edad6
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/android.hardware.automotive.audiocontrol@1.0-service.rc
@@ -0,0 +1,4 @@
+service vendor.evs-hal-mock /vendor/bin/hw/android.hardware.automotive.audiocontrol@1.0-service
+    class hal
+    user audioserver
+    group system
diff --git a/automotive/audiocontrol/1.0/default/service.cpp b/automotive/audiocontrol/1.0/default/service.cpp
new file mode 100644
index 0000000..a033fd9
--- /dev/null
+++ b/automotive/audiocontrol/1.0/default/service.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <unistd.h>
+
+#include <hidl/HidlTransportSupport.h>
+#include <log/log.h>
+#include <utils/Errors.h>
+#include <utils/StrongPointer.h>
+
+#include "AudioControl.h"
+
+
+// libhidl:
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+
+// Generated HIDL files
+using android::hardware::automotive::audiocontrol::V1_0::IAudioControl;
+
+// The namespace in which all our implementation code lives
+using namespace android::hardware::automotive::audiocontrol::V1_0::implementation;
+using namespace android;
+
+
+// Main service entry point
+int main() {
+    // Create an instance of our service class
+    android::sp<IAudioControl> service = new AudioControl();
+    configureRpcThreadpool(1, true /*callerWillJoin*/);
+
+    if (service->registerAsService() != OK) {
+        ALOGE("registerAsService failed");
+        return 1;
+    }
+
+    // Join (forever) the thread pool we created for the service above
+    joinRpcThreadpool();
+
+    // We don't ever actually expect to return, so return an error if we do get here
+    return 2;
+}
\ No newline at end of file
diff --git a/automotive/audiocontrol/1.0/types.hal b/automotive/audiocontrol/1.0/types.hal
new file mode 100644
index 0000000..6301d3a
--- /dev/null
+++ b/automotive/audiocontrol/1.0/types.hal
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.audiocontrol@1.0;
+
+
+/**
+ * Predefined flags to identifying audio contexts
+ */
+enum ContextNumber : uint32_t {
+    INVALID = 0,    /* Shouldn't be used */
+
+    // Sounds from Android (counting from 1 coincidentally lets us match AudioAttributes usages)
+    MUSIC,          /* Music playback */
+    NAVIGATION,     /* Navigation directions */
+    VOICE_COMMAND,  /* Voice command session */
+    CALL_RING,      /* Voice call ringing */
+    CALL,           /* Voice call */
+    ALARM,          /* Alarm sound from Android */
+    NOTIFICATION,   /* Notifications */
+    SYSTEM_SOUND,   /* User interaction sounds (button clicks, etc) */
+};
+
+
+/** Error codes used in AudioControl HAL interface. */
+enum AudioResult : uint32_t {
+    OK = 0,
+    NOT_AVAILABLE,
+    INVALID_ARGUMENT,
+    UNDERLYING_SERVICE_ERROR,
+};
diff --git a/automotive/evs/1.0/default/Android.bp b/automotive/evs/1.0/default/Android.bp
index 2574e86..7286478 100644
--- a/automotive/evs/1.0/default/Android.bp
+++ b/automotive/evs/1.0/default/Android.bp
@@ -13,7 +13,6 @@
 
     shared_libs: [
         "android.hardware.automotive.evs@1.0",
-        "libui",
         "libbase",
         "libbinder",
         "libcutils",
@@ -21,6 +20,7 @@
         "libhidlbase",
         "libhidltransport",
         "liblog",
+        "libui",
         "libutils",
     ],
 
diff --git a/bluetooth/1.0/default/h4_protocol.cc b/bluetooth/1.0/default/h4_protocol.cc
index 163cc33..df40507 100644
--- a/bluetooth/1.0/default/h4_protocol.cc
+++ b/bluetooth/1.0/default/h4_protocol.cc
@@ -71,8 +71,10 @@
     ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd, buffer, 1));
     if (bytes_read != 1) {
       if (bytes_read == 0) {
-        LOG_ALWAYS_FATAL("%s: Unexpected EOF reading the packet type!",
-                         __func__);
+        // This is only expected if the UART got closed when shutting down.
+        ALOGE("%s: Unexpected EOF reading the packet type!", __func__);
+        sleep(5);  // Expect to be shut down within 5 seconds.
+        return;
       } else if (bytes_read < 0) {
         LOG_ALWAYS_FATAL("%s: Read packet type error: %s", __func__,
                          strerror(errno));
diff --git a/bluetooth/1.0/default/hci_packetizer.cc b/bluetooth/1.0/default/hci_packetizer.cc
index fde08ac..71f4328 100644
--- a/bluetooth/1.0/default/hci_packetizer.cc
+++ b/bluetooth/1.0/default/hci_packetizer.cc
@@ -56,9 +56,13 @@
       ssize_t bytes_read = TEMP_FAILURE_RETRY(
           read(fd, preamble_ + bytes_read_,
                preamble_size_for_type[packet_type] - bytes_read_));
-      if (bytes_read <= 0) {
-        LOG_ALWAYS_FATAL_IF((bytes_read == 0),
-                            "%s: Unexpected EOF reading the header!", __func__);
+      if (bytes_read == 0) {
+        // This is only expected if the UART got closed when shutting down.
+        ALOGE("%s: Unexpected EOF reading the header!", __func__);
+        sleep(5);  // Expect to be shut down within 5 seconds.
+        return;
+      }
+      if (bytes_read < 0) {
         LOG_ALWAYS_FATAL("%s: Read header error: %s", __func__,
                          strerror(errno));
       }
@@ -80,10 +84,13 @@
           fd,
           packet_.data() + preamble_size_for_type[packet_type] + bytes_read_,
           bytes_remaining_));
-      if (bytes_read <= 0) {
-        LOG_ALWAYS_FATAL_IF((bytes_read == 0),
-                            "%s: Unexpected EOF reading the payload!",
-                            __func__);
+      if (bytes_read == 0) {
+        // This is only expected if the UART got closed when shutting down.
+        ALOGE("%s: Unexpected EOF reading the payload!", __func__);
+        sleep(5);  // Expect to be shut down within 5 seconds.
+        return;
+      }
+      if (bytes_read < 0) {
         LOG_ALWAYS_FATAL("%s: Read payload error: %s", __func__,
                          strerror(errno));
       }
diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
index 6ce2f11..a8f5bb4 100644
--- a/bluetooth/1.0/default/vendor_interface.cc
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -49,6 +49,7 @@
 bool recent_activity_flag;
 
 VendorInterface* g_vendor_interface = nullptr;
+std::mutex wakeup_mutex_;
 
 HC_BT_HDR* WrapPacketAndCopy(uint16_t event, const hidl_vec<uint8_t>& data) {
   size_t packet_size = data.size() + sizeof(HC_BT_HDR);
@@ -308,6 +309,7 @@
 }
 
 size_t VendorInterface::Send(uint8_t type, const uint8_t* data, size_t length) {
+  std::unique_lock<std::mutex> lock(wakeup_mutex_);
   recent_activity_flag = true;
 
   if (lpm_wake_deasserted == true) {
@@ -350,6 +352,7 @@
 
 void VendorInterface::OnTimeout() {
   ALOGV("%s", __func__);
+  std::unique_lock<std::mutex> lock(wakeup_mutex_);
   if (recent_activity_flag == false) {
     lpm_wake_deasserted = true;
     bt_vendor_lpm_wake_state_t wakeState = BT_VND_LPM_WAKE_DEASSERT;
diff --git a/broadcastradio/1.2/default/BroadcastRadio.cpp b/broadcastradio/1.2/default/BroadcastRadio.cpp
index 5164e47..74f6589 100644
--- a/broadcastradio/1.2/default/BroadcastRadio.cpp
+++ b/broadcastradio/1.2/default/BroadcastRadio.cpp
@@ -107,7 +107,7 @@
     prop10.numTuners = 1;
     prop10.numAudioSources = 1;
     prop10.supportsCapture = false;
-    prop11.supportsBackgroundScanning = false;
+    prop11.supportsBackgroundScanning = true;
     prop11.supportedProgramTypes = hidl_vec<uint32_t>({
         static_cast<uint32_t>(ProgramType::AM), static_cast<uint32_t>(ProgramType::FM),
         static_cast<uint32_t>(ProgramType::AM_HD), static_cast<uint32_t>(ProgramType::FM_HD),
diff --git a/broadcastradio/1.2/default/Tuner.cpp b/broadcastradio/1.2/default/Tuner.cpp
index f589332..e95a132 100644
--- a/broadcastradio/1.2/default/Tuner.cpp
+++ b/broadcastradio/1.2/default/Tuner.cpp
@@ -343,7 +343,11 @@
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return ProgramListResult::NOT_INITIALIZED;
 
-    return ProgramListResult::UNAVAILABLE;
+    if (mCallback1_1 != nullptr) {
+        mCallback1_1->backgroundScanComplete(ProgramListResult::OK);
+    }
+
+    return ProgramListResult::OK;
 }
 
 Return<void> Tuner::getProgramList(const hidl_vec<VendorKeyValue>& vendorFilter,
diff --git a/broadcastradio/2.0/Android.bp b/broadcastradio/2.0/Android.bp
index 1d7861e..7409005 100644
--- a/broadcastradio/2.0/Android.bp
+++ b/broadcastradio/2.0/Android.bp
@@ -8,7 +8,9 @@
     },
     srcs: [
         "types.hal",
+        "IAnnouncementObserver.hal",
         "IBroadcastRadio.hal",
+        "ICloseHandle.hal",
         "ITunerCallback.hal",
         "ITunerSession.hal",
     ],
@@ -16,8 +18,14 @@
         "android.hidl.base@1.0",
     ],
     types: [
+        "AmFmBandRange",
+        "AmFmRegionConfig",
+        "Announcement",
+        "AnnouncementType",
         "ConfigFlag",
         "Constants",
+        "DabTableEntry",
+        "Deemphasis",
         "IdentifierType",
         "Metadata",
         "MetadataKey",
@@ -28,6 +36,7 @@
         "ProgramListChunk",
         "ProgramSelector",
         "Properties",
+        "Rds",
         "Result",
         "VendorKeyValue",
     ],
diff --git a/broadcastradio/2.0/IAnnouncementObserver.hal b/broadcastradio/2.0/IAnnouncementObserver.hal
new file mode 100644
index 0000000..c91e29a
--- /dev/null
+++ b/broadcastradio/2.0/IAnnouncementObserver.hal
@@ -0,0 +1,30 @@
+/* Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.broadcastradio@2.0;
+
+/**
+ * Callback interface for announcement observer.
+ *
+ * For typical configuration, the observer is a broadcast radio service.
+ */
+interface IAnnouncementObserver {
+    /**
+     * Called whenever announcement list has changed.
+     *
+     * @param announcements The complete list of currently active announcements.
+     */
+    oneway onListUpdated(vec<Announcement> announcements);
+};
diff --git a/broadcastradio/2.0/IBroadcastRadio.hal b/broadcastradio/2.0/IBroadcastRadio.hal
index 3ab1cc2..7578f44 100644
--- a/broadcastradio/2.0/IBroadcastRadio.hal
+++ b/broadcastradio/2.0/IBroadcastRadio.hal
@@ -15,6 +15,8 @@
 
 package android.hardware.broadcastradio@2.0;
 
+import IAnnouncementObserver;
+import ICloseHandle;
 import ITunerCallback;
 import ITunerSession;
 
@@ -33,6 +35,28 @@
     getProperties() generates (Properties properties);
 
     /**
+     * Fetches current or possible AM/FM region configuration.
+     *
+     * @param full If true, returns full hardware capabilities.
+     *             If false, returns current regional configuration.
+     * @return result OK in case of success.
+     *                NOT_SUPPORTED if the tuner doesn't support AM/FM.
+     * @return config Hardware capabilities (full=true) or
+     *                current configuration (full=false).
+     */
+    getAmFmRegionConfig(bool full)
+            generates (Result result, AmFmRegionConfig config);
+
+    /**
+     * Fetches current DAB region configuration.
+     *
+     * @return result OK in case of success.
+     *                NOT_SUPPORTED if the tuner doesn't support DAB.
+     * @return config Current configuration.
+     */
+    getDabRegionConfig() generates (Result result, vec<DabTableEntry> config);
+
+    /**
      * Opens a new tuner session.
      *
      * There may be only one session active at a time. If the new session was
@@ -44,7 +68,7 @@
      * @return session The session interface.
      */
     openSession(ITunerCallback callback)
-            generates (Result result, ITunerSession session);
+        generates (Result result, ITunerSession session);
 
     /**
      * Fetch image from radio module cache.
@@ -78,4 +102,28 @@
      *               or a zero-length vector if identifier doesn't exist.
      */
     getImage(uint32_t id) generates (vec<uint8_t> image);
+
+    /**
+     * Registers announcement observer.
+     *
+     * If there is at least one observer registered, HAL implementation must
+     * notify about announcements even if no sessions are active.
+     *
+     * If the observer dies, the HAL implementation must unregister observer
+     * automatically.
+     *
+     * @param enabled The list of announcement types to watch for.
+     * @param cb The callback interface.
+     * @return result OK in case of success.
+     *                NOT_SUPPORTED if the tuner doesn't support announcements.
+     * @return closeHandle A handle to unregister observer,
+     *                     nullptr if result was not OK.
+     */
+    registerAnnouncementObserver(
+            vec<AnnouncementType> enabled,
+            IAnnouncementObserver cb
+        ) generates (
+            Result result,
+            ICloseHandle closeHandle
+        );
 };
diff --git a/broadcastradio/2.0/ICloseHandle.hal b/broadcastradio/2.0/ICloseHandle.hal
new file mode 100644
index 0000000..34cea14
--- /dev/null
+++ b/broadcastradio/2.0/ICloseHandle.hal
@@ -0,0 +1,32 @@
+/* Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.broadcastradio@2.0;
+
+/**
+ * Represents a generic close handle to remove a callback that doesn't need
+ * active interface.
+ */
+interface ICloseHandle {
+    /**
+     * Closes the handle.
+     *
+     * The call must not fail and must only be issued once.
+     *
+     * After the close call is executed, no other calls to this interface
+     * are allowed.
+     */
+    close();
+};
diff --git a/broadcastradio/2.0/ITunerSession.hal b/broadcastradio/2.0/ITunerSession.hal
index a3f93fd..a58fa62 100644
--- a/broadcastradio/2.0/ITunerSession.hal
+++ b/broadcastradio/2.0/ITunerSession.hal
@@ -154,7 +154,7 @@
      * @return results Operation completion status for parameters being set.
      */
     setParameters(vec<VendorKeyValue> parameters)
-            generates (vec<VendorKeyValue> results);
+        generates (vec<VendorKeyValue> results);
 
     /**
      * Generic method for retrieving vendor-specific parameter values.
diff --git a/broadcastradio/2.0/default/Android.bp b/broadcastradio/2.0/default/Android.bp
index 6d4effb..900454e 100644
--- a/broadcastradio/2.0/default/Android.bp
+++ b/broadcastradio/2.0/default/Android.bp
@@ -24,6 +24,9 @@
         "-Wextra",
         "-Werror",
     ],
+    cppflags: [
+        "-std=c++1z",
+    ],
     srcs: [
         "BroadcastRadio.cpp",
         "TunerSession.cpp",
diff --git a/broadcastradio/2.0/default/BroadcastRadio.cpp b/broadcastradio/2.0/default/BroadcastRadio.cpp
index 5ab517d..d16aaff 100644
--- a/broadcastradio/2.0/default/BroadcastRadio.cpp
+++ b/broadcastradio/2.0/default/BroadcastRadio.cpp
@@ -33,6 +33,16 @@
 using std::mutex;
 using std::vector;
 
+static const AmFmRegionConfig gDefaultAmFmConfig = {  //
+    {
+        {87500, 108000, 100, 100},  // FM
+        {153, 282, 3, 9},           // AM LW
+        {531, 1620, 9, 9},          // AM MW
+        {1600, 30000, 1, 5},        // AM SW
+    },
+    static_cast<uint32_t>(Deemphasis::D50),
+    static_cast<uint32_t>(Rds::RDS)};
+
 static Properties initProperties(const VirtualRadio& virtualRadio) {
     Properties prop = {};
 
@@ -51,7 +61,9 @@
 }
 
 BroadcastRadio::BroadcastRadio(const VirtualRadio& virtualRadio)
-    : mVirtualRadio(virtualRadio), mProperties(initProperties(virtualRadio)) {}
+    : mVirtualRadio(virtualRadio),
+      mProperties(initProperties(virtualRadio)),
+      mAmFmConfig(gDefaultAmFmConfig) {}
 
 Return<void> BroadcastRadio::getProperties(getProperties_cb _hidl_cb) {
     ALOGV("%s", __func__);
@@ -59,6 +71,44 @@
     return {};
 }
 
+AmFmRegionConfig BroadcastRadio::getAmFmConfig() const {
+    lock_guard<mutex> lk(mMut);
+    return mAmFmConfig;
+}
+
+Return<void> BroadcastRadio::getAmFmRegionConfig(bool full, getAmFmRegionConfig_cb _hidl_cb) {
+    ALOGV("%s(%d)", __func__, full);
+
+    if (full) {
+        AmFmRegionConfig config = {};
+        config.ranges = hidl_vec<AmFmBandRange>({
+            {65000, 108000, 10, 0},  // FM
+            {150, 30000, 1, 0},      // AM
+        });
+        config.fmDeemphasis = Deemphasis::D50 | Deemphasis::D75;
+        config.fmRds = Rds::RDS | Rds::RBDS;
+        _hidl_cb(Result::OK, config);
+        return {};
+    } else {
+        _hidl_cb(Result::OK, getAmFmConfig());
+        return {};
+    }
+}
+
+Return<void> BroadcastRadio::getDabRegionConfig(getDabRegionConfig_cb _hidl_cb) {
+    ALOGV("%s", __func__);
+
+    hidl_vec<DabTableEntry> config = {
+        {"5A", 174928},  {"7D", 194064},  {"8A", 195936},  {"8B", 197648},  {"9A", 202928},
+        {"9B", 204640},  {"9C", 206352},  {"10B", 211648}, {"10C", 213360}, {"10D", 215072},
+        {"11A", 216928}, {"11B", 218640}, {"11C", 220352}, {"11D", 222064}, {"12A", 223936},
+        {"12B", 225648}, {"12C", 227360}, {"12D", 229072},
+    };
+
+    _hidl_cb(Result::OK, config);
+    return {};
+}
+
 Return<void> BroadcastRadio::openSession(const sp<ITunerCallback>& callback,
                                          openSession_cb _hidl_cb) {
     ALOGV("%s", __func__);
@@ -91,6 +141,15 @@
     return {};
 }
 
