diff --git a/audio/7.1/IDevice.hal b/audio/7.1/IDevice.hal
index 373d17f..e0b1e92 100644
--- a/audio/7.1/IDevice.hal
+++ b/audio/7.1/IDevice.hal
@@ -85,4 +85,16 @@
                     Result retval,
                     IStreamIn inStream,
                     AudioConfig suggestedConfig);
+
+    /**
+     * Notifies the device module about the connection state of an input/output
+     * device attached to it. The devicePort identifies the device and may also
+     * provide extra information such as raw audio descriptors.
+     *
+     * @param devicePort audio device port.
+     * @param connected whether the device is connected.
+     * @return retval operation completion status.
+     */
+    setConnectedState_7_1(AudioPort devicePort, bool connected)
+            generates (Result retval);
 };
diff --git a/audio/core/all-versions/default/Device.cpp b/audio/core/all-versions/default/Device.cpp
index ac5a3ba..ca8c03d 100644
--- a/audio/core/all-versions/default/Device.cpp
+++ b/audio/core/all-versions/default/Device.cpp
@@ -616,6 +616,21 @@
 
 #endif
 
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+Return<Result> Device::setConnectedState_7_1(const AudioPort& devicePort, bool connected) {
+    if (version() >= AUDIO_DEVICE_API_VERSION_3_2 &&
+        mDevice->set_device_connected_state_v7 != nullptr) {
+        audio_port_v7 halPort;
+        if (status_t status = HidlUtils::audioPortToHal(devicePort, &halPort); status != NO_ERROR) {
+            return analyzeStatus("audioPortToHal", status);
+        }
+        return analyzeStatus("set_device_connected_state_v7",
+                             mDevice->set_device_connected_state_v7(mDevice, &halPort, connected));
+    }
+    return Result::NOT_SUPPORTED;
+}
+#endif
+
 }  // namespace implementation
 }  // namespace CPP_VERSION
 }  // namespace audio
diff --git a/audio/core/all-versions/default/include/core/default/Device.h b/audio/core/all-versions/default/include/core/default/Device.h
index 0aeb6b3..8cde3e0 100644
--- a/audio/core/all-versions/default/include/core/default/Device.h
+++ b/audio/core/all-versions/default/include/core/default/Device.h
@@ -163,6 +163,9 @@
                                   const hidl_vec<AudioPortConfig>& sinks,
                                   createAudioPatch_cb _hidl_cb) override;
 #endif
+#if MAJOR_VERSION == 7 && MINOR_VERSION == 1
+    Return<Result> setConnectedState_7_1(const AudioPort& devicePort, bool connected) override;
+#endif
     Return<void> debug(const hidl_handle& fd, const hidl_vec<hidl_string>& options) override;
 
     // Utility methods for extending interfaces.
diff --git a/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp
index b750f56..d82d4ad 100644
--- a/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/all-versions/vts/functional/7.1/AudioPrimaryHidlHalTest.cpp
@@ -16,3 +16,34 @@
 
 // pull in all the <= 7.0 tests
 #include "7.0/AudioPrimaryHidlHalTest.cpp"
+
+TEST_P(AudioHidlDeviceTest, SetConnectedState_7_1) {
+    doc::test("Check that the HAL can be notified of device connection and disconnection");
+    using AD = xsd::AudioDevice;
+    for (auto deviceType : {AD::AUDIO_DEVICE_OUT_HDMI, AD::AUDIO_DEVICE_OUT_WIRED_HEADPHONE,
+                            AD::AUDIO_DEVICE_IN_USB_HEADSET}) {
+        SCOPED_TRACE("device=" + toString(deviceType));
+        for (bool state : {true, false}) {
+            SCOPED_TRACE("state=" + ::testing::PrintToString(state));
+            DeviceAddress address = {};
+            address.deviceType = toString(deviceType);
+            if (deviceType == AD::AUDIO_DEVICE_IN_USB_HEADSET) {
+                address.address.alsa({0, 0});
+            }
+            AudioPort devicePort;
+            devicePort.ext.device(address);
+            auto ret = getDevice()->setConnectedState_7_1(devicePort, state);
+            ASSERT_TRUE(ret.isOk());
+            if (ret == Result::NOT_SUPPORTED) {
+                doc::partialTest("setConnectedState_7_1 is not supported");
+                break;  // other deviceType might be supported
+            }
+            ASSERT_OK(ret);
+        }
+    }
+
+    // Because there is no way of knowing if the devices were connected before
+    // calling setConnectedState, there is no way to restore the HAL to its
+    // initial state. To workaround this, destroy the HAL at the end of this test.
+    ASSERT_TRUE(resetDevice());
+}
diff --git a/contexthub/aidl/Android.bp b/contexthub/aidl/Android.bp
index e9143b5..5926b77 100644
--- a/contexthub/aidl/Android.bp
+++ b/contexthub/aidl/Android.bp
@@ -24,6 +24,7 @@
 aidl_interface {
     name: "android.hardware.contexthub",
     vendor_available: true,
+    host_supported: true,
     srcs: ["android/hardware/contexthub/*.aidl"],
     stability: "vintf",
     backend: {
diff --git a/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl b/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
index 2135041..16666ef 100644
--- a/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
+++ b/contexthub/aidl/android/hardware/contexthub/IContextHub.aidl
@@ -189,9 +189,8 @@
      * called, the HAL is expected to clean up any resources attached to the messaging channel
      * associated with this host endpoint ID.
      *
-     * @param hostEndPointId The ID of the host that has disconnected.
-     *
-     * @throws EX_ILLEGAL_ARGUMENT if hostEndpointId is not associated with a connected host.
+     * @param hostEndPointId The ID of the host that has disconnected. Any invalid values for this
+     *                       parameter should be ignored (no-op).
      */
     void onHostEndpointDisconnected(char hostEndpointId);
 
diff --git a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
index f0583be..3c01c6b 100644
--- a/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
+++ b/contexthub/aidl/vts/VtsAidlHalContextHubTargetTest.cpp
@@ -338,8 +338,7 @@
 TEST_P(ContextHubAidl, TestInvalidHostConnection) {
     constexpr char16_t kHostEndpointId = 1;
 
-    Status status = contextHub->onHostEndpointDisconnected(kHostEndpointId);
-    ASSERT_EQ(status.exceptionCode(), android::binder::Status::EX_ILLEGAL_ARGUMENT);
+    ASSERT_TRUE(contextHub->onHostEndpointDisconnected(kHostEndpointId).isOk());
 }
 
 std::string PrintGeneratedTest(const testing::TestParamInfo<ContextHubAidl::ParamType>& info) {
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
index affef2b..5657434 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnss.aidl
@@ -56,6 +56,10 @@
   void setPositionMode(in android.hardware.gnss.IGnss.PositionModeOptions options);
   android.hardware.gnss.IGnssAntennaInfo getExtensionGnssAntennaInfo();
   @nullable android.hardware.gnss.measurement_corrections.IMeasurementCorrectionsInterface getExtensionMeasurementCorrections();
+  void startSvStatus();
+  void stopSvStatus();
+  void startNmea();
+  void stopNmea();
   const int ERROR_INVALID_ARGUMENT = 1;
   const int ERROR_ALREADY_INIT = 2;
   const int ERROR_GENERIC = 3;
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnssDebug.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnssDebug.aidl
index 27d9887..8e4b5f2 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnssDebug.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/IGnssDebug.aidl
@@ -42,13 +42,6 @@
     NOT_AVAILABLE = 2,
   }
   @Backing(type="int") @VintfStability
-  enum SatelliteEphemerisSource {
-    DEMODULATED = 0,
-    SUPL_PROVIDED = 1,
-    OTHER_SERVER_PROVIDED = 2,
-    OTHER = 3,
-  }
-  @Backing(type="int") @VintfStability
   enum SatelliteEphemerisHealth {
     GOOD = 0,
     BAD = 1,
@@ -79,7 +72,7 @@
     int svid;
     android.hardware.gnss.GnssConstellationType constellation;
     android.hardware.gnss.IGnssDebug.SatelliteEphemerisType ephemerisType;
-    android.hardware.gnss.IGnssDebug.SatelliteEphemerisSource ephemerisSource;
+    android.hardware.gnss.SatellitePvt.SatelliteEphemerisSource ephemerisSource;
     android.hardware.gnss.IGnssDebug.SatelliteEphemerisHealth ephemerisHealth;
     float ephemerisAgeSeconds;
     boolean serverPredictionIsAvailable;
diff --git a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/SatellitePvt.aidl b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/SatellitePvt.aidl
index 8c17841..21a2520 100644
--- a/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/SatellitePvt.aidl
+++ b/gnss/aidl/aidl_api/android.hardware.gnss/current/android/hardware/gnss/SatellitePvt.aidl
@@ -40,7 +40,19 @@
   android.hardware.gnss.SatelliteClockInfo satClockInfo;
   double ionoDelayMeters;
   double tropoDelayMeters;
+  int TOC;
+  int IODC;
+  int TOE;
+  int IODE;
+  android.hardware.gnss.SatellitePvt.SatelliteEphemerisSource ephemerisSource = android.hardware.gnss.SatellitePvt.SatelliteEphemerisSource.OTHER;
   const int HAS_POSITION_VELOCITY_CLOCK_INFO = 1;
   const int HAS_IONO = 2;
   const int HAS_TROPO = 4;
+  @Backing(type="int") @VintfStability
+  enum SatelliteEphemerisSource {
+    DEMODULATED = 0,
+    SERVER_NORMAL = 1,
+    SERVER_LONG_TERM = 2,
+    OTHER = 3,
+  }
 }
diff --git a/gnss/aidl/android/hardware/gnss/IGnss.aidl b/gnss/aidl/android/hardware/gnss/IGnss.aidl
index 79950ad..12fdbb4 100644
--- a/gnss/aidl/android/hardware/gnss/IGnss.aidl
+++ b/gnss/aidl/android/hardware/gnss/IGnss.aidl
@@ -320,4 +320,25 @@
      * @return Handle to the IMeasurementCorrectionsInterface.
      */
     @nullable IMeasurementCorrectionsInterface getExtensionMeasurementCorrections();
+
+    /**
+     * Starts a SvStatus output stream using the IGnssCallback gnssSvStatusCb().
+     */
+    void startSvStatus();
+
+    /**
+     * Stops the SvStatus output stream.
+     */
+    void stopSvStatus();
+
+    /**
+     * Starts an NMEA (National Marine Electronics Association) output stream using the
+     * IGnssCallback gnssNmeaCb().
+     */
+    void startNmea();
+
+    /**
+     * Stops the NMEA output stream.
+     */
+    void stopNmea();
 }
diff --git a/gnss/aidl/android/hardware/gnss/IGnssCallback.aidl b/gnss/aidl/android/hardware/gnss/IGnssCallback.aidl
index a74d097..866606f 100644
--- a/gnss/aidl/android/hardware/gnss/IGnssCallback.aidl
+++ b/gnss/aidl/android/hardware/gnss/IGnssCallback.aidl
@@ -202,6 +202,10 @@
     /**
      * Callback for the HAL to pass a vector of GnssSvInfo back to the client.
      *
+     * If GnssMeasurement is registered, the SvStatus report interval is the same as the measurement
+     * interval, i.e., the interval the measurement engine runs at. If GnssMeasurement is not
+     * registered, the SvStatus interval is the same as the location interval.
+     *
      * @param svInfo SV status information from HAL.
      */
     void gnssSvStatusCb(in GnssSvInfo[] svInfoList);
diff --git a/gnss/aidl/android/hardware/gnss/IGnssDebug.aidl b/gnss/aidl/android/hardware/gnss/IGnssDebug.aidl
index 475a4a3..3071dce5 100644
--- a/gnss/aidl/android/hardware/gnss/IGnssDebug.aidl
+++ b/gnss/aidl/android/hardware/gnss/IGnssDebug.aidl
@@ -17,6 +17,7 @@
 package android.hardware.gnss;
 
 import android.hardware.gnss.GnssConstellationType;
+import android.hardware.gnss.SatellitePvt.SatelliteEphemerisSource;
 
