diff --git a/camera/provider/2.4/default/service.cpp b/camera/provider/2.4/default/service.cpp
index 84f4839..0a4f787 100644
--- a/camera/provider/2.4/default/service.cpp
+++ b/camera/provider/2.4/default/service.cpp
@@ -22,9 +22,9 @@
 
 #include <android/hardware/camera/provider/2.4/ICameraProvider.h>
 #include <binder/ProcessState.h>
-#include <cutils/memory.h>
 #include <cutils/properties.h>
 #include <hidl/LegacySupport.h>
+#include <malloc.h>
 
 using android::status_t;
 using android::hardware::defaultLazyPassthroughServiceImplementation;
@@ -46,7 +46,13 @@
 
     // b/166675194
     if (property_get_bool("ro.vendor.camera.provider24.disable_mem_init", false)) {
-        process_disable_memory_mitigations();
+        if (mallopt(M_BIONIC_ZERO_INIT, 0) == 0) {
+            // Note - heap initialization is only present on devices with Scudo.
+            // Devices with jemalloc don't have heap-init, and thus the mallopt
+            // will fail. On these devices, you probably just want to remove the
+            // property.
+            ALOGE("Disabling heap initialization failed.");
+        }
     }
 
     status_t status;
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 23fd541..93a46dd 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -82,7 +82,7 @@
         <name>android.hardware.automotive.sv</name>
         <version>1.0</version>
         <interface>
-            <name>ISurroundView</name>
+            <name>ISurroundViewService</name>
             <instance>default</instance>
         </interface>
     </hal>
diff --git a/radio/1.6/IRadio.hal b/radio/1.6/IRadio.hal
index 0a5dc83..1862800 100644
--- a/radio/1.6/IRadio.hal
+++ b/radio/1.6/IRadio.hal
@@ -18,12 +18,9 @@
 
 
 import @1.0::CdmaSmsMessage;
-import @1.0::Dial;
 import @1.0::GsmSmsMessage;
 import @1.1::CardPowerState;
 import @1.2::DataRequestReason;
-import @1.4::EmergencyCallRouting;
-import @1.4::EmergencyServiceCategory;
 import @1.4::RadioAccessFamily;
 import @1.5::IRadio;
 import @1.5::AccessNetwork;
@@ -377,64 +374,6 @@
             int64_t completionDurationMillis);
 
     /**
-     * Initiate emergency voice call, with zero or more emergency service category(s), zero or
-     * more emergency Uniform Resource Names (URN), and routing information for handling the call.
-     * Android uses this request to make its emergency call instead of using @1.0::IRadio.dial
-     * if the 'address' in the 'dialInfo' field is identified as an emergency number by Android.
-     *
-     * In multi-sim scenario, if the emergency number is from a specific subscription, this radio
-     * request can still be sent out on the other subscription as long as routing is set to
-     * @1.4::EmergencyNumberRouting#EMERGENCY. This radio request will not be sent on an inactive
-     * (PIN/PUK locked) subscription unless both subscriptions are PIN/PUK locked. In this case,
-     * the request will be sent on the primary subscription.
-     *
-     * Some countries or carriers require some emergency numbers that must be handled with normal
-     * call routing if possible or emergency routing. 1) if the 'routing' field is specified as
-     * @1.4::EmergencyNumberRouting#NORMAL, the implementation must try the full radio service to
-     * use normal call routing to handle the call; if service cannot support normal routing, the
-     * implementation must use emergency routing to handle the call. 2) if 'routing' is specified
-     * as @1.4::EmergencyNumberRouting#EMERGENCY, the implementation must use emergency routing to
-     * handle the call. 3) if 'routing' is specified as @1.4::EmergencyNumberRouting#UNKNOWN,
-     * Android does not know how to handle the call.
-     *
-     * If the dialed emergency number does not have a specified emergency service category, the
-     * 'categories' field is set to @1.4::EmergencyServiceCategory#UNSPECIFIED; if the dialed
-     * emergency number does not have specified emergency Uniform Resource Names, the 'urns' field
-     * is set to an empty list. If the underlying technology used to request emergency services
-     * does not support the emergency service category or emergency uniform resource names, the
-     * field 'categories' or 'urns' may be ignored.
-     *
-     * In the scenarios that the 'address' in the 'dialInfo' field has other functions besides the
-     * emergency number function, if the 'hasKnownUserIntentEmergency' field is true, the user's
-     * intent for this dial request is emergency call, and the modem must treat this as an actual
-     * emergency dial; if the 'hasKnownUserIntentEmergency' field is false, Android does not know
-     * user's intent for this call.
-     *
-     * If 'isTesting' is true, this request is for testing purpose, and must not be sent to a real
-     * emergency service; otherwise it's for a real emergency call request.
-     *
-     * Reference: 3gpp 22.101, Section 10 - Emergency Calls;
-     *            3gpp 23.167, Section 6 - Functional description;
-     *            3gpp 24.503, Section 5.1.6.8.1 - General;
-     *            RFC 5031
-     *
-     * @param serial Serial number of request.
-     * @param dialInfo the same @1.0::Dial information used by @1.0::IRadio.dial.
-     * @param categories bitfield<@1.4::EmergencyServiceCategory> the Emergency Service Category(s)
-     *     of the call.
-     * @param urns the emergency Uniform Resource Names (URN)
-     * @param routing @1.4::EmergencyCallRouting the emergency call routing information.
-     * @param hasKnownUserIntentEmergency Flag indicating if user's intent for the emergency call
-     *     is known.
-     * @param isTesting Flag indicating if this request is for testing purpose.
-     *
-     * Response function is IRadioResponse.emergencyDialResponse()
-     */
-    oneway emergencyDial_1_6(int32_t serial, Dial dialInfo,
-            bitfield<EmergencyServiceCategory> categories, vec<string> urns,
-            EmergencyCallRouting routing, bool hasKnownUserIntentEmergency, bool isTesting);
-
-    /**
      * Get which bands the modem's background scan is acting on.
      *
      * @param serial Serial number of request.
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_api.cpp b/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
index 44900b8..8b87292 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.6/vts/functional/radio_hidl_hal_api.cpp
@@ -412,167 +412,6 @@
 }
 
