diff --git a/audio/aidl/common/include/Utils.h b/audio/aidl/common/include/Utils.h
index ef312d5..a1008a4 100644
--- a/audio/aidl/common/include/Utils.h
+++ b/audio/aidl/common/include/Utils.h
@@ -174,6 +174,12 @@
     return result;
 }
 
+template <typename E, typename U = std::underlying_type_t<E>,
+          typename = std::enable_if_t<is_bit_position_enum<E>::value>>
+constexpr bool isAnyBitPositionFlagSet(U mask, std::initializer_list<E> flags) {
+    return (mask & makeBitPositionFlagMask<E>(flags)) != 0;
+}
+
 constexpr int32_t frameCountFromDurationUs(long durationUs, int32_t sampleRateHz) {
     return (static_cast<long long>(durationUs) * sampleRateHz) / 1000000LL;
 }
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index 7373073..4a7bfbd 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -56,6 +56,7 @@
 using namespace android;
 using aidl::android::hardware::audio::common::AudioOffloadMetadata;
 using aidl::android::hardware::audio::common::getChannelCount;
+using aidl::android::hardware::audio::common::isAnyBitPositionFlagSet;
 using aidl::android::hardware::audio::common::isBitPositionFlagSet;
 using aidl::android::hardware::audio::common::isTelephonyDeviceType;
 using aidl::android::hardware::audio::common::isValidAudioMode;
@@ -85,6 +86,7 @@
 using aidl::android::media::audio::common::AudioDeviceType;
 using aidl::android::media::audio::common::AudioDualMonoMode;
 using aidl::android::media::audio::common::AudioFormatType;
+using aidl::android::media::audio::common::AudioInputFlags;
 using aidl::android::media::audio::common::AudioIoFlags;
 using aidl::android::media::audio::common::AudioLatencyMode;
 using aidl::android::media::audio::common::AudioMMapPolicy;
@@ -1749,8 +1751,13 @@
     for (const auto& port : ports) {
         // Virtual devices may not require external hardware and thus can always be connected.
         if (port.ext.get<AudioPortExt::device>().device.type.connection ==
-            AudioDeviceDescription::CONNECTION_VIRTUAL)
+                    AudioDeviceDescription::CONNECTION_VIRTUAL ||
+            // SCO devices are handled at low level by DSP, may not be able to check actual
+            // connection.
+            port.ext.get<AudioPortExt::device>().device.type.connection ==
+                    AudioDeviceDescription::CONNECTION_BT_SCO) {
             continue;
+        }
         AudioPort portWithData = GenerateUniqueDeviceAddress(port), connectedPort;
         ScopedAStatus status = module->connectExternalDevice(portWithData, &connectedPort);
         EXPECT_STATUS(EX_ILLEGAL_STATE, status) << "static port " << portWithData.toString();
@@ -3780,6 +3787,19 @@
         }
         for (const auto& portConfig : allPortConfigs) {
             SCOPED_TRACE(portConfig.toString());
+            // Certain types of ports can not be used without special preconditions.
+            if ((IOTraits<Stream>::is_input &&
+                 isAnyBitPositionFlagSet(
+                         portConfig.flags.value().template get<AudioIoFlags::Tag::input>(),
+                         {AudioInputFlags::MMAP_NOIRQ, AudioInputFlags::VOIP_TX,
+                          AudioInputFlags::HW_HOTWORD})) ||
+                (!IOTraits<Stream>::is_input &&
+                 isAnyBitPositionFlagSet(
+                         portConfig.flags.value().template get<AudioIoFlags::Tag::output>(),
+                         {AudioOutputFlags::MMAP_NOIRQ, AudioOutputFlags::VOIP_RX,
+                          AudioOutputFlags::COMPRESS_OFFLOAD, AudioOutputFlags::INCALL_MUSIC}))) {
+                continue;
+            }
             const bool isNonBlocking =
                     IOTraits<Stream>::is_input
                             ? false
diff --git a/camera/device/default/ExternalCameraDeviceSession.cpp b/camera/device/default/ExternalCameraDeviceSession.cpp
index 126b782..91196d4 100644
--- a/camera/device/default/ExternalCameraDeviceSession.cpp
+++ b/camera/device/default/ExternalCameraDeviceSession.cpp
@@ -538,6 +538,19 @@
         return Status::INTERNAL_ERROR;
     }
 