 /**
  * Extended interface for GNSS Debug support
@@ -35,16 +36,6 @@
         NOT_AVAILABLE = 2,
     }
 
-    /** Satellite's ephemeris source */
-    @VintfStability
-    @Backing(type="int")
-    enum SatelliteEphemerisSource {
-        DEMODULATED = 0,
-        SUPL_PROVIDED = 1,
-        OTHER_SERVER_PROVIDED = 2,
-        OTHER = 3,
-    }
-
     /** Satellite's ephemeris health */
     @VintfStability
     @Backing(type="int")
diff --git a/gnss/aidl/android/hardware/gnss/SatellitePvt.aidl b/gnss/aidl/android/hardware/gnss/SatellitePvt.aidl
index a238e3f..e79249d 100644
--- a/gnss/aidl/android/hardware/gnss/SatellitePvt.aidl
+++ b/gnss/aidl/android/hardware/gnss/SatellitePvt.aidl
@@ -74,4 +74,62 @@
 
     /** Tropospheric delay in meters. */
     double tropoDelayMeters;
+
+    /**
+     * Time of Clock.
+     *
+     * This is defined in GPS ICD200 documentation
+     * (e.g., https://www.gps.gov/technical/icwg/IS-GPS-200H.pdf).
+     */
+    int TOC;
+
+    /**
+     * Issue of Data, Clock.
+     *
+     * This is defined in GPS ICD200 documentation
+     * (e.g., https://www.gps.gov/technical/icwg/IS-GPS-200H.pdf).
+     *
+     * The field must be set to 0 if it is not supported.
+     */
+    int IODC;
+
+    /**
+     * Time of Ephemeris.
+     *
+     * This is defined in GPS ICD200 documentation
+     * (e.g., https://www.gps.gov/technical/icwg/IS-GPS-200H.pdf).
+     */
+    int TOE;
+
+    /**
+     * Issue of Data, Ephemeris.
+     *
+     * This is defined in GPS ICD200 documentation
+     * (e.g., https://www.gps.gov/technical/icwg/IS-GPS-200H.pdf).
+     *
+     * The field must be set to 0 if it is not supported.
+     */
+    int IODE;
+
+    /** Satellite's ephemeris source */
+    @VintfStability
+    @Backing(type="int")
+    enum SatelliteEphemerisSource {
+        // Demodulated from broadcast signals
+        DEMODULATED = 0,
+        // Server provided Normal type ephemeris data, which is similar to broadcast ephemeris in
+        // longevity (e.g. SUPL) - lasting for few hours and providing satellite orbit and clock
+        // with accuracy of 1 - 2 meters.
+        SERVER_NORMAL = 1,
+        // Server provided Long-Term type ephemeris data, which lasts for many hours to several days
+        // and often provides satellite orbit and clock accuracy of 2 - 20 meters.
+        SERVER_LONG_TERM = 2,
+        // Other source
+        OTHER = 3,
+    }
+
+    /**
+     * Source of the ephemeris.
+     */
+    SatelliteEphemerisSource ephemerisSource = SatelliteEphemerisSource.OTHER;
 }
diff --git a/gnss/aidl/default/Gnss.cpp b/gnss/aidl/default/Gnss.cpp
index eb17bbf..af1dd5c 100644
--- a/gnss/aidl/default/Gnss.cpp
+++ b/gnss/aidl/default/Gnss.cpp
@@ -87,15 +87,13 @@
     mIsActive = true;
     this->reportGnssStatusValue(IGnssCallback::GnssStatusValue::SESSION_BEGIN);
     mThread = std::thread([this]() {
-        auto svStatus = filterBlocklistedSatellites(Utils::getMockSvInfoList());
-        this->reportSvStatus(svStatus);
+        this->reportSvStatus();
         if (!mFirstFixReceived) {
             std::this_thread::sleep_for(std::chrono::milliseconds(TTFF_MILLIS));
             mFirstFixReceived = true;
         }
         while (mIsActive == true) {
-            auto svStatus = filterBlocklistedSatellites(Utils::getMockSvInfoList());
-            this->reportSvStatus(svStatus);
+            this->reportSvStatus();
 
             auto currentLocation = getLocationFromHW();
             mGnssPowerIndication->notePowerConsumption();
@@ -124,6 +122,13 @@
     return;
 }
 
+void Gnss::reportSvStatus() const {
+    if (mIsSvStatusActive) {
+        auto svStatus = filterBlocklistedSatellites(Utils::getMockSvInfoList());
+        reportSvStatus(svStatus);
+    }
+}
+
 void Gnss::reportSvStatus(const std::vector<GnssSvInfo>& svInfoList) const {
     std::unique_lock<std::mutex> lock(mMutex);
     if (sGnssCallback == nullptr) {
@@ -136,7 +141,8 @@
     }
 }
 
-std::vector<GnssSvInfo> Gnss::filterBlocklistedSatellites(std::vector<GnssSvInfo> gnssSvInfoList) {
+std::vector<GnssSvInfo> Gnss::filterBlocklistedSatellites(
+        std::vector<GnssSvInfo> gnssSvInfoList) const {
     ALOGD("filterBlocklistedSatellites");
     for (uint32_t i = 0; i < gnssSvInfoList.size(); i++) {
         if (mGnssConfiguration->isBlocklisted(gnssSvInfoList[i])) {
@@ -168,6 +174,26 @@
     return ScopedAStatus::ok();
 }
 
+ScopedAStatus Gnss::startSvStatus() {
+    ALOGD("startSvStatus");
+    mIsSvStatusActive = true;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Gnss::stopSvStatus() {
+    ALOGD("stopSvStatus");
+    mIsSvStatusActive = false;
+    return ScopedAStatus::ok();
+}
+ScopedAStatus Gnss::startNmea() {
+    ALOGD("startNmea");
+    return ScopedAStatus::ok();
+}
+ScopedAStatus Gnss::stopNmea() {
+    ALOGD("stopNmea");
+    return ScopedAStatus::ok();
+}
+
 ScopedAStatus Gnss::close() {
     ALOGD("close");
     sGnssCallback = nullptr;
diff --git a/gnss/aidl/default/Gnss.h b/gnss/aidl/default/Gnss.h
index b50a1ae..1489b4b 100644
--- a/gnss/aidl/default/Gnss.h
+++ b/gnss/aidl/default/Gnss.h
@@ -51,6 +51,10 @@
     ndk::ScopedAStatus injectBestLocation(const GnssLocation& location) override;
     ndk::ScopedAStatus deleteAidingData(GnssAidingData aidingDataFlags) override;
     ndk::ScopedAStatus setPositionMode(const PositionModeOptions& options) override;
+    ndk::ScopedAStatus startSvStatus() override;
+    ndk::ScopedAStatus stopSvStatus() override;
+    ndk::ScopedAStatus startNmea() override;
+    ndk::ScopedAStatus stopNmea() override;
 
     ndk::ScopedAStatus getExtensionPsds(std::shared_ptr<IGnssPsds>* iGnssPsds) override;
     ndk::ScopedAStatus getExtensionGnssConfiguration(
@@ -83,9 +87,10 @@
 
   private:
     void reportLocation(const GnssLocation&) const;
+    void reportSvStatus() const;
     void reportSvStatus(const std::vector<IGnssCallback::GnssSvInfo>& svInfoList) const;
     std::vector<IGnssCallback::GnssSvInfo> filterBlocklistedSatellites(
-            std::vector<IGnssCallback::GnssSvInfo> gnssSvInfoList);
+            std::vector<IGnssCallback::GnssSvInfo> gnssSvInfoList) const;
     void reportGnssStatusValue(const IGnssCallback::GnssStatusValue gnssStatusValue) const;
     std::unique_ptr<GnssLocation> getLocationFromHW();
 
@@ -93,6 +98,7 @@
 
     std::atomic<long> mMinIntervalMs;
     std::atomic<bool> mIsActive;
+    std::atomic<bool> mIsSvStatusActive;
     std::atomic<bool> mFirstFixReceived;
     std::thread mThread;
 
diff --git a/gnss/aidl/vts/gnss_hal_test.cpp b/gnss/aidl/vts/gnss_hal_test.cpp
index 4828f19..c1128ba 100644
--- a/gnss/aidl/vts/gnss_hal_test.cpp
+++ b/gnss/aidl/vts/gnss_hal_test.cpp
@@ -100,9 +100,11 @@
     }
 
     SetPositionMode(min_interval_msec, low_power_mode);
-    auto result = aidl_gnss_hal_->start();
+    auto status = aidl_gnss_hal_->start();
+    EXPECT_TRUE(status.isOk());
 
-    EXPECT_TRUE(result.isOk());
+    status = aidl_gnss_hal_->startSvStatus();
+    EXPECT_TRUE(status.isOk());
 
     /*
      * GnssLocationProvider support of AGPS SUPL & XtraDownloader is not available in VTS,
@@ -129,8 +131,10 @@
         // Invoke the super method.
         return GnssHalTestTemplate<IGnss_V2_1>::StopAndClearLocations();
     }
+    auto status = aidl_gnss_hal_->stopSvStatus();
+    EXPECT_TRUE(status.isOk());
 
-    auto status = aidl_gnss_hal_->stop();
+    status = aidl_gnss_hal_->stop();
     EXPECT_TRUE(status.isOk());
 
     /*
diff --git a/gnss/aidl/vts/gnss_hal_test_cases.cpp b/gnss/aidl/vts/gnss_hal_test_cases.cpp
index 1b69488..8e51b44 100644
--- a/gnss/aidl/vts/gnss_hal_test_cases.cpp
+++ b/gnss/aidl/vts/gnss_hal_test_cases.cpp
@@ -102,7 +102,7 @@
     }
 }
 
-void CheckSatellitePvt(const SatellitePvt& satellitePvt) {
+void CheckSatellitePvt(const SatellitePvt& satellitePvt, const int interfaceVersion) {
     const double kMaxOrbitRadiusMeters = 43000000.0;
     const double kMaxVelocityMps = 4000.0;
     // The below values are determined using GPS ICD Table 20-1
@@ -147,6 +147,14 @@
         ALOGD("Found HAS_TROPO");
         ASSERT_TRUE(satellitePvt.tropoDelayMeters > 0 && satellitePvt.tropoDelayMeters < 100);
     }
+    if (interfaceVersion >= 2) {
+        ASSERT_TRUE(satellitePvt.TOC >= 0 && satellitePvt.TOC <= 604784);
+        ASSERT_TRUE(satellitePvt.TOE >= 0 && satellitePvt.TOE <= 604784);
+        // IODC has 10 bits
+        ASSERT_TRUE(satellitePvt.IODC >= 0 && satellitePvt.IODC <= 1023);
+        // IODE has 8 bits
+        ASSERT_TRUE(satellitePvt.IODE >= 0 && satellitePvt.IODE <= 255);
+    }
 }
 
 void CheckGnssMeasurementClockFields(const GnssData& measurement) {
@@ -226,7 +234,7 @@
                 kIsSatellitePvtSupported == true) {
                 ALOGD("Found a measurement with SatellitePvt");
                 satellitePvtFound = true;
-                CheckSatellitePvt(measurement.satellitePvt);
+                CheckSatellitePvt(measurement.satellitePvt, aidl_gnss_hal_->getInterfaceVersion());
             }
         }
     }
@@ -337,7 +345,7 @@
     auto powerStats1 = gnssPowerIndicationCallback->last_gnss_power_stats_;
 
     // Get a location and request another GnssPowerStats
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         gnss_cb_->location_cbq_.reset();
     } else {
         aidl_gnss_cb_->location_cbq_.reset();
@@ -416,18 +424,18 @@
     const int kLocationsToAwait = 3;
     const int kRetriesToUnBlocklist = 10;
 