 /*
- * Test IRadio.emergencyDial() for the response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories = static_cast<int>(
-            ::android::hardware::radio::V1_4::EmergencyServiceCategory::UNSPECIFIED);
-    std::vector<hidl_string> urns = {""};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::UNKNOWN;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
- * Test IRadio.emergencyDial() with specified service and its response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6_withServices) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories =
-            static_cast<int>(::android::hardware::radio::V1_4::EmergencyServiceCategory::AMBULANCE);
-    std::vector<hidl_string> urns = {"urn:service:sos.ambulance"};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::UNKNOWN;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial_withServices, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
- * Test IRadio.emergencyDial() with known emergency call routing and its response returned.
- */
-TEST_P(RadioHidlTest_v1_6, emergencyDial_1_6_withEmergencyRouting) {
-    if (!deviceSupportsFeature(FEATURE_VOICE_CALL)) {
-        ALOGI("Skipping emergencyDial because voice call is not supported in device");
-        return;
-    } else {
-        ALOGI("Running emergencyDial because voice call is supported in device");
-    }
-
-    serial = GetRandomSerialNumber();
-
-    ::android::hardware::radio::V1_0::Dial dialInfo;
-    dialInfo.address = hidl_string("911");
-    int categories = static_cast<int>(
-            ::android::hardware::radio::V1_4::EmergencyServiceCategory::UNSPECIFIED);
-    std::vector<hidl_string> urns = {""};
-    ::android::hardware::radio::V1_4::EmergencyCallRouting routing =
-            ::android::hardware::radio::V1_4::EmergencyCallRouting::EMERGENCY;
-
-    Return<void> res =
-            radio_v1_6->emergencyDial_1_6(serial, dialInfo, categories, urns, routing, true, true);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_v1_6->rspInfo_v1_0.type);
-    EXPECT_EQ(serial, radioRsp_v1_6->rspInfo_v1_0.serial);
-
-    ALOGI("emergencyDial_withEmergencyRouting, rspInfo_v1_0.error = %s\n",
-          toString(radioRsp_v1_6->rspInfo_v1_0.error).c_str());
-    ::android::hardware::radio::V1_0::RadioError rspEmergencyDial =
-            radioRsp_v1_6->rspInfo_v1_0.error;
-
-    // In DSDS or TSTS, we only check the result if the current slot is IN_SERVICE
-    // or Emergency_Only.
-    if (isDsDsEnabled() || isTsTsEnabled()) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->getVoiceRegistrationState(serial);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        if (isVoiceEmergencyOnly(radioRsp_v1_6->voiceRegResp.regState) ||
-            isVoiceInService(radioRsp_v1_6->voiceRegResp.regState)) {
-            EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-        }
-    } else {
-        EXPECT_EQ(::android::hardware::radio::V1_0::RadioError::NONE, rspEmergencyDial);
-    }
-
-    // Give some time for modem to establish the emergency call channel.
-    sleep(MODEM_EMERGENCY_CALL_ESTABLISH_TIME);
-
-    // Disconnect all the potential established calls to prevent them affecting other tests.
-    clearPotentialEstablishedCalls();
-}
-
-/*
  * Test IRadio.getCurrentCalls_1_6() for the response returned.
  */
 TEST_P(RadioHidlTest_v1_6, getCurrentCalls_1_6) {
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_test.cpp b/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
index 59f7682..79c3cde 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
+++ b/radio/1.6/vts/functional/radio_hidl_hal_test.cpp
@@ -74,29 +74,6 @@
     return status;
 }
 
-void RadioHidlTest_v1_6::clearPotentialEstablishedCalls() {
-    // Get the current call Id to hangup the established emergency call.
-    serial = GetRandomSerialNumber();
-    radio_v1_6->getCurrentCalls_1_6(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-
-    // Hang up to disconnect the established call channels.
-    for (const ::android::hardware::radio::V1_6::Call& call : radioRsp_v1_6->currentCalls) {
-        serial = GetRandomSerialNumber();
-        radio_v1_6->hangup(serial, call.base.base.index);
-        ALOGI("Hang up to disconnect the established call channel: %d", call.base.base.index);
-        EXPECT_EQ(std::cv_status::no_timeout, wait());
-        // Give some time for modem to disconnect the established call channel.
-        sleep(MODEM_EMERGENCY_CALL_DISCONNECT_TIME);
-    }
-
-    // Verify there are no more current calls.
-    serial = GetRandomSerialNumber();
-    radio_v1_6->getCurrentCalls_1_6(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(0, radioRsp_v1_6->currentCalls.size());
-}
-
 void RadioHidlTest_v1_6::updateSimCardStatus() {
     serial = GetRandomSerialNumber();
     radio_v1_6->getIccCardStatus(serial);
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
index ea85e3a..334fec3 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
+++ b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
@@ -70,8 +70,7 @@
     ::android::hardware::radio::V1_6::RadioResponseInfo rspInfo;
 
     // Call
-    hidl_vec<::android::hardware::radio::V1_6::Call> currentCalls;
-    ::android::hardware::radio::V1_2::VoiceRegStateResult voiceRegResp;
+    hidl_vec<::android::hardware::radio::V1_2::Call> currentCalls;
 
     // Sms
     SendSmsResult sendSmsResult;
diff --git a/radio/1.6/vts/functional/radio_response.cpp b/radio/1.6/vts/functional/radio_response.cpp
index 6edf2fd..100fabd 100644
--- a/radio/1.6/vts/functional/radio_response.cpp
+++ b/radio/1.6/vts/functional/radio_response.cpp
@@ -816,11 +816,8 @@
 }
 
 Return<void> RadioResponse_v1_6::getVoiceRegistrationStateResponse_1_2(
-        const ::android::hardware::radio::V1_0::RadioResponseInfo& info,
-        const ::android::hardware::radio::V1_2::VoiceRegStateResult& voiceRegResponse) {
-    rspInfo_v1_0 = info;
-    voiceRegResp = voiceRegResponse;
-    parent_v1_6.notify(info.serial);
+        const ::android::hardware::radio::V1_0::RadioResponseInfo& /*info*/,
+        const ::android::hardware::radio::V1_2::VoiceRegStateResult& /*voiceRegResponse*/) {
     return Void();
 }
 
@@ -1213,9 +1210,8 @@
 
 Return<void> RadioResponse_v1_6::getCurrentCallsResponse_1_6(
         const ::android::hardware::radio::V1_6::RadioResponseInfo& info,
-        const ::android::hardware::hidl_vec<::android::hardware::radio::V1_6::Call>& calls) {
+        const ::android::hardware::hidl_vec<::android::hardware::radio::V1_6::Call>& /*calls*/) {
     rspInfo = info;
-    currentCalls = calls;
     parent_v1_6.notify(info.serial);
     return Void();
 }
diff --git a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
index 78da3e8..c720d6d 100644
--- a/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
+++ b/security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/SecurityLevel.aidl
@@ -36,4 +36,5 @@
   SOFTWARE = 0,
   TRUSTED_ENVIRONMENT = 1,
   STRONGBOX = 2,
+  KEYSTORE = 100,
 }
diff --git a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
index b149ac9..69bec2d7 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
@@ -36,7 +36,6 @@
      * deciding whether a given tag from `keyParams` argument to the generation/import method should
      * be returned in `keyCharacteristics` are:
      *
-     * - If the IKeyMintDevice cannot fully enforce the semantics of the tag, it should be omitted.
      * - If the semantics of the tag are fully enforced by the IKeyMintDevice, without any
      *   assistance from components running at other security levels, it should be included in an
      *   entry with the SecurityLevel of the IKeyMintDevice.
@@ -45,6 +44,9 @@
      *   SecurityLevel of the involved components.  For example if a StrongBox IKeyMintDevice relies
      *   on a TEE to validate biometric authentication, biometric authentication tags go in an entry
      *   with SecurityLevel::TRUSTED_ENVIRONMENT.
+     * - If the semantics are not enforced by KeyMint at all, SecurityLevel::KEYSTORE is used to
+     *   indicate that Keystore should enforce.  Note that in Keymaster (predecessor to KeyMint),
+     *   these tags would have been in SecurityLevel::SOFTWARE.
      */
     KeyCharacteristics[] keyCharacteristics;
 
diff --git a/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl b/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
index 10363e9..c63859c 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/SecurityLevel.aidl
@@ -17,16 +17,59 @@
 package android.hardware.security.keymint;
 