+Return<void> BroadcastRadio::registerAnnouncementObserver(
+    const hidl_vec<AnnouncementType>& enabled, const sp<IAnnouncementObserver>& /* cb */,
+    registerAnnouncementObserver_cb _hidl_cb) {
+    ALOGV("%s(%s)", __func__, toString(enabled).c_str());
+
+    _hidl_cb(Result::NOT_SUPPORTED, nullptr);
+    return {};
+}
+
 }  // namespace implementation
 }  // namespace V2_0
 }  // namespace broadcastradio
diff --git a/broadcastradio/2.0/default/BroadcastRadio.h b/broadcastradio/2.0/default/BroadcastRadio.h
index fcf0615..7904946 100644
--- a/broadcastradio/2.0/default/BroadcastRadio.h
+++ b/broadcastradio/2.0/default/BroadcastRadio.h
@@ -32,14 +32,22 @@
 
     // V2_0::IBroadcastRadio methods
     Return<void> getProperties(getProperties_cb _hidl_cb) override;
+    Return<void> getAmFmRegionConfig(bool full, getAmFmRegionConfig_cb _hidl_cb);
+    Return<void> getDabRegionConfig(getDabRegionConfig_cb _hidl_cb);
     Return<void> openSession(const sp<ITunerCallback>& callback, openSession_cb _hidl_cb) override;
     Return<void> getImage(uint32_t id, getImage_cb _hidl_cb);
+    Return<void> registerAnnouncementObserver(const hidl_vec<AnnouncementType>& enabled,
+                                              const sp<IAnnouncementObserver>& cb,
+                                              registerAnnouncementObserver_cb _hidl_cb);
 
     std::reference_wrapper<const VirtualRadio> mVirtualRadio;
     Properties mProperties;
 
+    AmFmRegionConfig getAmFmConfig() const;
+
    private:
-    std::mutex mMut;
+    mutable std::mutex mMut;
+    AmFmRegionConfig mAmFmConfig;
     wp<TunerSession> mSession;
 };
 
diff --git a/broadcastradio/2.0/default/TunerSession.cpp b/broadcastradio/2.0/default/TunerSession.cpp
index 36a22c5..3166d86 100644
--- a/broadcastradio/2.0/default/TunerSession.cpp
+++ b/broadcastradio/2.0/default/TunerSession.cpp
@@ -56,6 +56,9 @@
 static ProgramInfo makeDummyProgramInfo(const ProgramSelector& selector) {
     ProgramInfo info = {};
     info.selector = selector;
+    info.logicallyTunedTo = utils::make_identifier(
+        IdentifierType::AMFM_FREQUENCY, utils::getId(selector, IdentifierType::AMFM_FREQUENCY));
+    info.physicallyTunedTo = info.logicallyTunedTo;
     return info;
 }
 
@@ -74,8 +77,12 @@
     mCallback->onCurrentProgramInfoChanged(programInfo);
 }
 
+const BroadcastRadio& TunerSession::module() const {
+    return mModule.get();
+}
+
 const VirtualRadio& TunerSession::virtualRadio() const {
-    return mModule.get().mVirtualRadio;
+    return module().mVirtualRadio;
 }
 
 Return<Result> TunerSession::tune(const ProgramSelector& sel) {
@@ -83,7 +90,7 @@
     lock_guard<mutex> lk(mMut);
     if (mIsClosed) return Result::INVALID_STATE;
 
-    if (!utils::isSupported(mModule.get().mProperties, sel)) {
+    if (!utils::isSupported(module().mProperties, sel)) {
         ALOGW("Selector not supported");
         return Result::NOT_SUPPORTED;
     }
@@ -167,23 +174,19 @@
     mIsTuneCompleted = false;
 
     auto stepTo = utils::getId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY);
-#if 0
-    // TODO(b/69958423): handle regions
-    if (directionUp) {
-        stepTo += mAmfmConfig.spacings[0];
-    } else {
-        stepTo -= mAmfmConfig.spacings[0];
+    auto range = getAmFmRangeLocked();
+    if (!range) {
+        ALOGE("Can't find current band");
+        return Result::INTERNAL_ERROR;
     }
 
-    if (stepTo > mAmfmConfig.upperLimit) stepTo = mAmfmConfig.lowerLimit;
-    if (stepTo < mAmfmConfig.lowerLimit) stepTo = mAmfmConfig.upperLimit;
-#else
     if (directionUp) {
-        stepTo += 100;
+        stepTo += range->spacing;
     } else {
-        stepTo -= 100;
+        stepTo -= range->spacing;
     }
-#endif
+    if (stepTo > range->upperBound) stepTo = range->lowerBound;
+    if (stepTo < range->lowerBound) stepTo = range->upperBound;
 
     auto task = [this, stepTo]() {
         ALOGI("Performing step to %s", std::to_string(stepTo).c_str());
@@ -277,6 +280,18 @@
     return {};
 }
 
+std::optional<AmFmBandRange> TunerSession::getAmFmRangeLocked() const {
+    if (!mIsTuneCompleted) return {};
+    if (!utils::hasId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY)) return {};
+
+    auto freq = utils::getId(mCurrentProgram, IdentifierType::AMFM_FREQUENCY);
+    for (auto&& range : module().getAmFmConfig().ranges) {
+        if (range.lowerBound <= freq && range.upperBound >= freq) return range;
+    }
+
+    return {};
+}
+
 }  // namespace implementation
 }  // namespace V2_0
 }  // namespace broadcastradio
diff --git a/broadcastradio/2.0/default/TunerSession.h b/broadcastradio/2.0/default/TunerSession.h
index a58aa19..5d27b1e 100644
--- a/broadcastradio/2.0/default/TunerSession.h
+++ b/broadcastradio/2.0/default/TunerSession.h
@@ -22,6 +22,8 @@
 #include <android/hardware/broadcastradio/2.0/ITunerSession.h>
 #include <broadcastradio-utils/WorkerThread.h>
 
+#include <optional>
+
 namespace android {
 namespace hardware {
 namespace broadcastradio {
@@ -48,6 +50,8 @@
                                        getParameters_cb _hidl_cb) override;
     virtual Return<void> close() override;
 
+    std::optional<AmFmBandRange> getAmFmRangeLocked() const;
+
    private:
     std::mutex mMut;
     WorkerThread mThread;
@@ -61,6 +65,7 @@
 
     void tuneInternalLocked(const ProgramSelector& sel);
     const VirtualRadio& virtualRadio() const;
+    const BroadcastRadio& module() const;
 };
 
 }  // namespace implementation
diff --git a/broadcastradio/2.0/default/VirtualProgram.cpp b/broadcastradio/2.0/default/VirtualProgram.cpp
index 1acd4d3..acde704 100644
--- a/broadcastradio/2.0/default/VirtualProgram.cpp
+++ b/broadcastradio/2.0/default/VirtualProgram.cpp
@@ -13,11 +13,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#define LOG_TAG "BcRadioDef.VirtualProgram"
+
 #include "VirtualProgram.h"
 
 #include "resources.h"
 
+#include <android-base/logging.h>
 #include <broadcastradio-utils-2x/Utils.h>
+#include <log/log.h>
 
 namespace android {
 namespace hardware {
@@ -38,6 +42,39 @@
     auto pType = getType(selector.primaryId);
     auto isDigital = (pType != IdentifierType::AMFM_FREQUENCY && pType != IdentifierType::RDS_PI);
 
+    auto selectId = [&info](IdentifierType type) {
+        return utils::make_identifier(type, utils::getId(info.selector, type));
+    };
+
+    switch (pType) {
+        case IdentifierType::AMFM_FREQUENCY:
+            info.logicallyTunedTo = info.physicallyTunedTo =
+                selectId(IdentifierType::AMFM_FREQUENCY);
+            break;
+        case IdentifierType::RDS_PI:
+            info.logicallyTunedTo = selectId(IdentifierType::RDS_PI);
+            info.physicallyTunedTo = selectId(IdentifierType::AMFM_FREQUENCY);
+            break;
+        case IdentifierType::HD_STATION_ID_EXT:
+            info.logicallyTunedTo = selectId(IdentifierType::HD_STATION_ID_EXT);
+            info.physicallyTunedTo = selectId(IdentifierType::AMFM_FREQUENCY);
+            break;
+        case IdentifierType::DAB_SID_EXT:
+            info.logicallyTunedTo = selectId(IdentifierType::DAB_SID_EXT);
+            info.physicallyTunedTo = selectId(IdentifierType::DAB_ENSEMBLE);
+            break;
+        case IdentifierType::DRMO_SERVICE_ID:
+            info.logicallyTunedTo = selectId(IdentifierType::DRMO_SERVICE_ID);
+            info.physicallyTunedTo = selectId(IdentifierType::DRMO_FREQUENCY);
+            break;
+        case IdentifierType::SXM_SERVICE_ID:
+            info.logicallyTunedTo = selectId(IdentifierType::SXM_SERVICE_ID);
+            info.physicallyTunedTo = selectId(IdentifierType::SXM_CHANNEL);
+            break;
+        default:
+            LOG(FATAL) << "Unsupported program type: " << toString(pType);
+    }
+
     info.infoFlags |= ProgramInfoFlags::TUNED;
     info.infoFlags |= ProgramInfoFlags::STEREO;
     info.signalQuality = isDigital ? 100 : 80;
diff --git a/broadcastradio/2.0/types.hal b/broadcastradio/2.0/types.hal
index 42eab6a..1fd3715 100644
--- a/broadcastradio/2.0/types.hal
+++ b/broadcastradio/2.0/types.hal
@@ -32,6 +32,7 @@
 enum Result : int32_t {
     OK,
     UNKNOWN_ERROR,
+    INTERNAL_ERROR,
     INVALID_ARGUMENTS,
     INVALID_STATE,
     NOT_SUPPORTED,
@@ -66,7 +67,7 @@
      * Forces the digital playback for the supporting radio technology.
      *
      * User may disable digital-analog handover that happens with poor
-     * receiption conditions. With digital forced, the radio will remain silent
+     * reception conditions. With digital forced, the radio will remain silent
      * instead of switching to analog channel if it's available. This is purely
      * user choice, it does not reflect the actual state of handover.
      */
@@ -75,8 +76,9 @@
     /**
      * RDS Alternative Frequencies.
      *
-     * If set, radio tuner automatically switches to the best available
-     * frequency that currently listened RDS station broadcasts.
+     * If set and the currently tuned RDS station broadcasts on multiple
+     * channels, radio tuner automatically switches to the best available
+     * alternative.
      */
     RDS_AF,
 
@@ -120,6 +122,108 @@
 };
 
 /**
+ * A supported or configured RDS variant.
+ *
+ * Both might be set for hardware capabilities check (with full=true when
+ * calling getAmFmRegionConfig), but only one (or none) for specific
+ * region settings.
+ */
+enum Rds : uint8_t {
+    /** Standard variant, used everywhere except North America. */
+    RDS = 1 << 0,
+
+    /** Variant used in North America. */
+    RBDS = 1 << 1,
+};
+
+/**
+ * FM de-emphasis filter supported or configured.
+ *
+ * Both might be set for hardware capabilities check (with full=true when
+ * calling getAmFmRegionConfig), but exactly one for specific region settings.
+ */
+enum Deemphasis : uint8_t {
+    D50 = 1 << 0,
+    D75 = 1 << 1,
+};
+
+/**
+ * Regional configuration for AM/FM.
+ *
+ * For hardware capabilities check (with full=true when calling
+ * getAmFmRegionConfig), HAL implementation fills entire supported range of
+ * frequencies and features.
+ *
+ * When checking current configuration, at most one bit in each bitfield
+ * can be set.
+ */
+struct AmFmRegionConfig {
+    /**
+     * All supported or configured AM/FM bands.
+     *
+     * AM/FM bands are identified by frequency value
+     * (see IdentifierType::AMFM_FREQUENCY).
+     *
+     * With typical configuration, it's expected to have two frequency ranges
+     * for capabilities check (AM and FM) and four ranges for specific region
+     * configuration (AM LW, AM MW, AM SW, FM).
+     */
+    vec<AmFmBandRange> ranges;
+
+    /** De-emphasis filter supported/configured. */
+    bitfield<Deemphasis> fmDeemphasis;
+
+    /** RDS/RBDS variant supported/configured. */
+    bitfield<Rds> fmRds;
+};
+
+/**
+ * AM/FM band range for region configuration.
+ *
+ * Defines channel grid: each possible channel is set at
+ * lowerBound + channelNumber * spacing, up to upperBound.
+ */
+struct AmFmBandRange {
+    /** The frequency of the first channel within the range. */
+    uint32_t lowerBound;
+
+    /** The frequency of the last channel within the range. */
+    uint32_t upperBound;
+
+    /** Channel grid resolution, how far apart are the channels. */
+    uint32_t spacing;
+
+    /**
+     * Spacing used when scanning for channels. It's a multiply of spacing and
+     * allows to skip some channels when scanning to make it faster.
+     *
+     * Tuner may first quickly check every n-th channel and if it detects echo
+     * from a station, it fine-tunes to find the exact frequency.
+     *
+     * It's ignored for capabilities check (with full=true when calling
+     * getAmFmRegionConfig).
+     */
+    uint32_t scanSpacing;
+};
+
+/**
+ * An entry in regional configuration for DAB.
+ *
+ * Defines a frequency table row for ensembles.
+ */
+struct DabTableEntry {
+    /**
+     * Channel name, i.e. 5A, 7B.
+     *
+     * It must match the following regular expression: /^[A-Z0-9]{2,5}$/.
+     */
+    string label;
+
+    /** Frequency, in kHz. */
+    uint32_t frequency;
+};
+
+/**
  * Properties of a given broadcast radio module.
  */
 struct Properties {
@@ -185,6 +289,69 @@
      */
     ProgramSelector selector;
 
+    /**
+     * Identifier currently used for program selection.
+     *
+     * It allows to determine which technology is currently used for reception.
+     *
+     * Some program selectors contain tuning information for different radio
+     * technologies (i.e. FM RDS and DAB). For example, user may tune using
+     * a ProgramSelector with RDS_PI primary identifier, but the tuner hardware
+     * may choose to use DAB technology to make actual tuning. This identifier
+     * must reflect that.
+     *
+     * This field is optional, but must be set for currently tuned program.
+     * If it's not set, its value must be initialized to all-zeros.
+     *
+     * Only primary identifiers for a given radio technology are valid:
+     *  - AMFM_FREQUENCY for analog AM/FM;
+     *  - RDS_PI for FM RDS;
+     *  - HD_STATION_ID_EXT;
+     *  - DAB_SID_EXT;
+     *  - DRMO_SERVICE_ID;
+     *  - SXM_SERVICE_ID;
+     *  - VENDOR_*;
+     *  - more might come in next minor versions of this HAL.
+     */
+    ProgramIdentifier logicallyTunedTo;
+
+    /**
+     * Identifier currently used by hardware to physically tune to a channel.
+     *
+     * Some radio technologies broadcast the same program on multiple channels,
+     * i.e. with RDS AF the same program may be broadcasted on multiple
+     * alternative frequencies; the same DAB program may be broadcast on
+     * multiple ensembles. This identifier points to the channel to which the
+     * radio hardware is physically tuned to.
+     *
+     * This field is optional, but must be set for currently tuned program.
+     * If it's not set, its type field must be initialized to
+     * IdentifierType::INVALID.
+     *
+     * Only physical identifiers are valid:
+     *  - AMFM_FREQUENCY;
+     *  - DAB_ENSEMBLE;
+     *  - DRMO_FREQUENCY;
+     *  - SXM_CHANNEL;
+     *  - VENDOR_*;
+     *  - more might come in next minor versions of this HAL.
+     */
+    ProgramIdentifier physicallyTunedTo;
+
+    /**
+     * Primary identifiers of related contents.
+     *
+     * Some radio technologies provide pointers to other programs that carry
+     * related content (i.e. DAB soft-links). This field is a list of pointers
+     * to other programs on the program list.
+     *
+     * Please note, that these identifiers does not have to exist on the program
+     * list - i.e. DAB tuner may provide information on FM RDS alternatives
+     * despite not supporting FM RDS. If the system has multiple tuners, another
+     * one may have it on its list.
+     */
+    vec<ProgramIdentifier> relatedContent;
+
     bitfield<ProgramInfoFlags> infoFlags;
 
     /**
@@ -275,6 +442,8 @@
     /** See VENDOR_START */
     VENDOR_END = 1999,
 
+    INVALID = 0,
+
     /**
      * Primary identifier for analogue (without RDS) AM/FM stations:
      * frequency in kHz.
@@ -285,7 +454,7 @@
      *  - 1.71MHz - 30MHz: AM SW;
      *  - >60MHz: FM.
      */
-    AMFM_FREQUENCY = 1,
+    AMFM_FREQUENCY,
 
     /**
      * 16bit primary identifier for FM RDS station.
@@ -298,7 +467,12 @@
      * Consists of (from the LSB):
      * - 32bit: Station ID number;
      * - 4bit: HD Radio subchannel;
-     * - 18bit: AMFM_FREQUENCY. // TODO(b/69958777): is it necessary?
+     * - 18bit: AMFM_FREQUENCY.
+     *
+     * While station ID number should be unique globally, it sometimes get
+     * abused by broadcasters (i.e. not being set at all). To ensure local
+     * uniqueness, AMFM_FREQUENCY was added here. Global uniqueness is
+     * a best-effort - see HD_STATION_NAME.
      *
      * HD Radio subchannel is a value in range 0-7.
      * This index is 0-based (where 0 is MPS and 1..7 are SPS),
@@ -310,6 +484,22 @@
     HD_STATION_ID_EXT,
 