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         gnss_cb_->location_cbq_.reset();
     } else {
         aidl_gnss_cb_->location_cbq_.reset();
     }
     StartAndCheckLocations(kLocationsToAwait);
-    int location_called_count = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    int location_called_count = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->location_cbq_.calledCount()
                                         : aidl_gnss_cb_->location_cbq_.calledCount();
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
-    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->sv_info_list_cbq_.size()
                                         : aidl_gnss_cb_->sv_info_list_cbq_.size();
     EXPECT_GE(sv_info_list_cbq_size + 1, kLocationsToAwait);
@@ -442,7 +450,7 @@
 
     const int kGnssSvInfoListTimeout = 2;
     BlocklistedSource source_to_blocklist;
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         std::list<hidl_vec<IGnssCallback_2_1::GnssSvInfo>> sv_info_vec_list;
         int count = gnss_cb_->sv_info_list_cbq_.retrieve(sv_info_vec_list, sv_info_list_cbq_size,
                                                          kGnssSvInfoListTimeout);
@@ -480,7 +488,7 @@
     ASSERT_TRUE(status.isOk());
 
     // retry and ensure satellite not used
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         gnss_cb_->sv_info_list_cbq_.reset();
         gnss_cb_->location_cbq_.reset();
     } else {
@@ -491,7 +499,7 @@
     StartAndCheckLocations(kLocationsToAwait);
 
     // early exit if test is being run with insufficient signal
-    location_called_count = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    location_called_count = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                     ? gnss_cb_->location_cbq_.calledCount()
                                     : aidl_gnss_cb_->location_cbq_.calledCount();
     if (location_called_count == 0) {
@@ -500,14 +508,14 @@
     ASSERT_TRUE(location_called_count > 0);
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
-    sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                     ? gnss_cb_->sv_info_list_cbq_.size()
                                     : aidl_gnss_cb_->sv_info_list_cbq_.size();
     EXPECT_GE(sv_info_list_cbq_size + 1, kLocationsToAwait);
     ALOGD("Observed %d GnssSvInfo, while awaiting %d Locations (%d received)",
           sv_info_list_cbq_size, kLocationsToAwait, location_called_count);
     for (int i = 0; i < sv_info_list_cbq_size; ++i) {
-        if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+        if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
             hidl_vec<IGnssCallback_2_1::GnssSvInfo> sv_info_vec;
             gnss_cb_->sv_info_list_cbq_.retrieve(sv_info_vec, kGnssSvInfoListTimeout);
             for (uint32_t iSv = 0; iSv < sv_info_vec.size(); iSv++) {
@@ -542,7 +550,7 @@
     while (!strongest_sv_is_reobserved && (unblocklist_loops_remaining-- > 0)) {
         StopAndClearLocations();
 
-        if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+        if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
             gnss_cb_->sv_info_list_cbq_.reset();
             gnss_cb_->location_cbq_.reset();
         } else {
@@ -552,7 +560,7 @@
         StartAndCheckLocations(kLocationsToAwait);
 
         // early exit loop if test is being run with insufficient signal
-        location_called_count = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+        location_called_count = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->location_cbq_.calledCount()
                                         : aidl_gnss_cb_->location_cbq_.calledCount();
         if (location_called_count == 0) {
@@ -561,7 +569,7 @@
         ASSERT_TRUE(location_called_count > 0);
 
         // Tolerate 1 less sv status to handle edge cases in reporting.
-        sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+        sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->sv_info_list_cbq_.size()
                                         : aidl_gnss_cb_->sv_info_list_cbq_.size();
         EXPECT_GE(sv_info_list_cbq_size + 1, kLocationsToAwait);
@@ -570,7 +578,7 @@
               sv_info_list_cbq_size, kLocationsToAwait, unblocklist_loops_remaining);
 
         for (int i = 0; i < sv_info_list_cbq_size; ++i) {
-            if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+            if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
                 hidl_vec<IGnssCallback_2_1::GnssSvInfo> sv_info_vec;
                 gnss_cb_->sv_info_list_cbq_.retrieve(sv_info_vec, kGnssSvInfoListTimeout);
                 for (uint32_t iSv = 0; iSv < sv_info_vec.size(); iSv++) {
@@ -655,7 +663,7 @@
     ASSERT_TRUE(status.isOk());
 
     // retry and ensure constellation not used
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         gnss_cb_->sv_info_list_cbq_.reset();
         gnss_cb_->location_cbq_.reset();
     } else {
@@ -665,14 +673,14 @@
     StartAndCheckLocations(kLocationsToAwait);
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
-    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->sv_info_list_cbq_.size()
                                         : aidl_gnss_cb_->sv_info_list_cbq_.size();
     EXPECT_GE(sv_info_list_cbq_size + 1, kLocationsToAwait);
     ALOGD("Observed %d GnssSvInfo, while awaiting %d Locations", sv_info_list_cbq_size,
           kLocationsToAwait);
     for (int i = 0; i < sv_info_list_cbq_size; ++i) {
-        if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+        if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
             hidl_vec<IGnssCallback_2_1::GnssSvInfo> sv_info_vec;
             gnss_cb_->sv_info_list_cbq_.retrieve(sv_info_vec, kGnssSvInfoListTimeout);
             for (uint32_t iSv = 0; iSv < sv_info_vec.size(); iSv++) {
@@ -758,7 +766,7 @@
     StopAndClearLocations();
 
     // retry and ensure constellation not used
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         gnss_cb_->sv_info_list_cbq_.reset();
         gnss_cb_->location_cbq_.reset();
     } else {
@@ -768,14 +776,14 @@
     StartAndCheckLocations(kLocationsToAwait);
 
     // Tolerate 1 less sv status to handle edge cases in reporting.
-    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() == 1)
+    int sv_info_list_cbq_size = (aidl_gnss_hal_->getInterfaceVersion() <= 1)
                                         ? gnss_cb_->sv_info_list_cbq_.size()
                                         : aidl_gnss_cb_->sv_info_list_cbq_.size();
     EXPECT_GE(sv_info_list_cbq_size + 1, kLocationsToAwait);
     ALOGD("Observed %d GnssSvInfo, while awaiting %d Locations", sv_info_list_cbq_size,
           kLocationsToAwait);
     for (int i = 0; i < sv_info_list_cbq_size; ++i) {
-        if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+        if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
             hidl_vec<IGnssCallback_2_1::GnssSvInfo> sv_info_vec;
             gnss_cb_->sv_info_list_cbq_.retrieve(sv_info_vec, kGnssSvInfoListTimeout);
             for (uint32_t iSv = 0; iSv < sv_info_vec.size(); iSv++) {
@@ -813,7 +821,7 @@
  * TestAllExtensions.
  */
 TEST_P(GnssHalTest, TestAllExtensions) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
 
@@ -855,7 +863,7 @@
  * 3. Sets SUPL server host/port.
  */
 TEST_P(GnssHalTest, TestAGnssExtension) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     sp<IAGnss> iAGnss;
@@ -879,7 +887,7 @@
  * 3. Sets reference location.
  */
 TEST_P(GnssHalTest, TestAGnssRilExtension) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     sp<IAGnssRil> iAGnssRil;
@@ -913,7 +921,7 @@
  * Ensures that GnssDebug values make sense.
  */
 TEST_P(GnssHalTest, GnssDebugValuesSanityTest) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     sp<IGnssDebug> iGnssDebug;
@@ -962,7 +970,7 @@
  * 3. Sets proxy apps
  */
 TEST_P(GnssHalTest, TestGnssVisibilityControlExtension) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     sp<IGnssVisibilityControl> iGnssVisibilityControl;
@@ -986,7 +994,7 @@
  *    and verifies mandatory fields are valid.
  */
 TEST_P(GnssHalTest, TestGnssMeasurementSetCallbackWithOptions) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     const int kFirstGnssMeasurementTimeoutSeconds = 10;
@@ -1024,7 +1032,7 @@
  * 2. Sets a GnssMeasurementCallback, waits for a measurement.
  */
 TEST_P(GnssHalTest, TestGnssAgcInGnssMeasurement) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     const int kFirstGnssMeasurementTimeoutSeconds = 10;
@@ -1070,7 +1078,7 @@
 TEST_P(GnssHalTest, TestGnssAntennaInfo) {
     const int kAntennaInfoTimeoutSeconds = 2;
 
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
 
@@ -1148,7 +1156,7 @@
  * capability flag is set.
  */
 TEST_P(GnssHalTest, TestGnssMeasurementCorrections) {
-    if (aidl_gnss_hal_->getInterfaceVersion() == 1) {
+    if (aidl_gnss_hal_->getInterfaceVersion() <= 1) {
         return;
     }
     if (!(aidl_gnss_cb_->last_capabilities_ &
diff --git a/gnss/common/utils/default/Utils.cpp b/gnss/common/utils/default/Utils.cpp
index 122a293..4e6a718 100644
--- a/gnss/common/utils/default/Utils.cpp
+++ b/gnss/common/utils/default/Utils.cpp
@@ -32,6 +32,7 @@
 using aidl::android::hardware::gnss::GnssLocation;
 using aidl::android::hardware::gnss::GnssMeasurement;
 using aidl::android::hardware::gnss::IGnss;
+using aidl::android::hardware::gnss::IGnssDebug;
 using aidl::android::hardware::gnss::IGnssMeasurementCallback;
 using aidl::android::hardware::gnss::SatellitePvt;
 using GnssSvInfo = aidl::android::hardware::gnss::IGnssCallback::GnssSvInfo;
@@ -181,21 +182,30 @@
             .fullInterSignalBiasUncertaintyNs = 792.0,
             .satelliteInterSignalBiasNs = 233.9,
             .satelliteInterSignalBiasUncertaintyNs = 921.2,
-            .satellitePvt = {.flags = SatellitePvt::HAS_POSITION_VELOCITY_CLOCK_INFO |
-                                      SatellitePvt::HAS_IONO | SatellitePvt::HAS_TROPO,
-                             .satPosEcef = {.posXMeters = 10442993.1153328,
-                                            .posYMeters = -19926932.8051666,
-                                            .posZMeters = -12034295.0216203,
-                                            .ureMeters = 1000.2345678},
-                             .satVelEcef = {.velXMps = -478.667183715732,
-                                            .velYMps = 1580.68371984114,
-                                            .velZMps = -3030.52994449997,
-                                            .ureRateMps = 10.2345678},
-                             .satClockInfo = {.satHardwareCodeBiasMeters = 1.396983861923e-09,
-                                              .satTimeCorrectionMeters = -7113.08964331,
-                                              .satClkDriftMps = 0},
-                             .ionoDelayMeters = 3.069949602639317e-08,
-                             .tropoDelayMeters = 3.882265204404031},
+            .satellitePvt =
+                    {
+                            .flags = SatellitePvt::HAS_POSITION_VELOCITY_CLOCK_INFO |
+                                     SatellitePvt::HAS_IONO | SatellitePvt::HAS_TROPO,
+                            .satPosEcef = {.posXMeters = 10442993.1153328,
+                                           .posYMeters = -19926932.8051666,
+                                           .posZMeters = -12034295.0216203,
+                                           .ureMeters = 1000.2345678},
+                            .satVelEcef = {.velXMps = -478.667183715732,
+                                           .velYMps = 1580.68371984114,
+                                           .velZMps = -3030.52994449997,
+                                           .ureRateMps = 10.2345678},
+                            .satClockInfo = {.satHardwareCodeBiasMeters = 1.396983861923e-09,
+                                             .satTimeCorrectionMeters = -7113.08964331,
+                                             .satClkDriftMps = 0},
+                            .ionoDelayMeters = 3.069949602639317e-08,
+                            .tropoDelayMeters = 3.882265204404031,
+                            .ephemerisSource =
+                                    SatellitePvt::SatelliteEphemerisSource::SERVER_LONG_TERM,
+                            .TOC = 12345,
+                            .IODC = 143,
+                            .TOE = 9876,
+                            .IODE = 48,
+                    },
             .correlationVectors = {}};
 