 /**
- * Device security levels.
+ * Device security levels.  These enum values are used in two ways:
+ *
+ * 1.  Returned from IKeyMintDevice::getHardwareInfo to identify the security level of the
+ *     IKeyMintDevice.  This characterizes the sort of environment in which the KeyMint
+ *     implementation runs, and therefore the security of its operations.
+ *
+ * 2.  Associated with individual KeyMint authorization Tags in KeyCharacteristics or in attestation
+ *     certificates.  This specifies the security level of the weakest environment involved in
+ *     enforcing that particular tag, i.e. the sort of security environment an attacker would have
+ *     to subvert in order to break the enforcement of that tag.
  */
 @VintfStability
 @Backing(type="int")
 enum SecurityLevel {
+    /**
+     * The SOFTWARE security level represents a KeyMint implementation that runs in an Android
+     * process, or a tag enforced by such an implementation.  An attacker who can compromise that
+     * process, or obtain root, or subvert the kernel on the device can defeat it.
+     *
+     * Note that the distinction between SOFTWARE and KEYSTORE is only relevant on-device.  For
+     * attestation purposes, these categories are combined into the software-enforced authorization
+     * list.
+     */
     SOFTWARE = 0,
+
+    /**
+     * The TRUSTED_ENVIRONMENT security level represents a KeyMint implementation that runs in an
+     * Android process, or a tag enforced by such an implementation.  An attacker who completely
+     * compromises Android, including the Linux kernel, does not have the ability to subvert it.  At
+     * attacker who can find an exploit that gains them control of the trusted environment, or who
+     * has access to the physical device and can mount a sophisticated hardware attack, may be able
+     * to defeat it.
+     */
     TRUSTED_ENVIRONMENT = 1,
     /**
-     * STRONGBOX specifies that the secure hardware satisfies the requirements specified in CDD
-     * 9.11.2.
+     * The STRONGBOX security level represents a KeyMint implementation that runs in security
+     * hardware that satisfies the requirements specified in CDD 9.11.2.  Roughly speaking, these
+     * are discrete, security-focus computing environments that are hardened against physical and
+     * side channel attack, and have had their security formally validated by a competent
+     * penetration testing lab.
      */
     STRONGBOX = 2,
+
+    /**
+     * KeyMint implementations must never return the KEYSTORE security level from getHardwareInfo.
+     * It is used to specify tags that are not enforced by the IKeyMintDevice, but are instead
+     * to be enforced by Keystore.  An attacker who can subvert the keystore process or gain root or
+     * subvert the kernel can prevent proper enforcement of these tags.
+     *
+     *
+     * Note that the distinction between SOFTWARE and KEYSTORE is only relevant on-device.  When
+     * KeyMint generates an attestation certificate, these categories are combined into the
+     * software-enforced authorization list.
+     */
+    KEYSTORE = 100
 }
diff --git a/tetheroffload/control/1.1/IOffloadControl.hal b/tetheroffload/control/1.1/IOffloadControl.hal
index eb5b8a1..2eb54c8 100644
--- a/tetheroffload/control/1.1/IOffloadControl.hal
+++ b/tetheroffload/control/1.1/IOffloadControl.hal
@@ -37,11 +37,9 @@
      * offload is started. This is because the quota values would likely become stale over
      * time and would not reflect any new traffic that has occurred.
      *
-     * This API replaces {@link @1.0::IOffloadControl::setDataLimit}, the framework would always
-     * calls this API if 1.1 HAL is supported. Otherwise, calls the other one. Thus, no
-     * interaction between the two APIs need to be addressed. However, the hardware implementation
-     * still needs to keep functionality of both in case of shipping with older framework that
-     * doesn't support 1.1 HAL.
+     * This API replaces {@link @1.0::IOffloadControl::setDataLimit}, the framework will always
+     * call setDataWarningAndLimit on 1.1 implementations, and setDataLimit on 1.0 implementations.
+     * Thus, no interaction between the two APIs need to be addressed.
      *
      * The specified quota bytes MUST replace any previous quotas set by
      * {@code setDataWarningAndLimit} specified on the same interface. It may be interpreted as
diff --git a/wifi/1.5/IWifiApIface.hal b/wifi/1.5/IWifiApIface.hal
index 9625a6b..c638f1d 100644
--- a/wifi/1.5/IWifiApIface.hal
+++ b/wifi/1.5/IWifiApIface.hal
@@ -37,4 +37,18 @@
      *         |WifiStatusCode.ERROR_UNKNOWN|
      */
     resetToFactoryMacAddress() generates (WifiStatus status);
+
+    /**
+     * Get the names of the bridged AP instances.
+     *
+     * @return status WifiStatus of the operation
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     *
+     * @return instances A vector which contains the names of the bridged AP
+     * instances. Note: Returns an empty vector for a non-bridged AP.
+     */
+    getBridgedInstances() generates (WifiStatus status, vec<string> instances);
 };
diff --git a/wifi/1.5/IWifiChip.hal b/wifi/1.5/IWifiChip.hal
index b2960cf..209190a 100644
--- a/wifi/1.5/IWifiChip.hal
+++ b/wifi/1.5/IWifiChip.hal
@@ -234,4 +234,33 @@
      *         |WifiStatusCode.FAILURE_IFACE_INVALID|
      */
     setCountryCode(int8_t[2] code) generates (WifiStatus status);
+
+    /**
+     * Retrieve list of usable Wifi channels for the specified band &
+     * operational modes.
+     *
+     * The list of usable Wifi channels in a given band depends on factors
+     * like current country code, operational mode (e.g. STA, SAP, CLI, GO,
+     * TDLS, NAN) and any hard restrictons due to DFS, LTE Coex and
+     * MCC(multi channel-concurrency).
+     *
+     * @param band |WifiBand| for which list of usable channels is requested.
+     * @param ifaceModeMask Bitmask of the modes represented by |WifiIfaceMode|
+     *        Bitmask respresents all the modes that the caller is interested
+     *        in (e.g. STA, SAP, CLI, GO, TDLS, NAN).
+     *        Note: Bitmask does not represent concurrency matrix.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.FAILURE_UNKNOWN|
+     * @return channels List of channels represented by |WifiUsableChannel|
+     *         Each entry represents a channel frequency, bandwidth and
+     *         bitmask of operational modes (e.g. STA, SAP, CLI, GO, TDLS, NAN)
+     *         allowed on that channel.
+     *         Note: Bitmask does not represent concurrency matrix.
+     */
+    getUsableChannels(WifiBand band, bitfield<WifiIfaceMode> ifaceModeMask)
+        generates (WifiStatus status, vec<WifiUsableChannel> channels);
 };
diff --git a/wifi/1.5/default/hidl_struct_util.cpp b/wifi/1.5/default/hidl_struct_util.cpp
index 8e2e647..7cee4cd 100644
--- a/wifi/1.5/default/hidl_struct_util.cpp
+++ b/wifi/1.5/default/hidl_struct_util.cpp
@@ -356,6 +356,129 @@
     return true;
 }
 