     /**
+     * 64bit additional identifier for HD Radio.
+     *
+     * Due to Station ID abuse, some HD_STATION_ID_EXT identifiers may be not
+     * globally unique. To provide a best-effort solution, a short version of
+     * station name may be carried as additional identifier and may be used
+     * by the tuner hardware to double-check tuning.
+     *
+     * The name is limited to the first 8 A-Z0-9 characters (lowercase letters
+     * must be converted to uppercase). Encoded in little-endian ASCII:
+     * the first character of the name is the LSB.
+     *
+     * For example: "Abc" is encoded as 0x434241.
+     */
+    HD_STATION_NAME,
+
+    /**
      * 28bit compound primary identifier for Digital Audio Broadcasting.
      *
      * Consists of (from the LSB):
@@ -324,7 +514,7 @@
      * The remaining bits should be set to zeros when writing on the chip side
      * and ignored when read.
      */
-    DAB_SID_EXT = HD_STATION_ID_EXT + 2,
+    DAB_SID_EXT,
 
     /** 16bit */
     DAB_ENSEMBLE,
@@ -609,3 +799,55 @@
      */
     bool excludeModifications;
 };
+
+/**
+ * Type of an announcement.
+ *
+ * It maps to different announcement types per each radio technology.
+ */
+enum AnnouncementType : uint8_t {
+    /** DAB alarm, RDS emergency program type (PTY 31). */
+    EMERGENCY = 1,
+
+    /** DAB warning. */
+    WARNING,
+
+    /** DAB road traffic, RDS TA, HD Radio transportation. */
+    TRAFFIC,
+
+    /** Weather. */
+    WEATHER,
+
+    /** News. */
+    NEWS,
+
+    /** DAB event, special event. */
+    EVENT,
+
+    /** DAB sport report, RDS sports. */
+    SPORT,
+
+    /** All others. */
+    MISC,
+};
+
+/**
+ * A pointer to a station broadcasting active announcement.
+ */
+struct Announcement {
+    /**
+     * Program selector to tune to the announcement.
+     */
+    ProgramSelector selector;
+
+    /** Announcement type. */
+    AnnouncementType type;
+
+    /**
+     * Vendor-specific information.
+     *
+     * It may be used for extra features, not supported by the platform,
+     * for example: com.me.hdradio.urgency=100; com.me.hdradio.certainity=50.
+     */
+    vec<VendorKeyValue> vendorInfo;
+};
diff --git a/broadcastradio/2.0/vts/functional/Android.bp b/broadcastradio/2.0/vts/functional/Android.bp
index 6017b15..6940bca 100644
--- a/broadcastradio/2.0/vts/functional/Android.bp
+++ b/broadcastradio/2.0/vts/functional/Android.bp
@@ -17,6 +17,9 @@
 cc_test {
     name: "VtsHalBroadcastradioV2_0TargetTest",
     defaults: ["VtsHalTargetTestDefaults"],
+    cppflags: [
+        "-std=c++1z",
+    ],
     srcs: ["VtsHalBroadcastradioV2_0TargetTest.cpp"],
     static_libs: [
         "android.hardware.broadcastradio@2.0",
diff --git a/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp b/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
index 4ab6cbe..1111478 100644
--- a/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
+++ b/broadcastradio/2.0/vts/functional/VtsHalBroadcastradioV2_0TargetTest.cpp
@@ -26,9 +26,12 @@
 #include <broadcastradio-vts-utils/call-barrier.h>
 #include <broadcastradio-vts-utils/mock-timeout.h>
 #include <broadcastradio-vts-utils/pointer-utils.h>
+#include <cutils/bitops.h>
 #include <gmock/gmock.h>
 
 #include <chrono>
+#include <optional>
+#include <regex>
 
 namespace android {
 namespace hardware {
@@ -87,12 +90,18 @@
     utils::ProgramInfoSet mProgramList;
 };
 
+struct AnnouncementObserverMock : public IAnnouncementObserver {
+    MOCK_METHOD1(onListUpdated, Return<void>(const hidl_vec<Announcement>&));
+};
+
 class BroadcastRadioHalTest : public ::testing::VtsHalHidlTargetTestBase {
    protected:
     virtual void SetUp() override;
     virtual void TearDown() override;
 
     bool openSession();
+    bool getAmFmRegionConfig(bool full, AmFmRegionConfig* config);
+    std::optional<utils::ProgramInfoSet> getProgramList();
 
     sp<IBroadcastRadio> mModule;
     Properties mProperties;
@@ -159,6 +168,41 @@
     return nullptr != mSession.get();
 }
 
+bool BroadcastRadioHalTest::getAmFmRegionConfig(bool full, AmFmRegionConfig* config) {
+    auto halResult = Result::UNKNOWN_ERROR;
+    auto cb = [&](Result result, AmFmRegionConfig configCb) {
+        halResult = result;
+        if (config) *config = configCb;
+    };
+
+    auto hidlResult = mModule->getAmFmRegionConfig(full, cb);
+    EXPECT_TRUE(hidlResult.isOk());
+
+    if (halResult == Result::NOT_SUPPORTED) return false;
+
+    EXPECT_EQ(Result::OK, halResult);
+    return halResult == Result::OK;
+}
+
+std::optional<utils::ProgramInfoSet> BroadcastRadioHalTest::getProgramList() {
+    EXPECT_TIMEOUT_CALL(*mCallback, onProgramListReady).Times(AnyNumber());
+
+    auto startResult = mSession->startProgramListUpdates({});
+    if (startResult == Result::NOT_SUPPORTED) {
+        printSkipped("Program list not supported");
+        return nullopt;
+    }
+    EXPECT_EQ(Result::OK, startResult);
+    if (startResult != Result::OK) return nullopt;
+
+    EXPECT_TIMEOUT_CALL_WAIT(*mCallback, onProgramListReady, timeout::programListScan);
+
+    auto stopResult = mSession->stopProgramListUpdates();
+    EXPECT_TRUE(stopResult.isOk());
+
+    return mCallback->mProgramList;
+}
+
 /**
  * Test session opening.
  *
@@ -181,6 +225,127 @@
     ASSERT_TRUE(openSession());
 }
 
+static bool isValidAmFmFreq(uint64_t freq) {
+    auto id = utils::make_identifier(IdentifierType::AMFM_FREQUENCY, freq);
+    return utils::isValid(id);
+}
+
+static void validateRange(const AmFmBandRange& range) {
+    EXPECT_TRUE(isValidAmFmFreq(range.lowerBound));
+    EXPECT_TRUE(isValidAmFmFreq(range.upperBound));
+    EXPECT_LT(range.lowerBound, range.upperBound);
+    EXPECT_GT(range.spacing, 0u);
+    EXPECT_EQ(0u, (range.upperBound - range.lowerBound) % range.spacing);
+}
+
+static bool supportsFM(const AmFmRegionConfig& config) {
+    for (auto&& range : config.ranges) {
+        if (utils::getBand(range.lowerBound) == utils::FrequencyBand::FM) return true;
+    }
+    return false;
+}
+
+/**
+ * Test fetching AM/FM regional configuration.
+ *
+ * Verifies that:
+ *  - AM/FM regional configuration is either set at startup or not supported at all by the hardware;
+ *  - there is at least one AM/FM band configured;
+ *  - FM Deemphasis and RDS are correctly configured for FM-capable radio;
+ *  - all channel grids (frequency ranges and spacings) are valid;
+ *  - scan spacing is a multiply of manual spacing value.
+ */
+TEST_F(BroadcastRadioHalTest, GetAmFmRegionConfig) {
+    AmFmRegionConfig config;
+    bool supported = getAmFmRegionConfig(false, &config);
+    if (!supported) {
+        printSkipped("AM/FM not supported");
+        return;
+    }
+
+    EXPECT_GT(config.ranges.size(), 0u);
+    EXPECT_LE(popcountll(config.fmDeemphasis), 1);
+    EXPECT_LE(popcountll(config.fmRds), 1);
+
+    for (auto&& range : config.ranges) {
+        validateRange(range);
+        EXPECT_EQ(0u, range.scanSpacing % range.spacing);
+        EXPECT_GE(range.scanSpacing, range.spacing);
+    }
+
+    if (supportsFM(config)) {
+        EXPECT_EQ(popcountll(config.fmDeemphasis), 1);
+    }
+}
+
+/**
+ * Test fetching AM/FM regional capabilities.
+ *
+ * Verifies that:
+ *  - AM/FM regional capabilities are either available or not supported at all by the hardware;
+ *  - there is at least one AM/FM range supported;
+ *  - there is at least one de-emphasis filter mode supported for FM-capable radio;
+ *  - all channel grids (frequency ranges and spacings) are valid;
+ *  - scan spacing is not set.
+ */
+TEST_F(BroadcastRadioHalTest, GetAmFmRegionConfigCapabilities) {
+    AmFmRegionConfig config;
+    bool supported = getAmFmRegionConfig(true, &config);
+    if (!supported) {
+        printSkipped("AM/FM not supported");
+        return;
+    }
+
+    EXPECT_GT(config.ranges.size(), 0u);
+
+    for (auto&& range : config.ranges) {
+        validateRange(range);
+        EXPECT_EQ(0u, range.scanSpacing);
+    }
+
+    if (supportsFM(config)) {
+        EXPECT_GE(popcountll(config.fmDeemphasis), 1);
+    }
+}
+
+/**
+ * Test fetching DAB regional configuration.
+ *
+ * Verifies that:
+ *  - DAB regional configuration is either set at startup or not supported at all by the hardware;
+ *  - all channel labels match correct format;
+ *  - all channel frequencies are in correct range.
+ */
+TEST_F(BroadcastRadioHalTest, GetDabRegionConfig) {
+    Result halResult;
+    hidl_vec<DabTableEntry> config;
+    auto cb = [&](Result result, hidl_vec<DabTableEntry> configCb) {
+        halResult = result;
+        config = configCb;
+    };
+    auto hidlResult = mModule->getDabRegionConfig(cb);
+    ASSERT_TRUE(hidlResult.isOk());
+
+    if (halResult == Result::NOT_SUPPORTED) {
+        printSkipped("DAB not supported");
+        return;
+    }
+    ASSERT_EQ(Result::OK, halResult);
+
+    std::regex re("^[A-Z0-9]{2,5}$");
+    // double-check correctness of the test
+    ASSERT_TRUE(std::regex_match("5A", re));
+    ASSERT_FALSE(std::regex_match("5a", re));
+    ASSERT_FALSE(std::regex_match("123ABC", re));
+
+    for (auto&& entry : config) {
+        EXPECT_TRUE(std::regex_match(std::string(entry.label), re));
+
+        auto id = utils::make_identifier(IdentifierType::DAB_FREQUENCY, entry.frequency);
+        EXPECT_TRUE(utils::isValid(id));
+    }
+}
+
 /**
  * Test tuning with FM selector.
  *
@@ -505,21 +670,74 @@
 TEST_F(BroadcastRadioHalTest, GetProgramList) {
     ASSERT_TRUE(openSession());
 
-    EXPECT_TIMEOUT_CALL(*mCallback, onProgramListReady).Times(AnyNumber());
+    getProgramList();
+}
 
-    auto startResult = mSession->startProgramListUpdates({});
-    if (startResult == Result::NOT_SUPPORTED) {
-        printSkipped("Program list not supported");
+/**
+ * Test HD_STATION_NAME correctness.
+ *
+ * Verifies that if a program on the list contains HD_STATION_NAME identifier:
+ *  - the program provides station name in its metadata;
+ *  - the identifier matches the name;
+ *  - there is only one identifier of that type.
+ */
+TEST_F(BroadcastRadioHalTest, HdRadioStationNameId) {
+    ASSERT_TRUE(openSession());
+
+    auto list = getProgramList();
+    if (!list) return;
+
+    for (auto&& program : *list) {
+        auto nameIds = utils::getAllIds(program.selector, IdentifierType::HD_STATION_NAME);
+        EXPECT_LE(nameIds.size(), 1u);
+        if (nameIds.size() == 0) continue;
+
+        auto name = utils::getMetadataString(program, MetadataKey::PROGRAM_NAME);
+        if (!name) name = utils::getMetadataString(program, MetadataKey::RDS_PS);
+        ASSERT_TRUE(name.has_value());
+
+        auto expectedId = utils::make_hdradio_station_name(*name);
+        EXPECT_EQ(expectedId.value, nameIds[0]);
+    }
+}
+
+/**
+ * Test announcement observer registration.
+ *
+ * Verifies that:
+ *  - registerAnnouncementObserver either succeeds or returns NOT_SUPPORTED;
+ *  - if it succeeds, it returns a valid close handle (which is a nullptr otherwise);
+ *  - closing handle does not crash.
+ */
+TEST_F(BroadcastRadioHalTest, AnnouncementObserverRegistration) {
+    sp<AnnouncementObserverMock> observer = new AnnouncementObserverMock();
+
+    Result halResult = Result::UNKNOWN_ERROR;
+    sp<ICloseHandle> closeHandle = nullptr;
+    auto cb = [&](Result result, const sp<ICloseHandle>& closeHandle_) {
+        halResult = result;
+        closeHandle = closeHandle_;
+    };
+
+    auto hidlResult =
+        mModule->registerAnnouncementObserver({AnnouncementType::EMERGENCY}, observer, cb);
+    ASSERT_TRUE(hidlResult.isOk());
+
+    if (halResult == Result::NOT_SUPPORTED) {
+        ASSERT_EQ(nullptr, closeHandle.get());
+        printSkipped("Announcements not supported");
         return;
     }
-    ASSERT_EQ(Result::OK, startResult);
 
-    EXPECT_TIMEOUT_CALL_WAIT(*mCallback, onProgramListReady, timeout::programListScan);
+    ASSERT_EQ(Result::OK, halResult);
+    ASSERT_NE(nullptr, closeHandle.get());
 
-    auto stopResult = mSession->stopProgramListUpdates();
-    EXPECT_TRUE(stopResult.isOk());
+    closeHandle->close();
 }
 
+// TODO(b/70939328): test ProgramInfo's currentlyTunedId and
+// currentlyTunedChannel once the program list is implemented.
+
 }  // namespace vts
 }  // namespace V2_0
 }  // namespace broadcastradio
diff --git a/broadcastradio/common/tests/Android.bp b/broadcastradio/common/tests/Android.bp
index 512c02e..f6a3b6f 100644
--- a/broadcastradio/common/tests/Android.bp
+++ b/broadcastradio/common/tests/Android.bp
@@ -22,6 +22,9 @@
         "-Wextra",
         "-Werror",
     ],
+    cppflags: [
+        "-std=c++1z",
+    ],
     srcs: [
         "CommonXX_test.cpp",
     ],
@@ -43,8 +46,12 @@
         "-Wextra",
         "-Werror",
     ],
+    cppflags: [
+        "-std=c++1z",
+    ],
     srcs: [
         "IdentifierIterator_test.cpp",
+        "ProgramIdentifier_test.cpp",
     ],
     static_libs: [
         "android.hardware.broadcastradio@common-utils-2x-lib",
diff --git a/broadcastradio/common/tests/ProgramIdentifier_test.cpp b/broadcastradio/common/tests/ProgramIdentifier_test.cpp
new file mode 100644
index 0000000..51ad014
--- /dev/null
+++ b/broadcastradio/common/tests/ProgramIdentifier_test.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <broadcastradio-utils-2x/Utils.h>
+#include <gtest/gtest.h>
+
+#include <optional>
+
+namespace {
+
+namespace utils = android::hardware::broadcastradio::utils;
+
+TEST(ProgramIdentifierTest, hdRadioStationName) {
+    auto verify = [](std::string name, uint64_t nameId) {
+        auto id = utils::make_hdradio_station_name(name);
+        EXPECT_EQ(nameId, id.value) << "Failed to convert '" << name << "'";
+    };
+
+    verify("", 0);
+    verify("Abc", 0x434241);
+    verify("Some Station 1", 0x54415453454d4f53);
+    verify("Station1", 0x314e4f4954415453);
+    verify("!@#$%^&*()_+", 0);
+    verify("-=[]{};':\"0", 0x30);
+}
+
+}  // anonymous namespace
diff --git a/broadcastradio/common/utils2x/Android.bp b/broadcastradio/common/utils2x/Android.bp
index c6b94af..aab94f2 100644
--- a/broadcastradio/common/utils2x/Android.bp
+++ b/broadcastradio/common/utils2x/Android.bp
@@ -23,6 +23,9 @@
         "-Wextra",
         "-Werror",
     ],
+    cppflags: [
+        "-std=c++1z",
+    ],
     srcs: [
         "Utils.cpp",
     ],
diff --git a/broadcastradio/common/utils2x/Utils.cpp b/broadcastradio/common/utils2x/Utils.cpp
index 10a155b..6fe9554 100644
--- a/broadcastradio/common/utils2x/Utils.cpp
+++ b/broadcastradio/common/utils2x/Utils.cpp
@@ -89,6 +89,18 @@
     return IdentifierIterator(sel) + 1 /* primary id */ + sel.secondaryIds.size();
 }
 
+FrequencyBand getBand(uint64_t freq) {
+    // keep in sync with
+    // frameworks/base/services/core/java/com/android/server/broadcastradio/hal2/Utils.java
+    if (freq < 30) return FrequencyBand::UNKNOWN;
+    if (freq < 500) return FrequencyBand::AM_LW;
+    if (freq < 1705) return FrequencyBand::AM_MW;
+    if (freq < 30000) return FrequencyBand::AM_SW;
+    if (freq < 60000) return FrequencyBand::UNKNOWN;
+    if (freq < 110000) return FrequencyBand::FM;
+    return FrequencyBand::UNKNOWN;
+}
+
 static bool bothHaveId(const ProgramSelector& a, const ProgramSelector& b,
                        const IdentifierType type) {
     return hasId(a, type) && hasId(b, type);
@@ -194,7 +206,7 @@
     return false;
 }
 
-static bool isValid(const ProgramIdentifier& id) {
+bool isValid(const ProgramIdentifier& id) {
     auto val = id.value;
     bool valid = true;
 
