diff --git a/audio/aidl/android/hardware/audio/effect/IFactory.aidl b/audio/aidl/android/hardware/audio/effect/IFactory.aidl
index b80e6ac..75d4d9e 100644
--- a/audio/aidl/android/hardware/audio/effect/IFactory.aidl
+++ b/audio/aidl/android/hardware/audio/effect/IFactory.aidl
@@ -74,13 +74,18 @@
 
     /**
      * Called by the framework to destroy the effect and free up all currently allocated resources.
-     * It is recommended to destroy the effect from the client side as soon as it is becomes unused.
+     * This method can be called at any time to destroy an effect instance. It is recommended to
+     * destroy the effect from the client side as soon as it becomes unused to free up resources.
      *
-     * The client must ensure effect instance is closed before destroy.
+     * The effect instance must handle any necessary cleanup and resource deallocation.
+     * If the effect is in the **PROCESSING** or **DRAINING** state, it must gracefully stop
+     * processing before destruction.
+     * The effect must ensure that all internal states are properly cleaned up to prevent resource
+     * leaks.
      *
      * @param handle The handle of effect instance to be destroyed.
      * @throws EX_ILLEGAL_ARGUMENT if the effect handle is not valid.
-     * @throws EX_ILLEGAL_STATE if the effect instance is not in a proper state to be destroyed.
+     * @throws EX_ILLEGAL_STATE if the effect instance can not be destroyed.
      */
     void destroyEffect(in IEffect handle);
 }
diff --git a/audio/aidl/android/hardware/audio/effect/State.aidl b/audio/aidl/android/hardware/audio/effect/State.aidl
index 1b698d7..ecd1bbe 100644
--- a/audio/aidl/android/hardware/audio/effect/State.aidl
+++ b/audio/aidl/android/hardware/audio/effect/State.aidl
@@ -24,6 +24,8 @@
  * it should transfer to IDLE state after handle the command successfully. Effect instance should
  * consume minimal resource and transfer to INIT state after it was close().
  *
+ * An effect instance can be destroyed from any state using `IFactory.destroyEffect()`.
+ *
  * Refer to the state machine diagram `state.gv` for a detailed state diagram.
  */
 @VintfStability
@@ -66,6 +68,7 @@
      * - Transitions to **INIT** on `IEffect.close()`.
      * - Remains in **IDLE** on `IEffect.getParameter()`, `IEffect.setParameter()`,
      *   `IEffect.getDescriptor()`, `IEffect.command(CommandId.RESET)`, and `IEffect.reopen()`.
+     * - Transitions to the final state on `IFactory.destroyEffect()`.
      */
     IDLE,
 
@@ -98,6 +101,7 @@
      *   stop processing with `CommandId.STOP` before closing.
      * - If `IEffect.close()` is called in this state, the effect instance should stop processing,
      *   transition to **IDLE**, and then close.
+     * - Transitions to the final state on `IFactory.destroyEffect()`.
      */
     PROCESSING,
 
@@ -123,6 +127,7 @@
      * - If not implemented, the effect instance may transition directly from **PROCESSING** to
      *   **IDLE** without this intermediate state.
      * - Any `CommandId.STOP` commands received during **DRAINING** should be ignored.
+     * - Transitions to the final state on `IFactory.destroyEffect()`.
      */
     DRAINING,
 }
diff --git a/audio/aidl/android/hardware/audio/effect/state.gv b/audio/aidl/android/hardware/audio/effect/state.gv
index 2a8194e..8590296 100644
--- a/audio/aidl/android/hardware/audio/effect/state.gv
+++ b/audio/aidl/android/hardware/audio/effect/state.gv
@@ -13,8 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-// To render: "dot -Tpng state.gv -o state.png"
 
+// To render: "dot -Tpng state.gv -o state.png"
 digraph effect_state_machine {
 
     rankdir=LR; // Left to Right layout
@@ -29,40 +29,30 @@
     I [shape=point, fillcolor=black, width=0.2];
 
     // Final state node
-    F [shape=doublecircle, fillcolor=white, width=0.2];
+    F [shape=doublecircle, label="Destroyed"];
 
     // Define other nodes with colors
-    INIT [shape=ellipse, fillcolor=lightgreen];
-    IDLE [shape=ellipse, fillcolor=lightblue];
-    PROCESSING [shape=ellipse, fillcolor=lightyellow];
-    DRAINING [shape=ellipse, fillcolor=lightgrey];
+    INIT [shape=ellipse, fillcolor=lightgreen, label="INIT"];
+    IDLE [shape=ellipse, fillcolor=lightblue, label="IDLE"];
+    PROCESSING [shape=ellipse, fillcolor=lightyellow, label="PROCESSING"];
+    DRAINING [shape=ellipse, fillcolor=lightgrey, label="DRAINING"];
+    ANY_STATE [shape=ellipse, style=dashed, label="Any State", fillcolor=white];
 
-    // Transitions
+    // Main transitions
     I -> INIT [label="IFactory.createEffect", fontcolor="navy"];
-
-    INIT -> F [label="IFactory.destroyEffect"];
-
     INIT -> IDLE [label="IEffect.open()", fontcolor="lime"];
-
     IDLE -> PROCESSING [label="IEffect.command(START)"];
-
-    PROCESSING -> IDLE [label="IEffect.command(STOP)\nIEffect.command(RESET)"];
-
-    PROCESSING -> DRAINING [label="IEffect.command(STOP)", fontcolor="orange"];
-
-    DRAINING -> IDLE [label="Draining complete\n(IEffect.command(RESET)\nautomatic)"];
-
-    DRAINING -> PROCESSING [label="IEffect.command(START)\n(Interrupt draining)"];
-
+    PROCESSING -> IDLE [label="IEffect.command(STOP) (if draining not required)\nIEffect.command(RESET)"];
+    PROCESSING -> DRAINING [label="IEffect.command(STOP) (if draining required)", fontcolor="orange"];
+    DRAINING -> IDLE [label="IEffect.command(RESET)\nDraining complete (automatic transition)"];
+    DRAINING -> PROCESSING [label="IEffect.command(START) (Interrupt draining)"];
     IDLE -> INIT [label="IEffect.close()"];
 
-    // Self-loops
-    INIT -> INIT [label="IEffect.getState\nIEffect.getDescriptor"];
-
-    IDLE -> IDLE [label="IEffect.getParameter\nIEffect.setParameter\nIEffect.getDescriptor\nIEffect.command(RESET)\nIEffect.reopen"];
-
-    PROCESSING -> PROCESSING [label="IEffect.getParameter\nIEffect.setParameter\nIEffect.getDescriptor\nIEffect.reopen"];
-
-    DRAINING -> DRAINING [label="IEffect.getParameter\nIEffect.setParameter\nIEffect.getDescriptor\nIEffect.reopen\nFading"];
-
+    // Global transitions
+    subgraph cluster_global_transitions {
+        label="Global Transitions (Any State)";
+        style=dashed;
+        ANY_STATE -> F [label="IFactory.destroyEffect", style="bold"];
+        ANY_STATE -> ANY_STATE [label="IEffect.getParameter\nIEffect.setParameter\nIEffect.getDescriptor\nIEffect.getState\nIEffect.reopen", fontsize=10];
+    }
 }
diff --git a/audio/aidl/default/EffectImpl.cpp b/audio/aidl/default/EffectImpl.cpp
index 7857f53..97f7286 100644
--- a/audio/aidl/default/EffectImpl.cpp
+++ b/audio/aidl/default/EffectImpl.cpp
@@ -22,7 +22,10 @@
 #include "effect-impl/EffectTypes.h"
 #include "include/effect-impl/EffectTypes.h"
 
+using aidl::android::hardware::audio::effect::CommandId;
+using aidl::android::hardware::audio::effect::Descriptor;
 using aidl::android::hardware::audio::effect::IEffect;
+using aidl::android::hardware::audio::effect::kDestroyAnyStateSupportedVersion;
 using aidl::android::hardware::audio::effect::kEventFlagDataMqNotEmpty;
 using aidl::android::hardware::audio::effect::kEventFlagNotEmpty;
 using aidl::android::hardware::audio::effect::kReopenSupportedVersion;
@@ -31,13 +34,45 @@
 using ::android::hardware::EventFlag;
 
 extern "C" binder_exception_t destroyEffect(const std::shared_ptr<IEffect>& instanceSp) {
-    State state;
-    ndk::ScopedAStatus status = instanceSp->getState(&state);
-    if (!status.isOk() || State::INIT != state) {
+    if (!instanceSp) {
+        LOG(ERROR) << __func__ << " nullptr";
+        return EX_ILLEGAL_ARGUMENT;
+    }
+
+    Descriptor desc;
+    ndk::ScopedAStatus status = instanceSp->getDescriptor(&desc);
+    if (!status.isOk()) {
         LOG(ERROR) << __func__ << " instance " << instanceSp.get()
+                   << " failed to get descriptor, status: " << status.getDescription();
+        return EX_ILLEGAL_STATE;
+    }
+
+    State state;
+    status = instanceSp->getState(&state);
+    if (!status.isOk()) {
+        LOG(ERROR) << __func__ << " " << desc.common.name << " instance " << instanceSp.get()
                    << " in state: " << toString(state) << ", status: " << status.getDescription();
         return EX_ILLEGAL_STATE;
     }
+
+    int effectVersion = 0;
+    if (!instanceSp->getInterfaceVersion(&effectVersion).isOk()) {
+        LOG(WARNING) << __func__ << " " << desc.common.name << " failed to get interface version";
+    }
+
+    if (effectVersion < kDestroyAnyStateSupportedVersion) {
+        if (State::INIT != state) {
+            LOG(ERROR) << __func__ << " " << desc.common.name << " can not destroy instance "
+                       << instanceSp.get() << " in state: " << toString(state);
+            return EX_ILLEGAL_STATE;
+        }
+    } else {
+        instanceSp->command(CommandId::RESET);
+        instanceSp->close();
+    }
+
+    LOG(DEBUG) << __func__ << " " << desc.common.name << " instance " << instanceSp.get()
+               << " destroyed";
     return EX_NONE;
 }
 
diff --git a/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp b/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
index d23bdc9..5b78981 100644
--- a/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
@@ -42,6 +42,7 @@
 using aidl::android::hardware::audio::effect::Flags;
 using aidl::android::hardware::audio::effect::IEffect;
 using aidl::android::hardware::audio::effect::IFactory;
+using aidl::android::hardware::audio::effect::kDestroyAnyStateSupportedVersion;
 using aidl::android::hardware::audio::effect::Parameter;
 using aidl::android::hardware::audio::effect::State;
 using aidl::android::media::audio::common::AudioDeviceDescription;
@@ -316,28 +317,39 @@
     ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
 }
 
-// Expect EX_ILLEGAL_STATE if the effect instance is not in a proper state to be destroyed.
+// Expect EX_ILLEGAL_STATE if the effect instance is not in a proper state to be destroyed before
+// `kDestroyAnyStateSupportedVersion`.
+// For any version after `kDestroyAnyStateSupportedVersion`, expect `destroy` to always success.
 TEST_P(AudioEffectTest, DestroyOpenEffects) {
     ASSERT_NO_FATAL_FAILURE(create(mFactory, mEffect, mDescriptor));
     ASSERT_NO_FATAL_FAILURE(open(mEffect));
-    ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect, EX_ILLEGAL_STATE));
-
-    // cleanup
-    ASSERT_NO_FATAL_FAILURE(close(mEffect));
-    ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    if (mVersion < kDestroyAnyStateSupportedVersion) {
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect, EX_ILLEGAL_STATE));
+        // cleanup
+        ASSERT_NO_FATAL_FAILURE(close(mEffect));
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    } else {
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    }
 }
 
-// Expect EX_ILLEGAL_STATE if the effect instance is not in a proper state to be destroyed.
+// Expect EX_ILLEGAL_STATE if the effect instance is not in a proper state to be destroyed before
+// `kDestroyAnyStateSupportedVersion`.
+// For any version after `kDestroyAnyStateSupportedVersion`, expect `destroy` to always success.
 TEST_P(AudioEffectTest, DestroyProcessingEffects) {
     ASSERT_NO_FATAL_FAILURE(create(mFactory, mEffect, mDescriptor));
     ASSERT_NO_FATAL_FAILURE(open(mEffect));
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
-    ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect, EX_ILLEGAL_STATE));
 
-    // cleanup
-    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
-    ASSERT_NO_FATAL_FAILURE(close(mEffect));
-    ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    if (mVersion < kDestroyAnyStateSupportedVersion) {
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect, EX_ILLEGAL_STATE));
+        // cleanup
+        ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
+        ASSERT_NO_FATAL_FAILURE(close(mEffect));
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    } else {
+        ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
+    }
 }
 
 TEST_P(AudioEffectTest, NormalSequenceStates) {
diff --git a/automotive/vehicle/Android.bp b/automotive/vehicle/Android.bp
index 7c2d115..d549a82 100644
--- a/automotive/vehicle/Android.bp
+++ b/automotive/vehicle/Android.bp
@@ -29,7 +29,7 @@
 cc_defaults {
     name: "VehicleHalInterfaceDefaults",
     static_libs: [
-        "android.hardware.automotive.vehicle-V3-ndk",
+        "android.hardware.automotive.vehicle-V4-ndk",
         "android.hardware.automotive.vehicle.property-V4-ndk",
     ],
 }
@@ -45,7 +45,7 @@
 aidl_interface_defaults {
     name: "android.hardware.automotive.vehicle-latest-defaults",
     imports: [
-        "android.hardware.automotive.vehicle-V3",
+        "android.hardware.automotive.vehicle-V4",
         "android.hardware.automotive.vehicle.property-V4",
     ],
 }
diff --git a/automotive/vehicle/aidl/aidl_test/Android.bp b/automotive/vehicle/aidl/aidl_test/Android.bp
index 1e43070..8edd636 100644
--- a/automotive/vehicle/aidl/aidl_test/Android.bp
+++ b/automotive/vehicle/aidl/aidl_test/Android.bp
@@ -52,7 +52,7 @@
         ":IVehicleGeneratedJavaFiles-V4",
     ],
     static_libs: [
-        "android.hardware.automotive.vehicle-V3-java",
+        "android.hardware.automotive.vehicle-V4-java",
         "android.hardware.automotive.vehicle.property-V4-java",
         "androidx.test.runner",
         "truth",
diff --git a/automotive/vehicle/aidl/impl/current/vhal/include/DefaultVehicleHal.h b/automotive/vehicle/aidl/impl/current/vhal/include/DefaultVehicleHal.h
index 932a2e2..5d64e6f 100644
--- a/automotive/vehicle/aidl/impl/current/vhal/include/DefaultVehicleHal.h
+++ b/automotive/vehicle/aidl/impl/current/vhal/include/DefaultVehicleHal.h
@@ -70,6 +70,18 @@
                                    const std::vector<int32_t>& propIds) override;
     ndk::ScopedAStatus returnSharedMemory(const CallbackType& callback,
                                           int64_t sharedMemoryId) override;
+    ndk::ScopedAStatus getSupportedValuesLists(
+            const std::vector<aidlvhal::PropIdAreaId>& propIdAreaIds,
+            aidlvhal::SupportedValuesListResults* supportedValuesListResults) override;
+    ndk::ScopedAStatus getMinMaxSupportedValue(
+            const std::vector<aidlvhal::PropIdAreaId>& propIdAreaIds,
+            aidlvhal::MinMaxSupportedValueResults* minMaxSupportedValueResults) override;
+    ndk::ScopedAStatus registerSupportedValueChangeCallback(
+            const std::shared_ptr<aidlvhal::IVehicleCallback>& callback,
+            const std::vector<aidlvhal::PropIdAreaId>& propIdAreaIds) override;
+    ndk::ScopedAStatus unregisterSupportedValueChangeCallback(
+            const std::shared_ptr<aidlvhal::IVehicleCallback>& callback,
+            const std::vector<aidlvhal::PropIdAreaId>& propIdAreaIds) override;
     binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
 