+uint32_t convertHidlWifiBandToLegacyMacBand(V1_5::WifiBand hidl_band) {
+    switch (hidl_band) {
+        case V1_5::WifiBand::BAND_24GHZ:
+            return legacy_hal::WLAN_MAC_2_4_BAND;
+        case V1_5::WifiBand::BAND_5GHZ:
+        case V1_5::WifiBand::BAND_5GHZ_DFS:
+        case V1_5::WifiBand::BAND_5GHZ_WITH_DFS:
+            return legacy_hal::WLAN_MAC_5_0_BAND;
+        case V1_5::WifiBand::BAND_24GHZ_5GHZ:
+        case V1_5::WifiBand::BAND_24GHZ_5GHZ_WITH_DFS:
+            return (legacy_hal::WLAN_MAC_2_4_BAND |
+                    legacy_hal::WLAN_MAC_5_0_BAND);
+        case V1_5::WifiBand::BAND_6GHZ:
+            return legacy_hal::WLAN_MAC_6_0_BAND;
+        case V1_5::WifiBand::BAND_5GHZ_6GHZ:
+            return (legacy_hal::WLAN_MAC_5_0_BAND |
+                    legacy_hal::WLAN_MAC_6_0_BAND);
+        case V1_5::WifiBand::BAND_24GHZ_5GHZ_6GHZ:
+        case V1_5::WifiBand::BAND_24GHZ_5GHZ_WITH_DFS_6GHZ:
+            return (legacy_hal::WLAN_MAC_2_4_BAND |
+                    legacy_hal::WLAN_MAC_5_0_BAND |
+                    legacy_hal::WLAN_MAC_6_0_BAND);
+        case V1_5::WifiBand::BAND_60GHZ:
+            return legacy_hal::WLAN_MAC_60_0_BAND;
+        default:
+            return (
+                legacy_hal::WLAN_MAC_2_4_BAND | legacy_hal::WLAN_MAC_5_0_BAND |
+                legacy_hal::WLAN_MAC_6_0_BAND | legacy_hal::WLAN_MAC_60_0_BAND);
+    }
+}
+
+uint32_t convertHidlWifiIfaceModeToLegacy(uint32_t hidl_iface_mask) {
+    uint32_t legacy_iface_mask = 0;
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_STA) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_STA);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_SOFTAP) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_SOFTAP);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_P2P_CLIENT) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_P2P_CLIENT);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_P2P_GO) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_P2P_GO);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_NAN) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_NAN);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_TDLS) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_TDLS);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_MESH) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_MESH);
+    }
+    if (hidl_iface_mask & V1_5::WifiIfaceMode::IFACE_MODE_IBSS) {
+        legacy_iface_mask |= (1 << legacy_hal::WIFI_INTERFACE_IBSS);
+    }
+    return legacy_iface_mask;
+}
+
+uint32_t convertLegacyWifiInterfaceModeToHidl(uint32_t legacy_iface_mask) {
+    uint32_t hidl_iface_mask = 0;
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_STA)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_STA;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_SOFTAP)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_SOFTAP;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_P2P_CLIENT)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_P2P_CLIENT;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_P2P_GO)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_P2P_GO;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_NAN)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_NAN;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_TDLS)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_TDLS;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_MESH)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_MESH;
+    }
+    if (legacy_iface_mask & (1 << legacy_hal::WIFI_INTERFACE_IBSS)) {
+        hidl_iface_mask |= V1_5::WifiIfaceMode::IFACE_MODE_IBSS;
+    }
+    return hidl_iface_mask;
+}
+
+bool convertLegacyWifiUsableChannelToHidl(
+    const legacy_hal::wifi_usable_channel& legacy_usable_channel,
+    V1_5::WifiUsableChannel* hidl_usable_channel) {
+    if (!hidl_usable_channel) {
+        return false;
+    }
+    *hidl_usable_channel = {};
+    hidl_usable_channel->channel = legacy_usable_channel.freq;
+    hidl_usable_channel->channelBandwidth =
+        convertLegacyWifiChannelWidthToHidl(legacy_usable_channel.width);
+    hidl_usable_channel->ifaceModeMask = convertLegacyWifiInterfaceModeToHidl(
+        legacy_usable_channel.iface_mode_mask);
+
+    return true;
+}
+
+bool convertLegacyWifiUsableChannelsToHidl(
+    const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
+    std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels) {
+    if (!hidl_usable_channels) {
+        return false;
+    }
+    *hidl_usable_channels = {};
+    for (const auto& legacy_usable_channel : legacy_usable_channels) {
+        V1_5::WifiUsableChannel hidl_usable_channel;
+        if (!convertLegacyWifiUsableChannelToHidl(legacy_usable_channel,
+                                                  &hidl_usable_channel)) {
+            return false;
+        }
+        hidl_usable_channels->push_back(hidl_usable_channel);
+    }
+    return true;
+}
+
 bool convertLegacyWifiMacInfosToHidl(
     const std::vector<legacy_hal::WifiMacInfo>& legacy_mac_infos,
     std::vector<V1_4::IWifiChipEventCallback::RadioModeInfo>*
diff --git a/wifi/1.5/default/hidl_struct_util.h b/wifi/1.5/default/hidl_struct_util.h
index feb47ef..c0d7bf8 100644
--- a/wifi/1.5/default/hidl_struct_util.h
+++ b/wifi/1.5/default/hidl_struct_util.h
@@ -206,6 +206,11 @@
 bool convertLegacyVectorOfRttResultToHidl(
     const std::vector<const legacy_hal::wifi_rtt_result*>& legacy_results,
     std::vector<V1_4::RttResult>* hidl_results);
+uint32_t convertHidlWifiBandToLegacyMacBand(V1_5::WifiBand band);
+uint32_t convertHidlWifiIfaceModeToLegacy(uint32_t hidl_iface_mask);
+bool convertLegacyWifiUsableChannelsToHidl(
+    const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
+    std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels);
 }  // namespace hidl_struct_util
 }  // namespace implementation
 }  // namespace V1_5
diff --git a/wifi/1.5/default/wifi_ap_iface.cpp b/wifi/1.5/default/wifi_ap_iface.cpp
index d98aa45..b438a4a 100644
--- a/wifi/1.5/default/wifi_ap_iface.cpp
+++ b/wifi/1.5/default/wifi_ap_iface.cpp
@@ -47,6 +47,12 @@
 
 std::string WifiApIface::getName() { return ifname_; }
 
+void WifiApIface::removeInstance(std::string instance) {
+    instances_.erase(
+        std::remove(instances_.begin(), instances_.end(), instance),
+        instances_.end());
+}
+
 Return<void> WifiApIface::getName(getName_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiApIface::getNameInternal, hidl_status_cb);
@@ -93,6 +99,13 @@
                            hidl_status_cb);
 }
 