+    if (request.outputBuffers.empty()) {
+        ALOGE("%s: No output buffers provided.", __FUNCTION__);
+        return Status::ILLEGAL_ARGUMENT;
+    }
+
+    for (auto& outputBuf : request.outputBuffers) {
+        if (outputBuf.streamId == -1 || mStreamMap.find(outputBuf.streamId) == mStreamMap.end()) {
+            ALOGE("%s: Invalid streamId in CaptureRequest.outputBuffers: %d", __FUNCTION__,
+                  outputBuf.streamId);
+            return Status::ILLEGAL_ARGUMENT;
+        }
+    }
+
     const camera_metadata_t* rawSettings = nullptr;
     bool converted;
     CameraMetadata settingsFmq;  // settings from FMQ
@@ -572,8 +585,6 @@
         return Status::ILLEGAL_ARGUMENT;
     }
 
-    std::vector<buffer_handle_t*> allBufPtrs;
-    std::vector<int> allFences;
     size_t numOutputBufs = request.outputBuffers.size();
 
     if (numOutputBufs == 0) {
@@ -629,11 +640,6 @@
         }
     }
 
-    status = importRequestLocked(request, allBufPtrs, allFences);
-    if (status != Status::OK) {
-        return status;
-    }
-
     nsecs_t shutterTs = 0;
     std::unique_ptr<V4L2Frame> frameIn = dequeueV4l2FrameLocked(&shutterTs);
     if (frameIn == nullptr) {
@@ -656,8 +662,8 @@
         halBuf.height = stream.height;
         halBuf.format = stream.format;
         halBuf.usage = stream.usage;
-        halBuf.bufPtr = allBufPtrs[i];
-        halBuf.acquireFence = allFences[i];
+        halBuf.bufPtr = nullptr;  // threadloop will request buffer from cameraservice
+        halBuf.acquireFence = 0;  // threadloop will request fence from cameraservice
         halBuf.fenceTimeout = false;
     }
     {
@@ -1351,56 +1357,6 @@
     return false;
 }
 