     IVehicleHardware* getHardware();
diff --git a/automotive/vehicle/aidl/impl/current/vhal/src/DefaultVehicleHal.cpp b/automotive/vehicle/aidl/impl/current/vhal/src/DefaultVehicleHal.cpp
index aa9ef53..1e55a1a 100644
--- a/automotive/vehicle/aidl/impl/current/vhal/src/DefaultVehicleHal.cpp
+++ b/automotive/vehicle/aidl/impl/current/vhal/src/DefaultVehicleHal.cpp
@@ -49,12 +49,15 @@
 using ::aidl::android::hardware::automotive::vehicle::GetValueRequests;
 using ::aidl::android::hardware::automotive::vehicle::GetValueResult;
 using ::aidl::android::hardware::automotive::vehicle::GetValueResults;
+using ::aidl::android::hardware::automotive::vehicle::IVehicleCallback;
+using ::aidl::android::hardware::automotive::vehicle::MinMaxSupportedValueResults;
 using ::aidl::android::hardware::automotive::vehicle::SetValueRequest;
 using ::aidl::android::hardware::automotive::vehicle::SetValueRequests;
 using ::aidl::android::hardware::automotive::vehicle::SetValueResult;
 using ::aidl::android::hardware::automotive::vehicle::SetValueResults;
 using ::aidl::android::hardware::automotive::vehicle::StatusCode;
 using ::aidl::android::hardware::automotive::vehicle::SubscribeOptions;
+using ::aidl::android::hardware::automotive::vehicle::SupportedValuesListResults;
 using ::aidl::android::hardware::automotive::vehicle::VehicleAreaConfig;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropConfigs;
@@ -961,6 +964,34 @@
     return ScopedAStatus::ok();
 }
 
+ScopedAStatus DefaultVehicleHal::getSupportedValuesLists(
+        const std::vector<::aidl::android::hardware::automotive::vehicle::PropIdAreaId>&,
+        SupportedValuesListResults*) {
+    // TODO(b/381020465): Add relevant implementation.
+    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ScopedAStatus DefaultVehicleHal::getMinMaxSupportedValue(
+        const std::vector<::aidl::android::hardware::automotive::vehicle::PropIdAreaId>&,
+        MinMaxSupportedValueResults*) {
+    // TODO(b/381020465): Add relevant implementation.
+    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ScopedAStatus DefaultVehicleHal::registerSupportedValueChangeCallback(
+        const std::shared_ptr<IVehicleCallback>&,
+        const std::vector<::aidl::android::hardware::automotive::vehicle::PropIdAreaId>&) {
+    // TODO(b/381020465): Add relevant implementation.
+    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ScopedAStatus DefaultVehicleHal::unregisterSupportedValueChangeCallback(
+        const std::shared_ptr<IVehicleCallback>&,
+        const std::vector<::aidl::android::hardware::automotive::vehicle::PropIdAreaId>&) {
+    // TODO(b/381020465): Add relevant implementation.
+    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
 IVehicleHardware* DefaultVehicleHal::getHardware() {
     return mVehicleHardware.get();
 }
diff --git a/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.cpp b/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.cpp
index c272123..72c5dc5 100644
--- a/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.cpp
+++ b/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.cpp
@@ -27,6 +27,7 @@
 namespace {
 
 using ::aidl::android::hardware::automotive::vehicle::GetValueResults;
+using ::aidl::android::hardware::automotive::vehicle::PropIdAreaId;
 using ::aidl::android::hardware::automotive::vehicle::SetValueResults;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropErrors;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValues;
@@ -91,6 +92,11 @@
     return result;
 }
 
+ScopedAStatus MockVehicleCallback::onSupportedValueChange(const std::vector<PropIdAreaId>&) {
+    // TODO(b/381020465): Add relevant implementation.
+    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
 std::optional<GetValueResults> MockVehicleCallback::nextGetValueResults() {
     std::scoped_lock<std::mutex> lockGuard(mLock);
     return pop(mGetValueResults);
diff --git a/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.h b/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.h
index 672ff4f..81a85ff 100644
--- a/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.h
+++ b/automotive/vehicle/aidl/impl/current/vhal/test/MockVehicleCallback.h
@@ -55,6 +55,9 @@
             int32_t) override;
     ndk::ScopedAStatus onPropertySetError(
             const aidl::android::hardware::automotive::vehicle::VehiclePropErrors&) override;
+    ndk::ScopedAStatus onSupportedValueChange(
+            const std::vector<aidl::android::hardware::automotive::vehicle::PropIdAreaId>&)
+            override;
 
     // Test functions
     std::optional<aidl::android::hardware::automotive::vehicle::GetValueResults>
diff --git a/automotive/vehicle/aidl/impl/current/vhal/test/SubscriptionManagerTest.cpp b/automotive/vehicle/aidl/impl/current/vhal/test/SubscriptionManagerTest.cpp
index 440a9f9..5d58de5 100644
--- a/automotive/vehicle/aidl/impl/current/vhal/test/SubscriptionManagerTest.cpp
+++ b/automotive/vehicle/aidl/impl/current/vhal/test/SubscriptionManagerTest.cpp
@@ -70,6 +70,12 @@
         return ScopedAStatus::ok();
     }
 
+    ScopedAStatus onSupportedValueChange(
+            const std::vector<::aidl::android::hardware::automotive::vehicle::PropIdAreaId>&)
+            override {
+        return ScopedAStatus::ok();
+    }
+
     // Test functions.
     std::list<VehiclePropValue> getEvents() {
         std::scoped_lock<std::mutex> lockGuard(mLock);
diff --git a/automotive/vehicle/vhal_static_cpp_lib.mk b/automotive/vehicle/vhal_static_cpp_lib.mk
index 9371453..7ab34f4 100644
--- a/automotive/vehicle/vhal_static_cpp_lib.mk
+++ b/automotive/vehicle/vhal_static_cpp_lib.mk
@@ -16,5 +16,5 @@
 # interface and VHAL properties.
 
 LOCAL_STATIC_LIBRARIES += \
-    android.hardware.automotive.vehicle-V3-ndk \
+    android.hardware.automotive.vehicle-V4-ndk \
     android.hardware.automotive.vehicle.property-V4-ndk
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/BroadcastCapability.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/BroadcastCapability.aidl
index 58710ef..2872362 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/BroadcastCapability.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/BroadcastCapability.aidl
@@ -38,6 +38,7 @@
   android.hardware.bluetooth.audio.AudioLocation supportedChannel;
   int channelCountPerStream;
   android.hardware.bluetooth.audio.BroadcastCapability.LeAudioCodecCapabilities leAudioCodecCapabilities;
+  @nullable android.hardware.bluetooth.audio.CodecSpecificConfigurationLtv.AudioChannelAllocation audioLocation;
   @VintfStability
   parcelable VendorCapabilities {
     ParcelableHolder extension;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
index be79b0d..97fcd1f 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
@@ -92,6 +92,7 @@
     const int FRONT_RIGHT_WIDE = 0x02000000;
     const int LEFT_SURROUND = 0x04000000;
     const int RIGHT_SURROUND = 0x08000000;
+    const int MONO = 0x00000000;
   }
   parcelable OctetsPerCodecFrame {
     int value;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
index 481e2ac..6ed0e56 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -39,6 +39,7 @@
   int deviceCount;
   int channelCountPerDevice;
   android.hardware.bluetooth.audio.UnicastCapability.LeAudioCodecCapabilities leAudioCodecCapabilities;
+  @nullable android.hardware.bluetooth.audio.CodecSpecificConfigurationLtv.AudioChannelAllocation audioLocation;
   @VintfStability
   parcelable VendorCapabilities {
     ParcelableHolder extension;
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/BroadcastCapability.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/BroadcastCapability.aidl
index f1301fb..db3c10e 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/BroadcastCapability.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/BroadcastCapability.aidl
@@ -17,6 +17,7 @@
 package android.hardware.bluetooth.audio;
 
 import android.hardware.bluetooth.audio.AudioLocation;
+import android.hardware.bluetooth.audio.CodecSpecificConfigurationLtv.AudioChannelAllocation;
 import android.hardware.bluetooth.audio.CodecType;
 import android.hardware.bluetooth.audio.Lc3Capabilities;
 
@@ -35,8 +36,11 @@
         @nullable VendorCapabilities[] vendorCapabillities;
     }
     CodecType codecType;
+    // @deprecated use audioLocation if present.
     AudioLocation supportedChannel;
     // Supported channel count for each stream
     int channelCountPerStream;
     LeAudioCodecCapabilities leAudioCodecCapabilities;
+    // The new audio location type, replacing supportedChannel
+    @nullable AudioChannelAllocation audioLocation;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
index 5e32e5e..2835325 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
@@ -47,6 +47,7 @@
     }
 
     parcelable AudioChannelAllocation {
+        // @deprecated use MONO instead.
         const int NOT_ALLOWED = 0x00000000;
         const int FRONT_LEFT = 0x00000001;
         const int FRONT_RIGHT = 0x00000002;
@@ -76,6 +77,7 @@
         const int FRONT_RIGHT_WIDE = 0x02000000;
         const int LEFT_SURROUND = 0x04000000;
         const int RIGHT_SURROUND = 0x08000000;
+        const int MONO = 0x00000000;
 
         // Bit mask of Audio Locations
         int bitmask;
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
index 8583221..9f33672 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -18,6 +18,7 @@
 
 import android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities;
 import android.hardware.bluetooth.audio.AudioLocation;
+import android.hardware.bluetooth.audio.CodecSpecificConfigurationLtv.AudioChannelAllocation;
 import android.hardware.bluetooth.audio.CodecType;
 import android.hardware.bluetooth.audio.Lc3Capabilities;
 import android.hardware.bluetooth.audio.OpusCapabilities;
@@ -39,10 +40,13 @@
         OpusCapabilities opusCapabilities;
     }
     CodecType codecType;
+    // @deprecated use audioLocation if present.
     AudioLocation supportedChannel;
     // The number of connected device
     int deviceCount;
     // Supported channel count for each device
     int channelCountPerDevice;
     LeAudioCodecCapabilities leAudioCodecCapabilities;
+    // The new audio location type, replacing supportedChannel
+    @nullable AudioChannelAllocation audioLocation;
 }
diff --git a/bluetooth/audio/utils/Android.bp b/bluetooth/audio/utils/Android.bp
index d931c4d..d4968a8 100644
--- a/bluetooth/audio/utils/Android.bp
+++ b/bluetooth/audio/utils/Android.bp
@@ -90,13 +90,15 @@
 
 cc_test {
     name: "BluetoothLeAudioCodecsProviderTest",
-    defaults: [
-        "latest_android_hardware_bluetooth_audio_ndk_shared",
-    ],
     srcs: [
         "aidl_session/BluetoothLeAudioCodecsProvider.cpp",
         "aidl_session/BluetoothLeAudioCodecsProviderTest.cpp",
     ],
+    defaults: [
+        "latest_android_hardware_audio_common_ndk_static",
+        "latest_android_hardware_bluetooth_audio_ndk_static",
+        "latest_android_media_audio_common_types_ndk_static",
+    ],
     header_libs: [
         "libxsdc-utils",
     ],
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
index 8475d39..07e4997 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
@@ -95,7 +95,7 @@
 constexpr uint8_t kLeAudioCodecFrameDur20000us = 0x02;
 
 /* Audio Allocations */
-constexpr uint32_t kLeAudioLocationNotAllowed = 0x00000000;
+constexpr uint32_t kLeAudioLocationMonoAudio = 0x00000000;
 constexpr uint32_t kLeAudioLocationFrontLeft = 0x00000001;
 constexpr uint32_t kLeAudioLocationFrontRight = 0x00000002;
 constexpr uint32_t kLeAudioLocationFrontCenter = 0x00000004;
@@ -178,8 +178,8 @@
 
 /* Helper map for matching various audio channel allocation notations */
 std::map<uint32_t, uint32_t> audio_channel_allocation_map = {
-    {kLeAudioLocationNotAllowed,
-     CodecSpecificConfigurationLtv::AudioChannelAllocation::NOT_ALLOWED},
+    {kLeAudioLocationMonoAudio,
+     CodecSpecificConfigurationLtv::AudioChannelAllocation::MONO},
     {kLeAudioLocationFrontLeft,
      CodecSpecificConfigurationLtv::AudioChannelAllocation::FRONT_LEFT},
     {kLeAudioLocationFrontRight,
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
index 473777c..59c43a4 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
@@ -119,19 +119,36 @@
     // Mapping octetsPerCodecFrame to bitdepth for easier comparison.
     transport.bitdepth.push_back(codec_config.getOctetsPerCodecFrame());
     transport.frameDurationUs.push_back(codec_config.getFrameDurationUs());
-    switch (strategy_config.getAudioLocation()) {
-      case setting::AudioLocation::MONO:
+    if (strategy_config.hasAudioLocation()) {
+      switch (strategy_config.getAudioLocation()) {
+        case setting::AudioLocation::MONO:
+          if (strategy_config_channel_count == 1)
+            transport.channelMode.push_back(ChannelMode::MONO);
+          else
+            transport.channelMode.push_back(ChannelMode::DUALMONO);
+          break;
+        case setting::AudioLocation::STEREO:
+          transport.channelMode.push_back(ChannelMode::STEREO);
+          break;
+        default:
+          transport.channelMode.push_back(ChannelMode::UNKNOWN);
+          break;
+      }
+    } else if (strategy_config.hasAudioChannelAllocation()) {
+      auto count =
+          std::bitset<32>(strategy_config.getAudioChannelAllocation()).count();
+      if (count <= 1) {
         if (strategy_config_channel_count == 1)
           transport.channelMode.push_back(ChannelMode::MONO);
         else
           transport.channelMode.push_back(ChannelMode::DUALMONO);
-        break;
-      case setting::AudioLocation::STEREO:
+      } else if (count == 2) {
         transport.channelMode.push_back(ChannelMode::STEREO);
-        break;
-      default:
+      } else {
         transport.channelMode.push_back(ChannelMode::UNKNOWN);
-        break;
+      }
+    } else {
+      transport.channelMode.push_back(ChannelMode::UNKNOWN);
     }
   }
 