     GnssClock clock = {.gnssClockFlags = GnssClock::HAS_FULL_BIAS | GnssClock::HAS_BIAS |
diff --git a/identity/aidl/android/hardware/identity/IIdentityCredential.aidl b/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
index 84d6ed0..82b0a83 100644
--- a/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
+++ b/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
@@ -438,8 +438,9 @@
      * If the method is called on an instance obtained via IPresentationSession.getCredential(),
      * STATUS_FAILED must be returned.
      *
-     * @param challenge a challenge set by the issuer to ensure freshness. Maximum size is 32 bytes
-     *     and it may be empty. Fails with STATUS_INVALID_DATA if bigger than 32 bytes.
+     * @param challenge a challenge set by the issuer to ensure freshness. Implementations must
+     *   support challenges that are at least 32 bytes. Fails with STATUS_INVALID_DATA if bigger
+     *   than 32 bytes.
      * @return a COSE_Sign1 signature described above.
      */
     byte[] deleteCredentialWithChallenge(in byte[] challenge);
@@ -463,8 +464,9 @@
      * If the method is called on an instance obtained via IPresentationSession.getCredential(),
      * STATUS_FAILED must be returned.
      *
-     * @param challenge a challenge set by the issuer to ensure freshness. Maximum size is 32 bytes
-     *     and it may be empty. Fails with STATUS_INVALID_DATA if bigger than 32 bytes.
+     * @param challenge a challenge set by the issuer to ensure freshness. Implementations must
+     *   support challenges that are at least 32 bytes. Fails with STATUS_INVALID_DATA if bigger
+     *   than 32 bytes.
      * @return a COSE_Sign1 signature described above.
      */
     byte[] proveOwnership(in byte[] challenge);
diff --git a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
index 756b008..1c80cbb 100644
--- a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
+++ b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
@@ -127,7 +127,8 @@
      *     https://developer.android.com/training/articles/security-key-attestation#certificate_schema_attestationid
      *
      * @param attestationChallenge a challenge set by the issuer to ensure freshness. If
-     *    this is empty, the call fails with STATUS_INVALID_DATA.
+     *    this is empty, the call fails with STATUS_INVALID_DATA. Implementations must
+     *    support challenges of at least 32 bytes.
      *
      * @return the X.509 certificate chain for the credentialKey
      */
diff --git a/identity/aidl/vts/Android.bp b/identity/aidl/vts/Android.bp
index c5b84a1..20faeee 100644
--- a/identity/aidl/vts/Android.bp
+++ b/identity/aidl/vts/Android.bp
@@ -58,3 +58,16 @@
         "vts",
     ],
 }
+
+java_test_host {
+    name: "IdentityCredentialImplementedTest",
+    libs: [
+        "tradefed",
+        "vts-core-tradefed-harness",
+    ],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "vts",
+    ],
+    test_config: "IdentityCredentialImplementedTest.xml",
+}
diff --git a/identity/aidl/vts/DeleteCredentialTests.cpp b/identity/aidl/vts/DeleteCredentialTests.cpp
index 7627c9c..a126463 100644
--- a/identity/aidl/vts/DeleteCredentialTests.cpp
+++ b/identity/aidl/vts/DeleteCredentialTests.cpp
@@ -146,7 +146,9 @@
                                 credentialData_, &credential)
                         .isOk());
 
-    vector<uint8_t> challenge = {65, 66, 67};
+    // Implementations must support at least 32 bytes.
+    string challengeString = "0123456789abcdef0123456789abcdef";
+    vector<uint8_t> challenge(challengeString.begin(), challengeString.end());
     vector<uint8_t> proofOfDeletionSignature;
     ASSERT_TRUE(
             credential->deleteCredentialWithChallenge(challenge, &proofOfDeletionSignature).isOk());
@@ -154,8 +156,13 @@
             support::coseSignGetPayload(proofOfDeletionSignature);
     ASSERT_TRUE(proofOfDeletion);
     string cborPretty = cppbor::prettyPrint(proofOfDeletion.value(), 32, {});
-    EXPECT_EQ("['ProofOfDeletion', 'org.iso.18013-5.2019.mdl', {0x41, 0x42, 0x43}, true, ]",
-              cborPretty);
+    EXPECT_EQ(
+            "['ProofOfDeletion', 'org.iso.18013-5.2019.mdl', {"
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, "
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66}, true, ]",
+            cborPretty);
     EXPECT_TRUE(support::coseCheckEcDsaSignature(proofOfDeletionSignature, {},  // Additional data
                                                  credentialPubKey_));
 }
diff --git a/identity/aidl/vts/IdentityCredentialImplementedTest.xml b/identity/aidl/vts/IdentityCredentialImplementedTest.xml
new file mode 100644
index 0000000..1d76a74
--- /dev/null
+++ b/identity/aidl/vts/IdentityCredentialImplementedTest.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs IdentityCredentialImplementedTest">
+  <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
+
+  <test class="com.android.tradefed.testtype.HostTest" >
+    <option name="jar" value="IdentityCredentialImplementedTest.jar" />
+  </test>
+</configuration>
diff --git a/identity/aidl/vts/ProveOwnershipTests.cpp b/identity/aidl/vts/ProveOwnershipTests.cpp
index c622193..f8ec670 100644
--- a/identity/aidl/vts/ProveOwnershipTests.cpp
+++ b/identity/aidl/vts/ProveOwnershipTests.cpp
@@ -125,14 +125,22 @@
                                 credentialData_, &credential)
                         .isOk());
 
-    vector<uint8_t> challenge = {17, 18};
+    // Implementations must support at least 32 bytes.
+    string challengeString = "0123456789abcdef0123456789abcdef";
+    vector<uint8_t> challenge(challengeString.begin(), challengeString.end());
     vector<uint8_t> proofOfOwnershipSignature;
     ASSERT_TRUE(credential->proveOwnership(challenge, &proofOfOwnershipSignature).isOk());
     optional<vector<uint8_t>> proofOfOwnership =
             support::coseSignGetPayload(proofOfOwnershipSignature);
     ASSERT_TRUE(proofOfOwnership);
     string cborPretty = cppbor::prettyPrint(proofOfOwnership.value(), 32, {});
-    EXPECT_EQ("['ProofOfOwnership', 'org.iso.18013-5.2019.mdl', {0x11, 0x12}, true, ]", cborPretty);
+    EXPECT_EQ(
+            "['ProofOfOwnership', 'org.iso.18013-5.2019.mdl', {"
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, "
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66}, true, ]",
+            cborPretty);
     EXPECT_TRUE(support::coseCheckEcDsaSignature(proofOfOwnershipSignature, {},  // Additional data
                                                  credentialPubKey_));
 }
diff --git a/identity/aidl/vts/VtsAttestationTests.cpp b/identity/aidl/vts/VtsAttestationTests.cpp
index e12fe05..7caa259 100644
--- a/identity/aidl/vts/VtsAttestationTests.cpp
+++ b/identity/aidl/vts/VtsAttestationTests.cpp
@@ -66,7 +66,8 @@
     ASSERT_TRUE(setupWritableCredential(writableCredential, credentialStore_,
                                         false /* testCredential */));
 
-    string challenge = "NotSoRandomChallenge1NotSoRandomChallenge1NotSoRandomChallenge1";
+    // Must support at least 32 bytes.
+    string challenge = "0123456789abcdef0123456789abcdef";
     vector<uint8_t> attestationChallenge(challenge.begin(), challenge.end());
     vector<Certificate> attestationCertificate;
     string applicationId = "Attestation Verification";
diff --git a/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java b/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java
new file mode 100644
index 0000000..19568af
--- /dev/null
+++ b/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.tests.security.identity;
+
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeTrue;
+
+import android.platform.test.annotations.RequiresDevice;
+import com.android.tradefed.device.DeviceNotAvailableException;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class IdentityCredentialImplementedTest extends BaseHostJUnit4Test {
+    // Returns the ro.vendor.api_level or 0 if not set.
+    //
+    // Throws NumberFormatException if ill-formatted.
+    //
+    // Throws DeviceNotAvailableException if device is not available.
+    //
+    private int getVendorApiLevel() throws NumberFormatException, DeviceNotAvailableException {
+        String vendorApiLevelString =
+                getDevice().executeShellCommand("getprop ro.vendor.api_level").trim();
+        if (vendorApiLevelString.isEmpty()) {
+            return 0;
+        }
+        return Integer.parseInt(vendorApiLevelString);
+    }
+
+    // As of Android 13 (API level 32), Identity Credential is required at feature version 202201
+    // or newer.
+    //
+    @RequiresDevice
+    @Test
+    public void testIdentityCredentialIsImplemented() throws Exception {
+        int vendorApiLevel = getVendorApiLevel();
+        assumeTrue(vendorApiLevel >= 32);
+
+        final String minimumFeatureVersionNeeded = "202201";
+
+        String result = getDevice().executeShellCommand(
+                "pm has-feature android.hardware.identity_credential "
+                + minimumFeatureVersionNeeded);
+        if (!result.trim().equals("true")) {
+            fail("Identity Credential feature version " + minimumFeatureVersionNeeded
+                    + " required but not found");
+        }
+    }
+}
diff --git a/neuralnetworks/aidl/utils/src/Conversions.cpp b/neuralnetworks/aidl/utils/src/Conversions.cpp
index eb28db7..9b897c4 100644
--- a/neuralnetworks/aidl/utils/src/Conversions.cpp
+++ b/neuralnetworks/aidl/utils/src/Conversions.cpp
@@ -967,6 +967,11 @@
 }
 
 nn::GeneralResult<Model> unvalidatedConvert(const nn::Model& model) {
+    if (!hal::utils::hasNoPointerData(model)) {
+        return NN_ERROR(nn::ErrorStatus::INVALID_ARGUMENT)
+               << "Model cannot be unvalidatedConverted because it contains pointer-based memory";
+    }
+
     return Model{
             .main = NN_TRY(unvalidatedConvert(model.main)),
             .referenced = NN_TRY(unvalidatedConvert(model.referenced)),
@@ -982,6 +987,11 @@
 }
 
 nn::GeneralResult<Request> unvalidatedConvert(const nn::Request& request) {
+    if (!hal::utils::hasNoPointerData(request)) {
+        return NN_ERROR(nn::ErrorStatus::INVALID_ARGUMENT)
+               << "Request cannot be unvalidatedConverted because it contains pointer-based memory";
+    }
+
     return Request{
             .inputs = NN_TRY(unvalidatedConvert(request.inputs)),
             .outputs = NN_TRY(unvalidatedConvert(request.outputs)),
diff --git a/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h b/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
index ae0d092..c04294a 100644
--- a/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
+++ b/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
@@ -20,6 +20,7 @@
 #include <nnapi/Result.h>
 #include <nnapi/SharedMemory.h>
 #include <nnapi/Types.h>
+
 #include <functional>
 #include <vector>
 
@@ -47,81 +48,10 @@
         const nn::Capabilities::PerformanceInfo& float32Performance,
         const nn::Capabilities::PerformanceInfo& quantized8Performance);
 