-Status ExternalCameraDeviceSession::importRequestLocked(const CaptureRequest& request,
-                                                        std::vector<buffer_handle_t*>& allBufPtrs,
-                                                        std::vector<int>& allFences) {
-    return importRequestLockedImpl(request, allBufPtrs, allFences);
-}
-
-Status ExternalCameraDeviceSession::importRequestLockedImpl(
-        const CaptureRequest& request, std::vector<buffer_handle_t*>& allBufPtrs,
-        std::vector<int>& allFences) {
-    size_t numOutputBufs = request.outputBuffers.size();
-    size_t numBufs = numOutputBufs;
-    // Validate all I/O buffers
-    std::vector<buffer_handle_t> allBufs;
-    std::vector<uint64_t> allBufIds;
-    allBufs.resize(numBufs);
-    allBufIds.resize(numBufs);
-    allBufPtrs.resize(numBufs);
-    allFences.resize(numBufs);
-    std::vector<int32_t> streamIds(numBufs);
-
-    for (size_t i = 0; i < numOutputBufs; i++) {
-        allBufs[i] = ::android::makeFromAidl(request.outputBuffers[i].buffer);
-        allBufIds[i] = request.outputBuffers[i].bufferId;
-        allBufPtrs[i] = &allBufs[i];
-        streamIds[i] = request.outputBuffers[i].streamId;
-    }
-
-    {
-        Mutex::Autolock _l(mCbsLock);
-        for (size_t i = 0; i < numBufs; i++) {
-            Status st = importBufferLocked(streamIds[i], allBufIds[i], allBufs[i], &allBufPtrs[i]);
-            if (st != Status::OK) {
-                // Detailed error logs printed in importBuffer
-                return st;
-            }
-        }
-    }
-
-    // All buffers are imported. Now validate output buffer acquire fences
-    for (size_t i = 0; i < numOutputBufs; i++) {
-        if (!sHandleImporter.importFence(
-                    ::android::makeFromAidl(request.outputBuffers[i].acquireFence), allFences[i])) {
-            ALOGE("%s: output buffer %zu acquire fence is invalid", __FUNCTION__, i);
-            cleanupInflightFences(allFences, i);
-            return Status::INTERNAL_ERROR;
-        }
-    }
-    return Status::OK;
-}
-
 Status ExternalCameraDeviceSession::importBuffer(int32_t streamId, uint64_t bufId,
                                                  buffer_handle_t buf,
                                                  /*out*/ buffer_handle_t** outBufPtr) {
@@ -1770,8 +1726,8 @@
         result.outputBuffers[i].bufferId = req->buffers[i].bufferId;
         result.outputBuffers[i].status = BufferStatus::ERROR;
         if (req->buffers[i].acquireFence >= 0) {
-            native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);
-            handle->data[0] = req->buffers[i].acquireFence;
+            // numFds = 0 for error
+            native_handle_t* handle = native_handle_create(/*numFds*/ 0, /*numInts*/ 0);
             result.outputBuffers[i].releaseFence = android::dupToAidl(handle);
             native_handle_delete(handle);
         }
@@ -2005,9 +1961,16 @@
         std::chrono::milliseconds timeout = std::chrono::milliseconds(kReqProcTimeoutMs);
         auto st = mRequestDoneCond.wait_for(lk, timeout);
         if (st == std::cv_status::timeout) {
+            mRequestingBuffer = false;
             ALOGE("%s: wait for buffer request finish timeout!", __FUNCTION__);
             return -1;
         }
+
+        if (mPendingReturnBufferReqs.empty()) {
+            mRequestingBuffer = false;
+            ALOGE("%s: cameraservice did not return any buffers!", __FUNCTION__);
+            return -1;
+        }
     }
     mRequestingBuffer = false;
     *outBufReqs = std::move(mPendingReturnBufferReqs);
@@ -2057,6 +2020,8 @@
     if (!ret.isOk()) {
         ALOGE("%s: Transaction error: %d:%d", __FUNCTION__, ret.getExceptionCode(),
               ret.getServiceSpecificError());
+        mBufferReqs.clear();
+        mRequestDoneCond.notify_one();
         return false;
     }
 
@@ -2065,17 +2030,24 @@
         if (bufRets.size() != mHalBufferReqs.size()) {
             ALOGE("%s: expect %zu buffer requests returned, only got %zu", __FUNCTION__,
                   mHalBufferReqs.size(), bufRets.size());
+            mBufferReqs.clear();
+            lk.unlock();
+            mRequestDoneCond.notify_one();
             return false;
         }
 
         auto parent = mParent.lock();
         if (parent == nullptr) {
             ALOGE("%s: session has been disconnected!", __FUNCTION__);
+            mBufferReqs.clear();
+            lk.unlock();
+            mRequestDoneCond.notify_one();
             return false;
         }
 
         std::vector<int> importedFences;
         importedFences.resize(bufRets.size());
+        bool hasError = false;
         for (size_t i = 0; i < bufRets.size(); i++) {
             int streamId = bufRets[i].streamId;
             switch (bufRets[i].val.getTag()) {
@@ -2086,7 +2058,8 @@
                             bufRets[i].val.get<StreamBuffersVal::Tag::buffers>();
                     if (hBufs.size() != 1) {
                         ALOGE("%s: expect 1 buffer returned, got %zu!", __FUNCTION__, hBufs.size());
-                        return false;
+                        hasError = true;
+                        break;
                     }
                     const StreamBuffer& hBuf = hBufs[0];
 
