diff --git a/audio/core/all-versions/default/Conversions.cpp b/audio/core/all-versions/default/Conversions.cpp
index 11872c0..eddff55 100644
--- a/audio/core/all-versions/default/Conversions.cpp
+++ b/audio/core/all-versions/default/Conversions.cpp
@@ -19,6 +19,7 @@
 #include <stdio.h>
 
 #include <log/log.h>
+#include <media/AudioContainers.h>
 
 namespace android {
 namespace hardware {
@@ -31,26 +32,22 @@
     char halAddress[AUDIO_DEVICE_MAX_ADDRESS_LEN];
     memset(halAddress, 0, sizeof(halAddress));
     uint32_t halDevice = static_cast<uint32_t>(address.device);
-    const bool isInput = (halDevice & AUDIO_DEVICE_BIT_IN) != 0;
-    if (isInput) halDevice &= ~AUDIO_DEVICE_BIT_IN;
-    if ((!isInput && (halDevice & AUDIO_DEVICE_OUT_ALL_A2DP) != 0) ||
-        (isInput && (halDevice & AUDIO_DEVICE_IN_BLUETOOTH_A2DP) != 0)) {
+    if (getAudioDeviceOutAllA2dpSet().count(halDevice) > 0 ||
+        halDevice == AUDIO_DEVICE_IN_BLUETOOTH_A2DP) {
         snprintf(halAddress, sizeof(halAddress), "%02X:%02X:%02X:%02X:%02X:%02X",
                  address.address.mac[0], address.address.mac[1], address.address.mac[2],
                  address.address.mac[3], address.address.mac[4], address.address.mac[5]);
-    } else if ((!isInput && (halDevice & AUDIO_DEVICE_OUT_IP) != 0) ||
-               (isInput && (halDevice & AUDIO_DEVICE_IN_IP) != 0)) {
+    } else if (halDevice == AUDIO_DEVICE_OUT_IP || halDevice == AUDIO_DEVICE_IN_IP) {
         snprintf(halAddress, sizeof(halAddress), "%d.%d.%d.%d", address.address.ipv4[0],
                  address.address.ipv4[1], address.address.ipv4[2], address.address.ipv4[3]);
-    } else if ((!isInput && (halDevice & AUDIO_DEVICE_OUT_ALL_USB) != 0) ||
-               (isInput && (halDevice & AUDIO_DEVICE_IN_ALL_USB) != 0)) {
+    } else if (getAudioDeviceOutAllUsbSet().count(halDevice) > 0 ||
+               getAudioDeviceInAllUsbSet().count(halDevice) > 0) {
         snprintf(halAddress, sizeof(halAddress), "card=%d;device=%d", address.address.alsa.card,
                  address.address.alsa.device);
-    } else if ((!isInput && (halDevice & AUDIO_DEVICE_OUT_BUS) != 0) ||
-               (isInput && (halDevice & AUDIO_DEVICE_IN_BUS) != 0)) {
+    } else if (halDevice == AUDIO_DEVICE_OUT_BUS || halDevice == AUDIO_DEVICE_IN_BUS) {
         snprintf(halAddress, sizeof(halAddress), "%s", address.busAddress.c_str());
-    } else if ((!isInput && (halDevice & AUDIO_DEVICE_OUT_REMOTE_SUBMIX)) != 0 ||
-               (isInput && (halDevice & AUDIO_DEVICE_IN_REMOTE_SUBMIX) != 0)) {
+    } else if (halDevice == AUDIO_DEVICE_OUT_REMOTE_SUBMIX ||
+               halDevice == AUDIO_DEVICE_IN_REMOTE_SUBMIX) {
         snprintf(halAddress, sizeof(halAddress), "%s", address.rSubmixAddress.c_str());
     }
     return halAddress;
@@ -67,32 +64,28 @@
         return OK;
     }
 
-    const bool isInput = (device & AUDIO_DEVICE_BIT_IN) != 0;
-    if (isInput) device &= ~AUDIO_DEVICE_BIT_IN;
-    if ((!isInput && (device & AUDIO_DEVICE_OUT_ALL_A2DP) != 0) ||
-        (isInput && (device & AUDIO_DEVICE_IN_BLUETOOTH_A2DP) != 0)) {
+    if (getAudioDeviceOutAllA2dpSet().count(device) > 0 ||
+        device == AUDIO_DEVICE_IN_BLUETOOTH_A2DP) {
         int status =
             sscanf(halAddress, "%hhX:%hhX:%hhX:%hhX:%hhX:%hhX", &address->address.mac[0],
                    &address->address.mac[1], &address->address.mac[2], &address->address.mac[3],
                    &address->address.mac[4], &address->address.mac[5]);
         return status == 6 ? OK : BAD_VALUE;
-    } else if ((!isInput && (device & AUDIO_DEVICE_OUT_IP) != 0) ||
-               (isInput && (device & AUDIO_DEVICE_IN_IP) != 0)) {
+    } else if (device == AUDIO_DEVICE_OUT_IP || device == AUDIO_DEVICE_IN_IP) {
         int status =
             sscanf(halAddress, "%hhu.%hhu.%hhu.%hhu", &address->address.ipv4[0],
                    &address->address.ipv4[1], &address->address.ipv4[2], &address->address.ipv4[3]);
         return status == 4 ? OK : BAD_VALUE;
-    } else if ((!isInput && (device & AUDIO_DEVICE_OUT_ALL_USB)) != 0 ||
-               (isInput && (device & AUDIO_DEVICE_IN_ALL_USB)) != 0) {
+    } else if (getAudioDeviceOutAllUsbSet().count(device) > 0 ||
+               getAudioDeviceInAllUsbSet().count(device) > 0) {
         int status = sscanf(halAddress, "card=%d;device=%d", &address->address.alsa.card,
                             &address->address.alsa.device);
         return status == 2 ? OK : BAD_VALUE;
-    } else if ((!isInput && (device & AUDIO_DEVICE_OUT_BUS) != 0) ||
-               (isInput && (device & AUDIO_DEVICE_IN_BUS) != 0)) {
+    } else if (device == AUDIO_DEVICE_OUT_BUS || device == AUDIO_DEVICE_IN_BUS) {
         address->busAddress = halAddress;
         return OK;
-    } else if ((!isInput && (device & AUDIO_DEVICE_OUT_REMOTE_SUBMIX)) != 0 ||
-               (isInput && (device & AUDIO_DEVICE_IN_REMOTE_SUBMIX) != 0)) {
+    } else if (device == AUDIO_DEVICE_OUT_REMOTE_SUBMIX ||
+               device == AUDIO_DEVICE_IN_REMOTE_SUBMIX) {
         address->rSubmixAddress = halAddress;
         return OK;
     }
diff --git a/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp b/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
index 22e60be..2afbbb8 100644
--- a/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
+++ b/audio/core/all-versions/vts/functional/6.0/AudioPrimaryHidlHalTest.cpp
@@ -83,7 +83,6 @@
                     for (auto& config : configs) {
                         // Some combinations of flags declared in the config file require special
                         // treatment.
-                        bool special = false;
                         if (flags & AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD) {
                             config.offloadInfo.sampleRateHz = config.sampleRateHz;
                             config.offloadInfo.channelMask = config.channelMask;
@@ -94,22 +93,13 @@
                             config.offloadInfo.bitWidth = 16;
                             config.offloadInfo.bufferSize = 256;  // arbitrary value
                             config.offloadInfo.usage = AudioUsage::MEDIA;
-                            result.emplace_back(
-                                    device, config,
-                                    AudioOutputFlag(AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD));
-                            special = true;
-                        }
-                        if ((flags & AUDIO_OUTPUT_FLAG_DIRECT) &&
-                            !(flags &
-                              (AUDIO_OUTPUT_FLAG_HW_AV_SYNC | AUDIO_OUTPUT_FLAG_MMAP_NOIRQ))) {
                             result.emplace_back(device, config,
-                                                AudioOutputFlag(AUDIO_OUTPUT_FLAG_DIRECT));
-                            special = true;
-                        }
-                        if (flags & AUDIO_OUTPUT_FLAG_PRIMARY) {  // ignore the flag
-                            flags &= ~AUDIO_OUTPUT_FLAG_PRIMARY;
-                        }
-                        if (!special) {
+                                                AudioOutputFlag(AUDIO_OUTPUT_FLAG_COMPRESS_OFFLOAD |
+                                                                AUDIO_OUTPUT_FLAG_DIRECT));
+                        } else {
+                            if (flags & AUDIO_OUTPUT_FLAG_PRIMARY) {  // ignore the flag
+                                flags &= ~AUDIO_OUTPUT_FLAG_PRIMARY;
+                            }
                             result.emplace_back(device, config, AudioOutputFlag(flags));
                         }
                     }
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp
index 0afa779..33ec996 100644
--- a/audio/effect/all-versions/default/Effect.cpp
+++ b/audio/effect/all-versions/default/Effect.cpp
@@ -713,7 +713,10 @@
 #elif MAJOR_VERSION >= 6
     // No need to join the processing thread, it is part of the API contract that the client
     // must finish processing before closing the effect.
-    return analyzeStatus("EffectRelease", "", sContextCallFunction, EffectRelease(mHandle));
+    Result retval =
+            analyzeStatus("EffectRelease", "", sContextCallFunction, EffectRelease(mHandle));
+    EffectMap::getInstance().remove(mHandle);
+    return retval;
 #endif
 }
 
diff --git a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
index d689e62..8ee3c54 100644
--- a/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
+++ b/automotive/vehicle/2.0/default/common/include/vhal_v2_0/VmsUtils.h
@@ -153,7 +153,7 @@
 std::unique_ptr<VehiclePropValue> createAvailabilityRequest();
 