-// Indicates if the object contains no pointer-based data that could be relocated to shared memory.
-bool hasNoPointerData(const nn::Model& model);
-bool hasNoPointerData(const nn::Request& request);
-
-// Relocate pointer-based data to shared memory. If `model` has no Operand::LifeTime::POINTER data,
-// the function returns with a reference to `model`. If `model` has Operand::LifeTime::POINTER data,
-// the model is copied to `maybeModelInSharedOut` with the POINTER data relocated to a memory pool,
-// and the function returns with a reference to `*maybeModelInSharedOut`.
-nn::GeneralResult<std::reference_wrapper<const nn::Model>> flushDataFromPointerToShared(
-        const nn::Model* model, std::optional<nn::Model>* maybeModelInSharedOut);
-
-// Record a relocation mapping between pointer-based data and shared memory.
-// Only two specializations of this template may exist:
-// - RelocationInfo<const void*> for request inputs
-// - RelocationInfo<void*> for request outputs
-template <typename PointerType>
-struct RelocationInfo {
-    PointerType data;
-    size_t length;
-    size_t offset;
-};
-using InputRelocationInfo = RelocationInfo<const void*>;
-using OutputRelocationInfo = RelocationInfo<void*>;
-
-// Keep track of the relocation mapping between pointer-based data and shared memory pool,
-// and provide method to copy the data between pointers and the shared memory pool.
-// Only two specializations of this template may exist:
-// - RelocationTracker<InputRelocationInfo> for request inputs
-// - RelocationTracker<OutputRelocationInfo> for request outputs
-template <typename RelocationInfoType>
-class RelocationTracker {
-  public:
-    static nn::GeneralResult<std::unique_ptr<RelocationTracker>> create(
-            std::vector<RelocationInfoType> relocationInfos, nn::SharedMemory memory) {
-        auto mapping = NN_TRY(map(memory));
-        return std::make_unique<RelocationTracker<RelocationInfoType>>(
-                std::move(relocationInfos), std::move(memory), std::move(mapping));
-    }
-
-    RelocationTracker(std::vector<RelocationInfoType> relocationInfos, nn::SharedMemory memory,
-                      nn::Mapping mapping)
-        : kRelocationInfos(std::move(relocationInfos)),
-          kMemory(std::move(memory)),
-          kMapping(std::move(mapping)) {}
-
-    // Specializations defined in CommonUtils.cpp.
-    // For InputRelocationTracker, this method will copy pointer data to the shared memory pool.
-    // For OutputRelocationTracker, this method will copy shared memory data to the pointers.
-    void flush() const;
-
-  private:
-    const std::vector<RelocationInfoType> kRelocationInfos;
-    const nn::SharedMemory kMemory;
-    const nn::Mapping kMapping;
-};
-using InputRelocationTracker = RelocationTracker<InputRelocationInfo>;
-using OutputRelocationTracker = RelocationTracker<OutputRelocationInfo>;
-
-struct RequestRelocation {
-    std::unique_ptr<InputRelocationTracker> input;
-    std::unique_ptr<OutputRelocationTracker> output;
-};
-
-// Relocate pointer-based data to shared memory. If `request` has no
-// Request::Argument::LifeTime::POINTER data, the function returns with a reference to `request`. If
-// `request` has Request::Argument::LifeTime::POINTER data, the request is copied to
-// `maybeRequestInSharedOut` with the POINTER data relocated to a memory pool, and the function
-// returns with a reference to `*maybeRequestInSharedOut`. The `relocationOut` will be set to track
-// the input and output relocations.
-//
-// Unlike `flushDataFromPointerToShared`, this method will not copy the input pointer data to the
-// shared memory pool. Use `relocationOut` to flush the input or output data after the call.
-nn::GeneralResult<std::reference_wrapper<const nn::Request>> convertRequestFromPointerToShared(
-        const nn::Request* request, uint32_t alignment, uint32_t padding,
-        std::optional<nn::Request>* maybeRequestInSharedOut, RequestRelocation* relocationOut);
+using nn::convertRequestFromPointerToShared;
+using nn::flushDataFromPointerToShared;
+using nn::hasNoPointerData;
+using nn::RequestRelocation;
 
 }  // namespace android::hardware::neuralnetworks::utils
 
diff --git a/neuralnetworks/utils/common/src/CommonUtils.cpp b/neuralnetworks/utils/common/src/CommonUtils.cpp
index b249881..dd55add 100644
--- a/neuralnetworks/utils/common/src/CommonUtils.cpp
+++ b/neuralnetworks/utils/common/src/CommonUtils.cpp
@@ -31,59 +31,6 @@
 #include <vector>
 
 namespace android::hardware::neuralnetworks::utils {
-namespace {
-
-bool hasNoPointerData(const nn::Operand& operand);
-bool hasNoPointerData(const nn::Model::Subgraph& subgraph);
-bool hasNoPointerData(const nn::Request::Argument& argument);
-
-template <typename Type>
-bool hasNoPointerData(const std::vector<Type>& objects) {
-    return std::all_of(objects.begin(), objects.end(),
-                       [](const auto& object) { return hasNoPointerData(object); });
-}
-
-bool hasNoPointerData(const nn::DataLocation& location) {
-    return std::visit([](auto ptr) { return ptr == nullptr; }, location.pointer);
-}
-
-bool hasNoPointerData(const nn::Operand& operand) {
-    return hasNoPointerData(operand.location);
-}
-
-bool hasNoPointerData(const nn::Model::Subgraph& subgraph) {
-    return hasNoPointerData(subgraph.operands);
-}
-
-bool hasNoPointerData(const nn::Request::Argument& argument) {
-    return hasNoPointerData(argument.location);
-}
-
-void copyPointersToSharedMemory(nn::Operand* operand, nn::ConstantMemoryBuilder* memoryBuilder) {
-    CHECK(operand != nullptr);
-    CHECK(memoryBuilder != nullptr);
-
-    if (operand->lifetime != nn::Operand::LifeTime::POINTER) {
-        return;
-    }
-
-    const void* data = std::visit([](auto ptr) { return static_cast<const void*>(ptr); },
-                                  operand->location.pointer);
-    CHECK(data != nullptr);
-    operand->lifetime = nn::Operand::LifeTime::CONSTANT_REFERENCE;
-    operand->location = memoryBuilder->append(data, operand->location.length);
-}
-
-void copyPointersToSharedMemory(nn::Model::Subgraph* subgraph,
-                                nn::ConstantMemoryBuilder* memoryBuilder) {
-    CHECK(subgraph != nullptr);
-    std::for_each(subgraph->operands.begin(), subgraph->operands.end(),
-                  [memoryBuilder](auto& operand) {
-                      copyPointersToSharedMemory(&operand, memoryBuilder);
-                  });
-}
-
-}  // anonymous namespace
 
 nn::Capabilities::OperandPerformanceTable makeQuantized8PerformanceConsistentWithP(
         const nn::Capabilities::PerformanceInfo& float32Performance,
@@ -104,131 +51,4 @@
             .value();
 }
 
-bool hasNoPointerData(const nn::Model& model) {
-    return hasNoPointerData(model.main) && hasNoPointerData(model.referenced);
-}
-
-bool hasNoPointerData(const nn::Request& request) {
-    return hasNoPointerData(request.inputs) && hasNoPointerData(request.outputs);
-}
-
-nn::GeneralResult<std::reference_wrapper<const nn::Model>> flushDataFromPointerToShared(
-        const nn::Model* model, std::optional<nn::Model>* maybeModelInSharedOut) {
-    CHECK(model != nullptr);
-    CHECK(maybeModelInSharedOut != nullptr);
-
-    if (hasNoPointerData(*model)) {
-        return *model;
-    }
-
-    // Make a copy of the model in order to make modifications. The modified model is returned to
-    // the caller through `maybeModelInSharedOut` if the function succeeds.
-    nn::Model modelInShared = *model;
-
-    nn::ConstantMemoryBuilder memoryBuilder(modelInShared.pools.size());
-    copyPointersToSharedMemory(&modelInShared.main, &memoryBuilder);
-    std::for_each(modelInShared.referenced.begin(), modelInShared.referenced.end(),
-                  [&memoryBuilder](auto& subgraph) {
-                      copyPointersToSharedMemory(&subgraph, &memoryBuilder);
-                  });
-
-    if (!memoryBuilder.empty()) {
-        auto memory = NN_TRY(memoryBuilder.finish());
-        modelInShared.pools.push_back(std::move(memory));
-    }
-
-    *maybeModelInSharedOut = modelInShared;
-    return **maybeModelInSharedOut;
-}
-
-template <>
-void InputRelocationTracker::flush() const {
-    // Copy from pointers to shared memory.
-    uint8_t* memoryPtr = static_cast<uint8_t*>(std::get<void*>(kMapping.pointer));
-    for (const auto& [data, length, offset] : kRelocationInfos) {
-        std::memcpy(memoryPtr + offset, data, length);
-    }
-}
-
-template <>
-void OutputRelocationTracker::flush() const {
-    // Copy from shared memory to pointers.
-    const uint8_t* memoryPtr = static_cast<const uint8_t*>(
-            std::visit([](auto ptr) { return static_cast<const void*>(ptr); }, kMapping.pointer));
-    for (const auto& [data, length, offset] : kRelocationInfos) {
-        std::memcpy(data, memoryPtr + offset, length);
-    }
-}
-
-nn::GeneralResult<std::reference_wrapper<const nn::Request>> convertRequestFromPointerToShared(
-        const nn::Request* request, uint32_t alignment, uint32_t padding,
-        std::optional<nn::Request>* maybeRequestInSharedOut, RequestRelocation* relocationOut) {
-    CHECK(request != nullptr);
-    CHECK(maybeRequestInSharedOut != nullptr);
-    CHECK(relocationOut != nullptr);
-
-    if (hasNoPointerData(*request)) {
-        return *request;
-    }
-
-    // Make a copy of the request in order to make modifications. The modified request is returned
-    // to the caller through `maybeRequestInSharedOut` if the function succeeds.
-    nn::Request requestInShared = *request;
-
-    RequestRelocation relocation;
-
-    // Change input pointers to shared memory.
-    nn::MutableMemoryBuilder inputBuilder(requestInShared.pools.size());
-    std::vector<InputRelocationInfo> inputRelocationInfos;
-    for (auto& input : requestInShared.inputs) {
-        const auto& location = input.location;
-        if (input.lifetime != nn::Request::Argument::LifeTime::POINTER) {
-            continue;
-        }
-
-        input.lifetime = nn::Request::Argument::LifeTime::POOL;
-        const void* data = std::visit([](auto ptr) { return static_cast<const void*>(ptr); },
-                                      location.pointer);
-        CHECK(data != nullptr);
-        input.location = inputBuilder.append(location.length, alignment, padding);
-        inputRelocationInfos.push_back({data, input.location.length, input.location.offset});
-    }
-
-    // Allocate input memory.
-    if (!inputBuilder.empty()) {
-        auto memory = NN_TRY(inputBuilder.finish());
-        requestInShared.pools.push_back(memory);
-        relocation.input = NN_TRY(
-                InputRelocationTracker::create(std::move(inputRelocationInfos), std::move(memory)));
-    }
-
-    // Change output pointers to shared memory.
-    nn::MutableMemoryBuilder outputBuilder(requestInShared.pools.size());
-    std::vector<OutputRelocationInfo> outputRelocationInfos;
-    for (auto& output : requestInShared.outputs) {
-        const auto& location = output.location;
-        if (output.lifetime != nn::Request::Argument::LifeTime::POINTER) {
-            continue;
-        }
-
-        output.lifetime = nn::Request::Argument::LifeTime::POOL;
-        void* data = std::get<void*>(location.pointer);
-        CHECK(data != nullptr);
-        output.location = outputBuilder.append(location.length, alignment, padding);
-        outputRelocationInfos.push_back({data, output.location.length, output.location.offset});
-    }
-
-    // Allocate output memory.
-    if (!outputBuilder.empty()) {
-        auto memory = NN_TRY(outputBuilder.finish());
-        requestInShared.pools.push_back(memory);
-        relocation.output = NN_TRY(OutputRelocationTracker::create(std::move(outputRelocationInfos),
-                                                                   std::move(memory)));
-    }
-
-    *maybeRequestInSharedOut = requestInShared;
-    *relocationOut = std::move(relocation);
-    return **maybeRequestInSharedOut;
-}
-
 }  // namespace android::hardware::neuralnetworks::utils
diff --git a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
index b0761bf..586e659 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
@@ -30,26 +30,22 @@
      * DeviceInfo is a CBOR Map structure described by the following CDDL.
      *
      *     DeviceInfo = {
-     *         ? "brand" : tstr,
-     *         ? "manufacturer" : tstr,
-     *         ? "product" : tstr,
-     *         ? "model" : tstr,
-     *         ? "board" : tstr,
-     *         ? "vb_state" : "green" / "yellow" / "orange",    // Taken from the AVB values
-     *         ? "bootloader_state" : "locked" / "unlocked",    // Taken from the AVB values
-     *         ? "vbmeta_digest": bstr,                         // Taken from the AVB values
-     *         ? "os_version" : tstr,                    // Same as android.os.Build.VERSION.release
-     *         ? "system_patch_level" : uint,                   // YYYYMMDD
-     *         ? "boot_patch_level" : uint,                     // YYYYMMDD
-     *         ? "vendor_patch_level" : uint,                   // YYYYMMDD
-     *         "version" : 1,                      // The CDDL schema version.
-     *         "security_level" : "tee" / "strongbox"
-     *         "att_id_state": "locked" / "open",  // Attestation IDs State. If "locked", this
-     *                                             // indicates a device's attestable IDs are
-     *                                             // factory-locked and immutable. If "open",
-     *                                             // this indicates the device is still in a
-     *                                             // provisionable state and the attestable IDs
-     *                                             // are not yet frozen.
+     *         "brand" : tstr,
+     *         "manufacturer" : tstr,
+     *         "product" : tstr,
+     *         "model" : tstr,
+     *         "device" : tstr,
+     *         "vb_state" : "green" / "yellow" / "orange",    // Taken from the AVB values
+     *         "bootloader_state" : "locked" / "unlocked",    // Taken from the AVB values
+     *         "vbmeta_digest": bstr,                         // Taken from the AVB values
+     *         "os_version" : tstr,                      // Same as android.os.Build.VERSION.release
+     *         "system_patch_level" : uint,                   // YYYYMMDD
+     *         "boot_patch_level" : uint,                     // YYYYMMDD
+     *         "vendor_patch_level" : uint,                   // YYYYMMDD
+     *         "version" : 2,                                 // The CDDL schema version.
+     *         "security_level" : "tee" / "strongbox",
+     *         "fused": 1 / 0,  // 1 if secure boot is enforced for the processor that the IRPC
+     *                          // implementation is contained in. 0 otherwise.
      *     }
      */
     byte[] deviceInfo;
diff --git a/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl b/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
index 24cdbc1..a14fc88 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
@@ -169,7 +169,6 @@
      *     PubKeyEd25519 = {                // COSE_Key
      *         1 : 1,                         // Key type : octet key pair
      *         3 : AlgorithmEdDSA,            // Algorithm : EdDSA
-     *         4 : 2,                         // Ops: Verify
      *         -1 : 6,                        // Curve : Ed25519
      *         -2 : bstr                      // X coordinate, little-endian
      *     }
@@ -184,7 +183,6 @@
      *     PubKeyECDSA256 = {                 // COSE_Key
      *         1 : 2,                         // Key type : EC2
      *         3 : AlgorithmES256,            // Algorithm : ECDSA w/ SHA-256
-     *         4 : 2,                         // Ops: Verify
      *         -1 : 1,                        // Curve: P256
      *         -2 : bstr,                     // X coordinate
      *         -3 : bstr                      // Y coordinate
diff --git a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 829780d..3a7e000 100644
--- a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -57,6 +57,22 @@
 using namespace remote_prov;
 using namespace keymaster;
 
+std::set<std::string> getAllowedVbStates() {
+    return {"green", "yellow", "orange"};
+}
+
+std::set<std::string> getAllowedBootloaderStates() {
+    return {"locked", "unlocked"};
+}
+
+std::set<std::string> getAllowedSecurityLevels() {
+    return {"tee", "strongbox"};
+}
+
+std::set<std::string> getAllowedAttIdStates() {
+    return {"locked", "open"};
+}
+
 bytevec string_to_bytevec(const char* s) {
     const uint8_t* p = reinterpret_cast<const uint8_t*>(s);
     return bytevec(p, p + strlen(s));
@@ -406,6 +422,8 @@
         ASSERT_TRUE(deviceInfoMap) << "Failed to parse deviceInfo: " << deviceInfoErrMsg;
         ASSERT_TRUE(deviceInfoMap->asMap());
 
+        checkDeviceInfo(deviceInfoMap->asMap());
+
         auto& signingKey = bccContents->back().pubKey;
         auto macKey = verifyAndParseCoseSign1(signedMac->asArray(), signingKey,
                                               cppbor::Array()  // SignedMacAad
@@ -432,6 +450,76 @@
         }
     }
 
+    void checkType(const cppbor::Map* devInfo, uint8_t majorType, std::string entryName) {
+        const auto& val = devInfo->get(entryName);
+        ASSERT_TRUE(val) << entryName << " does not exist";
+        ASSERT_EQ(val->type(), majorType) << entryName << " has the wrong type.";
+        switch (majorType) {
+            case cppbor::TSTR:
+                ASSERT_GT(val->asTstr()->value().size(), 0);
+                break;
+            case cppbor::BSTR:
+                ASSERT_GT(val->asBstr()->value().size(), 0);
+                break;
+            default:
+                break;
+        }
+    }
+
+    void checkDeviceInfo(const cppbor::Map* deviceInfo) {
+        const auto& version = deviceInfo->get("version");
+        ASSERT_TRUE(version);
+        ASSERT_TRUE(version->asUint());
+        RpcHardwareInfo info;
+        provisionable_->getHardwareInfo(&info);
+        ASSERT_EQ(version->asUint()->value(), info.versionNumber);
+        std::set<std::string> allowList;
+        switch (version->asUint()->value()) {
+            // These fields became mandated in version 2.
+            case 2:
+                checkType(deviceInfo, cppbor::TSTR, "brand");
+                checkType(deviceInfo, cppbor::TSTR, "manufacturer");
+                checkType(deviceInfo, cppbor::TSTR, "product");
+                checkType(deviceInfo, cppbor::TSTR, "model");
+                checkType(deviceInfo, cppbor::TSTR, "device");
+                // TODO: Refactor the KeyMint code that validates these fields and include it here.
+                checkType(deviceInfo, cppbor::TSTR, "vb_state");
+                allowList = getAllowedVbStates();
+                ASSERT_NE(allowList.find(deviceInfo->get("vb_state")->asTstr()->value()),
+                          allowList.end());
+                checkType(deviceInfo, cppbor::TSTR, "bootloader_state");
+                allowList = getAllowedBootloaderStates();
+                ASSERT_NE(allowList.find(deviceInfo->get("bootloader_state")->asTstr()->value()),
+                          allowList.end());
+                checkType(deviceInfo, cppbor::BSTR, "vbmeta_digest");
+                checkType(deviceInfo, cppbor::TSTR, "os_version");
+                checkType(deviceInfo, cppbor::UINT, "system_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "boot_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "vendor_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "fused");
+                ASSERT_LT(deviceInfo->get("fused")->asUint()->value(), 2);  // Must be 0 or 1.
+                checkType(deviceInfo, cppbor::TSTR, "security_level");
+                allowList = getAllowedSecurityLevels();
+                ASSERT_NE(allowList.find(deviceInfo->get("security_level")->asTstr()->value()),
+                          allowList.end());
+                break;
+            case 1:
+                checkType(deviceInfo, cppbor::TSTR, "security_level");
+                allowList = getAllowedSecurityLevels();
+                ASSERT_NE(allowList.find(deviceInfo->get("security_level")->asTstr()->value()),
+                          allowList.end());
+                if (version->asUint()->value() == 1) {
+                    checkType(deviceInfo, cppbor::TSTR, "att_id_state");
+                    allowList = getAllowedAttIdStates();
+                    ASSERT_NE(allowList.find(deviceInfo->get("att_id_state")->asTstr()->value()),
+                              allowList.end());
+                }
+                break;
+            default:
+                FAIL() << "Unrecognized version: " << version->asUint()->value();
+        }
+    }
+
     bytevec eekId_;
     size_t testEekLength_;
     EekChain testEekChain_;
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index 0cbee51..35cb891 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -26,6 +26,11 @@
 
 namespace aidl::android::hardware::security::keymint::remote_prov {
 
+constexpr uint32_t kBccPayloadIssuer = 1;
+constexpr uint32_t kBccPayloadSubject = 2;
+constexpr int32_t kBccPayloadSubjPubKey = -4670552;
+constexpr int32_t kBccPayloadKeyUsage = -4670553;
+
 bytevec kTestMacKey(32 /* count */, 0 /* byte value */);
 
 bytevec randomBytes(size_t numBytes) {
@@ -98,6 +103,18 @@
     return prodEek;
 }
 
+ErrMsgOr<bytevec> validatePayloadAndFetchPubKey(const cppbor::Map* payload) {
+    const auto& issuer = payload->get(kBccPayloadIssuer);
+    if (!issuer || !issuer->asTstr()) return "Issuer is not present or not a tstr.";
+    const auto& subject = payload->get(kBccPayloadSubject);
+    if (!subject || !subject->asTstr()) return "Subject is not present or not a tstr.";
+    const auto& keyUsage = payload->get(kBccPayloadKeyUsage);
+    if (!keyUsage || !keyUsage->asBstr()) return "Key usage is not present or not a bstr.";
+    const auto& serializedKey = payload->get(kBccPayloadSubjPubKey);
+    if (!serializedKey || !serializedKey->asBstr()) return "Key is not present or not a bstr.";
+    return serializedKey->asBstr()->value();
+}
+
 ErrMsgOr<bytevec> verifyAndParseCoseSign1Cwt(const cppbor::Array* coseSign1,
                                              const bytevec& signingCoseKey, const bytevec& aad) {
     if (!coseSign1 || coseSign1->size() != kCoseSign1EntryCount) {
@@ -126,18 +143,16 @@
         return "Unsupported signature algorithm";
     }
 
-    // TODO(jbires): Handle CWTs as the CoseSign1 payload in a less hacky way. Since the CWT payload
-    //               is extremely remote provisioning specific, probably just make a separate
-    //               function there.
     auto [parsedPayload, __, payloadErrMsg] = cppbor::parse(payload);
     if (!parsedPayload) return payloadErrMsg + " when parsing key";
     if (!parsedPayload->asMap()) return "CWT must be a map";
-    auto serializedKey = parsedPayload->asMap()->get(-4670552)->clone();
-    if (!serializedKey || !serializedKey->asBstr()) return "Could not find key entry";
+    auto serializedKey = validatePayloadAndFetchPubKey(parsedPayload->asMap());
+    if (!serializedKey) {
+        return "CWT validation failed: " + serializedKey.moveMessage();
+    }
 
     bool selfSigned = signingCoseKey.empty();
-    auto key =
-            CoseKey::parseEd25519(selfSigned ? serializedKey->asBstr()->value() : signingCoseKey);
+    auto key = CoseKey::parseEd25519(selfSigned ? *serializedKey : signingCoseKey);
     if (!key) return "Bad signing key: " + key.moveMessage();
 
     bytevec signatureInput =
@@ -148,7 +163,7 @@
         return "Signature verification failed";
     }
 
-    return serializedKey->asBstr()->value();
+    return serializedKey.moveValue();
 }
 
 ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc) {
@@ -156,8 +171,11 @@
 
     std::vector<BccEntryData> result;
 
+    const auto& devicePubKey = bcc->get(0);
+    if (!devicePubKey->asMap()) return "Invalid device public key at the 1st entry in the BCC";
+
     bytevec prevKey;
-    // TODO(jbires): Actually process the pubKey at the start of the new bcc entry
+
     for (size_t i = 1; i < bcc->size(); ++i) {
         const cppbor::Array* entry = bcc->get(i)->asArray();
         if (!entry || entry->size() != kCoseSign1EntryCount) {
@@ -177,6 +195,13 @@
 
         // This entry's public key is the signing key for the next entry.
         prevKey = payload.moveValue();
+        if (i == 1) {
+            auto [parsedRootKey, _, errMsg] = cppbor::parse(prevKey);
+            if (!parsedRootKey || !parsedRootKey->asMap()) return "Invalid payload entry in BCC.";
+            if (*parsedRootKey != *devicePubKey) {
+                return "Device public key doesn't match BCC root.";
+            }
+        }
     }
 
     return result;
diff --git a/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp b/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
index 105cb97..83d0dc9 100644
--- a/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
+++ b/sensors/aidl/vts/VtsAidlHalSensorsTargetTest.cpp
@@ -75,6 +75,7 @@
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_LIMITED_AXES);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_LIMITED_AXES_UNCALIBRATED);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(GYROSCOPE_UNCALIBRATED);
+        CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEADING);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_BEAT);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(HEART_RATE);
         CHECK_TYPE_STRING_FOR_SENSOR_TYPE(LIGHT);
@@ -144,6 +145,7 @@
         case SensorType::GEOMAGNETIC_ROTATION_VECTOR:
         case SensorType::POSE_6DOF:
         case SensorType::HEART_BEAT:
+        case SensorType::HEADING:
             return SensorInfo::SENSOR_FLAG_BITS_CONTINUOUS_MODE;
 
         case SensorType::LIGHT:
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
index 114fe4f..086166a 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
@@ -69,37 +69,6 @@
 // disable.
 bool waitForSupplicantStop() { return waitForSupplicantState(false); }
 