+Return<void> WifiApIface::getBridgedInstances(
+    getBridgedInstances_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiApIface::getBridgedInstancesInternal,
+                           hidl_status_cb);
+}
+
 std::pair<WifiStatus, std::string> WifiApIface::getNameInternal() {
     return {createWifiStatus(WifiStatusCode::SUCCESS), ifname_};
 }
@@ -178,6 +191,15 @@
     }
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
+
+std::pair<WifiStatus, std::vector<hidl_string>>
+WifiApIface::getBridgedInstancesInternal() {
+    std::vector<hidl_string> instances;
+    for (const auto& instance_name : instances_) {
+        instances.push_back(instance_name);
+    }
+    return {createWifiStatus(WifiStatusCode::SUCCESS), instances};
+}
 }  // namespace implementation
 }  // namespace V1_5
 }  // namespace wifi
diff --git a/wifi/1.5/default/wifi_ap_iface.h b/wifi/1.5/default/wifi_ap_iface.h
index 02fb2d8..8f8387d 100644
--- a/wifi/1.5/default/wifi_ap_iface.h
+++ b/wifi/1.5/default/wifi_ap_iface.h
@@ -43,6 +43,7 @@
     void invalidate();
     bool isValid();
     std::string getName();
+    void removeInstance(std::string instance);
 
     // HIDL methods exposed.
     Return<void> getName(getName_cb hidl_status_cb) override;
@@ -59,6 +60,9 @@
     Return<void> resetToFactoryMacAddress(
         resetToFactoryMacAddress_cb hidl_status_cb) override;
 
+    Return<void> getBridgedInstances(
+        getBridgedInstances_cb hidl_status_cb) override;
+
    private:
     // Corresponding worker functions for the HIDL methods.
     std::pair<WifiStatus, std::string> getNameInternal();
@@ -70,6 +74,8 @@
     std::pair<WifiStatus, std::array<uint8_t, 6>> getFactoryMacAddressInternal(
         const std::string& ifaceName);
     WifiStatus resetToFactoryMacAddressInternal();
+    std::pair<WifiStatus, std::vector<hidl_string>>
+    getBridgedInstancesInternal();
 
     std::string ifname_;
     std::vector<std::string> instances_;
diff --git a/wifi/1.5/default/wifi_chip.cpp b/wifi/1.5/default/wifi_chip.cpp
index 414d74c..2dc7314 100644
--- a/wifi/1.5/default/wifi_chip.cpp
+++ b/wifi/1.5/default/wifi_chip.cpp
@@ -738,6 +738,14 @@
                            code);
 }
 
+Return<void> WifiChip::getUsableChannels(
+    WifiBand band, hidl_bitfield<WifiIfaceMode> ifaceModeMask,
+    getUsableChannels_cb _hidl_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::getUsableChannelsInternal, _hidl_cb, band,
+                           ifaceModeMask);
+}
+
 void WifiChip::invalidateAndRemoveAllIfaces() {
     invalidateAndClearBridgedApAll();
     invalidateAndClearAll(ap_ifaces_);
@@ -1066,6 +1074,7 @@
         }
     }
     br_ifaces_ap_instances_.erase(ifInstanceName);
+    iface->removeInstance(ifInstanceName);
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
@@ -1490,6 +1499,25 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
+std::pair<WifiStatus, std::vector<WifiUsableChannel>>
+WifiChip::getUsableChannelsInternal(WifiBand band, uint32_t ifaceModeMask) {
+    legacy_hal::wifi_error legacy_status;
+    std::vector<legacy_hal::wifi_usable_channel> legacy_usable_channels;
+    std::tie(legacy_status, legacy_usable_channels) =
+        legacy_hal_.lock()->getUsableChannels(
+            hidl_struct_util::convertHidlWifiBandToLegacyMacBand(band),
+            hidl_struct_util::convertHidlWifiIfaceModeToLegacy(ifaceModeMask));
+    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+        return {createWifiStatusFromLegacyError(legacy_status), {}};
+    }
+    std::vector<WifiUsableChannel> hidl_usable_channels;
+    if (!hidl_struct_util::convertLegacyWifiUsableChannelsToHidl(
+            legacy_usable_channels, &hidl_usable_channels)) {
+        return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
+    }
+    return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_usable_channels};
+}
+
 WifiStatus WifiChip::handleChipConfiguration(
     /* NONNULL */ std::unique_lock<std::recursive_mutex>* lock,
     ChipModeId mode_id) {
diff --git a/wifi/1.5/default/wifi_chip.h b/wifi/1.5/default/wifi_chip.h
index 7d7a9b5..d542792 100644
--- a/wifi/1.5/default/wifi_chip.h
+++ b/wifi/1.5/default/wifi_chip.h
@@ -180,6 +180,9 @@
         setCoexUnsafeChannels_cb hidl_status_cb) override;
     Return<void> setCountryCode(const hidl_array<int8_t, 2>& code,
                                 setCountryCode_cb _hidl_cb) override;
+    Return<void> getUsableChannels(WifiBand band,
+                                   hidl_bitfield<WifiIfaceMode> ifaceModeMask,
+                                   getUsableChannels_cb _hidl_cb) override;
 
    private:
     void invalidateAndRemoveAllIfaces();
@@ -261,6 +264,8 @@
     WifiStatus setCoexUnsafeChannelsInternal(
         std::vector<CoexUnsafeChannel> unsafe_channels, uint32_t restrictions);
     WifiStatus setCountryCodeInternal(const std::array<int8_t, 2>& code);
+    std::pair<WifiStatus, std::vector<WifiUsableChannel>>
+    getUsableChannelsInternal(WifiBand band, uint32_t ifaceModeMask);
     WifiStatus handleChipConfiguration(
         std::unique_lock<std::recursive_mutex>* lock, ChipModeId mode_id);
     WifiStatus registerDebugRingBufferCallback();
diff --git a/wifi/1.5/default/wifi_legacy_hal.cpp b/wifi/1.5/default/wifi_legacy_hal.cpp
index 3e65ee0..94603b3 100644
--- a/wifi/1.5/default/wifi_legacy_hal.cpp
+++ b/wifi/1.5/default/wifi_legacy_hal.cpp
@@ -36,6 +36,7 @@
 static constexpr uint32_t kLinkLayerStatsDataMpduSizeThreshold = 128;
 static constexpr uint32_t kMaxWakeReasonStatsArraySize = 32;
 static constexpr uint32_t kMaxRingBuffers = 10;
+static constexpr uint32_t kMaxWifiUsableChannels = 256;
 // need a long timeout (1000ms) for chips that unload their driver.
 static constexpr uint32_t kMaxStopCompleteWaitMs = 1000;
 static constexpr char kDriverPropName[] = "wlan.driver.status";
@@ -1636,6 +1637,19 @@
                                                    multiplier);
 }
 