 // Creates a VehiclePropValue containing a message of type
-// VmsMessageType.AVAILABILITY_REQUEST.
+// VmsMessageType.SUBSCRIPTIONS_REQUEST.
 std::unique_ptr<VehiclePropValue> createSubscriptionsRequest();
 
 // Creates a VehiclePropValue containing a message of type VmsMessageType.DATA.
@@ -202,21 +202,21 @@
 
 // Returns true if the new sequence number is greater than the last seen
 // sequence number.
-bool isSequenceNumberNewer(const VehiclePropValue& subscription_change,
+bool isSequenceNumberNewer(const VehiclePropValue& subscriptions_state,
                            const int last_seen_sequence_number);
 
 // Returns sequence number of the message.
-int32_t getSequenceNumberForSubscriptionsState(const VehiclePropValue& subscription_change);
+int32_t getSequenceNumberForSubscriptionsState(const VehiclePropValue& subscriptions_state);
 
-// Takes a subscription change message and returns the layers that have active
+// Takes a subscriptions state message and returns the layers that have active
 // subscriptions of the layers that are offered by your HAL client/publisher.
 //
-// A publisher can use this function when receiving a subscription change message
-// to determine which layers to publish data on.
+// A publisher can use this function when receiving a subscriptions response or subscriptions
+// change message to determine which layers to publish data on.
 // The caller of this function can optionally decide to not consume these layers
 // if the subscription change has the sequence number less than the last seen
 // sequence number.
-std::vector<VmsLayer> getSubscribedLayers(const VehiclePropValue& subscription_change,
+std::vector<VmsLayer> getSubscribedLayers(const VehiclePropValue& subscriptions_state,
                                           const VmsOffers& offers);
 
 // Takes an availability change message and returns true if the parsed message implies that
diff --git a/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp b/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
index d346206..9eba905 100644
--- a/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VmsUtils.cpp
@@ -194,32 +194,35 @@
     return -1;
 }
 
-bool isSequenceNumberNewer(const VehiclePropValue& subscription_change,
+bool isSequenceNumberNewer(const VehiclePropValue& subscriptions_state,
                            const int last_seen_sequence_number) {
-    return (isValidVmsMessage(subscription_change) &&
-            parseMessageType(subscription_change) == VmsMessageType::SUBSCRIPTIONS_CHANGE &&
-            subscription_change.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex &&
-            subscription_change.value.int32Values[kSubscriptionStateSequenceNumberIndex] >
+    return (isValidVmsMessage(subscriptions_state) &&
+            (parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_CHANGE ||
+             parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_RESPONSE) &&
+            subscriptions_state.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex &&
+            subscriptions_state.value.int32Values[kSubscriptionStateSequenceNumberIndex] >
                     last_seen_sequence_number);
 }
 
-int32_t getSequenceNumberForSubscriptionsState(const VehiclePropValue& subscription_change) {
-    if (isValidVmsMessage(subscription_change) &&
-        parseMessageType(subscription_change) == VmsMessageType::SUBSCRIPTIONS_CHANGE &&
-        subscription_change.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex) {
-        return subscription_change.value.int32Values[kSubscriptionStateSequenceNumberIndex];
+int32_t getSequenceNumberForSubscriptionsState(const VehiclePropValue& subscriptions_state) {
+    if (isValidVmsMessage(subscriptions_state) &&
+        (parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_CHANGE ||
+         parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_RESPONSE) &&
+        subscriptions_state.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex) {
+        return subscriptions_state.value.int32Values[kSubscriptionStateSequenceNumberIndex];
     }
     return -1;
 }
 
-std::vector<VmsLayer> getSubscribedLayers(const VehiclePropValue& subscription_change,
+std::vector<VmsLayer> getSubscribedLayers(const VehiclePropValue& subscriptions_state,
                                           const VmsOffers& offers) {
-    if (isValidVmsMessage(subscription_change) &&
-        parseMessageType(subscription_change) == VmsMessageType::SUBSCRIPTIONS_CHANGE &&
-        subscription_change.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex) {
-        const int32_t num_of_layers = subscription_change.value.int32Values[toInt(
+    if (isValidVmsMessage(subscriptions_state) &&
+        (parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_CHANGE ||
+         parseMessageType(subscriptions_state) == VmsMessageType::SUBSCRIPTIONS_RESPONSE) &&
+        subscriptions_state.value.int32Values.size() > kSubscriptionStateSequenceNumberIndex) {
+        const int32_t num_of_layers = subscriptions_state.value.int32Values[toInt(
                 VmsSubscriptionsStateIntegerValuesIndex::NUMBER_OF_LAYERS)];
-        const int32_t num_of_associated_layers = subscription_change.value.int32Values[toInt(
+        const int32_t num_of_associated_layers = subscriptions_state.value.int32Values[toInt(
                 VmsSubscriptionsStateIntegerValuesIndex ::NUMBER_OF_ASSOCIATED_LAYERS)];
 
         std::unordered_set<VmsLayer, VmsLayer::VmsLayerHashFunction> offered_layers;
@@ -231,9 +234,9 @@
         int current_index = toInt(VmsSubscriptionsStateIntegerValuesIndex::SUBSCRIPTIONS_START);
         // Add all subscribed layers which are offered by the current publisher.
         for (int i = 0; i < num_of_layers; i++) {
-            VmsLayer layer = VmsLayer(subscription_change.value.int32Values[current_index],
-                                      subscription_change.value.int32Values[current_index + 1],
-                                      subscription_change.value.int32Values[current_index + 2]);
+            VmsLayer layer = VmsLayer(subscriptions_state.value.int32Values[current_index],
+                                      subscriptions_state.value.int32Values[current_index + 1],
+                                      subscriptions_state.value.int32Values[current_index + 2]);
             if (offered_layers.find(layer) != offered_layers.end()) {
                 subscribed_layers.push_back(layer);
             }
@@ -243,15 +246,15 @@
         // For this, we need to check if the associated layer has a publisher ID which is
         // same as that of the current publisher.
         for (int i = 0; i < num_of_associated_layers; i++) {
-            VmsLayer layer = VmsLayer(subscription_change.value.int32Values[current_index],
-                                      subscription_change.value.int32Values[current_index + 1],
-                                      subscription_change.value.int32Values[current_index + 2]);
+            VmsLayer layer = VmsLayer(subscriptions_state.value.int32Values[current_index],
+                                      subscriptions_state.value.int32Values[current_index + 1],
+                                      subscriptions_state.value.int32Values[current_index + 2]);
             current_index += kLayerSize;
             if (offered_layers.find(layer) != offered_layers.end()) {
-                int32_t num_of_publisher_ids = subscription_change.value.int32Values[current_index];
+                int32_t num_of_publisher_ids = subscriptions_state.value.int32Values[current_index];
                 current_index++;
                 for (int j = 0; j < num_of_publisher_ids; j++) {
-                    if (subscription_change.value.int32Values[current_index] ==
+                    if (subscriptions_state.value.int32Values[current_index] ==
                         offers.publisher_id) {
                         subscribed_layers.push_back(layer);
                     }
diff --git a/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp b/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
index 7189212..8b547f1 100644
--- a/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/VmsUtils_test.cpp
@@ -214,57 +214,82 @@
     EXPECT_EQ(parsePublisherIdResponse(*message), -1);
 }
 
-TEST(VmsUtilsTest, validSequenceNumberForSubscriptionsState) {
+TEST(VmsUtilsTest, validSequenceNumberForSubscriptionsChange) {
     auto message = createBaseVmsMessage(2);
     message->value.int32Values =
             hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE), 1234};
     EXPECT_EQ(getSequenceNumberForSubscriptionsState(*message), 1234);
 }
 
+TEST(VmsUtilsTest, validSequenceNumberForSubscriptionsResponse) {
+    auto message = createBaseVmsMessage(2);
+    message->value.int32Values =
+            hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_RESPONSE), 1234};
+    EXPECT_EQ(getSequenceNumberForSubscriptionsState(*message), 1234);
+}
+
 TEST(VmsUtilsTest, invalidSubscriptionsState) {
     auto message = createBaseVmsMessage(1);
     EXPECT_EQ(getSequenceNumberForSubscriptionsState(*message), -1);
 }
 
-TEST(VmsUtilsTest, newSequenceNumberForExistingSmallerNumber) {
+TEST(VmsUtilsTest, newSequenceNumberForExistingSmallerNumberForChange) {
     auto message = createBaseVmsMessage(2);
     message->value.int32Values =
             hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE), 1234};
     EXPECT_TRUE(isSequenceNumberNewer(*message, 1233));
 }
 
-TEST(VmsUtilsTest, newSequenceNumberForExistingGreaterNumber) {
+TEST(VmsUtilsTest, newSequenceNumberForExistingSmallerNumberForResponse) {
+    auto message = createBaseVmsMessage(2);
+    message->value.int32Values =
+            hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_RESPONSE), 1234};
+    EXPECT_TRUE(isSequenceNumberNewer(*message, 1233));
+}
+
+TEST(VmsUtilsTest, newSequenceNumberForExistingGreaterNumberForChange) {
     auto message = createBaseVmsMessage(2);
     message->value.int32Values =
             hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE), 1234};
     EXPECT_FALSE(isSequenceNumberNewer(*message, 1235));
 }
 
-TEST(VmsUtilsTest, newSequenceNumberForSameNumber) {
+TEST(VmsUtilsTest, newSequenceNumberForExistingGreaterNumberForResponse) {
+    auto message = createBaseVmsMessage(2);
+    message->value.int32Values =
+            hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_RESPONSE), 1234};
+    EXPECT_FALSE(isSequenceNumberNewer(*message, 1235));
+}
+
+TEST(VmsUtilsTest, newSequenceNumberForSameNumberForChange) {
     auto message = createBaseVmsMessage(2);
     message->value.int32Values =
             hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE), 1234};
     EXPECT_FALSE(isSequenceNumberNewer(*message, 1234));
 }
 
