Merge "HAL changes for Passpoint T&C"
diff --git a/audio/7.0/types.hal b/audio/7.0/types.hal
index 4a9e289..7c050c1 100644
--- a/audio/7.0/types.hal
+++ b/audio/7.0/types.hal
@@ -30,7 +30,6 @@
     NOT_SUPPORTED
 };
 
-@export(name="audio_drain_type_t", value_prefix="AUDIO_DRAIN_")
 enum AudioDrain : int32_t {
     /** drain() returns when all data has been played. */
     ALL,
@@ -315,7 +314,7 @@
  * Behavior when the values for speed and / or pitch are out
  * of applicable range.
  */
-@export(name="audio_timestretch_fallback_mode_t", value_prefix="AUDIO_TIMESTRETCH_FALLBACK_")
+@export(name="", value_prefix="HAL_AUDIO_TIMESTRETCH_FALLBACK_")
 enum TimestretchFallbackMode : int32_t {
     // Need to be in sync with AUDIO_FALLBACK_MODE_* constants in
     // frameworks/base/media/java/android/media/PlaybackParams.java
diff --git a/audio/common/7.0/types.hal b/audio/common/7.0/types.hal
index 0d0fa7e..631d524 100644
--- a/audio/common/7.0/types.hal
+++ b/audio/common/7.0/types.hal
@@ -78,6 +78,7 @@
  */
 typedef int32_t AudioSession;
 
+@export(name="", value_prefix="HAL_AUDIO_SESSION_")
 enum AudioSessionConsts : int32_t {
     /**
      * Session for effects attached to a particular sink or source audio device
@@ -137,7 +138,7 @@
  * Major modes for a mobile device. The current mode setting affects audio
  * routing.
  */
-@export(name="audio_mode_t", value_prefix="AUDIO_MODE_")
+@export(name="", value_prefix="HAL_AUDIO_MODE_")
 enum AudioMode : int32_t {
     NORMAL           = 0,
     RINGTONE         = 1,
@@ -222,6 +223,27 @@
 };
 
 /**
+ * Enumeration of metadata types permitted for use by
+ * encapsulation mode audio streams.
+ */
+@export(name="audio_encapsulation_metadata_type_t", value_prefix="AUDIO_ENCAPSULATION_METADATA_TYPE_")
+enum AudioEncapsulationMetadataType : int32_t {
+    /**
+     * No metadata.
+     */
+    NONE              = 0,
+    /**
+     * Encapsulation metadata type for framework tuner information.
+     */
+    FRAMEWORK_TUNER   = 1,
+    /**
+     * Encapsulation metadata type for DVB AD descriptor.
+     * This metadata is formatted per ETSI TS 101 154 Table E.1: AD_descriptor.
+     */
+    DVB_AD_DESCRIPTOR = 2,
+};
+
+/**
  * Additional information about the stream passed to hardware decoders.
  */
 struct AudioOffloadInfo {
diff --git a/audio/core/all-versions/default/StreamOut.cpp b/audio/core/all-versions/default/StreamOut.cpp
index 1519c48..007eb45 100644
--- a/audio/core/all-versions/default/StreamOut.cpp
+++ b/audio/core/all-versions/default/StreamOut.cpp
@@ -496,11 +496,11 @@
 }
 
 Return<Result> StreamOut::drain(AudioDrain type) {
+    audio_drain_type_t halDrainType =
+            type == AudioDrain::EARLY_NOTIFY ? AUDIO_DRAIN_EARLY_NOTIFY : AUDIO_DRAIN_ALL;
     return mStream->drain != NULL
-                   ? Stream::analyzeStatus(
-                             "drain",
-                             mStream->drain(mStream, static_cast<audio_drain_type_t>(type)),
-                             {ENOSYS} /*ignore*/)
+                   ? Stream::analyzeStatus("drain", mStream->drain(mStream, halDrainType),
+                                           {ENOSYS} /*ignore*/)
                    : Result::NOT_SUPPORTED;
 }
 
diff --git a/biometrics/face/aidl/Android.bp b/biometrics/face/aidl/Android.bp
index 4f8b71d..a4fcbfe 100644
--- a/biometrics/face/aidl/Android.bp
+++ b/biometrics/face/aidl/Android.bp
@@ -12,8 +12,7 @@
     stability: "vintf",
     backend: {
         java: {
-            enabled: false,
-            platform_apis: false,
+            platform_apis: true,
         },
         cpp: {
             enabled: false,
diff --git a/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/AcquiredInfo.aidl b/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/AcquiredInfo.aidl
index 011b711..88c066c 100644
--- a/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/AcquiredInfo.aidl
+++ b/biometrics/face/aidl/aidl_api/android.hardware.biometrics.face/current/android/hardware/biometrics/face/AcquiredInfo.aidl
@@ -41,4 +41,5 @@
   START = 20,
   SENSOR_DIRTY = 21,
   VENDOR = 22,
+  FIRST_FRAME_RECEIVED = 23,
 }
diff --git a/biometrics/face/aidl/android/hardware/biometrics/face/AcquiredInfo.aidl b/biometrics/face/aidl/android/hardware/biometrics/face/AcquiredInfo.aidl
index fffb418..5897cdc 100644
--- a/biometrics/face/aidl/android/hardware/biometrics/face/AcquiredInfo.aidl
+++ b/biometrics/face/aidl/android/hardware/biometrics/face/AcquiredInfo.aidl
@@ -198,10 +198,9 @@
     /**
      * This message represents the earliest message sent at the beginning of the authentication
      * pipeline. It is expected to be used to measure latency. For example, in a camera-based
-     * authentication system it's expected to be sent prior to camera initialization. Note this
-     * should be sent whenever authentication is restarted (see IBiometricsFace#userActivity).
-     * The framework will measure latency based on the time between the last START message and the
-     * onAuthenticated callback.
+     * authentication system it's expected to be sent prior to camera initialization. The framework
+     * will measure latency based on the time between the last START message and the onAuthenticated
+     * callback.
      */
     START = 20,
 
@@ -213,7 +212,12 @@
     /**
      * Vendor-specific acquisition message. See ISessionCallback#onAcquired vendorCode
      * documentation.
-    */
-    VENDOR = 22
+     */
+    VENDOR = 22,
+
+    /**
+     * The first frame from the camera has been received.
+     */
+    FIRST_FRAME_RECEIVED = 23
 }
 
diff --git a/current.txt b/current.txt
index d8ca42c..7ef176b 100644
--- a/current.txt
+++ b/current.txt
@@ -767,11 +767,13 @@
 98592d193a717066facf91428426e5abe211e3bd718bc372e29fb944ddbe6e7c android.hardware.wifi.supplicant@1.3::types
 
 # ABI preserving changes to HALs during Android S
+1ca372cd67d197df099e87616a613ba6ede6552638a603e18f86c8834302c3d1 android.hardware.gnss@1.0::IGnssMeasurementCallback
+6a271e493907e8ba20912e42771bd0d99ae45431a851d5675ef9496d02510a34 android.hardware.gnss@1.1::IGnssMeasurementCallback
 3da3ce039247872d95c6bd48621dbfdfa1c2d2a91a90f257862f87ee2bc46300 android.hardware.health@2.1::types
 cd84ab19c590e0e73dd2307b591a3093ee18147ef95e6d5418644463a6620076 android.hardware.neuralnetworks@1.2::IDevice
 9625e85f56515ad2cf87b6a1847906db669f746ea4ab02cd3d4ca25abc9b0109 android.hardware.neuralnetworks@1.2::types
 9e758e208d14f7256e0885d6d8ad0b61121b21d8c313864f981727ae55bffd16 android.hardware.neuralnetworks@1.3::types
-7da2707d4cf93818eaf8038eb65e2180116a399c310e594a00935c5c981aa340 android.hardware.radio@1.0::types
+0f53d70e1eadf8d987766db4bf6ae2048004682168f4cab118da576787def3fa android.hardware.radio@1.0::types
 38d65fb20c60a5b823298560fc0825457ecdc49603a4b4e94bf81511790737da android.hardware.radio@1.4::types
 954c334efd80e8869b66d1ce5fe2755712d96ba4b3c38d415739c330af5fb4cb android.hardware.radio@1.5::types
 
diff --git a/gnss/1.0/IGnssMeasurementCallback.hal b/gnss/1.0/IGnssMeasurementCallback.hal
index 2d44766..d219af0 100644
--- a/gnss/1.0/IGnssMeasurementCallback.hal
+++ b/gnss/1.0/IGnssMeasurementCallback.hal
@@ -106,8 +106,63 @@
         STATE_GLO_TOD_KNOWN          = 1 << 15,
     };
 
-    /**
+     /**
      * Flags indicating the Accumulated Delta Range's states.
+     *
+     * See the table below for a detailed interpretation of each state.
+     *
+     * +---------------------+-------------------+-----------------------------+
+     * | ADR_STATE           | Time of relevance | Interpretation              |
+     * +---------------------+-------------------+-----------------------------+
+     * | UNKNOWN             | ADR(t)            | No valid carrier phase      |
+     * |                     |                   | information is available    |
+     * |                     |                   | at time t.                  |
+     * +---------------------+-------------------+-----------------------------+
+     * | VALID               | ADR(t)            | Valid carrier phase         |
+     * |                     |                   | information is available    |
+     * |                     |                   | at time t. This indicates   |
+     * |                     |                   | that this measurement can   |
+     * |                     |                   | be used as a reference for  |
+     * |                     |                   | future measurements.        |
+     * |                     |                   | However, to compare it to   |
+     * |                     |                   | previous measurements to    |
+     * |                     |                   | compute delta range,        |
+     * |                     |                   | other bits should be        |
+     * |                     |                   | checked. Specifically, it   |
+     * |                     |                   | can be used for delta range |
+     * |                     |                   | computation if it is valid  |
+     * |                     |                   | and has no reset or cycle   |
+     * |                     |                   | slip at this epoch i.e.     |
+     * |                     |                   | if VALID_BIT == 1 &&        |
+     * |                     |                   | CYCLE_SLIP_BIT == 0 &&      |
+     * |                     |                   | RESET_BIT == 0.             |
+     * +---------------------+-------------------+-----------------------------+
+     * | RESET               | ADR(t) - ADR(t-1) | Carrier phase accumulation  |
+     * |                     |                   | has been restarted between  |
+     * |                     |                   | current time t and previous |
+     * |                     |                   | time t-1. This indicates    |
+     * |                     |                   | that this measurement can   |
+     * |                     |                   | be used as a reference for  |
+     * |                     |                   | future measurements, but it |
+     * |                     |                   | should not be compared to   |
+     * |                     |                   | previous measurements to    |
+     * |                     |                   | compute delta range.        |
+     * +---------------------+-------------------+-----------------------------+
+     * | CYCLE_SLIP          | ADR(t) - ADR(t-1) | Cycle slip(s) have been     |
+     * |                     |                   | detected between the        |
+     * |                     |                   | current time t and previous |
+     * |                     |                   | time t-1. This indicates    |
+     * |                     |                   | that this measurement can   |
+     * |                     |                   | be used as a reference for  |
+     * |                     |                   | future measurements.        |
+     * |                     |                   | Clients can use a           |
+     * |                     |                   | measurement with a cycle    |
+     * |                     |                   | slip to compute delta range |
+     * |                     |                   | against previous            |
+     * |                     |                   | measurements at their own   |
+     * |                     |                   | risk.                       |
+     * +---------------------+-------------------+-----------------------------+
+     *
      */
     @export(name="", value_prefix="GNSS_")
     enum GnssAccumulatedDeltaRangeState : uint16_t {
diff --git a/gnss/1.1/IGnssMeasurementCallback.hal b/gnss/1.1/IGnssMeasurementCallback.hal
index 5a60a56..36841ee 100644
--- a/gnss/1.1/IGnssMeasurementCallback.hal
+++ b/gnss/1.1/IGnssMeasurementCallback.hal
@@ -20,8 +20,18 @@
 
 /** The callback interface to report measurements from the HAL. */
 interface IGnssMeasurementCallback extends @1.0::IGnssMeasurementCallback {
-    /**
+     /**
      * Flags indicating the Accumulated Delta Range's states.
+     *
+     * See the table below for a detailed interpretation of each state. This is
+     * a continuation of the table from 1.1/IGnssMeasurementCallback.hal.
+     *
+     * +---------------------+-------------------+-----------------------------+
+     * | ADR_STATE           | Time of relevance | Interpretation              |
+     * +---------------------+-------------------+-----------------------------+
+     * | HALF_CYCLE_RESOLVED | ADR(t)            | Half cycle ambiguity is     |
+     * |                     |                   | resolved at time t.         |
+     * +---------------------+-------------------+-----------------------------+
      */
     enum GnssAccumulatedDeltaRangeState
             : @1.0::IGnssMeasurementCallback.GnssAccumulatedDeltaRangeState {
diff --git a/gnss/common/utils/default/include/v2_1/GnssTemplate.h b/gnss/common/utils/default/include/v2_1/GnssTemplate.h
index 7c3c58a..cbf3933 100644
--- a/gnss/common/utils/default/include/v2_1/GnssTemplate.h
+++ b/gnss/common/utils/default/include/v2_1/GnssTemplate.h
@@ -689,6 +689,10 @@
 template <class T_IGnss>
 Return<void> GnssTemplate<T_IGnss>::debug(const hidl_handle& fd,
                                           const hidl_vec<hidl_string>& options) {
+    if (fd == nullptr || fd->numFds == 0) {
+        return Void();
+    }
+
     if (options.size() == 0) {
         return help(fd);
     } else if (options[0] == "location") {
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 025aa7c..cafa5a6 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -166,11 +166,15 @@
 };
 
 enum CardState : int32_t {
+    /* card is physically absent from device. (Some old modems use CardState.ABSENT when the SIM
+       is powered off. This is no longer correct, however the platform will still support this
+       legacy behavior.) */
     ABSENT,
+    /* card is inserted in the device */
     PRESENT,
     ERROR,
-    RESTRICTED,                           // card is present but not usable due to carrier
-                                          // restrictions
+    /* card is present but not usable due to carrier restrictions */
+    RESTRICTED,
 };
 
 enum PinState : int32_t {
diff --git a/radio/1.5/vts/functional/radio_hidl_hal_api.cpp b/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
index ca1593f..7166654 100644
--- a/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.5/vts/functional/radio_hidl_hal_api.cpp
@@ -437,6 +437,7 @@
 TEST_P(RadioHidlTest_v1_5, togglingUiccApplicationsSimPresent) {
     // This test case only test SIM ABSENT case.
     if (cardStatus.base.base.base.cardState != CardState::PRESENT) return;
+    if (cardStatus.applications.size() == 0) return;
 
     // Disable Uicc applications.
     serial = GetRandomSerialNumber();
diff --git a/radio/1.6/IRadio.hal b/radio/1.6/IRadio.hal
index ca40a17..eb20542 100644
--- a/radio/1.6/IRadio.hal
+++ b/radio/1.6/IRadio.hal
@@ -19,6 +19,7 @@
 
 import @1.0::CdmaSmsMessage;
 import @1.0::GsmSmsMessage;
+import @1.1::CardPowerState;
 import @1.2::DataRequestReason;
 import @1.5::IRadio;
 import @1.5::AccessNetwork;
@@ -183,6 +184,42 @@
     oneway sendCdmaSmsExpectMore_1_6(int32_t serial, CdmaSmsMessage sms);
 
     /**
+     * Set SIM card power state.
+     * Request is used to power off or power on the card. It should not generate
+     * a CardState.CARDSTATE_ABSENT indication, since the SIM is still physically
+     * inserted.
+     *
+     * @param serial Serial number of request
+     * @param powerUp POWER_DOWN if powering down the SIM card,
+     *                POWER_UP if powering up the SIM card,
+     *                POWER_UP_PASS_THROUGH if powering up the SIM card in
+     *                                      pass through mode.
+     *
+     * When SIM card is in POWER_UP_PASS_THROUGH, the modem does not send
+     * any command to it (for example SELECT of MF, or TERMINAL
+     * CAPABILITY), and the SIM card is controlled completely by Telephony
+     * sending APDUs directly. The SIM card state must be
+     * RIL_CARDSTATE_PRESENT and the number of card apps will be 0.
+     * No new error code is generated. Emergency calls are supported in
+     * the same way as if the SIM card is absent.
+     * Pass-through mode is valid only for the specific card session where
+     * it is activated, and normal behavior occurs at the next SIM
+     * initialization, unless POWER_UP_PASS_THROUGH is requested again.
+     *
+     * The device is required to power down the SIM card before it can
+     * switch the mode between POWER_UP and POWER_UP_PASS_THROUGH.
+     * At device power up, the SIM interface is powered up automatically.
+     * Each subsequent request to this method is processed only after the
+     * completion of the previous one.
+     *
+     * Response callback is IRadioResponse.setSimCardPowerResponse_1_6().
+     * Note that this differs from setSimCardPower_1_1 in that the response
+     * callback should only be sent once the device has finished executing
+     * the request (the SIM has finished powering on or off).
+     */
+    oneway setSimCardPower_1_6(int32_t serial, CardPowerState powerUp);
+
+    /**
      * Enable or disable E-UTRA-NR dual connectivity. If disabled then UE will not connect
      * to secondary carrier.
      *
@@ -205,4 +242,67 @@
      * Response callback is IRadioResponse.isNRDualConnectivityEnabledResponse()
      */
     oneway isNrDualConnectivityEnabled(int32_t serial);
+
+    /**
+     * Reserves an unallocated pdu session id from the pool of ids.
+     *
+     * The allocated id is returned in the response.
+     *
+     * When the id is no longer needed, call releasePduSessionId to
+     * return it to the pool.
+     *
+     * Reference: 3GPP TS 24.007 section 11.2.3.1b
+     *
+     * @param serial Serial number of request.
+     *
+     * Response function is IRadioResponse.allocatePduSessionIdResponse()
+     */
+    oneway allocatePduSessionId(int32_t serial);
+
+    /**
+     * Releases a pdu session id that was previously allocated using
+     * allocatePduSessionId.
+     *
+     * Reference: 3GPP TS 24.007 section 11.2.3.1b
+     * @param serial Serial number of request.
+     * @param id Pdu session id to release.
+     *
+     * Response function is IRadioResponse.releasePduSessionIdResponse()
+     */
+    oneway releasePduSessionId(int32_t serial, int32_t id);
+
+    /**
+     * Indicates that a handover to the IWLAN transport has begun.
+     *
+     * Any resources being transferred to the IWlan transport cannot be released while a
+     * handover is underway. For example, if a pdu session id needs to be
+     * transferred to IWlan, then, the modem should not release the id while
+     * the handover is in progress.
+     *
+     * If a handover was unsuccessful, then the framework calls IRadio::cancelHandover.
+     * The modem retains ownership over any of the resources being transferred to IWlan.
+     *
+     * If a handover was successful, the framework calls IRadio::deactivateDataCall with reason
+     * HANDOVER. The IWlan transport now owns the transferred resources and is responsible for
+     * releasing them.
+     *
+     * @param serial Serial number of request.
+     * @param id callId The identifier of the data call which is provided in SetupDataCallResult
+     *
+     * Response function is IRadioResponse.beginHandoverResponse()
+     */
+    oneway beginHandover(int32_t serial, int32_t callId);
+
+    /**
+     * Indicates that a handover was cancelled after a call to IRadio::beginHandover.
+     *
+     * Since the handover was unsuccessful, the modem retains ownership over any of the resources
+     * being transferred and is still responsible for releasing them.
+     *
+     * @param serial Serial number of request.
+     * @param id callId The identifier of the data call which is provided in SetupDataCallResult
+     *
+     * Response function is IRadioResponse.cancelHandoverResponse()
+     */
+    oneway cancelHandover(int32_t serial, int32_t callId);
 };
diff --git a/radio/1.6/IRadioResponse.hal b/radio/1.6/IRadioResponse.hal
index 4ff7e47..07322be 100644
--- a/radio/1.6/IRadioResponse.hal
+++ b/radio/1.6/IRadioResponse.hal
@@ -207,6 +207,22 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:SIM_ERR (indicates a timeout or other issue making the SIM unresponsive)
+     *
+     * Note that this differs from setSimCardPowerResponse_1_1 in that the response
+     * should only be sent once the request from setSimCardPower_1_6 is complete
+     * (the SIM has finished powering on or off).
+     */
+    oneway setSimCardPowerResponse_1_6(RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INTERNAL_ERR
      */
     oneway enableNrDualConnectivityResponse(RadioResponseInfo info);
@@ -222,4 +238,56 @@
      *   RadioError:INTERNAL_ERR
      */
     oneway isNrDualConnectivityEnabledResponse(RadioResponseInfo info, bool isEnabled);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param id The allocated id. On an error, this is set to -1
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_RESOURCES- Indicates that no pdu session ids are available
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     */
+    oneway allocatePduSessionIdResponse(RadioResponseInfo info, int32_t id);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_RESOURCES
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     */
+    oneway releasePduSessionIdResponse(RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_RESOURCES
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_CALL_ID
+     */
+    oneway beginHandoverResponse(RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     * @param dcResponse Attributes of data call
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_RESOURCES
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_CALL_ID
+     */
+    oneway cancelHandoverResponse(RadioResponseInfo info);
 };
diff --git a/radio/1.6/types.hal b/radio/1.6/types.hal
index 07b4977..8f842a3 100644
--- a/radio/1.6/types.hal
+++ b/radio/1.6/types.hal
@@ -18,8 +18,10 @@
 
 import @1.0::RadioError;
 import @1.0::RadioResponseType;
-import @1.5::SetupDataCallResult;
-
+import @1.4::DataCallFailCause;
+import @1.4::DataConnActiveStatus;
+import @1.4::PdpProtocolType;
+import @1.5::LinkAddress;
 import android.hidl.safe_union@1.0::Monostate;
 
 struct QosBandwidth {
@@ -240,8 +242,72 @@
     NO_FALLBACK_RETRY_SETUP_NORMAL = 3
 };
 
+/**
+ * Overwritten from @1.5::SetupDataCallResult in order to change the suggestedRetryTime
+ * to 64-bit value. In the future, this must be extended instead of overwritten.
+ * Also added defaultQos, qosSessions, and handoverFailureMode in this version.
+ */
 struct SetupDataCallResult {
-    @1.5::SetupDataCallResult base;
+    /** Data call fail cause. DataCallFailCause.NONE if no error. */
+    DataCallFailCause cause;
+
+    /**
+     * If cause is not DataCallFailCause.NONE, this field indicates the network suggested data
+     * retry back-off time in milliseconds. Negative value indicates network does not give any
+     * suggestion. 0 indicates retry should be performed immediately. 0x7fffffffffffffff indicates
+     * the device should not retry data setup anymore.
+     */
+    uint64_t suggestedRetryTime;
+
+    /** Context ID, uniquely identifies this data connection. */
+    int32_t cid;
+
+    /** Data connection active status. */
+    DataConnActiveStatus active;
+
+    /**
+     * PDP protocol type. If cause is DataCallFailCause.ONLY_SINGLE_BEARER_ALLOWED, this is the
+     * protocol type supported, such as "IP" or "IPV6".
+     */
+    PdpProtocolType type;
+
+    /** The network interface name. */
+    string ifname;
+
+    /**
+     * List of link address.
+     */
+    vec<LinkAddress> addresses;
+
+    /**
+     * List of DNS server addresses, e.g., "192.0.1.3" or "192.0.1.11 2001:db8::1". Empty if no dns
+     * server addresses returned.
+     */
+    vec<string> dnses;
+
+    /**
+     * List of default gateway addresses, e.g., "192.0.1.3" or "192.0.1.11 2001:db8::1".
+     * When empty, the addresses represent point to point connections.
+     */
+    vec<string> gateways;
+
+    /**
+     * List of P-CSCF(Proxy Call State Control Function) addresses via PCO(Protocol Configuration
+     * Option), e.g., "2001:db8::1 2001:db8::2 2001:db8::3". Empty if not IMS client.
+     */
+    vec<string> pcscf;
+
+    /**
+     * MTU received from network for IPv4.
+     * Value <= 0 means network has either not sent a value or sent an invalid value.
+     */
+    int32_t mtuV4;
+
+    /**
+     * MTU received from network for IPv6.
+     * Value <= 0 means network has either not sent a value or sent an invalid value.
+     */
+    int32_t mtuV6;
 
     /** Default bearer QoS. Applicable to LTE and NR */
     Qos defaultQos;
@@ -254,6 +320,14 @@
 
     /** Specifies the fallback mode on an IWLAN handover failure. */
     HandoverFailureMode handoverFailureMode;
+
+    /**
+     * The allocated pdu session id for this data call.
+     * A value of -1 means no pdu session id was attached to this call.
+     *
+     * Reference: 3GPP TS 24.007 section 11.2.3.1b
+     */
+    int32_t pduSessionId;
 };
 
 /**
diff --git a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
index 784bcd9..850425d 100644
--- a/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
+++ b/radio/1.6/vts/functional/radio_hidl_hal_utils_v1_6.h
@@ -80,6 +80,9 @@
     bool enableModemResponseToggle;
     bool isNRDualConnectivityEnabled;
 
+    // Pdu Session Id and Handover
+    int32_t allocatedPduSessionId;
+
     ::android::hardware::hidl_bitfield<::android::hardware::radio::V1_4::RadioAccessFamily>
             networkTypeBitmapResponse;
 
@@ -763,6 +766,9 @@
             const ::android::hardware::radio::V1_6::RadioResponseInfo& info,
             const SendSmsResult& sms);
 
+    Return<void> setSimCardPowerResponse_1_6(
+            const ::android::hardware::radio::V1_6::RadioResponseInfo& info);
+
     Return<void> sendCdmaSmsExpectMoreResponse_1_6(
             const ::android::hardware::radio::V1_6::RadioResponseInfo& info,
             const SendSmsResult& sms);
@@ -771,6 +777,18 @@
             const ::android::hardware::radio::V1_6::RadioResponseInfo& info);
     Return<void> isNrDualConnectivityEnabledResponse(
             const ::android::hardware::radio::V1_6::RadioResponseInfo& info, bool isEnabled);
+
+    Return<void> allocatePduSessionIdResponse(
+            const ::android::hardware::radio::V1_6::RadioResponseInfo& info, int32_t id);
+
+    Return<void> releasePduSessionIdResponse(
+            const ::android::hardware::radio::V1_6::RadioResponseInfo& info);
+
+    Return<void> beginHandoverResponse(
+            const ::android::hardware::radio::V1_6::RadioResponseInfo& info);
+
+    Return<void> cancelHandoverResponse(
+            const ::android::hardware::radio::V1_6::RadioResponseInfo& info);
 };
 
 /* Callback class for radio indication */
diff --git a/radio/1.6/vts/functional/radio_response.cpp b/radio/1.6/vts/functional/radio_response.cpp
index ffa384e..fc56947 100644
--- a/radio/1.6/vts/functional/radio_response.cpp
+++ b/radio/1.6/vts/functional/radio_response.cpp
@@ -1097,6 +1097,13 @@
     return Void();
 }
 
+Return<void> RadioResponse_v1_6::setSimCardPowerResponse_1_6(
+        const ::android::hardware::radio::V1_6::RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_v1_6.notify(info.serial);
+    return Void();
+}
+
 Return<void> RadioResponse_v1_6::sendCdmaSmsExpectMoreResponse_1_6(
         const ::android::hardware::radio::V1_6::RadioResponseInfo& info,
         const SendSmsResult& sms) {
@@ -1113,3 +1120,32 @@
     parent_v1_6.notify(info.serial);
     return Void();
 }
+
+Return<void> RadioResponse_v1_6::allocatePduSessionIdResponse(
+        const ::android::hardware::radio::V1_6::RadioResponseInfo& info, int32_t id) {
+    rspInfo = info;
+    allocatedPduSessionId = id;
+    parent_v1_6.notify(info.serial);
+    return Void();
+}
+
+Return<void> RadioResponse_v1_6::releasePduSessionIdResponse(
+        const ::android::hardware::radio::V1_6::RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_v1_6.notify(info.serial);
+    return Void();
+}
+
+Return<void> RadioResponse_v1_6::beginHandoverResponse(
+        const ::android::hardware::radio::V1_6::RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_v1_6.notify(info.serial);
+    return Void();
+}
+
+Return<void> RadioResponse_v1_6::cancelHandoverResponse(
+        const ::android::hardware::radio::V1_6::RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_v1_6.notify(info.serial);
+    return Void();
+}
diff --git a/tv/tuner/1.1/types.hal b/tv/tuner/1.1/types.hal
index defc99b..3ff795a 100644
--- a/tv/tuner/1.1/types.hal
+++ b/tv/tuner/1.1/types.hal
@@ -72,6 +72,18 @@
      * IFrontend.linkCiCam.
      */
     INVALID_LTS_ID = 0xFFFFFFFF,
+    /**
+     * An invalid frontend ID.
+     */
+    INVALID_FRONTEND_ID = 0xFFFFFFFF,
+    /**
+     * An invalid LNB ID.
+     */
+    INVALID_LNB_ID = 0xFFFFFFFF,
+    /**
+     * An invalid key token. It is used to remove the current key from the descrambler.
+     */
+    INVALID_KEYTOKEN = 0x00,
 };
 
 @export
diff --git a/update-base-files.sh b/update-base-files.sh
index daaa530..d01847d 100755
--- a/update-base-files.sh
+++ b/update-base-files.sh
@@ -42,8 +42,11 @@
 
 # system/media
 hidl-gen $options \
+         -o $ANDROID_BUILD_TOP/system/media/audio/include/system/audio_common-base.h \
+         android.hardware.audio.common@7.0
+hidl-gen $options \
          -o $ANDROID_BUILD_TOP/system/media/audio/include/system/audio-base.h \
-         android.hardware.audio.common@2.0
+         android.hardware.audio@7.0
 hidl-gen $options \
          -o $ANDROID_BUILD_TOP/system/media/audio/include/system/audio_effect-base.h \
-         android.hardware.audio.effect@2.0
+         android.hardware.audio.effect@7.0
diff --git a/wifi/supplicant/1.4/ISupplicantStaNetwork.hal b/wifi/supplicant/1.4/ISupplicantStaNetwork.hal
index f12ace4..0cc62c0 100644
--- a/wifi/supplicant/1.4/ISupplicantStaNetwork.hal
+++ b/wifi/supplicant/1.4/ISupplicantStaNetwork.hal
@@ -143,4 +143,22 @@
      */
     registerCallback_1_4(ISupplicantStaNetworkCallback callback)
         generates (SupplicantStatus status);
+
+    /**
+     * Set whether to enable SAE H2E (Hash-to-Element) only mode.
+     *
+     * When enabled, only SAE H2E network is allowed; othewise
+     * H&P (Hunting and Pecking) and H2E are both allowed.
+     * H&P only mode is not supported.
+     * If this API is not called before connecting to a SAE
+     * network, the behavior is undefined.
+     *
+     * @param enable true to set, false otherwise.
+     * @return status Status of the operation.
+     *         Possible status codes:
+     *         |SupplicantStatusCode.SUCCESS|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    enableSaeH2eOnlyMode(bool enable) generates (SupplicantStatus status);
 };
diff --git a/wifi/supplicant/1.4/vts/functional/supplicant_sta_network_hidl_test.cpp b/wifi/supplicant/1.4/vts/functional/supplicant_sta_network_hidl_test.cpp
index 32e4f17..aaaccfc 100644
--- a/wifi/supplicant/1.4/vts/functional/supplicant_sta_network_hidl_test.cpp
+++ b/wifi/supplicant/1.4/vts/functional/supplicant_sta_network_hidl_test.cpp
@@ -90,6 +90,18 @@
         });
 }
 
+/*
+ * enable SAE H2E (Hash-to-Element) only mode
+ */
+TEST_P(SupplicantStaNetworkHidlTest, EnableSaeH2eOnlyMode) {
+    v1_4->enableSaeH2eOnlyMode(true, [&](const SupplicantStatus& status) {
+        EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
+    });
+    v1_4->enableSaeH2eOnlyMode(false, [&](const SupplicantStatus& status) {
+        EXPECT_EQ(SupplicantStatusCode::SUCCESS, status.code);
+    });
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(SupplicantStaNetworkHidlTest);
 INSTANTIATE_TEST_CASE_P(
     PerInstance, SupplicantStaNetworkHidlTest,