+std::pair<wifi_error, std::vector<wifi_usable_channel>>
+WifiLegacyHal::getUsableChannels(uint32_t band_mask, uint32_t iface_mode_mask) {
+    std::vector<wifi_usable_channel> channels;
+    channels.resize(kMaxWifiUsableChannels);
+    uint32_t size = 0;
+    wifi_error status = global_func_table_.wifi_get_usable_channels(
+        global_handle_, band_mask, iface_mode_mask, channels.size(), &size,
+        reinterpret_cast<wifi_usable_channel*>(channels.data()));
+    CHECK(size >= 0 && size <= kMaxWifiUsableChannels);
+    channels.resize(size);
+    return {status, std::move(channels)};
+}
+
 void WifiLegacyHal::invalidate() {
     global_handle_ = nullptr;
     iface_name_to_handle_.clear();
diff --git a/wifi/1.5/default/wifi_legacy_hal.h b/wifi/1.5/default/wifi_legacy_hal.h
index 0cc1cff..dc641ae 100644
--- a/wifi/1.5/default/wifi_legacy_hal.h
+++ b/wifi/1.5/default/wifi_legacy_hal.h
@@ -36,9 +36,13 @@
 namespace legacy_hal {
 // Import all the types defined inside the legacy HAL header files into this
 // namespace.
+using ::frame_info;
+using ::frame_type;
 using ::FRAME_TYPE_80211_MGMT;
 using ::FRAME_TYPE_ETHERNET_II;
 using ::FRAME_TYPE_UNKNOWN;
+using ::fw_roaming_state_t;
+using ::mac_addr;
 using ::NAN_CHANNEL_24G_BAND;
 using ::NAN_CHANNEL_5G_BAND_HIGH;
 using ::NAN_CHANNEL_5G_BAND_LOW;
@@ -80,8 +84,6 @@
 using ::NAN_RESPONSE_TCA;
 using ::NAN_RESPONSE_TRANSMIT_FOLLOWUP;
 using ::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
-using ::NAN_SECURITY_KEY_INPUT_PASSPHRASE;
-using ::NAN_SECURITY_KEY_INPUT_PMK;
 using ::NAN_SECURITY_KEY_INPUT_PMK;
 using ::NAN_SERVICE_ACCEPT_POLICY_ALL;
 using ::NAN_SERVICE_ACCEPT_POLICY_NONE;
@@ -154,19 +156,20 @@
 using ::RTT_PEER_P2P_CLIENT;
 using ::RTT_PEER_P2P_GO;
 using ::RTT_PEER_STA;
+using ::rtt_peer_type;
 using ::RTT_STATUS_ABORTED;
-using ::RTT_STATUS_FAILURE;
 using ::RTT_STATUS_FAIL_AP_ON_DIFF_CHANNEL;
 using ::RTT_STATUS_FAIL_BUSY_TRY_LATER;
 using ::RTT_STATUS_FAIL_FTM_PARAM_OVERRIDE;
 using ::RTT_STATUS_FAIL_INVALID_TS;
-using ::RTT_STATUS_FAIL_NOT_SCHEDULED_YET;
 using ::RTT_STATUS_FAIL_NO_CAPABILITY;
 using ::RTT_STATUS_FAIL_NO_RSP;
+using ::RTT_STATUS_FAIL_NOT_SCHEDULED_YET;
 using ::RTT_STATUS_FAIL_PROTOCOL;
 using ::RTT_STATUS_FAIL_REJECTED;
 using ::RTT_STATUS_FAIL_SCHEDULE;
 using ::RTT_STATUS_FAIL_TM_TIMEOUT;
+using ::RTT_STATUS_FAILURE;
 using ::RTT_STATUS_INVALID_REQ;
 using ::RTT_STATUS_NAN_RANGING_CONCURRENCY_NOT_SUPPORTED;
 using ::RTT_STATUS_NAN_RANGING_PROTOCOL_FAILURE;
@@ -185,6 +188,8 @@
 using ::RX_PKT_FATE_FW_DROP_OTHER;
 using ::RX_PKT_FATE_FW_QUEUED;
 using ::RX_PKT_FATE_SUCCESS;
+using ::ssid_t;
+using ::transaction_id;
 using ::TX_PKT_FATE_ACKED;
 using ::TX_PKT_FATE_DRV_DROP_INVALID;
 using ::TX_PKT_FATE_DRV_DROP_NOBUFS;
@@ -199,24 +204,31 @@
 using ::WIFI_AC_BK;
 using ::WIFI_AC_VI;
 using ::WIFI_AC_VO;
+using ::wifi_band;
 using ::WIFI_BAND_A;
-using ::WIFI_BAND_ABG;
-using ::WIFI_BAND_ABG_WITH_DFS;
 using ::WIFI_BAND_A_DFS;
 using ::WIFI_BAND_A_WITH_DFS;
+using ::WIFI_BAND_ABG;
+using ::WIFI_BAND_ABG_WITH_DFS;
 using ::WIFI_BAND_BG;
 using ::WIFI_BAND_UNSPECIFIED;
+using ::wifi_cached_scan_results;
 using ::WIFI_CHAN_WIDTH_10;
 using ::WIFI_CHAN_WIDTH_160;
 using ::WIFI_CHAN_WIDTH_20;
 using ::WIFI_CHAN_WIDTH_40;
 using ::WIFI_CHAN_WIDTH_5;
-using ::WIFI_CHAN_WIDTH_5;
 using ::WIFI_CHAN_WIDTH_80;
 using ::WIFI_CHAN_WIDTH_80P80;
 using ::WIFI_CHAN_WIDTH_INVALID;
+using ::wifi_channel_info;
+using ::wifi_channel_stat;
+using ::wifi_channel_width;
+using ::wifi_coex_restriction;
+using ::wifi_coex_unsafe_channel;
 using ::WIFI_DUAL_STA_NON_TRANSIENT_UNBIASED;
 using ::WIFI_DUAL_STA_TRANSIENT_PREFER_PRIMARY;
+using ::wifi_error;
 using ::WIFI_ERROR_BUSY;
 using ::WIFI_ERROR_INVALID_ARGS;
 using ::WIFI_ERROR_INVALID_REQUEST_ID;
@@ -228,12 +240,29 @@
 using ::WIFI_ERROR_TOO_MANY_REQUESTS;
 using ::WIFI_ERROR_UNINITIALIZED;
 using ::WIFI_ERROR_UNKNOWN;
+using ::wifi_gscan_capabilities;
+using ::wifi_hal_fn;
+using ::wifi_information_element;
+using ::WIFI_INTERFACE_IBSS;
+using ::WIFI_INTERFACE_MESH;
+using ::wifi_interface_mode;
+using ::WIFI_INTERFACE_NAN;
+using ::WIFI_INTERFACE_P2P_CLIENT;
+using ::WIFI_INTERFACE_P2P_GO;
+using ::WIFI_INTERFACE_SOFTAP;
+using ::WIFI_INTERFACE_STA;
+using ::WIFI_INTERFACE_TDLS;
+using ::wifi_interface_type;
 using ::WIFI_INTERFACE_TYPE_AP;
 using ::WIFI_INTERFACE_TYPE_NAN;
 using ::WIFI_INTERFACE_TYPE_P2P;
 using ::WIFI_INTERFACE_TYPE_STA;
+using ::WIFI_INTERFACE_UNKNOWN;
+using ::wifi_latency_mode;
 using ::WIFI_LATENCY_MODE_LOW;
 using ::WIFI_LATENCY_MODE_NORMAL;
+using ::wifi_lci_information;
+using ::wifi_lcr_information;
 using ::WIFI_LOGGER_CONNECT_EVENT_SUPPORTED;
 using ::WIFI_LOGGER_DRIVER_DUMP_SUPPORTED;
 using ::WIFI_LOGGER_MEMORY_DUMP_SUPPORTED;
@@ -242,61 +271,34 @@
 using ::WIFI_LOGGER_WAKE_LOCK_SUPPORTED;
 using ::WIFI_MOTION_EXPECTED;
 using ::WIFI_MOTION_NOT_EXPECTED;
+using ::wifi_motion_pattern;
 using ::WIFI_MOTION_UNKNOWN;
+using ::wifi_multi_sta_use_case;
+using ::wifi_power_scenario;
 using ::WIFI_POWER_SCENARIO_ON_BODY_CELL_OFF;
 using ::WIFI_POWER_SCENARIO_ON_BODY_CELL_ON;
 using ::WIFI_POWER_SCENARIO_ON_HEAD_CELL_OFF;
 using ::WIFI_POWER_SCENARIO_ON_HEAD_CELL_ON;
 using ::WIFI_POWER_SCENARIO_VOICE_CALL;
-using ::WIFI_RTT_BW_10;
-using ::WIFI_RTT_BW_160;
-using ::WIFI_RTT_BW_20;
-using ::WIFI_RTT_BW_40;
-using ::WIFI_RTT_BW_5;
-using ::WIFI_RTT_BW_80;
-using ::WIFI_RTT_PREAMBLE_HE;
-using ::WIFI_RTT_PREAMBLE_HT;
-using ::WIFI_RTT_PREAMBLE_LEGACY;
-using ::WIFI_RTT_PREAMBLE_VHT;
-using ::WIFI_SCAN_FLAG_INTERRUPTED;
-using ::WIFI_SUCCESS;
-using ::WLAN_MAC_2_4_BAND;
-using ::WLAN_MAC_5_0_BAND;
-using ::WLAN_MAC_6_0_BAND;
-using ::frame_info;
-using ::frame_type;
-using ::fw_roaming_state_t;
-using ::mac_addr;
-using ::rtt_peer_type;
-using ::ssid_t;
-using ::transaction_id;
-using ::wifi_band;
-using ::wifi_cached_scan_results;
-using ::wifi_channel_info;
-using ::wifi_channel_stat;
-using ::wifi_channel_width;
-using ::wifi_coex_restriction;
-using ::wifi_coex_unsafe_channel;
-using ::wifi_error;
-using ::wifi_gscan_capabilities;
-using ::wifi_hal_fn;
-using ::wifi_information_element;
-using ::wifi_interface_type;
-using ::wifi_latency_mode;
-using ::wifi_lci_information;
-using ::wifi_lcr_information;
-using ::wifi_motion_pattern;
-using ::wifi_multi_sta_use_case;
-using ::wifi_power_scenario;
 using ::wifi_rate;
 using ::wifi_request_id;
 using ::wifi_ring_buffer_status;
 using ::wifi_roaming_capabilities;
 using ::wifi_roaming_config;
 using ::wifi_rtt_bw;
+using ::WIFI_RTT_BW_10;
+using ::WIFI_RTT_BW_160;
+using ::WIFI_RTT_BW_20;
+using ::WIFI_RTT_BW_40;
+using ::WIFI_RTT_BW_5;
+using ::WIFI_RTT_BW_80;
 using ::wifi_rtt_capabilities;
 using ::wifi_rtt_config;
 using ::wifi_rtt_preamble;
+using ::WIFI_RTT_PREAMBLE_HE;
+using ::WIFI_RTT_PREAMBLE_HT;
+using ::WIFI_RTT_PREAMBLE_LEGACY;
+using ::WIFI_RTT_PREAMBLE_VHT;
 using ::wifi_rtt_responder;
 using ::wifi_rtt_result;
 using ::wifi_rtt_status;
@@ -305,9 +307,16 @@
 using ::wifi_rx_report;
 using ::wifi_scan_bucket_spec;
 using ::wifi_scan_cmd_params;
+using ::WIFI_SCAN_FLAG_INTERRUPTED;
 using ::wifi_scan_result;
+using ::WIFI_SUCCESS;
 using ::wifi_tx_packet_fate;
 using ::wifi_tx_report;
+using ::wifi_usable_channel;
+using ::WLAN_MAC_2_4_BAND;
+using ::WLAN_MAC_5_0_BAND;
+using ::WLAN_MAC_60_0_BAND;
+using ::WLAN_MAC_6_0_BAND;
 