-TEST(VmsUtilsTest, subscribedLayers) {
+TEST(VmsUtilsTest, newSequenceNumberForSameNumberForResponse) {
+    auto message = createBaseVmsMessage(2);
+    message->value.int32Values =
+            hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_RESPONSE), 1234};
+    EXPECT_FALSE(isSequenceNumberNewer(*message, 1234));
+}
+
+void testSubscribedLayers(VmsMessageType type) {
     VmsOffers offers = {123,
                         {VmsLayerOffering(VmsLayer(1, 0, 1), {VmsLayer(4, 1, 1)}),
                          VmsLayerOffering(VmsLayer(2, 0, 1))}};
     auto message = createBaseVmsMessage(2);
-    message->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE),
+    message->value.int32Values = hidl_vec<int32_t>{toInt(type),
                                                    1234,  // sequence number
                                                    2,     // number of layers
                                                    1,     // number of associated layers
                                                    1,     // layer 1
-                                                   0,
-                                                   1,
+                                                   0,           1,
                                                    4,  // layer 2
-                                                   1,
-                                                   1,
+                                                   1,           1,
                                                    2,  // associated layer
-                                                   0,
-                                                   1,
+                                                   0,           1,
                                                    2,    // number of publisher IDs
                                                    111,  // publisher IDs
                                                    123};
@@ -275,10 +300,18 @@
     EXPECT_EQ(result.at(1), VmsLayer(2, 0, 1));
 }
 
-TEST(VmsUtilsTest, subscribedLayersWithDifferentSubtype) {
+TEST(VmsUtilsTest, subscribedLayersForChange) {
+    testSubscribedLayers(VmsMessageType::SUBSCRIPTIONS_CHANGE);
+}
+
+TEST(VmsUtilsTest, subscribedLayersForResponse) {
+    testSubscribedLayers(VmsMessageType::SUBSCRIPTIONS_RESPONSE);
+}
+
+void testSubscribedLayersWithDifferentSubtype(VmsMessageType type) {
     VmsOffers offers = {123, {VmsLayerOffering(VmsLayer(1, 0, 1))}};
     auto message = createBaseVmsMessage(2);
-    message->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE),
+    message->value.int32Values = hidl_vec<int32_t>{toInt(type),
                                                    1234,  // sequence number
                                                    1,     // number of layers
                                                    0,     // number of associated layers
@@ -289,36 +322,58 @@
     EXPECT_TRUE(getSubscribedLayers(*message, offers).empty());
 }
 
-TEST(VmsUtilsTest, subscribedLayersWithDifferentVersion) {
+TEST(VmsUtilsTest, subscribedLayersWithDifferentSubtypeForChange) {
+    testSubscribedLayersWithDifferentSubtype(VmsMessageType::SUBSCRIPTIONS_CHANGE);
+}
+
+TEST(VmsUtilsTest, subscribedLayersWithDifferentSubtypeForResponse) {
+    testSubscribedLayersWithDifferentSubtype(VmsMessageType::SUBSCRIPTIONS_RESPONSE);
+}
+
+void subscribedLayersWithDifferentVersion(VmsMessageType type) {
     VmsOffers offers = {123, {VmsLayerOffering(VmsLayer(1, 0, 1))}};
     auto message = createBaseVmsMessage(2);
-    message->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE),
-                                                   1234,  // sequence number
-                                                   1,     // number of layers
-                                                   0,     // number of associated layers
-                                                   1,     // layer 1
-                                                   0,
-                                                   2};  // different version
+    message->value.int32Values = hidl_vec<int32_t>{toInt(type),
+                                                   1234,             // sequence number
+                                                   1,                // number of layers
+                                                   0,                // number of associated layers
+                                                   1,                // layer 1
+                                                   0,           2};  // different version
     EXPECT_TRUE(isValidVmsMessage(*message));
     EXPECT_TRUE(getSubscribedLayers(*message, offers).empty());
 }
 
-TEST(VmsUtilsTest, subscribedLayersWithDifferentPublisherId) {
+TEST(VmsUtilsTest, subscribedLayersWithDifferentVersionForChange) {
+    subscribedLayersWithDifferentVersion(VmsMessageType::SUBSCRIPTIONS_CHANGE);
+}
+
+TEST(VmsUtilsTest, subscribedLayersWithDifferentVersionForResponse) {
+    subscribedLayersWithDifferentVersion(VmsMessageType::SUBSCRIPTIONS_RESPONSE);
+}
+
+void subscribedLayersWithDifferentPublisherId(VmsMessageType type) {
     VmsOffers offers = {123, {VmsLayerOffering(VmsLayer(1, 0, 1))}};
     auto message = createBaseVmsMessage(2);
-    message->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::SUBSCRIPTIONS_CHANGE),
+    message->value.int32Values = hidl_vec<int32_t>{toInt(type),
                                                    1234,  // sequence number
                                                    0,     // number of layers
                                                    1,     // number of associated layers
                                                    1,     // associated layer 1
-                                                   0,
-                                                   1,
+                                                   0,           1,
                                                    1,     // number of publisher IDs
                                                    234};  // publisher ID 1
     EXPECT_TRUE(isValidVmsMessage(*message));
     EXPECT_TRUE(getSubscribedLayers(*message, offers).empty());
 }
 
+TEST(VmsUtilsTest, subscribedLayersWithDifferentPublisherIdForChange) {
+    subscribedLayersWithDifferentPublisherId(VmsMessageType::SUBSCRIPTIONS_CHANGE);
+}
+
+TEST(VmsUtilsTest, subscribedLayersWithDifferentPublisherIdForResponse) {
+    subscribedLayersWithDifferentPublisherId(VmsMessageType::SUBSCRIPTIONS_RESPONSE);
+}
+
 TEST(VmsUtilsTest, serviceNewlyStarted) {
     auto message = createBaseVmsMessage(2);
     message->value.int32Values = hidl_vec<int32_t>{toInt(VmsMessageType::AVAILABILITY_CHANGE), 0};
diff --git a/broadcastradio/1.1/default/service.cpp b/broadcastradio/1.1/default/service.cpp
index f8af0b7..29dc76f 100644
--- a/broadcastradio/1.1/default/service.cpp
+++ b/broadcastradio/1.1/default/service.cpp
@@ -20,6 +20,7 @@
 
 #include "BroadcastRadioFactory.h"
 
+using android::sp;
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
 using android::hardware::broadcastradio::V1_1::implementation::BroadcastRadioFactory;
@@ -27,8 +28,8 @@
 int main(int /* argc */, char** /* argv */) {
     configureRpcThreadpool(4, true);
 
-    BroadcastRadioFactory broadcastRadioFactory;
-    auto status = broadcastRadioFactory.registerAsService();
+    sp<BroadcastRadioFactory> broadcastRadioFactory(new BroadcastRadioFactory());
+    auto status = broadcastRadioFactory->registerAsService();
     CHECK_EQ(status, android::OK) << "Failed to register Broadcast Radio HAL implementation";
 
     joinRpcThreadpool();
diff --git a/broadcastradio/2.0/default/service.cpp b/broadcastradio/2.0/default/service.cpp
index 349aba2..bd746fd 100644
--- a/broadcastradio/2.0/default/service.cpp
+++ b/broadcastradio/2.0/default/service.cpp
@@ -19,6 +19,7 @@
 #include "BroadcastRadio.h"
 #include "VirtualRadio.h"
 
+using android::sp;
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
 using android::hardware::broadcastradio::V2_0::implementation::BroadcastRadio;
@@ -30,13 +31,13 @@
     android::base::SetMinimumLogSeverity(android::base::VERBOSE);
     configureRpcThreadpool(4, true);
 
-    BroadcastRadio broadcastRadio(gAmFmRadio);
-    auto amFmStatus = broadcastRadio.registerAsService("amfm");
+    sp<BroadcastRadio> broadcastRadio(new BroadcastRadio(gAmFmRadio));
+    auto amFmStatus = broadcastRadio->registerAsService("amfm");
     CHECK_EQ(amFmStatus, android::OK)
         << "Failed to register Broadcast Radio AM/FM HAL implementation";
 
-    BroadcastRadio dabRadio(gDabRadio);
-    auto dabStatus = dabRadio.registerAsService("dab");
+    sp<BroadcastRadio> dabRadio(new BroadcastRadio(gDabRadio));
+    auto dabStatus = dabRadio->registerAsService("dab");
     CHECK_EQ(dabStatus, android::OK) << "Failed to register Broadcast Radio DAB HAL implementation";
 
     joinRpcThreadpool();
diff --git a/drm/1.0/default/CryptoPlugin.cpp b/drm/1.0/default/CryptoPlugin.cpp
index 666653b..8ddc380 100644
--- a/drm/1.0/default/CryptoPlugin.cpp
+++ b/drm/1.0/default/CryptoPlugin.cpp
@@ -101,11 +101,20 @@
         std::unique_ptr<android::CryptoPlugin::SubSample[]> legacySubSamples =
                 std::make_unique<android::CryptoPlugin::SubSample[]>(subSamples.size());
 
+        size_t destSize = 0;
         for (size_t i = 0; i < subSamples.size(); i++) {
-            legacySubSamples[i].mNumBytesOfClearData
-                = subSamples[i].numBytesOfClearData;
-            legacySubSamples[i].mNumBytesOfEncryptedData
-                = subSamples[i].numBytesOfEncryptedData;
+            uint32_t numBytesOfClearData = subSamples[i].numBytesOfClearData;
+            legacySubSamples[i].mNumBytesOfClearData = numBytesOfClearData;
+            uint32_t numBytesOfEncryptedData = subSamples[i].numBytesOfEncryptedData;
+            legacySubSamples[i].mNumBytesOfEncryptedData = numBytesOfEncryptedData;
+            if (__builtin_add_overflow(destSize, numBytesOfClearData, &destSize)) {
+                _hidl_cb(Status::BAD_VALUE, 0, "subsample clear size overflow");
+                return Void();
+            }
+            if (__builtin_add_overflow(destSize, numBytesOfEncryptedData, &destSize)) {
+                _hidl_cb(Status::BAD_VALUE, 0, "subsample encrypted size overflow");
+                return Void();
+            }
         }
 