@@ -206,8 +218,13 @@
     };
 
     switch (getType(id)) {
-        case IdentifierType::AMFM_FREQUENCY:
+        case IdentifierType::INVALID:
+            expect(false, "IdentifierType::INVALID");
+            break;
         case IdentifierType::DAB_FREQUENCY:
+            expect(val > 100000u, "f > 100MHz");
+        // fallthrough
+        case IdentifierType::AMFM_FREQUENCY:
         case IdentifierType::DRMO_FREQUENCY:
             expect(val > 100u, "f > 100kHz");
             expect(val < 10000000u, "f < 10GHz");
@@ -228,6 +245,15 @@
             expect(freq < 10000000u, "f < 10GHz");
             break;
         }
+        case IdentifierType::HD_STATION_NAME: {
+            while (val > 0) {
+                auto ch = static_cast<char>(val & 0xFF);
+                val >>= 8;
+                expect((ch >= '0' && ch <= '9') || (ch >= 'A' && ch <= 'Z'),
+                       "HD_STATION_NAME does not match [A-Z0-9]+");
+            }
+            break;
+        }
         case IdentifierType::DAB_SID_EXT: {
             auto sid = val & 0xFFFF;  // 16bit
             val >>= 16;
@@ -350,6 +376,40 @@
     }
 }
 
+std::optional<std::string> getMetadataString(const V2_0::ProgramInfo& info,
+                                             const V2_0::MetadataKey key) {
+    auto isKey = [key](const V2_0::Metadata& item) {
+        return static_cast<V2_0::MetadataKey>(item.key) == key;
+    };
+
+    auto it = std::find_if(info.metadata.begin(), info.metadata.end(), isKey);
+    if (it == info.metadata.end()) return std::nullopt;
+
+    return it->stringValue;
+}
+
+V2_0::ProgramIdentifier make_hdradio_station_name(const std::string& name) {
+    constexpr size_t maxlen = 8;
+
+    std::string shortName;
+    shortName.reserve(maxlen);
+
+    auto&& loc = std::locale::classic();
+    for (char ch : name) {
+        if (!std::isalnum(ch, loc)) continue;
+        shortName.push_back(std::toupper(ch, loc));
+        if (shortName.length() >= maxlen) break;
+    }
+
+    uint64_t val = 0;
+    for (auto rit = shortName.rbegin(); rit != shortName.rend(); ++rit) {
+        val <<= 8;
+        val |= static_cast<uint8_t>(*rit);
+    }
+
+    return make_identifier(IdentifierType::HD_STATION_NAME, val);
+}
+
 }  // namespace utils
 }  // namespace broadcastradio
 }  // namespace hardware
diff --git a/broadcastradio/common/utils2x/include/broadcastradio-utils-2x/Utils.h b/broadcastradio/common/utils2x/include/broadcastradio-utils-2x/Utils.h
index bac11fd..5e51941 100644
--- a/broadcastradio/common/utils2x/include/broadcastradio-utils-2x/Utils.h
+++ b/broadcastradio/common/utils2x/include/broadcastradio-utils-2x/Utils.h
@@ -18,6 +18,7 @@
 
 #include <android/hardware/broadcastradio/2.0/types.h>
 #include <chrono>
+#include <optional>
 #include <queue>
 #include <thread>
 #include <unordered_set>
@@ -27,6 +28,14 @@
 namespace broadcastradio {
 namespace utils {
 
+enum class FrequencyBand {
+    UNKNOWN,
+    FM,
+    AM_LW,
+    AM_MW,
+    AM_SW,
+};
+
 V2_0::IdentifierType getType(uint32_t typeAsInt);
 V2_0::IdentifierType getType(const V2_0::ProgramIdentifier& id);
 
@@ -64,6 +73,16 @@
 IdentifierIterator end(const V2_0::ProgramSelector& sel);
 
 /**
+ * Guesses band from the frequency value.
+ *
+ * The band bounds are not exact to cover multiple regions.
+ * The function is biased towards success, i.e. it never returns
+ * FrequencyBand::UNKNOWN for correct frequency, but a result for
+ * incorrect one is undefined (it doesn't have to return UNKNOWN).
+ */
+FrequencyBand getBand(uint64_t frequency);
+
+/**
  * Checks, if {@code pointer} tunes to {@channel}.
  *
  * For example, having a channel {AMFM_FREQUENCY = 103.3}:
@@ -105,6 +124,7 @@
  */
 bool isSupported(const V2_0::Properties& prop, const V2_0::ProgramSelector& sel);
 
+bool isValid(const V2_0::ProgramIdentifier& id);
 bool isValid(const V2_0::ProgramSelector& sel);
 
 V2_0::ProgramIdentifier make_identifier(V2_0::IdentifierType type, uint64_t value);
@@ -127,6 +147,11 @@
 
 void updateProgramList(ProgramInfoSet& list, const V2_0::ProgramListChunk& chunk);
 
+std::optional<std::string> getMetadataString(const V2_0::ProgramInfo& info,
+                                             const V2_0::MetadataKey key);
+
+V2_0::ProgramIdentifier make_hdradio_station_name(const std::string& name);
+
 }  // namespace utils
 }  // namespace broadcastradio
 }  // namespace hardware
diff --git a/camera/metadata/3.3/Android.bp b/camera/metadata/3.3/Android.bp
index 458f895..3f1dabc 100644
--- a/camera/metadata/3.3/Android.bp
+++ b/camera/metadata/3.3/Android.bp
@@ -14,6 +14,9 @@
     ],
     types: [
         "CameraMetadataEnumAndroidControlAfSceneChange",
+        "CameraMetadataEnumAndroidControlCaptureIntent",
+        "CameraMetadataEnumAndroidLensPoseReference",
+        "CameraMetadataEnumAndroidRequestAvailableCapabilities",
         "CameraMetadataTag",
     ],
     gen_java: true,
diff --git a/camera/metadata/3.3/types.hal b/camera/metadata/3.3/types.hal
index 7f96d9e..3027555 100644
--- a/camera/metadata/3.3/types.hal
+++ b/camera/metadata/3.3/types.hal
@@ -43,12 +43,39 @@
 
     ANDROID_CONTROL_END_3_3,
 
+    /** android.lens.poseReference [static, enum, public]
+     *
+     * <p>The origin for ANDROID_LENS_POSE_TRANSLATION.</p>
+     *
+     * @see ANDROID_LENS_POSE_TRANSLATION
+     */
+    ANDROID_LENS_POSE_REFERENCE = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_LENS_END,
+
+    ANDROID_LENS_END_3_3,
+
+    /** android.info.version [static, byte, public]
+     *
+     * <p>A short string for manufacturer version information about the camera device, such as
+     * ISP hardware, sensors, etc.</p>
+     */
+    ANDROID_INFO_VERSION = android.hardware.camera.metadata@3.2::CameraMetadataTag:ANDROID_INFO_END,
+
+    ANDROID_INFO_END_3_3,
+
 };
 
 /*
  * Enumeration definitions for the various entries that need them
  */
 
+/** android.control.captureIntent enumeration values added since v3.2
+ * @see ANDROID_CONTROL_CAPTURE_INTENT
+ */
+enum CameraMetadataEnumAndroidControlCaptureIntent :
+        @3.2::CameraMetadataEnumAndroidControlCaptureIntent {
+    ANDROID_CONTROL_CAPTURE_INTENT_MOTION_TRACKING,
+};
+
 /** android.control.afSceneChange enumeration values
  * @see ANDROID_CONTROL_AF_SCENE_CHANGE
  */
@@ -56,3 +83,19 @@
     ANDROID_CONTROL_AF_SCENE_CHANGE_NOT_DETECTED,
     ANDROID_CONTROL_AF_SCENE_CHANGE_DETECTED,
 };
+
+/** android.lens.poseReference enumeration values
+ * @see ANDROID_LENS_POSE_REFERENCE
+ */
+enum CameraMetadataEnumAndroidLensPoseReference : uint32_t {
+    ANDROID_LENS_POSE_REFERENCE_PRIMARY_CAMERA,
+    ANDROID_LENS_POSE_REFERENCE_GYROSCOPE,
+};
+
+/** android.request.availableCapabilities enumeration values added since v3.2
+ * @see ANDROID_REQUEST_AVAILABLE_CAPABILITIES
+ */
+enum CameraMetadataEnumAndroidRequestAvailableCapabilities :
+        @3.2::CameraMetadataEnumAndroidRequestAvailableCapabilities {
+    ANDROID_REQUEST_AVAILABLE_CAPABILITIES_MOTION_TRACKING,
+};
diff --git a/compatibility_matrix.current.xml b/compatibility_matrix.current.xml
index 5b033e7..9287d67 100644
--- a/compatibility_matrix.current.xml
+++ b/compatibility_matrix.current.xml
@@ -81,7 +81,7 @@
     </hal>
     <hal format="hidl" optional="false">
         <name>android.hardware.configstore</name>
-        <version>1.0-1</version>
+        <version>1.0</version>
         <interface>
             <name>ISurfaceFlingerConfigs</name>
             <instance>default</instance>
diff --git a/configstore/1.1/default/Android.mk b/configstore/1.0/default/Android.mk
similarity index 63%
rename from configstore/1.1/default/Android.mk
rename to configstore/1.0/default/Android.mk
index 53e454b..22d7c92 100644
--- a/configstore/1.1/default/Android.mk
+++ b/configstore/1.0/default/Android.mk
@@ -2,12 +2,15 @@
 
 ################################################################################
 include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.configstore@1.1-service
-LOCAL_REQUIRED_MODULES_arm64 := configstore@1.1.policy
+LOCAL_MODULE := android.hardware.configstore@1.0-service
+# seccomp is not required for coverage build.
+ifneq ($(NATIVE_COVERAGE),true)
+LOCAL_REQUIRED_MODULES_arm64 := configstore@1.0.policy
+endif
 LOCAL_PROPRIETARY_MODULE := true
 LOCAL_MODULE_CLASS := EXECUTABLES
 LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_INIT_RC := android.hardware.configstore@1.1-service.rc
+LOCAL_INIT_RC := android.hardware.configstore@1.0-service.rc
 LOCAL_SRC_FILES:= service.cpp
 
 include $(LOCAL_PATH)/surfaceflinger.mk
@@ -19,17 +22,16 @@
     libhwminijail \
     liblog \
     libutils \
-    android.hardware.configstore@1.0 \
-    android.hardware.configstore@1.1
+    android.hardware.configstore@1.0
 
 include $(BUILD_EXECUTABLE)
 
 # seccomp filter for configstore
 ifeq ($(TARGET_ARCH), $(filter $(TARGET_ARCH), arm64))
 include $(CLEAR_VARS)
-LOCAL_MODULE := configstore@1.1.policy
+LOCAL_MODULE := configstore@1.0.policy
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/seccomp_policy
-LOCAL_SRC_FILES := seccomp_policy/configstore@1.1-$(TARGET_ARCH).policy
+LOCAL_SRC_FILES := seccomp_policy/configstore@1.0-$(TARGET_ARCH).policy
 include $(BUILD_PREBUILT)
 endif
diff --git a/configstore/1.1/default/SurfaceFlingerConfigs.cpp b/configstore/1.0/default/SurfaceFlingerConfigs.cpp
similarity index 96%
rename from configstore/1.1/default/SurfaceFlingerConfigs.cpp
rename to configstore/1.0/default/SurfaceFlingerConfigs.cpp
index 5a040f2..3239274 100644
--- a/configstore/1.1/default/SurfaceFlingerConfigs.cpp
+++ b/configstore/1.0/default/SurfaceFlingerConfigs.cpp
@@ -19,7 +19,7 @@
 namespace android {
 namespace hardware {
 namespace configstore {
-namespace V1_1 {
+namespace V1_0 {
 namespace implementation {
 
 // Methods from ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs
@@ -139,13 +139,10 @@
     return Void();
 }
 
-// Methods from ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs
-// follow.
-
 // Methods from ::android::hidl::base::V1_0::IBase follow.
 
 }  // namespace implementation
-}  // namespace V1_1
+}  // namespace V1_0
 }  // namespace configstore
 }  // namespace hardware
 }  // namespace android
diff --git a/configstore/1.1/default/SurfaceFlingerConfigs.h b/configstore/1.0/default/SurfaceFlingerConfigs.h
similarity index 77%
rename from configstore/1.1/default/SurfaceFlingerConfigs.h
rename to configstore/1.0/default/SurfaceFlingerConfigs.h
index 53e8ae8..32e5fc3 100644
--- a/configstore/1.1/default/SurfaceFlingerConfigs.h
+++ b/configstore/1.0/default/SurfaceFlingerConfigs.h
@@ -1,17 +1,17 @@
-#ifndef ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
-#define ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
+#ifndef ANDROID_HARDWARE_CONFIGSTORE_V1_0_SURFACEFLINGERCONFIGS_H
+#define ANDROID_HARDWARE_CONFIGSTORE_V1_0_SURFACEFLINGERCONFIGS_H
 
-#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
+#include <android/hardware/configstore/1.0/ISurfaceFlingerConfigs.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
 
 namespace android {
 namespace hardware {
 namespace configstore {
-namespace V1_1 {
+namespace V1_0 {
 namespace implementation {
 
-using ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs;
+using ::android::hardware::configstore::V1_0::ISurfaceFlingerConfigs;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
 using ::android::sp;
@@ -32,16 +32,13 @@
     Return<void> maxFrameBufferAcquiredBuffers(maxFrameBufferAcquiredBuffers_cb _hidl_cb) override;
     Return<void> startGraphicsAllocatorService(startGraphicsAllocatorService_cb _hidl_cb) override;
 
-    // Methods from
-    // ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs follow.
-
     // Methods from ::android::hidl::base::V1_0::IBase follow.
 };
 
 }  // namespace implementation
-}  // namespace V1_1
+}  // namespace V1_0
 }  // namespace configstore
 }  // namespace hardware
 }  // namespace android
 
-#endif  // ANDROID_HARDWARE_CONFIGSTORE_V1_1_SURFACEFLINGERCONFIGS_H
+#endif  // ANDROID_HARDWARE_CONFIGSTORE_V1_0_SURFACEFLINGERCONFIGS_H
diff --git a/configstore/1.0/default/android.hardware.configstore@1.0-service.rc b/configstore/1.0/default/android.hardware.configstore@1.0-service.rc
new file mode 100644
index 0000000..40fb498
--- /dev/null
+++ b/configstore/1.0/default/android.hardware.configstore@1.0-service.rc
@@ -0,0 +1,4 @@
+service vendor.configstore-hal-1-0 /vendor/bin/hw/android.hardware.configstore@1.0-service
+    class hal animation
+    user system
+    group system
diff --git a/configstore/1.1/default/seccomp_policy/configstore@1.1-arm64.policy b/configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
similarity index 100%
rename from configstore/1.1/default/seccomp_policy/configstore@1.1-arm64.policy
rename to configstore/1.0/default/seccomp_policy/configstore@1.0-arm64.policy
diff --git a/configstore/1.1/default/service.cpp b/configstore/1.0/default/service.cpp
similarity index 80%
rename from configstore/1.1/default/service.cpp
rename to configstore/1.0/default/service.cpp
index 535e0cd..c9c81a0 100644
--- a/configstore/1.1/default/service.cpp
+++ b/configstore/1.0/default/service.cpp
@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.configstore@1.1-service"
+#define LOG_TAG "android.hardware.configstore@1.0-service"
 
-#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
+#include <android/hardware/configstore/1.0/ISurfaceFlingerConfigs.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hwminijail/HardwareMinijail.h>
 
@@ -24,8 +24,8 @@
 
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
-using android::hardware::configstore::V1_1::ISurfaceFlingerConfigs;
-using android::hardware::configstore::V1_1::implementation::SurfaceFlingerConfigs;
+using android::hardware::configstore::V1_0::ISurfaceFlingerConfigs;
+using android::hardware::configstore::V1_0::implementation::SurfaceFlingerConfigs;
 using android::hardware::SetupMinijail;
 using android::sp;
 using android::status_t;
@@ -34,7 +34,7 @@
 int main() {
     configureRpcThreadpool(10, true);
 