 // APF capabilities supported by the iface.
 struct PacketFilterCapabilities {
@@ -693,6 +702,11 @@
     wifi_error setDtimConfig(const std::string& iface_name,
                              uint32_t multiplier);
 
+    // Retrieve the list of usable channels in the requested bands
+    // for the requested modes
+    std::pair<wifi_error, std::vector<wifi_usable_channel>> getUsableChannels(
+        uint32_t band_mask, uint32_t iface_mode_mask);
+
    private:
     // Retrieve interface handles for all the available interfaces.
     wifi_error retrieveIfaceHandles();
diff --git a/wifi/1.5/default/wifi_legacy_hal_stubs.cpp b/wifi/1.5/default/wifi_legacy_hal_stubs.cpp
index 7ba5d9b..6212960 100644
--- a/wifi/1.5/default/wifi_legacy_hal_stubs.cpp
+++ b/wifi/1.5/default/wifi_legacy_hal_stubs.cpp
@@ -159,6 +159,7 @@
     populateStubFor(&hal_fn->wifi_twt_get_stats);
     populateStubFor(&hal_fn->wifi_twt_clear_stats);
     populateStubFor(&hal_fn->wifi_set_dtim_config);
+    populateStubFor(&hal_fn->wifi_get_usable_channels);
     return true;
 }
 }  // namespace legacy_hal
diff --git a/wifi/1.5/types.hal b/wifi/1.5/types.hal
index 9fa5c80..4dff774 100644
--- a/wifi/1.5/types.hal
+++ b/wifi/1.5/types.hal
@@ -24,6 +24,8 @@
 import @1.0::NanCapabilities;
 import @1.2::NanConfigRequestSupplemental;
 import @1.3::StaLinkLayerRadioStats;
+import @1.0::WifiChannelInMhz;
+import @1.0::WifiChannelWidthInMhz;
 
 /**
  * Wifi bands defined in 80211 spec.
@@ -44,6 +46,64 @@
 };
 
 /**
+ * Interface operating modes.
+ */
+enum WifiIfaceMode : uint32_t {
+    /**
+     * Interface operation mode is client.
+     */
+    IFACE_MODE_STA = 1 << 0,
+    /**
+     * Interface operation mode is Hotspot.
+     */
+    IFACE_MODE_SOFTAP = 1 << 1,
+    /**
+     * Interface operation mode is Ad-Hoc network.
+     */
+    IFACE_MODE_IBSS = 1 << 2,
+    /**
+     * Interface operation mode is Wifi Direct Client.
+     */
+    IFACE_MODE_P2P_CLIENT = 1 << 3,
+    /**
+     * Interface operation mode is Wifi Direct Group Owner.
+     */
+    IFACE_MODE_P2P_GO = 1 << 4,
+    /**
+     * Interface operation mode is Aware.
+     */
+    IFACE_MODE_NAN = 1 << 5,
+    /**
+     * Interface operation mode is Mesh network.
+     */
+    IFACE_MODE_MESH = 1 << 6,
+    /**
+     * Interface operation mode is Tunneled Direct Link Setup.
+     */
+    IFACE_MODE_TDLS = 1 << 7,
+};
+
+/**
+ * Wifi usable channel information.
+ */
+struct WifiUsableChannel {
+    /**
+     * Wifi channel freqeuncy in MHz.
+     */
+    WifiChannelInMhz channel;
+
+    /**
+     * Wifi channel bandwidth in MHz.
+     */
+    WifiChannelWidthInMhz channelBandwidth;
+
+    /**
+     * Iface modes feasible on this channel.
+     */
+    bitfield<WifiIfaceMode> ifaceModeMask;
+};
+
+/**
  * NAN configuration request parameters added in the 1.2 HAL. These are supplemental to previous
  * versions.
  */
diff --git a/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp b/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
index e47b14d..424f934 100644
--- a/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
+++ b/wifi/1.5/vts/functional/wifi_ap_iface_hidl_test.cpp
@@ -67,8 +67,8 @@
     std::string GetInstanceName() { return GetParam(); }
 };
 