         AString detailMessage;
@@ -137,11 +146,24 @@
                 _hidl_cb(Status::ERROR_DRM_CANNOT_HANDLE, 0, "invalid buffer size");
                 return Void();
             }
+
+            if (destSize > destBuffer.size) {
+                _hidl_cb(Status::BAD_VALUE, 0, "subsample sum too large");
+                return Void();
+            }
+
             destPtr = static_cast<void *>(base + destination.nonsecureMemory.offset);
         } else if (destination.type == BufferType::NATIVE_HANDLE) {
+            if (!secure) {
+                _hidl_cb(Status::BAD_VALUE, 0, "native handle destination must be secure");
+                return Void();
+            }
             native_handle_t *handle = const_cast<native_handle_t *>(
                     destination.secureMemory.getNativeHandle());
             destPtr = static_cast<void *>(handle);
+        } else {
+            _hidl_cb(Status::BAD_VALUE, 0, "invalid destination type");
+            return Void();
         }
         ssize_t result = mLegacyPlugin->decrypt(secure, keyId.data(), iv.data(),
                 legacyMode, legacyPattern, srcPtr, legacySubSamples.get(),
diff --git a/health/1.0/default/Android.bp b/health/1.0/default/Android.bp
index 049e393..7581335 100644
--- a/health/1.0/default/Android.bp
+++ b/health/1.0/default/Android.bp
@@ -18,3 +18,55 @@
 