@@ -336,8 +353,12 @@
   for (const auto& scenario : supported_scenarios) {
     UnicastCapability unicast_encode_capability =
         GetUnicastCapability(scenario.getEncode());
+    LOG(INFO) << __func__ << ": Unicast capability encode = "
+              << unicast_encode_capability.toString();
     UnicastCapability unicast_decode_capability =
         GetUnicastCapability(scenario.getDecode());
+    LOG(INFO) << __func__ << ": Unicast capability decode = "
+              << unicast_decode_capability.toString();
     BroadcastCapability broadcast_capability = {.codecType =
                                                     CodecType::UNKNOWN};
 
@@ -384,22 +405,36 @@
     return {.codecType = CodecType::UNKNOWN};
   }
 
+  // Populate audio location
+  AudioLocation audio_location = AudioLocation::UNKNOWN;
+  if (strategy_configuration_iter->second.hasAudioLocation()) {
+    audio_location = GetAudioLocation(
+        strategy_configuration_iter->second.getAudioLocation());
+  }
+
+  // Populate audio channel allocation
+  std::optional<CodecSpecificConfigurationLtv::AudioChannelAllocation>
+      audio_channel_allocation = std::nullopt;
+  if (strategy_configuration_iter->second.hasAudioChannelAllocation()) {
+    LOG(INFO) << __func__ << ": has allocation";
+    CodecSpecificConfigurationLtv::AudioChannelAllocation tmp;
+    tmp.bitmask =
+        strategy_configuration_iter->second.getAudioChannelAllocation();
+    audio_channel_allocation = tmp;
+  }
+
   CodecType codec_type =
       GetCodecType(codec_configuration_iter->second.getCodec());
   if (codec_type == CodecType::LC3) {
     return ComposeUnicastCapability(
-        codec_type,
-        GetAudioLocation(
-            strategy_configuration_iter->second.getAudioLocation()),
+        codec_type, audio_location, audio_channel_allocation,
         strategy_configuration_iter->second.getConnectedDevice(),
         strategy_configuration_iter->second.getChannelCount(),
         ComposeLc3Capability(codec_configuration_iter->second));
   } else if (codec_type == CodecType::APTX_ADAPTIVE_LE ||
              codec_type == CodecType::APTX_ADAPTIVE_LEX) {
     return ComposeUnicastCapability(
-        codec_type,
-        GetAudioLocation(
-            strategy_configuration_iter->second.getAudioLocation()),
+        codec_type, audio_location, audio_channel_allocation,
         strategy_configuration_iter->second.getConnectedDevice(),
         strategy_configuration_iter->second.getChannelCount(),
         ComposeAptxAdaptiveLeCapability(codec_configuration_iter->second));
@@ -435,11 +470,27 @@
   std::vector<std::optional<Lc3Capabilities>> bcastLc3Cap(
       1, std::optional(ComposeLc3Capability(codec_configuration_iter->second)));
 
+  // Populate audio location
+  AudioLocation audio_location = AudioLocation::UNKNOWN;
+  if (strategy_configuration_iter->second.hasAudioLocation()) {
+    audio_location = GetAudioLocation(
+        strategy_configuration_iter->second.getAudioLocation());
+  }
+
+  // Populate audio channel allocation
+  std::optional<CodecSpecificConfigurationLtv::AudioChannelAllocation>
+      audio_channel_allocation = std::nullopt;
+  if (strategy_configuration_iter->second.hasAudioChannelAllocation()) {
+    LOG(INFO) << __func__ << ": has allocation";
+    CodecSpecificConfigurationLtv::AudioChannelAllocation tmp;
+    tmp.bitmask =
+        strategy_configuration_iter->second.getAudioChannelAllocation();
+    audio_channel_allocation = tmp;
+  }
+
   if (codec_type == CodecType::LC3) {
     return ComposeBroadcastCapability(
-        codec_type,
-        GetAudioLocation(
-            strategy_configuration_iter->second.getAudioLocation()),
+        codec_type, audio_location, audio_channel_allocation,
         strategy_configuration_iter->second.getChannelCount(), bcastLc3Cap);
   }
   return {.codecType = CodecType::UNKNOWN};
@@ -448,16 +499,21 @@
 template <class T>
 BroadcastCapability BluetoothLeAudioCodecsProvider::ComposeBroadcastCapability(
     const CodecType& codec_type, const AudioLocation& audio_location,
+    const std::optional<CodecSpecificConfigurationLtv::AudioChannelAllocation>&
+        audio_channel_allocation,
     const uint8_t& channel_count, const std::vector<T>& capability) {
   return {.codecType = codec_type,
           .supportedChannel = audio_location,
           .channelCountPerStream = channel_count,
-          .leAudioCodecCapabilities = std::optional(capability)};
+          .leAudioCodecCapabilities = std::optional(capability),
+          .audioLocation = audio_channel_allocation};
 }
 
 template <class T>
 UnicastCapability BluetoothLeAudioCodecsProvider::ComposeUnicastCapability(
     const CodecType& codec_type, const AudioLocation& audio_location,
+    const std::optional<CodecSpecificConfigurationLtv::AudioChannelAllocation>&
+        audio_channel_allocation,
     const uint8_t& device_cnt, const uint8_t& channel_count,
     const T& capability) {
   return {
@@ -467,6 +523,7 @@
       .channelCountPerDevice = channel_count,
       .leAudioCodecCapabilities =
           UnicastCapability::LeAudioCodecCapabilities(capability),
+      .audioLocation = audio_channel_allocation,
   };
 }
 
@@ -519,38 +576,87 @@
          codec_configuration.hasOctetsPerCodecFrame();
 }
 
+bool IsValidStereoAudioLocation(
+    const setting::StrategyConfiguration& strategy_configuration) {
+  if ((strategy_configuration.getConnectedDevice() == 2 &&
+       strategy_configuration.getChannelCount() == 1) ||
+      (strategy_configuration.getConnectedDevice() == 1 &&
+       strategy_configuration.getChannelCount() == 2)) {
+    // Stereo
+    // 1. two connected device, one for L one for R
+    // 2. one connected device for both L and R
+    return true;
+  } else if (strategy_configuration.getConnectedDevice() == 0 &&
+             strategy_configuration.getChannelCount() == 2) {
+    // Broadcast
+    return true;
+  }
+  return false;
+}
+
+bool IsValidMonoAudioLocation(
+    const setting::StrategyConfiguration& strategy_configuration) {
+  if (strategy_configuration.getConnectedDevice() == 1 &&
+      strategy_configuration.getChannelCount() == 1) {
+    return true;
+  }
+  return false;
+}
+
+bool IsValidAudioLocation(
+    const setting::StrategyConfiguration& strategy_configuration) {
+  if (strategy_configuration.getAudioLocation() ==
+      setting::AudioLocation::STEREO)
+    return IsValidStereoAudioLocation(strategy_configuration);
+  else if (strategy_configuration.getAudioLocation() ==
+           setting::AudioLocation::MONO)
+    return IsValidMonoAudioLocation(strategy_configuration);
+  return false;
+}
+
+bool IsValidAudioChannelAllocation(
+    const setting::StrategyConfiguration& strategy_configuration) {
+  // First, ensure that there's only 2 bitmask enabled
+  int audio_channel_allocation =
+      strategy_configuration.getAudioChannelAllocation();
+  int count = 0;
+  for (int bit = 0; bit < 32; ++bit)
+    if (audio_channel_allocation & (1 << bit)) ++count;
+  if (count > 2) {
+    LOG(WARNING) << "Cannot parse more than 2 audio location, input is "
+                 << audio_channel_allocation;
+    return false;
+  }
+
+  if (count == 2)
+    return IsValidStereoAudioLocation(strategy_configuration);
+  else
+    return IsValidMonoAudioLocation(strategy_configuration);
+}
+
 bool BluetoothLeAudioCodecsProvider::IsValidStrategyConfiguration(
     const setting::StrategyConfiguration& strategy_configuration) {
   if (!strategy_configuration.hasName() ||
-      !strategy_configuration.hasAudioLocation() ||
       !strategy_configuration.hasConnectedDevice() ||
       !strategy_configuration.hasChannelCount()) {
     return false;
   }
-  if (strategy_configuration.getAudioLocation() ==
-      setting::AudioLocation::STEREO) {
-    if ((strategy_configuration.getConnectedDevice() == 2 &&
-         strategy_configuration.getChannelCount() == 1) ||
-        (strategy_configuration.getConnectedDevice() == 1 &&
-         strategy_configuration.getChannelCount() == 2)) {
-      // Stereo
-      // 1. two connected device, one for L one for R
-      // 2. one connected device for both L and R
-      return true;
-    } else if (strategy_configuration.getConnectedDevice() == 0 &&
-               strategy_configuration.getChannelCount() == 2) {
-      // Broadcast
-      return true;
-    }
-  } else if (strategy_configuration.getAudioLocation() ==
-             setting::AudioLocation::MONO) {
-    if (strategy_configuration.getConnectedDevice() == 1 &&
-        strategy_configuration.getChannelCount() == 1) {
-      // Mono
-      return true;
-    }
-  }
-  return false;
+
+  // Both audio location field cannot be empty
+  if (!strategy_configuration.hasAudioLocation() &&
+      !strategy_configuration.hasAudioChannelAllocation())
+    return false;
+
+  // Any audio location field that presents must be valid
+  if (strategy_configuration.hasAudioLocation() &&
+      !IsValidAudioLocation(strategy_configuration))
+    return false;
+
+  if (strategy_configuration.hasAudioChannelAllocation() &&
+      !IsValidAudioChannelAllocation(strategy_configuration))
+    return false;
+
+  return true;
 }
 
 }  // namespace audio
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
index 5bf67e2..23b2bb6 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
@@ -23,6 +23,7 @@
 #include <vector>
 
 #include "aidl/android/hardware/bluetooth/audio/CodecInfo.h"
+#include "aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.h"
 #include "aidl/android/hardware/bluetooth/audio/SessionType.h"
 #include "aidl_android_hardware_bluetooth_audio_setting.h"
 
@@ -84,12 +85,18 @@
   template <class T>
   static inline UnicastCapability ComposeUnicastCapability(
       const CodecType& codec_type, const AudioLocation& audio_location,
+      const std::optional<
+          CodecSpecificConfigurationLtv::AudioChannelAllocation>&
+          audio_channel_allocation,
       const uint8_t& device_cnt, const uint8_t& channel_count,
       const T& capability);
 
   template <class T>
   static inline BroadcastCapability ComposeBroadcastCapability(
       const CodecType& codec_type, const AudioLocation& audio_location,
+      const std::optional<
+          CodecSpecificConfigurationLtv::AudioChannelAllocation>&
+          audio_channel_allocation,
       const uint8_t& channel_count, const std::vector<T>& capability);
 
   static inline Lc3Capabilities ComposeLc3Capability(
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
index dba2749..c47f7d5 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
@@ -64,19 +64,101 @@
 static const StrategyConfiguration kValidStrategyStereoOneCis(
     std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
     std::make_optional(AudioLocation::STEREO), std::make_optional(2),
-    std::make_optional(1));
+    std::make_optional(1), std::nullopt);
 static const StrategyConfiguration kValidStrategyStereoTwoCis(
     std::make_optional("STEREO_TWO_CISES_PER_DEVICE"),
     std::make_optional(AudioLocation::STEREO), std::make_optional(1),
-    std::make_optional(2));
+    std::make_optional(2), std::nullopt);
 static const StrategyConfiguration kValidStrategyMonoOneCis(
     std::make_optional("MONO_ONE_CIS_PER_DEVICE"),
     std::make_optional(AudioLocation::MONO), std::make_optional(1),
-    std::make_optional(1));
+    std::make_optional(1), std::nullopt);
 static const StrategyConfiguration kValidStrategyBroadcastStereo(
     std::make_optional("BROADCAST_STEREO"),
     std::make_optional(AudioLocation::STEREO), std::make_optional(0),
-    std::make_optional(2));
+    std::make_optional(2), std::nullopt);
+
+static const StrategyConfiguration kValidStrategyStereoOneCisInt(
+    std::make_optional("STEREO_ONE_CIS_PER_DEVICE"), std::nullopt,
+    std::make_optional(2), std::make_optional(1), std::make_optional(3));
+static const StrategyConfiguration kValidStrategyStereoTwoCisInt(
+    std::make_optional("STEREO_TWO_CISES_PER_DEVICE"), std::nullopt,
+    std::make_optional(1), std::make_optional(2), std::make_optional(3));
+static const StrategyConfiguration kValidStrategyMonoOneCisInt(
+    std::make_optional("MONO_ONE_CIS_PER_DEVICE"), std::nullopt,
+    std::make_optional(1), std::make_optional(1), std::make_optional(4));
+static const StrategyConfiguration kValidStrategyBroadcastStereoInt(
+    std::make_optional("BROADCAST_STEREO"), std::nullopt, std::make_optional(0),
+    std::make_optional(2), std::make_optional(3));
+
+static const StrategyConfiguration kValidStrategyStereoOneCisBoth(
+    std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+    std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+    std::make_optional(1), std::make_optional(3));
+static const StrategyConfiguration kValidStrategyStereoTwoCisBoth(
+    std::make_optional("STEREO_TWO_CISES_PER_DEVICE"),
+    std::make_optional(AudioLocation::STEREO), std::make_optional(1),
+    std::make_optional(2), std::make_optional(3));
+static const StrategyConfiguration kValidStrategyMonoOneCisBoth(
+    std::make_optional("MONO_ONE_CIS_PER_DEVICE"),
+    std::make_optional(AudioLocation::MONO), std::make_optional(1),
+    std::make_optional(1), std::make_optional(4));
+static const StrategyConfiguration kValidStrategyBroadcastStereoBoth(
+    std::make_optional("BROADCAST_STEREO"),
+    std::make_optional(AudioLocation::STEREO), std::make_optional(0),
+    std::make_optional(2), std::make_optional(3));
+
+// List of all invalid strategy configuration
+const auto kInvalidStrategyStereoTwoCisTwoDevice = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+        std::make_optional(2), std::nullopt)});
+const auto kInvalidStrategyMonoTwoCisTwoDevice = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("MONO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+        std::make_optional(2), std::nullopt)});
+const auto kInvalidStrategyNoName = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::nullopt, std::make_optional(AudioLocation::STEREO),
+        std::make_optional(2), std::make_optional(1), std::nullopt)});
+const auto kInvalidStrategyNoLocation = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"), std::nullopt,
+        std::make_optional(2), std::make_optional(1), std::nullopt)});
+const auto kInvalidStrategyNoDevice = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::nullopt,
+        std::make_optional(1), std::nullopt)});
+const auto kInvalidStrategyNoChannel = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+        std::nullopt, std::nullopt)});
+const auto kInvalidStrategyIntMoreBitmask = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+        std::make_optional(1), std::make_optional(7))});
+const auto kInvalidStrategyIntStereoTwoCisTwoDevice = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"), std::nullopt,
+        std::make_optional(2), std::make_optional(2), std::make_optional(3))});
+const auto kInvalidStrategyIntMonoTwoCisTwoDevice = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("MONO_ONE_CIS_PER_DEVICE"), std::nullopt,
+        std::make_optional(2), std::make_optional(2), std::make_optional(4))});
+const auto kInvalidStrategyIntBroadcast = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("MONO_ONE_CIS_PER_DEVICE"), std::nullopt,
+        std::make_optional(0), std::make_optional(1), std::make_optional(3))});
+const auto kInvalidStrategyBothStereoMonoInt = StrategyConfigurationList(
+    std::vector<StrategyConfiguration>{StrategyConfiguration(
+        std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
+        std::make_optional(AudioLocation::STEREO), std::make_optional(2),
+        std::make_optional(1), std::make_optional(4))});
 