-/*
- * resetToFactoryMacAddress
+/**
+ * resetToFactoryMacAddress in bridged AP mode.
  */
 TEST_P(WifiApIfaceHidlTest, resetToFactoryMacAddressInBridgedModeTest) {
     if (!isBridgedSupport_) GTEST_SKIP() << "Missing Bridged AP support";
@@ -79,8 +79,8 @@
     EXPECT_EQ(WifiStatusCode::SUCCESS, status.code);
 }
 
-/*
- * resetToFactoryMacAddress
+/**
+ * resetToFactoryMacAddress in non-bridged mode
  */
 TEST_P(WifiApIfaceHidlTest, resetToFactoryMacAddressTest) {
     sp<IWifiApIface> wifi_ap_iface = getWifiApIface_1_5(GetInstanceName());
@@ -89,6 +89,34 @@
     EXPECT_EQ(WifiStatusCode::SUCCESS, status.code);
 }
 
+/**
+ * getBridgedInstances in non-bridged mode
+ */
+TEST_P(WifiApIfaceHidlTest, getBridgedInstancesTest) {
+    sp<IWifiApIface> wifi_ap_iface = getWifiApIface_1_5(GetInstanceName());
+    ASSERT_NE(nullptr, wifi_ap_iface.get());
+    const auto& status_and_instances =
+        HIDL_INVOKE(wifi_ap_iface, getBridgedInstances);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_instances.first.code);
+    const auto& instances = status_and_instances.second;
+    EXPECT_EQ(0, instances.size());
+}
+
+/**
+ * getBridgedInstances in bridged AP mode.
+ */
+TEST_P(WifiApIfaceHidlTest, getBridgedInstancesInBridgedModeTest) {
+    if (!isBridgedSupport_) GTEST_SKIP() << "Missing Bridged AP support";
+    sp<IWifiApIface> wifi_ap_iface =
+        getBridgedWifiApIface_1_5(GetInstanceName());
+    ASSERT_NE(nullptr, wifi_ap_iface.get());
+    const auto& status_and_instances =
+        HIDL_INVOKE(wifi_ap_iface, getBridgedInstances);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_instances.first.code);
+    const auto& instances = status_and_instances.second;
+    EXPECT_EQ(2, instances.size());
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(WifiApIfaceHidlTest);
 INSTANTIATE_TEST_SUITE_P(
     PerInstance, WifiApIfaceHidlTest,
diff --git a/wifi/1.5/vts/functional/wifi_chip_hidl_ap_test.cpp b/wifi/1.5/vts/functional/wifi_chip_hidl_ap_test.cpp
index 922c9a7..d6a0408 100644
--- a/wifi/1.5/vts/functional/wifi_chip_hidl_ap_test.cpp
+++ b/wifi/1.5/vts/functional/wifi_chip_hidl_ap_test.cpp
@@ -101,14 +101,23 @@
     ASSERT_NE(nullptr, wifi_ap_iface.get());
     const auto& status_and_name = HIDL_INVOKE(wifi_ap_iface, getName);
     EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_name.first.code);
-    // TODO: b/173999527, add API to get instance name to replace it.
-    std::string br_name = status_and_name.second;  // ap_br_ is the pre-fix
-    std::string instance_name =
-        br_name.substr(6, br_name.length());  // remove the pre-fex
+    std::string br_name = status_and_name.second;
+    const auto& status_and_instances =
+        HIDL_INVOKE(wifi_ap_iface, getBridgedInstances);
+    EXPECT_EQ(WifiStatusCode::SUCCESS, status_and_instances.first.code);
+    const auto& instances = status_and_instances.second;
+    EXPECT_EQ(2, instances.size());
     const auto& status_code =
         HIDL_INVOKE(wifi_chip_, removeIfaceInstanceFromBridgedApIface, br_name,
-                    instance_name);
+                    instances[0]);
     EXPECT_EQ(WifiStatusCode::SUCCESS, status_code.code);
+    const auto& status_and_instances_after_remove =
+        HIDL_INVOKE(wifi_ap_iface, getBridgedInstances);
+    EXPECT_EQ(WifiStatusCode::SUCCESS,
+              status_and_instances_after_remove.first.code);
+    const auto& instances_after_remove =
+        status_and_instances_after_remove.second;
+    EXPECT_EQ(1, instances_after_remove.size());
 }
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(WifiChipHidlTest);
diff --git a/wifi/1.5/vts/functional/wifi_chip_hidl_test.cpp b/wifi/1.5/vts/functional/wifi_chip_hidl_test.cpp
index 36a8448..509f1bd 100644
--- a/wifi/1.5/vts/functional/wifi_chip_hidl_test.cpp
+++ b/wifi/1.5/vts/functional/wifi_chip_hidl_test.cpp
@@ -45,6 +45,7 @@
 using ::android::hardware::wifi::V1_4::IWifiChipEventCallback;
 using ::android::hardware::wifi::V1_5::IWifiChip;
 using ::android::hardware::wifi::V1_5::WifiBand;
+using ::android::hardware::wifi::V1_5::WifiIfaceMode;
 
 /**
  * Fixture to use for all Wifi chip HIDL interface tests.
@@ -187,6 +188,23 @@
               HIDL_INVOKE(wifi_chip_, setCountryCode, kCountryCode).code);
 }
 
+/* getUsableChannels:
+ * Ensure that a call to getUsableChannels will return with a success
+ * status for valid inputs.
+ */
+TEST_P(WifiChipHidlTest, getUsableChannels) {
+    uint32_t ifaceModeMask =
+        WifiIfaceMode::IFACE_MODE_P2P_CLIENT | WifiIfaceMode::IFACE_MODE_P2P_GO;
+    configureChipForIfaceType(IfaceType::STA, true);
+    WifiBand band = WifiBand::BAND_24GHZ_5GHZ_6GHZ;
+    const auto& statusNonEmpty =
+        HIDL_INVOKE(wifi_chip_, getUsableChannels, band, ifaceModeMask);
+    if (statusNonEmpty.first.code != WifiStatusCode::SUCCESS) {
+        EXPECT_EQ(WifiStatusCode::ERROR_NOT_SUPPORTED,
+                  statusNonEmpty.first.code);
+    }
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(WifiChipHidlTest);
 INSTANTIATE_TEST_SUITE_P(
     PerInstance, WifiChipHidlTest,