 }
 
+cc_library_static {
+    name: "android.hardware.health@1.0-impl-helper",
+    vendor: true,
+    srcs: ["Health.cpp"],
+
+    header_libs: [
+        "libbase_headers",
+        "libhealthd_headers",
+    ],
+
+    shared_libs: [
+        "libcutils",
+        "libhidlbase",
+        "liblog",
+        "libutils",
+        "android.hardware.health@1.0",
+    ],
+
+    static_libs: [
+        "android.hardware.health@1.0-convert",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.health@1.0-impl",
+    vendor: true,
+    relative_install_path: "hw",
+
+    static_libs: [
+        "android.hardware.health@1.0-impl-helper",
+        "android.hardware.health@1.0-convert",
+        "libhealthd.default",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.health@1.0-service",
+    vendor: true,
+    relative_install_path: "hw",
+    init_rc: ["android.hardware.health@1.0-service.rc"],
+    srcs: ["HealthService.cpp"],
+
+    shared_libs: [
+        "liblog",
+        "libcutils",
+        "libdl",
+        "libbase",
+        "libutils",
+        "libhidlbase",
+        "android.hardware.health@1.0",
+    ],
+}
diff --git a/health/1.0/default/Android.mk b/health/1.0/default/Android.mk
deleted file mode 100644
index bbf37af..0000000
--- a/health/1.0/default/Android.mk
+++ /dev/null
@@ -1,45 +0,0 @@
-LOCAL_PATH := $(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.health@1.0-impl
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_C_INCLUDES := system/core/base/include
-LOCAL_SRC_FILES := \
-    Health.cpp \
-
-LOCAL_HEADER_LIBRARIES := libhealthd_headers
-
-LOCAL_SHARED_LIBRARIES := \
-    libcutils \
-    libhidlbase \
-    liblog \
-    libutils \
-    android.hardware.health@1.0 \
-
-LOCAL_STATIC_LIBRARIES := android.hardware.health@1.0-convert
-
-LOCAL_HAL_STATIC_LIBRARIES := libhealthd
-
-include $(BUILD_SHARED_LIBRARY)
-
-include $(CLEAR_VARS)
-LOCAL_PROPRIETARY_MODULE := true
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_MODULE := android.hardware.health@1.0-service
-LOCAL_INIT_RC := android.hardware.health@1.0-service.rc
-LOCAL_SRC_FILES := \
-    HealthService.cpp \
-
-LOCAL_SHARED_LIBRARIES := \
-    liblog \
-    libcutils \
-    libdl \
-    libbase \
-    libutils \
-    libhidlbase \
-    android.hardware.health@1.0 \
-
-include $(BUILD_EXECUTABLE)
-
-include $(call first-makefiles-under,$(LOCAL_PATH))
diff --git a/health/1.0/default/README.md b/health/1.0/default/README.md
new file mode 100644
index 0000000..1ded7de
--- /dev/null
+++ b/health/1.0/default/README.md
@@ -0,0 +1,66 @@
+# Implement the 2.1 HAL instead!
+
+It is strongly recommended that you implement the 2.1 HAL directly. See
+`hardware/interfaces/health/2.1/README.md` for more details.
+
+# Implement Health 1.0 HAL
+
+1. Install common binderized service. The binderized service `dlopen()`s
+   passthrough implementations on the device, so there is no need to write
+   your own.
+
+    ```mk
+    # Install default binderized implementation to vendor.
+    PRODUCT_PACKAGES += android.hardware.health@1.0-service
+    ```
+
+1. Add proper VINTF manifest entry to your device manifest. Example:
+
+    ```xml
+    <hal format="hidl">
+        <name>android.hardware.health</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IHealth</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    ```
+
+1. Install the proper passthrough implemetation.
+
+    1. If you want to use the default implementation (with default `libhealthd`),
+       add the following to `device.mk`:
+
+        ```mk
+        PRODUCT_PACKAGES += \
+            android.hardware.health@1.0-impl
+        ```
+
+    1. Otherwise, if you have a customized `libhealthd.<board>`:
+
+        1. Define your passthrough implementation. Example (replace `<device>`
+           and `<board>` accordingly):
+
+            ```bp
+            cc_library_shared {
+                name: "android.hardware.health@1.0-impl-<device>",
+                vendor: true,
+                relative_install_path: "hw",
+
+                static_libs: [
+                    "android.hardware.health@1.0-impl-helper",
+                    "android.hardware.health@1.0-convert",
+                    "libhealthd.<board>",
+                ],
+            }
+            ```
+
+        1. Add to `device.mk`.
+
+            ```
+            PRODUCT_PACKAGES += android.hardware.health@1.0-impl-<device>
+            ```
+
+        1. Define appropriate SELinux permissions.
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index 0e12283..4409bde 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -527,9 +527,9 @@
         HidlBuf key_blob;
         KeyCharacteristics key_characteristics;
         ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
-                                                 .RsaSigningKey(key_size, 3)
-                                                 .Digest(Digest::NONE)
-                                                 .Padding(PaddingMode::NONE),
+                                                     .RsaSigningKey(key_size, 65537)
+                                                     .Digest(Digest::NONE)
+                                                     .Padding(PaddingMode::NONE),
                                              &key_blob, &key_characteristics));
 
         ASSERT_GT(key_blob.size(), 0U);
@@ -579,11 +579,12 @@
     for (auto key_size : InvalidKeySizes(Algorithm::RSA)) {
         HidlBuf key_blob;
         KeyCharacteristics key_characteristics;
-        ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE, GenerateKey(AuthorizationSetBuilder()
-                                                                   .RsaSigningKey(key_size, 3)
-                                                                   .Digest(Digest::NONE)
-                                                                   .Padding(PaddingMode::NONE),
-                                                               &key_blob, &key_characteristics));
+        ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE,
+                  GenerateKey(AuthorizationSetBuilder()
+                                      .RsaSigningKey(key_size, 65537)
+                                      .Digest(Digest::NONE)
+                                      .Padding(PaddingMode::NONE),
+                              &key_blob, &key_characteristics));
     }
 }
 
diff --git a/media/omx/1.0/vts/functional/README.md b/media/omx/1.0/vts/functional/README.md
index acffc42..274b30d 100644
--- a/media/omx/1.0/vts/functional/README.md
+++ b/media/omx/1.0/vts/functional/README.md
@@ -18,17 +18,17 @@
 
 usage:
 
-VtsHalMediaOmxV1\_0TargetAudioDecTest -I default -C <comp name> -R audio_decoder.<comp class> -P /sdcard/media/
+VtsHalMediaOmxV1\_0TargetAudioDecTest -I default -C <comp name> -R audio_decoder.<comp class> -P /data/local/tmp/media/
 
-VtsHalMediaOmxV1\_0TargetAudioEncTest -I default -C <comp name> -R audio_encoder.<comp class> -P /sdcard/media/
+VtsHalMediaOmxV1\_0TargetAudioEncTest -I default -C <comp name> -R audio_encoder.<comp class> -P /data/local/tmp/media/
 
 #### video :
 This folder includes test fixtures associated with testing video encoder and decoder components such as simple encoding of a raw clip or decoding of an elementary stream, end of stream test, timestamp deviations test, flush test and so on. These tests are aimed towards testing the plugin that connects the component to the omx core.
 
 usage:
 
-VtsHalMediaOmxV1\_0TargetVideoDecTest -I default -C <comp name> -R video_decoder.<comp class> -P /sdcard/media/
+VtsHalMediaOmxV1\_0TargetVideoDecTest -I default -C <comp name> -R video_decoder.<comp class> -P /data/local/tmp/media/
 
-VtsHalMediaOmxV1\_0TargetVideoEncTest -I default -C <comp name> -R video_encoder.<comp class> -P /sdcard/media/
+VtsHalMediaOmxV1\_0TargetVideoEncTest -I default -C <comp name> -R video_encoder.<comp class> -P /data/local/tmp/media/
 
-While tesing audio/video encoder, decoder components, test fixtures require input files. These input are files are present in the folder 'res'. Before running the tests all the files in 'res' have to be placed in '/media/sdcard/' or a path of your choice and this path needs to be provided as an argument to the test application
\ No newline at end of file
+While tesing audio/video encoder, decoder components, test fixtures require input files. These input are files are present in the folder 'res'. Before running the tests all the files in 'res' have to be placed in '/data/local/tmp/media' or a path of your choice and this path needs to be provided as an argument to the test application
diff --git a/media/omx/1.0/vts/functional/common/Android.bp b/media/omx/1.0/vts/functional/common/Android.bp
index cdc52fb..5a79e55 100644
--- a/media/omx/1.0/vts/functional/common/Android.bp
+++ b/media/omx/1.0/vts/functional/common/Android.bp
@@ -29,6 +29,21 @@
         "android.hidl.memory@1.0",
         "android.hardware.media.omx@1.0",
         "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.allocator@3.0",
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
+        "android.hardware.graphics.mapper@2.0",
+        "android.hardware.graphics.mapper@3.0",
+    ],
+    export_static_lib_headers: [
+        "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.allocator@3.0",
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
+        "android.hardware.graphics.mapper@2.0",
+        "android.hardware.graphics.mapper@3.0",
     ],
 }
 
@@ -40,7 +55,12 @@
     static_libs: [
         "VtsHalMediaOmxV1_0CommonUtil",
         "android.hardware.graphics.allocator@2.0",
+        "android.hardware.graphics.allocator@3.0",
+        "android.hardware.graphics.common@1.0",
+        "android.hardware.graphics.common@1.1",
+        "android.hardware.graphics.common@1.2",
         "android.hardware.graphics.mapper@2.0",
+        "android.hardware.graphics.mapper@3.0",
         "android.hardware.graphics.bufferqueue@1.0",
         "android.hardware.graphics.common@1.0",
         "android.hardware.media.omx@1.0",
diff --git a/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp b/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
index f299e36..8d4c022 100644
--- a/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
+++ b/media/omx/1.0/vts/functional/common/media_hidl_test_common.cpp
@@ -22,8 +22,11 @@
 #include <android-base/logging.h>
 
 #include <android/hardware/graphics/allocator/2.0/IAllocator.h>
+#include <android/hardware/graphics/allocator/3.0/IAllocator.h>
 #include <android/hardware/graphics/mapper/2.0/IMapper.h>
 #include <android/hardware/graphics/mapper/2.0/types.h>
+#include <android/hardware/graphics/mapper/3.0/IMapper.h>
+#include <android/hardware/graphics/mapper/3.0/types.h>
 #include <android/hardware/media/omx/1.0/IOmx.h>
 #include <android/hardware/media/omx/1.0/IOmxNode.h>
 #include <android/hardware/media/omx/1.0/IOmxObserver.h>
@@ -31,7 +34,9 @@
 #include <android/hidl/allocator/1.0/IAllocator.h>
 #include <android/hidl/memory/1.0/IMapper.h>
 #include <android/hidl/memory/1.0/IMemory.h>
-#include <cutils/atomic.h>
+
+#include <atomic>
+#include <variant>
 
 using ::android::hardware::graphics::common::V1_0::BufferUsage;