@@ -2094,31 +2067,47 @@
                     // TODO: create a batch import API so we don't need to lock/unlock mCbsLock
                     // repeatedly?
                     lk.unlock();
-                    Status s =
-                            parent->importBuffer(streamId, hBuf.bufferId, makeFromAidl(hBuf.buffer),
-                                                 /*out*/ &mBufferReqs[i].bufPtr);
+                    native_handle_t* h = makeFromAidl(hBuf.buffer);
+                    Status s = parent->importBuffer(streamId, hBuf.bufferId, h,
+                                                    /*out*/ &mBufferReqs[i].bufPtr);
+                    native_handle_delete(h);
                     lk.lock();
 
                     if (s != Status::OK) {
                         ALOGE("%s: stream %d import buffer failed!", __FUNCTION__, streamId);
                         cleanupInflightFences(importedFences, i - 1);
-                        return false;
+                        hasError = true;
+                        break;
                     }
-                    if (!sHandleImporter.importFence(makeFromAidl(hBuf.acquireFence),
-                                                     mBufferReqs[i].acquireFence)) {
+                    h = makeFromAidl(hBuf.acquireFence);
+                    if (!sHandleImporter.importFence(h, mBufferReqs[i].acquireFence)) {
                         ALOGE("%s: stream %d import fence failed!", __FUNCTION__, streamId);
                         cleanupInflightFences(importedFences, i - 1);
-                        return false;
+                        native_handle_delete(h);
+                        hasError = true;
+                        break;
                     }
+                    native_handle_delete(h);
                     importedFences[i] = mBufferReqs[i].acquireFence;
                 } break;
                 default:
                     ALOGE("%s: Unknown StreamBuffersVal!", __FUNCTION__);
-                    return false;
+                    hasError = true;
+                    break;
+            }
+            if (hasError) {
+                mBufferReqs.clear();
+                lk.unlock();
+                mRequestDoneCond.notify_one();
+                return true;
             }
         }
     } else {
         ALOGE("%s: requestStreamBuffers call failed!", __FUNCTION__);
+        mBufferReqs.clear();
+        lk.unlock();
+        mRequestDoneCond.notify_one();
+        return true;
     }
 
     mPendingReturnBufferReqs = std::move(mBufferReqs);
@@ -2823,6 +2812,11 @@
         if (res != 0) {
             // For some webcam, the first few V4L2 frames might be malformed...
             ALOGE("%s: Convert V4L2 frame to YU12 failed! res %d", __FUNCTION__, res);
+
+            ATRACE_BEGIN("Wait for BufferRequest done");
+            res = waitForBufferRequestDone(&req->buffers);
+            ATRACE_END();
+
             lk.unlock();
             Status st = parent->processCaptureRequestError(req);
             if (st != Status::OK) {
@@ -2838,9 +2832,15 @@
     ATRACE_END();
 
     if (res != 0) {
+        // HAL buffer management buffer request can fail
         ALOGE("%s: wait for BufferRequest done failed! res %d", __FUNCTION__, res);
         lk.unlock();
-        return onDeviceError("%s: failed to process buffer request error!", __FUNCTION__);
+        Status st = parent->processCaptureRequestError(req);
+        if (st != Status::OK) {
+            return onDeviceError("%s: failed to process capture request error!", __FUNCTION__);
+        }
+        signalRequestDone();
+        return true;
     }
 
     ALOGV("%s processing new request", __FUNCTION__);
diff --git a/camera/device/default/ExternalCameraDeviceSession.h b/camera/device/default/ExternalCameraDeviceSession.h
index 736bfd1..795b589 100644
--- a/camera/device/default/ExternalCameraDeviceSession.h
+++ b/camera/device/default/ExternalCameraDeviceSession.h
@@ -266,15 +266,6 @@
                             const std::vector<SupportedV4L2Format>& supportedFormats,
                             const ExternalCameraConfig& cfg);
 