-// Helper function to initialize the driver and firmware to STA mode
-// using the vendor HAL HIDL interface.
-void initilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
-    if (getWifi(wifi_instance_name) != nullptr) {
-        sp<IWifiChip> wifi_chip = getWifiChip(wifi_instance_name);
-        ChipModeId mode_id;
-        EXPECT_TRUE(configureChipToSupportIfaceType(
-            wifi_chip, ::android::hardware::wifi::V1_0::IfaceType::STA, &mode_id));
-    } else {
-        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
-    }
-}
-
-// Helper function to deinitialize the driver and firmware
-// using the vendor HAL HIDL interface.
-void deInitilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
-    if (getWifi(wifi_instance_name) != nullptr) {
-        stopWifi(wifi_instance_name);
-    } else {
-        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
-    }
-}
-
 // Helper function to find any iface of the desired type exposed.
 bool findIfaceOfType(sp<ISupplicant> supplicant, IfaceType desired_type,
                      ISupplicant::IfaceInfo* out_info) {
@@ -156,14 +125,46 @@
     SupplicantManager supplicant_manager;
 
     ASSERT_TRUE(supplicant_manager.StopSupplicant());
-    deInitilializeDriverAndFirmware(wifi_instance_name);
+    deInitializeDriverAndFirmware(wifi_instance_name);
     ASSERT_FALSE(supplicant_manager.IsSupplicantRunning());
 }
 
+// Helper function to initialize the driver and firmware to STA mode
+// using the vendor HAL HIDL interface.
+void initializeDriverAndFirmware(const std::string& wifi_instance_name) {
+    // Skip if wifi instance is not set.
+    if (wifi_instance_name == "") {
+        return;
+    }
+    if (getWifi(wifi_instance_name) != nullptr) {
+        sp<IWifiChip> wifi_chip = getWifiChip(wifi_instance_name);
+        ChipModeId mode_id;
+        EXPECT_TRUE(configureChipToSupportIfaceType(
+            wifi_chip, ::android::hardware::wifi::V1_0::IfaceType::STA,
+            &mode_id));
+    } else {
+        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
+    }
+}
+
+// Helper function to deinitialize the driver and firmware
+// using the vendor HAL HIDL interface.
+void deInitializeDriverAndFirmware(const std::string& wifi_instance_name) {
+    // Skip if wifi instance is not set.
+    if (wifi_instance_name == "") {
+        return;
+    }
+    if (getWifi(wifi_instance_name) != nullptr) {
+        stopWifi(wifi_instance_name);
+    } else {
+        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
+    }
+}
+
 void startSupplicantAndWaitForHidlService(
     const std::string& wifi_instance_name,
     const std::string& supplicant_instance_name) {
-    initilializeDriverAndFirmware(wifi_instance_name);
+    initializeDriverAndFirmware(wifi_instance_name);
 
     SupplicantManager supplicant_manager;
     ASSERT_TRUE(supplicant_manager.StartSupplicant());
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
index 22cea8c..7228623 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
@@ -42,6 +42,11 @@
     const std::string& wifi_instance_name,
     const std::string& supplicant_instance_name);
 
+// Used to initialize/deinitialize the driver and firmware at the
+// beginning and end of each test.
+void initializeDriverAndFirmware(const std::string& wifi_instance_name);
+void deInitializeDriverAndFirmware(const std::string& wifi_instance_name);
+
 // Helper functions to obtain references to the various HIDL interface objects.
 // Note: We only have a single instance of each of these objects currently.
 // These helper functions should be modified to return vectors if we support
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
index ca40379..5c0aacd 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
@@ -61,6 +61,9 @@
   void reassociate();
   void reconnect();
   void registerCallback(in android.hardware.wifi.supplicant.ISupplicantStaIfaceCallback callback);
+  void setQosPolicyFeatureEnabled(in boolean enable);
+  void sendQosPolicyResponse(in boolean morePolicies, in android.hardware.wifi.supplicant.QosPolicyStatus[] qosPolicyStatusList);
+  void removeAllQosPolicies();
   void removeDppUri(in int id);
   void removeExtRadioWork(in int id);
   void removeNetwork(in int id);
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
index 37b34cf..c17c624 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
@@ -60,4 +60,6 @@
   oneway void onWpsEventFail(in byte[] bssid, in android.hardware.wifi.supplicant.WpsConfigError configError, in android.hardware.wifi.supplicant.WpsErrorIndication errorInd);
   oneway void onWpsEventPbcOverlap();
   oneway void onWpsEventSuccess();
+  oneway void onQosPolicyReset();
+  oneway void onQosPolicyRequest(in android.hardware.wifi.supplicant.QosPolicyData[] qosPolicyData);
 }
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/IpVersion.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/IpVersion.aidl
new file mode 100644
index 0000000..f571b44
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/IpVersion.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@Backing(type="byte") @VintfStability
+enum IpVersion {
+  VERSION_4 = 0,
+  VERSION_6 = 1,
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PortRange.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PortRange.aidl
new file mode 100644
index 0000000..b2004f2
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/PortRange.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@VintfStability
+parcelable PortRange {
+  int startPort;
+  int endPort;
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl
new file mode 100644
index 0000000..8fb91d0
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@Backing(type="byte") @VintfStability
+enum ProtocolNextHeader {
+  TCP = 6,
+  UDP = 17,
+  ESP = 50,
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl
new file mode 100644
index 0000000..8bf5fd8
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@VintfStability
+parcelable QosPolicyClassifierParams {
+  android.hardware.wifi.supplicant.IpVersion ipVersion;
+  android.hardware.wifi.supplicant.QosPolicyClassifierParamsMask classifierParamMask;
+  byte[] srcIp;
+  byte[] dstIp;
+  int srcPort;
+  android.hardware.wifi.supplicant.PortRange dstPortRange;
+  android.hardware.wifi.supplicant.ProtocolNextHeader protocolNextHdr;
+  byte[] flowLabelIpv6;
+  String domainName;
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl
new file mode 100644
index 0000000..280ddbe
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@Backing(type="int") @VintfStability
+enum QosPolicyClassifierParamsMask {
+  SRC_IP = 1,
+  DST_IP = 2,
+  SRC_PORT = 4,
+  DST_PORT_RANGE = 8,
+  PROTOCOL_NEXT_HEADER = 16,
+  FLOW_LABEL = 32,
+  DOMAIN_NAME = 64,
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyData.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyData.aidl
new file mode 100644
index 0000000..1719565
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyData.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@VintfStability
+parcelable QosPolicyData {
+  byte policyId;
+  android.hardware.wifi.supplicant.QosPolicyRequestType requestType;
+  byte dscp;
+  android.hardware.wifi.supplicant.QosPolicyClassifierParams classifierParams;
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl
new file mode 100644
index 0000000..4c1e4fa
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@Backing(type="byte") @VintfStability
+enum QosPolicyRequestType {
+  QOS_POLICY_ADD = 0,
+  QOS_POLICY_REMOVE = 1,
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatus.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatus.aidl
new file mode 100644
index 0000000..61278c5
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatus.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@VintfStability
+parcelable QosPolicyStatus {
+  byte policyId;
+  android.hardware.wifi.supplicant.QosPolicyStatusCode status;
+}
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl
new file mode 100644
index 0000000..4d40edc
--- /dev/null
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.wifi.supplicant;
+@Backing(type="byte") @VintfStability
+enum QosPolicyStatusCode {
+  QOS_POLICY_SUCCESS = 0,
+  QOS_POLICY_REQUEST_DECLINED = 1,
+  QOS_POLICY_CLASSIFIER_NOT_SUPPORTED = 2,
+  QOS_POLICY_INSUFFICIENT_RESOURCES = 3,
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
index b48fa04..a48a991 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIface.aidl
@@ -28,6 +28,7 @@
 import android.hardware.wifi.supplicant.ISupplicantStaNetwork;
 import android.hardware.wifi.supplicant.IfaceType;
 import android.hardware.wifi.supplicant.KeyMgmtMask;
+import android.hardware.wifi.supplicant.QosPolicyStatus;
 import android.hardware.wifi.supplicant.RxFilterType;
 import android.hardware.wifi.supplicant.WpaDriverCapabilitiesMask;
 import android.hardware.wifi.supplicant.WpsConfigMethods;
@@ -377,6 +378,37 @@
     void registerCallback(in ISupplicantStaIfaceCallback callback);
 