 using ::android::hardware::graphics::common::V1_0::PixelFormat;
@@ -195,67 +200,104 @@
                             BufferInfo* buffer, uint32_t nFrameWidth,
                             uint32_t nFrameHeight, int32_t* nStride,
                             int format) {
-    android::hardware::media::omx::V1_0::Status status;
-    sp<android::hardware::graphics::allocator::V2_0::IAllocator> allocator =
-        android::hardware::graphics::allocator::V2_0::IAllocator::getService();
-    ASSERT_NE(nullptr, allocator.get());
+    struct AllocatorV2 : public GrallocV2 {
+        sp<IAllocator> mAllocator;
+        sp<IMapper> mMapper;
+        AllocatorV2(sp<IAllocator>&& allocator, sp<IMapper>&& mapper)
+              : mAllocator{std::move(allocator)}, mMapper{std::move(mapper)} {}
+        AllocatorV2() = default;
+    };
+    struct AllocatorV3 : public GrallocV3 {
+        sp<IAllocator> mAllocator;
+        sp<IMapper> mMapper;
+        AllocatorV3(sp<IAllocator>&& allocator, sp<IMapper>&& mapper)
+              : mAllocator{std::move(allocator)}, mMapper{std::move(mapper)} {}
+        AllocatorV3() = default;
+    };
+    std::variant<AllocatorV2, AllocatorV3> grallocVar;
 
-    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper =
-        android::hardware::graphics::mapper::V2_0::IMapper::getService();
-    ASSERT_NE(mapper.get(), nullptr);
+    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper2{};
+    sp<android::hardware::graphics::mapper::V3_0::IMapper> mapper3{};
+    sp<android::hardware::graphics::allocator::V2_0::IAllocator> allocator2{};
+    sp<android::hardware::graphics::allocator::V3_0::IAllocator> allocator3 =
+        android::hardware::graphics::allocator::V3_0::IAllocator::getService();
+    if (allocator3) {
+        mapper3 =
+            android::hardware::graphics::mapper::V3_0::IMapper::getService();
+        ASSERT_NE(nullptr, mapper3.get());
+        grallocVar.emplace<AllocatorV3>(std::move(allocator3), std::move(mapper3));
+    } else {
+        allocator2 =
+            android::hardware::graphics::allocator::V2_0::IAllocator::getService();
+        ASSERT_NE(nullptr, allocator2.get());
+        mapper2 =
+            android::hardware::graphics::mapper::V2_0::IMapper::getService();
+        ASSERT_NE(nullptr, allocator2.get());
+        grallocVar.emplace<AllocatorV2>(std::move(allocator2), std::move(mapper2));
+    }
 
-    android::hardware::graphics::mapper::V2_0::IMapper::BufferDescriptorInfo
-        descriptorInfo;
-    uint32_t usage;
-
-    descriptorInfo.width = nFrameWidth;
-    descriptorInfo.height = nFrameHeight;
-    descriptorInfo.layerCount = 1;
-    descriptorInfo.format = static_cast<PixelFormat>(format);
-    descriptorInfo.usage = static_cast<uint64_t>(BufferUsage::CPU_READ_OFTEN);
-    omxNode->getGraphicBufferUsage(
+    android::hardware::media::omx::V1_0::Status status{};
+    uint64_t usage{};
+    ASSERT_TRUE(omxNode->getGraphicBufferUsage(
         portIndex,
         [&status, &usage](android::hardware::media::omx::V1_0::Status _s,
                           uint32_t _n1) {
             status = _s;
             usage = _n1;
-        });
-    if (status == android::hardware::media::omx::V1_0::Status::OK) {
-        descriptorInfo.usage |= usage;
-    }
+        }).isOk());
+    ASSERT_EQ(status, android::hardware::media::omx::V1_0::Status::OK);
 
-    ::android::hardware::hidl_vec<uint32_t> descriptor;
-    android::hardware::graphics::mapper::V2_0::Error error;
-    mapper->createDescriptor(
-        descriptorInfo, [&error, &descriptor](
-                            android::hardware::graphics::mapper::V2_0::Error _s,
-                            ::android::hardware::hidl_vec<uint32_t> _n1) {
-            error = _s;
-            descriptor = _n1;
-        });
-    ASSERT_EQ(error, android::hardware::graphics::mapper::V2_0::Error::NONE);
+    static std::atomic_int32_t bufferIdCounter{0};
 
-    static volatile int32_t nextId = 0;
-    uint64_t id = static_cast<uint64_t>(getpid()) << 32;
-    allocator->allocate(
-        descriptor, 1,
-        [&](android::hardware::graphics::mapper::V2_0::Error _s, uint32_t _n1,
-            const ::android::hardware::hidl_vec<
-                ::android::hardware::hidl_handle>& _n2) {
-            ASSERT_EQ(android::hardware::graphics::mapper::V2_0::Error::NONE,
-                      _s);
-            *nStride = _n1;
-            buffer->omxBuffer.nativeHandle = _n2[0];
-            buffer->omxBuffer.attr.anwBuffer.width = nFrameWidth;
-            buffer->omxBuffer.attr.anwBuffer.height = nFrameHeight;
-            buffer->omxBuffer.attr.anwBuffer.stride = _n1;
-            buffer->omxBuffer.attr.anwBuffer.format = descriptorInfo.format;
-            buffer->omxBuffer.attr.anwBuffer.usage = descriptorInfo.usage;
-            buffer->omxBuffer.attr.anwBuffer.layerCount =
-                descriptorInfo.layerCount;
-            buffer->omxBuffer.attr.anwBuffer.id =
-                id | static_cast<uint32_t>(android_atomic_inc(&nextId));
-        });
+    std::visit([buffer, nFrameWidth, nFrameHeight, format, usage, nStride](auto&& gralloc) {
+            using Gralloc = std::remove_reference_t<decltype(gralloc)>;
+            using Descriptor = typename Gralloc::Descriptor;
+            using DescriptorInfo = typename Gralloc::DescriptorInfo;
+            using Error = typename Gralloc::Error;
+            using Format = typename Gralloc::Format;
+            using Usage = typename Gralloc::Usage;
+
+            Error error{};
+            Descriptor descriptor{};
+
+            DescriptorInfo descriptorInfo{};
+            descriptorInfo.width = nFrameWidth;
+            descriptorInfo.height = nFrameHeight;
+            descriptorInfo.layerCount = 1;
+            descriptorInfo.format = static_cast<Format>(format);
+            descriptorInfo.usage = usage | Usage(BufferUsage::CPU_READ_OFTEN);
+
+            gralloc.mMapper->createDescriptor(descriptorInfo,
+                    [&error, &descriptor](
+                        Error _s,
+                        const Descriptor& _n1) {
+                    error = _s;
+                    descriptor = _n1;
+                });
+            ASSERT_EQ(error, Error::NONE);
+
+            gralloc.mAllocator->allocate(
+                descriptor, 1,
+                [&](Error _s, uint32_t _n1,
+                    const ::android::hardware::hidl_vec<
+                        ::android::hardware::hidl_handle>& _n2) {
+                    ASSERT_EQ(Error::NONE, _s);
+                    *nStride = _n1;
+                    buffer->omxBuffer.nativeHandle = _n2[0];
+                    buffer->omxBuffer.attr.anwBuffer.width = nFrameWidth;
+                    buffer->omxBuffer.attr.anwBuffer.height = nFrameHeight;
+                    buffer->omxBuffer.attr.anwBuffer.stride = _n1;
+                    buffer->omxBuffer.attr.anwBuffer.format =
+                        static_cast<PixelFormat>(descriptorInfo.format);
+                    buffer->omxBuffer.attr.anwBuffer.usage =
+                        static_cast<uint32_t>(descriptorInfo.usage);
+                    buffer->omxBuffer.attr.anwBuffer.layerCount =
+                        descriptorInfo.layerCount;
+                    buffer->omxBuffer.attr.anwBuffer.id =
+                        (static_cast<uint64_t>(getpid()) << 32) |
+                        bufferIdCounter.fetch_add(1, std::memory_order_relaxed);
+                });
+        }, grallocVar);
 }
 
 // allocate buffers needed on a component port
diff --git a/media/omx/1.0/vts/functional/common/media_hidl_test_common.h b/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
index 1575ba2..ac077a3 100644
--- a/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
+++ b/media/omx/1.0/vts/functional/common/media_hidl_test_common.h
@@ -22,6 +22,16 @@
 #endif
 
 #include <getopt.h>
+
+#include <android/hardware/graphics/allocator/2.0/IAllocator.h>
+#include <android/hardware/graphics/allocator/3.0/IAllocator.h>
+#include <android/hardware/graphics/common/1.0/types.h>
+#include <android/hardware/graphics/common/1.1/types.h>
+#include <android/hardware/graphics/common/1.2/types.h>
+#include <android/hardware/graphics/mapper/2.0/IMapper.h>
+#include <android/hardware/graphics/mapper/2.0/types.h>
+#include <android/hardware/graphics/mapper/3.0/IMapper.h>
+#include <android/hardware/graphics/mapper/3.0/types.h>
 #include <media/stagefright/foundation/ALooper.h>
 #include <utils/Condition.h>
 #include <utils/List.h>
@@ -288,6 +298,36 @@
 /*
  * common functions declarations
  */
+struct GrallocV2 {
+    using Format = android::hardware::graphics::common::V1_0::PixelFormat;
+    using Usage = android::hardware::hidl_bitfield<
+            android::hardware::graphics::common::V1_0::BufferUsage>;
+
+    using IAllocator = android::hardware::graphics::allocator::V2_0::IAllocator;
+
+    using IMapper = android::hardware::graphics::mapper::V2_0::IMapper;
+    using Error = android::hardware::graphics::mapper::V2_0::Error;
+    using Descriptor = android::hardware::graphics::mapper::V2_0::BufferDescriptor;
+    using YCbCrLayout = android::hardware::graphics::mapper::V2_0::YCbCrLayout;
+    using DescriptorInfo = IMapper::BufferDescriptorInfo;
+    using Rect = IMapper::Rect;
+};
+
+struct GrallocV3 {
+    using Format = android::hardware::graphics::common::V1_2::PixelFormat;
+    using Usage = android::hardware::hidl_bitfield<
+            android::hardware::graphics::common::V1_2::BufferUsage>;
+
+    using IAllocator = android::hardware::graphics::allocator::V3_0::IAllocator;
+
+    using IMapper = android::hardware::graphics::mapper::V3_0::IMapper;
+    using Error = android::hardware::graphics::mapper::V3_0::Error;
+    using Descriptor = android::hardware::graphics::mapper::V3_0::BufferDescriptor;
+    using YCbCrLayout = android::hardware::graphics::mapper::V3_0::YCbCrLayout;
+    using DescriptorInfo = IMapper::BufferDescriptorInfo;
+    using Rect = IMapper::Rect;
+};
+
 Return<android::hardware::media::omx::V1_0::Status> setRole(
     sp<IOmxNode> omxNode, const char* role);
 
@@ -368,7 +408,7 @@
    public:
     virtual void registerTestServices() override { registerTestService<IOmx>(); }
 
-    ComponentTestEnvironment() : res("/sdcard/media/") {}
+    ComponentTestEnvironment() : res("/data/local/tmp/media/") {}
 
     void setComponent(const char* _component) { component = _component; }
 
diff --git a/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp b/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
index a740a80..2280cee 100644
--- a/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
+++ b/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
@@ -63,6 +63,7 @@
 #include <media_video_hidl_test_common.h>
 #include <system/window.h>
 #include <fstream>
+#include <variant>
 
 static ComponentTestEnvironment* gEnv = nullptr;
 
@@ -364,6 +365,61 @@
     return Void();
 };
 
+// Variant of mappers
+struct MapperV2 : public GrallocV2 {
+    sp<IMapper> mMapper;
+    MapperV2(sp<IMapper>&& mapper): mMapper{std::move(mapper)} {}
+    MapperV2() = default;
+    android::hardware::Return<void> lock(
+            void* buffer,
+            Usage usage,