-    // Validate and import request's output buffers and acquire fence
-    Status importRequestLocked(const CaptureRequest& request,
-                               std::vector<buffer_handle_t*>& allBufPtrs,
-                               std::vector<int>& allFences);
-
-    Status importRequestLockedImpl(const CaptureRequest& request,
-                                   std::vector<buffer_handle_t*>& allBufPtrs,
-                                   std::vector<int>& allFences);
-
     Status importBufferLocked(int32_t streamId, uint64_t bufId, buffer_handle_t buf,
                               /*out*/ buffer_handle_t** outBufPtr);
     static void cleanupInflightFences(std::vector<int>& allFences, size_t numFences);
diff --git a/camera/device/default/ExternalCameraOfflineSession.cpp b/camera/device/default/ExternalCameraOfflineSession.cpp
index 536fa47..2d4e2e0 100644
--- a/camera/device/default/ExternalCameraOfflineSession.cpp
+++ b/camera/device/default/ExternalCameraOfflineSession.cpp
@@ -111,6 +111,7 @@
                 native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);
                 handle->data[0] = req->buffers[i].acquireFence;
                 result.outputBuffers[i].releaseFence = android::dupToAidl(handle);
+                native_handle_delete(handle);
             }
             notifyError(req->frameNumber, req->buffers[i].streamId, ErrorCode::ERROR_BUFFER);
         } else {
@@ -120,6 +121,7 @@
                 native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);
                 handle->data[0] = req->buffers[i].acquireFence;
                 outputBuffer.releaseFence = android::dupToAidl(handle);
+                native_handle_delete(handle);
             }
         }
     }
@@ -248,6 +250,7 @@
             native_handle_t* handle = native_handle_create(/*numFds*/ 1, /*numInts*/ 0);
             handle->data[0] = req->buffers[i].acquireFence;
             outputBuffer.releaseFence = dupToAidl(handle);
+            native_handle_delete(handle);
         }
     }
 
diff --git a/identity/aidl/default/Android.bp b/identity/aidl/default/Android.bp
index 7bc3c8d..a1045c3 100644
--- a/identity/aidl/default/Android.bp
+++ b/identity/aidl/default/Android.bp
@@ -36,7 +36,7 @@
     ],
     static_libs: [
         "libbase",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libutils",
         "libsoft_attestation_cert",
@@ -102,7 +102,7 @@
     ],
     static_libs: [
         "libbase",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libutils",
         "libsoft_attestation_cert",
@@ -146,7 +146,7 @@
     ],
     static_libs: [
         "libbase",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libutils",
         "libsoft_attestation_cert",
diff --git a/identity/aidl/vts/Android.bp b/identity/aidl/vts/Android.bp
index 6f7ab54..8ff2382 100644
--- a/identity/aidl/vts/Android.bp
+++ b/identity/aidl/vts/Android.bp
@@ -42,7 +42,7 @@
         "android.hardware.security.rkp-V3-cpp",
         "android.hardware.security.rkp-V3-ndk",
         "android.hardware.security.secureclock-V1-ndk",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libkeymaster_portable",
         "libkeymint_vts_test_utils",
diff --git a/identity/support/Android.bp b/identity/support/Android.bp
index d62d055..cc0a684 100644
--- a/identity/support/Android.bp
+++ b/identity/support/Android.bp
@@ -36,7 +36,7 @@
         "libpuresoftkeymasterdevice",
     ],
     static_libs: [
-        "libcppbor_external",
+        "libcppbor",
     ],
 }
 
@@ -70,7 +70,7 @@
     ],
     static_libs: [
         "android.hardware.identity-support-lib",
-        "libcppbor_external",
+        "libcppbor",
         "libgmock",
     ],
     test_suites: ["general-tests"],
diff --git a/security/keymint/aidl/default/Android.bp b/security/keymint/aidl/default/Android.bp
index c707845..0cf53cf 100644
--- a/security/keymint/aidl/default/Android.bp
+++ b/security/keymint/aidl/default/Android.bp
@@ -30,7 +30,7 @@
         "android.hardware.security.secureclock-V1-ndk",
         "libbase",
         "libbinder_ndk",
-        "libcppbor_external",
+        "libcppbor",
         "libcrypto",
         "libkeymaster_portable",
         "libkeymint",
@@ -115,5 +115,47 @@
         "libkmr_wire",
     ],
     srcs: ["ta/lib.rs"],
+}
 
+apex {
+    name: "com.android.hardware.keymint.rust_nonsecure",
+    manifest: "manifest.json",
+    file_contexts: "file_contexts",
+    key: "com.google.cf.apex.key",
+    certificate: ":com.android.hardware.certificate",
+    soc_specific: true,
+    updatable: false,
+    binaries: [
+        "android.hardware.security.keymint-service.nonsecure",
+    ],
+    prebuilts: [
+        "keymint_aidl_nonsecure_init_rc",
+        "keymint_aidl_nonsecure_vintf",
+        "android.hardware.hardware_keystore.xml", // permissions
+    ],
+}
+
+prebuilt_etc {
+    name: "keymint_aidl_nonsecure_init_rc",
+    filename_from_src: true,
+    vendor: true,
+    src: ":gen-keymint_aidl_nonsecure_init_rc",
+}
+
+genrule {
+    name: "gen-keymint_aidl_nonsecure_init_rc",
+    srcs: ["android.hardware.security.keymint-service.nonsecure.rc"],
+    out: ["android.hardware.security.keymint-service.nonsecure.apex.rc"],
+    cmd: "sed -E 's%/vendor/bin/%/apex/com.android.hardware.keymint/bin/%' $(in) > $(out)",
+}
+
+prebuilt_etc {
+    name: "keymint_aidl_nonsecure_vintf",
+    sub_dir: "vintf",
+    vendor: true,
+    srcs: [
+        "android.hardware.security.keymint-service.xml",
+        "android.hardware.security.sharedsecret-service.xml",
+        "android.hardware.security.secureclock-service.xml",
+    ],
 }
diff --git a/security/keymint/aidl/default/file_contexts b/security/keymint/aidl/default/file_contexts
new file mode 100644
index 0000000..dce7e3c
--- /dev/null
+++ b/security/keymint/aidl/default/file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                                                           u:object_r:vendor_file:s0
+/etc(/.*)?                                                       u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.security\.keymint-service\.nonsecure  u:object_r:hal_keymint_rust_exec:s0
diff --git a/security/keymint/aidl/default/manifest.json b/security/keymint/aidl/default/manifest.json
new file mode 100644
index 0000000..289943e
--- /dev/null
+++ b/security/keymint/aidl/default/manifest.json
@@ -0,0 +1,5 @@
+{
+    "name": "com.android.hardware.keymint",
+    "version": 1,
+    "vendorBootstrap": true
+}
diff --git a/security/keymint/aidl/vts/functional/Android.bp b/security/keymint/aidl/vts/functional/Android.bp
index 41b161d..7a135e1 100644
--- a/security/keymint/aidl/vts/functional/Android.bp
+++ b/security/keymint/aidl/vts/functional/Android.bp
@@ -45,7 +45,7 @@
         "android.hardware.security.secureclock-V1-ndk",
         "libavb_user",
         "libavb",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libfs_mgr",
         "libjsoncpp",
diff --git a/security/keymint/aidl/vts/performance/Android.bp b/security/keymint/aidl/vts/performance/Android.bp
index 7e3a3e5..6179c99 100644
--- a/security/keymint/aidl/vts/performance/Android.bp
+++ b/security/keymint/aidl/vts/performance/Android.bp
@@ -41,7 +41,7 @@
     ],
     static_libs: [
         "android.hardware.security.secureclock-V1-ndk",
-        "libcppbor_external",
+        "libcppbor",
         "libchrome",
     ],
 }
diff --git a/security/keymint/support/Android.bp b/security/keymint/support/Android.bp
index 1a8695b..5c9efef 100644
--- a/security/keymint/support/Android.bp
+++ b/security/keymint/support/Android.bp
@@ -72,7 +72,7 @@
     shared_libs: [
         "libbase",
         "libbinder_ndk",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libcrypto",
         "libkeymaster_portable",
@@ -94,7 +94,7 @@
     ],
     shared_libs: [
         "libbase",
-        "libcppbor_external",
+        "libcppbor",
         "libcppcose_rkp",
         "libcrypto",
         "libjsoncpp",
diff --git a/security/rkp/aidl/vts/functional/Android.bp b/security/rkp/aidl/vts/functional/Android.bp
index 9c2b6e1..2cce8db 100644
--- a/security/rkp/aidl/vts/functional/Android.bp
+++ b/security/rkp/aidl/vts/functional/Android.bp
@@ -32,7 +32,7 @@
         "libcrypto",
     ],
     static_libs: [
-        "libcppbor_external",
+        "libcppbor",
         "libgmock_ndk",
         "libkeymint_vts_test_utils",
     ],
diff --git a/security/sharedsecret/aidl/android/hardware/security/sharedsecret/ISharedSecret.aidl b/security/sharedsecret/aidl/android/hardware/security/sharedsecret/ISharedSecret.aidl
index eca8d87..b0dd284 100644
--- a/security/sharedsecret/aidl/android/hardware/security/sharedsecret/ISharedSecret.aidl
+++ b/security/sharedsecret/aidl/android/hardware/security/sharedsecret/ISharedSecret.aidl
@@ -81,14 +81,9 @@
      *           defined in the standard.  The counter is prefixed and length L appended, as shown
      *           in the construction on page 12 of the standard.  The label string is UTF-8 encoded.
      *
-     *     ``K'' is a pre-established shared secret, set up during factory reset.  The mechanism for
-     *           establishing this shared secret is implementation-defined.Any method of securely
-     *           establishing K that ensures that an attacker cannot obtain or derive its value is
-     *           acceptable.
-     *
-     *           CRITICAL SECURITY REQUIREMENT: All keys created by a IKeymintDevice instance must
-     *           be cryptographically bound to the value of K, such that establishing a new K
-     *           permanently destroys them.
+     *     ``K'' is a pre-established shared secret.  The mechanism for establishing this shared
+     *           secret is implementation-defined.  Any method of securely establishing K that
+     *           ensures that an attacker cannot obtain or derive its value is acceptable.
      *
      *     ``||'' represents concatenation.
      *
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
index 8ad6ee0..491a79b 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTargetTest.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <android/binder_manager.h>
+#include <cutils/properties.h>
 
 #include "DemuxTests.h"
 #include "DescramblerTests.h"
@@ -29,6 +30,17 @@
 namespace {
 
 bool initConfiguration() {
+    std::array<char, PROPERTY_VALUE_MAX> variant;
+    auto res = property_get("ro.vendor.vts_tuner_configuration_variant", variant.data(), "");
+    if (res <= 0) {
+        ALOGE("[vts] failed to read system property ro.vendor.vts_tuner_configuration_variant");
+        return false;
+    }
+    string configFilePath = "/vendor/etc/tuner_vts_config_aidl_V1";
+    if (variant.size() != 0) {
+        configFilePath = configFilePath + "."  + variant.data();
+    }
+    configFilePath = configFilePath + ".xml";
     TunerTestingConfigAidlReader1_0::setConfigFilePath(configFilePath);
     if (!TunerTestingConfigAidlReader1_0::checkConfigFileExists()) {
         return false;
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
index ff94639..29d2f18 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
@@ -52,8 +52,6 @@
 const int32_t FMQ_SIZE_4M = 0x400000;
 const int32_t FMQ_SIZE_16M = 0x1000000;
 
-const string configFilePath = "/vendor/etc/tuner_vts_config_aidl_V1.xml";
-
 #define FILTER_MAIN_TYPE_BIT_COUNT 5
 #define STATUS_CHECK_INTERVAL_MS 100L