 // Define valid test list built from above valid components
 // Scenario, Configuration, CodecConfiguration, StrategyConfiguration
@@ -88,11 +170,16 @@
 static const std::vector<CodecConfigurationList> kValidCodecConfigurationList =
     {CodecConfigurationList(
         std::vector<CodecConfiguration>{kValidCodecLC3_16k_1})};
+
 static const std::vector<StrategyConfigurationList>
     kValidStrategyConfigurationList = {
         StrategyConfigurationList(std::vector<StrategyConfiguration>{
             kValidStrategyStereoOneCis, kValidStrategyStereoTwoCis,
-            kValidStrategyMonoOneCis, kValidStrategyBroadcastStereo})};
+            kValidStrategyMonoOneCis, kValidStrategyBroadcastStereo,
+            kValidStrategyStereoOneCisInt, kValidStrategyStereoTwoCisInt,
+            kValidStrategyMonoOneCisInt, kValidStrategyBroadcastStereoInt,
+            kValidStrategyStereoOneCisBoth, kValidStrategyStereoTwoCisBoth,
+            kValidStrategyMonoOneCisBoth, kValidStrategyBroadcastStereoBoth})};
 
 class BluetoothLeAudioCodecsProviderTest
     : public ::testing::TestWithParam<OffloadSetting> {
@@ -270,49 +357,19 @@
   static std::vector<StrategyConfigurationList>
   CreateInvalidStrategyConfigurations() {
     std::vector<StrategyConfigurationList>
-        invalid_strategy_configuration_test_cases;
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
-                std::make_optional(AudioLocation::STEREO),
-                std::make_optional(2), std::make_optional(2))}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::make_optional("MONO_ONE_CIS_PER_DEVICE"),
-                std::make_optional(AudioLocation::STEREO),
-                std::make_optional(2), std::make_optional(2))}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::nullopt, std::make_optional(AudioLocation::STEREO),
-                std::make_optional(2), std::make_optional(1))}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::make_optional("STEREO_ONE_CIS_PER_DEVICE"), std::nullopt,
-                std::make_optional(2), std::make_optional(1))}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
-                std::make_optional(AudioLocation::STEREO), std::nullopt,
-                std::make_optional(1))}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(
-            std::vector<StrategyConfiguration>{StrategyConfiguration(
-                std::make_optional("STEREO_ONE_CIS_PER_DEVICE"),
-                std::make_optional(AudioLocation::STEREO),
-                std::make_optional(2), std::nullopt)}));
-
-    invalid_strategy_configuration_test_cases.push_back(
-        StrategyConfigurationList(std::vector<StrategyConfiguration>{}));
+        invalid_strategy_configuration_test_cases = {
+            kInvalidStrategyStereoTwoCisTwoDevice,
+            kInvalidStrategyMonoTwoCisTwoDevice,
+            kInvalidStrategyNoName,
+            kInvalidStrategyNoLocation,
+            kInvalidStrategyNoDevice,
+            kInvalidStrategyNoChannel,
+            kInvalidStrategyIntMoreBitmask,
+            kInvalidStrategyIntStereoTwoCisTwoDevice,
+            kInvalidStrategyIntMonoTwoCisTwoDevice,
+            kInvalidStrategyIntBroadcast,
+            kInvalidStrategyBothStereoMonoInt,
+            StrategyConfigurationList(std::vector<StrategyConfiguration>{})};
 
     return invalid_strategy_configuration_test_cases;
   }
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
index eaace78..b6ebbd9 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
@@ -69,9 +69,9 @@
     <codecConfiguration name="APTX_ADAPTIVE_LEX_96k" codec="APTX_ADAPTIVE_LEX" samplingFrequency="96000" frameDurationUs="10000" octetsPerCodecFrame="816"/>
   </codecConfigurationList>
   <strategyConfigurationList>
-    <strategyConfiguration name="STEREO_ONE_CIS_PER_DEVICE" audioLocation="STEREO" connectedDevice="2" channelCount="1"/>
-    <strategyConfiguration name="STEREO_TWO_CISES_PER_DEVICE" audioLocation="STEREO" connectedDevice="1" channelCount="2"/>
-    <strategyConfiguration name="MONO_ONE_CIS_PER_DEVICE" audioLocation="MONO" connectedDevice="1" channelCount="1"/>
-    <strategyConfiguration name="BROADCAST_STEREO" audioLocation="STEREO" connectedDevice="0" channelCount="2"/>
+    <strategyConfiguration name="STEREO_ONE_CIS_PER_DEVICE" audioLocation="STEREO" connectedDevice="2" channelCount="1" audioChannelAllocation="3"/>
+    <strategyConfiguration name="STEREO_TWO_CISES_PER_DEVICE" audioLocation="STEREO" connectedDevice="1" channelCount="2" audioChannelAllocation="3"/>
+    <strategyConfiguration name="MONO_ONE_CIS_PER_DEVICE" audioLocation="MONO" connectedDevice="1" channelCount="1" audioChannelAllocation="4"/>
+    <strategyConfiguration name="BROADCAST_STEREO" audioLocation="STEREO" connectedDevice="0" channelCount="2" audioChannelAllocation="3"/>
   </strategyConfigurationList>
 </leAudioOffloadSetting>
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
index 03c8ade..d9ccab5 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
@@ -56,9 +56,12 @@
   <xs:element name="strategyConfiguration">
     <xs:complexType>
       <xs:attribute name="name" type="xs:string"/>
+      <!-- Deprecated definition of Audio Location, please use audioLocationInt -->
       <xs:attribute name="audioLocation" type="audioLocation"/>
       <xs:attribute name="connectedDevice" type="xs:unsignedByte"/>
       <xs:attribute name="channelCount" type="xs:unsignedByte"/>
+      <!-- Integer Audio Location to populate to audioLocation if present -->
+      <xs:attribute name="audioChannelAllocation" type="xs:int"/>
     </xs:complexType>
   </xs:element>
   <xs:simpleType name="audioLocation">
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt b/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
index a882174..b6c2f03 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
@@ -81,10 +81,12 @@
 
   public class StrategyConfiguration {
     ctor public StrategyConfiguration();
+    method public int getAudioChannelAllocation();
     method public aidl.android.hardware.bluetooth.audio.setting.AudioLocation getAudioLocation();
     method public short getChannelCount();
     method public short getConnectedDevice();
     method public String getName();
+    method public void setAudioChannelAllocation(int);
     method public void setAudioLocation(aidl.android.hardware.bluetooth.audio.setting.AudioLocation);
     method public void setChannelCount(short);
     method public void setConnectedDevice(short);
diff --git a/broadcastradio/aidl/default/fuzzer.cpp b/broadcastradio/aidl/default/fuzzer.cpp
index d535432..2492d47 100644
--- a/broadcastradio/aidl/default/fuzzer.cpp
+++ b/broadcastradio/aidl/default/fuzzer.cpp
@@ -24,6 +24,8 @@
 using ::android::fuzzService;
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    // TODO(b/183141167): need to rewrite 'dump' to avoid SIGPIPE.
+    signal(SIGPIPE, SIG_IGN);
     const VirtualRadio& amFmRadioMock = VirtualRadio::getAmFmRadio();
     std::shared_ptr<BroadcastRadio> amFmRadio =
             ::ndk::SharedRefBase::make<BroadcastRadio>(amFmRadioMock);
diff --git a/compatibility_matrices/compatibility_matrix.202504.xml b/compatibility_matrices/compatibility_matrix.202504.xml
index 8a3efa7..41ac390 100644
--- a/compatibility_matrices/compatibility_matrix.202504.xml
+++ b/compatibility_matrices/compatibility_matrix.202504.xml
@@ -312,7 +312,7 @@
     </hal>
     <hal format="aidl">
         <name>android.hardware.security.secretkeeper</name>
-        <version>1</version>
+        <version>1-2</version>
         <interface>
             <name>ISecretkeeper</name>
             <instance>default</instance>
@@ -653,6 +653,15 @@
         </interface>
     </hal>
     <hal format="aidl">
+      <name>android.hardware.virtualization.capabilities</name>
+        <version>1</version>
+        <interface>
+            <name>IVmCapabilitiesService</name>
+            <instance>default</instance>
+            <instance>noop</instance>
+        </interface>
+    </hal>
+    <hal format="aidl">
         <name>android.hardware.weaver</name>
         <version>2</version>
         <interface>
diff --git a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
index adbc344..1e568b9 100644
--- a/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/aidl_api/android.hardware.graphics.composer3/current/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -89,6 +89,7 @@
   oneway void notifyExpectedPresent(long display, in android.hardware.graphics.composer3.ClockMonotonicTimestamp expectedPresentTime, int frameIntervalNs);
   int getMaxLayerPictureProfiles(long display);
   oneway void startHdcpNegotiation(long display, in android.hardware.drm.HdcpLevels levels);
+  android.hardware.graphics.composer3.Luts[] getLuts(long display, in android.hardware.graphics.composer3.Buffer[] buffers);
   const int EX_BAD_CONFIG = 1;
   const int EX_BAD_DISPLAY = 2;
   const int EX_BAD_LAYER = 3;
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
index b4d2e7f..7556962 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/IComposerClient.aidl
@@ -22,6 +22,7 @@
 import android.hardware.graphics.common.HdrConversionCapability;
 import android.hardware.graphics.common.HdrConversionStrategy;
 import android.hardware.graphics.common.Transform;
+import android.hardware.graphics.composer3.Buffer;
 import android.hardware.graphics.composer3.ClientTargetProperty;
 import android.hardware.graphics.composer3.ClockMonotonicTimestamp;
 import android.hardware.graphics.composer3.ColorMode;
@@ -38,6 +39,7 @@
 import android.hardware.graphics.composer3.FormatColorComponent;
 import android.hardware.graphics.composer3.HdrCapabilities;
 import android.hardware.graphics.composer3.IComposerCallback;
+import android.hardware.graphics.composer3.Luts;
 import android.hardware.graphics.composer3.OverlayProperties;
 import android.hardware.graphics.composer3.PerFrameMetadataKey;
 import android.hardware.graphics.composer3.PowerMode;
@@ -956,4 +958,12 @@
      *
      */
     oneway void startHdcpNegotiation(long display, in HdcpLevels levels);
+
+    /*
+     * Returns the Luts based on the buffers.
+     *
+     * @param display is the display for which the luts are requested.
+     * @param buffers is the buffer where the luts can be computed from
+     */
+    Luts[] getLuts(long display, in Buffer[] buffers);
 }
diff --git a/power/OWNERS b/power/OWNERS
index 95778a4..13895bd 100644
--- a/power/OWNERS
+++ b/power/OWNERS
@@ -1,6 +1,3 @@
 # Bug component: 826709
-
-# ADPF virtual team
-lpy@google.com
-wvw@google.com
 file:platform/frameworks/base:/ADPF_OWNERS
+wvw@google.com
diff --git a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
index 083a9aa..b41da3f 100644
--- a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
+++ b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
@@ -95,6 +95,18 @@
             << "Verified boot state must be \"UNVERIFIED\" aka \"orange\".";
 }
 
+// Check that the attested Verified Boot key is 32 bytes of zeroes since the bootloader is unlocked.
+TEST_P(BootloaderStateTest, VerifiedBootKeyAllZeroes) {
+    // Gate this test to avoid waiver issues.
+    if (get_vsr_api_level() <= __ANDROID_API_V__) {
+        return;
+    }
+
+    std::vector<uint8_t> expectedVbKey(32, 0);
+    ASSERT_EQ(attestedVbKey_, expectedVbKey) << "Verified Boot key digest must be 32 bytes of "
+                                                "zeroes since the bootloader is unlocked.";
+}
+
 // Following error codes from avb_slot_data() mean that slot data was loaded
 // (even if verification failed).
 static inline bool avb_slot_data_loaded(AvbSlotVerifyResult result) {
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 0ce6a15..09446ce 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -1908,16 +1908,29 @@
         }
     }
 
+    if (get_vsr_api_level() > __ANDROID_API_V__) {
+        // The Verified Boot key field should be exactly 32 bytes since it
+        // contains the SHA-256 hash of the key on locked devices or 32 bytes
+        // of zeroes on unlocked devices. This wasn't checked for earlier
+        // versions of the KeyMint HAL, so only only be strict for VSR-16+.
+        EXPECT_EQ(verified_boot_key.size(), 32);
+    } else if (get_vsr_api_level() == __ANDROID_API_V__) {
+        // The Verified Boot key field should be:
+        //   - Exactly 32 bytes on locked devices since it should contain
+        //     the SHA-256 hash of the key, or
+        //   - Up to 32 bytes of zeroes on unlocked devices (behaviour on
+        //     unlocked devices isn't specified in the HAL interface
+        //     specification).
+        // Thus, we can't check for strict equality in case unlocked devices
+        // report values with less than 32 bytes. This wasn't checked for
+        // earlier versions of the KeyMint HAL, so only check on VSR-15.
+        EXPECT_LE(verified_boot_key.size(), 32);
+    }
+
     // Verified Boot key should be all zeroes if the boot state is "orange".
     std::string empty_boot_key(32, '\0');
     std::string verified_boot_key_str((const char*)verified_boot_key.data(),
                                       verified_boot_key.size());
-    if (get_vsr_api_level() >= __ANDROID_API_V__) {
-        // The attestation should contain the SHA-256 hash of the verified boot
-        // key.  However, this was not checked for earlier versions of the KeyMint
-        // HAL so only be strict for VSR-V and above.
-        EXPECT_LE(verified_boot_key.size(), 32);
-    }
     EXPECT_NE(property_get("ro.boot.verifiedbootstate", property_value, ""), 0);
     if (!strcmp(property_value, "green")) {
         EXPECT_EQ(verified_boot_state, VerifiedBoot::VERIFIED);
diff --git a/security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp b/security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp
index 9f7322a..f7639bf 100644
--- a/security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp
+++ b/security/keymint/aidl/vts/functional/SecureElementProvisioningTest.cpp
@@ -114,10 +114,22 @@
         const auto& vbKey = rot->asArray()->get(pos++);
         ASSERT_TRUE(vbKey);
         ASSERT_TRUE(vbKey->asBstr());
-        if (get_vsr_api_level() >= __ANDROID_API_V__) {
-            // The attestation should contain the SHA-256 hash of the verified boot
-            // key.  However, this not was checked for earlier versions of the KeyMint
-            // HAL so only be strict for VSR-V and above.
+        if (get_vsr_api_level() > __ANDROID_API_V__) {
+            // The Verified Boot key field should be exactly 32 bytes since it
+            // contains the SHA-256 hash of the key on locked devices or 32 bytes
+            // of zeroes on unlocked devices. This wasn't checked for earlier
+            // versions of the KeyMint HAL, so only only be strict for VSR-16+.
+            ASSERT_EQ(vbKey->asBstr()->value().size(), 32);
+        } else if (get_vsr_api_level() == __ANDROID_API_V__) {
+            // The Verified Boot key field should be:
+            //   - Exactly 32 bytes on locked devices since it should contain
+            //     the SHA-256 hash of the key, or
+            //   - Up to 32 bytes of zeroes on unlocked devices (behaviour on
+            //     unlocked devices isn't specified in the HAL interface
+            //     specification).
+            // Thus, we can't check for strict equality in case unlocked devices
+            // report values with less than 32 bytes. This wasn't checked for
+            // earlier versions of the KeyMint HAL, so only check on VSR-15.
             ASSERT_LE(vbKey->asBstr()->value().size(), 32);
         }
 
diff --git a/security/secretkeeper/aidl/Android.bp b/security/secretkeeper/aidl/Android.bp
index d282621..f0b7894 100644
--- a/security/secretkeeper/aidl/Android.bp
+++ b/security/secretkeeper/aidl/Android.bp
@@ -25,7 +25,7 @@
         "android.hardware.security.authgraph-V1",
     ],
     stability: "vintf",
-    frozen: true,
+    frozen: false,
     backend: {
         java: {
             enabled: true,
@@ -88,6 +88,6 @@
 rust_defaults {
     name: "secretkeeper_use_latest_hal_aidl_rust",
     rustlibs: [
-        "android.hardware.security.secretkeeper-V1-rust",
+        "android.hardware.security.secretkeeper-V2-rust",
     ],
 }
diff --git a/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/ISecretkeeper.aidl b/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/ISecretkeeper.aidl
index 8ce37cd..ed48480 100644
--- a/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/ISecretkeeper.aidl
+++ b/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/ISecretkeeper.aidl
@@ -38,6 +38,7 @@
   byte[] processSecretManagementRequest(in byte[] request);
   void deleteIds(in android.hardware.security.secretkeeper.SecretId[] ids);
   void deleteAll();
+  android.hardware.security.secretkeeper.PublicKey getSecretkeeperIdentity();
   const int ERROR_UNKNOWN_KEY_ID = 1;
   const int ERROR_INTERNAL_ERROR = 2;
   const int ERROR_REQUEST_MALFORMED = 3;
diff --git a/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/PublicKey.aidl b/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/PublicKey.aidl
new file mode 100644
index 0000000..f690abf
--- /dev/null
+++ b/security/secretkeeper/aidl/aidl_api/android.hardware.security.secretkeeper/current/android/hardware/security/secretkeeper/PublicKey.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.security.secretkeeper;
+/* @hide */
+@VintfStability
+parcelable PublicKey {
+  byte[] keyMaterial;
+}
diff --git a/security/secretkeeper/aidl/android/hardware/security/secretkeeper/ISecretkeeper.aidl b/security/secretkeeper/aidl/android/hardware/security/secretkeeper/ISecretkeeper.aidl
index b07dba8..91493a1 100644
--- a/security/secretkeeper/aidl/android/hardware/security/secretkeeper/ISecretkeeper.aidl
+++ b/security/secretkeeper/aidl/android/hardware/security/secretkeeper/ISecretkeeper.aidl
@@ -17,6 +17,7 @@
 package android.hardware.security.secretkeeper;
 
 import android.hardware.security.authgraph.IAuthGraphKeyExchange;
+import android.hardware.security.secretkeeper.PublicKey;
 import android.hardware.security.secretkeeper.SecretId;
 
 @VintfStability
@@ -101,4 +102,12 @@
      * Delete data of all clients.
      */
     void deleteAll();
+
+    /**
+     * Gets the public key of the secret keeper instance. This should be a CBOR-encoded
+     * COSE_Key, as a PubKeyEd25519 / PubKeyECDSA256 / PubKeyECDSA384, as defined in
+     * generateCertificateRequestV2.cddl. Clients must have a trusted way of ensuring
+     * this key is valid.
+     */
+    PublicKey getSecretkeeperIdentity();
 }
diff --git a/security/secretkeeper/aidl/android/hardware/security/secretkeeper/PublicKey.aidl b/security/secretkeeper/aidl/android/hardware/security/secretkeeper/PublicKey.aidl
new file mode 100644
index 0000000..ccc89b3
--- /dev/null
+++ b/security/secretkeeper/aidl/android/hardware/security/secretkeeper/PublicKey.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.secretkeeper;
+
+/**
+ * Contents of a pubkey.
+ * @hide
+ */
+@VintfStability
+parcelable PublicKey {
+    /**
+     * CBOR-encoded COSE_Key
+     */
+    byte[] keyMaterial;
+}
diff --git a/security/secretkeeper/aidl/vts/Android.bp b/security/secretkeeper/aidl/vts/Android.bp
index be07a7b..c84afae 100644
--- a/security/secretkeeper/aidl/vts/Android.bp
+++ b/security/secretkeeper/aidl/vts/Android.bp
@@ -38,6 +38,7 @@
     srcs: ["secretkeeper_test_client.rs"],
     defaults: [
         "rdroidtest.defaults",
+        "secretkeeper_use_latest_hal_aidl_rust",
     ],
     test_suites: [
         "general-tests",
@@ -45,7 +46,6 @@
     ],
     test_config: "AndroidTest.xml",
     rustlibs: [
-        "android.hardware.security.secretkeeper-V1-rust",
         "libauthgraph_boringssl",
         "libauthgraph_core",
         "libauthgraph_wire",
@@ -66,9 +66,10 @@
 rust_binary {
     name: "secretkeeper_cli",
     srcs: ["secretkeeper_cli.rs"],
+    defaults: ["secretkeeper_use_latest_hal_aidl_rust"],
     lints: "android",
-    rlibs: [
-        "android.hardware.security.secretkeeper-V1-rust",
+    prefer_rlib: true,
+    rustlibs: [
         "libanyhow",
         "libauthgraph_boringssl",
         "libauthgraph_core",
diff --git a/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs b/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
index 449a99a..b944865 100644
--- a/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
+++ b/security/secretkeeper/aidl/vts/secretkeeper_test_client.rs
@@ -16,6 +16,7 @@
 
 use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::ISecretkeeper::ISecretkeeper;
 use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::SecretId::SecretId;
+use android_hardware_security_secretkeeper::aidl::android::hardware::security::secretkeeper::PublicKey::PublicKey;
 use authgraph_vts_test as ag_vts;
 use authgraph_boringssl as boring;
 use authgraph_core::key;
@@ -70,20 +71,32 @@
     0x06, 0xAC, 0x36, 0x8B, 0x3C, 0x95, 0x50, 0x16, 0x67, 0x71, 0x65, 0x26, 0xEB, 0xD0, 0xC3, 0x98,
 ]);
 
-// Android expects the public key of Secretkeeper instance to be present in the Linux device tree.
+// Android expects the public key of Secretkeeper instance to be available either
+// a) by being present in the Linux device tree (prior to version 2 of the secretkeeper HAL), or
+// b) via the `getSecretKeeperIdentity` operation from v2 onwards.
 // This allows clients to (cryptographically) verify that they are indeed talking to the real
 // secretkeeper.
 // Note that this is the identity of the `default` instance (and not `nonsecure`)!
-fn get_secretkeeper_identity() -> Option<CoseKey> {
-    let path = Path::new(SECRETKEEPER_KEY_HOST_DT);
-    if path.exists() {
-        let key = fs::read(path).unwrap();
-        let mut key = CoseKey::from_slice(&key).unwrap();
-        key.canonicalize(CborOrdering::Lexicographic);
-        Some(key)
+fn get_secretkeeper_identity(instance: &str) -> Option<CoseKey> {
+    let sk = get_connection(instance);
+    let key_material = if sk.getInterfaceVersion().expect("Error getting sk interface version") >= 2 {
+        let PublicKey { keyMaterial } = sk.getSecretkeeperIdentity().expect("Error calling getSecretkeeperIdentity");
+        Some(keyMaterial)
     } else {
-        None
-    }
+        let path = Path::new(SECRETKEEPER_KEY_HOST_DT);
+        if path.exists() {
+            let key_material = fs::read(path).unwrap();
+            Some(key_material)
+        } else {
+            None
+        }
+    };
+
+    key_material.map(|km| {
+        let mut cose_key = CoseKey::from_slice(&km).expect("Error deserializing CoseKey from key material");
+        cose_key.canonicalize(CborOrdering::Lexicographic);
+        cose_key
+    })
 }
 
 fn get_instances() -> Vec<(String, String)> {
@@ -760,12 +773,12 @@
 }
 
 // This test checks that the identity of Secretkeeper (in context of AuthGraph key exchange) is
-// same as the one advertized in Linux device tree. This is only expected from `default` instance.
+// same as the one either a) advertized in Linux device tree or b) retrieved from SK itself
+// from (HAL v2 onwards). This is only expected from `default` instance.
 #[rdroidtest(get_instances())]
-#[ignore_if(|p| p != "default")]
 fn secretkeeper_check_identity(instance: String) {
-    let sk_key = get_secretkeeper_identity()
-        .expect("Failed to extract identity of default instance from device tree");
+    let sk_key = get_secretkeeper_identity(&instance)
+        .expect("Failed to extract identity of default instance");
     // Create a session with this expected identity. This succeeds only if the identity used by
     // Secretkeeper is sk_key.
     let _ = SkClient::with_expected_sk_identity(&instance, sk_key).unwrap();
diff --git a/security/secretkeeper/default/Android.bp b/security/secretkeeper/default/Android.bp
index 799188f..134afc9 100644
--- a/security/secretkeeper/default/Android.bp
+++ b/security/secretkeeper/default/Android.bp
@@ -28,9 +28,9 @@
     vendor_available: true,
     defaults: [
         "authgraph_use_latest_hal_aidl_rust",
+        "secretkeeper_use_latest_hal_aidl_rust",
     ],
     rustlibs: [
-        "android.hardware.security.secretkeeper-V1-rust",
         "libauthgraph_boringssl",
         "libauthgraph_core",
         "libauthgraph_hal",
@@ -50,9 +50,9 @@
     prefer_rlib: true,
     defaults: [
         "authgraph_use_latest_hal_aidl_rust",
+        "secretkeeper_use_latest_hal_aidl_rust",
     ],
     rustlibs: [
-        "android.hardware.security.secretkeeper-V1-rust",
         "libandroid_logger",
         "libbinder_rs",
         "liblog_rust",
diff --git a/security/secretkeeper/default/secretkeeper.xml b/security/secretkeeper/default/secretkeeper.xml
index 40aebe0..699fff0 100644
--- a/security/secretkeeper/default/secretkeeper.xml
+++ b/security/secretkeeper/default/secretkeeper.xml
@@ -19,7 +19,7 @@
 
     <hal format="aidl">
         <name>android.hardware.security.secretkeeper</name>
-        <version>1</version>
+        <version>2</version>
         <interface>
             <name>ISecretkeeper</name>
             <instance>nonsecure</instance>
diff --git a/thermal/OWNERS b/thermal/OWNERS
index 7229b22..13895bd 100644
--- a/thermal/OWNERS
+++ b/thermal/OWNERS
@@ -1,5 +1,3 @@
 # Bug component: 826709
-
-# ADPF virtual team
-lpy@google.com
+file:platform/frameworks/base:/ADPF_OWNERS
 wvw@google.com
diff --git a/thermal/aidl/default/Thermal.cpp b/thermal/aidl/default/Thermal.cpp
index 339e9b8..04efbd6 100644
--- a/thermal/aidl/default/Thermal.cpp
+++ b/thermal/aidl/default/Thermal.cpp
@@ -47,27 +47,85 @@
     return ScopedAStatus::ok();
 }
 
-ScopedAStatus Thermal::getTemperatures(std::vector<Temperature>* /* out_temperatures */) {
+ScopedAStatus Thermal::getTemperatures(std::vector<Temperature>* out_temperatures) {
     LOG(VERBOSE) << __func__;
+    std::vector<Temperature> temperatures;
+    temperatures.push_back(Temperature{
+            .name = "skin",
+            .type = TemperatureType::SKIN,
+            .value = 30.1f,
+    });
+    temperatures.push_back(Temperature{
+            .name = "battery",
+            .type = TemperatureType::BATTERY,
+            .value = 30.2f,
+    });
+    *out_temperatures = temperatures;
     return ScopedAStatus::ok();
 }
 
 ScopedAStatus Thermal::getTemperaturesWithType(TemperatureType in_type,
-                                               std::vector<Temperature>* /* out_temperatures */) {
+                                               std::vector<Temperature>* out_temperatures) {
     LOG(VERBOSE) << __func__ << " TemperatureType: " << static_cast<int32_t>(in_type);
+    if (in_type == TemperatureType::SKIN) {
+        std::vector<Temperature> temperatures;
+        temperatures.push_back(Temperature{
+                .name = "skin",
+                .type = TemperatureType::SKIN,
+                .value = 30.1f,
+        });
+        *out_temperatures = temperatures;
+    } else if (in_type == TemperatureType::BATTERY) {
+        std::vector<Temperature> temperatures;
+        temperatures.push_back(Temperature{
+                .name = "battery",
+                .type = TemperatureType::BATTERY,
+                .value = 30.2f,
+        });
+        *out_temperatures = temperatures;
+    }
     return ScopedAStatus::ok();
 }
 
 ScopedAStatus Thermal::getTemperatureThresholds(
-        std::vector<TemperatureThreshold>* /* out_temperatureThresholds */) {
+        std::vector<TemperatureThreshold>* out_temperatureThresholds) {
     LOG(VERBOSE) << __func__;
+    std::vector<TemperatureThreshold> temperatureThresholds;
+    temperatureThresholds.push_back(TemperatureThreshold{
+            .name = "skin",
+            .type = TemperatureType::SKIN,
+            .hotThrottlingThresholds = {30.0f, 31.0f, 32.0f, 33.0f, 34.0f, 35.0f, 36.0f},
+    });
+    temperatureThresholds.push_back(TemperatureThreshold{
+            .name = "battery",
+            .type = TemperatureType::BATTERY,
+            .hotThrottlingThresholds = {30.0f, 31.0f, 32.0f, 33.0f, 34.0f, 35.0f, 36.0f},
+    });
+    *out_temperatureThresholds = temperatureThresholds;
     return ScopedAStatus::ok();
 }
 
 ScopedAStatus Thermal::getTemperatureThresholdsWithType(
         TemperatureType in_type,
-        std::vector<TemperatureThreshold>* /* out_temperatureThresholds */) {
+        std::vector<TemperatureThreshold>* out_temperatureThresholds) {
     LOG(VERBOSE) << __func__ << " TemperatureType: " << static_cast<int32_t>(in_type);
+    if (in_type == TemperatureType::SKIN) {
+        std::vector<TemperatureThreshold> temperatureThresholds;
+        temperatureThresholds.push_back(TemperatureThreshold{
+                .name = "skin",
+                .type = TemperatureType::SKIN,
+                .hotThrottlingThresholds = {30.0f, 31.0f, 32.0f, 33.0f, 34.0f, 35.0f, 36.0f},
+        });
+        *out_temperatureThresholds = temperatureThresholds;
+    } else if (in_type == TemperatureType::BATTERY) {
+        std::vector<TemperatureThreshold> temperatureThresholds;
+        temperatureThresholds.push_back(TemperatureThreshold{
+                .name = "battery",
+                .type = TemperatureType::BATTERY,
+                .hotThrottlingThresholds = {30.0f, 31.0f, 32.0f, 33.0f, 34.0f, 35.0f, 36.0f},
+        });
+        *out_temperatureThresholds = temperatureThresholds;
+    }
     return ScopedAStatus::ok();
 }
 
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorRange.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorRange.aidl
new file mode 100644
index 0000000..c08c6cc
--- /dev/null
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorRange.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tv.mediaquality;
+@VintfStability
+enum ColorRange {
+  AUTO,
+  LIMITED,
+  FULL,
+}
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorSpace.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorSpace.aidl
new file mode 100644
index 0000000..9bcddcb
--- /dev/null
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ColorSpace.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tv.mediaquality;
+@VintfStability
+enum ColorSpace {
+  AUTO,
+  S_RGB_BT_709,
+  DCI,
+  ADOBE_RGB,
+  BT2020,
+  ON,
+  OFF,
+}
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/Gamma.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/Gamma.aidl
new file mode 100644
index 0000000..89bb808
--- /dev/null
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/Gamma.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tv.mediaquality;
+@VintfStability
+enum Gamma {
+  DARK,
+  MIDDLE,
+  BRIGHT,
+}
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IMediaQuality.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IMediaQuality.aidl
index 006abee..115ada7 100644
--- a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IMediaQuality.aidl
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IMediaQuality.aidl
@@ -49,12 +49,12 @@
   void setAutoAqEnabled(boolean enable);
   android.hardware.tv.mediaquality.IPictureProfileChangedListener getPictureProfileListener();
   void setPictureProfileAdjustmentListener(android.hardware.tv.mediaquality.IPictureProfileAdjustmentListener listener);
-  android.hardware.tv.mediaquality.PictureParameters getPictureParameters(long pictureProfileId);
   void sendDefaultPictureParameters(in android.hardware.tv.mediaquality.PictureParameters pictureParameters);
   android.hardware.tv.mediaquality.ISoundProfileChangedListener getSoundProfileListener();
   void setSoundProfileAdjustmentListener(android.hardware.tv.mediaquality.ISoundProfileAdjustmentListener listener);
-  android.hardware.tv.mediaquality.SoundParameters getSoundParameters(long soundProfileId);
   void sendDefaultSoundParameters(in android.hardware.tv.mediaquality.SoundParameters soundParameters);
   void getParamCaps(in android.hardware.tv.mediaquality.ParameterName[] paramNames, out android.hardware.tv.mediaquality.ParamCapability[] caps);
   void getVendorParamCaps(in android.hardware.tv.mediaquality.VendorParameterIdentifier[] names, out android.hardware.tv.mediaquality.VendorParamCapability[] caps);
+  void setPictureParametersCallback(android.hardware.tv.mediaquality.IPictureParametersCallback callback);
+  void setSoundParametersCallback(android.hardware.tv.mediaquality.ISoundParametersCallback callback);
 }
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl
new file mode 100644
index 0000000..ccb31c4
--- /dev/null
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tv.mediaquality;
+@VintfStability
+interface IPictureParametersCallback {
+  android.hardware.tv.mediaquality.PictureParameters getPictureParameters(long pictureProfileId);
+}
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl
new file mode 100644
index 0000000..9509006
--- /dev/null
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.tv.mediaquality;
+@VintfStability
+interface ISoundParametersCallback {
+  android.hardware.tv.mediaquality.SoundParameters getSoundParameters(long SoundProfileId);
+}
diff --git a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/PictureParameter.aidl b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/PictureParameter.aidl
index ae396ad..c38e96f 100644
--- a/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/PictureParameter.aidl
+++ b/tv/mediaquality/aidl/aidl_api/android.hardware.tv.mediaquality/current/android/hardware/tv/mediaquality/PictureParameter.aidl
@@ -60,4 +60,15 @@
   boolean globeDimming;
   boolean autoPictureQualityEnabled;
   boolean autoSuperResolutionEnabled;
+  android.hardware.tv.mediaquality.ColorRange levelRange;
+  boolean gamutMapping;
+  boolean pcMode;
+  boolean lowLatency;
+  boolean vrr;
+  boolean cvrr;
+  android.hardware.tv.mediaquality.ColorRange hdmiRgbRange;
+  android.hardware.tv.mediaquality.ColorSpace colorSpace;
+  int panelInitMaxLuminceNits;
+  boolean panelInitMaxLuminceValid;
+  android.hardware.tv.mediaquality.Gamma gamma;
 }
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorRange.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorRange.aidl
new file mode 100644
index 0000000..29f12ef
--- /dev/null
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorRange.aidl
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.mediaquality;
+
+/**
+ * The range of color the TV can display.
+ */
+@VintfStability
+enum ColorRange {
+    AUTO,
+    LIMITED,
+    FULL,
+}
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorSpace.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorSpace.aidl
new file mode 100644
index 0000000..bd4511d
--- /dev/null
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ColorSpace.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.mediaquality;
+
+/**
+ * Specific model used to define and represent colors numerically.
+ */
+@VintfStability
+enum ColorSpace {
+    AUTO,
+    S_RGB_BT_709,
+    DCI,
+    ADOBE_RGB,
+    BT2020,
+    ON,
+    OFF,
+}
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/Gamma.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/Gamma.aidl
new file mode 100644
index 0000000..c633557
--- /dev/null
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/Gamma.aidl
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.mediaquality;
+
+@VintfStability
+enum Gamma {
+    DARK,
+    MIDDLE,
+    BRIGHT,
+}
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IMediaQuality.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IMediaQuality.aidl
index 6a992a1..e12ded0 100644
--- a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IMediaQuality.aidl
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IMediaQuality.aidl
@@ -18,8 +18,10 @@
 
 import android.hardware.tv.mediaquality.AmbientBacklightSettings;
 import android.hardware.tv.mediaquality.IMediaQualityCallback;
+import android.hardware.tv.mediaquality.IPictureParametersCallback;
 import android.hardware.tv.mediaquality.IPictureProfileAdjustmentListener;
 import android.hardware.tv.mediaquality.IPictureProfileChangedListener;
+import android.hardware.tv.mediaquality.ISoundParametersCallback;
 import android.hardware.tv.mediaquality.ISoundProfileAdjustmentListener;
 import android.hardware.tv.mediaquality.ISoundProfileChangedListener;
 import android.hardware.tv.mediaquality.ParamCapability;
@@ -154,14 +156,6 @@
     void setPictureProfileAdjustmentListener(IPictureProfileAdjustmentListener listener);
 
     /**
-     * Get the picture parameters by PictureProfile id. Check PictureParameters for its' detail.
-     *
-     * @param pictureProfileId The PictureProfile id that associate with the PictureProfile.
-     * @return PictureParameters with all the pre-defined parameters and vendor defined parameters.
-     */
-    PictureParameters getPictureParameters(long pictureProfileId);
-
-    /**
      * Send the default picture parameters to the vendor code or HAL to apply the picture
      * parameters.
      *
@@ -185,14 +179,6 @@
     void setSoundProfileAdjustmentListener(ISoundProfileAdjustmentListener listener);
 
     /**
-     * Get the sound parameters by SoundProfile id. Check SoundParameters for its' detail.
-     *
-     * @param soundProfileId The SoundProfile id that associate with a SoundProfile.
-     * @return SoundParameters with all the pre-defined parameters and vendor defined parameters.
-     */
-    SoundParameters getSoundParameters(long soundProfileId);
-
-    /**
      * Send the default sound parameters to the vendor code or HAL to apply the sound parameters.
      *
      * @param soundParameters SoundParameters with pre-defined parameters and vendor defined
@@ -209,4 +195,30 @@
      * Gets vendor capability information of the given parameters.
      */
     void getVendorParamCaps(in VendorParameterIdentifier[] names, out VendorParamCapability[] caps);
+
+    /**
+     * Sets picture parameters callback to get the picture parameters send by the client.
+     *
+     * When the same client registers this callback multiple times, only the most recent
+     * registration will be active. The previous callback will be overwritten.
+     *
+     * When different client registers this callback, it will overwrite the previous registered
+     * client. Only one callback can be active.
+     *
+     * @param callback Callback object to pass PictureParameters.
+     */
+    void setPictureParametersCallback(IPictureParametersCallback callback);
+
+    /**
+     * Sets sound parameters callback to get the sound parameters send by the client.
+     *
+     * When the same client registers this callback multiple times, only the most recent
+     * registration will be active. The previous callback will be overwritten.
+     *
+     * When different client registers this callback, it will overwrite the previous registered
+     * client. Only one callback can be active.
+     *
+     * @param callback Callback object to pass SoundParameters.
+     */
+    void setSoundParametersCallback(ISoundParametersCallback callback);
 }
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl
new file mode 100644
index 0000000..b92c775
--- /dev/null
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/IPictureParametersCallback.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.mediaquality;
+
+import android.hardware.tv.mediaquality.PictureParameters;
+
+@VintfStability
+interface IPictureParametersCallback {
+    /**
+     * Get the picture parameters by PictureProfile id. Check PictureParameters for its' detail.
+     * This is called from the HAL to media quality framework.
+     *
+     * @param pictureProfileId The PictureProfile id that associate with the PictureProfile.
+     * @return PictureParameters with all the pre-defined parameters and vendor defined parameters.
+     */
+    PictureParameters getPictureParameters(long pictureProfileId);
+}
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl
new file mode 100644
index 0000000..856ceb4
--- /dev/null
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/ISoundParametersCallback.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tv.mediaquality;
+
+import android.hardware.tv.mediaquality.SoundParameters;
+
+@VintfStability
+interface ISoundParametersCallback {
+    /**
+     * Get the Sound parameters by SoundProfile id. Check SoundParameters for its' detail.
+     * This is called from the HAL to media quality framework.
+     *
+     * @param SoundProfileId The SoundProfile id that associate with the SoundProfile.
+     * @return SoundParameters with all the pre-defined parameters and vendor defined parameters.
+     */
+    SoundParameters getSoundParameters(long SoundProfileId);
+}
diff --git a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/PictureParameter.aidl b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/PictureParameter.aidl
index 922368d..b7f2a11 100644
--- a/tv/mediaquality/aidl/android/hardware/tv/mediaquality/PictureParameter.aidl
+++ b/tv/mediaquality/aidl/android/hardware/tv/mediaquality/PictureParameter.aidl
@@ -16,8 +16,12 @@
 
 package android.hardware.tv.mediaquality;
 
+import android.hardware.tv.mediaquality.ColorRange;
+import android.hardware.tv.mediaquality.ColorSpace;
 import android.hardware.tv.mediaquality.ColorTemperature;
+import android.hardware.tv.mediaquality.Gamma;
 import android.hardware.tv.mediaquality.QualityLevel;
+
 /**
  * The parameters for Picture Profile.
  */
@@ -187,4 +191,66 @@
      * image and uses its knowledge to invent the missing pixel, make the image look sharper.
      */
     boolean autoSuperResolutionEnabled;
+
+    /**
+     * The color range of the content. This indicates the range of luminance values
+     * used in the video signal.
+     */
+    ColorRange levelRange;
+
+    /**
+     * Enable/disable gamut mapping. Gamut mapping is a process that adjusts
+     * the colors in the video signal to match the color gamut of the display.
+     */
+    boolean gamutMapping;
+
+    /**
+     * Enable/disable PC mode. PC mode is a display mode that is optimized for
+     * use with computers.
+     */
+    boolean pcMode;
+
+    /**
+     * Enable/disable low latency mode. Low latency mode reduces the delay
+     * between the video source and the display.
+     */
+    boolean lowLatency;
+
+    /**
+     * Enable/disable variable refresh rate (VRR) mode. VRR allows the display to
+     * dynamically adjust its refresh rate to match the frame rate of the video
+     * source, reducing screen tearing.
+     */
+    boolean vrr;
+
+    /**
+     * Enable/disable continuous variable refresh rate (CVRR) mode. CVRR is a type
+     * of VRR that allows for a wider range of refresh rates.
+     */
+    boolean cvrr;
+
+    /**
+     * The color range of the HDMI input. This indicates the range of luminance
+     * values used in the HDMI signal.
+     */
+    ColorRange hdmiRgbRange;
+
+    /**
+     * The color space of the content. This indicates the color gamut and
+     * transfer function used in the video signal.
+     */
+    ColorSpace colorSpace;
+
+    /**
+     * The initial maximum luminance of the panel, in nits.
+     */
+    int panelInitMaxLuminceNits;
+
+    /**
+     * Whether the initial maximum luminance value is valid.
+     */
+    boolean panelInitMaxLuminceValid;
+
+    /* The gamma curve used for the display. */
+    Gamma gamma;
 }
diff --git a/tv/mediaquality/aidl/default/hal/media_quality_hal_impl.rs b/tv/mediaquality/aidl/default/hal/media_quality_hal_impl.rs
index 35fb999..190e6a7 100644
--- a/tv/mediaquality/aidl/default/hal/media_quality_hal_impl.rs
+++ b/tv/mediaquality/aidl/default/hal/media_quality_hal_impl.rs
@@ -24,16 +24,16 @@
     IPictureProfileChangedListener::IPictureProfileChangedListener,
     ParamCapability::ParamCapability,
     ParameterName::ParameterName,
-    PictureParameter::PictureParameter,
     PictureParameters::PictureParameters,
     ISoundProfileAdjustmentListener::ISoundProfileAdjustmentListener,
     ISoundProfileChangedListener::ISoundProfileChangedListener,
-    SoundParameter::SoundParameter,
     SoundParameters::SoundParameters,
     VendorParamCapability::VendorParamCapability,
     VendorParameterIdentifier::VendorParameterIdentifier,
+    IPictureParametersCallback::IPictureParametersCallback,
+    ISoundParametersCallback::ISoundParametersCallback,
 };
-use binder::{Interface, ParcelableHolder, Strong};
+use binder::{Interface, Strong};
 use std::sync::{Arc, Mutex};
 use std::thread;
 
@@ -54,6 +54,8 @@
             Arc<Mutex<Option<Strong<dyn ISoundProfileAdjustmentListener>>>>,
     picture_profile_changed_listener: Arc<Mutex<Option<Strong<dyn IPictureProfileChangedListener>>>>,
     sound_profile_changed_listener: Arc<Mutex<Option<Strong<dyn ISoundProfileChangedListener>>>>,
+    picture_parameters_callback: Arc<Mutex<Option<Strong<dyn IPictureParametersCallback>>>>,
+    sound_parameters_callback: Arc<Mutex<Option<Strong<dyn ISoundParametersCallback>>>>,
 }
 
 impl MediaQualityService {
@@ -75,6 +77,8 @@
             sound_profile_adjustment_listener: Arc::new(Mutex::new(None)),
             picture_profile_changed_listener: Arc::new(Mutex::new(None)),
             sound_profile_changed_listener: Arc::new(Mutex::new(None)),
+            picture_parameters_callback: Arc::new(Mutex::new(None)),
+            sound_parameters_callback: Arc::new(Mutex::new(None)),
         }
     }
 }
@@ -224,25 +228,6 @@
         Ok(())
     }
 