+            const Rect& rect,
+            const android::hardware::hidl_handle& handle,
+            Error* error,
+            void** data) {
+        return mMapper->lock(buffer, usage, rect, handle,
+                             [error, data](Error e, void* d) {
+                                *error = e;
+                                *data = d;
+                             });
+    }
+};
+struct MapperV3 : public GrallocV3 {
+    sp<IMapper> mMapper;
+    MapperV3(sp<IMapper>&& mapper): mMapper{std::move(mapper)} {}
+    MapperV3() = default;
+    android::hardware::Return<void> lock(
+            void* buffer,
+            Usage usage,
+            const Rect& rect,
+            const android::hardware::hidl_handle& handle,
+            Error* error,
+            void** data) {
+        return mMapper->lock(buffer, usage, rect, handle,
+                             [error, data](Error e, void* d, int32_t, int32_t) {
+                                *error = e;
+                                *data = d;
+                             });
+    }
+};
+using MapperVar = std::variant<MapperV2, MapperV3>;
+// Initializes the MapperVar by trying services of different versions.
+bool initialize(MapperVar& mapperVar) {
+    sp<android::hardware::graphics::mapper::V3_0::IMapper> mapper3 =
+        android::hardware::graphics::mapper::V3_0::IMapper::getService();
+    if (mapper3) {
+        mapperVar.emplace<MapperV3>(std::move(mapper3));
+        return true;
+    }
+    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper2 =
+        android::hardware::graphics::mapper::V2_0::IMapper::getService();
+    if (mapper2) {
+        mapperVar.emplace<MapperV2>(std::move(mapper2));
+        return true;
+    }
+    return false;
+}
+
 // request VOP refresh
 void requestIDR(sp<IOmxNode> omxNode, OMX_U32 portIndex) {
     android::hardware::media::omx::V1_0::Status status;
@@ -574,150 +630,166 @@
 
 int colorFormatConversion(BufferInfo* buffer, void* buff, PixelFormat format,
                           std::ifstream& eleStream) {
-    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper =
-        android::hardware::graphics::mapper::V2_0::IMapper::getService();
-    EXPECT_NE(mapper.get(), nullptr);
-    if (mapper.get() == nullptr) return 1;
-
-    android::hardware::hidl_handle fence;
-    android::hardware::graphics::mapper::V2_0::IMapper::Rect rect;
-    android::hardware::graphics::mapper::V2_0::YCbCrLayout ycbcrLayout;
-    android::hardware::graphics::mapper::V2_0::Error error;
-    rect.left = 0;
-    rect.top = 0;
-    rect.width = buffer->omxBuffer.attr.anwBuffer.width;
-    rect.height = buffer->omxBuffer.attr.anwBuffer.height;
-
-    if (format == PixelFormat::YV12 || format == PixelFormat::YCRCB_420_SP ||
-        format == PixelFormat::YCBCR_420_888) {
-        mapper->lockYCbCr(
-            buff, buffer->omxBuffer.attr.anwBuffer.usage, rect, fence,
-            [&](android::hardware::graphics::mapper::V2_0::Error _e,
-                android::hardware::graphics::mapper::V2_0::YCbCrLayout _n1) {
-                error = _e;
-                ycbcrLayout = _n1;
-            });
-        EXPECT_EQ(error,
-                  android::hardware::graphics::mapper::V2_0::Error::NONE);
-        if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
-            return 1;
-
-        int size = ((rect.width * rect.height * 3) >> 1);
-        char* img = new char[size];
-        if (img == nullptr) return 1;
-        eleStream.read(img, size);
-        if (eleStream.gcount() != size) {
-            delete[] img;
-            return 1;
-        }
-
-        char* imgTmp = img;
-        char* ipBuffer = static_cast<char*>(ycbcrLayout.y);
-        for (size_t y = rect.height; y > 0; --y) {
-            memcpy(ipBuffer, imgTmp, rect.width);
-            ipBuffer += ycbcrLayout.yStride;
-            imgTmp += rect.width;
-        }
-
-        if (format == PixelFormat::YV12)
-            EXPECT_EQ(ycbcrLayout.chromaStep, 1U);
-        else if (format == PixelFormat::YCRCB_420_SP)
-            EXPECT_EQ(ycbcrLayout.chromaStep, 2U);
-
-        ipBuffer = static_cast<char*>(ycbcrLayout.cb);
-        for (size_t y = rect.height >> 1; y > 0; --y) {
-            for (int32_t x = 0; x < (rect.width >> 1); ++x) {
-                ipBuffer[ycbcrLayout.chromaStep * x] = *imgTmp++;
-            }
-            ipBuffer += ycbcrLayout.cStride;
-        }
-        ipBuffer = static_cast<char*>(ycbcrLayout.cr);
-        for (size_t y = rect.height >> 1; y > 0; --y) {
-            for (int32_t x = 0; x < (rect.width >> 1); ++x) {
-                ipBuffer[ycbcrLayout.chromaStep * x] = *imgTmp++;
-            }
-            ipBuffer += ycbcrLayout.cStride;
-        }
-
-        delete[] img;
-
-        mapper->unlock(buff,
-                       [&](android::hardware::graphics::mapper::V2_0::Error _e,
-                           android::hardware::hidl_handle _n1) {
-                           error = _e;
-                           fence = _n1;
-                       });
-        EXPECT_EQ(error,
-                  android::hardware::graphics::mapper::V2_0::Error::NONE);
-        if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
-            return 1;
-    } else {
-        void* data;
-        mapper->lock(buff, buffer->omxBuffer.attr.anwBuffer.usage, rect, fence,
-                     [&](android::hardware::graphics::mapper::V2_0::Error _e,
-                         void* _n1) {
-                         error = _e;
-                         data = _n1;
-                     });
-        EXPECT_EQ(error,
-                  android::hardware::graphics::mapper::V2_0::Error::NONE);
-        if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
-            return 1;
-
-        if (format == PixelFormat::BGRA_8888) {
-            char* ipBuffer = static_cast<char*>(data);
-            for (size_t y = rect.height; y > 0; --y) {
-                eleStream.read(ipBuffer, rect.width * 4);
-                if (eleStream.gcount() != rect.width * 4) return 1;
-                ipBuffer += buffer->omxBuffer.attr.anwBuffer.stride * 4;
-            }
-        } else {
-            EXPECT_TRUE(false) << "un expected pixel format";
-            return 1;
-        }
-
-        mapper->unlock(buff,
-                       [&](android::hardware::graphics::mapper::V2_0::Error _e,
-                           android::hardware::hidl_handle _n1) {
-                           error = _e;
-                           fence = _n1;
-                       });
-        EXPECT_EQ(error,
-                  android::hardware::graphics::mapper::V2_0::Error::NONE);
-        if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
-            return 1;
+    MapperVar mapperVar;
+    if (!initialize(mapperVar)) {
+        EXPECT_TRUE(false) << "failed to obtain mapper service";
+        return 1;
     }
 
-    return 0;
+    return std::visit([buffer, buff, format, &eleStream](auto&& mapper) -> int {
+            using Gralloc = std::remove_reference_t<decltype(mapper)>;
+            using Error = typename Gralloc::Error;
+            using Rect = typename Gralloc::Rect;
+            using Usage = typename Gralloc::Usage;
+            using YCbCrLayout = typename Gralloc::YCbCrLayout;
+
+            android::hardware::hidl_handle fence;
+            Rect rect;
+            YCbCrLayout ycbcrLayout;
+            Error error;
+            rect.left = 0;
+            rect.top = 0;
+            rect.width = buffer->omxBuffer.attr.anwBuffer.width;
+            rect.height = buffer->omxBuffer.attr.anwBuffer.height;
+
+            if (format == PixelFormat::YV12 || format == PixelFormat::YCRCB_420_SP ||
+                format == PixelFormat::YCBCR_420_888) {
+                mapper.mMapper->lockYCbCr(
+                        buff,
+                        static_cast<Usage>(
+                            buffer->omxBuffer.attr.anwBuffer.usage),
+                        rect,
+                        fence,
+                        [&](Error _e,
+                            const YCbCrLayout& _n1) {
+                            error = _e;
+                            ycbcrLayout = _n1;
+                        });
+                EXPECT_EQ(error, Error::NONE);
+                if (error != Error::NONE)
+                    return 1;
+
+                int size = ((rect.width * rect.height * 3) >> 1);
+                char* img = new char[size];
+                if (img == nullptr) return 1;
+                eleStream.read(img, size);
+                if (eleStream.gcount() != size) {
+                    delete[] img;
+                    return 1;
+                }
+
+                char* imgTmp = img;
+                char* ipBuffer = static_cast<char*>(ycbcrLayout.y);
+                for (size_t y = rect.height; y > 0; --y) {
+                    memcpy(ipBuffer, imgTmp, rect.width);
+                    ipBuffer += ycbcrLayout.yStride;
+                    imgTmp += rect.width;
+                }
+
+                if (format == PixelFormat::YV12)
+                    EXPECT_EQ(ycbcrLayout.chromaStep, 1U);
+                else if (format == PixelFormat::YCRCB_420_SP)
+                    EXPECT_EQ(ycbcrLayout.chromaStep, 2U);
+
+                ipBuffer = static_cast<char*>(ycbcrLayout.cb);
+                for (size_t y = rect.height >> 1; y > 0; --y) {
+                    for (int32_t x = 0; x < (rect.width >> 1); ++x) {
+                        ipBuffer[ycbcrLayout.chromaStep * x] = *imgTmp++;
+                    }
+                    ipBuffer += ycbcrLayout.cStride;
+                }
+                ipBuffer = static_cast<char*>(ycbcrLayout.cr);
+                for (size_t y = rect.height >> 1; y > 0; --y) {
+                    for (int32_t x = 0; x < (rect.width >> 1); ++x) {
+                        ipBuffer[ycbcrLayout.chromaStep * x] = *imgTmp++;
+                    }
+                    ipBuffer += ycbcrLayout.cStride;
+                }
+
+                delete[] img;
+
+                mapper.mMapper->unlock(buff,
+                               [&](Error _e,
+                                   const android::hardware::hidl_handle& _n1) {
+                                   error = _e;
+                                   fence = _n1;
+                               });
+                EXPECT_EQ(error, Error::NONE);
+                if (error != Error::NONE)
+                    return 1;
+            } else {
+                void* data;
+                mapper.lock(
+                        buff,
+                        buffer->omxBuffer.attr.anwBuffer.usage,
+                        rect,
+                        fence,
+                        &error,
+                        &data);
+                EXPECT_EQ(error, Error::NONE);
+                if (error != Error::NONE)
+                    return 1;
+
+                if (format == PixelFormat::BGRA_8888) {
+                    char* ipBuffer = static_cast<char*>(data);
+                    for (size_t y = rect.height; y > 0; --y) {
+                        eleStream.read(ipBuffer, rect.width * 4);
+                        if (eleStream.gcount() != rect.width * 4) return 1;