-    SetupMinijail("/vendor/etc/seccomp_policy/configstore@1.1.policy");
+    SetupMinijail("/vendor/etc/seccomp_policy/configstore@1.0.policy");
 
     sp<ISurfaceFlingerConfigs> surfaceFlingerConfigs = new SurfaceFlingerConfigs;
     status_t status = surfaceFlingerConfigs->registerAsService();
diff --git a/configstore/1.1/default/surfaceflinger.mk b/configstore/1.0/default/surfaceflinger.mk
similarity index 100%
rename from configstore/1.1/default/surfaceflinger.mk
rename to configstore/1.0/default/surfaceflinger.mk
diff --git a/configstore/1.1/Android.bp b/configstore/1.1/Android.bp
deleted file mode 100644
index f0a1748..0000000
--- a/configstore/1.1/Android.bp
+++ /dev/null
@@ -1,18 +0,0 @@
-// This file is autogenerated by hidl-gen -Landroidbp.
-
-hidl_interface {
-    name: "android.hardware.configstore@1.1",
-    root: "android.hardware",
-    vndk: {
-        enabled: true,
-    },
-    srcs: [
-        "ISurfaceFlingerConfigs.hal",
-    ],
-    interfaces: [
-        "android.hardware.configstore@1.0",
-        "android.hidl.base@1.0",
-    ],
-    gen_java: true,
-}
-
diff --git a/configstore/1.1/ISurfaceFlingerConfigs.hal b/configstore/1.1/ISurfaceFlingerConfigs.hal
deleted file mode 100644
index 5eacbe0..0000000
--- a/configstore/1.1/ISurfaceFlingerConfigs.hal
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.1 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.1
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.hardware.configstore@1.1;
-
-import @1.0::ISurfaceFlingerConfigs;
-
-/**
- * New revision of ISurfaceFlingerConfigs
- */
-
-interface ISurfaceFlingerConfigs extends @1.0::ISurfaceFlingerConfigs {
-};
diff --git a/configstore/1.1/default/android.hardware.configstore@1.1-service.rc b/configstore/1.1/default/android.hardware.configstore@1.1-service.rc
deleted file mode 100644
index 105678a..0000000
--- a/configstore/1.1/default/android.hardware.configstore@1.1-service.rc
+++ /dev/null
@@ -1,4 +0,0 @@
-service vendor.configstore-hal /vendor/bin/hw/android.hardware.configstore@1.1-service
-    class hal animation
-    user system
-    group system
diff --git a/configstore/1.1/vts/functional/Android.bp b/configstore/1.1/vts/functional/Android.bp
deleted file mode 100644
index 59beb09..0000000
--- a/configstore/1.1/vts/functional/Android.bp
+++ /dev/null
@@ -1,26 +0,0 @@
-//
-// Copyright (C) 2017 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-
-cc_test {
-    name: "VtsHalConfigstoreV1_1TargetTest",
-    defaults: ["VtsHalTargetTestDefaults"],
-    srcs: ["VtsHalConfigstoreV1_1TargetTest.cpp"],
-    static_libs: [
-        "android.hardware.configstore@1.0",
-        "android.hardware.configstore@1.1",
-    ],
-}
-
diff --git a/configstore/1.1/vts/functional/VtsHalConfigstoreV1_1TargetTest.cpp b/configstore/1.1/vts/functional/VtsHalConfigstoreV1_1TargetTest.cpp
deleted file mode 100644
index bd3da4c..0000000
--- a/configstore/1.1/vts/functional/VtsHalConfigstoreV1_1TargetTest.cpp
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright (C) 2017 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "ConfigstoreHidlHalTest"
-
-#include <VtsHalHidlTargetTestBase.h>
-#include <android-base/logging.h>
-#include <android/hardware/configstore/1.0/types.h>
-#include <android/hardware/configstore/1.1/ISurfaceFlingerConfigs.h>
-#include <unistd.h>
-
-using ::android::hardware::configstore::V1_1::ISurfaceFlingerConfigs;
-using ::android::sp;
-
-#define ASSERT_OK(ret) ASSERT_TRUE(ret.isOk())
-#define EXPECT_OK(ret) EXPECT_TRUE(ret.isOk())
-
-class ConfigstoreHidlTest : public ::testing::VtsHalHidlTargetTestBase {
-   public:
-    sp<ISurfaceFlingerConfigs> sfConfigs;
-
-    virtual void SetUp() override {
-        sfConfigs = ::testing::VtsHalHidlTargetTestBase::getService<ISurfaceFlingerConfigs>();
-        ASSERT_NE(sfConfigs, nullptr);
-    }
-
-    virtual void TearDown() override {}
-};
-
-/**
- * Placeholder testcase.
- */
-TEST_F(ConfigstoreHidlTest, Test) {
-    ASSERT_TRUE(true);
-}
-
-int main(int argc, char** argv) {
-    ::testing::InitGoogleTest(&argc, argv);
-    int status = RUN_ALL_TESTS();
-    LOG(INFO) << "Test result = " << status;
-    return status;
-}
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index fd75dbd..f9c868d 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -99,8 +99,8 @@
         legacyPattern.mEncryptBlocks = pattern.encryptBlocks;
         legacyPattern.mSkipBlocks = pattern.skipBlocks;
 
-        android::CryptoPlugin::SubSample *legacySubSamples =
-            new android::CryptoPlugin::SubSample[subSamples.size()];
+        std::unique_ptr<android::CryptoPlugin::SubSample[]> legacySubSamples =
+                std::make_unique<android::CryptoPlugin::SubSample[]>(subSamples.size());
 
         for (size_t i = 0; i < subSamples.size(); i++) {
             legacySubSamples[i].mNumBytesOfClearData
@@ -145,11 +145,9 @@
             destPtr = static_cast<void *>(handle);
         }
         ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(),
-                legacyMode, legacyPattern, srcPtr, legacySubSamples,
+                legacyMode, legacyPattern, srcPtr, legacySubSamples.get(),
                 subSamples.size(), destPtr, &detailMessage);
 
-        delete[] legacySubSamples;
-
         uint32_t status;
         uint32_t bytesWritten;
 
diff --git a/gnss/1.0/default/Gnss.cpp b/gnss/1.0/default/Gnss.cpp
index f362749..32c131c 100644
--- a/gnss/1.0/default/Gnss.cpp
+++ b/gnss/1.0/default/Gnss.cpp
@@ -121,7 +121,7 @@
     svStatus.numSvs = status->num_svs;
 
     if (svStatus.numSvs > static_cast<uint32_t>(GnssMax::SVS_COUNT)) {
-        ALOGW("Too many satellites %zd. Clamps to %d.", svStatus.numSvs, GnssMax::SVS_COUNT);
+        ALOGW("Too many satellites %u. Clamps to %d.", svStatus.numSvs, GnssMax::SVS_COUNT);
         svStatus.numSvs = static_cast<uint32_t>(GnssMax::SVS_COUNT);
     }
 
@@ -191,7 +191,7 @@
      * GnssMax::SVS_COUNT entries.
      */
     if (svStatus.numSvs > static_cast<uint32_t>(GnssMax::SVS_COUNT)) {
-        ALOGW("Too many satellites %zd. Clamps to %d.", svStatus.numSvs, GnssMax::SVS_COUNT);
+        ALOGW("Too many satellites %u. Clamps to %d.", svStatus.numSvs, GnssMax::SVS_COUNT);
         svStatus.numSvs = static_cast<uint32_t>(GnssMax::SVS_COUNT);
     }
 
diff --git a/gnss/1.1/Android.bp b/gnss/1.1/Android.bp
index 6909807..417b4f5 100644
--- a/gnss/1.1/Android.bp
+++ b/gnss/1.1/Android.bp
@@ -9,6 +9,7 @@
     srcs: [
         "IGnss.hal",
         "IGnssCallback.hal",
+        "IGnssConfiguration.hal",
         "IGnssMeasurement.hal",
     ],
     interfaces: [
diff --git a/gnss/1.1/IGnss.hal b/gnss/1.1/IGnss.hal
index d5e0c3e..0c3d876 100644
--- a/gnss/1.1/IGnss.hal
+++ b/gnss/1.1/IGnss.hal
@@ -18,8 +18,9 @@
 
 import @1.0::IGnss;
 
-import IGnssMeasurement;
 import IGnssCallback;
+import IGnssConfiguration;
+import IGnssMeasurement;
 
 /** Represents the standard GNSS (Global Navigation Satellite System) interface. */
 interface IGnss extends @1.0::IGnss {
@@ -65,6 +66,13 @@
              generates (bool success);
 
    /**
+    * This method returns the IGnssConfiguration interface.
+    *
+    * @return gnssConfigurationIface Handle to the IGnssConfiguration interface.
+    */
+    getExtensionGnssConfiguration_1_1() generates (IGnssConfiguration gnssConfigurationIface);
+
+   /**
     * This method returns the IGnssMeasurement interface.
     *
     * @return gnssMeasurementIface Handle to the IGnssMeasurement interface.
diff --git a/gnss/1.1/IGnssConfiguration.hal b/gnss/1.1/IGnssConfiguration.hal
new file mode 100644
index 0000000..105fda3
--- /dev/null
+++ b/gnss/1.1/IGnssConfiguration.hal
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.gnss@1.1;
+
+import @1.0::IGnssConfiguration;
+import @1.0::GnssConstellationType;
+
+/**
+ * Extended interface for GNSS Configuration support.
+ */
+interface IGnssConfiguration extends @1.0::IGnssConfiguration {
+    struct BlacklistedSource {
+        /**
+         * Defines the constellation of the given satellite(s).
+         */
+        GnssConstellationType constellation;
+
+        /**
+         * Satellite (space vehicle) ID number, as defined in GnssSvInfo::svid
+         *
+         * Or 0 to blacklist all svid's for the specified constellation
+         */
+        int16_t svid;
+    };
+
+    /**
+     * Injects a vector of BlacklistedSource(s) which the HAL must not use to calculate the
+     * GNSS location output.
+     *
+     * The superset of all satellite sources provided, including wildcards, in the latest call
+     * to this method, is the set of satellites sources that must not be used in calculating
+     * location.
+     *
+     * All measurements from the specified satellites, across frequency bands, are blacklisted
+     * together.
+     *
+     * If this method is never called after the IGnssConfiguration.hal connection is made on boot,
+     * or is called with an empty vector, then no satellites are to be blacklisted as a result of
+     * this API.
+     *
+     * This blacklist must be considered as an additional source of which satellites
+     * should not be trusted for location on top of existing sources of similar information
+     * such as satellite broadcast health being unhealthy and measurement outlier removal.
+     *
+     * @param blacklist The BlacklistedSource(s) of satellites the HAL must not use.
+     *
+     * @return success Whether the HAL accepts and abides by the provided blacklist.
+     */
+    setBlacklist(vec<BlacklistedSource> blacklist) generates (bool success);
+};
\ No newline at end of file
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.cpp b/gnss/1.1/vts/functional/gnss_hal_test.cpp
index 2f4dd93..7e43b92 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test.cpp
@@ -14,9 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "VtsHalGnssV1_1TargetTest"
-#include <log/log.h>
-
 #include <gnss_hal_test.h>
 
 #include <chrono>
@@ -31,6 +28,7 @@
 
 void GnssHalTest::SetUp() {
     gnss_hal_ = ::testing::VtsHalHidlTargetTestBase::getService<IGnss>();
+    list_gnss_sv_status_.clear();
     ASSERT_NE(gnss_hal_, nullptr);
 }
 
@@ -43,18 +41,156 @@
     }
 }
 
+void GnssHalTest::StopAndClearLocations() {
+    auto result = gnss_hal_->stop();
+
+    EXPECT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+
+    /*
+     * Clear notify/waiting counter, allowing up till the timeout after
+     * the last reply for final startup messages to arrive (esp. system
+     * info.)
+     */
+    while (wait(TIMEOUT_SEC) == std::cv_status::no_timeout) {
+    }
+}
+
+void GnssHalTest::SetPositionMode(const int min_interval_msec, const bool low_power_mode) {
+    const int kPreferredAccuracy = 0;  // Ideally perfect (matches GnssLocationProvider)
+    const int kPreferredTimeMsec = 0;  // Ideally immediate
+
+    auto result = gnss_hal_->setPositionMode_1_1(
+        IGnss::GnssPositionMode::MS_BASED, IGnss::GnssPositionRecurrence::RECURRENCE_PERIODIC,
+        min_interval_msec, kPreferredAccuracy, kPreferredTimeMsec, low_power_mode);
+
+    ASSERT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+}
+
+bool GnssHalTest::StartAndGetSingleLocation() {
+    auto result = gnss_hal_->start();
+
+    EXPECT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+
+    /*
+     * GPS signals initially optional for this test, so don't expect fast fix,
+     * or no timeout, unless signal is present
+     */
+    const int kFirstGnssLocationTimeoutSeconds = 15;
+
+    wait(kFirstGnssLocationTimeoutSeconds);
+    EXPECT_EQ(location_called_count_, 1);
+
+    if (location_called_count_ > 0) {
+        // don't require speed on first fix
+        CheckLocation(last_location_, false);
+        return true;
+    }
+    return false;
+}
+
+void GnssHalTest::CheckLocation(GnssLocation& location, bool check_speed) {
+    bool check_more_accuracies = (info_called_count_ > 0 && last_info_.yearOfHw >= 2017);
+
+    EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_LAT_LONG);
+    EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_ALTITUDE);
+    if (check_speed) {
+        EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED);
+    }
+    EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_HORIZONTAL_ACCURACY);
+    // New uncertainties available in O must be provided,
+    // at least when paired with modern hardware (2017+)
+    if (check_more_accuracies) {
+        EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_VERTICAL_ACCURACY);
+        if (check_speed) {
+            EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED_ACCURACY);
+            if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING) {
+                EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING_ACCURACY);
+            }
+        }
+    }
+    EXPECT_GE(location.latitudeDegrees, -90.0);
+    EXPECT_LE(location.latitudeDegrees, 90.0);
+    EXPECT_GE(location.longitudeDegrees, -180.0);
+    EXPECT_LE(location.longitudeDegrees, 180.0);
+    EXPECT_GE(location.altitudeMeters, -1000.0);
+    EXPECT_LE(location.altitudeMeters, 30000.0);
+    if (check_speed) {
+        EXPECT_GE(location.speedMetersPerSec, 0.0);
+        EXPECT_LE(location.speedMetersPerSec, 5.0);  // VTS tests are stationary.
+
+        // Non-zero speeds must be reported with an associated bearing
+        if (location.speedMetersPerSec > 0.0) {
+            EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING);
+        }
+    }
+
+    /*
+     * Tolerating some especially high values for accuracy estimate, in case of
+     * first fix with especially poor geometry (happens occasionally)
+     */
+    EXPECT_GT(location.horizontalAccuracyMeters, 0.0);
+    EXPECT_LE(location.horizontalAccuracyMeters, 250.0);
+
+    /*
+     * Some devices may define bearing as -180 to +180, others as 0 to 360.
+     * Both are okay & understandable.
+     */
+    if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING) {
+        EXPECT_GE(location.bearingDegrees, -180.0);
+        EXPECT_LE(location.bearingDegrees, 360.0);
+    }
+    if (location.gnssLocationFlags & GnssLocationFlags::HAS_VERTICAL_ACCURACY) {
+        EXPECT_GT(location.verticalAccuracyMeters, 0.0);
+        EXPECT_LE(location.verticalAccuracyMeters, 500.0);
+    }
+    if (location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED_ACCURACY) {
+        EXPECT_GT(location.speedAccuracyMetersPerSecond, 0.0);
+        EXPECT_LE(location.speedAccuracyMetersPerSecond, 50.0);
+    }
+    if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING_ACCURACY) {
+        EXPECT_GT(location.bearingAccuracyDegrees, 0.0);
+        EXPECT_LE(location.bearingAccuracyDegrees, 360.0);
+    }
+
+    // Check timestamp > 1.48e12 (47 years in msec - 1970->2017+)
+    EXPECT_GT(location.timestamp, 1.48e12);
+}
+
+void GnssHalTest::StartAndCheckLocations(int count) {
+    const int kMinIntervalMsec = 500;
+    const int kLocationTimeoutSubsequentSec = 2;
+    const bool kLowPowerMode = true;
+
+    SetPositionMode(kMinIntervalMsec, kLowPowerMode);
+
+    EXPECT_TRUE(StartAndGetSingleLocation());
+
+    for (int i = 1; i < count; i++) {
+        EXPECT_EQ(std::cv_status::no_timeout, wait(kLocationTimeoutSubsequentSec));
+        EXPECT_EQ(location_called_count_, i + 1);
+        // Don't cause confusion by checking details if no location yet
+        if (location_called_count_ > 0) {
+            // Should be more than 1 location by now, but if not, still don't check first fix speed
+            CheckLocation(last_location_, location_called_count_ > 1);
+        }
+    }
+}
+
 void GnssHalTest::notify() {
     std::unique_lock<std::mutex> lock(mtx_);
     notify_count_++;
     cv_.notify_one();
 }
 
-std::cv_status GnssHalTest::wait(int timeoutSeconds) {
+std::cv_status GnssHalTest::wait(int timeout_seconds) {
     std::unique_lock<std::mutex> lock(mtx_);
 
     auto status = std::cv_status::no_timeout;
     while (notify_count_ == 0) {
-        status = cv_.wait_for(lock, std::chrono::seconds(timeoutSeconds));
+        status = cv_.wait_for(lock, std::chrono::seconds(timeout_seconds));
         if (status == std::cv_status::timeout) return status;
     }
     notify_count_--;
@@ -93,3 +229,10 @@
     parent_.notify();
     return Void();
 }
+
+Return<void> GnssHalTest::GnssCallback::gnssSvStatusCb(
+    const IGnssCallback::GnssSvStatus& svStatus) {
+    ALOGI("GnssSvStatus received");
+    parent_.list_gnss_sv_status_.emplace_back(svStatus);
+    return Void();
+}
diff --git a/gnss/1.1/vts/functional/gnss_hal_test.h b/gnss/1.1/vts/functional/gnss_hal_test.h
index bbc8d9f..a06db5d 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test.h
+++ b/gnss/1.1/vts/functional/gnss_hal_test.h
@@ -17,11 +17,14 @@
 #ifndef GNSS_HAL_TEST_H_
 #define GNSS_HAL_TEST_H_
 
+#define LOG_TAG "VtsHalGnssV1_1TargetTest"
+
 #include <android/hardware/gnss/1.1/IGnss.h>
 
 #include <VtsHalHidlTargetTestBase.h>
 
 #include <condition_variable>
+#include <list>
 #include <mutex>
 
 using android::hardware::Return;
@@ -32,7 +35,9 @@
 using android::hardware::gnss::V1_1::IGnss;
 using android::hardware::gnss::V1_1::IGnssCallback;
 using android::hardware::gnss::V1_0::GnssLocationFlags;
+
 using android::sp;
+
 #define TIMEOUT_SEC 2  // for basic commands/responses
 
 // The main test class for GNSS HAL.
@@ -48,7 +53,7 @@
     void notify();
 
     /* Test code calls this function to wait for a callback */
-    std::cv_status wait(int timeoutSeconds);
+    std::cv_status wait(int timeout_seconds);
 
     /* Callback class for data & Event. */
     class GnssCallback : public IGnssCallback {
@@ -63,9 +68,6 @@
         Return<void> gnssStatusCb(const IGnssCallback::GnssStatusValue /* status */) override {
             return Void();
         }
-        Return<void> gnssSvStatusCb(const IGnssCallback::GnssSvStatus& /* svStatus */) override {
-            return Void();
-        }
         Return<void> gnssNmeaCb(int64_t /* timestamp */,
                                 const android::hardware::hidl_string& /* nmea */) override {
             return Void();
@@ -74,10 +76,11 @@
         Return<void> gnssReleaseWakelockCb() override { return Void(); }
         Return<void> gnssRequestTimeCb() override { return Void(); }
         // Actual (test) callback handlers
+        Return<void> gnssNameCb(const android::hardware::hidl_string& name) override;
         Return<void> gnssLocationCb(const GnssLocation& location) override;
         Return<void> gnssSetCapabilitesCb(uint32_t capabilities) override;
         Return<void> gnssSetSystemInfoCb(const IGnssCallback::GnssSystemInfo& info) override;
-        Return<void> gnssNameCb(const android::hardware::hidl_string& name) override;
+        Return<void> gnssSvStatusCb(const IGnssCallback::GnssSvStatus& svStatus) override;
     };
 
     /*
@@ -86,120 +89,35 @@
      *
      * returns  true if a location was successfully generated
      */
-    bool StartAndGetSingleLocation(bool checkAccuracies) {
-        auto result = gnss_hal_->start();
-
-        EXPECT_TRUE(result.isOk());
-        EXPECT_TRUE(result);
-
-        /*
-         * GPS signals initially optional for this test, so don't expect fast fix,
-         * or no timeout, unless signal is present
-         */
-        int firstGnssLocationTimeoutSeconds = 15;
-
-        wait(firstGnssLocationTimeoutSeconds);
-        EXPECT_EQ(location_called_count_, 1);
-
-        if (location_called_count_ > 0) {
-            // don't require speed on first fix
-            CheckLocation(last_location_, checkAccuracies, false);
-            return true;
-        }
-        return false;
-    }
+    bool StartAndGetSingleLocation();
 
     /*
      * CheckLocation:
-     *   Helper function to vet Location fields when calling setPositionMode_1_1()
+     *   Helper function to vet Location fields
      */
-    void CheckLocation(GnssLocation& location, bool checkAccuracies, bool checkSpeed) {
-        EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_LAT_LONG);
-        EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_ALTITUDE);
-        if (checkSpeed) {
-            EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED);
-        }
-        EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_HORIZONTAL_ACCURACY);
-        // New uncertainties available in O must be provided,
-        // at least when paired with modern hardware (2017+)
-        if (checkAccuracies) {
-            EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_VERTICAL_ACCURACY);
-            if (checkSpeed) {
-                EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED_ACCURACY);
-                if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING) {
-                    EXPECT_TRUE(location.gnssLocationFlags &
-                                GnssLocationFlags::HAS_BEARING_ACCURACY);
-                }
-            }
-        }
-        EXPECT_GE(location.latitudeDegrees, -90.0);
-        EXPECT_LE(location.latitudeDegrees, 90.0);
-        EXPECT_GE(location.longitudeDegrees, -180.0);
-        EXPECT_LE(location.longitudeDegrees, 180.0);
-        EXPECT_GE(location.altitudeMeters, -1000.0);
-        EXPECT_LE(location.altitudeMeters, 30000.0);
-        if (checkSpeed) {
-            EXPECT_GE(location.speedMetersPerSec, 0.0);
-            EXPECT_LE(location.speedMetersPerSec, 5.0);  // VTS tests are stationary.
+    void CheckLocation(GnssLocation& location, bool check_speed);
 
-            // Non-zero speeds must be reported with an associated bearing
-            if (location.speedMetersPerSec > 0.0) {
-                EXPECT_TRUE(location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING);
-            }
-        }
-
-        /*
-         * Tolerating some especially high values for accuracy estimate, in case of
-         * first fix with especially poor geometry (happens occasionally)
-         */
-        EXPECT_GT(location.horizontalAccuracyMeters, 0.0);
-        EXPECT_LE(location.horizontalAccuracyMeters, 250.0);
-
-        /*
-         * Some devices may define bearing as -180 to +180, others as 0 to 360.
-         * Both are okay & understandable.
-         */
-        if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING) {
-            EXPECT_GE(location.bearingDegrees, -180.0);
-            EXPECT_LE(location.bearingDegrees, 360.0);
-        }
-        if (location.gnssLocationFlags & GnssLocationFlags::HAS_VERTICAL_ACCURACY) {
-            EXPECT_GT(location.verticalAccuracyMeters, 0.0);
-            EXPECT_LE(location.verticalAccuracyMeters, 500.0);
-        }
-        if (location.gnssLocationFlags & GnssLocationFlags::HAS_SPEED_ACCURACY) {
-            EXPECT_GT(location.speedAccuracyMetersPerSecond, 0.0);
-            EXPECT_LE(location.speedAccuracyMetersPerSecond, 50.0);
-        }
-        if (location.gnssLocationFlags & GnssLocationFlags::HAS_BEARING_ACCURACY) {
-            EXPECT_GT(location.bearingAccuracyDegrees, 0.0);
-            EXPECT_LE(location.bearingAccuracyDegrees, 360.0);
-        }
-
-        // Check timestamp > 1.48e12 (47 years in msec - 1970->2017+)
-        EXPECT_GT(location.timestamp, 1.48e12);
-    }
+    /*
+     * StartAndCheckLocations:
+     *   Helper function to collect, and check a number of
+     *   normal ~1Hz locations.
+     *
+     *   Note this leaves the Location request active, to enable Stop call vs. other call
+     *   reordering tests.
+     */
+    void StartAndCheckLocations(int count);
 
     /*
      * StopAndClearLocations:
-     * Helper function to stop locations
-     *
-     * returns  true if a location was successfully generated
+     * Helper function to stop locations, and clear any remaining notifications
      */
-    void StopAndClearLocations() {
-        auto result = gnss_hal_->stop();
+    void StopAndClearLocations();
 
-        EXPECT_TRUE(result.isOk());
-        EXPECT_TRUE(result);
-
-        /*
-         * Clear notify/waiting counter, allowing up till the timeout after
-         * the last reply for final startup messages to arrive (esp. system
-         * info.)
-         */
-        while (wait(TIMEOUT_SEC) == std::cv_status::no_timeout) {
-        }
-    }
+    /*
+     * SetPositionMode:
+     * Helper function to set positioning mode and verify output
+     */
+    void SetPositionMode(const int min_interval_msec, const bool low_power_mode);
 
     sp<IGnss> gnss_hal_;         // GNSS HAL to call into
     sp<IGnssCallback> gnss_cb_;  // Primary callback interface
@@ -213,6 +131,7 @@
     int capabilities_called_count_;
     int location_called_count_;
     GnssLocation last_location_;
+    list<IGnssCallback::GnssSvStatus> list_gnss_sv_status_;
 
     int name_called_count_;
     android::hardware::hidl_string last_name_;
diff --git a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
index 47bad34..c9e36a9 100644
--- a/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
+++ b/gnss/1.1/vts/functional/gnss_hal_test_cases.cpp
@@ -18,6 +18,12 @@
 
 #include <VtsHalHidlTargetTestBase.h>
 
+#include <android/hardware/gnss/1.1/IGnssConfiguration.h>
+
+using android::hardware::hidl_vec;
+
+using android::hardware::gnss::V1_0::GnssConstellationType;
+using android::hardware::gnss::V1_1::IGnssConfiguration;
 using android::hardware::gnss::V1_1::IGnssMeasurement;
 
 /*
@@ -70,43 +76,291 @@
 }
 
 /*
- * GetLocation:
+ * GetLocationLowPower:
  * Turns on location, waits for at least 5 locations allowing max of LOCATION_TIMEOUT_SUBSEQUENT_SEC
  * between one location and the next. Also ensure that MIN_INTERVAL_MSEC is respected by waiting
  * NO_LOCATION_PERIOD_SEC and verfiy that no location is received. Also perform validity checks on
  * each received location.
  */
 TEST_F(GnssHalTest, GetLocationLowPower) {
-#define MIN_INTERVAL_MSEC 5000
-#define PREFERRED_ACCURACY 0   // Ideally perfect (matches GnssLocationProvider)
-#define PREFERRED_TIME_MSEC 0  // Ideally immediate
+    const int kMinIntervalMsec = 5000;
+    const int kLocationTimeoutSubsequentSec = (kMinIntervalMsec / 1000) + 1;
+    const int kNoLocationPeriodSec = 2;
+    const int kLocationsToCheck = 5;
+    const bool kLowPowerMode = true;
 
-#define LOCATION_TIMEOUT_SUBSEQUENT_SEC (MIN_INTERVAL_MSEC + 1000) / 1000
-#define NO_LOCATION_PERIOD_SEC 2
-#define LOCATIONS_TO_CHECK 5
-#define LOW_POWER_MODE true
+    SetPositionMode(kMinIntervalMsec, kLowPowerMode);
 
-    bool checkMoreAccuracies = (info_called_count_ > 0 && last_info_.yearOfHw >= 2017);
+    EXPECT_TRUE(StartAndGetSingleLocation());
 
-    auto result = gnss_hal_->setPositionMode_1_1(
-        IGnss::GnssPositionMode::MS_BASED, IGnss::GnssPositionRecurrence::RECURRENCE_PERIODIC,
-        MIN_INTERVAL_MSEC, PREFERRED_ACCURACY, PREFERRED_TIME_MSEC, LOW_POWER_MODE);
-
-    ASSERT_TRUE(result.isOk());
-    EXPECT_TRUE(result);
-
-    EXPECT_TRUE(StartAndGetSingleLocation(checkMoreAccuracies));
-
-    for (int i = 1; i < LOCATIONS_TO_CHECK; i++) {
-        // Verify that MIN_INTERVAL_MSEC is respected by waiting NO_LOCATION_PERIOD_SEC and
+    for (int i = 1; i < kLocationsToCheck; i++) {
+        // Verify that kMinIntervalMsec is respected by waiting kNoLocationPeriodSec and
         // ensure that no location is received yet
-        wait(NO_LOCATION_PERIOD_SEC);
+        wait(kNoLocationPeriodSec);
         EXPECT_EQ(location_called_count_, i);
         EXPECT_EQ(std::cv_status::no_timeout,
-                  wait(LOCATION_TIMEOUT_SUBSEQUENT_SEC - NO_LOCATION_PERIOD_SEC));
+                  wait(kLocationTimeoutSubsequentSec - kNoLocationPeriodSec));
         EXPECT_EQ(location_called_count_, i + 1);
-        CheckLocation(last_location_, checkMoreAccuracies, true);
+        CheckLocation(last_location_, true);
     }
 
     StopAndClearLocations();
+}
+
+/*
+ * FindStrongFrequentSource:
+ *
+ * Search through a GnssSvStatus list for the strongest satellite observed enough times
+ *
+ * returns the strongest source,
+ *         or a source with constellation == UNKNOWN if none are found sufficient times
+ */
+
+IGnssConfiguration::BlacklistedSource FindStrongFrequentSource(
+    const list<IGnssCallback::GnssSvStatus> list_gnss_sv_status, const int min_observations) {
+    struct ComparableBlacklistedSource {
+        IGnssConfiguration::BlacklistedSource id;
+
+        bool operator<(const ComparableBlacklistedSource& compare) const {
+            return ((id.svid < compare.id.svid) || ((id.svid == compare.id.svid) &&
+                                                    (id.constellation < compare.id.constellation)));
+        }
+    };
+
+    struct SignalCounts {
+        int observations;
+        float max_cn0_dbhz;
+    };
+
+    std::map<ComparableBlacklistedSource, SignalCounts> mapSignals;
+
+    for (const auto& gnss_sv_status : list_gnss_sv_status) {
+        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+            if (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX) {
+                ComparableBlacklistedSource source;
+                source.id.svid = gnss_sv.svid;
+                source.id.constellation = gnss_sv.constellation;
+
+                const auto& itSignal = mapSignals.find(source);
+                if (itSignal == mapSignals.end()) {
+                    SignalCounts counts;
+                    counts.observations = 1;
+                    counts.max_cn0_dbhz = gnss_sv.cN0Dbhz;
+                    mapSignals.insert(
+                        std::pair<ComparableBlacklistedSource, SignalCounts>(source, counts));
+                } else {
+                    itSignal->second.observations++;
+                    if (itSignal->second.max_cn0_dbhz < gnss_sv.cN0Dbhz) {
+                        itSignal->second.max_cn0_dbhz = gnss_sv.cN0Dbhz;
+                    }
+                }
+            }
+        }
+    }
+
+    float max_cn0_dbhz_with_sufficient_count = 0.;
+    int total_observation_count = 0;
+    int blacklisted_source_count_observation = 0;
+
+    ComparableBlacklistedSource source_to_blacklist;  // initializes to zero = UNKNOWN constellation
+    for (auto const& pairSignal : mapSignals) {
+        total_observation_count += pairSignal.second.observations;
+        if ((pairSignal.second.observations >= min_observations) &&
+            (pairSignal.second.max_cn0_dbhz > max_cn0_dbhz_with_sufficient_count)) {
+            source_to_blacklist = pairSignal.first;
+            blacklisted_source_count_observation = pairSignal.second.observations;
+            max_cn0_dbhz_with_sufficient_count = pairSignal.second.max_cn0_dbhz;
+        }
+    }
+    ALOGD(
+        "Among %d observations, chose svid %d, constellation %d, "
+        "with %d observations at %.1f max CNo",
+        total_observation_count, source_to_blacklist.id.svid,
+        (int)source_to_blacklist.id.constellation, blacklisted_source_count_observation,
+        max_cn0_dbhz_with_sufficient_count);
+
+    return source_to_blacklist.id;
+}
+
+/*
+ * BlacklistIndividualSatellites:
+ *
+ * 1) Turns on location, waits for 3 locations, ensuring they are valid, and checks corresponding
+ * GnssStatus for common satellites (strongest and one other.)
+ * 2a & b) Turns off location, and blacklists common satellites.
+ * 3) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
+ * GnssStatus does not use those satellites.
+ * 4a & b) Turns off location, and send in empty blacklist.
+ * 5) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
+ * GnssStatus does re-use at least the previously strongest satellite
+ */
+TEST_F(GnssHalTest, BlacklistIndividualSatellites) {
+    const int kLocationsToAwait = 3;
+
+    StartAndCheckLocations(kLocationsToAwait);
+
+    EXPECT_GE((int)list_gnss_sv_status_.size(), kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
+          kLocationsToAwait);
+
+    /*
+     * Identify strongest SV seen at least kLocationsToAwait -1 times
+     * Why -1?  To avoid test flakiness in case of (plausible) slight flakiness in strongest signal
+     * observability (one epoch RF null)
+     */
+
+    IGnssConfiguration::BlacklistedSource source_to_blacklist =
+        FindStrongFrequentSource(list_gnss_sv_status_, kLocationsToAwait - 1);
+    EXPECT_NE(source_to_blacklist.constellation, GnssConstellationType::UNKNOWN);
+
+    // Stop locations, blacklist the common SV
+    StopAndClearLocations();
+
+    auto gnss_configuration_hal_return = gnss_hal_->getExtensionGnssConfiguration_1_1();
+    ASSERT_TRUE(gnss_configuration_hal_return.isOk());
+    sp<IGnssConfiguration> gnss_configuration_hal = gnss_configuration_hal_return;
+    ASSERT_NE(gnss_configuration_hal, nullptr);
+
+    hidl_vec<IGnssConfiguration::BlacklistedSource> sources;
+    sources.resize(1);
+    sources[0] = source_to_blacklist;
+
+    auto result = gnss_configuration_hal->setBlacklist(sources);
+    ASSERT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+
+    // retry and ensure satellite not used
+    list_gnss_sv_status_.clear();
+
+    location_called_count_ = 0;
+    StartAndCheckLocations(kLocationsToAwait);
+
+    EXPECT_GE((int)list_gnss_sv_status_.size(), kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
+          kLocationsToAwait);
+    for (const auto& gnss_sv_status : list_gnss_sv_status_) {
+        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+            EXPECT_FALSE((gnss_sv.svid == source_to_blacklist.svid) &&
+                         (gnss_sv.constellation == source_to_blacklist.constellation) &&
+                         (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX));
+        }
+    }
+
+    // clear blacklist and restart - this time updating the blacklist while location is still on
+    sources.resize(0);
+
+    result = gnss_configuration_hal->setBlacklist(sources);
+    ASSERT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+
+    location_called_count_ = 0;
+    StopAndClearLocations();
+    list_gnss_sv_status_.clear();
+
+    StartAndCheckLocations(kLocationsToAwait);
+
+    EXPECT_GE((int)list_gnss_sv_status_.size(), kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
+          kLocationsToAwait);
+
+    bool strongest_sv_is_reobserved = false;
+    for (const auto& gnss_sv_status : list_gnss_sv_status_) {
+        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+            if ((gnss_sv.svid == source_to_blacklist.svid) &&
+                (gnss_sv.constellation == source_to_blacklist.constellation) &&
+                (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX)) {
+                strongest_sv_is_reobserved = true;
+                break;
+            }
+        }
+        if (strongest_sv_is_reobserved) break;
+    }
+    EXPECT_TRUE(strongest_sv_is_reobserved);
+}
+
+/*
+ * BlacklistConstellation:
+ *
+ * 1) Turns on location, waits for 3 locations, ensuring they are valid, and checks corresponding
+ * GnssStatus for any non-GPS constellations.
+ * 2a & b) Turns off location, and blacklist first non-GPS constellations.
+ * 3) Restart location, wait for 3 locations, ensuring they are valid, and checks corresponding
+ * GnssStatus does not use any constellation but GPS.
+ * 4a & b) Clean up by turning off location, and send in empty blacklist.
+ */
+TEST_F(GnssHalTest, BlacklistConstellation) {
+    const int kLocationsToAwait = 3;
+
+    StartAndCheckLocations(kLocationsToAwait);
+
+    EXPECT_GE((int)list_gnss_sv_status_.size(), kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
+          kLocationsToAwait);
+
+    // Find first non-GPS constellation to blacklist
+    GnssConstellationType constellation_to_blacklist = GnssConstellationType::UNKNOWN;
+    for (const auto& gnss_sv_status : list_gnss_sv_status_) {
+        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+            if ((gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX) &&
+                (gnss_sv.constellation != GnssConstellationType::UNKNOWN) &&
+                (gnss_sv.constellation != GnssConstellationType::GPS)) {
+                // found a non-GPS constellation
+                constellation_to_blacklist = gnss_sv.constellation;
+                break;
+            }
+        }
+        if (constellation_to_blacklist != GnssConstellationType::UNKNOWN) {
+            break;
+        }
+    }
+
+    if (constellation_to_blacklist == GnssConstellationType::UNKNOWN) {
+        ALOGI("No non-GPS constellations found, constellation blacklist test less effective.");
+        // Proceed functionally to blacklist something.
+        constellation_to_blacklist = GnssConstellationType::GLONASS;
+    }
+    IGnssConfiguration::BlacklistedSource source_to_blacklist;
+    source_to_blacklist.constellation = constellation_to_blacklist;
+    source_to_blacklist.svid = 0;  // documented wildcard for all satellites in this constellation
+
+    auto gnss_configuration_hal_return = gnss_hal_->getExtensionGnssConfiguration_1_1();
+    ASSERT_TRUE(gnss_configuration_hal_return.isOk());
+    sp<IGnssConfiguration> gnss_configuration_hal = gnss_configuration_hal_return;
+    ASSERT_NE(gnss_configuration_hal, nullptr);
+
+    hidl_vec<IGnssConfiguration::BlacklistedSource> sources;
+    sources.resize(1);
+    sources[0] = source_to_blacklist;
+
+    auto result = gnss_configuration_hal->setBlacklist(sources);
+    ASSERT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
+
+    // retry and ensure constellation not used
+    list_gnss_sv_status_.clear();
+
+    location_called_count_ = 0;
+    StartAndCheckLocations(kLocationsToAwait);
+
+    EXPECT_GE((int)list_gnss_sv_status_.size(), kLocationsToAwait);
+    ALOGD("Observed %d GnssSvStatus, while awaiting %d Locations", (int)list_gnss_sv_status_.size(),
+          kLocationsToAwait);
+    for (const auto& gnss_sv_status : list_gnss_sv_status_) {
+        for (uint32_t iSv = 0; iSv < gnss_sv_status.numSvs; iSv++) {
+            const auto& gnss_sv = gnss_sv_status.gnssSvList[iSv];
+            EXPECT_FALSE((gnss_sv.constellation == source_to_blacklist.constellation) &&
+                         (gnss_sv.svFlag & IGnssCallback::GnssSvFlags::USED_IN_FIX));
+        }
+    }
+
+    // clean up
+    StopAndClearLocations();
+    sources.resize(0);
+    result = gnss_configuration_hal->setBlacklist(sources);
+    ASSERT_TRUE(result.isOk());
+    EXPECT_TRUE(result);
 }
\ No newline at end of file
diff --git a/keymaster/4.0/IKeymasterDevice.hal b/keymaster/4.0/IKeymasterDevice.hal
index 84354bf..14c9c35 100644
--- a/keymaster/4.0/IKeymasterDevice.hal
+++ b/keymaster/4.0/IKeymasterDevice.hal
@@ -54,7 +54,7 @@
      * device with a StrongBox Keymaster has two Keymasters instances, because there must be a TEE
      * Keymaster as well.  The HMAC key used to MAC and verify authentication tokens must be shared
      * between TEE and StrongBox so they can each validate tokens produced by the other.  This
-     * method is the second and final step in the process for for agreeing on a shared key.  It is
+     * method is the second and final step in the process for agreeing on a shared key.  It is
      * called by Keystore during startup if and only if Keystore loads multiple Keymaster HALs.
      * Keystore calls it on each of the HAL instances, and sends to it all of the
      * HmacSharingParameters returned by all HALs.
@@ -94,7 +94,7 @@
      *     Any method of securely establishing K that ensures that an attacker cannot obtain or
      *     derive its value is acceptable.  What follows is a recommended approach, to be executed
      *     during each factory reset.  It relies on use of the factory-installed attestation keys to
-     *     mitigate man-in-the-middle attacks.  This protocol requires that one of the instancess
+     *     mitigate man-in-the-middle attacks.  This protocol requires that one of the instances
      *     have secure persistent storage.  This model was chosen because StrongBox has secure
      *     persistent storage (by definition), but the TEE may not.  The instance without storage is
      *     assumed to be able to derive a unique hardware-bound key (HBK) which is used only for
diff --git a/keymaster/4.0/support/Android.bp b/keymaster/4.0/support/Android.bp
index 31acfca..748fed3 100644
--- a/keymaster/4.0/support/Android.bp
+++ b/keymaster/4.0/support/Android.bp
@@ -29,7 +29,6 @@
     ],
     export_include_dirs: ["include"],
     shared_libs: [
-        "android.hardware.keymaster@3.0",
         "android.hardware.keymaster@4.0",
         "libcrypto",
         "libhidlbase",
diff --git a/keymaster/4.0/support/include/keymasterV4_0/key_param_output.h b/keymaster/4.0/support/include/keymasterV4_0/key_param_output.h
index 9736da0..74be343 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/key_param_output.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/key_param_output.h
@@ -23,8 +23,7 @@
 namespace android {
 namespace hardware {
 namespace keymaster {
-
-namespace V3_0 {
+namespace V4_0 {
 
 inline ::std::ostream& operator<<(::std::ostream& os, Algorithm value) {
     return os << toString(value);
@@ -46,15 +45,11 @@
     return os << toString(value);
 }
 
-inline ::std::ostream& operator<<(::std::ostream& os, PaddingMode value) {
+inline ::std::ostream& operator<<(::std::ostream& os, KeyOrigin value) {
     return os << toString(value);
 }
 
-}  // namespace V3_0
-
-namespace V4_0 {
-
-inline ::std::ostream& operator<<(::std::ostream& os, KeyOrigin value) {
+inline ::std::ostream& operator<<(::std::ostream& os, PaddingMode value) {
     return os << toString(value);
 }
 
diff --git a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
index e5187df..2f9f88b 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/keymaster_tags.h
@@ -68,15 +68,6 @@
 namespace keymaster {
 namespace V4_0 {
 
-using ::android::hardware::keymaster::V3_0::Algorithm;
-using ::android::hardware::keymaster::V3_0::BlockMode;
-using ::android::hardware::keymaster::V3_0::Digest;
-using ::android::hardware::keymaster::V3_0::EcCurve;
-using ::android::hardware::keymaster::V3_0::HardwareAuthenticatorType;
-using ::android::hardware::keymaster::V3_0::KeyFormat;
-using ::android::hardware::keymaster::V3_0::PaddingMode;
-using ::android::hardware::keymaster::V3_0::TagType;
-
 // The following create the numeric values that KM_TAG_PADDING and KM_TAG_DIGEST used to have.  We
 // need these old values to be able to support old keys that use them.
 static const int32_t KM_TAG_DIGEST_OLD = static_cast<int32_t>(TagType::ENUM) | 5;
diff --git a/keymaster/4.0/types.hal b/keymaster/4.0/types.hal
index 8ca2274..0c890bd 100644
--- a/keymaster/4.0/types.hal
+++ b/keymaster/4.0/types.hal
@@ -16,20 +16,6 @@
 
 package android.hardware.keymaster@4.0;
 
-import android.hardware.keymaster@3.0::Algorithm;
-import android.hardware.keymaster@3.0::BlockMode;
-import android.hardware.keymaster@3.0::Digest;
-import android.hardware.keymaster@3.0::EcCurve;
-import android.hardware.keymaster@3.0::ErrorCode;
-import android.hardware.keymaster@3.0::HardwareAuthenticatorType;
-import android.hardware.keymaster@3.0::KeyBlobUsageRequirements;
-import android.hardware.keymaster@3.0::KeyDerivationFunction;
-import android.hardware.keymaster@3.0::KeyFormat;
-import android.hardware.keymaster@3.0::KeyOrigin;
-import android.hardware.keymaster@3.0::PaddingMode;
-import android.hardware.keymaster@3.0::SecurityLevel;
-import android.hardware.keymaster@3.0::TagType;
-
 /**
  * Time in milliseconds since some arbitrary point in time.  Time must be monotonically increasing,
  * and a secure environment's notion of "current time" must not repeat until the Android device
@@ -45,14 +31,39 @@
     AUTH_TOKEN_MAC_LENGTH = 32,
 };
 
+enum TagType : uint32_t {
+    /** Invalid type, used to designate a tag as uninitialized. */
+    INVALID = 0 << 28,
+    /** Enumeration value. */
+    ENUM = 1 << 28,
+    /** Repeatable enumeration value. */
+    ENUM_REP = 2 << 28,
+    /** 32-bit unsigned integer. */
+    UINT = 3 << 28,
+    /** Repeatable 32-bit unsigned integer. */
+    UINT_REP = 4 << 28,
+    /** 64-bit unsigned integer. */
+    ULONG = 5 << 28,
+    /** 64-bit unsigned integer representing a date and time, in milliseconds since 1 Jan 1970. */
+    DATE = 6 << 28,
+    /** Boolean.  If a tag with this type is present, the value is "true".  If absent, "false". */
+    BOOL = 7 << 28,
+    /** Byte string containing an arbitrary-length integer, big-endian ordering. */
+    BIGNUM = 8 << 28,
+    /** Byte string */
+    BYTES = 9 << 28,
+    /** Repeatable 64-bit unsigned integer */
+    ULONG_REP = 10 << 28,
+};
+
 enum Tag : uint32_t {
     INVALID = TagType:INVALID | 0,
 
-    /**
+    /*
      * Tags that must be semantically enforced by hardware and software implementations.
      */
 
-    /** Crypto parameters */
+    /* Crypto parameters */
     PURPOSE = TagType:ENUM_REP | 1,    /* KeyPurpose. */
     ALGORITHM = TagType:ENUM | 2,      /* Algorithm. */
     KEY_SIZE = TagType:UINT | 3,       /* Key size in bits. */
@@ -65,14 +76,14 @@
     // 9 reserved
     EC_CURVE = TagType:ENUM | 10,      /* EcCurve. */
 
-    /** Algorithm-specific. */
+    /* Algorithm-specific. */
     RSA_PUBLIC_EXPONENT = TagType:ULONG | 200,
     // 201 reserved for ECIES
     INCLUDE_UNIQUE_ID = TagType:BOOL | 202, /* If true, attestation certificates for this key must
                                              * contain an application-scoped and time-bounded
                                              * device-unique ID.*/
 
-    /** Other hardware-enforced. */
+    /* Other hardware-enforced. */
     BLOB_USAGE_REQUIREMENTS = TagType:ENUM | 301, /* KeyBlobUsageRequirements. */
     BOOTLOADER_ONLY = TagType:BOOL | 302,         /* Usable only by bootloader. */
     ROLLBACK_RESISTANCE = TagType:BOOL | 303,     /* Whether key is rollback-resistant.  Specified
@@ -90,12 +101,12 @@
      * attestation header. */
     HARDWARE_TYPE = TagType:ENUM | 304,
 
-    /**
+    /*
      * Tags that should be semantically enforced by hardware if possible and will otherwise be
      * enforced by software (keystore).
      */
 
-    /** Key validity period */
+    /* Key validity period */
     ACTIVE_DATETIME = TagType:DATE | 400,             /* Start of validity. */
     ORIGINATION_EXPIRE_DATETIME = TagType:DATE | 401, /* Date when new "messages" should no longer
                                                        * be created. */
@@ -106,11 +117,10 @@
     MAX_USES_PER_BOOT = TagType:UINT | 404,           /* Number of times the key can be used per
                                                        * boot. */
 
-    /** User authentication */
+    /* User authentication */
     // 500-501 reserved
     USER_SECURE_ID = TagType:ULONG_REP | 502, /* Secure ID of authorized user or authenticator(s).
-                                               * Disallowed if ALL_USERS or NO_AUTH_REQUIRED is
-                                               * present. */
+                                               * Disallowed if NO_AUTH_REQUIRED is present. */
     NO_AUTH_REQUIRED = TagType:BOOL | 503,    /* If key is usable without authentication. */
     USER_AUTH_TYPE = TagType:ENUM | 504,      /* Bitmask of authenticator types allowed when
                                                * USER_SECURE_ID contains a secure user ID, rather
@@ -126,10 +136,10 @@
                                                 * if device is still on-body (requires secure
                                                 * on-body sensor. */
 
-    /** Application access control */
+    /* Application access control */
     APPLICATION_ID = TagType:BYTES | 601, /* Byte string identifying the authorized application. */
 
-    /**
+    /*
      * Semantically unenforceable tags, either because they have no specific meaning or because
      * they're informational only.
      */
@@ -164,7 +174,7 @@
     ATTESTATION_ID_MODEL = TagType:BYTES | 717, /* Used to provide the device's model name to be
                                                  * included in attestation */
 
-    /** Tags used only to provide data to or receive data from operations */
+    /* Tags used only to provide data to or receive data from operations */
     ASSOCIATED_DATA = TagType:BYTES | 1000, /* Used to provide associated data for AEAD modes. */
     NONCE = TagType:BYTES | 1001,           /* Nonce or Initialization Vector */
     MAC_LENGTH = TagType:UINT | 1003,       /* MAC or AEAD authentication tag length in bits. */
@@ -175,15 +185,120 @@
 };
 
 /**
- * The origin of a key, i.e. where it was generated.
+ * Algorithms provided by keymaser implementations.
  */
-enum KeyOrigin : @3.0::KeyOrigin {
-    /** Securely imported into Keymaster.  Was created elsewhere, and passed securely through
-     *  Android to secure hardware. */
+enum Algorithm : uint32_t {
+    /** Asymmetric algorithms. */
+    RSA = 1,
+    // DSA = 2, -- Removed, do not re-use value 2.
+    EC = 3,
+
+    /** Block ciphers algorithms */
+    AES = 32,
+
+    /** MAC algorithms */
+    HMAC = 128,
+};
+
+/**
+ * Symmetric block cipher modes provided by keymaster implementations.
+ */
+enum BlockMode : uint32_t {
+    /*
+     * Unauthenticated modes, usable only for encryption/decryption and not generally recommended
+     * except for compatibility with existing other protocols.
+     */
+    ECB = 1,
+    CBC = 2,
+    CTR = 3,
+
+    /*
+     * Authenticated modes, usable for encryption/decryption and signing/verification.  Recommended
+     * over unauthenticated modes for all purposes.
+     */
+    GCM = 32,
+};
+
+/**
+ * Padding modes that may be applied to plaintext for encryption operations.  This list includes
+ * padding modes for both symmetric and asymmetric algorithms.  Note that implementations should not
+ * provide all possible combinations of algorithm and padding, only the
+ * cryptographically-appropriate pairs.
+ */
+enum PaddingMode : uint32_t {
+    NONE = 1, /* deprecated */
+    RSA_OAEP = 2,
+    RSA_PSS = 3,
+    RSA_PKCS1_1_5_ENCRYPT = 4,
+    RSA_PKCS1_1_5_SIGN = 5,
+    PKCS7 = 64,
+};
+
+/**
+ * Digests provided by keymaster implementations.
+ */
+enum Digest : uint32_t {
+    NONE = 0,
+    MD5 = 1,
+    SHA1 = 2,
+    SHA_2_224 = 3,
+    SHA_2_256 = 4,
+    SHA_2_384 = 5,
+    SHA_2_512 = 6,
+};
+
+/**
+ * Supported EC curves, used in ECDSA
+ */
+enum EcCurve : uint32_t {
+    P_224 = 0,
+    P_256 = 1,
+    P_384 = 2,
+    P_521 = 3,
+};
+
+/**
+ * The origin of a key (or pair), i.e. where it was generated.  Note that ORIGIN can be found in
+ * either the hardware-enforced or software-enforced list for a key, indicating whether the key is
+ * hardware or software-based.  Specifically, a key with GENERATED in the hardware-enforced list
+ * must be guaranteed never to have existed outide the secure hardware.
+ */
+enum KeyOrigin : uint32_t {
+    /** Generated in keymaster.  Should not exist outside the TEE. */
+    GENERATED = 0,
+
+    /** Derived inside keymaster.  Likely exists off-device. */
+    DERIVED = 1,
+
+    /** Imported into keymaster.  Existed as cleartext in Android. */
+    IMPORTED = 2,
+
+    /**
+     * Keymaster did not record origin.  This value can only be seen on keys in a keymaster0
+     * implementation.  The keymaster0 adapter uses this value to document the fact that it is
+     * unkown whether the key was generated inside or imported into keymaster.
+     */
+    UNKNOWN = 3,
+
+    /**
+     * Securely imported into Keymaster.  Was created elsewhere, and passed securely through Android
+     * to secure hardware.
+     */
     SECURELY_IMPORTED = 4,
 };
 
 /**
+ * Usability requirements of key blobs.  This defines what system functionality must be available
+ * for the key to function.  For example, key "blobs" which are actually handles referencing
+ * encrypted key material stored in the file system cannot be used until the file system is
+ * available, and should have BLOB_REQUIRES_FILE_SYSTEM.
+ */
+enum KeyBlobUsageRequirements : uint32_t {
+    STANDALONE = 0,
+    REQUIRES_FILE_SYSTEM = 1,
+};
+
+/**
  * Possible purposes of a key (or pair).
  */
 enum KeyPurpose : uint32_t {
@@ -198,15 +313,118 @@
 /**
  * Keymaster error codes.
  */
-enum ErrorCode : @3.0::ErrorCode {
+enum ErrorCode : int32_t {
+    OK = 0,
+    ROOT_OF_TRUST_ALREADY_SET = -1,
+    UNSUPPORTED_PURPOSE = -2,
+    INCOMPATIBLE_PURPOSE = -3,
+    UNSUPPORTED_ALGORITHM = -4,
+    INCOMPATIBLE_ALGORITHM = -5,
+    UNSUPPORTED_KEY_SIZE = -6,
+    UNSUPPORTED_BLOCK_MODE = -7,
+    INCOMPATIBLE_BLOCK_MODE = -8,
+    UNSUPPORTED_MAC_LENGTH = -9,
+    UNSUPPORTED_PADDING_MODE = -10,
+    INCOMPATIBLE_PADDING_MODE = -11,
+    UNSUPPORTED_DIGEST = -12,
+    INCOMPATIBLE_DIGEST = -13,
+    INVALID_EXPIRATION_TIME = -14,
+    INVALID_USER_ID = -15,
+    INVALID_AUTHORIZATION_TIMEOUT = -16,
+    UNSUPPORTED_KEY_FORMAT = -17,
+    INCOMPATIBLE_KEY_FORMAT = -18,
+    UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = -19,   /** For PKCS8 & PKCS12 */
+    UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = -20, /** For PKCS8 & PKCS12 */
+    INVALID_INPUT_LENGTH = -21,
+    KEY_EXPORT_OPTIONS_INVALID = -22,
+    DELEGATION_NOT_ALLOWED = -23,
+    KEY_NOT_YET_VALID = -24,
+    KEY_EXPIRED = -25,
+    KEY_USER_NOT_AUTHENTICATED = -26,
+    OUTPUT_PARAMETER_NULL = -27,
+    INVALID_OPERATION_HANDLE = -28,
+    INSUFFICIENT_BUFFER_SPACE = -29,
+    VERIFICATION_FAILED = -30,
+    TOO_MANY_OPERATIONS = -31,
+    UNEXPECTED_NULL_POINTER = -32,
+    INVALID_KEY_BLOB = -33,
+    IMPORTED_KEY_NOT_ENCRYPTED = -34,
+    IMPORTED_KEY_DECRYPTION_FAILED = -35,
+    IMPORTED_KEY_NOT_SIGNED = -36,
+    IMPORTED_KEY_VERIFICATION_FAILED = -37,
+    INVALID_ARGUMENT = -38,
+    UNSUPPORTED_TAG = -39,
+    INVALID_TAG = -40,
+    MEMORY_ALLOCATION_FAILED = -41,
+    IMPORT_PARAMETER_MISMATCH = -44,
+    SECURE_HW_ACCESS_DENIED = -45,
+    OPERATION_CANCELLED = -46,
+    CONCURRENT_ACCESS_CONFLICT = -47,
+    SECURE_HW_BUSY = -48,
+    SECURE_HW_COMMUNICATION_FAILED = -49,
+    UNSUPPORTED_EC_FIELD = -50,
+    MISSING_NONCE = -51,
+    INVALID_NONCE = -52,
+    MISSING_MAC_LENGTH = -53,
+    KEY_RATE_LIMIT_EXCEEDED = -54,
+    CALLER_NONCE_PROHIBITED = -55,
+    KEY_MAX_OPS_EXCEEDED = -56,
+    INVALID_MAC_LENGTH = -57,
+    MISSING_MIN_MAC_LENGTH = -58,
+    UNSUPPORTED_MIN_MAC_LENGTH = -59,
+    UNSUPPORTED_KDF = -60,
+    UNSUPPORTED_EC_CURVE = -61,
+    KEY_REQUIRES_UPGRADE = -62,
+    ATTESTATION_CHALLENGE_MISSING = -63,
+    KEYMASTER_NOT_CONFIGURED = -64,
+    ATTESTATION_APPLICATION_ID_MISSING = -65,
+    CANNOT_ATTEST_IDS = -66,
     ROLLBACK_RESISTANCE_UNAVAILABLE = -67,
     HARDWARE_TYPE_UNAVAILABLE = -68,
+
+    UNIMPLEMENTED = -100,
+    VERSION_MISMATCH = -101,
+
+    UNKNOWN_ERROR = -1000,
+};
+
+/**
+ * Key derivation functions, mostly used in ECIES.
+ */
+enum KeyDerivationFunction : uint32_t {
+    /** Do not apply a key derivation function; use the raw agreed key */
+    NONE = 0,
+    /** HKDF defined in RFC 5869 with SHA256 */
+    RFC5869_SHA256 = 1,
+    /** KDF1 defined in ISO 18033-2 with SHA1 */
+    ISO18033_2_KDF1_SHA1 = 2,
+    /** KDF1 defined in ISO 18033-2 with SHA256 */
+    ISO18033_2_KDF1_SHA256 = 3,
+    /** KDF2 defined in ISO 18033-2 with SHA1 */
+    ISO18033_2_KDF2_SHA1 = 4,
+    /** KDF2 defined in ISO 18033-2 with SHA256 */
+    ISO18033_2_KDF2_SHA256 = 5,
+};
+
+/**
+ * Hardware authentication type, used by HardwareAuthTokens to specify the mechanism used to
+ * authentiate the user, and in KeyCharacteristics to specify the allowable mechanisms for
+ * authenticating to activate a key.
+ */
+enum HardwareAuthenticatorType : uint32_t {
+    NONE = 0,
+    PASSWORD = 1 << 0,
+    FINGERPRINT = 1 << 1,
+    // Additional entries must be powers of 2.
+    ANY = 0xFFFFFFFF,
 };
 
 /**
  * Device security levels.
  */
-enum SecurityLevel : @3.0::SecurityLevel {
+enum SecurityLevel : uint32_t {
+    SOFTWARE = 0,
+    TRUSTED_ENVIRONMENT = 1,
     /**
      * STRONGBOX specifies that the secure hardware satisfies the following requirements:
      *
@@ -243,6 +461,18 @@
     STRONGBOX = 2,              /* See IKeymaster::isStrongBox */
 };
 
+/**
+ * Formats for key import and export.
+ */
+enum KeyFormat : uint32_t {
+    /** X.509 certificate format, for public key export. */
+    X509 = 0,
+    /** PCKS#8 format, asymmetric key pair import. */
+    PKCS8 = 1,
+    /** Raw bytes, for symmetric key import and export. */
+    RAW = 3,
+};
+
 struct KeyParameter {
     /**
      * Discriminates the uinon/blob field used.  The blob cannot be coincided with the union, but
diff --git a/light/2.0/default/android.hardware.light@2.0-service.rc b/light/2.0/default/android.hardware.light@2.0-service.rc
index f268706..68f74c4 100644
--- a/light/2.0/default/android.hardware.light@2.0-service.rc
+++ b/light/2.0/default/android.hardware.light@2.0-service.rc
@@ -1,4 +1,5 @@
 service vendor.light-hal-2-0 /vendor/bin/hw/android.hardware.light@2.0-service
+    interface android.hardware.light@2.0::ILight default
     class hal
     user system
     group system
diff --git a/radio/1.2/Android.bp b/radio/1.2/Android.bp
index cdb9bf6..3e678bb 100644
--- a/radio/1.2/Android.bp
+++ b/radio/1.2/Android.bp
@@ -19,6 +19,7 @@
         "android.hidl.base@1.0",
     ],
     types: [
+        "CardStatus",
         "CellIdentityCdma",
         "CellIdentityGsm",
         "CellIdentityLte",
@@ -35,6 +36,8 @@
         "NetworkScanResult",
         "RadioConst",
         "ScanIntervalRange",
+        "SimSlotStatus",
+        "SlotState",
     ],
     gen_java: true,
 }
diff --git a/radio/1.2/IRadio.hal b/radio/1.2/IRadio.hal
index 6ae78a0..73f1024 100644
--- a/radio/1.2/IRadio.hal
+++ b/radio/1.2/IRadio.hal
@@ -37,4 +37,46 @@
      * Response function is IRadioResponse.startNetworkScanResponse()
      */
     oneway startNetworkScan_1_2(int32_t serial, NetworkScanRequest request);
+
+    /**
+     * Get SIM Slot status.
+     *
+     * Request provides the slot status of all active and inactive SIM slots and whether card is
+     * present in the slots or not.
+     *
+     * @param serial Serial number of request.
+     *
+     * Response callback is IRadioResponse.getSimSlotsStatusResponse()
+     */
+    oneway getSimSlotsStatus(int32_t serial);
+
+    /**
+     * Set SIM Slot mapping.
+
+     * Maps the logical slots to the physical slots. Logical slot is the slot that is seen by modem.
+     * Physical slot is the actual physical slot. Request maps the physical slot to logical slot.
+     * Logical slots that are already mapped to the requested physical slot are not impacted.
+     *
+     * Example no. of logical slots 1 and physical slots 2:
+     * The only logical slot (index 0) can be mapped to first physical slot (value 0) or second
+     * physical slot(value 1), while the other physical slot remains unmapped and inactive.
+     * slotMap[0] = 1 or slotMap[0] = 0
+     *
+     * Example no. of logical slots 2 and physical slots 2:
+     * First logical slot (index 0) can be mapped to physical slot 1 or 2 and other logical slot
+     * can be mapped to other physical slot. Each logical slot must be mapped to a physical slot.
+     * slotMap[0] = 0 and slotMap[1] = 1 or slotMap[0] = 1 and slotMap[1] = 0
+     *
+     * @param serial Serial number of request
+     * @param slotMap Logical to physical slot mapping, size == no. of radio instances. Index is
+     *        mapping to logical slot and value to physical slot, need to provide all the slots
+     *        mapping when sending request in case of multi slot device.
+     *        EX: uint32_t slotMap[logical slot] = physical slot
+     *        index 0 is the first logical_slot number of logical slots is equal to number of Radio
+     *        instances and number of physical slots is equal to size of slotStatus in
+     *        getSimSlotsStatusResponse
+     *
+     * Response callback is IRadioResponse.setSimSlotsMappingResponse()
+     */
+    oneway setSimSlotsMapping(int32_t serial, vec<uint32_t> slotMap);
 };
diff --git a/radio/1.2/IRadioIndication.hal b/radio/1.2/IRadioIndication.hal
index 5d3efcf..4aae74d 100644
--- a/radio/1.2/IRadioIndication.hal
+++ b/radio/1.2/IRadioIndication.hal
@@ -28,4 +28,13 @@
      * Incremental network scan results
      */
     oneway networkScanResult_1_2(RadioIndicationType type, NetworkScanResult result);
-};
\ No newline at end of file
+
+    /**
+     * Indicates SIM slot status change.
+     *
+     * @param type Type of radio indication
+     * @param slotStatus new slot status info with size equals to the number of physical slots on
+     *        the device
+     */
+    oneway simSlotsStatusChanged(RadioIndicationType type, vec<SimSlotStatus> slotStatus);
+};
diff --git a/radio/1.2/IRadioResponse.hal b/radio/1.2/IRadioResponse.hal
index 5bfbbae..cf6bc00 100644
--- a/radio/1.2/IRadioResponse.hal
+++ b/radio/1.2/IRadioResponse.hal
@@ -41,4 +41,42 @@
      *   RadioError:CANCELLED
      */
     oneway getCellInfoListResponse_1_2(RadioResponseInfo info, vec<CellInfo> cellInfo);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param cardStatus ICC card status as defined by CardStatus in types.hal
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     */
+    oneway getIccCardStatusResponse_1_2(RadioResponseInfo info, CardStatus cardStatus);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param slotStatus Sim slot struct containing all the physical SIM slots info with size
+      *       equals to the number of physical slots on the device
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:NO_MEMORY
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:MODEM_ERR
+     *   RadioError:INVALID_ARGUMENTS
+     */
+    oneway getSimSlotsStatusResponse(RadioResponseInfo info, vec<SimSlotStatus> slotStatus);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:NO_MEMORY
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:MODEM_ERR
+     */
+    oneway setSimSlotsMappingResponse(RadioResponseInfo info);
 };
diff --git a/radio/1.2/types.hal b/radio/1.2/types.hal
index 52af575..1e28d3b 100644
--- a/radio/1.2/types.hal
+++ b/radio/1.2/types.hal
@@ -17,6 +17,8 @@
 package android.hardware.radio@1.2;
 
 import @1.0::CdmaSignalStrength;
+import @1.0::CardState;
+import @1.0::CardStatus;
 import @1.0::CellIdentityCdma;
 import @1.0::CellIdentityGsm;
 import @1.0::CellIdentityLte;
@@ -187,37 +189,97 @@
      * Cell type for selecting from union CellInfo.
      */
     CellInfoType cellInfoType;
-    /*
+    /**
      * True if this cell is registered false if not registered.
      */
     bool registered;
-    /*
+    /**
      * Type of time stamp represented by timeStamp.
      */
     TimeStampType timeStampType;
-    /*
+    /**
      * Time in nanos as returned by ril_nano_time.
      */
     uint64_t timeStamp;
-    /*
+    /**
      * Only one of the below vectors must be of size 1 based on the CellInfoType and others must be
      * of size 0.
      */
     vec<CellInfoGsm> gsm;
-    /*
+    /**
      * Valid only if type = cdma and size = 1 else must be empty.
      */
     vec<CellInfoCdma> cdma;
-    /*
+    /**
      * Valid only if type = lte and size = 1 else must be empty.
      */
     vec<CellInfoLte> lte;
-    /*
+    /**
      * Valid only if type = wcdma and size = 1 else must be empty.
      */
     vec<CellInfoWcdma> wcdma;
-    /*
+    /**
      * Valid only if type = tdscdma and size = 1 else must be empty.
      */
     vec<CellInfoTdscdma> tdscdma;
 };
+
+enum SlotState : int32_t {
+    /**
+     * Physical slot is inactive
+     */
+    INACTIVE  = 0x00,
+    /**
+     * Physical slot is active
+     */
+    ACTIVE    = 0x01,
+};
+
+struct CardStatus {
+    @1.0::CardStatus base;
+    uint32_t physicalSlotId;
+    /**
+     * An Answer To Reset (ATR) is a message output by a Smart Card conforming to ISO/IEC 7816
+     * standards, following electrical reset of the card's chip. The ATR conveys information about
+     * the communication parameters proposed by the card, and the card's nature and state.
+     *
+     * This data is applicable only when cardState is CardState:PRESENT.
+     */
+    string atr;
+    /**
+     * Integrated Circuit Card IDentifier (ICCID) is Unique Identifier of the SIM CARD. File is
+     * located in the SIM card at EFiccid (0x2FE2) as per ETSI 102.221. The ICCID is defined by
+     * the ITU-T recommendation E.118 ISO/IEC 7816.
+     *
+     * This data is applicable only when cardState is CardState:PRESENT.
+     */
+    string iccid;
+};
+
+struct SimSlotStatus {
+    /**
+     * Card state in the physical slot
+     */
+    CardState cardState;
+    /**
+     * Slot state Active/Inactive
+     */
+    SlotState slotState;
+    /**
+     * An Answer To Reset (ATR) is a message output by a Smart Card conforming to ISO/IEC 7816
+     * standards, following electrical reset of the card's chip. The ATR conveys information about
+     * the communication parameters proposed by the card, and the card's nature and state.
+     *
+     * This data is applicable only when cardState is CardState:PRESENT.
+     */
+    string atr;
+    uint32_t logicalSlotId;
+    /**
+     * Integrated Circuit Card IDentifier (ICCID) is Unique Identifier of the SIM CARD. File is
+     * located in the SIM card at EFiccid (0x2FE2) as per ETSI 102.221. The ICCID is defined by
+     * the ITU-T recommendation E.118 ISO/IEC 7816.
+     *
+     * This data is applicable only when cardState is CardState:PRESENT.
+     */
+    string iccid;
+};
diff --git a/tests/baz/1.0/IBaz.hal b/tests/baz/1.0/IBaz.hal
index 8c6a9a4..9a9e754 100644
--- a/tests/baz/1.0/IBaz.hal
+++ b/tests/baz/1.0/IBaz.hal
@@ -68,6 +68,10 @@
         bitfield<BitField> bf;
     };
 
+    struct StructWithInterface {
+        int32_t number;
+        IBase dummy;
+    };
     oneway doThis(float param);
 
     doThatAndReturnSomething(int64_t param) generates (int32_t result);
@@ -93,4 +97,6 @@
     size(uint32_t size) generates (uint32_t size);
 
     getNestedStructs() generates(vec<NestedStruct> data);
+
+    haveSomeStructWithInterface(StructWithInterface swi) generates(StructWithInterface swi);
 };
diff --git a/tests/baz/1.0/default/Baz.cpp b/tests/baz/1.0/default/Baz.cpp
index 5ccd87b..e118122 100644
--- a/tests/baz/1.0/default/Baz.cpp
+++ b/tests/baz/1.0/default/Baz.cpp
@@ -394,6 +394,12 @@
     _hidl_cb(result);
     return Void();
 }
+
+Return<void> Baz::haveSomeStructWithInterface(const StructWithInterface& swi,
+                                              haveSomeStructWithInterface_cb _hidl_cb) {
+    _hidl_cb(swi);
+    return Void();
+}
 // Methods from ::android::hidl::base::V1_0::IBase follow.
 
 IBaz* HIDL_FETCH_IBaz(const char* /* name */) {
diff --git a/tests/baz/1.0/default/Baz.h b/tests/baz/1.0/default/Baz.h
index 4443587..c264f47 100644
--- a/tests/baz/1.0/default/Baz.h
+++ b/tests/baz/1.0/default/Baz.h
@@ -91,6 +91,8 @@
     Return<uint32_t> size(uint32_t size) override;
     Return<void> getNestedStructs(getNestedStructs_cb _hidl_cb) override;
 
+    Return<void> haveSomeStructWithInterface(const StructWithInterface& swi,
+                                             haveSomeStructWithInterface_cb _hidl_cb) override;
     // Methods from ::android::hidl::base::V1_0::IBase follow.
  private:
     sp<IBazCallback> mStoredCallback;
diff --git a/tests/memory/1.0/IMemoryTest.hal b/tests/memory/1.0/IMemoryTest.hal
index b20859c..3c4d4f3 100644
--- a/tests/memory/1.0/IMemoryTest.hal
+++ b/tests/memory/1.0/IMemoryTest.hal
@@ -23,6 +23,6 @@
     haveSomeMemory(memory mem) generates(memory mem);
     fillMemory(memory memory_in, uint8_t filler);
     haveSomeMemoryBlock(MemoryBlock blk) generates(MemoryBlock blk);
-    set(memory mem) generates();
+    set(memory mem);
     get()generates(IMemoryToken token);
 };
diff --git a/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp b/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
index 33f3049..7fa20c9 100644
--- a/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
+++ b/wifi/supplicant/1.0/vts/functional/VtsHalWifiSupplicantV1_0TargetTest.cpp
@@ -25,8 +25,7 @@
     virtual void SetUp() override {
         stopSupplicant();
     }
-    virtual void TearDown() override {
-    }
+    virtual void TearDown() override { startSupplicantAndWaitForHidlService(); }
 };
 
 int main(int argc, char** argv) {
diff --git a/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp b/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
index 81893e5..b5e369a 100644
--- a/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
+++ b/wifi/supplicant/1.1/vts/functional/VtsHalWifiSupplicantV1_1TargetTest.cpp
@@ -23,7 +23,7 @@
 class SupplicantHidlEnvironment : public ::testing::Environment {
    public:
     virtual void SetUp() override { stopSupplicant(); }
-    virtual void TearDown() override {}
+    virtual void TearDown() override { startSupplicantAndWaitForHidlService(); }
 };
 
 int main(int argc, char** argv) {