-    fn getPictureParameters(&self, id: i64) -> binder::Result<PictureParameters>{
-        let picture_parameters = match id {
-            1 => {
-                vec![
-                    PictureParameter::Brightness(0.5),
-                    PictureParameter::Contrast(50),
-                ]
-            },
-            _ => vec![]
-        };
-
-        let picture_params = PictureParameters {
-            pictureParameters: picture_parameters,
-            vendorPictureParameters: ParcelableHolder::default(),
-        };
-
-        Ok(picture_params)
-    }
-
     fn sendDefaultPictureParameters(&self, _picture_parameters: &PictureParameters) -> binder::Result<()>{
         println!("Received picture parameters");
         Ok(())
@@ -264,25 +249,6 @@
         Ok(())
     }
 
-    fn getSoundParameters(&self, id: i64) -> binder::Result<SoundParameters>{
-        let sound_parameters = match id {
-            1 => {
-                vec![
-                    SoundParameter::Balance(50),
-                    SoundParameter::Bass(50),
-                ]
-            },
-            _ => vec![]
-        };
-
-        let sound_params = SoundParameters {
-            soundParameters: sound_parameters,
-            vendorSoundParameters: ParcelableHolder::default(),
-        };
-
-        Ok(sound_params)
-    }
-
     fn sendDefaultSoundParameters(&self, _sound_parameters: &SoundParameters) -> binder::Result<()>{
         println!("Received sound parameters");
         Ok(())
@@ -305,4 +271,22 @@
         println!("getVendorParamCaps. len= {}", param_names.len());
         Ok(())
     }
+
+    fn setPictureParametersCallback(
+        &self,
+        callback: &Strong<dyn IPictureParametersCallback>
+    ) -> binder::Result<()> {
+        let mut cb = self.picture_parameters_callback.lock().unwrap();
+        *cb = Some(callback.clone());
+        Ok(())
+    }
+
+    fn setSoundParametersCallback(
+        &self,
+        callback: &Strong<dyn ISoundParametersCallback>
+    ) -> binder::Result<()> {
+        let mut cb = self.sound_parameters_callback.lock().unwrap();
+        *cb = Some(callback.clone());
+        Ok(())
+    }
 }
diff --git a/tv/mediaquality/aidl/vts/functional/VtsHalMediaQualityTest.cpp b/tv/mediaquality/aidl/vts/functional/VtsHalMediaQualityTest.cpp
index b508ed6..c3e25a4 100644
--- a/tv/mediaquality/aidl/vts/functional/VtsHalMediaQualityTest.cpp
+++ b/tv/mediaquality/aidl/vts/functional/VtsHalMediaQualityTest.cpp
@@ -23,8 +23,10 @@
 #include <aidl/android/hardware/tv/mediaquality/BnPictureProfileAdjustmentListener.h>
 #include <aidl/android/hardware/tv/mediaquality/BnSoundProfileAdjustmentListener.h>
 #include <aidl/android/hardware/tv/mediaquality/IMediaQuality.h>
+#include <aidl/android/hardware/tv/mediaquality/PictureParameter.h>
 #include <aidl/android/hardware/tv/mediaquality/PictureParameters.h>
 #include <aidl/android/hardware/tv/mediaquality/PictureProfile.h>
+#include <aidl/android/hardware/tv/mediaquality/SoundParameter.h>
 #include <aidl/android/hardware/tv/mediaquality/SoundParameters.h>
 #include <aidl/android/hardware/tv/mediaquality/SoundProfile.h>
 
@@ -43,8 +45,10 @@
 using aidl::android::hardware::tv::mediaquality::BnSoundProfileAdjustmentListener;
 using aidl::android::hardware::tv::mediaquality::IMediaQuality;
 using aidl::android::hardware::tv::mediaquality::ParamCapability;
+using aidl::android::hardware::tv::mediaquality::PictureParameter;
 using aidl::android::hardware::tv::mediaquality::PictureParameters;
 using aidl::android::hardware::tv::mediaquality::PictureProfile;
+using aidl::android::hardware::tv::mediaquality::SoundParameter;
 using aidl::android::hardware::tv::mediaquality::SoundParameters;
 using aidl::android::hardware::tv::mediaquality::SoundProfile;
 using aidl::android::hardware::tv::mediaquality::VendorParamCapability;
@@ -162,18 +166,20 @@
     ASSERT_OK(mediaquality->setPictureProfileAdjustmentListener(listener));
 }
 
-TEST_P(MediaQualityAidl, TestGetPictureParameters) {
-    PictureParameters pictureParams;
-    auto result = mediaquality->getPictureParameters(1, &pictureParams);
-    ASSERT_TRUE(result.isOk());
-    ASSERT_EQ(pictureParams.pictureParameters.size(), 2);
-}
-
 TEST_P(MediaQualityAidl, TestSendDefaultPictureParameters) {
-    PictureParameters pictureParams;
-    auto result = mediaquality->getPictureParameters(1, &pictureParams);
-    ASSERT_TRUE(result.isOk());
-    ASSERT_OK(mediaquality->sendDefaultPictureParameters(pictureParams));
+    PictureParameters pictureParameters;
+    std::vector<PictureParameter> picParams;
+
+    PictureParameter brightnessParam;
+    brightnessParam.set<PictureParameter::Tag::brightness>(0.5f);
+    picParams.push_back(brightnessParam);
+
+    PictureParameter contrastParam;
+    contrastParam.set<PictureParameter::Tag::contrast>(50);
+    picParams.push_back(contrastParam);
+
+    pictureParameters.pictureParameters = picParams;
+    ASSERT_OK(mediaquality->sendDefaultPictureParameters(pictureParameters));
 }
 
 TEST_P(MediaQualityAidl, TestSetSoundProfileAdjustmentListener) {
@@ -183,18 +189,20 @@
     ASSERT_OK(mediaquality->setSoundProfileAdjustmentListener(listener));
 }
 
-TEST_P(MediaQualityAidl, TestGetSoundParameters) {
-    SoundParameters soundParams;
-    auto result = mediaquality->getSoundParameters(1, &soundParams);
-    ASSERT_TRUE(result.isOk());
-    ASSERT_EQ(soundParams.soundParameters.size(), 2);
-}
-
 TEST_P(MediaQualityAidl, TestSendDefaultSoundParameters) {
-    SoundParameters soundParams;
-    auto result = mediaquality->getSoundParameters(1, &soundParams);
-    ASSERT_TRUE(result.isOk());
-    ASSERT_OK(mediaquality->sendDefaultSoundParameters(soundParams));
+    SoundParameters soundParameters;
+    std::vector<SoundParameter> soundParams;
+
+    SoundParameter balanceParam;
+    balanceParam.set<SoundParameter::Tag::balance>(50);
+    soundParams.push_back(balanceParam);
+
+    SoundParameter bassParam;
+    bassParam.set<SoundParameter::Tag::bass>(50);
+    soundParams.push_back(bassParam);
+
+    soundParameters.soundParameters = soundParams;
+    ASSERT_OK(mediaquality->sendDefaultSoundParameters(soundParameters));
 }
 
 TEST_P(MediaQualityAidl, TestSetAmbientBacklightDetector) {
diff --git a/virtualization/capabilities_service/aidl/Android.bp b/virtualization/capabilities_service/aidl/Android.bp
new file mode 100644
index 0000000..b0bbbdd
--- /dev/null
+++ b/virtualization/capabilities_service/aidl/Android.bp
@@ -0,0 +1,35 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_team: "trendy_team_virtualization",
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+aidl_interface {
+    name: "android.hardware.virtualization.capabilities.capabilities_service",
+    vendor_available: true,
+    srcs: ["android/**/*.aidl"],
+    stability: "vintf",
+    backend: {
+        rust: {
+            enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.virt",
+            ],
+        },
+    },
+    frozen: false,
+}
diff --git a/virtualization/capabilities_service/aidl/aidl_api/android.hardware.virtualization.capabilities.capabilities_service/current/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl b/virtualization/capabilities_service/aidl/aidl_api/android.hardware.virtualization.capabilities.capabilities_service/current/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl
new file mode 100644
index 0000000..68ff021
--- /dev/null
+++ b/virtualization/capabilities_service/aidl/aidl_api/android.hardware.virtualization.capabilities.capabilities_service/current/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.virtualization.capabilities;
+@VintfStability
+interface IVmCapabilitiesService {
+  void grantAccessToVendorTeeServices(in ParcelFileDescriptor vmFd, in String[] vendorTeeServices);
+}
diff --git a/virtualization/capabilities_service/aidl/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl b/virtualization/capabilities_service/aidl/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl
new file mode 100644
index 0000000..0d09ecb
--- /dev/null
+++ b/virtualization/capabilities_service/aidl/android/hardware/virtualization/capabilities/IVmCapabilitiesService.aidl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.virtualization.capabilities;
+
+/**
+ * Encapsulates vendor-specific capabilities that can be granted to VMs.
+ */
+@VintfStability
+interface IVmCapabilitiesService {
+    /**
+     * Grant access for the VM represented by the given vm_fd to the given vendor-owned tee
+     * services. The names in |vendorTeeServices| must match the ones defined in the
+     * tee_service_contexts files.
+     * TODO(ioffe): link to the integration doc for custom smc filtering feature once
+     * it's ready.
+     */
+    void grantAccessToVendorTeeServices(
+            in ParcelFileDescriptor vmFd, in String[] vendorTeeServices);
+}
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
index 6482eac..565f33a 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
@@ -109,6 +109,7 @@
     T2LM_NEGOTIATION = (1 << 8) /* 256 */,
     SET_VOIP_MODE = (1 << 9) /* 512 */,
     MLO_SAP = (1 << 10) /* 1024 */,
+    MULTIPLE_MLD_ON_SAP = (1 << 11) /* 2048 */,
   }
   @VintfStability
   parcelable ChipConcurrencyCombinationLimit {
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
index 8c44330..9d982b8 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
@@ -72,4 +72,5 @@
   oneway void notifyInitiateBootstrappingResponse(in char id, in android.hardware.wifi.NanStatus status, in int bootstrappingInstanceId);
   oneway void notifyRespondToBootstrappingIndicationResponse(in char id, in android.hardware.wifi.NanStatus status);
   oneway void notifyTerminatePairingResponse(in char id, in android.hardware.wifi.NanStatus status);
+  oneway void notifyRangingResults(in android.hardware.wifi.RttResult[] results, in byte discoverySessionId);
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCapabilities.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCapabilities.aidl
index a30893a..0722a04 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCapabilities.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCapabilities.aidl
@@ -54,4 +54,7 @@
   boolean supportsPairing;
   boolean supportsSetClusterId;
   boolean supportsSuspension;
+  boolean supportsPeriodicRanging;
+  android.hardware.wifi.RttBw maxSupportedBandwidth;
+  int maxNumRxChainsSupported;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanDiscoveryCommonConfig.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
index 96d940a..58e62db 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
@@ -55,4 +55,7 @@
   char distanceIngressCm;
   char distanceEgressCm;
   boolean enableSessionSuspendability;
+  int rttBurstSize;
+  android.hardware.wifi.RttPreamble preamble;
+  @nullable android.hardware.wifi.WifiChannelInfo channelInfo;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanPublishRequest.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanPublishRequest.aidl
index bdc8357..90e9a8b 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanPublishRequest.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanPublishRequest.aidl
@@ -41,4 +41,5 @@
   android.hardware.wifi.NanPairingConfig pairingConfig;
   byte[16] identityKey;
   @nullable android.hardware.wifi.common.OuiKeyedData[] vendorData;
+  boolean rangingResultsRequired;
 }
diff --git a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
index 78508cf..5a5e4a7 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
@@ -91,6 +91,14 @@
          * Chip supports Wi-Fi 7 MLO SoftAp.
          */
         MLO_SAP = 1 << 10,
+        /**
+         * Chip supports multiple Wi-Fi 7 multi-link devices (MLD) on SoftAp.
+         * When this feature flag is enabled, it is an indication that the chip can
+         * support Bridged-SoftAp in 11be with separate MLD MAC addresses.
+         * When this feature is disabled, then only one MLD address can be used in 11be mode
+         * (if supported), this includes use of MLO if MLO_SAP flag is set to True.
+         */
+        MULTIPLE_MLD_ON_SAP = 1 << 11,
     }
 
     /**
diff --git a/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl b/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
index 3649b7b..376dcac 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
@@ -29,6 +29,7 @@
 import android.hardware.wifi.NanPairingRequestInd;
 import android.hardware.wifi.NanStatus;
 import android.hardware.wifi.NanSuspensionModeChangeInd;
+import android.hardware.wifi.RttResult;
 /**
  * NAN Response and Asynchronous Event Callbacks.
  *
@@ -461,4 +462,12 @@
      *        |NanStatusCode.INVALID_PAIRING_ID|
      */
     void notifyTerminatePairingResponse(in char id, in NanStatus status);
+
+    /**
+     * Callback is invoked when ranging results are available.
+     *
+     * @param results RttResult data.
+     * @param discoverySessionId Discovery session ID.
+     */
+    void notifyRangingResults(in RttResult[] results, in byte discoverySessionId);
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanCapabilities.aidl b/wifi/aidl/android/hardware/wifi/NanCapabilities.aidl
index f581c5e..f9f825f 100644
--- a/wifi/aidl/android/hardware/wifi/NanCapabilities.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanCapabilities.aidl
@@ -16,6 +16,8 @@
 
 package android.hardware.wifi;
 
+import android.hardware.wifi.RttBw;
+
 /**
  * NDP Capabilities response.
  */
@@ -103,4 +105,16 @@
      * Flag to indicate if NAN suspension is supported.
      */
     boolean supportsSuspension;
+    /**
+     * Flag to indicate if NAN periodic ranging is supported.
+     */
+    boolean supportsPeriodicRanging;
+    /**
+     * Maximum supported bandwidth.
+     */
+    RttBw maxSupportedBandwidth;
+    /**
+     * Maximum number of supported receive chains.
+     */
+    int maxNumRxChainsSupported;
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanDiscoveryCommonConfig.aidl b/wifi/aidl/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
index 4bedce0..725ed3c 100644
--- a/wifi/aidl/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanDiscoveryCommonConfig.aidl
@@ -18,6 +18,8 @@
 
 import android.hardware.wifi.NanDataPathSecurityConfig;
 import android.hardware.wifi.NanMatchAlg;
+import android.hardware.wifi.RttPreamble;
+import android.hardware.wifi.WifiChannelInfo;
 
 /**
  * Configurations of NAN discovery sessions. Common to publish and subscribe discovery.
@@ -136,10 +138,14 @@
      */
     boolean rangingRequired;
     /**
-     * Interval in ms between two ranging measurements. Only relevant if |rangingRequired| is true.
+     * Interval in ms between two ranging measurements. Only applies to periodic ranging and is
+     * only relevant if |rangingRequired| is true.
+     *
      * If the Awake DW interval specified either in |discoveryWindowPeriod| or in
      * |NanBandSpecificConfig.discoveryWindowIntervalVal| is larger than the ranging interval then
      * priority is given to Awake DW interval.
+     *
+     * If this is set to 0, then only one ranging is performed.
      */
     int rangingIntervalMs;
     /**
@@ -162,4 +168,16 @@
      * |NanCapabilities.supportsSuspension| is false.
      */
     boolean enableSessionSuspendability;
+    /**
+     * The number of FTM packets used to estimate a range.
+     */
+    int rttBurstSize;
+    /**
+     * RTT preamble to be used in the RTT frames.
+     */
+    RttPreamble preamble;
+    /**
+     * Channel information.
+     */
+    @nullable WifiChannelInfo channelInfo;
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanPublishRequest.aidl b/wifi/aidl/android/hardware/wifi/NanPublishRequest.aidl
index ae75caf..09ea496 100644
--- a/wifi/aidl/android/hardware/wifi/NanPublishRequest.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPublishRequest.aidl
@@ -61,4 +61,9 @@
      * that no vendor data is provided.
      */
     @nullable OuiKeyedData[] vendorData;
+    /**
+     * If |NanCapabilities.supportsPeriodicRanging| is true, then this field specifies whether the
+     * ranging results need to be notified to the Publisher when they are available.
+     */
+    boolean rangingResultsRequired;
 }
diff --git a/wifi/aidl/default/aidl_struct_util.cpp b/wifi/aidl/default/aidl_struct_util.cpp
index bf6c206..75e9bfe 100644
--- a/wifi/aidl/default/aidl_struct_util.cpp
+++ b/wifi/aidl/default/aidl_struct_util.cpp
@@ -26,6 +26,9 @@
 namespace aidl_struct_util {
 
 WifiChannelWidthInMhz convertLegacyWifiChannelWidthToAidl(legacy_hal::wifi_channel_width type);
+bool convertAidlWifiChannelInfoToLegacy(const WifiChannelInfo& aidl_info,
+                                        legacy_hal::wifi_channel_info* legacy_info);
+RttBw convertLegacyRttBwToAidl(legacy_hal::wifi_rtt_bw type);
 
 std::string safeConvertChar(const char* str, size_t max_len) {
     const char* c = str;
@@ -1859,7 +1862,9 @@
     legacy_request->ranging_auto_response = aidl_request.baseConfigs.rangingRequired
                                                     ? legacy_hal::NAN_RANGING_AUTO_RESPONSE_ENABLE
                                                     : legacy_hal::NAN_RANGING_AUTO_RESPONSE_DISABLE;
-    legacy_request->sdea_params.range_report = legacy_hal::NAN_DISABLE_RANGE_REPORT;
+    legacy_request->sdea_params.range_report = aidl_request.rangingResultsRequired
+                                                       ? legacy_hal::NAN_ENABLE_RANGE_REPORT
+                                                       : legacy_hal::NAN_DISABLE_RANGE_REPORT;
     legacy_request->publish_type = convertAidlNanPublishTypeToLegacy(aidl_request.publishType);
     legacy_request->tx_type = convertAidlNanTxTypeToLegacy(aidl_request.txType);
     legacy_request->service_responder_policy = aidl_request.autoAcceptDataPathRequests
@@ -1988,6 +1993,17 @@
     legacy_request->ranging_cfg.distance_ingress_mm =
             aidl_request.baseConfigs.distanceIngressCm * 10;
     legacy_request->ranging_cfg.distance_egress_mm = aidl_request.baseConfigs.distanceEgressCm * 10;
+    legacy_request->ranging_cfg.rtt_burst_size = aidl_request.baseConfigs.rttBurstSize;
+    legacy_request->ranging_cfg.preamble =
+            convertAidlRttPreambleToLegacy(aidl_request.baseConfigs.preamble);
+    if (aidl_request.baseConfigs.channelInfo.has_value()) {
+        if (!convertAidlWifiChannelInfoToLegacy(aidl_request.baseConfigs.channelInfo.value(),
+                                                &legacy_request->ranging_cfg.channel_info)) {
+            LOG(ERROR) << "convertAidlNanSubscribeRequestToLegacy: "
+                          "Unable to convert aidl channel info to legacy";
+            return false;
+        }
+    }
     legacy_request->ranging_auto_response = aidl_request.baseConfigs.rangingRequired
                                                     ? legacy_hal::NAN_RANGING_AUTO_RESPONSE_ENABLE
                                                     : legacy_hal::NAN_RANGING_AUTO_RESPONSE_DISABLE;
@@ -2296,6 +2312,9 @@
     aidl_response->supportsPairing = legacy_response.is_pairing_supported;
     aidl_response->supportsSetClusterId = legacy_response.is_set_cluster_id_supported;
     aidl_response->supportsSuspension = legacy_response.is_suspension_supported;
+    aidl_response->supportsPeriodicRanging = legacy_response.is_periodic_ranging_supported;
+    aidl_response->maxSupportedBandwidth = convertLegacyRttBwToAidl(legacy_response.supported_bw);
+    aidl_response->maxNumRxChainsSupported = legacy_response.num_rx_chains_supported;
 
     return true;
 }
diff --git a/wifi/aidl/default/aidl_struct_util.h b/wifi/aidl/default/aidl_struct_util.h
index 2574f95..9a3c535 100644
--- a/wifi/aidl/default/aidl_struct_util.h
+++ b/wifi/aidl/default/aidl_struct_util.h
@@ -231,6 +231,8 @@
                                       TwtSession* aidl_twt_session);
 bool convertLegacyHalTwtSessionStatsToAidl(legacy_hal::wifi_twt_session_stats twt_stats,
                                            TwtSessionStats* aidl_twt_stats);
+legacy_hal::wifi_rtt_preamble convertAidlRttPreambleToLegacy(RttPreamble type);
+
 }  // namespace aidl_struct_util
 }  // namespace wifi
 }  // namespace hardware
diff --git a/wifi/aidl/default/tests/wifi_nan_iface_unit_tests.cpp b/wifi/aidl/default/tests/wifi_nan_iface_unit_tests.cpp
index d58a9b0..513f440 100644
--- a/wifi/aidl/default/tests/wifi_nan_iface_unit_tests.cpp
+++ b/wifi/aidl/default/tests/wifi_nan_iface_unit_tests.cpp
@@ -138,6 +138,7 @@
     MOCK_METHOD2(notifyResumeResponse, ndk::ScopedAStatus(char16_t, const NanStatus&));
     MOCK_METHOD2(notifyTerminatePairingResponse, ndk::ScopedAStatus(char16_t, const NanStatus&));
     MOCK_METHOD1(eventSuspensionModeChanged, ndk::ScopedAStatus(const NanSuspensionModeChangeInd&));
+    MOCK_METHOD2(notifyRangingResults, ndk::ScopedAStatus(const std::vector<RttResult>&, int8_t));
 };
 
 class WifiNanIfaceTest : public Test {
diff --git a/wifi/aidl/default/wifi_legacy_hal.cpp b/wifi/aidl/default/wifi_legacy_hal.cpp
index bd92a20..8d69013 100644
--- a/wifi/aidl/default/wifi_legacy_hal.cpp
+++ b/wifi/aidl/default/wifi_legacy_hal.cpp
@@ -372,6 +372,16 @@
     }
 }
 
+std::function<void(wifi_rtt_result* rtt_results[], uint32_t num_results, uint16_t session_id)>
+        on_nan_event_ranging_results_callback;
+void onAsyncNanEventRangingResults(wifi_rtt_result* rtt_results[], uint32_t num_results,
+                                   uint16_t session_id) {
+    const auto lock = aidl_sync_util::acquireGlobalLock();
+    if (on_nan_event_ranging_results_callback && rtt_results) {
+        on_nan_event_ranging_results_callback(rtt_results, num_results, session_id);
+    }
+}
+
 std::function<void(const NanPairingRequestInd&)> on_nan_event_pairing_request_user_callback;
 void onAsyncNanEventPairingRequest(NanPairingRequestInd* event) {
     const auto lock = aidl_sync_util::acquireGlobalLock();
@@ -1510,6 +1520,7 @@
     on_nan_event_schedule_update_user_callback = user_callbacks.on_event_schedule_update;
     on_nan_event_suspension_mode_change_user_callback =
             user_callbacks.on_event_suspension_mode_change;
+    on_nan_event_ranging_results_callback = user_callbacks.on_ranging_results;
 
     return global_func_table_.wifi_nan_register_handler(getIfaceHandle(iface_name),
                                                         {onAsyncNanNotifyResponse,
@@ -1534,7 +1545,8 @@
                                                          onAsyncNanEventPairingConfirm,
                                                          onAsyncNanEventBootstrappingRequest,
                                                          onAsyncNanEventBootstrappingConfirm,
-                                                         onAsyncNanEventSuspensionModeChange});
+                                                         onAsyncNanEventSuspensionModeChange,
+                                                         onAsyncNanEventRangingResults});
 }
 
 wifi_error WifiLegacyHal::nanEnableRequest(const std::string& iface_name, transaction_id id,
diff --git a/wifi/aidl/default/wifi_legacy_hal.h b/wifi/aidl/default/wifi_legacy_hal.h
index aa563cb..f603210 100644
--- a/wifi/aidl/default/wifi_legacy_hal.h
+++ b/wifi/aidl/default/wifi_legacy_hal.h
@@ -63,6 +63,7 @@
 using ::NAN_DP_REQUEST_CHANNEL_SETUP;
 using ::NAN_DP_REQUEST_REJECT;
 using ::NAN_DP_RESPONDER_RESPONSE;
+using ::NAN_ENABLE_RANGE_REPORT;
 using ::NAN_GET_CAPABILITIES;
 using ::NAN_MATCH_ALG_MATCH_CONTINUOUS;
 using ::NAN_MATCH_ALG_MATCH_NEVER;
@@ -488,6 +489,8 @@
     std::function<void(const NanBootstrappingRequestInd&)> on_event_bootstrapping_request;
     std::function<void(const NanBootstrappingConfirmInd&)> on_event_bootstrapping_confirm;
     std::function<void(const NanSuspensionModeChangeInd&)> on_event_suspension_mode_change;
+    std::function<void(wifi_rtt_result* rtt_results[], uint32_t num_results, uint16_t session_id)>
+            on_ranging_results;
 };
 
 // Full scan results contain IE info and are hence passed by reference, to
diff --git a/wifi/aidl/default/wifi_nan_iface.cpp b/wifi/aidl/default/wifi_nan_iface.cpp
index 9d50798..950e647 100644
--- a/wifi/aidl/default/wifi_nan_iface.cpp
+++ b/wifi/aidl/default/wifi_nan_iface.cpp
@@ -613,7 +613,36 @@
                     }
                 }
             };
+    callback_handlers.on_ranging_results = [weak_ptr_this](
+                                                   legacy_hal::wifi_rtt_result* rtt_results[],
+                                                   uint32_t num_results, uint16_t session_id) {
+        const auto shared_ptr_this = weak_ptr_this.lock();
+        if (!shared_ptr_this.get() || !shared_ptr_this->isValid()) {
+            LOG(ERROR) << "Callback invoked on an invalid object";
+            return;
+        }
+        if (shared_ptr_this->getMinCallbackVersion() < 3) {
+            LOG(INFO) << "notifyRangingResults requires callback version 3";
+            return;
+        }
 
+        std::vector<const wifi_rtt_result*> legacy_results;
+        std::copy_if(rtt_results, rtt_results + num_results, back_inserter(legacy_results),
+                     [](wifi_rtt_result* rtt_result) { return rtt_result != nullptr; });
+
+        std::vector<RttResult> aidl_results;
+        if (!aidl_struct_util::convertLegacyVectorOfRttResultToAidl(legacy_results,
+                                                                    &aidl_results)) {
+            LOG(ERROR) << "Failed to convert RTT results to AIDL structs";
+            return;
+        }
+
+        for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
+            if (!callback->notifyRangingResults(aidl_results, session_id).isOk()) {
+                LOG(ERROR) << "Failed to invoke the callback";
+            }
+        }
+    };
     legacy_hal::wifi_error legacy_status =
             legacy_hal_.lock()->nanRegisterCallbackHandlers(ifname_, callback_handlers);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
diff --git a/wifi/aidl/vts/functional/wifi_nan_iface_aidl_test.cpp b/wifi/aidl/vts/functional/wifi_nan_iface_aidl_test.cpp
index bc169a4..d646162 100644
--- a/wifi/aidl/vts/functional/wifi_nan_iface_aidl_test.cpp
+++ b/wifi/aidl/vts/functional/wifi_nan_iface_aidl_test.cpp
@@ -58,6 +58,7 @@
 using aidl::android::hardware::wifi::NanStatusCode;
 using aidl::android::hardware::wifi::NanSuspensionModeChangeInd;
 using aidl::android::hardware::wifi::NanTxType;
+using aidl::android::hardware::wifi::RttResult;
 
 #define TIMEOUT_PERIOD 10
 
@@ -106,6 +107,7 @@
         NOTIFY_SUSPEND_RESPONSE,
         NOTIFY_RESUME_RESPONSE,
         NOTIFY_TERMINATE_PAIRING_RESPONSE,
+        NOTIFY_RANGING_RESULTS,
 
         EVENT_CLUSTER_EVENT,
         EVENT_DISABLED,
@@ -400,6 +402,12 @@
             parent_.notify(NOTIFY_TERMINATE_PAIRING_RESPONSE);
             return ndk::ScopedAStatus::ok();
         }
+        ::ndk::ScopedAStatus notifyRangingResults(const std::vector<RttResult>& /* results */,
+                                                  int8_t discoverySessionId) override {
+            parent_.session_id_ = discoverySessionId;
+            parent_.notify(NOTIFY_RANGING_RESULTS);
+            return ndk::ScopedAStatus::ok();
+        }
 
       private:
         WifiNanIfaceAidlTest& parent_;
diff --git a/wifi/legacy_headers/include/hardware_legacy/wifi_nan.h b/wifi/legacy_headers/include/hardware_legacy/wifi_nan.h
index 4e490d9..cd4e86d 100644
--- a/wifi/legacy_headers/include/hardware_legacy/wifi_nan.h
+++ b/wifi/legacy_headers/include/hardware_legacy/wifi_nan.h
@@ -19,6 +19,7 @@
 
 #include <net/if.h>
 #include <stdbool.h>
+#include "rtt.h"
 #include "wifi_hal.h"
 
 #ifdef __cplusplus
@@ -476,6 +477,9 @@
     bool is_pairing_supported;
     bool is_set_cluster_id_supported;
     bool is_suspension_supported;
+    bool is_periodic_ranging_supported;
+    wifi_rtt_bw supported_bw;
+    u8 num_rx_chains_supported;
 } NanCapabilities;
 
 /*
@@ -746,6 +750,12 @@
     u32 distance_ingress_mm;
     /* Egress distance in millmilliimeters (optional) */
     u32 distance_egress_mm;
+    /* Number of FTM frames per burst */
+    u32 rtt_burst_size;
+    /* RTT Measurement Preamble */
+    wifi_rtt_preamble preamble;
+    /* Channel information */
+    wifi_channel_info channel_info;
 } NanRangingCfg;
 
 /* NAN Ranging request's response */
@@ -3103,6 +3113,7 @@
     void (*EventBootstrappingRequest) (NanBootstrappingRequestInd* event);
     void (*EventBootstrappingConfirm) (NanBootstrappingConfirmInd* event);
     void (*EventSuspensionModeChange) (NanSuspensionModeChangeInd* event);
+    void (*EventRangingResults)(wifi_rtt_result* rtt_result[], u32 num_results, u16 session_id);
 } NanCallbackHandler;
 
 /**@brief nan_enable_request