     /**
+     * Enable/disable QoS policy feature.
+     * @param enable true to enable, false to disable.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|
+     */
+    void setQosPolicyFeatureEnabled(in boolean enable);
+
+    /**
+     * Send a DSCP policy response to the AP. If a DSCP request is ongoing,
+     * sends a solicited (uses the ongoing DSCP request as dialog token) DSCP
+     * response. Otherwise, sends an unsolicited DSCP response.
+     *
+     * @param morePolicies Flag to indicate more QoS policies can be accommodated.
+     * @param qosPolicyStatusList QoS policy status info for each QoS policy id.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_UNSUPPORTED|
+     */
+    void sendQosPolicyResponse(in boolean morePolicies, in QosPolicyStatus[] qosPolicyStatusList);
+
+    /**
+     * Indicate removal of all active QoS policies configured by the AP.
+     *
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_UNSUPPORTED|
+     */
+    void removeAllQosPolicies();
+
+    /**
      * Remove a DPP peer URI.
      *
      * @param id The ID of the URI, as returned by |addDppPeerUri|.
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
index 594fef9..ca63f5c 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaIfaceCallback.aidl
@@ -26,6 +26,7 @@
 import android.hardware.wifi.supplicant.DppProgressCode;
 import android.hardware.wifi.supplicant.Hs20AnqpData;
 import android.hardware.wifi.supplicant.OsuMethod;
+import android.hardware.wifi.supplicant.QosPolicyData;
 import android.hardware.wifi.supplicant.StaIfaceCallbackState;
 import android.hardware.wifi.supplicant.StaIfaceReasonCode;
 import android.hardware.wifi.supplicant.WpsConfigError;
@@ -275,4 +276,17 @@
      * Used to indicate the success of a WPS connection attempt.
      */
     oneway void onWpsEventSuccess();
+
+    /**
+     * Used to indicate that the AP has cleared all DSCP requests
+     * associated with this device.
+     */
+    oneway void onQosPolicyReset();
+
+    /**
+     * Used to indicate a DSCP request was received from the AP.
+     *
+     * @param qosPolicyData QoS policies info requested by the AP.
+     */
+    oneway void onQosPolicyRequest(in QosPolicyData[] qosPolicyData);
 }
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/IpVersion.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/IpVersion.aidl
new file mode 100644
index 0000000..ad83fd7
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/IpVersion.aidl
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Enum values for IP version.
+ */
+@VintfStability
+@Backing(type="byte")
+enum IpVersion {
+    VERSION_4,
+    VERSION_6,
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PortRange.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PortRange.aidl
new file mode 100644
index 0000000..0b8385e
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/PortRange.aidl
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Port range to indicate start port and end port number.
+ */
+@VintfStability
+parcelable PortRange {
+    int startPort;
+    int endPort;
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl
new file mode 100644
index 0000000..643405b
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ProtocolNextHeader.aidl
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Enum values for Protocol/Next Header.
+ */
+@VintfStability
+@Backing(type="byte")
+enum ProtocolNextHeader {
+    TCP = 6,
+    UDP = 17,
+    ESP = 50,
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl
new file mode 100644
index 0000000..d95d18d
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParams.aidl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+import android.hardware.wifi.supplicant.IpVersion;
+import android.hardware.wifi.supplicant.PortRange;
+import android.hardware.wifi.supplicant.ProtocolNextHeader;
+import android.hardware.wifi.supplicant.QosPolicyClassifierParamsMask;
+
+/**
+ * QoS policy classifier parameters. Refer section 5.4 of the
+ * WFA (WiFi Alliance) QoS Management Specification v2.0.
+ */
+@VintfStability
+parcelable QosPolicyClassifierParams {
+    IpVersion ipVersion;
+
+    /**
+     * Classifier bit mask to identify filled fields. Setting a bit
+     * in the mask to 1 means the corresponding field in this struct
+     * has a value. Otherwise, that field should be ignored.
+     */
+    QosPolicyClassifierParamsMask classifierParamMask;
+
+    /** Source IP address. */
+    byte[] srcIp;
+
+    /** Destination IP address. */
+    byte[] dstIp;
+
+    /** Source port. */
+    int srcPort;
+
+    /**
+     * Destination port range. In the case of a single destination port,
+     * both startPort and endPort will have the same values.
+     */
+    PortRange dstPortRange;
+
+    /** Represents protocol for IPv4 and Next Header for IPv6. */
+    ProtocolNextHeader protocolNextHdr;
+
+    /** Applicable only for IPv6. */
+    byte[/* 3 */] flowLabelIpv6;
+
+    /**
+     * Domain Name encoded and formatted in accordance with the rules for
+     * "reg-name" in RFC 3986.
+     */
+    String domainName;
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl
new file mode 100644
index 0000000..51bc14c
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyClassifierParamsMask.aidl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Enum values for QoS policy classifier params mask bits.
+ */
+@VintfStability
+@Backing(type="int")
+enum QosPolicyClassifierParamsMask {
+    SRC_IP = 1 << 0,
+    DST_IP = 1 << 1,
+    SRC_PORT = 1 << 2,
+    DST_PORT_RANGE = 1 << 3,
+    PROTOCOL_NEXT_HEADER = 1 << 4,
+    FLOW_LABEL = 1 << 5,
+    DOMAIN_NAME = 1 << 6,
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyData.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyData.aidl
new file mode 100644
index 0000000..0ae0def
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyData.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+import android.hardware.wifi.supplicant.QosPolicyClassifierParams;
+import android.hardware.wifi.supplicant.QosPolicyRequestType;
+
+/**
+ * QoS policy information in DSCP request.
+ */
+@VintfStability
+parcelable QosPolicyData {
+    /** QoS Policy identifier. */
+    byte policyId;
+
+    QosPolicyRequestType requestType;
+
+    /**
+     * DSCP value to be set for uplink traffic streams matched with
+     * |classifierParams|. Applicable only when |requestType| is
+     * |QOS_POLICY_ADD|.
+     */
+    byte dscp;
+
+    /**
+     * QoS policy classifier params. Applicable only when |requestType|
+     * is |QOS_POLICY_ADD|.
+     */
+    QosPolicyClassifierParams classifierParams;
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl
new file mode 100644
index 0000000..fd9a8d0
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyRequestType.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Enum values for QoS Policy request type.
+ */
+@VintfStability
+@Backing(type="byte")
+enum QosPolicyRequestType {
+    /**
+     * If an Add request includes an existing policy,
+     * it should be considered an update request by the handler.
+     */
+    QOS_POLICY_ADD,
+    QOS_POLICY_REMOVE,
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatus.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatus.aidl
new file mode 100644
index 0000000..9087048
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatus.aidl
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+import android.hardware.wifi.supplicant.QosPolicyStatusCode;
+
+/**
+ * QoS policy status tuple.
+ */
+@VintfStability
+parcelable QosPolicyStatus {
+    byte policyId;
+    QosPolicyStatusCode status;
+}
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl
new file mode 100644
index 0000000..8ab60ad
--- /dev/null
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/QosPolicyStatusCode.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi.supplicant;
+
+/**
+ * Enum values for QoS policy response status.
+ */
+@VintfStability
+@Backing(type="byte")
+enum QosPolicyStatusCode {
+    QOS_POLICY_SUCCESS,
+    QOS_POLICY_REQUEST_DECLINED,
+    QOS_POLICY_CLASSIFIER_NOT_SUPPORTED,
+    QOS_POLICY_INSUFFICIENT_RESOURCES,
+}
diff --git a/wifi/supplicant/aidl/vts/functional/Android.bp b/wifi/supplicant/aidl/vts/functional/Android.bp
index 65f9652..8e142ec 100644
--- a/wifi/supplicant/aidl/vts/functional/Android.bp
+++ b/wifi/supplicant/aidl/vts/functional/Android.bp
@@ -33,11 +33,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
@@ -55,11 +67,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
@@ -77,11 +101,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
index 470a9b0..90ca215 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
@@ -169,8 +169,7 @@
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
@@ -184,13 +183,13 @@
             GTEST_SKIP() << "Wi-Fi Direct is not supported, skip this test.";
         }
 
-        EXPECT_TRUE(supplicant_->addP2pInterface(getP2pIfaceName(), &p2p_iface_)
+        EXPECT_TRUE(supplicant_->getP2pInterface(getP2pIfaceName(), &p2p_iface_)
                         .isOk());
         ASSERT_NE(p2p_iface_, nullptr);
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
index 6e6955f..c163864 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
@@ -191,27 +191,32 @@
     ::ndk::ScopedAStatus onWpsEventSuccess() override {
         return ndk::ScopedAStatus::ok();
     }
+    ::ndk::ScopedAStatus onQosPolicyReset() override { return ndk::ScopedAStatus::ok(); }
+    ::ndk::ScopedAStatus onQosPolicyRequest(
+            const std::vector<::aidl::android::hardware::wifi::supplicant ::
+                                      QosPolicyData /* qosPolicyData */>&) override {
+        return ndk::ScopedAStatus::ok();
+    }
 };
 
 class SupplicantStaIfaceAidlTest : public testing::TestWithParam<std::string> {
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
                                          true,  // show timestamps
                                          true)
                         .isOk());
-        EXPECT_TRUE(supplicant_->addStaInterface(getStaIfaceName(), &sta_iface_)
+        EXPECT_TRUE(supplicant_->getStaInterface(getStaIfaceName(), &sta_iface_)
                         .isOk());
         ASSERT_NE(sta_iface_, nullptr);
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
index c6dd981..b3f70da 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
@@ -105,15 +105,14 @@
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
                                          true,  // show timestamps
                                          true)
                         .isOk());
-        EXPECT_TRUE(supplicant_->addStaInterface(getStaIfaceName(), &sta_iface_)
+        EXPECT_TRUE(supplicant_->getStaInterface(getStaIfaceName(), &sta_iface_)
                         .isOk());
         ASSERT_NE(sta_iface_, nullptr);
         EXPECT_TRUE(sta_iface_->addNetwork(&sta_network_).isOk());
@@ -121,7 +120,7 @@
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
index b7e1a80..17e0394 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
@@ -19,8 +19,14 @@
 
 #include <VtsCoreUtil.h>
 #include <android-base/logging.h>
+#include <android/hardware/wifi/1.0/IWifi.h>
+#include <hidl/ServiceManagement.h>
+#include <supplicant_hidl_test_utils.h>
 #include <wifi_system/supplicant_manager.h>
 
+using aidl::android::hardware::wifi::supplicant::IfaceInfo;
+using aidl::android::hardware::wifi::supplicant::ISupplicant;
+using aidl::android::hardware::wifi::supplicant::ISupplicantP2pIface;
 using aidl::android::hardware::wifi::supplicant::ISupplicantStaIface;
 using aidl::android::hardware::wifi::supplicant::KeyMgmtMask;
 using android::wifi_system::SupplicantManager;
@@ -37,6 +43,14 @@
     return std::string(buffer.data());
 }
 
+std::string getWifiInstanceName() {
+    const std::vector<std::string> instances =
+        android::hardware::getAllHalInstanceNames(
+            ::android::hardware::wifi::V1_0::IWifi::descriptor);
+    EXPECT_NE(0, instances.size());
+    return instances.size() != 0 ? instances[0] : "";
+}
+
 bool keyMgmtSupported(std::shared_ptr<ISupplicantStaIface> iface,
                       KeyMgmtMask expected) {
     KeyMgmtMask caps;
@@ -53,60 +67,44 @@
     return keyMgmtSupported(iface, filsMask);
 }
 
-bool waitForSupplicantState(bool is_running) {
+void startSupplicant() {
+    initializeDriverAndFirmware(getWifiInstanceName());
     SupplicantManager supplicant_manager;
-    int count = 50; /* wait at most 5 seconds for completion */
-    while (count-- > 0) {
-        if (supplicant_manager.IsSupplicantRunning() == is_running) {
-            return true;
-        }
-        usleep(100000);
-    }
-    LOG(ERROR) << "Supplicant not " << (is_running ? "running" : "stopped");
-    return false;
+    ASSERT_TRUE(supplicant_manager.StartSupplicant());
+    ASSERT_TRUE(supplicant_manager.IsSupplicantRunning());
 }
 
-bool waitForFrameworkReady() {
-    int waitCount = 15;
-    do {
-        // Check whether package service is ready or not.
-        if (!testing::checkSubstringInCommandOutput(
-                "/system/bin/service check package", ": not found")) {
-            return true;
-        }
-        LOG(INFO) << "Framework is not ready";
-        sleep(1);
-    } while (waitCount-- > 0);
-    return false;
-}
-
-bool waitForSupplicantStart() { return waitForSupplicantState(true); }
-
-bool waitForSupplicantStop() { return waitForSupplicantState(false); }
-
-void stopSupplicant() {
-    SupplicantManager supplicant_manager;
-    ASSERT_TRUE(supplicant_manager.StopSupplicant());
-    ASSERT_FALSE(supplicant_manager.IsSupplicantRunning());
-}
-
-bool startWifiFramework() {
-    std::system("svc wifi enable");
-    std::system("cmd wifi set-scan-always-available enabled");
-    return waitForSupplicantStart();
-}
-
-bool stopWifiFramework() {
-    std::system("svc wifi disable");
-    std::system("cmd wifi set-scan-always-available disabled");
-    return waitForSupplicantStop();
-}
+// Wrapper around the implementation in supplicant_hidl_test_util.
+void stopSupplicantService() { stopSupplicant(getWifiInstanceName()); }
 
 void initializeService() {
     ASSERT_TRUE(stopWifiFramework());
     std::system("/system/bin/start");
     ASSERT_TRUE(waitForFrameworkReady());
-    stopSupplicant();
+    stopSupplicantService();
+    startSupplicant();
+}
+
+void addStaIface(const std::shared_ptr<ISupplicant> supplicant) {
+    ASSERT_TRUE(supplicant.get());
+    std::shared_ptr<ISupplicantStaIface> iface;
+    ASSERT_TRUE(supplicant->addStaInterface(getStaIfaceName(), &iface).isOk());
+}
+
+void addP2pIface(const std::shared_ptr<ISupplicant> supplicant) {
+    ASSERT_TRUE(supplicant.get());
+    std::shared_ptr<ISupplicantP2pIface> iface;
+    ASSERT_TRUE(supplicant->addP2pInterface(getP2pIfaceName(), &iface).isOk());
+}
+
+std::shared_ptr<ISupplicant> getSupplicant(const char* supplicant_name) {
+    std::shared_ptr<ISupplicant> supplicant = ISupplicant::fromBinder(
+        ndk::SpAIBinder(AServiceManager_waitForService(supplicant_name)));
+    addStaIface(supplicant);
+    if (testing::deviceSupportsFeature("android.hardware.wifi.direct")) {
+        addP2pIface(supplicant);
+    }
+    return supplicant;
 }
 
 #endif  // SUPPLICANT_TEST_UTILS_H
\ No newline at end of file