+                        ipBuffer += buffer->omxBuffer.attr.anwBuffer.stride * 4;
+                    }
+                } else {
+                    EXPECT_TRUE(false) << "un expected pixel format";
+                    return 1;
+                }
+
+                mapper.mMapper->unlock(
+                        buff,
+                        [&](Error _e, const android::hardware::hidl_handle& _n1) {
+                            error = _e;
+                            fence = _n1;
+                        });
+                EXPECT_EQ(error, Error::NONE);
+                if (error != Error::NONE)
+                    return 1;
+            }
+
+            return 0;
+        }, mapperVar);
 }
 
 int fillGraphicBuffer(BufferInfo* buffer, PixelFormat format,
                       std::ifstream& eleStream) {
-    sp<android::hardware::graphics::mapper::V2_0::IMapper> mapper =
-        android::hardware::graphics::mapper::V2_0::IMapper::getService();
-    EXPECT_NE(mapper.get(), nullptr);
-    if (mapper.get() == nullptr) return 1;
-
-    void* buff = nullptr;
-    android::hardware::graphics::mapper::V2_0::Error error;
-    mapper->importBuffer(
-        buffer->omxBuffer.nativeHandle,
-        [&](android::hardware::graphics::mapper::V2_0::Error _e, void* _n1) {
-            error = _e;
-            buff = _n1;
-        });
-    EXPECT_EQ(error, android::hardware::graphics::mapper::V2_0::Error::NONE);
-    if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
+    MapperVar mapperVar;
+    if (!initialize(mapperVar)) {
+        EXPECT_TRUE(false) << "failed to obtain mapper service";
         return 1;
+    }
 
-    if (colorFormatConversion(buffer, buff, format, eleStream)) return 1;
+    return std::visit([buffer, format, &eleStream](auto&& mapper) -> int {
+            using Gralloc = std::remove_reference_t<decltype(mapper)>;
+            using Error = typename Gralloc::Error;
 
-    error = mapper->freeBuffer(buff);
-    EXPECT_EQ(error, android::hardware::graphics::mapper::V2_0::Error::NONE);
-    if (error != android::hardware::graphics::mapper::V2_0::Error::NONE)
-        return 1;
+            void* buff = nullptr;
+            Error error;
+            mapper.mMapper->importBuffer(
+                buffer->omxBuffer.nativeHandle,
+                [&](Error _e, void* _n1) {
+                    error = _e;
+                    buff = _n1;
+                });
+            EXPECT_EQ(error, Error::NONE);
+            if (error != Error::NONE)
+                return 1;
 
-    return 0;
+            if (colorFormatConversion(buffer, buff, format, eleStream)) return 1;
+
+            error = mapper.mMapper->freeBuffer(buff);
+            EXPECT_EQ(error, Error::NONE);
+            if (error != Error::NONE)
+                return 1;
+
+            return 0;
+        }, mapperVar);
 }
 
 int dispatchGraphicBuffer(sp<IOmxNode> omxNode,
diff --git a/tv/tuner/1.0/IDemux.hal b/tv/tuner/1.0/IDemux.hal
index 9e799b4..16fc392 100644
--- a/tv/tuner/1.0/IDemux.hal
+++ b/tv/tuner/1.0/IDemux.hal
@@ -25,7 +25,6 @@
 /**
  * Demultiplexer(Demux) takes a single multiplexed input and splits it into
  * one or more output.
- *
  */
 interface IDemux {
     /**
@@ -134,4 +133,30 @@
      */
     openDvr(DvrType type, uint32_t bufferSize, IDvrCallback cb)
         generates (Result result, IDvr dvr);
+
+    /**
+     * Connect Conditional Access Modules (CAM) through Common Interface (CI)
+     *
+     * It is used by the client to connect CI-CAM. The demux uses the output
+     * from the frontend as the input by default, and must change to use the
+     * output from CI-CAM as the input after this call take place.
+     *
+     * @param ciCamId specify CI-CAM Id to connect.
+     * @return result Result status of the operation.
+     *         SUCCESS if successful,
+     *         UNKNOWN_ERROR if failed for other reasons.
+     */
+    connectCiCam(uint32_t ciCamId) generates (Result result);
+
+    /**
+     * Disconnect Conditional Access Modules (CAM)
+     *
+     * It is used by the client to disconnect CI-CAM. The demux will use the
+     * output from the frontend as the input after this call take place.
+     *
+     * @return result Result status of the operation.
+     *         SUCCESS if successful,
+     *         UNKNOWN_ERROR if failed for other reasons.
+     */
+    disconnectCiCam() generates (Result result);
 };
diff --git a/tv/tuner/1.0/IFilter.hal b/tv/tuner/1.0/IFilter.hal
index deaf3d4..3ed09f6 100644
--- a/tv/tuner/1.0/IFilter.hal
+++ b/tv/tuner/1.0/IFilter.hal
@@ -113,6 +113,21 @@
     getId() generates (Result result, uint32_t filterId);
 
     /**
+     * Release the handle reported by the HAL for AV memory.
+     *
+     * It is used by the client to notify the HAL that the AV handle won't be
+     * used any more in client side, so that the HAL can mark the memory
+     * presented by file descripor in the handle as released.
+     *
+     * @param avMemory A handle associated to the memory for audio or video.
+     * @return result Result status of the operation.
+     *         SUCCESS if successful,
+     *         INVALID_ARGUMENT if failed for wrong parameter.
+     *         UNKNOWN_ERROR if failed for other reasons.
+     */
+    releaseAvHandle(handle avMemory) generates (Result result);
+
+    /**
      * Set the filter's data source.
      *
      * A filter uses demux as data source by default. If the data was packetized
diff --git a/tv/tuner/1.0/default/Demux.cpp b/tv/tuner/1.0/default/Demux.cpp
index c5921f7..71a26ab 100644
--- a/tv/tuner/1.0/default/Demux.cpp
+++ b/tv/tuner/1.0/default/Demux.cpp
@@ -147,6 +147,20 @@
     return Void();
 }
 
+Return<Result> Demux::connectCiCam(uint32_t ciCamId) {
+    ALOGV("%s", __FUNCTION__);
+
+    mCiCamId = ciCamId;
+
+    return Result::SUCCESS;
+}
+
+Return<Result> Demux::disconnectCiCam() {
+    ALOGV("%s", __FUNCTION__);
+
+    return Result::SUCCESS;
+}
+
 Result Demux::removeFilter(uint32_t filterId) {
     ALOGV("%s", __FUNCTION__);
 
diff --git a/tv/tuner/1.0/default/Demux.h b/tv/tuner/1.0/default/Demux.h
index a9756cc..037429d 100644
--- a/tv/tuner/1.0/default/Demux.h
+++ b/tv/tuner/1.0/default/Demux.h
@@ -76,6 +76,10 @@
     virtual Return<void> openDvr(DvrType type, uint32_t bufferSize, const sp<IDvrCallback>& cb,
                                  openDvr_cb _hidl_cb) override;
 
+    virtual Return<Result> connectCiCam(uint32_t ciCamId) override;
+
+    virtual Return<Result> disconnectCiCam() override;
+
     // Functions interacts with Tuner Service
     void stopBroadcastInput();
     Result removeFilter(uint32_t filterId);
@@ -118,6 +122,7 @@
     void startTsFilter(vector<uint8_t> data);
 
     uint32_t mDemuxId;
+    uint32_t mCiCamId;
     /**
      * Record the last used filter id. Initial value is -1.
      * Filter Id starts with 0.
diff --git a/tv/tuner/1.0/default/Filter.cpp b/tv/tuner/1.0/default/Filter.cpp
index 3d8a977..befd1e6 100644
--- a/tv/tuner/1.0/default/Filter.cpp
+++ b/tv/tuner/1.0/default/Filter.cpp
@@ -120,6 +120,12 @@
     return Result::SUCCESS;
 }
 
+Return<Result> Filter::releaseAvHandle(const hidl_handle& /*avMemory*/) {
+    ALOGV("%s", __FUNCTION__);
+
+    return Result::SUCCESS;
+}
+
 Return<Result> Filter::close() {
     ALOGV("%s", __FUNCTION__);
 
@@ -289,6 +295,9 @@
                 case DemuxTsFilterType::RECORD:
                     startRecordFilterHandler();
                     break;
+                case DemuxTsFilterType::TEMI:
+                    startTemiFilterHandler();
+                    break;
             }
             break;
         case DemuxFilterMainType::MMTP:
@@ -419,6 +428,11 @@
     return Result::SUCCESS;
 }
 
+Result Filter::startTemiFilterHandler() {
+    // TODO handle starting TEMI filter
+    return Result::SUCCESS;
+}
+
 bool Filter::writeSectionsAndCreateEvent(vector<uint8_t> data) {
     // TODO check how many sections has been read
     ALOGD("[Filter] section hander");
@@ -453,4 +467,4 @@
 }  // namespace tuner
 }  // namespace tv
 }  // namespace hardware
-}  // namespace android
\ No newline at end of file
+}  // namespace android
diff --git a/tv/tuner/1.0/default/Filter.h b/tv/tuner/1.0/default/Filter.h
index 21d4297..fbd965a 100644
--- a/tv/tuner/1.0/default/Filter.h
+++ b/tv/tuner/1.0/default/Filter.h
@@ -68,6 +68,8 @@
 
     virtual Return<Result> flush() override;
 
+    virtual Return<Result> releaseAvHandle(const hidl_handle& avMemory) override;
+
     virtual Return<Result> close() override;
 
     /**
@@ -129,6 +131,7 @@
     Result startMediaFilterHandler();
     Result startRecordFilterHandler();
     Result startPcrFilterHandler();
+    Result startTemiFilterHandler();
     Result startFilterLoop();
 
     void deleteEventFlag();
@@ -176,4 +179,4 @@
 }  // namespace hardware
 }  // namespace android
 
-#endif  // ANDROID_HARDWARE_TV_TUNER_V1_0_FILTER_H_
\ No newline at end of file
+#endif  // ANDROID_HARDWARE_TV_TUNER_V1_0_FILTER_H_
diff --git a/tv/tuner/1.0/types.hal b/tv/tuner/1.0/types.hal
index a0cf0d9..ef33952 100644
--- a/tv/tuner/1.0/types.hal
+++ b/tv/tuner/1.0/types.hal
@@ -1759,6 +1759,12 @@
      * buffer of the record.
      */
     RECORD,
+    /**
+     * A filter to filter out Timed External Media Information (TEMI) according
+     * to ISO/IEC 13818-1:2013/ DAM 6 from input stream, and send TEMI event to
+     * client through onFilterEvent.
+     */
+    TEMI,
 };
 
 /**
@@ -2170,7 +2176,8 @@
 
     safe_union FilterSettings {
         /**
-         * Not additional parameters. it's used by PCR, TS subtype filters.
+         * Not additional parameters. it's used by PCR, TS, TEMI subtype
+         * filters.
          */
         Monostate noinit;
 
@@ -2461,6 +2468,27 @@
 };
 
 /**
+ *  Filter Event for Timed External Media Information (TEMI) data.
+ */
+struct DemuxFilterTemiEvent {
+    /**
+     * Presentation Time Stamp for audio or video frame. It based on 90KHz has
+     * the same format as PTS (Presentation Time Stamp) in ISO/IEC 13818-1.
+     */
+    uint64_t pts;
+
+    /**
+     * TEMI Descriptor Tag
+     */
+    uint8_t descrTag;
+
+    /**
+     * TEMI Descriptor
+     */
+    vec<uint8_t> descrData;
+};
+
+/**
  *  Filter Event for MMTP Record data.
  */
 struct DemuxFilterMmtpRecordEvent {
@@ -2521,6 +2549,8 @@
         DemuxFilterDownloadEvent download;
 
         DemuxFilterIpPayloadEvent ipPayload;
+
+        DemuxFilterTemiEvent temi;
     };
 
     /**
diff --git a/tv/tuner/1.0/vts/functional/VtsHalTvTunerV1_0TargetTest.cpp b/tv/tuner/1.0/vts/functional/VtsHalTvTunerV1_0TargetTest.cpp
index c666226..da3e300 100644
--- a/tv/tuner/1.0/vts/functional/VtsHalTvTunerV1_0TargetTest.cpp
+++ b/tv/tuner/1.0/vts/functional/VtsHalTvTunerV1_0TargetTest.cpp
@@ -159,6 +159,7 @@
     RECORD,
     MMTPRECORD,
     DOWNLOAD,
+    TEMI,
 };
 
 struct PlaybackConf {
@@ -821,6 +822,9 @@
                 case DemuxTsFilterType::RECORD:
                     eventType = FilterEventType::RECORD;
                     break;
+                case DemuxTsFilterType::TEMI:
+                    eventType = FilterEventType::TEMI;
+                    break;
             }
             break;
         case DemuxFilterMainType::MMTP: