diff --git a/Android.bp b/Android.bp
index 68115aa..baf3291 100644
--- a/Android.bp
+++ b/Android.bp
@@ -86,9 +86,3 @@
         "VtsHalHidlTargetTestBase",
     ],
 }
-
-dirgroup {
-    name: "trusty_dirgroup_hardware_interfaces",
-    dirs: ["."],
-    visibility: ["//trusty/vendor/google/aosp/scripts"],
-}
diff --git a/audio/aidl/Android.bp b/audio/aidl/Android.bp
index 4902497..7b6109a 100644
--- a/audio/aidl/Android.bp
+++ b/audio/aidl/Android.bp
@@ -228,6 +228,13 @@
     ],
 }
 
+rust_defaults {
+    name: "latest_android_hardware_audio_core_rust",
+    rustlibs: [
+        latest_android_hardware_audio_core + "-rust",
+    ],
+}
+
 // Used for the standalone sounddose HAL
 aidl_interface {
     name: "android.hardware.audio.core.sounddose",
diff --git a/audio/aidl/android/hardware/audio/core/stream-out-async-sm.gv b/audio/aidl/android/hardware/audio/core/stream-out-async-sm.gv
index 56b7926..e2da90d 100644
--- a/audio/aidl/android/hardware/audio/core/stream-out-async-sm.gv
+++ b/audio/aidl/android/hardware/audio/core/stream-out-async-sm.gv
@@ -45,6 +45,8 @@
     PAUSED -> ACTIVE [label="start"];                 // consumer -> active
     PAUSED -> IDLE [label="flush"];                   // producer -> passive, buffer is cleared
     DRAINING -> IDLE [label="←IStreamCallback.onDrainReady"];
+    DRAINING -> DRAINING [label="←IStreamCallback.onDrainReady"];  // allowed for `DRAIN_EARLY_NOTIFY`
+    DRAINING -> IDLE [label="<empty buffer>"];        // allowed for `DRAIN_EARLY_NOTIFY`
     DRAINING -> TRANSFERRING [label="burst"];         // producer -> active
     DRAINING -> ACTIVE [label="burst"];               // full write
     DRAINING -> DRAIN_PAUSED [label="pause"];         // consumer -> passive (not consuming)
diff --git a/audio/aidl/common/include/Utils.h b/audio/aidl/common/include/Utils.h
index ce29635..52ae936 100644
--- a/audio/aidl/common/include/Utils.h
+++ b/audio/aidl/common/include/Utils.h
@@ -29,7 +29,6 @@
 #include <aidl/android/media/audio/common/AudioIoFlags.h>
 #include <aidl/android/media/audio/common/AudioMode.h>
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
-#include <aidl/android/media/audio/common/AudioPolicyForcedConfig.h>
 #include <aidl/android/media/audio/common/PcmType.h>
 #include <android/binder_auto_utils.h>
 #include <utils/FastStrcmp.h>
@@ -63,31 +62,6 @@
         ::aidl::android::media::audio::common::AudioMode::CALL_SCREEN,
 };
 
-constexpr std::array<::aidl::android::media::audio::common::AudioPolicyForcedConfig, 17>
-        kValidAudioPolicyForcedConfig = {
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::NONE,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::SPEAKER,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::HEADPHONES,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::BT_SCO,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::BT_A2DP,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::WIRED_ACCESSORY,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::BT_CAR_DOCK,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::BT_DESK_DOCK,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::ANALOG_DOCK,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::DIGITAL_DOCK,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::NO_BT_A2DP,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::SYSTEM_ENFORCED,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::
-                        HDMI_SYSTEM_AUDIO_ENFORCED,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::
-                        ENCODED_SURROUND_NEVER,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::
-                        ENCODED_SURROUND_ALWAYS,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::
-                        ENCODED_SURROUND_MANUAL,
-                ::aidl::android::media::audio::common::AudioPolicyForcedConfig::BT_BLE,
-};
-
 constexpr bool iequals(const std::string& str1, const std::string& str2) {
     return str1.length() == str2.length() &&
            !fasticmp<strncmp>(str1.c_str(), str2.c_str(), str1.length());
@@ -168,12 +142,6 @@
            kValidAudioModes.end();
 }
 
-constexpr bool isValidAudioPolicyForcedConfig(
-        ::aidl::android::media::audio::common::AudioPolicyForcedConfig config) {
-    return std::find(kValidAudioPolicyForcedConfig.begin(), kValidAudioPolicyForcedConfig.end(),
-                     config) != kValidAudioPolicyForcedConfig.end();
-}
-
 static inline bool maybeVendorExtension(const std::string& s) {
     // Only checks whether the string starts with the "vendor prefix".
     static const std::string vendorPrefix = "VX_";
diff --git a/audio/aidl/default/CapEngineConfigXmlConverter.cpp b/audio/aidl/default/CapEngineConfigXmlConverter.cpp
index a6e78b9..20fbca4 100644
--- a/audio/aidl/default/CapEngineConfigXmlConverter.cpp
+++ b/audio/aidl/default/CapEngineConfigXmlConverter.cpp
@@ -96,8 +96,8 @@
     } else if (!fastcmp<strncmp>(criterionName.c_str(), kXsdcForceConfigForUse,
             strlen(kXsdcForceConfigForUse))) {
         AudioHalCapCriterionV2::ForceConfigForUse value;
-        value.forceUse = VALUE_OR_RETURN(convertForceUseCriterionToAidl(criterionName));
-        value.values.emplace_back(VALUE_OR_RETURN(convertForcedConfigToAidl(criterionValue)));
+        value.values.emplace_back(
+                VALUE_OR_RETURN(convertForceUseToAidl(criterionName, criterionValue)));
         rule.criterionAndValue = AudioHalCapCriterionV2::make<Tag::forceConfigForUse>(value);
     } else {
         LOG(ERROR) << __func__ << " unrecognized criterion " << criterionName;
diff --git a/audio/aidl/default/Module.cpp b/audio/aidl/default/Module.cpp
index 51b6085..e96cf81 100644
--- a/audio/aidl/default/Module.cpp
+++ b/audio/aidl/default/Module.cpp
@@ -207,9 +207,9 @@
         return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
     }
     const auto& flags = portConfigIt->flags.value();
-    StreamContext::DebugParameters params{mDebug.streamTransientStateDelayMs,
-                                          mVendorDebug.forceTransientBurst,
-                                          mVendorDebug.forceSynchronousDrain};
+    StreamContext::DebugParameters params{
+            mDebug.streamTransientStateDelayMs, mVendorDebug.forceTransientBurst,
+            mVendorDebug.forceSynchronousDrain, mVendorDebug.forceDrainToDraining};
     std::unique_ptr<StreamContext::DataMQ> dataMQ = nullptr;
     std::shared_ptr<IStreamCallback> streamAsyncCallback = nullptr;
     std::shared_ptr<ISoundDose> soundDose;
@@ -1524,6 +1524,7 @@
 
 const std::string Module::VendorDebug::kForceTransientBurstName = "aosp.forceTransientBurst";
 const std::string Module::VendorDebug::kForceSynchronousDrainName = "aosp.forceSynchronousDrain";
+const std::string Module::VendorDebug::kForceDrainToDrainingName = "aosp.forceDrainToDraining";
 
 ndk::ScopedAStatus Module::getVendorParameters(const std::vector<std::string>& in_ids,
                                                std::vector<VendorParameter>* _aidl_return) {
@@ -1538,6 +1539,10 @@
             VendorParameter forceSynchronousDrain{.id = id};
             forceSynchronousDrain.ext.setParcelable(Boolean{mVendorDebug.forceSynchronousDrain});
             _aidl_return->push_back(std::move(forceSynchronousDrain));
+        } else if (id == VendorDebug::kForceDrainToDrainingName) {
+            VendorParameter forceDrainToDraining{.id = id};
+            forceDrainToDraining.ext.setParcelable(Boolean{mVendorDebug.forceDrainToDraining});
+            _aidl_return->push_back(std::move(forceDrainToDraining));
         } else {
             allParametersKnown = false;
             LOG(VERBOSE) << __func__ << ": " << mType << ": unrecognized parameter \"" << id << "\"";
@@ -1578,6 +1583,10 @@
             if (!extractParameter<Boolean>(p, &mVendorDebug.forceSynchronousDrain)) {
                 return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
             }
+        } else if (p.id == VendorDebug::kForceDrainToDrainingName) {
+            if (!extractParameter<Boolean>(p, &mVendorDebug.forceDrainToDraining)) {
+                return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+            }
         } else {
             allParametersKnown = false;
             LOG(VERBOSE) << __func__ << ": " << mType << ": unrecognized parameter \"" << p.id
diff --git a/audio/aidl/default/Stream.cpp b/audio/aidl/default/Stream.cpp
index 3d7f30c..4525f6a 100644
--- a/audio/aidl/default/Stream.cpp
+++ b/audio/aidl/default/Stream.cpp
@@ -382,8 +382,20 @@
 const std::string StreamOutWorkerLogic::kThreadName = "writer";
 
 StreamOutWorkerLogic::Status StreamOutWorkerLogic::cycle() {
-    if (mState == StreamDescriptor::State::DRAINING ||
-        mState == StreamDescriptor::State::TRANSFERRING) {
+    if (mState == StreamDescriptor::State::DRAINING && mContext->getForceDrainToDraining() &&
+        mOnDrainReadyStatus == OnDrainReadyStatus::UNSENT) {
+        std::shared_ptr<IStreamCallback> asyncCallback = mContext->getAsyncCallback();
+        if (asyncCallback != nullptr) {
+            ndk::ScopedAStatus status = asyncCallback->onDrainReady();
+            if (!status.isOk()) {
+                LOG(ERROR) << __func__ << ": error from onDrainReady: " << status;
+            }
+            // This sets the timeout for moving into IDLE on next iterations.
+            switchToTransientState(StreamDescriptor::State::DRAINING);
+            mOnDrainReadyStatus = OnDrainReadyStatus::SENT;
+        }
+    } else if (mState == StreamDescriptor::State::DRAINING ||
+               mState == StreamDescriptor::State::TRANSFERRING) {
         if (auto stateDurationMs = std::chrono::duration_cast<std::chrono::milliseconds>(
                     std::chrono::steady_clock::now() - mTransientStateStart);
             stateDurationMs >= mTransientStateDelayMs) {
@@ -396,9 +408,12 @@
                 // drain or transfer completion. In the stub, we switch unconditionally.
                 if (mState == StreamDescriptor::State::DRAINING) {
                     mState = StreamDescriptor::State::IDLE;
-                    ndk::ScopedAStatus status = asyncCallback->onDrainReady();
-                    if (!status.isOk()) {
-                        LOG(ERROR) << __func__ << ": error from onDrainReady: " << status;
+                    if (mOnDrainReadyStatus != OnDrainReadyStatus::SENT) {
+                        ndk::ScopedAStatus status = asyncCallback->onDrainReady();
+                        if (!status.isOk()) {
+                            LOG(ERROR) << __func__ << ": error from onDrainReady: " << status;
+                        }
+                        mOnDrainReadyStatus = OnDrainReadyStatus::SENT;
                     }
                 } else {
                     mState = StreamDescriptor::State::ACTIVE;
@@ -537,6 +552,10 @@
                             mState = StreamDescriptor::State::IDLE;
                         } else {
                             switchToTransientState(StreamDescriptor::State::DRAINING);
+                            mOnDrainReadyStatus =
+                                    mode == StreamDescriptor::DrainMode::DRAIN_EARLY_NOTIFY
+                                            ? OnDrainReadyStatus::UNSENT
+                                            : OnDrainReadyStatus::IGNORE;
                         }
                     } else {
                         LOG(ERROR) << __func__ << ": drain failed: " << status;
diff --git a/audio/aidl/default/XsdcConversion.cpp b/audio/aidl/default/XsdcConversion.cpp
index ba6110d..b42d7f5 100644
--- a/audio/aidl/default/XsdcConversion.cpp
+++ b/audio/aidl/default/XsdcConversion.cpp
@@ -1,3 +1,19 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 #include <inttypes.h>
 
 #include <unordered_set>
@@ -5,6 +21,7 @@
 #define LOG_TAG "AHAL_Config"
 #include <android-base/logging.h>
 #include <android-base/strings.h>
+#include <android/binder_enums.h>
 
 #include <aidl/android/media/audio/common/AudioPort.h>
 #include <aidl/android/media/audio/common/AudioPortConfig.h>
@@ -20,9 +37,7 @@
 
 using aidl::android::hardware::audio::common::iequals;
 using aidl::android::hardware::audio::common::isValidAudioMode;
-using aidl::android::hardware::audio::common::isValidAudioPolicyForcedConfig;
 using aidl::android::hardware::audio::common::kValidAudioModes;
-using aidl::android::hardware::audio::common::kValidAudioPolicyForcedConfig;
 using aidl::android::media::audio::common::AudioChannelLayout;
 using aidl::android::media::audio::common::AudioContentType;
 using aidl::android::media::audio::common::AudioDevice;
@@ -38,7 +53,6 @@
 using aidl::android::media::audio::common::AudioHalVolumeCurve;
 using aidl::android::media::audio::common::AudioIoFlags;
 using aidl::android::media::audio::common::AudioMode;
-using aidl::android::media::audio::common::AudioPolicyForcedConfig;
 using aidl::android::media::audio::common::AudioPolicyForceUse;
 using aidl::android::media::audio::common::AudioPort;
 using aidl::android::media::audio::common::AudioPortConfig;
@@ -49,9 +63,10 @@
 using aidl::android::media::audio::common::AudioSource;
 using aidl::android::media::audio::common::AudioStreamType;
 using aidl::android::media::audio::common::AudioUsage;
-using ::android::BAD_VALUE;
-using ::android::base::unexpected;
-using ::android::utilities::convertTo;
+using android::BAD_VALUE;
+using android::base::unexpected;
+using android::utilities::convertTo;
+using ndk::enum_range;
 
 namespace ap_xsd = android::audio::policy::configuration;
 namespace eng_xsd = android::audio::policy::engine::configuration;
@@ -531,18 +546,6 @@
     return result;
 }
 
-ConversionResult<AudioPolicyForcedConfig> convertForcedConfigToAidl(
-        const std::string& xsdcForcedConfigCriterionType) {
-    const auto it = std::find_if(
-            kValidAudioPolicyForcedConfig.begin(), kValidAudioPolicyForcedConfig.end(),
-            [&](const auto& config) { return toString(config) == xsdcForcedConfigCriterionType; });
-    if (it == kValidAudioPolicyForcedConfig.end()) {
-        LOG(ERROR) << __func__ << " invalid forced config " << xsdcForcedConfigCriterionType;
-        return unexpected(BAD_VALUE);
-    }
-    return *it;
-}
-
 ConversionResult<AudioMode> convertTelephonyModeToAidl(const std::string& xsdcModeCriterionType) {
     const auto it = std::find_if(kValidAudioModes.begin(), kValidAudioModes.end(),
                                  [&xsdcModeCriterionType](const auto& mode) {
@@ -637,6 +640,16 @@
     return aidlDeviceAddresses;
 }
 
+ConversionResult<AudioMode> convertAudioModeToAidl(const std::string& xsdcAudioModeType) {
+    const auto it = std::find_if(enum_range<AudioMode>().begin(), enum_range<AudioMode>().end(),
+                                 [&](const auto v) { return toString(v) == xsdcAudioModeType; });
+    if (it == enum_range<AudioMode>().end()) {
+        LOG(ERROR) << __func__ << " invalid audio mode " << xsdcAudioModeType;
+        return unexpected(BAD_VALUE);
+    }
+    return *it;
+}
+
 ConversionResult<std::vector<AudioMode>> convertTelephonyModesToAidl(
         const eng_xsd::CriterionTypeType& xsdcTelephonyModeCriterionType) {
     if (xsdcTelephonyModeCriterionType.getValues().empty()) {
@@ -647,71 +660,97 @@
     for (eng_xsd::ValuesType xsdcValues : xsdcTelephonyModeCriterionType.getValues()) {
         aidlAudioModes.reserve(xsdcValues.getValue().size());
         for (const eng_xsd::ValueType& xsdcValue : xsdcValues.getValue()) {
-            int integerValue = xsdcValue.getNumerical();
-            if (!isValidAudioMode(AudioMode(integerValue))) {
-                LOG(ERROR) << __func__ << " invalid audio mode " << integerValue;
-                return unexpected(BAD_VALUE);
-            }
-            aidlAudioModes.push_back(AudioMode(integerValue));
+            aidlAudioModes.push_back(
+                    VALUE_OR_RETURN(convertAudioModeToAidl(xsdcValue.getLiteral())));
         }
     }
     return aidlAudioModes;
 }
 
-ConversionResult<std::vector<AudioPolicyForcedConfig>> convertForcedConfigsToAidl(
+ConversionResult<std::vector<AudioPolicyForceUse>> convertForceUseConfigsToAidl(
+        const std::string& criterionValue,
         const eng_xsd::CriterionTypeType& xsdcForcedConfigCriterionType) {
     if (xsdcForcedConfigCriterionType.getValues().empty()) {
         LOG(ERROR) << __func__ << " no values provided";
         return unexpected(BAD_VALUE);
     }
-    std::vector<AudioPolicyForcedConfig> aidlForcedConfigs;
+    std::vector<AudioPolicyForceUse> aidlForcedConfigs;
     for (eng_xsd::ValuesType xsdcValues : xsdcForcedConfigCriterionType.getValues()) {
         aidlForcedConfigs.reserve(xsdcValues.getValue().size());
         for (const eng_xsd::ValueType& xsdcValue : xsdcValues.getValue()) {
-            int integerValue = xsdcValue.getNumerical();
-            if (!isValidAudioPolicyForcedConfig(AudioPolicyForcedConfig(integerValue))) {
-                LOG(ERROR) << __func__ << " invalid forced config mode " << integerValue;
-                return unexpected(BAD_VALUE);
-            }
-            aidlForcedConfigs.push_back(AudioPolicyForcedConfig(integerValue));
+            aidlForcedConfigs.push_back(
+                    VALUE_OR_RETURN(convertForceUseToAidl(criterionValue, xsdcValue.getLiteral())));
         }
     }
     return aidlForcedConfigs;
 }
 
-ConversionResult<AudioPolicyForceUse> convertForceUseCriterionToAidl(
-        const std::string& xsdcCriterionName) {
+template <typename T>
+ConversionResult<T> convertForceUseForcedConfigToAidl(
+        const std::string& xsdcForcedConfigCriterionType) {
+    const auto it = std::find_if(enum_range<T>().begin(), enum_range<T>().end(), [&](const auto v) {
+        return toString(v) == xsdcForcedConfigCriterionType;
+    });
+    if (it == enum_range<T>().end()) {
+        LOG(ERROR) << __func__ << " invalid forced config " << xsdcForcedConfigCriterionType;
+        return unexpected(BAD_VALUE);
+    }
+    return *it;
+}
+
+ConversionResult<AudioPolicyForceUse> convertForceUseToAidl(const std::string& xsdcCriterionName,
+                                                            const std::string& xsdcCriterionValue) {
     if (!fastcmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForCommunication,
-            strlen(kXsdcForceConfigForCommunication))) {
-        return AudioPolicyForceUse::COMMUNICATION;
+                          strlen(kXsdcForceConfigForCommunication))) {
+        const auto deviceCategory = VALUE_OR_RETURN(
+                convertForceUseForcedConfigToAidl<AudioPolicyForceUse::CommunicationDeviceCategory>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::forCommunication>(deviceCategory);
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForMedia,
             strlen(kXsdcForceConfigForMedia))) {
-        return AudioPolicyForceUse::MEDIA;
+        const auto deviceCategory = VALUE_OR_RETURN(
+                convertForceUseForcedConfigToAidl<AudioPolicyForceUse::MediaDeviceCategory>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::forMedia>(deviceCategory);
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForRecord,
             strlen(kXsdcForceConfigForRecord))) {
-        return AudioPolicyForceUse::RECORD;
+        const auto deviceCategory = VALUE_OR_RETURN(
+                convertForceUseForcedConfigToAidl<AudioPolicyForceUse::CommunicationDeviceCategory>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::forRecord>(deviceCategory);
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForDock,
-            strlen(kXsdcForceConfigForDock))) {
-        return AudioPolicyForceUse::DOCK;
+                           strlen(kXsdcForceConfigForDock))) {
+        const auto dockType =
+                VALUE_OR_RETURN(convertForceUseForcedConfigToAidl<AudioPolicyForceUse::DockType>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::dock>(dockType);
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForSystem,
             strlen(kXsdcForceConfigForSystem))) {
-        return AudioPolicyForceUse::SYSTEM;
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::systemSounds>(xsdcCriterionValue ==
+                                                                            "SYSTEM_ENFORCED");
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForHdmiSystemAudio,
             strlen(kXsdcForceConfigForHdmiSystemAudio))) {
-        return AudioPolicyForceUse::HDMI_SYSTEM_AUDIO;
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::hdmiSystemAudio>(
+                xsdcCriterionValue == "HDMI_SYSTEM_AUDIO_ENFORCED");
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForEncodedSurround,
             strlen(kXsdcForceConfigForEncodedSurround))) {
-        return AudioPolicyForceUse::ENCODED_SURROUND;
+        const auto encodedSurround = VALUE_OR_RETURN(
+                convertForceUseForcedConfigToAidl<AudioPolicyForceUse::EncodedSurroundConfig>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::encodedSurround>(encodedSurround);
     }
     if (!fasticmp<strncmp>(xsdcCriterionName.c_str(), kXsdcForceConfigForVibrateRinging,
             strlen(kXsdcForceConfigForVibrateRinging))) {
-        return AudioPolicyForceUse::VIBRATE_RINGING;
+        const auto deviceCategory = VALUE_OR_RETURN(
+                convertForceUseForcedConfigToAidl<AudioPolicyForceUse::CommunicationDeviceCategory>(
+                        xsdcCriterionValue));
+        return AudioPolicyForceUse::make<AudioPolicyForceUse::forVibrateRinging>(deviceCategory);
     }
     LOG(ERROR) << __func__ << " unrecognized force use " << xsdcCriterionName;
     return unexpected(BAD_VALUE);
@@ -747,9 +786,8 @@
     }
     if (!fastcmp<strncmp>(xsdcCriterion.getName().c_str(), kXsdcForceConfigForUse,
             strlen(kXsdcForceConfigForUse))) {
-        return AudioHalCapCriterionV2::make<Tag::forceConfigForUse>(
-                VALUE_OR_RETURN(convertForceUseCriterionToAidl(xsdcCriterion.getName())),
-                VALUE_OR_RETURN(convertForcedConfigsToAidl(xsdcCriterionType)));
+        return AudioHalCapCriterionV2::make<Tag::forceConfigForUse>(VALUE_OR_RETURN(
+                convertForceUseConfigsToAidl(xsdcCriterion.getName(), xsdcCriterionType)));
     }
     LOG(ERROR) << __func__ << " unrecognized criterion " << xsdcCriterion.getName();
     return unexpected(BAD_VALUE);
diff --git a/audio/aidl/default/config/audioPolicy/engine/api/current.txt b/audio/aidl/default/config/audioPolicy/engine/api/current.txt
index 8e0e9a2..017362f 100644
--- a/audio/aidl/default/config/audioPolicy/engine/api/current.txt
+++ b/audio/aidl/default/config/audioPolicy/engine/api/current.txt
@@ -148,6 +148,45 @@
     method public void setValue(@Nullable java.util.List<android.audio.policy.engine.configuration.FlagType>);
   }
 
+  public enum ForcedConfigCommunicationDeviceType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigCommunicationDeviceType BT_BLE;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigCommunicationDeviceType BT_SCO;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigCommunicationDeviceType NONE;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigCommunicationDeviceType SPEAKER;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigCommunicationDeviceType WIRED_ACCESSORY;
+  }
+
+  public enum ForcedConfigDockType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType ANALOG_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType BT_CAR_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType BT_DESK_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType DIGITAL_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType NONE;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigDockType WIRED_ACCESSORY;
+  }
+
+  public enum ForcedConfigMediaDeviceType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType ANALOG_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType BT_A2DP;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType DIGITAL_DOCK;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType HEADPHONES;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType NONE;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType NO_BT_A2DP;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType SPEAKER;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedConfigMediaDeviceType WIRED_ACCESSORY;
+  }
+
+  public enum ForcedEncodingSourroundConfigType {
+    method @NonNull public String getRawName();
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedEncodingSourroundConfigType ALWAYS;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedEncodingSourroundConfigType MANUAL;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedEncodingSourroundConfigType NEVER;
+    enum_constant public static final android.audio.policy.engine.configuration.ForcedEncodingSourroundConfigType UNSPECIFIED;
+  }
+
   public enum PfwCriterionTypeEnum {
     method @NonNull public String getRawName();
     enum_constant public static final android.audio.policy.engine.configuration.PfwCriterionTypeEnum exclusive;
@@ -244,10 +283,8 @@
     ctor public ValueType();
     method @Nullable public String getAndroid_type();
     method @Nullable public String getLiteral();
-    method @Nullable public long getNumerical();
     method public void setAndroid_type(@Nullable String);
     method public void setLiteral(@Nullable String);
-    method public void setNumerical(@Nullable long);
   }
 
   public class ValuesType {
diff --git a/audio/aidl/default/config/audioPolicy/engine/audio_policy_engine_configuration.xsd b/audio/aidl/default/config/audioPolicy/engine/audio_policy_engine_configuration.xsd
index e2508ea..c16e366 100644
--- a/audio/aidl/default/config/audioPolicy/engine/audio_policy_engine_configuration.xsd
+++ b/audio/aidl/default/config/audioPolicy/engine/audio_policy_engine_configuration.xsd
@@ -191,10 +191,9 @@
     <xs:complexType name="valueType">
         <xs:annotation>
             <xs:documentation xml:lang="en">
-                Criterion type is provided as a tuple of 'human readable' string (referred as the
-                literal part, that will allow to express 'human readable' rules, numerical value
-                associated in order to improve performances of the parameter framework library used,
-                and an optional android type.
+                Criterion type is provided as a pair of 'human readable' string (referred as the
+                literal part, that will allow to express 'human readable' rules and an optional
+                android type.
                 This android type is reserved for device type mapping with parameter framework
                 representation on a bitfield (Only one bit is expected to represent a device) and
                 android representation of a type that may use several bits.
@@ -203,7 +202,6 @@
             </xs:documentation>
         </xs:annotation>
         <xs:attribute name="literal" type="xs:string" use="required"/>
-        <xs:attribute name="numerical" type="xs:long" use="required"/>
         <xs:attribute name="android_type" type="longDecimalOrHexType" use="optional"/>
     </xs:complexType>
 
@@ -409,6 +407,49 @@
         </xs:restriction>
     </xs:simpleType>
 
+    <xs:simpleType name="forcedConfigCommunicationDeviceType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="NONE"/>
+            <xs:enumeration value="SPEAKER"/>
+            <xs:enumeration value="BT_SCO"/>
+            <xs:enumeration value="BT_BLE"/>
+            <xs:enumeration value="WIRED_ACCESSORY"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="forcedConfigMediaDeviceType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="NONE"/>
+            <xs:enumeration value="SPEAKER"/>
+            <xs:enumeration value="HEADPHONES"/>
+            <xs:enumeration value="BT_A2DP"/>
+            <xs:enumeration value="ANALOG_DOCK"/>
+            <xs:enumeration value="DIGITAL_DOCK"/>
+            <xs:enumeration value="WIRED_ACCESSORY"/>
+            <xs:enumeration value="NO_BT_A2DP"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="forcedConfigDockType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="NONE"/>
+            <xs:enumeration value="BT_CAR_DOCK"/>
+            <xs:enumeration value="BT_DESK_DOCK"/>
+            <xs:enumeration value="ANALOG_DOCK"/>
+            <xs:enumeration value="DIGITAL_DOCK"/>
+            <xs:enumeration value="WIRED_ACCESSORY"/>
+        </xs:restriction>
+    </xs:simpleType>
+
+    <xs:simpleType name="forcedEncodingSourroundConfigType">
+        <xs:restriction base="xs:string">
+            <xs:enumeration value="UNSPECIFIED"/>
+            <xs:enumeration value="NEVER"/>
+            <xs:enumeration value="ALWAYS"/>
+            <xs:enumeration value="MANUAL"/>
+        </xs:restriction>
+    </xs:simpleType>
+
     <xs:simpleType name="sourceEnumType">
         <xs:restriction base="xs:string">
             <xs:enumeration value="AUDIO_SOURCE_DEFAULT"/>
diff --git a/audio/aidl/default/include/core-impl/Module.h b/audio/aidl/default/include/core-impl/Module.h
index 7e32cf2..d03598a 100644
--- a/audio/aidl/default/include/core-impl/Module.h
+++ b/audio/aidl/default/include/core-impl/Module.h
@@ -148,8 +148,10 @@
     struct VendorDebug {
         static const std::string kForceTransientBurstName;
         static const std::string kForceSynchronousDrainName;
+        static const std::string kForceDrainToDrainingName;
         bool forceTransientBurst = false;
         bool forceSynchronousDrain = false;
+        bool forceDrainToDraining = false;
     };
     // ids of device ports created at runtime via 'connectExternalDevice'.
     // Also stores a list of ids of mix ports with dynamic profiles that were populated from
diff --git a/audio/aidl/default/include/core-impl/Stream.h b/audio/aidl/default/include/core-impl/Stream.h
index f7b9269..8297fc5 100644
--- a/audio/aidl/default/include/core-impl/Stream.h
+++ b/audio/aidl/default/include/core-impl/Stream.h
@@ -78,6 +78,10 @@
         bool forceTransientBurst = false;
         // Force the "drain" command to be synchronous, going directly to the IDLE state.
         bool forceSynchronousDrain = false;
+        // Force the "drain early notify" command to keep the SM in the DRAINING state
+        // after sending 'onDrainReady' callback. The SM moves to IDLE after
+        // 'transientStateDelayMs'.
+        bool forceDrainToDraining = false;
     };
 
     StreamContext() = default;
@@ -119,6 +123,7 @@
     ::aidl::android::media::audio::common::AudioIoFlags getFlags() const { return mFlags; }
     bool getForceTransientBurst() const { return mDebugParameters.forceTransientBurst; }
     bool getForceSynchronousDrain() const { return mDebugParameters.forceSynchronousDrain; }
+    bool getForceDrainToDraining() const { return mDebugParameters.forceDrainToDraining; }
     size_t getFrameSize() const;
     int getInternalCommandCookie() const { return mInternalCommandCookie; }
     int32_t getMixPortHandle() const { return mMixPortHandle; }
@@ -301,6 +306,9 @@
     bool write(size_t clientSize, StreamDescriptor::Reply* reply);
 
     std::shared_ptr<IStreamOutEventCallback> mEventCallback;
+
+    enum OnDrainReadyStatus : int32_t { IGNORE /*used for DRAIN_ALL*/, UNSENT, SENT };
+    OnDrainReadyStatus mOnDrainReadyStatus = OnDrainReadyStatus::IGNORE;
 };
 using StreamOutWorker = StreamWorkerImpl<StreamOutWorkerLogic>;
 
diff --git a/audio/aidl/default/include/core-impl/XsdcConversion.h b/audio/aidl/default/include/core-impl/XsdcConversion.h
index e855a3e..f00206b 100644
--- a/audio/aidl/default/include/core-impl/XsdcConversion.h
+++ b/audio/aidl/default/include/core-impl/XsdcConversion.h
@@ -1,6 +1,20 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 #include <string>
-#include <unordered_map>
-#include <unordered_set>
 
 #include <aidl/android/media/audio/common/AudioHalCapCriterion.h>
 #include <aidl/android/media/audio/common/AudioHalCapCriterionType.h>
@@ -21,10 +35,8 @@
 
 static constexpr const char kXsdcForceConfigForUse[] = "ForceUseFor";
 
-ConversionResult<aidlaudiocommon::AudioPolicyForceUse> convertForceUseCriterionToAidl(
-        const std::string& xsdcCriterionName);
-ConversionResult<aidlaudiocommon::AudioPolicyForcedConfig> convertForcedConfigToAidl(
-        const std::string& xsdcForcedConfigCriterionType);
+ConversionResult<aidlaudiocommon::AudioPolicyForceUse> convertForceUseToAidl(
+        const std::string& xsdcCriterionName, const std::string& xsdcCriterionValue);
 ConversionResult<aidlaudiocommon::AudioDeviceAddress> convertDeviceAddressToAidl(
         const std::string& xsdcAddress);
 ConversionResult<aidlaudiocommon::AudioMode> convertTelephonyModeToAidl(
diff --git a/audio/aidl/vts/Android.bp b/audio/aidl/vts/Android.bp
index cbd42c0..4a71be9 100644
--- a/audio/aidl/vts/Android.bp
+++ b/audio/aidl/vts/Android.bp
@@ -115,6 +115,9 @@
     defaults: ["VtsHalAudioEffectTargetTestDefaults"],
     static_libs: ["libaudioaidlranges"],
     srcs: ["VtsHalDynamicsProcessingTest.cpp"],
+    shared_libs: [
+        "libaudioutils",
+    ],
 }
 
 cc_test {
@@ -166,6 +169,9 @@
     name: "VtsHalVisualizerTargetTest",
     defaults: ["VtsHalAudioEffectTargetTestDefaults"],
     srcs: ["VtsHalVisualizerTargetTest.cpp"],
+    shared_libs: [
+        "libaudioutils",
+    ],
 }
 
 cc_test {
diff --git a/audio/aidl/vts/EffectHelper.h b/audio/aidl/vts/EffectHelper.h
index d716975..570ecef 100644
--- a/audio/aidl/vts/EffectHelper.h
+++ b/audio/aidl/vts/EffectHelper.h
@@ -375,7 +375,8 @@
                                         std::vector<float>& outputBuffer,
                                         const std::shared_ptr<IEffect>& effect,
                                         IEffect::OpenEffectReturn* openEffectReturn,
-                                        int version = -1, int times = 1) {
+                                        int version = -1, int times = 1,
+                                        bool callStopReset = true) {
         // Initialize AidlMessagequeues
         auto statusMQ = std::make_unique<EffectHelper::StatusMQ>(openEffectReturn->statusMQ);
         ASSERT_TRUE(statusMQ->isValid());
@@ -401,10 +402,14 @@
         }
 
         // Disable the process
-        ASSERT_NO_FATAL_FAILURE(command(effect, CommandId::STOP));
+        if (callStopReset) {
+            ASSERT_NO_FATAL_FAILURE(command(effect, CommandId::STOP));
+        }
         EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, outputBuffer));
 
-        ASSERT_NO_FATAL_FAILURE(command(effect, CommandId::RESET));
+        if (callStopReset) {
+            ASSERT_NO_FATAL_FAILURE(command(effect, CommandId::RESET));
+        }
     }
 
     // Find FFT bin indices for testFrequencies and get bin center frequencies
diff --git a/audio/aidl/vts/VtsHalAudioCoreConfigTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreConfigTargetTest.cpp
index 583143c..eaec88b 100644
--- a/audio/aidl/vts/VtsHalAudioCoreConfigTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreConfigTargetTest.cpp
@@ -55,7 +55,6 @@
 using aidl::android::media::audio::common::AudioHalVolumeGroup;
 using aidl::android::media::audio::common::AudioMode;
 using aidl::android::media::audio::common::AudioPolicyForceUse;
-using aidl::android::media::audio::common::AudioPolicyForcedConfig;
 using aidl::android::media::audio::common::AudioProductStrategyType;
 using aidl::android::media::audio::common::AudioSource;
 using aidl::android::media::audio::common::AudioStreamType;
@@ -577,7 +576,7 @@
     void ValidateCapSpecificConfig(const AudioHalEngineConfig::CapSpecificConfig& capCfg) {
         EXPECT_TRUE(capCfg.criteriaV2.has_value());
         std::unordered_set<AudioHalCapCriterionV2::Tag> criterionTagSet;
-        std::unordered_set<AudioPolicyForceUse> forceUseCriterionUseSet;
+        std::unordered_set<AudioPolicyForceUse::Tag> forceUseCriterionUseSet;
         for (const auto& criterion : capCfg.criteriaV2.value()) {
             EXPECT_TRUE(criterion.has_value());
             if (criterion.value().getTag() != AudioHalCapCriterionV2::forceConfigForUse) {
@@ -585,7 +584,9 @@
             } else {
                 auto forceUseCriterion =
                         criterion.value().get<AudioHalCapCriterionV2::forceConfigForUse>();
-                EXPECT_TRUE(forceUseCriterionUseSet.insert(forceUseCriterion.forceUse).second);
+                ASSERT_FALSE(forceUseCriterion.values.empty());
+                EXPECT_TRUE(forceUseCriterionUseSet.insert(forceUseCriterion.values[0].getTag())
+                                    .second);
             }
             EXPECT_NO_FATAL_FAILURE(ValidateAudioHalCapCriterion(criterion.value()));
         }
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index 6bfba65..6bce107 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -117,6 +117,10 @@
 using ndk::enum_range;
 using ndk::ScopedAStatus;
 
+static constexpr int32_t kAidlVersion1 = 1;
+static constexpr int32_t kAidlVersion2 = 2;
+static constexpr int32_t kAidlVersion3 = 3;
+
 template <typename T>
 std::set<int32_t> extractIds(const std::vector<T>& v) {
     std::set<int32_t> ids;
@@ -452,7 +456,6 @@
     // This is implemented by the 'StreamFixture' utility class.
     static constexpr int kNegativeTestBufferSizeFrames = 256;
     static constexpr int kDefaultLargeBufferSizeFrames = 48000;
-    static constexpr int32_t kAidlVersion3 = 3;
 
     void SetUpImpl(const std::string& moduleName, bool setUpDebug = true) {
         ASSERT_NO_FATAL_FAILURE(ConnectToService(moduleName, setUpDebug));
@@ -582,7 +585,7 @@
     std::unique_ptr<WithDebugFlags> debug;
     std::vector<AudioPort> initialPorts;
     std::vector<AudioRoute> initialRoutes;
-    int32_t aidlVersion;
+    int32_t aidlVersion = -1;
 };
 
 class WithDevicePortConnectedState {
@@ -1837,6 +1840,7 @@
 }
 
 TEST_P(AudioCoreModule, SetAudioPortConfigInvalidPortAudioGain) {
+    ASSERT_GE(aidlVersion, kAidlVersion1);
     if (aidlVersion < kAidlVersion3) {
         GTEST_SKIP() << "Skip for audio HAL version lower than " << kAidlVersion3;
     }
@@ -4021,6 +4025,7 @@
 
 enum {
     NAMED_CMD_NAME,
+    NAMED_CMD_MIN_INTERFACE_VERSION,
     NAMED_CMD_DELAY_MS,
     NAMED_CMD_STREAM_TYPE,
     NAMED_CMD_CMDS,
@@ -4028,7 +4033,7 @@
 };
 enum class StreamTypeFilter { ANY, SYNC, ASYNC };
 using NamedCommandSequence =
-        std::tuple<std::string, int /*cmdDelayMs*/, StreamTypeFilter,
+        std::tuple<std::string, int /*minInterfaceVersion*/, int /*cmdDelayMs*/, StreamTypeFilter,
                    std::shared_ptr<StateSequence>, bool /*validatePositionIncrease*/>;
 enum { PARAM_MODULE_NAME, PARAM_CMD_SEQ, PARAM_SETUP_SEQ };
 using StreamIoTestParameters =
@@ -4039,6 +4044,12 @@
   public:
     void SetUp() override {
         ASSERT_NO_FATAL_FAILURE(SetUpImpl(std::get<PARAM_MODULE_NAME>(GetParam())));
+        ASSERT_GE(aidlVersion, kAidlVersion1);
+        if (const int minVersion =
+                    std::get<NAMED_CMD_MIN_INTERFACE_VERSION>(std::get<PARAM_CMD_SEQ>(GetParam()));
+            aidlVersion < minVersion) {
+            GTEST_SKIP() << "Skip for audio HAL version lower than " << minVersion;
+        }
         ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
     }
 
@@ -4048,6 +4059,20 @@
         if (allPortConfigs.empty()) {
             GTEST_SKIP() << "No mix ports have attached devices";
         }
+        const auto& commandsAndStates =
+                std::get<NAMED_CMD_CMDS>(std::get<PARAM_CMD_SEQ>(GetParam()));
+        const bool validatePositionIncrease =
+                std::get<NAMED_CMD_VALIDATE_POS_INCREASE>(std::get<PARAM_CMD_SEQ>(GetParam()));
+        auto runStreamIoCommands = [&](const AudioPortConfig& portConfig) {
+            if (!std::get<PARAM_SETUP_SEQ>(GetParam())) {
+                ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq1(portConfig, commandsAndStates,
+                                                                    validatePositionIncrease));
+            } else {
+                ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq2(portConfig, commandsAndStates,
+                                                                    validatePositionIncrease));
+            }
+        };
+
         for (const auto& portConfig : allPortConfigs) {
             auto port = moduleConfig->getPort(portConfig.portId);
             ASSERT_TRUE(port.has_value());
@@ -4075,16 +4100,18 @@
             delayTransientStates.flags().streamTransientStateDelayMs =
                     std::get<NAMED_CMD_DELAY_MS>(std::get<PARAM_CMD_SEQ>(GetParam()));
             ASSERT_NO_FATAL_FAILURE(delayTransientStates.SetUp(module.get()));
-            const auto& commandsAndStates =
-                    std::get<NAMED_CMD_CMDS>(std::get<PARAM_CMD_SEQ>(GetParam()));
-            const bool validatePositionIncrease =
-                    std::get<NAMED_CMD_VALIDATE_POS_INCREASE>(std::get<PARAM_CMD_SEQ>(GetParam()));
-            if (!std::get<PARAM_SETUP_SEQ>(GetParam())) {
-                ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq1(portConfig, commandsAndStates,
-                                                                    validatePositionIncrease));
-            } else {
-                ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq2(portConfig, commandsAndStates,
-                                                                    validatePositionIncrease));
+            ASSERT_NO_FATAL_FAILURE(runStreamIoCommands(portConfig));
+            if (aidlVersion >= kAidlVersion3 && isNonBlocking && !IOTraits<Stream>::is_input) {
+                // Also try running the same sequence with "aosp.forceDrainToDraining" set.
+                // This will only work with the default implementation. When it works, the stream
+                // tries always to move to the 'DRAINING' state after an "early notify" drain.
+                // This helps to check more paths for our test scenarios.
+                WithModuleParameter forceDrainToDraining("aosp.forceDrainToDraining",
+                                                         Boolean{true});
+                if (forceDrainToDraining.SetUpNoChecks(module.get(), true /*failureExpected*/)
+                            .isOk()) {
+                    ASSERT_NO_FATAL_FAILURE(runStreamIoCommands(portConfig));
+                }
             }
             if (isNonBlocking) {
                 // Also try running the same sequence with "aosp.forceTransientBurst" set.
@@ -4094,13 +4121,7 @@
                 WithModuleParameter forceTransientBurst("aosp.forceTransientBurst", Boolean{true});
                 if (forceTransientBurst.SetUpNoChecks(module.get(), true /*failureExpected*/)
                             .isOk()) {
-                    if (!std::get<PARAM_SETUP_SEQ>(GetParam())) {
-                        ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq1(
-                                portConfig, commandsAndStates, validatePositionIncrease));
-                    } else {
-                        ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq2(
-                                portConfig, commandsAndStates, validatePositionIncrease));
-                    }
+                    ASSERT_NO_FATAL_FAILURE(runStreamIoCommands(portConfig));
                 }
             } else if (!IOTraits<Stream>::is_input) {
                 // Also try running the same sequence with "aosp.forceSynchronousDrain" set.
@@ -4111,13 +4132,7 @@
                                                           Boolean{true});
                 if (forceSynchronousDrain.SetUpNoChecks(module.get(), true /*failureExpected*/)
                             .isOk()) {
-                    if (!std::get<PARAM_SETUP_SEQ>(GetParam())) {
-                        ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq1(
-                                portConfig, commandsAndStates, validatePositionIncrease));
-                    } else {
-                        ASSERT_NO_FATAL_FAILURE(RunStreamIoCommandsImplSeq2(
-                                portConfig, commandsAndStates, validatePositionIncrease));
-                    }
+                    ASSERT_NO_FATAL_FAILURE(runStreamIoCommands(portConfig));
                 }
             }
         }
@@ -4570,14 +4585,14 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kReadSeq =
-        std::make_tuple(std::string("Read"), 0, StreamTypeFilter::ANY, makeBurstCommands(true),
-                        true /*validatePositionIncrease*/);
+        std::make_tuple(std::string("Read"), kAidlVersion1, 0, StreamTypeFilter::ANY,
+                        makeBurstCommands(true), true /*validatePositionIncrease*/);
 static const NamedCommandSequence kWriteSyncSeq =
-        std::make_tuple(std::string("Write"), 0, StreamTypeFilter::SYNC, makeBurstCommands(true),
-                        true /*validatePositionIncrease*/);
+        std::make_tuple(std::string("Write"), kAidlVersion1, 0, StreamTypeFilter::SYNC,
+                        makeBurstCommands(true), true /*validatePositionIncrease*/);
 static const NamedCommandSequence kWriteAsyncSeq =
-        std::make_tuple(std::string("Write"), 0, StreamTypeFilter::ASYNC, makeBurstCommands(false),
-                        true /*validatePositionIncrease*/);
+        std::make_tuple(std::string("Write"), kAidlVersion1, 0, StreamTypeFilter::ASYNC,
+                        makeBurstCommands(false), true /*validatePositionIncrease*/);
 
 std::shared_ptr<StateSequence> makeAsyncDrainCommands(bool isInput) {
     using State = StreamDescriptor::State;
@@ -4606,10 +4621,10 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kWriteDrainAsyncSeq = std::make_tuple(
-        std::string("WriteDrain"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
-        makeAsyncDrainCommands(false), false /*validatePositionIncrease*/);
+        std::string("WriteDrain"), kAidlVersion1, kStreamTransientStateTransitionDelayMs,
+        StreamTypeFilter::ASYNC, makeAsyncDrainCommands(false), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kDrainInSeq =
-        std::make_tuple(std::string("Drain"), 0, StreamTypeFilter::ANY,
+        std::make_tuple(std::string("Drain"), kAidlVersion1, 0, StreamTypeFilter::ANY,
                         makeAsyncDrainCommands(true), false /*validatePositionIncrease*/);
 
 std::shared_ptr<StateSequence> makeDrainOutCommands(bool isSync) {
@@ -4631,12 +4646,28 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kDrainOutSyncSeq =
-        std::make_tuple(std::string("Drain"), 0, StreamTypeFilter::SYNC, makeDrainOutCommands(true),
-                        false /*validatePositionIncrease*/);
+        std::make_tuple(std::string("Drain"), kAidlVersion1, 0, StreamTypeFilter::SYNC,
+                        makeDrainOutCommands(true), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kDrainOutAsyncSeq =
-        std::make_tuple(std::string("Drain"), 0, StreamTypeFilter::ASYNC,
+        std::make_tuple(std::string("Drain"), kAidlVersion3, 0, StreamTypeFilter::ASYNC,
                         makeDrainOutCommands(false), false /*validatePositionIncrease*/);
 
+std::shared_ptr<StateSequence> makeDrainEarlyOutCommands() {
+    using State = StreamDescriptor::State;
+    auto d = std::make_unique<StateDag>();
+    StateDag::Node last = d->makeFinalNode(State::IDLE);
+    StateDag::Node draining = d->makeNode(State::DRAINING, kDrainReadyEvent, last);
+    draining.children().push_back(d->makeNode(State::DRAINING, kGetStatusCommand, last));
+    StateDag::Node active = d->makeNode(State::ACTIVE, kDrainOutEarlyCommand, draining);
+    StateDag::Node idle = d->makeNode(State::IDLE, kBurstCommand, active);
+    idle.children().push_back(d->makeNode(State::TRANSFERRING, kTransferReadyEvent, active));
+    d->makeNode(State::STANDBY, kStartCommand, idle);
+    return std::make_shared<StateSequenceFollower>(std::move(d));
+}
+static const NamedCommandSequence kDrainEarlyOutAsyncSeq =
+        std::make_tuple(std::string("DrainEarly"), kAidlVersion3, 0, StreamTypeFilter::ASYNC,
+                        makeDrainEarlyOutCommands(), false /*validatePositionIncrease*/);
+
 std::shared_ptr<StateSequence> makeDrainPauseOutCommands(bool isSync) {
     using State = StreamDescriptor::State;
     auto d = std::make_unique<StateDag>();
@@ -4656,12 +4687,33 @@
     d->makeNode(State::STANDBY, kStartCommand, idle);
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
-static const NamedCommandSequence kDrainPauseOutSyncSeq = std::make_tuple(
-        std::string("DrainPause"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::SYNC,
-        makeDrainPauseOutCommands(true), false /*validatePositionIncrease*/);
-static const NamedCommandSequence kDrainPauseOutAsyncSeq = std::make_tuple(
-        std::string("DrainPause"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
-        makeDrainPauseOutCommands(false), false /*validatePositionIncrease*/);
+static const NamedCommandSequence kDrainPauseOutSyncSeq =
+        std::make_tuple(std::string("DrainPause"), kAidlVersion1,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::SYNC,
+                        makeDrainPauseOutCommands(true), false /*validatePositionIncrease*/);
+static const NamedCommandSequence kDrainPauseOutAsyncSeq =
+        std::make_tuple(std::string("DrainPause"), kAidlVersion1,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
+                        makeDrainPauseOutCommands(false), false /*validatePositionIncrease*/);
+
+std::shared_ptr<StateSequence> makeDrainEarlyPauseOutCommands() {
+    using State = StreamDescriptor::State;
+    auto d = std::make_unique<StateDag>();
+    StateDag::Node draining = d->makeNodes({std::make_pair(State::DRAINING, kPauseCommand),
+                                            std::make_pair(State::DRAIN_PAUSED, kStartCommand),
+                                            std::make_pair(State::DRAINING, kPauseCommand),
+                                            std::make_pair(State::DRAIN_PAUSED, kBurstCommand)},
+                                           State::TRANSFER_PAUSED);
+    StateDag::Node active = d->makeNode(State::ACTIVE, kDrainOutEarlyCommand, draining);
+    StateDag::Node idle = d->makeNode(State::IDLE, kBurstCommand, active);
+    idle.children().push_back(d->makeNode(State::TRANSFERRING, kDrainOutEarlyCommand, draining));
+    d->makeNode(State::STANDBY, kStartCommand, idle);
+    return std::make_shared<StateSequenceFollower>(std::move(d));
+}
+static const NamedCommandSequence kDrainEarlyPauseOutAsyncSeq =
+        std::make_tuple(std::string("DrainEarlyPause"), kAidlVersion3,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
+                        makeDrainEarlyPauseOutCommands(), false /*validatePositionIncrease*/);
 
 // This sequence also verifies that the capture / presentation position is not reset on standby.
 std::shared_ptr<StateSequence> makeStandbyCommands(bool isInput, bool isSync) {
@@ -4703,14 +4755,15 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kStandbyInSeq =
-        std::make_tuple(std::string("Standby"), 0, StreamTypeFilter::ANY,
+        std::make_tuple(std::string("Standby"), kAidlVersion1, 0, StreamTypeFilter::ANY,
                         makeStandbyCommands(true, false), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kStandbyOutSyncSeq =
-        std::make_tuple(std::string("Standby"), 0, StreamTypeFilter::SYNC,
+        std::make_tuple(std::string("Standby"), kAidlVersion1, 0, StreamTypeFilter::SYNC,
                         makeStandbyCommands(false, true), false /*validatePositionIncrease*/);
-static const NamedCommandSequence kStandbyOutAsyncSeq = std::make_tuple(
-        std::string("Standby"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
-        makeStandbyCommands(false, false), false /*validatePositionIncrease*/);
+static const NamedCommandSequence kStandbyOutAsyncSeq =
+        std::make_tuple(std::string("Standby"), kAidlVersion1,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
+                        makeStandbyCommands(false, false), false /*validatePositionIncrease*/);
 
 std::shared_ptr<StateSequence> makePauseCommands(bool isInput, bool isSync) {
     using State = StreamDescriptor::State;
@@ -4745,14 +4798,15 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kPauseInSeq =
-        std::make_tuple(std::string("Pause"), 0, StreamTypeFilter::ANY,
+        std::make_tuple(std::string("Pause"), kAidlVersion1, 0, StreamTypeFilter::ANY,
                         makePauseCommands(true, false), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kPauseOutSyncSeq =
-        std::make_tuple(std::string("Pause"), 0, StreamTypeFilter::SYNC,
+        std::make_tuple(std::string("Pause"), kAidlVersion1, 0, StreamTypeFilter::SYNC,
                         makePauseCommands(false, true), false /*validatePositionIncrease*/);
-static const NamedCommandSequence kPauseOutAsyncSeq = std::make_tuple(
-        std::string("Pause"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
-        makePauseCommands(false, false), false /*validatePositionIncrease*/);
+static const NamedCommandSequence kPauseOutAsyncSeq =
+        std::make_tuple(std::string("Pause"), kAidlVersion1, kStreamTransientStateTransitionDelayMs,
+                        StreamTypeFilter::ASYNC, makePauseCommands(false, false),
+                        false /*validatePositionIncrease*/);
 
 std::shared_ptr<StateSequence> makeFlushCommands(bool isInput, bool isSync) {
     using State = StreamDescriptor::State;
@@ -4780,14 +4834,15 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kFlushInSeq =
-        std::make_tuple(std::string("Flush"), 0, StreamTypeFilter::ANY,
+        std::make_tuple(std::string("Flush"), kAidlVersion1, 0, StreamTypeFilter::ANY,
                         makeFlushCommands(true, false), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kFlushOutSyncSeq =
-        std::make_tuple(std::string("Flush"), 0, StreamTypeFilter::SYNC,
+        std::make_tuple(std::string("Flush"), kAidlVersion1, 0, StreamTypeFilter::SYNC,
                         makeFlushCommands(false, true), false /*validatePositionIncrease*/);
-static const NamedCommandSequence kFlushOutAsyncSeq = std::make_tuple(
-        std::string("Flush"), kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
-        makeFlushCommands(false, false), false /*validatePositionIncrease*/);
+static const NamedCommandSequence kFlushOutAsyncSeq =
+        std::make_tuple(std::string("Flush"), kAidlVersion1, kStreamTransientStateTransitionDelayMs,
+                        StreamTypeFilter::ASYNC, makeFlushCommands(false, false),
+                        false /*validatePositionIncrease*/);
 
 std::shared_ptr<StateSequence> makeDrainPauseFlushOutCommands(bool isSync) {
     using State = StreamDescriptor::State;
@@ -4807,13 +4862,13 @@
     return std::make_shared<StateSequenceFollower>(std::move(d));
 }
 static const NamedCommandSequence kDrainPauseFlushOutSyncSeq =
-        std::make_tuple(std::string("DrainPauseFlush"), kStreamTransientStateTransitionDelayMs,
-                        StreamTypeFilter::SYNC, makeDrainPauseFlushOutCommands(true),
-                        false /*validatePositionIncrease*/);
+        std::make_tuple(std::string("DrainPauseFlush"), kAidlVersion1,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::SYNC,
+                        makeDrainPauseFlushOutCommands(true), false /*validatePositionIncrease*/);
 static const NamedCommandSequence kDrainPauseFlushOutAsyncSeq =
-        std::make_tuple(std::string("DrainPauseFlush"), kStreamTransientStateTransitionDelayMs,
-                        StreamTypeFilter::ASYNC, makeDrainPauseFlushOutCommands(false),
-                        false /*validatePositionIncrease*/);
+        std::make_tuple(std::string("DrainPauseFlush"), kAidlVersion1,
+                        kStreamTransientStateTransitionDelayMs, StreamTypeFilter::ASYNC,
+                        makeDrainPauseFlushOutCommands(false), false /*validatePositionIncrease*/);
 
 // Note, this isn't the "official" enum printer, it is only used to make the test name suffix.
 std::string PrintStreamFilterToString(StreamTypeFilter filter) {
@@ -4851,9 +4906,10 @@
         AudioStreamIoOutTest, AudioStreamIoOut,
         testing::Combine(testing::ValuesIn(android::getAidlHalInstanceNames(IModule::descriptor)),
                          testing::Values(kWriteSyncSeq, kWriteAsyncSeq, kWriteDrainAsyncSeq,
-                                         kDrainOutSyncSeq, kDrainPauseOutSyncSeq,
-                                         kDrainPauseOutAsyncSeq, kStandbyOutSyncSeq,
-                                         kStandbyOutAsyncSeq,
+                                         kDrainOutSyncSeq, kDrainOutAsyncSeq,
+                                         kDrainEarlyOutAsyncSeq, kDrainPauseOutSyncSeq,
+                                         kDrainPauseOutAsyncSeq, kDrainEarlyPauseOutAsyncSeq,
+                                         kStandbyOutSyncSeq, kStandbyOutAsyncSeq,
                                          kPauseOutSyncSeq,  // kPauseOutAsyncSeq,
                                          kFlushOutSyncSeq, kFlushOutAsyncSeq,
                                          kDrainPauseFlushOutSyncSeq, kDrainPauseFlushOutAsyncSeq),
diff --git a/audio/aidl/vts/VtsHalDynamicsProcessingTest.cpp b/audio/aidl/vts/VtsHalDynamicsProcessingTest.cpp
index 0c201cc..6e8d410 100644
--- a/audio/aidl/vts/VtsHalDynamicsProcessingTest.cpp
+++ b/audio/aidl/vts/VtsHalDynamicsProcessingTest.cpp
@@ -20,6 +20,8 @@
 
 #define LOG_TAG "VtsHalDynamicsProcessingTest"
 #include <android-base/logging.h>
+#include <audio_utils/power.h>
+#include <audio_utils/primitives.h>
 
 #include <Utils.h>
 
@@ -44,26 +46,25 @@
 class DynamicsProcessingTestHelper : public EffectHelper {
   public:
     DynamicsProcessingTestHelper(std::pair<std::shared_ptr<IFactory>, Descriptor> pair,
-                                 int32_t channelLayOut = AudioChannelLayout::LAYOUT_STEREO) {
+                                 int32_t channelLayOut = AudioChannelLayout::LAYOUT_STEREO)
+        : mChannelLayout(channelLayOut),
+          mChannelCount(::aidl::android::hardware::audio::common::getChannelCount(
+                  AudioChannelLayout::make<AudioChannelLayout::layoutMask>(mChannelLayout))) {
         std::tie(mFactory, mDescriptor) = pair;
-        mChannelLayout = channelLayOut;
-        mChannelCount = ::aidl::android::hardware::audio::common::getChannelCount(
-                AudioChannelLayout::make<AudioChannelLayout::layoutMask>(mChannelLayout));
     }
 
     // setup
     void SetUpDynamicsProcessingEffect() {
         ASSERT_NE(nullptr, mFactory);
         ASSERT_NO_FATAL_FAILURE(create(mFactory, mEffect, mDescriptor));
-
         Parameter::Specific specific = getDefaultParamSpecific();
         Parameter::Common common = createParamCommon(
-                0 /* session */, 1 /* ioHandle */, 44100 /* iSampleRate */, 44100 /* oSampleRate */,
-                0x100 /* iFrameCount */, 0x100 /* oFrameCount */,
+                0 /* session */, 1 /* ioHandle */, kSamplingFrequency /* iSampleRate */,
+                kSamplingFrequency /* oSampleRate */, kFrameCount /* iFrameCount */,
+                kFrameCount /* oFrameCount */,
                 AudioChannelLayout::make<AudioChannelLayout::layoutMask>(mChannelLayout),
                 AudioChannelLayout::make<AudioChannelLayout::layoutMask>(mChannelLayout));
-        IEffect::OpenEffectReturn ret;
-        ASSERT_NO_FATAL_FAILURE(open(mEffect, common, specific, &ret, EX_NONE));
+        ASSERT_NO_FATAL_FAILURE(open(mEffect, common, specific, &mOpenEffectReturn, EX_NONE));
         ASSERT_NE(nullptr, mEffect);
         mEngineConfigApplied = mEngineConfigPreset;
     }
@@ -113,6 +114,8 @@
     // get set params and validate
     void SetAndGetDynamicsProcessingParameters();
 
+    bool isAllParamsValid();
+
     // enqueue test parameters
     void addEngineConfig(const DynamicsProcessing::EngineArchitecture& cfg);
     void addPreEqChannelConfig(const std::vector<DynamicsProcessing::ChannelConfig>& cfg);
@@ -126,9 +129,12 @@
 
     static constexpr float kPreferredProcessingDurationMs = 10.0f;
     static constexpr int kBandCount = 5;
+    static constexpr int kSamplingFrequency = 44100;
+    static constexpr int kFrameCount = 2048;
     std::shared_ptr<IFactory> mFactory;
     std::shared_ptr<IEffect> mEffect;
     Descriptor mDescriptor;
+    IEffect::OpenEffectReturn mOpenEffectReturn;
     DynamicsProcessing::EngineArchitecture mEngineConfigApplied;
     DynamicsProcessing::EngineArchitecture mEngineConfigPreset{
             .resolutionPreference =
@@ -148,12 +154,12 @@
     static const std::set<DynamicsProcessing::StageEnablement> kStageEnablementTestSet;
     static const std::set<std::vector<DynamicsProcessing::InputGain>> kInputGainTestSet;
 
-  protected:
-    int mChannelCount;
-
   private:
-    int32_t mChannelLayout;
+    const int32_t mChannelLayout;
     std::vector<std::pair<DynamicsProcessing::Tag, DynamicsProcessing>> mTags;
+
+  protected:
+    const int mChannelCount;
     void CleanUp() {
         mTags.clear();
         mPreEqChannelEnable.clear();
@@ -329,10 +335,7 @@
 }
 
 void DynamicsProcessingTestHelper::SetAndGetDynamicsProcessingParameters() {
-    for (auto& it : mTags) {
-        auto& tag = it.first;
-        auto& dp = it.second;
-
+    for (const auto& [tag, dp] : mTags) {
         // validate parameter
         Descriptor desc;
         ASSERT_STATUS(EX_NONE, mEffect->getDescriptor(&desc));
@@ -371,6 +374,22 @@
     }
 }
 
+bool DynamicsProcessingTestHelper::isAllParamsValid() {
+    if (mTags.empty()) {
+        return false;
+    }
+    for (const auto& [tag, dp] : mTags) {
+        // validate parameter
+        if (!isParamInRange(dp, mDescriptor.capability.range.get<Range::dynamicsProcessing>())) {
+            return false;
+        }
+        if (!isParamValid(tag, dp)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 void DynamicsProcessingTestHelper::addEngineConfig(
         const DynamicsProcessing::EngineArchitecture& cfg) {
     DynamicsProcessing dp;
@@ -446,6 +465,21 @@
     mTags.push_back({DynamicsProcessing::inputGain, dp});
 }
 
+void fillLimiterConfig(std::vector<DynamicsProcessing::LimiterConfig>& limiterConfigList,
+                       int channelIndex, bool enable, int linkGroup, float attackTime,
+                       float releaseTime, float ratio, float threshold, float postGain) {
+    DynamicsProcessing::LimiterConfig cfg;
+    cfg.channel = channelIndex;
+    cfg.enable = enable;
+    cfg.linkGroup = linkGroup;
+    cfg.attackTimeMs = attackTime;
+    cfg.releaseTimeMs = releaseTime;
+    cfg.ratio = ratio;
+    cfg.thresholdDb = threshold;
+    cfg.postGainDb = postGain;
+    limiterConfigList.push_back(cfg);
+}
+
 /**
  * Test DynamicsProcessing Engine Configuration
  */
@@ -486,7 +520,7 @@
 
 TEST_P(DynamicsProcessingTestEngineArchitecture, SetAndGetEngineArch) {
     EXPECT_NO_FATAL_FAILURE(addEngineConfig(mCfg));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 INSTANTIATE_TEST_SUITE_P(
@@ -527,7 +561,7 @@
   public:
     DynamicsProcessingTestInputGain()
         : DynamicsProcessingTestHelper(std::get<INPUT_GAIN_INSTANCE_NAME>(GetParam())),
-          mInputGain(std::get<INPUT_GAIN_PARAM>(GetParam())){};
+          mInputGain(std::get<INPUT_GAIN_PARAM>(GetParam())) {};
 
     void SetUp() override { SetUpDynamicsProcessingEffect(); }
 
@@ -538,7 +572,7 @@
 
 TEST_P(DynamicsProcessingTestInputGain, SetAndGetInputGain) {
     EXPECT_NO_FATAL_FAILURE(addInputGain(mInputGain));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 INSTANTIATE_TEST_SUITE_P(
@@ -565,40 +599,23 @@
 enum LimiterConfigTestParamName {
     LIMITER_INSTANCE_NAME,
     LIMITER_CHANNEL,
-    LIMITER_ENABLE,
     LIMITER_LINK_GROUP,
-    LIMITER_ADDITIONAL,
-};
-enum LimiterConfigTestAdditionalParam {
     LIMITER_ATTACK_TIME,
     LIMITER_RELEASE_TIME,
     LIMITER_RATIO,
     LIMITER_THRESHOLD,
     LIMITER_POST_GAIN,
-    LIMITER_MAX_NUM,
 };
-using LimiterConfigTestAdditional = std::array<float, LIMITER_MAX_NUM>;
-// attackTime, releaseTime, ratio, thresh, postGain
-static constexpr std::array<LimiterConfigTestAdditional, 4> kLimiterConfigTestAdditionalParam = {
-        {{-1, -60, -2.5, -2, -3.14},
-         {-1, 60, -2.5, 2, -3.14},
-         {1, -60, 2.5, -2, 3.14},
-         {1, 60, 2.5, -2, 3.14}}};
 
 using LimiterConfigTestParams = std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>,
-                                           int32_t, bool, int32_t, LimiterConfigTestAdditional>;
+                                           int32_t, int32_t, float, float, float, float, float>;
 
-void fillLimiterConfig(DynamicsProcessing::LimiterConfig& cfg,
+void fillLimiterConfig(std::vector<DynamicsProcessing::LimiterConfig>& cfg,
                        const LimiterConfigTestParams& params) {
-    const std::array<float, LIMITER_MAX_NUM> additional = std::get<LIMITER_ADDITIONAL>(params);
-    cfg.channel = std::get<LIMITER_CHANNEL>(params);
-    cfg.enable = std::get<LIMITER_ENABLE>(params);
-    cfg.linkGroup = std::get<LIMITER_LINK_GROUP>(params);
-    cfg.attackTimeMs = additional[LIMITER_ATTACK_TIME];
-    cfg.releaseTimeMs = additional[LIMITER_RELEASE_TIME];
-    cfg.ratio = additional[LIMITER_RATIO];
-    cfg.thresholdDb = additional[LIMITER_THRESHOLD];
-    cfg.postGainDb = additional[LIMITER_POST_GAIN];
+    fillLimiterConfig(cfg, std::get<LIMITER_CHANNEL>(params), true,
+                      std::get<LIMITER_LINK_GROUP>(params), std::get<LIMITER_ATTACK_TIME>(params),
+                      std::get<LIMITER_RELEASE_TIME>(params), std::get<LIMITER_RATIO>(params),
+                      std::get<LIMITER_THRESHOLD>(params), std::get<LIMITER_POST_GAIN>(params));
 }
 
 class DynamicsProcessingTestLimiterConfig
@@ -607,7 +624,7 @@
   public:
     DynamicsProcessingTestLimiterConfig()
         : DynamicsProcessingTestHelper(std::get<LIMITER_INSTANCE_NAME>(GetParam())) {
-        fillLimiterConfig(mCfg, GetParam());
+        fillLimiterConfig(mLimiterConfigList, GetParam());
     }
 
     void SetUp() override { SetUpDynamicsProcessingEffect(); }
@@ -615,36 +632,194 @@
     void TearDown() override { TearDownDynamicsProcessingEffect(); }
 
     DynamicsProcessing::LimiterConfig mCfg;
+    std::vector<DynamicsProcessing::LimiterConfig> mLimiterConfigList;
 };
 
 TEST_P(DynamicsProcessingTestLimiterConfig, SetAndGetLimiterConfig) {
     EXPECT_NO_FATAL_FAILURE(addEngineConfig(mEngineConfigPreset));
-    EXPECT_NO_FATAL_FAILURE(addLimiterConfig({mCfg}));
-    SetAndGetDynamicsProcessingParameters();
+    EXPECT_NO_FATAL_FAILURE(addLimiterConfig(mLimiterConfigList));
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 INSTANTIATE_TEST_SUITE_P(
         DynamicsProcessingTest, DynamicsProcessingTestLimiterConfig,
         ::testing::Combine(testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
                                    IFactory::descriptor, getEffectTypeUuidDynamicsProcessing())),
-                           testing::Values(-1, 0, 1, 2),                           // channel count
-                           testing::Bool(),                                        // enable
-                           testing::Values(3),                                     // link group
-                           testing::ValuesIn(kLimiterConfigTestAdditionalParam)),  // Additional
+                           testing::Values(-1, 0, 1, 2),  // channel index
+                           testing::Values(3),            // link group
+                           testing::Values(-1, 1),        // attackTime
+                           testing::Values(-60, 60),      // releaseTime
+                           testing::Values(-2.5, 2.5),    // ratio
+                           testing::Values(-2, 2),        // thresh
+                           testing::Values(-3.14, 3.14)   // postGain
+                           ),
         [](const auto& info) {
             auto descriptor = std::get<LIMITER_INSTANCE_NAME>(info.param).second;
-            DynamicsProcessing::LimiterConfig cfg;
+            std::vector<DynamicsProcessing::LimiterConfig> cfg;
             fillLimiterConfig(cfg, info.param);
-            std::string name = "Implementor_" + descriptor.common.implementor + "_name_" +
-                               descriptor.common.name + "_UUID_" +
-                               toString(descriptor.common.id.uuid) + "_limiterConfig_" +
-                               cfg.toString();
+            std::string name =
+                    "Implementer_" + getPrefix(descriptor) + "_limiterConfig_" + cfg[0].toString();
             std::replace_if(
                     name.begin(), name.end(), [](const char c) { return !std::isalnum(c); }, '_');
             return name;
         });
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(DynamicsProcessingTestLimiterConfig);
 
+using LimiterConfigDataTestParams = std::pair<std::shared_ptr<IFactory>, Descriptor>;
+
+class DynamicsProcessingLimiterConfigDataTest
+    : public ::testing::TestWithParam<LimiterConfigDataTestParams>,
+      public DynamicsProcessingTestHelper {
+  public:
+    DynamicsProcessingLimiterConfigDataTest()
+        : DynamicsProcessingTestHelper(GetParam(), AudioChannelLayout::LAYOUT_MONO) {
+        mBufferSize = kFrameCount * mChannelCount;
+        mInput.resize(mBufferSize);
+        generateSineWave(1000 /*Input Frequency*/, mInput);
+        mInputDb = calculateDb(mInput);
+    }
+
+    void SetUp() override {
+        SetUpDynamicsProcessingEffect();
+        SKIP_TEST_IF_DATA_UNSUPPORTED(mDescriptor.common.flags);
+    }
+
+    void TearDown() override { TearDownDynamicsProcessingEffect(); }
+
+    float calculateDb(std::vector<float> input, size_t start = 0) {
+        return audio_utils_compute_power_mono(input.data() + start, AUDIO_FORMAT_PCM_FLOAT,
+                                              input.size() - start);
+    }
+
+    void computeThreshold(float ratio, float outputDb, float& threshold) {
+        EXPECT_NE(ratio, 0);
+        threshold = (mInputDb - (ratio * outputDb)) / (1 - ratio);
+    }
+
+    void computeRatio(float threshold, float outputDb, float& ratio) {
+        float inputOverThreshold = mInputDb - threshold;
+        float outputOverThreshold = outputDb - threshold;
+        EXPECT_NE(outputOverThreshold, 0);
+        ratio = inputOverThreshold / outputOverThreshold;
+    }
+
+    void setParamsAndProcess(std::vector<float>& output) {
+        EXPECT_NO_FATAL_FAILURE(addEngineConfig(mEngineConfigPreset));
+        EXPECT_NO_FATAL_FAILURE(addLimiterConfig(mLimiterConfigList));
+        ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
+        if (isAllParamsValid()) {
+            ASSERT_NO_FATAL_FAILURE(
+                    processAndWriteToOutput(mInput, output, mEffect, &mOpenEffectReturn));
+            EXPECT_GT(output.size(), kStartIndex);
+        }
+        cleanUpLimiterConfig();
+    }
+
+    void cleanUpLimiterConfig() {
+        CleanUp();
+        mLimiterConfigList.clear();
+    }
+    static constexpr float kDefaultLinkerGroup = 3;
+    static constexpr float kDefaultAttackTime = 0;
+    static constexpr float kDefaultReleaseTime = 0;
+    static constexpr float kDefaultRatio = 4;
+    static constexpr float kDefaultThreshold = 0;
+    static constexpr float kDefaultPostGain = 0;
+    static constexpr int kInputFrequency = 1000;
+    static constexpr size_t kStartIndex = 15 * kSamplingFrequency / 1000;  // skip 15ms
+    std::vector<DynamicsProcessing::LimiterConfig> mLimiterConfigList;
+    std::vector<float> mInput;
+    float mInputDb;
+    int mBufferSize;
+};
+
+TEST_P(DynamicsProcessingLimiterConfigDataTest, IncreasingThresholdDb) {
+    std::vector<float> thresholdValues = {-200, -150, -100, -50, -5, 0};
+    std::vector<float> output(mInput.size());
+    float previousThreshold = -FLT_MAX;
+    for (float threshold : thresholdValues) {
+        for (int i = 0; i < mChannelCount; i++) {
+            fillLimiterConfig(mLimiterConfigList, i, true, kDefaultLinkerGroup, kDefaultAttackTime,
+                              kDefaultReleaseTime, kDefaultRatio, threshold, kDefaultPostGain);
+        }
+        EXPECT_NO_FATAL_FAILURE(setParamsAndProcess(output));
+        if (!isAllParamsValid()) {
+            continue;
+        }
+        float outputDb = calculateDb(output, kStartIndex);
+        if (threshold >= mInputDb || kDefaultRatio == 1) {
+            EXPECT_EQ(std::round(mInputDb), std::round(outputDb));
+        } else {
+            float calculatedThreshold = 0;
+            EXPECT_NO_FATAL_FAILURE(computeThreshold(kDefaultRatio, outputDb, calculatedThreshold));
+            ASSERT_GT(calculatedThreshold, previousThreshold);
+            previousThreshold = calculatedThreshold;
+        }
+    }
+}
+
+TEST_P(DynamicsProcessingLimiterConfigDataTest, IncreasingRatio) {
+    std::vector<float> ratioValues = {1, 10, 20, 30, 40, 50};
+    std::vector<float> output(mInput.size());
+    float threshold = -10;
+    float previousRatio = 0;
+    for (float ratio : ratioValues) {
+        for (int i = 0; i < mChannelCount; i++) {
+            fillLimiterConfig(mLimiterConfigList, i, true, kDefaultLinkerGroup, kDefaultAttackTime,
+                              kDefaultReleaseTime, ratio, threshold, kDefaultPostGain);
+        }
+        EXPECT_NO_FATAL_FAILURE(setParamsAndProcess(output));
+        if (!isAllParamsValid()) {
+            continue;
+        }
+        float outputDb = calculateDb(output, kStartIndex);
+
+        if (threshold >= mInputDb) {
+            EXPECT_EQ(std::round(mInputDb), std::round(outputDb));
+        } else {
+            float calculatedRatio = 0;
+            EXPECT_NO_FATAL_FAILURE(computeRatio(threshold, outputDb, calculatedRatio));
+            ASSERT_GT(calculatedRatio, previousRatio);
+            previousRatio = calculatedRatio;
+        }
+    }
+}
+
+TEST_P(DynamicsProcessingLimiterConfigDataTest, LimiterEnableDisable) {
+    std::vector<bool> limiterEnableValues = {false, true};
+    std::vector<float> output(mInput.size());
+    for (bool isEnabled : limiterEnableValues) {
+        for (int i = 0; i < mChannelCount; i++) {
+            // Set non-default values
+            fillLimiterConfig(mLimiterConfigList, i, isEnabled, kDefaultLinkerGroup,
+                              5 /*attack time*/, 5 /*release time*/, 10 /*ratio*/,
+                              -10 /*threshold*/, 5 /*postgain*/);
+        }
+        EXPECT_NO_FATAL_FAILURE(setParamsAndProcess(output));
+        if (!isAllParamsValid()) {
+            continue;
+        }
+        if (isEnabled) {
+            EXPECT_NE(mInputDb, calculateDb(output, kStartIndex));
+        } else {
+            EXPECT_NEAR(mInputDb, calculateDb(output, kStartIndex), 0.05);
+        }
+    }
+}
+
+INSTANTIATE_TEST_SUITE_P(DynamicsProcessingTest, DynamicsProcessingLimiterConfigDataTest,
+                         testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
+                                 IFactory::descriptor, getEffectTypeUuidDynamicsProcessing())),
+                         [](const auto& info) {
+                             auto descriptor = info.param;
+                             std::string name = getPrefix(descriptor.second);
+                             std::replace_if(
+                                     name.begin(), name.end(),
+                                     [](const char c) { return !std::isalnum(c); }, '_');
+                             return name;
+                         });
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(DynamicsProcessingLimiterConfigDataTest);
+
 /**
  * Test DynamicsProcessing ChannelConfig
  */
@@ -673,19 +848,19 @@
 TEST_P(DynamicsProcessingTestChannelConfig, SetAndGetPreEqChannelConfig) {
     EXPECT_NO_FATAL_FAILURE(addEngineConfig(mEngineConfigPreset));
     EXPECT_NO_FATAL_FAILURE(addPreEqChannelConfig(mCfg));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 TEST_P(DynamicsProcessingTestChannelConfig, SetAndGetPostEqChannelConfig) {
     EXPECT_NO_FATAL_FAILURE(addEngineConfig(mEngineConfigPreset));
     EXPECT_NO_FATAL_FAILURE(addPostEqChannelConfig(mCfg));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 TEST_P(DynamicsProcessingTestChannelConfig, SetAndGetMbcChannelConfig) {
     EXPECT_NO_FATAL_FAILURE(addEngineConfig(mEngineConfigPreset));
     EXPECT_NO_FATAL_FAILURE(addMbcChannelConfig(mCfg));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 INSTANTIATE_TEST_SUITE_P(
@@ -715,12 +890,11 @@
 enum EqBandConfigTestParamName {
     EQ_BAND_INSTANCE_NAME,
     EQ_BAND_CHANNEL,
-    EQ_BAND_ENABLE,
     EQ_BAND_CUT_OFF_FREQ,
     EQ_BAND_GAIN
 };
 using EqBandConfigTestParams = std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, int32_t,
-                                          bool, std::vector<std::pair<int, float>>, float>;
+                                          std::vector<std::pair<int, float>>, float>;
 
 void fillEqBandConfig(std::vector<DynamicsProcessing::EqBandConfig>& cfgs,
                       const EqBandConfigTestParams& params) {
@@ -730,7 +904,7 @@
     for (int i = 0; i < bandCount; i++) {
         cfgs[i].channel = std::get<EQ_BAND_CHANNEL>(params);
         cfgs[i].band = cutOffFreqs[i].first;
-        cfgs[i].enable = std::get<EQ_BAND_ENABLE>(params);
+        cfgs[i].enable = true /*Eqband Enable*/;
         cfgs[i].cutoffFrequencyHz = cutOffFreqs[i].second;
         cfgs[i].gainDb = std::get<EQ_BAND_GAIN>(params);
     }
@@ -761,7 +935,7 @@
     }
     EXPECT_NO_FATAL_FAILURE(addPreEqChannelConfig(cfgs));
     EXPECT_NO_FATAL_FAILURE(addPreEqBandConfigs(mCfgs));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 TEST_P(DynamicsProcessingTestEqBandConfig, SetAndGetPostEqBandConfig) {
@@ -774,7 +948,7 @@
     }
     EXPECT_NO_FATAL_FAILURE(addPostEqChannelConfig(cfgs));
     EXPECT_NO_FATAL_FAILURE(addPostEqBandConfigs(mCfgs));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 std::vector<std::vector<std::pair<int, float>>> kBands{
@@ -825,9 +999,8 @@
         DynamicsProcessingTest, DynamicsProcessingTestEqBandConfig,
         ::testing::Combine(testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
                                    IFactory::descriptor, getEffectTypeUuidDynamicsProcessing())),
-                           testing::Values(-1, 0, 10),     // channel ID
-                           testing::Bool(),                // band enable
-                           testing::ValuesIn(kBands),      // cut off frequencies
+                           testing::Values(-1, 0, 10),     // channel index
+                           testing::ValuesIn(kBands),      // band index, cut off frequencies
                            testing::Values(-3.14f, 3.14f)  // gain
                            ),
         [](const auto& info) {
@@ -851,7 +1024,6 @@
 enum MbcBandConfigParamName {
     MBC_BAND_INSTANCE_NAME,
     MBC_BAND_CHANNEL,
-    MBC_BAND_ENABLE,
     MBC_BAND_CUTOFF_FREQ,
     MBC_BAND_ADDITIONAL
 };
@@ -877,7 +1049,7 @@
          {3, 10, 2, -2, -5, 90, 2.5, 2, 2}}};
 
 using TestParamsMbcBandConfig =
-        std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, int32_t, bool,
+        std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, int32_t,
                    std::vector<std::pair<int, float>>, TestParamsMbcBandConfigAdditional>;
 
 void fillMbcBandConfig(std::vector<DynamicsProcessing::MbcBandConfig>& cfgs,
@@ -890,7 +1062,7 @@
         cfgs[i] = DynamicsProcessing::MbcBandConfig{
                 .channel = std::get<MBC_BAND_CHANNEL>(params),
                 .band = cutOffFreqs[i].first,
-                .enable = std::get<MBC_BAND_ENABLE>(params),
+                .enable = true /*Mbc Band Enable*/,
                 .cutoffFrequencyHz = cutOffFreqs[i].second,
                 .attackTimeMs = additional[MBC_ADD_ATTACK_TIME],
                 .releaseTimeMs = additional[MBC_ADD_RELEASE_TIME],
@@ -930,16 +1102,15 @@
     }
     EXPECT_NO_FATAL_FAILURE(addMbcChannelConfig(cfgs));
     EXPECT_NO_FATAL_FAILURE(addMbcBandConfigs(mCfgs));
-    SetAndGetDynamicsProcessingParameters();
+    ASSERT_NO_FATAL_FAILURE(SetAndGetDynamicsProcessingParameters());
 }
 
 INSTANTIATE_TEST_SUITE_P(
         DynamicsProcessingTest, DynamicsProcessingTestMbcBandConfig,
         ::testing::Combine(testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
                                    IFactory::descriptor, getEffectTypeUuidDynamicsProcessing())),
-                           testing::Values(-1, 0, 10),  // channel count
-                           testing::Bool(),             // enable
-                           testing::ValuesIn(kBands),   // cut off frequencies
+                           testing::Values(-1, 0, 10),  // channel index
+                           testing::ValuesIn(kBands),   // band index, cut off frequencies
                            testing::ValuesIn(kMbcBandConfigAdditionalParam)),  // Additional
         [](const auto& info) {
             auto descriptor = std::get<MBC_BAND_INSTANCE_NAME>(info.param).second;
diff --git a/audio/aidl/vts/VtsHalVisualizerTargetTest.cpp b/audio/aidl/vts/VtsHalVisualizerTargetTest.cpp
index a0e43bc..a942521 100644
--- a/audio/aidl/vts/VtsHalVisualizerTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalVisualizerTargetTest.cpp
@@ -19,6 +19,7 @@
 #define LOG_TAG "VtsHalVisualizerTest"
 #include <android-base/logging.h>
 #include <android/binder_enums.h>
+#include <audio_utils/power.h>
 
 #include "EffectHelper.h"
 
@@ -44,9 +45,8 @@
     PARAM_MEASUREMENT_MODE,
     PARAM_LATENCY,
 };
-using VisualizerParamTestParam =
-        std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, int, Visualizer::ScalingMode,
-                   Visualizer::MeasurementMode, int>;
+using VisualizerTestParam = std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, int,
+                                       Visualizer::ScalingMode, Visualizer::MeasurementMode, int>;
 
 class VisualizerTestHelper : public EffectHelper {
   public:
@@ -139,10 +139,15 @@
                 {Visualizer::latencyMs, Visualizer::make<Visualizer::latencyMs>(latency)});
     }
 
+    static std::unordered_set<Visualizer::ScalingMode> getScalingModeValues() {
+        return {ndk::enum_range<Visualizer::ScalingMode>().begin(),
+                ndk::enum_range<Visualizer::ScalingMode>().end()};
+    }
+
     static constexpr long kInputFrameCount = 0x100, kOutputFrameCount = 0x100;
     const size_t mChannelCount =
             getChannelCount(AudioChannelLayout::make<AudioChannelLayout::layoutMask>(
-                    AudioChannelLayout::LAYOUT_STEREO));
+                    AudioChannelLayout::LAYOUT_MONO));
     const size_t mBufferSizeInFrames = kInputFrameCount * mChannelCount;
     const int mCaptureSize;
     const int mLatency;
@@ -161,7 +166,7 @@
     void CleanUp() { mCommonTags.clear(); }
 };
 
-class VisualizerParamTest : public ::testing::TestWithParam<VisualizerParamTestParam>,
+class VisualizerParamTest : public ::testing::TestWithParam<VisualizerTestParam>,
                             public VisualizerTestHelper {
   public:
     VisualizerParamTest()
@@ -181,11 +186,6 @@
         return {ndk::enum_range<Visualizer::MeasurementMode>().begin(),
                 ndk::enum_range<Visualizer::MeasurementMode>().end()};
     }
-
-    static std::unordered_set<Visualizer::ScalingMode> getScalingModeValues() {
-        return {ndk::enum_range<Visualizer::ScalingMode>().begin(),
-                ndk::enum_range<Visualizer::ScalingMode>().end()};
-    }
 };
 
 TEST_P(VisualizerParamTest, SetAndGetCaptureSize) {
@@ -237,6 +237,82 @@
     }
 }
 
+class VisualizerDataTest : public ::testing::TestWithParam<VisualizerTestParam>,
+                           public VisualizerTestHelper {
+  public:
+    VisualizerDataTest()
+        : VisualizerTestHelper(std::get<PARAM_INSTANCE_NAME>(GetParam()),
+                               std::get<PARAM_CAPTURE_SIZE>(GetParam()),
+                               std::get<PARAM_LATENCY>(GetParam()),
+                               std::get<PARAM_SCALING_MODE>(GetParam()),
+                               std::get<PARAM_MEASUREMENT_MODE>(GetParam())) {}
+
+    void SetUp() override { SetUpVisualizer(); }
+
+    void TearDown() override { TearDownVisualizer(); }
+};
+
+TEST_P(VisualizerDataTest, testScalingModeParameters) {
+    SKIP_TEST_IF_DATA_UNSUPPORTED(mDescriptor.common.flags);
+
+    // This test holds true for the following range
+    static_assert(kMaxAudioSampleValue <= 1.0 && kMaxAudioSampleValue > 0.0,
+                  "Valid range of kMaxAudioSample value for the test: (0.0, 1.0]");
+
+    constexpr float kPowerToleranceDb = 0.5;
+
+    generateSineWave(std::vector<int>{1000}, mInputBuffer, 1.0, mBufferSizeInFrames);
+    const float expectedPowerNormalized = audio_utils_compute_power_mono(
+            mInputBuffer.data(), AUDIO_FORMAT_PCM_FLOAT, mInputBuffer.size());
+
+    const std::vector<float> testMaxAudioSampleValueList = {
+            0.25 * kMaxAudioSampleValue, 0.5 * kMaxAudioSampleValue, 0.75 * kMaxAudioSampleValue,
+            kMaxAudioSampleValue};
+
+    Parameter::Id idCsb;
+    Visualizer::Id vsIdCsb;
+    vsIdCsb.set<Visualizer::Id::commonTag>(Visualizer::captureSampleBuffer);
+    idCsb.set<Parameter::Id::visualizerTag>(vsIdCsb);
+
+    for (float maxAudioSampleValue : testMaxAudioSampleValueList) {
+        bool allParamsValid = true;
+        ASSERT_NO_FATAL_FAILURE(addCaptureSizeParam(mCaptureSize));
+        ASSERT_NO_FATAL_FAILURE(addScalingModeParam(mScalingMode));
+        ASSERT_NO_FATAL_FAILURE(addLatencyParam(mLatency));
+        ASSERT_NO_FATAL_FAILURE(SetAndGetParameters(&allParamsValid));
+
+        generateSineWave(std::vector<int>{1000}, mInputBuffer, maxAudioSampleValue,
+                         mBufferSizeInFrames);
+
+        // The stop and reset calls to the effect are made towards the end in order to fetch the
+        // captureSampleBuffer values
+        ASSERT_NO_FATAL_FAILURE(processAndWriteToOutput(mInputBuffer, mOutputBuffer, mEffect,
+                                                        &mOpenEffectReturn, mVersion, 1, false));
+        if (allParamsValid) {
+            Parameter getParam;
+            EXPECT_STATUS(EX_NONE, mEffect->getParameter(idCsb, &getParam))
+                    << " with: " << idCsb.toString();
+            std::vector<uint8_t> captureBuffer = getParam.get<Parameter::specific>()
+                                                         .get<Parameter::Specific::visualizer>()
+                                                         .get<Visualizer::captureSampleBuffer>();
+            ASSERT_EQ((size_t)mCaptureSize, captureBuffer.size());
+
+            float currPowerCsb = audio_utils_compute_power_mono(
+                    captureBuffer.data(), AUDIO_FORMAT_PCM_8_BIT, mCaptureSize);
+
+            if (mScalingMode == Visualizer::ScalingMode::NORMALIZED) {
+                EXPECT_NEAR(currPowerCsb, expectedPowerNormalized, kPowerToleranceDb);
+            } else {
+                float powerI = audio_utils_compute_power_mono(
+                        mInputBuffer.data(), AUDIO_FORMAT_PCM_FLOAT, mInputBuffer.size());
+                EXPECT_NEAR(currPowerCsb, powerI, kPowerToleranceDb);
+            }
+        }
+        ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
+        ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::RESET));
+    }
+}
+
 std::vector<std::pair<std::shared_ptr<IFactory>, Descriptor>> kDescPair;
 INSTANTIATE_TEST_SUITE_P(
         VisualizerParamTest, VisualizerParamTest,
@@ -246,7 +322,7 @@
                 testing::ValuesIn(EffectHelper::getTestValueSet<Visualizer, int, Range::visualizer,
                                                                 Visualizer::captureSamples>(
                         kDescPair, EffectHelper::expandTestValueBasic<int>)),
-                testing::ValuesIn(VisualizerParamTest::getScalingModeValues()),
+                testing::ValuesIn(VisualizerTestHelper::getScalingModeValues()),
                 testing::ValuesIn(VisualizerParamTest::getMeasurementModeValues()),
                 testing::ValuesIn(EffectHelper::getTestValueSet<Visualizer, int, Range::visualizer,
                                                                 Visualizer::latencyMs>(
@@ -270,6 +346,35 @@
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(VisualizerParamTest);
 
+INSTANTIATE_TEST_SUITE_P(
+        VisualizerDataTest, VisualizerDataTest,
+        ::testing::Combine(
+                testing::ValuesIn(kDescPair = EffectFactoryHelper::getAllEffectDescriptors(
+                                          IFactory::descriptor, getEffectTypeUuidVisualizer())),
+                testing::Values(128),  // captureSize
+                testing::ValuesIn(VisualizerTestHelper::getScalingModeValues()),
+                testing::Values(Visualizer::MeasurementMode::PEAK_RMS),
+                testing::Values(0)  // latency
+                ),
+        [](const testing::TestParamInfo<VisualizerDataTest::ParamType>& info) {
+            auto descriptor = std::get<PARAM_INSTANCE_NAME>(info.param).second;
+            std::string captureSize = std::to_string(std::get<PARAM_CAPTURE_SIZE>(info.param));
+            std::string scalingMode = aidl::android::hardware::audio::effect::toString(
+                    std::get<PARAM_SCALING_MODE>(info.param));
+            std::string measurementMode = aidl::android::hardware::audio::effect::toString(
+                    std::get<PARAM_MEASUREMENT_MODE>(info.param));
+            std::string latency = std::to_string(std::get<PARAM_LATENCY>(info.param));
+
+            std::string name = getPrefix(descriptor) + "_captureSize" + captureSize +
+                               "_scalingMode" + scalingMode + "_measurementMode" + measurementMode +
+                               "_latency" + latency;
+            std::replace_if(
+                    name.begin(), name.end(), [](const char c) { return !std::isalnum(c); }, '_');
+            return name;
+        });
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(VisualizerDataTest);
+
 int main(int argc, char** argv) {
     ::testing::InitGoogleTest(&argc, argv);
     ::testing::UnitTest::GetInstance()->listeners().Append(new TestExecutionTracer());
diff --git a/authsecret/1.0/vts/functional/Android.bp b/authsecret/1.0/vts/functional/Android.bp
index 853b4dd..388cf3c 100644
--- a/authsecret/1.0/vts/functional/Android.bp
+++ b/authsecret/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/authsecret/aidl/vts/Android.bp b/authsecret/aidl/vts/Android.bp
index 5ec9947..bde1a40 100644
--- a/authsecret/aidl/vts/Android.bp
+++ b/authsecret/aidl/vts/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/automotive/can/1.0/default/libnetdevice/Android.bp b/automotive/can/1.0/default/libnetdevice/Android.bp
index 653e773..b42893e 100644
--- a/automotive/can/1.0/default/libnetdevice/Android.bp
+++ b/automotive/can/1.0/default/libnetdevice/Android.bp
@@ -23,10 +23,19 @@
     default_applicable_licenses: ["hardware_interfaces_license"],
 }
 
-cc_library_static {
-    name: "android.hardware.automotive.can@libnetdevice",
-    defaults: ["android.hardware.automotive.can@defaults"],
+cc_defaults {
+    name: "libnetdevice-common",
     vendor_available: true,
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-DANDROID_BASE_UNIQUE_FD_DISABLE_IMPLICIT_CONVERSION",
+    ],
+    shared_libs: [
+        "libbase",
+        "libutils",
+    ],
     srcs: [
         "can.cpp",
         "common.cpp",
@@ -40,3 +49,14 @@
         "libnl++",
     ],
 }
+
+// TODO: migrate to "libnetdevice" and remove
+cc_library_static {
+    name: "android.hardware.automotive.can@libnetdevice",
+    defaults: ["libnetdevice-common"],
+}
+
+cc_library_static {
+    name: "libnetdevice",
+    defaults: ["libnetdevice-common"],
+}
diff --git a/automotive/can/1.0/default/libnl++/Android.bp b/automotive/can/1.0/default/libnl++/Android.bp
index 01c1e55..d929d84 100644
--- a/automotive/can/1.0/default/libnl++/Android.bp
+++ b/automotive/can/1.0/default/libnl++/Android.bp
@@ -25,8 +25,17 @@
 
 cc_library_static {
     name: "libnl++",
-    defaults: ["android.hardware.automotive.can@defaults"],
     vendor_available: true,
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-DANDROID_BASE_UNIQUE_FD_DISABLE_IMPLICIT_CONVERSION",
+    ],
+    shared_libs: [
+        "libbase",
+        "libutils",
+    ],
     srcs: [
         "protocols/common/Empty.cpp",
         "protocols/common/Error.cpp",
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
index 60c276b..93c3d8c 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
@@ -59,8 +59,10 @@
     int bitmask;
     const int US7500 = 0x01;
     const int US10000 = 0x02;
+    const int US20000 = 0x04;
     const int US7500PREFERRED = 0x10;
     const int US10000PREFERRED = 0x20;
+    const int US20000PREFERRED = 0x40;
   }
   parcelable SupportedAudioChannelCounts {
     int bitmask;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
index 943d396..be79b0d 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
@@ -59,6 +59,7 @@
   enum FrameDuration {
     US7500 = 0x00,
     US10000 = 0x01,
+    US20000 = 0x02,
   }
   parcelable AudioChannelAllocation {
     int bitmask;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
index 031ee67..0613f6c 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
@@ -37,6 +37,7 @@
   android.hardware.bluetooth.audio.Lc3Configuration lc3Config;
   android.hardware.bluetooth.audio.LeAudioCodecConfiguration.VendorConfiguration vendorConfig;
   android.hardware.bluetooth.audio.AptxAdaptiveLeConfiguration aptxAdaptiveLeConfig;
+  android.hardware.bluetooth.audio.OpusConfiguration opusConfig;
   @VintfStability
   parcelable VendorConfiguration {
     ParcelableHolder extension;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
index 894a2f3..481e2ac 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -48,5 +48,6 @@
     android.hardware.bluetooth.audio.Lc3Capabilities lc3Capabilities;
     android.hardware.bluetooth.audio.UnicastCapability.VendorCapabilities vendorCapabillities;
     android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities aptxAdaptiveLeCapabilities;
+    android.hardware.bluetooth.audio.OpusCapabilities opusCapabilities;
   }
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
index fa302e3..94f0544 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificCapabilitiesLtv.aidl
@@ -50,9 +50,11 @@
     parcelable SupportedFrameDurations {
         const int US7500 = 0x01;
         const int US10000 = 0x02;
+        const int US20000 = 0x04;
         /* Bits 2-3 are RFU */
         const int US7500PREFERRED = 0x10;
         const int US10000PREFERRED = 0x20;
+        const int US20000PREFERRED = 0x40;
 
         /* 8 bit wide bit mask */
         int bitmask;
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
index c099ebe..5e32e5e 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecSpecificConfigurationLtv.aidl
@@ -43,6 +43,7 @@
     enum FrameDuration {
         US7500 = 0x00,
         US10000 = 0x01,
+        US20000 = 0x02,
     }
 
     parcelable AudioChannelAllocation {
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
index 7ce6ff3..20e6c0c 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
@@ -16,8 +16,9 @@
 
 package android.hardware.bluetooth.audio;
 
-import android.hardware.bluetooth.audio.Lc3Configuration;
 import android.hardware.bluetooth.audio.AptxAdaptiveLeConfiguration;
+import android.hardware.bluetooth.audio.Lc3Configuration;
+import android.hardware.bluetooth.audio.OpusConfiguration;
 
 @VintfStability
 union LeAudioCodecConfiguration {
@@ -28,4 +29,5 @@
     Lc3Configuration lc3Config;
     VendorConfiguration vendorConfig;
     AptxAdaptiveLeConfiguration aptxAdaptiveLeConfig;
+    OpusConfiguration opusConfig;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
index 07688a7..8583221 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -16,10 +16,11 @@
 
 package android.hardware.bluetooth.audio;
 
+import android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities;
 import android.hardware.bluetooth.audio.AudioLocation;
 import android.hardware.bluetooth.audio.CodecType;
 import android.hardware.bluetooth.audio.Lc3Capabilities;
-import android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities;
+import android.hardware.bluetooth.audio.OpusCapabilities;
 
 /**
  * Used to specify the le audio unicast codec capabilities for hardware offload.
@@ -35,6 +36,7 @@
         Lc3Capabilities lc3Capabilities;
         VendorCapabilities vendorCapabillities;
         AptxAdaptiveLeCapabilities aptxAdaptiveLeCapabilities;
+        OpusCapabilities opusCapabilities;
     }
     CodecType codecType;
     AudioLocation supportedChannel;
diff --git a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
index 61c29d3..a10e0a6 100644
--- a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
@@ -82,6 +82,8 @@
          CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US7500},
         {CodecSpecificConfigurationLtv::FrameDuration::US10000,
          CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US10000},
+        {CodecSpecificConfigurationLtv::FrameDuration::US20000,
+         CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US20000},
 };
 
 std::map<int32_t, CodecSpecificConfigurationLtv::SamplingFrequency>
@@ -768,7 +770,7 @@
   // A setting must match both source and sink.
   // First filter all setting matched with sink capability
   if (in_remoteSinkAudioCapabilities.has_value()) {
-    for (auto& setting : ase_configuration_settings)
+    for (auto& setting : ase_configuration_settings) {
       for (auto& capability : in_remoteSinkAudioCapabilities.value()) {
         if (!capability.has_value()) continue;
         auto filtered_ase_configuration_setting =
@@ -779,6 +781,7 @@
               filtered_ase_configuration_setting.value());
         }
       }
+    }
   } else {
     sink_matched_ase_configuration_settings = ase_configuration_settings;
   }
@@ -809,7 +812,6 @@
     // Matching priority list:
     // Preferred context - exact match with allocation
     // Any context - exact match with allocation
-
     auto matched_setting_with_context = matchWithRequirement(
         matched_ase_configuration_settings, requirement, true);
     if (matched_setting_with_context.has_value()) {
diff --git a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
index 4481238..a52d761 100644
--- a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
+++ b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
@@ -2375,6 +2375,43 @@
     return capability;
   }
 
+  LeAudioDeviceCapabilities GetOpusRemoteSinkCapability() {
+    // Create a capability specifically for vendor OPUS
+    LeAudioDeviceCapabilities capability;
+
+    auto vendor_codec = CodecId::Vendor();
+    vendor_codec.codecId = 255;
+    vendor_codec.id = 224;
+    capability.codecId = vendor_codec;
+
+    auto pref_context_metadata = MetadataLtv::PreferredAudioContexts();
+    pref_context_metadata.values =
+        GetAudioContext(AudioContext::MEDIA | AudioContext::CONVERSATIONAL |
+                        AudioContext::GAME);
+    capability.metadata = {pref_context_metadata};
+
+    auto sampling_rate =
+        CodecSpecificCapabilitiesLtv::SupportedSamplingFrequencies();
+    sampling_rate.bitmask =
+        CodecSpecificCapabilitiesLtv::SupportedSamplingFrequencies::HZ16000 |
+        CodecSpecificCapabilitiesLtv::SupportedSamplingFrequencies::HZ8000 |
+        CodecSpecificCapabilitiesLtv::SupportedSamplingFrequencies::HZ48000;
+    auto frame_duration =
+        CodecSpecificCapabilitiesLtv::SupportedFrameDurations();
+    frame_duration.bitmask =
+        CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US7500 |
+        CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US10000 |
+        CodecSpecificCapabilitiesLtv::SupportedFrameDurations::US20000;
+    auto octets = CodecSpecificCapabilitiesLtv::SupportedOctetsPerCodecFrame();
+    octets.min = 0;
+    octets.max = 240;
+    auto frames = CodecSpecificCapabilitiesLtv::SupportedMaxCodecFramesPerSDU();
+    frames.value = 2;
+    capability.codecSpecificCapabilities = {sampling_rate, frame_duration,
+                                            octets, frames};
+    return capability;
+  }
+
   LeAudioDeviceCapabilities GetDefaultRemoteSourceCapability() {
     // Create a capability
     LeAudioDeviceCapabilities capability;
@@ -2745,6 +2782,41 @@
     return requirement;
   }
 
+  LeAudioConfigurationRequirement GetOpusUnicastRequirement(
+      int32_t context_bits, bool is_sink_requirement,
+      bool is_source_requriement,
+      CodecSpecificConfigurationLtv::SamplingFrequency freq =
+          CodecSpecificConfigurationLtv::SamplingFrequency::HZ48000) {
+    // Create a requirements
+    LeAudioConfigurationRequirement requirement;
+    requirement.audioContext = GetAudioContext(context_bits);
+
+    auto allocation = CodecSpecificConfigurationLtv::AudioChannelAllocation();
+    allocation.bitmask =
+        CodecSpecificConfigurationLtv::AudioChannelAllocation::FRONT_LEFT |
+        CodecSpecificConfigurationLtv::AudioChannelAllocation::FRONT_RIGHT;
+
+    auto direction_ase_requriement = AseDirectionRequirement();
+    auto vendor_codec = CodecId::Vendor();
+    vendor_codec.codecId = 255;
+    vendor_codec.id = 224;
+    direction_ase_requriement.aseConfiguration.codecId = vendor_codec;
+    direction_ase_requriement.aseConfiguration.targetLatency =
+        LeAudioAseConfiguration::TargetLatency::HIGHER_RELIABILITY;
+
+    direction_ase_requriement.aseConfiguration.codecConfiguration = {
+        freq, CodecSpecificConfigurationLtv::FrameDuration::US20000, allocation
+
+    };
+    if (is_sink_requirement)
+      requirement.sinkAseRequirement = {direction_ase_requriement};
+
+    if (is_source_requriement)
+      requirement.sourceAseRequirement = {direction_ase_requriement};
+
+    return requirement;
+  }
+
   LeAudioConfigurationRequirement GetUnicastGameRequirement(bool asymmetric) {
     // Create a requirements
     LeAudioConfigurationRequirement requirement;
@@ -3172,6 +3244,31 @@
 }
 
 TEST_P(BluetoothAudioProviderLeAudioOutputHardwareAidl,
+       GetOpusAseConfiguration) {
+  if (GetProviderFactoryInterfaceVersion() <
+      BluetoothAudioHalVersion::VERSION_AIDL_V4) {
+    GTEST_SKIP();
+  }
+
+  std::vector<std::optional<LeAudioDeviceCapabilities>> sink_capabilities = {
+      GetOpusRemoteSinkCapability()};
+  std::vector<std::optional<LeAudioDeviceCapabilities>> source_capabilities = {
+      GetDefaultRemoteSourceCapability()};
+
+  std::vector<LeAudioAseConfigurationSetting> configurations;
+  std::vector<LeAudioConfigurationRequirement> sink_requirements = {
+      GetOpusUnicastRequirement(AudioContext::MEDIA, true /* sink */,
+                                false /* source */)};
+  auto aidl_retval = audio_provider_->getLeAudioAseConfiguration(
+      sink_capabilities, std::nullopt, sink_requirements, &configurations);
+
+  ASSERT_TRUE(aidl_retval.isOk());
+  if (!configurations.empty()) {
+    VerifyIfRequirementsSatisfied(sink_requirements, configurations);
+  }
+}
+
+TEST_P(BluetoothAudioProviderLeAudioOutputHardwareAidl,
        GetAseConfiguration_Multidirectional) {
   if (GetProviderFactoryInterfaceVersion() <
       BluetoothAudioHalVersion::VERSION_AIDL_V4) {
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
index 37812fa..8475d39 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioAseConfigurationSettingProvider.cpp
@@ -92,6 +92,7 @@
 /* Frame Durations */
 constexpr uint8_t kLeAudioCodecFrameDur7500us = 0x00;
 constexpr uint8_t kLeAudioCodecFrameDur10000us = 0x01;
+constexpr uint8_t kLeAudioCodecFrameDur20000us = 0x02;
 
 /* Audio Allocations */
 constexpr uint32_t kLeAudioLocationNotAllowed = 0x00000000;
@@ -171,7 +172,9 @@
         {kLeAudioCodecFrameDur7500us,
          CodecSpecificConfigurationLtv::FrameDuration::US7500},
         {kLeAudioCodecFrameDur10000us,
-         CodecSpecificConfigurationLtv::FrameDuration::US10000}};
+         CodecSpecificConfigurationLtv::FrameDuration::US10000},
+        {kLeAudioCodecFrameDur20000us,
+         CodecSpecificConfigurationLtv::FrameDuration::US20000}};
 
 /* Helper map for matching various audio channel allocation notations */
 std::map<uint32_t, uint32_t> audio_channel_allocation_map = {
@@ -487,6 +490,9 @@
       case CodecSpecificConfigurationLtv::FrameDuration::US10000:
         qos.sduIntervalUs = 10000;
         break;
+      case CodecSpecificConfigurationLtv::FrameDuration::US20000:
+        qos.sduIntervalUs = 20000;
+        break;
     }
     qos.sduIntervalUs *= frameBlockValue;
   }
diff --git a/bluetooth/audio/utils/le_audio_configuration_set/audio_set_configurations.json b/bluetooth/audio/utils/le_audio_configuration_set/audio_set_configurations.json
index fbfa3f9..88e9ce4 100644
--- a/bluetooth/audio/utils/le_audio_configuration_set/audio_set_configurations.json
+++ b/bluetooth/audio/utils/le_audio_configuration_set/audio_set_configurations.json
@@ -18,6 +18,7 @@
     " Example values which can be used as 'codec_configuration.compound_value'",
     "   Codec Coding formats:",
     "     LC3 = 6",
+    "     OPUS = 225",
     "   Sampling Frequencies: ",
     "     8000Hz = 1",
     "     11025Hz = 2",
@@ -34,7 +35,8 @@
     "     384000Hz = 13",
     "   Frame Durations:",
     "     7500us = 0",
-    "     10000us = 1"
+    "     10000us = 1",
+    "     20000us = 2"
   ],
   "configurations": [
     {
diff --git a/bluetooth/ranging/aidl/vts/Android.bp b/bluetooth/ranging/aidl/vts/Android.bp
index 9984ce8..bcae5d0 100644
--- a/bluetooth/ranging/aidl/vts/Android.bp
+++ b/bluetooth/ranging/aidl/vts/Android.bp
@@ -17,7 +17,7 @@
         "libutils",
     ],
     static_libs: [
-        "android.hardware.bluetooth.ranging-V1-ndk",
+        "android.hardware.bluetooth.ranging-V2-ndk",
         "libbluetooth-types",
     ],
     test_config: "VtsHalBluetoothRangingTargetTest.xml",
diff --git a/bluetooth/ranging/aidl/vts/VtsHalBluetoothRangingTargetTest.cpp b/bluetooth/ranging/aidl/vts/VtsHalBluetoothRangingTargetTest.cpp
index 702df95..4510f24 100644
--- a/bluetooth/ranging/aidl/vts/VtsHalBluetoothRangingTargetTest.cpp
+++ b/bluetooth/ranging/aidl/vts/VtsHalBluetoothRangingTargetTest.cpp
@@ -30,12 +30,15 @@
 using aidl::android::hardware::bluetooth::ranging::
     BnBluetoothChannelSoundingSessionCallback;
 using aidl::android::hardware::bluetooth::ranging::ChannelSoudingRawData;
+using aidl::android::hardware::bluetooth::ranging::ChannelSoundingProcedureData;
+using aidl::android::hardware::bluetooth::ranging::Config;
 using aidl::android::hardware::bluetooth::ranging::CsSecurityLevel;
 using aidl::android::hardware::bluetooth::ranging::IBluetoothChannelSounding;
 using aidl::android::hardware::bluetooth::ranging::
     IBluetoothChannelSoundingSession;
 using aidl::android::hardware::bluetooth::ranging::
     IBluetoothChannelSoundingSessionCallback;
+using aidl::android::hardware::bluetooth::ranging::ProcedureEnableConfig;
 using aidl::android::hardware::bluetooth::ranging::RangingResult;
 using aidl::android::hardware::bluetooth::ranging::Reason;
 using aidl::android::hardware::bluetooth::ranging::ResultType;
@@ -43,6 +46,12 @@
 using aidl::android::hardware::bluetooth::ranging::VendorSpecificData;
 using ndk::ScopedAStatus;
 
+enum class RangingHalVersion : uint8_t {
+  V_UNAVAILABLE = 0,
+  V_1,
+  V_2,
+};
+
 class BluetoothChannelSoundingSessionCallback
     : public BnBluetoothChannelSoundingSessionCallback {
  public:
@@ -80,6 +89,8 @@
     ALOGI("SetUp Ranging Test");
     bluetooth_channel_sounding_ = IBluetoothChannelSounding::fromBinder(
         ndk::SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    hal_version_ = GetRangingHalVersion();
+    ASSERT_GT(hal_version_, RangingHalVersion::V_UNAVAILABLE);
     ASSERT_NE(bluetooth_channel_sounding_, nullptr);
   }
 
@@ -95,6 +106,8 @@
   ScopedAStatus getSupportedSessionTypes(
       std::optional<std::vector<SessionType>>* _aidl_return);
   ScopedAStatus getMaxSupportedCsSecurityLevel(CsSecurityLevel* _aidl_return);
+  ScopedAStatus getSupportedCsSecurityLevels(
+      std::vector<CsSecurityLevel>* _aidl_return);
   ScopedAStatus openSession(
       const BluetoothChannelSoundingParameters& in_params,
       const std::shared_ptr<IBluetoothChannelSoundingSessionCallback>&
@@ -111,6 +124,30 @@
     return status;
   }
 
+  RangingHalVersion GetRangingHalVersion() {
+    int32_t aidl_version = 0;
+    if (bluetooth_channel_sounding_ == nullptr) {
+      return RangingHalVersion::V_UNAVAILABLE;
+    }
+    auto aidl_ret_val =
+        bluetooth_channel_sounding_->getInterfaceVersion(&aidl_version);
+    if (!aidl_ret_val.isOk()) {
+      return RangingHalVersion::V_UNAVAILABLE;
+    }
+    switch (aidl_version) {
+      case 1:
+        return RangingHalVersion::V_1;
+      case 2:
+        return RangingHalVersion::V_2;
+      default:
+        return RangingHalVersion::V_UNAVAILABLE;
+    }
+    return RangingHalVersion::V_UNAVAILABLE;
+  }
+
+ public:
+  RangingHalVersion hal_version_ = RangingHalVersion::V_UNAVAILABLE;
+
  private:
   std::shared_ptr<IBluetoothChannelSounding> bluetooth_channel_sounding_;
 };
@@ -130,6 +167,13 @@
   return bluetooth_channel_sounding_->getMaxSupportedCsSecurityLevel(
       _aidl_return);
 }
+
+ScopedAStatus BluetoothRangingTest::getSupportedCsSecurityLevels(
+    std::vector<CsSecurityLevel>* _aidl_return) {
+  return bluetooth_channel_sounding_->getSupportedCsSecurityLevels(
+      _aidl_return);
+}
+
 ScopedAStatus BluetoothRangingTest::openSession(
     const BluetoothChannelSoundingParameters& in_params,
     const std::shared_ptr<IBluetoothChannelSoundingSessionCallback>&
@@ -155,11 +199,25 @@
 }
 
 TEST_P(BluetoothRangingTest, GetMaxSupportedCsSecurityLevel) {
+  if (hal_version_ > RangingHalVersion::V_1) {
+    GTEST_SKIP();
+  }
   CsSecurityLevel security_level;
   ScopedAStatus status = getMaxSupportedCsSecurityLevel(&security_level);
   ASSERT_TRUE(status.isOk());
 }
 
+TEST_P(BluetoothRangingTest, GetSupportedCsSecurityLevels) {
+  if (hal_version_ < RangingHalVersion::V_2) {
+    GTEST_SKIP();
+  }
+  std::vector<CsSecurityLevel> supported_security_levels;
+  ScopedAStatus status =
+      getSupportedCsSecurityLevels(&supported_security_levels);
+  ASSERT_GT(static_cast<uint8_t>(supported_security_levels.size()), 0);
+  ASSERT_TRUE(status.isOk());
+}
+
 TEST_P(BluetoothRangingTest, OpenSession) {
   BluetoothChannelSoundingParameters params;
   std::shared_ptr<BluetoothChannelSoundingSessionCallback> callback = nullptr;
@@ -205,6 +263,9 @@
 }
 
 TEST_P(BluetoothRangingTest, WriteRawData) {
+  if (hal_version_ > RangingHalVersion::V_1) {
+    GTEST_SKIP();
+  }
   std::shared_ptr<IBluetoothChannelSoundingSession> session;
   auto status = initBluetoothChannelSoundingSession(&session);
   ASSERT_TRUE(status.isOk());
@@ -215,6 +276,62 @@
   }
 }
 
+TEST_P(BluetoothRangingTest, WriteProcedureData) {
+  if (hal_version_ < RangingHalVersion::V_2) {
+    GTEST_SKIP();
+  }
+  std::shared_ptr<IBluetoothChannelSoundingSession> session;
+  auto status = initBluetoothChannelSoundingSession(&session);
+  ASSERT_TRUE(status.isOk());
+  if (session != nullptr) {
+    ChannelSoundingProcedureData procedure_data;
+    status = session->writeProcedureData(procedure_data);
+    ASSERT_TRUE(status.isOk());
+  }
+}
+
+TEST_P(BluetoothRangingTest, UpdateChannelSoundingConfig) {
+  if (hal_version_ < RangingHalVersion::V_2) {
+    GTEST_SKIP();
+  }
+  std::shared_ptr<IBluetoothChannelSoundingSession> session;
+  auto status = initBluetoothChannelSoundingSession(&session);
+  ASSERT_TRUE(status.isOk());
+  if (session != nullptr) {
+    Config config;
+    status = session->updateChannelSoundingConfig(config);
+    ASSERT_TRUE(status.isOk());
+  }
+}
+
+TEST_P(BluetoothRangingTest, UpdateProcedureEnableConfig) {
+  if (hal_version_ < RangingHalVersion::V_2) {
+    GTEST_SKIP();
+  }
+  std::shared_ptr<IBluetoothChannelSoundingSession> session;
+  auto status = initBluetoothChannelSoundingSession(&session);
+  ASSERT_TRUE(status.isOk());
+  if (session != nullptr) {
+    ProcedureEnableConfig procedure_enable_config;
+    status = session->updateProcedureEnableConfig(procedure_enable_config);
+    ASSERT_TRUE(status.isOk());
+  }
+}
+
+TEST_P(BluetoothRangingTest, UpdateBleConnInterval) {
+  if (hal_version_ < RangingHalVersion::V_2) {
+    GTEST_SKIP();
+  }
+  std::shared_ptr<IBluetoothChannelSoundingSession> session;
+  auto status = initBluetoothChannelSoundingSession(&session);
+  ASSERT_TRUE(status.isOk());
+  if (session != nullptr) {
+    int ble_conn_interval = 10;
+    status = session->updateBleConnInterval(ble_conn_interval);
+    ASSERT_TRUE(status.isOk());
+  }
+}
+
 TEST_P(BluetoothRangingTest, CloseSession) {
   std::shared_ptr<IBluetoothChannelSoundingSession> session;
   auto status = initBluetoothChannelSoundingSession(&session);
diff --git a/common/aidl/Android.bp b/common/aidl/Android.bp
index 904a3d9..0ce52e7 100644
--- a/common/aidl/Android.bp
+++ b/common/aidl/Android.bp
@@ -26,7 +26,7 @@
             ],
         },
         cpp: {
-            enabled: false,
+            enabled: true,
         },
         ndk: {
             apex_available: [
diff --git a/common/fmq/aidl/Android.bp b/common/fmq/aidl/Android.bp
index 4a3658e..7fb6368 100644
--- a/common/fmq/aidl/Android.bp
+++ b/common/fmq/aidl/Android.bp
@@ -28,9 +28,8 @@
             sdk_version: "module_current",
         },
         cpp: {
-            // FMQ will not be supported in the cpp backend because the parcelables
-            // are not stable enough for use in shared memory
-            enabled: false,
+            // FMQ is only supported for PODs with the cpp backend
+            enabled: true,
         },
         ndk: {
             apex_available: [
diff --git a/compatibility_matrices/compatibility_matrix.202504.xml b/compatibility_matrices/compatibility_matrix.202504.xml
index 860552a..4b762ca 100644
--- a/compatibility_matrices/compatibility_matrix.202504.xml
+++ b/compatibility_matrices/compatibility_matrix.202504.xml
@@ -515,6 +515,14 @@
             <instance>nonsecure</instance>
         </interface>
     </hal>
+    <hal format="aidl">
+        <name>android.hardware.security.see.hwcrypto</name>
+        <version>1</version>
+        <interface>
+            <name>IHwCryptoKey</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="aidl" updatable-via-apex="true">
         <name>android.hardware.security.secureclock</name>
         <version>1</version>
diff --git a/compatibility_matrices/exclude/fcm_exclude.cpp b/compatibility_matrices/exclude/fcm_exclude.cpp
index b86f399..61fb2b3 100644
--- a/compatibility_matrices/exclude/fcm_exclude.cpp
+++ b/compatibility_matrices/exclude/fcm_exclude.cpp
@@ -156,6 +156,8 @@
             // Fastboot HAL is only used by recovery. Recovery is owned by OEM. Framework
             // does not depend on this HAL, hence it is not declared in any manifests or matrices.
             "android.hardware.fastboot@",
+            "android.hardware.security.see.hwcrypto.types",
+            "android.hardware.security.see.storage",
     };
 
     static std::vector<std::string> excluded_exact{
@@ -165,6 +167,8 @@
             "android.hardware.audio.core.sounddose@1",
             "android.hardware.audio.core.sounddose@2",
             "android.hardware.audio.core.sounddose@3",
+            // This is only used by a trusty VM
+            "android.hardware.security.see.authmgr@1",
 
             // Deprecated HALs.
             "android.hardware.audio.sounddose@3",
diff --git a/drm/aidl/vts/drm_hal_common.cpp b/drm/aidl/vts/drm_hal_common.cpp
index f0445a5..3636250 100644
--- a/drm/aidl/vts/drm_hal_common.cpp
+++ b/drm/aidl/vts/drm_hal_common.cpp
@@ -27,6 +27,7 @@
 #include <android/binder_process.h>
 #include <android/sharedmem.h>
 #include <cutils/native_handle.h>
+#include <cutils/properties.h>
 
 #include "drm_hal_clearkey_module.h"
 #include "drm_hal_common.h"
@@ -193,6 +194,13 @@
         GTEST_SKIP() << "No vendor module installed";
     }
 
+    char bootloader_state[PROPERTY_VALUE_MAX] = {};
+    if (property_get("ro.boot.vbmeta.device_state", bootloader_state, "") != 0) {
+        if (!strcmp(bootloader_state, "unlocked")) {
+            GTEST_SKIP() << "Skip test because bootloader is unlocked";
+        }
+    }
+
     if (drmInstance.find("IDrmFactory") != std::string::npos) {
         drmFactory = IDrmFactory::fromBinder(
                 ::ndk::SpAIBinder(AServiceManager_waitForService(drmInstance.c_str())));
diff --git a/graphics/composer/aidl/vts/RenderEngineVts.h b/graphics/composer/aidl/vts/RenderEngineVts.h
index bbe508f..6553720 100644
--- a/graphics/composer/aidl/vts/RenderEngineVts.h
+++ b/graphics/composer/aidl/vts/RenderEngineVts.h
@@ -51,9 +51,10 @@
 
   private:
     common::PixelFormat mFormat;
-    std::vector<::android::renderengine::LayerSettings> mCompositionLayers;
     std::unique_ptr<::android::renderengine::RenderEngine> mRenderEngine;
-    std::vector<::android::renderengine::LayerSettings> mRenderLayers;
+    // Delete RenderEngine layers before RenderEngine -- ExternalTexture holds a reference to
+    // RenderEngine.
+    std::vector<::android::renderengine::LayerSettings> mCompositionLayers;
     ::android::sp<::android::GraphicBuffer> mGraphicBuffer;
 
     DisplaySettings mDisplaySettings;
diff --git a/light/2.0/vts/functional/Android.bp b/light/2.0/vts/functional/Android.bp
index 91fb847..53e5446 100644
--- a/light/2.0/vts/functional/Android.bp
+++ b/light/2.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/light/aidl/vts/functional/Android.bp b/light/aidl/vts/functional/Android.bp
index 16804ea..ba05e2b 100644
--- a/light/aidl/vts/functional/Android.bp
+++ b/light/aidl/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/neuralnetworks/1.0/vts/functional/Android.bp b/neuralnetworks/1.0/vts/functional/Android.bp
index 8048e62..ed0e72b 100644
--- a/neuralnetworks/1.0/vts/functional/Android.bp
+++ b/neuralnetworks/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/neuralnetworks/1.1/vts/functional/Android.bp b/neuralnetworks/1.1/vts/functional/Android.bp
index 7c1c118..e65735f 100644
--- a/neuralnetworks/1.1/vts/functional/Android.bp
+++ b/neuralnetworks/1.1/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/neuralnetworks/1.2/vts/functional/Android.bp b/neuralnetworks/1.2/vts/functional/Android.bp
index 7e4b5bb..0a3c577 100644
--- a/neuralnetworks/1.2/vts/functional/Android.bp
+++ b/neuralnetworks/1.2/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/neuralnetworks/aidl/vts/functional/Android.bp b/neuralnetworks/aidl/vts/functional/Android.bp
index 04b4a45..20686c1 100644
--- a/neuralnetworks/aidl/vts/functional/Android.bp
+++ b/neuralnetworks/aidl/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/nfc/aidl/Android.bp b/nfc/aidl/Android.bp
index b34e4f2..1ffd274 100644
--- a/nfc/aidl/Android.bp
+++ b/nfc/aidl/Android.bp
@@ -33,8 +33,9 @@
             enabled: false,
         },
         java: {
-            sdk_version: "module_current",
             enabled: false,
+            sdk_version: "module_current",
+            min_sdk_version: "35",
         },
         ndk: {
             enabled: true,
@@ -42,6 +43,7 @@
                 "//apex_available:platform",
                 "com.android.nfcservices",
             ],
+            min_sdk_version: "35",
         },
         rust: {
             enabled: true,
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
index 0261a0a..4fdfae8 100644
--- a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
@@ -50,4 +50,5 @@
   byte[] offHostRouteEse;
   byte defaultIsoDepRoute;
   byte[] offHostSimPipeIds = {};
+  boolean t4tNfceeEnable;
 }
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
index 021dfe2..2df0d35 100644
--- a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -43,4 +43,5 @@
   byte discoveryPollKovio;
   byte discoveryPollBPrime;
   byte discoveryListenBPrime;
+  byte protocolChineseId;
 }
diff --git a/nfc/aidl/android/hardware/nfc/NfcConfig.aidl b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
index 870cdbd..86eee8b 100644
--- a/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
+++ b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
@@ -90,4 +90,8 @@
      * Pipe IDs for UICC. Empty if not available
      */
     byte[] offHostSimPipeIds = {};
+    /**
+     * T4T NFCEE feature configuration
+     */
+    boolean t4tNfceeEnable;
 }
diff --git a/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
index f8e3228..021e307 100644
--- a/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
+++ b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -33,4 +33,5 @@
     byte discoveryPollKovio;
     byte discoveryPollBPrime;
     byte discoveryListenBPrime;
+    byte protocolChineseId;
 }
diff --git a/oemlock/1.0/vts/functional/Android.bp b/oemlock/1.0/vts/functional/Android.bp
index f1b8d2f..80b4fdb 100644
--- a/oemlock/1.0/vts/functional/Android.bp
+++ b/oemlock/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_pixel_watch_system_software",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/oemlock/aidl/vts/Android.bp b/oemlock/aidl/vts/Android.bp
index eb999a9..e19bc6a 100644
--- a/oemlock/aidl/vts/Android.bp
+++ b/oemlock/aidl/vts/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_pixel_watch_system_software",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "hardware_interfaces_license"
diff --git a/radio/aidl/Android.bp b/radio/aidl/Android.bp
index eca9a27..01c09d8 100644
--- a/radio/aidl/Android.bp
+++ b/radio/aidl/Android.bp
@@ -14,6 +14,7 @@
     host_supported: true,
     srcs: ["android/hardware/radio/*.aidl"],
     stability: "vintf",
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -48,6 +49,7 @@
     srcs: ["android/hardware/radio/config/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -82,6 +84,7 @@
     srcs: ["android/hardware/radio/data/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -115,6 +118,7 @@
     srcs: ["android/hardware/radio/messaging/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -148,6 +152,7 @@
     srcs: ["android/hardware/radio/modem/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -181,6 +186,7 @@
     srcs: ["android/hardware/radio/network/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -213,6 +219,7 @@
     host_supported: true,
     srcs: ["android/hardware/radio/sap/*.aidl"],
     stability: "vintf",
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -241,6 +248,7 @@
     host_supported: true,
     srcs: ["android/hardware/radio/sim/*.aidl"],
     stability: "vintf",
+    flags: ["-Werror"],
     imports: [
         "android.hardware.radio-V4",
         "android.hardware.radio.config-V4",
@@ -287,6 +295,7 @@
     srcs: ["android/hardware/radio/voice/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: true,
@@ -322,6 +331,7 @@
         "android.hardware.radio-V4",
         "android.hardware.radio.data-V4",
     ],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: false,
@@ -356,6 +366,7 @@
     srcs: ["android/hardware/radio/ims/*.aidl"],
     stability: "vintf",
     imports: ["android.hardware.radio-V4"],
+    flags: ["-Werror"],
     backend: {
         cpp: {
             enabled: false,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/IRadioConfig.aidl b/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/IRadioConfig.aidl
index bc1c292..bba6bdd 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/IRadioConfig.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.config/current/android/hardware/radio/config/IRadioConfig.aidl
@@ -17,9 +17,10 @@
  * This interface is used by telephony and telecom to talk to cellular radio for the purpose of
  * radio configuration, and it is not associated with any specific modem or slot.
  * All the functions have minimum one parameter:
- * serial: which corresponds to serial no. of request. Serial numbers must only be memorized for the
- * duration of a method call. If clients provide colliding serials (including passing the same
- * serial to different methods), multiple responses (one for each method call) must still be served.
+ * serial: which corresponds to the serial number of the request. Serial numbers must only be
+ * memorized for the duration of a method call. If clients provide colliding serials (including
+ * passing the same serial to different methods), multiple responses (one for each method call) must
+ * still be served.
  */
 ///////////////////////////////////////////////////////////////////////////////
 // THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
index 009b428..a0ca4bf 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataCallFailCause.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.data;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum DataCallFailCause {
   NONE = 0,
   OPERATOR_BARRED = 0x08,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
index 7f3fdc7..d68a9d7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
@@ -37,9 +37,9 @@
 parcelable DataProfileInfo {
   int profileId;
   String apn;
-  android.hardware.radio.data.PdpProtocolType protocol;
-  android.hardware.radio.data.PdpProtocolType roamingProtocol;
-  android.hardware.radio.data.ApnAuthType authType;
+  android.hardware.radio.data.PdpProtocolType protocol = android.hardware.radio.data.PdpProtocolType.IP;
+  android.hardware.radio.data.PdpProtocolType roamingProtocol = android.hardware.radio.data.PdpProtocolType.IP;
+  android.hardware.radio.data.ApnAuthType authType = android.hardware.radio.data.ApnAuthType.NO_PAP_NO_CHAP;
   String user;
   String password;
   int type;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
index e1fedb8..f5fae50 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataThrottlingAction.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.data;
 /* @hide */
-@Backing(type="byte") @JavaDerive(toString=true) @VintfStability
+@Backing(type="byte") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum DataThrottlingAction {
   NO_DATA_THROTTLING,
   THROTTLE_SECONDARY_CARRIER,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
index bef4c73..67d679f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/LinkAddress.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.data;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable LinkAddress {
   String address;
   int addressProperties;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PortRange.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PortRange.aidl
index 45e2dc9..e428f1a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PortRange.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/PortRange.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.data;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable PortRange {
   int start;
   int end;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
index 8864c24..80c055e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/RouteSelectionDescriptor.aidl
@@ -36,7 +36,7 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable RouteSelectionDescriptor {
   byte precedence;
-  android.hardware.radio.data.PdpProtocolType sessionType;
+  android.hardware.radio.data.PdpProtocolType sessionType = android.hardware.radio.data.PdpProtocolType.IP;
   byte sscMode;
   android.hardware.radio.data.SliceInfo[] sliceInfo;
   String[] dnn;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/SetupDataCallResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/SetupDataCallResult.aidl
index 6ae626e..699cc4d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/SetupDataCallResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/SetupDataCallResult.aidl
@@ -33,13 +33,13 @@
 
 package android.hardware.radio.data;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable SetupDataCallResult {
-  android.hardware.radio.data.DataCallFailCause cause;
+  android.hardware.radio.data.DataCallFailCause cause = android.hardware.radio.data.DataCallFailCause.NONE;
   long suggestedRetryTime;
   int cid;
   int active;
-  android.hardware.radio.data.PdpProtocolType type;
+  android.hardware.radio.data.PdpProtocolType type = android.hardware.radio.data.PdpProtocolType.IP;
   String ifname;
   android.hardware.radio.data.LinkAddress[] addresses;
   String[] dnses;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
index 36a538c..3b38e19 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
@@ -33,8 +33,9 @@
 
 package android.hardware.radio.ims.media;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum AmrMode {
+  INVALID = 0,
   AMR_MODE_0 = (1 << 0) /* 1 */,
   AMR_MODE_1 = (1 << 1) /* 2 */,
   AMR_MODE_2 = (1 << 2) /* 4 */,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrParams.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrParams.aidl
index dcf0dd1..eb65eb1 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrParams.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrParams.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable AmrParams {
-  android.hardware.radio.ims.media.AmrMode amrMode;
+  android.hardware.radio.ims.media.AmrMode amrMode = android.hardware.radio.ims.media.AmrMode.INVALID;
   boolean octetAligned;
   int maxRedundancyMillis;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecParams.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecParams.aidl
index 6eefb34..1c80f7a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecParams.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecParams.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable CodecParams {
-  android.hardware.radio.ims.media.CodecType codecType;
+  android.hardware.radio.ims.media.CodecType codecType = android.hardware.radio.ims.media.CodecType.INVALID;
   byte rxPayloadTypeNumber;
   byte txPayloadTypeNumber;
   byte samplingRateKHz;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
index 98463b1..e97a647 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
@@ -35,6 +35,7 @@
 /* @hide */
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum CodecType {
+  INVALID = 0,
   AMR = (1 << 0) /* 1 */,
   AMR_WB = (1 << 1) /* 2 */,
   EVS = (1 << 2) /* 4 */,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
index 1a59389..ae0e1f7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
@@ -33,8 +33,9 @@
 
 package android.hardware.radio.ims.media;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum EvsMode {
+  INVALID = 0,
   EVS_MODE_0 = (1 << 0) /* 1 */,
   EVS_MODE_1 = (1 << 1) /* 2 */,
   EVS_MODE_2 = (1 << 2) /* 4 */,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsParams.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsParams.aidl
index deb53af..90d2204 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsParams.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsParams.aidl
@@ -35,8 +35,8 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable EvsParams {
-  android.hardware.radio.ims.media.EvsBandwidth bandwidth;
-  android.hardware.radio.ims.media.EvsMode evsMode;
+  android.hardware.radio.ims.media.EvsBandwidth bandwidth = android.hardware.radio.ims.media.EvsBandwidth.NONE;
+  android.hardware.radio.ims.media.EvsMode evsMode = android.hardware.radio.ims.media.EvsMode.INVALID;
   byte channelAwareMode;
   boolean useHeaderFullOnly;
   boolean useEvsModeSwitch;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
index 714442c..b9cc15c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.ims.media;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum RtcpXrReportBlockType {
   RTCPXR_NONE = 0,
   RTCPXR_LOSS_RLE_REPORT_BLOCK = (1 << 0) /* 1 */,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
index 472ec35..6af5523 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -36,7 +36,7 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable RtpConfig {
   int direction;
-  android.hardware.radio.AccessNetwork accessNetwork;
+  android.hardware.radio.AccessNetwork accessNetwork = android.hardware.radio.AccessNetwork.UNKNOWN;
   android.hardware.radio.ims.media.RtpAddress remoteAddress;
   android.hardware.radio.ims.media.RtpSessionParams sessionParams;
   android.hardware.radio.ims.media.RtcpConfig rtcpConfig;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
index 421f752..ae3bbac 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ConnectionFailureInfo.aidl
@@ -35,11 +35,12 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable ConnectionFailureInfo {
-  android.hardware.radio.ims.ConnectionFailureInfo.ConnectionFailureReason failureReason;
+  android.hardware.radio.ims.ConnectionFailureInfo.ConnectionFailureReason failureReason = android.hardware.radio.ims.ConnectionFailureInfo.ConnectionFailureReason.INVALID;
   int causeCode;
   int waitTimeMillis;
-  @Backing(type="int") @VintfStability
+  @Backing(type="int") @SuppressWarnings(value={"redundant-name"}) @VintfStability
   enum ConnectionFailureReason {
+    INVALID = 0,
     REASON_ACCESS_DENIED = 1,
     REASON_NAS_FAILURE = 2,
     REASON_RACH_FAILURE = 3,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
index 3895d75..73d987a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsCall.aidl
@@ -36,10 +36,10 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable ImsCall {
   int index;
-  android.hardware.radio.ims.ImsCall.CallType callType;
-  android.hardware.radio.AccessNetwork accessNetwork;
-  android.hardware.radio.ims.ImsCall.CallState callState;
-  android.hardware.radio.ims.ImsCall.Direction direction;
+  android.hardware.radio.ims.ImsCall.CallType callType = android.hardware.radio.ims.ImsCall.CallType.NORMAL;
+  android.hardware.radio.AccessNetwork accessNetwork = android.hardware.radio.AccessNetwork.UNKNOWN;
+  android.hardware.radio.ims.ImsCall.CallState callState = android.hardware.radio.ims.ImsCall.CallState.ACTIVE;
+  android.hardware.radio.ims.ImsCall.Direction direction = android.hardware.radio.ims.ImsCall.Direction.INCOMING;
   boolean isHeldByRemote;
   @Backing(type="int")
   enum CallType {
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsDeregistrationReason.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsDeregistrationReason.aidl
index 5b5bd40..62dc69b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsDeregistrationReason.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsDeregistrationReason.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.ims;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum ImsDeregistrationReason {
   REASON_SIM_REMOVED = 1,
   REASON_SIM_REFRESH = 2,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
index 66d8165..73cfd07 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/ImsRegistration.aidl
@@ -33,11 +33,11 @@
 
 package android.hardware.radio.ims;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable ImsRegistration {
-  android.hardware.radio.ims.ImsRegistrationState regState;
-  android.hardware.radio.AccessNetwork accessNetworkType;
-  android.hardware.radio.ims.SuggestedAction suggestedAction;
+  android.hardware.radio.ims.ImsRegistrationState regState = android.hardware.radio.ims.ImsRegistrationState.NOT_REGISTERED;
+  android.hardware.radio.AccessNetwork accessNetworkType = android.hardware.radio.AccessNetwork.UNKNOWN;
+  android.hardware.radio.ims.SuggestedAction suggestedAction = android.hardware.radio.ims.SuggestedAction.NONE;
   int capabilities;
   const int IMS_MMTEL_CAPABILITY_NONE = 0;
   const int IMS_MMTEL_CAPABILITY_VOICE = (1 << 0) /* 1 */;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
index 21645da..a2e2ae5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims/current/android/hardware/radio/ims/SrvccCall.aidl
@@ -36,10 +36,10 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable SrvccCall {
   int index;
-  android.hardware.radio.ims.SrvccCall.CallType callType;
+  android.hardware.radio.ims.SrvccCall.CallType callType = android.hardware.radio.ims.SrvccCall.CallType.NORMAL;
   int callState;
-  android.hardware.radio.ims.SrvccCall.CallSubState callSubstate;
-  android.hardware.radio.ims.SrvccCall.ToneType ringbackToneType;
+  android.hardware.radio.ims.SrvccCall.CallSubState callSubstate = android.hardware.radio.ims.SrvccCall.CallSubState.NONE;
+  android.hardware.radio.ims.SrvccCall.ToneType ringbackToneType = android.hardware.radio.ims.SrvccCall.ToneType.NONE;
   boolean isMpty;
   boolean isMT;
   String number;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
index a0e3991..9982395 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.messaging;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable CdmaSmsSubaddress {
   int subaddressType;
   boolean odd;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/ImsSmsMessage.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/ImsSmsMessage.aidl
index 40b9ddb..ff4a111 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/ImsSmsMessage.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/ImsSmsMessage.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable ImsSmsMessage {
-  android.hardware.radio.RadioTechnologyFamily tech;
+  android.hardware.radio.RadioTechnologyFamily tech = android.hardware.radio.RadioTechnologyFamily.THREE_GPP;
   boolean retry;
   int messageRef;
   android.hardware.radio.messaging.CdmaSmsMessage[] cdmaMessage;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/BarringInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/BarringInfo.aidl
index 67c9349..3c812c0 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/BarringInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/BarringInfo.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable BarringInfo {
   int serviceType;
   int barringType;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellInfo.aidl
index 6bb31b0..53d485a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellInfo.aidl
@@ -36,6 +36,6 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable CellInfo {
   boolean registered;
-  android.hardware.radio.network.CellConnectionStatus connectionStatus;
+  android.hardware.radio.network.CellConnectionStatus connectionStatus = android.hardware.radio.network.CellConnectionStatus.NONE;
   android.hardware.radio.network.CellInfoRatSpecificInfo ratSpecificInfo;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellularIdentifierDisclosure.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
index cb542e8..540dc1e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
@@ -36,7 +36,7 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable CellularIdentifierDisclosure {
   String plmn;
-  android.hardware.radio.network.CellularIdentifier identifier;
-  android.hardware.radio.network.NasProtocolMessage protocolMessage;
+  android.hardware.radio.network.CellularIdentifier identifier = android.hardware.radio.network.CellularIdentifier.UNKNOWN;
+  android.hardware.radio.network.NasProtocolMessage protocolMessage = android.hardware.radio.network.NasProtocolMessage.UNKNOWN;
   boolean isEmergency;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
index 0de7e20..81c286a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/Domain.aidl
@@ -35,6 +35,7 @@
 /* @hide */
 @Backing(type="int") @JavaDerive(toString=true) @VintfStability
 enum Domain {
+  INVALID = 0,
   CS = (1 << 0) /* 1 */,
   PS = (1 << 1) /* 2 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyMode.aidl
index c5b067e..93c32fb 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyMode.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum EmergencyMode {
   EMERGENCY_WWAN = 1,
   EMERGENCY_WLAN = 2,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
index 471c7a0..7273a94 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
@@ -36,5 +36,5 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable EmergencyNetworkScanTrigger {
   android.hardware.radio.AccessNetwork[] accessNetwork;
-  android.hardware.radio.network.EmergencyScanType scanType;
+  android.hardware.radio.network.EmergencyScanType scanType = android.hardware.radio.network.EmergencyScanType.NO_PREFERENCE;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyRegResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyRegResult.aidl
index 3b8083d..47940f3 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyRegResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EmergencyRegResult.aidl
@@ -35,9 +35,9 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable EmergencyRegResult {
-  android.hardware.radio.AccessNetwork accessNetwork;
-  android.hardware.radio.network.RegState regState;
-  android.hardware.radio.network.Domain emcDomain;
+  android.hardware.radio.AccessNetwork accessNetwork = android.hardware.radio.AccessNetwork.UNKNOWN;
+  android.hardware.radio.network.RegState regState = android.hardware.radio.network.RegState.NOT_REG_MT_NOT_SEARCHING_OP;
+  android.hardware.radio.network.Domain emcDomain = android.hardware.radio.network.Domain.INVALID;
   boolean isVopsSupported;
   boolean isEmcBearerSupported;
   byte nwProvidedEmc;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
index bb34fe1..2ff454c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/EutranRegistrationInfo.aidl
@@ -37,7 +37,7 @@
 parcelable EutranRegistrationInfo {
   android.hardware.radio.network.LteVopsInfo lteVopsInfo;
   android.hardware.radio.network.NrIndicators nrIndicators;
-  android.hardware.radio.network.EutranRegistrationInfo.AttachResultType lteAttachResultType;
+  android.hardware.radio.network.EutranRegistrationInfo.AttachResultType lteAttachResultType = android.hardware.radio.network.EutranRegistrationInfo.AttachResultType.NONE;
   int extraInfo;
   const int EXTRA_CSFB_NOT_PREFERRED = (1 << 0) /* 1 */;
   const int EXTRA_SMS_ONLY = (1 << 1) /* 2 */;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanRequest.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanRequest.aidl
index 60eaf77..cdac0be 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanRequest.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanRequest.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable NetworkScanRequest {
   int type;
   int interval;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanResult.aidl
index 695a194..518a378 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NetworkScanResult.aidl
@@ -33,10 +33,10 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable NetworkScanResult {
   int status;
-  android.hardware.radio.RadioError error;
+  android.hardware.radio.RadioError error = android.hardware.radio.RadioError.NONE;
   android.hardware.radio.network.CellInfo[] networkInfos;
   const int SCAN_STATUS_PARTIAL = 1;
   const int SCAN_STATUS_COMPLETE = 2;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrVopsInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrVopsInfo.aidl
index 61146aa..1b5b669 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrVopsInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrVopsInfo.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable NrVopsInfo {
   byte vopsSupported;
   byte emcSupported;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhysicalChannelConfig.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhysicalChannelConfig.aidl
index 7d64f7e..f58e5ed 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhysicalChannelConfig.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/PhysicalChannelConfig.aidl
@@ -35,8 +35,8 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable PhysicalChannelConfig {
-  android.hardware.radio.network.CellConnectionStatus status;
-  android.hardware.radio.RadioTechnology rat;
+  android.hardware.radio.network.CellConnectionStatus status = android.hardware.radio.network.CellConnectionStatus.NONE;
+  android.hardware.radio.RadioTechnology rat = android.hardware.radio.RadioTechnology.UNKNOWN;
   int downlinkChannelNumber;
   int uplinkChannelNumber;
   int cellBandwidthDownlinkKhz;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioAccessSpecifier.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioAccessSpecifier.aidl
index 8229207..9a018f7 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioAccessSpecifier.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioAccessSpecifier.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable RadioAccessSpecifier {
-  android.hardware.radio.AccessNetwork accessNetwork;
+  android.hardware.radio.AccessNetwork accessNetwork = android.hardware.radio.AccessNetwork.UNKNOWN;
   android.hardware.radio.network.RadioAccessSpecifierBands bands;
   int[] channels;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
index 6058e30..cbf37b2 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RadioBandMode.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum RadioBandMode {
   BAND_MODE_UNSPECIFIED,
   BAND_MODE_EURO,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegState.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegState.aidl
index f11b911..5e40813 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegState.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum RegState {
   NOT_REG_MT_NOT_SEARCHING_OP = 0,
   REG_HOME = 1,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegStateResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegStateResult.aidl
index 625d970..814cde8 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegStateResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/RegStateResult.aidl
@@ -35,9 +35,9 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable RegStateResult {
-  android.hardware.radio.network.RegState regState;
-  android.hardware.radio.RadioTechnology rat;
-  android.hardware.radio.network.RegistrationFailCause reasonForDenial;
+  android.hardware.radio.network.RegState regState = android.hardware.radio.network.RegState.NOT_REG_MT_NOT_SEARCHING_OP;
+  android.hardware.radio.RadioTechnology rat = android.hardware.radio.RadioTechnology.UNKNOWN;
+  android.hardware.radio.network.RegistrationFailCause reasonForDenial = android.hardware.radio.network.RegistrationFailCause.NONE;
   android.hardware.radio.network.CellIdentity cellIdentity;
   String registeredPlmn;
   android.hardware.radio.network.AccessTechnologySpecificInfo accessTechnologySpecificInfo;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
index 73ad180..8613f19 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
@@ -35,8 +35,8 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable SecurityAlgorithmUpdate {
-  android.hardware.radio.network.ConnectionEvent connectionEvent;
-  android.hardware.radio.network.SecurityAlgorithm encryption;
-  android.hardware.radio.network.SecurityAlgorithm integrity;
+  android.hardware.radio.network.ConnectionEvent connectionEvent = android.hardware.radio.network.ConnectionEvent.CS_SIGNALLING_GSM;
+  android.hardware.radio.network.SecurityAlgorithm encryption = android.hardware.radio.network.SecurityAlgorithm.A50;
+  android.hardware.radio.network.SecurityAlgorithm integrity = android.hardware.radio.network.SecurityAlgorithm.A50;
   boolean isUnprotectedEmergency;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SignalThresholdInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SignalThresholdInfo.aidl
index 77b4831..2041bad 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SignalThresholdInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/SignalThresholdInfo.aidl
@@ -33,14 +33,14 @@
 
 package android.hardware.radio.network;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable SignalThresholdInfo {
   int signalMeasurement;
   int hysteresisMs;
   int hysteresisDb;
   int[] thresholds;
   boolean isEnabled;
-  android.hardware.radio.AccessNetwork ran;
+  android.hardware.radio.AccessNetwork ran = android.hardware.radio.AccessNetwork.UNKNOWN;
   const int SIGNAL_MEASUREMENT_TYPE_RSSI = 1;
   const int SIGNAL_MEASUREMENT_TYPE_RSCP = 2;
   const int SIGNAL_MEASUREMENT_TYPE_RSRP = 3;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/AppStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/AppStatus.aidl
index 898b616..a3e6d3a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/AppStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/AppStatus.aidl
@@ -33,16 +33,16 @@
 
 package android.hardware.radio.sim;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable AppStatus {
   int appType;
   int appState;
-  android.hardware.radio.sim.PersoSubstate persoSubstate;
+  android.hardware.radio.sim.PersoSubstate persoSubstate = android.hardware.radio.sim.PersoSubstate.UNKNOWN;
   String aidPtr;
   String appLabelPtr;
   boolean pin1Replaced;
-  android.hardware.radio.sim.PinState pin1;
-  android.hardware.radio.sim.PinState pin2;
+  android.hardware.radio.sim.PinState pin1 = android.hardware.radio.sim.PinState.UNKNOWN;
+  android.hardware.radio.sim.PinState pin2 = android.hardware.radio.sim.PinState.UNKNOWN;
   const int APP_STATE_UNKNOWN = 0;
   const int APP_STATE_DETECTED = 1;
   const int APP_STATE_PIN = 2;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
index 066777a..6a908c4 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardPowerState.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.sim;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum CardPowerState {
   POWER_DOWN,
   POWER_UP,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardStatus.aidl
index 1a9d621..0d7e48a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CardStatus.aidl
@@ -36,7 +36,7 @@
 @JavaDerive(toString=true) @VintfStability
 parcelable CardStatus {
   int cardState;
-  android.hardware.radio.sim.PinState universalPinState;
+  android.hardware.radio.sim.PinState universalPinState = android.hardware.radio.sim.PinState.UNKNOWN;
   int gsmUmtsSubscriptionAppIndex;
   int cdmaSubscriptionAppIndex;
   int imsSubscriptionAppIndex;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
index a5b8dc9..8f5672f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -44,7 +44,7 @@
    */
   android.hardware.radio.sim.Carrier[] excludedCarriers;
   boolean allowedCarriersPrioritized;
-  android.hardware.radio.sim.CarrierRestrictions.CarrierRestrictionStatus status;
+  android.hardware.radio.sim.CarrierRestrictions.CarrierRestrictionStatus status = android.hardware.radio.sim.CarrierRestrictions.CarrierRestrictionStatus.UNKNOWN;
   android.hardware.radio.sim.CarrierInfo[] allowedCarrierInfoList = {};
   android.hardware.radio.sim.CarrierInfo[] excludedCarrierInfoList = {};
   @Backing(type="int") @VintfStability
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PbReceivedStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PbReceivedStatus.aidl
index aaf9f3e..5070ff2 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PbReceivedStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/PbReceivedStatus.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.sim;
 /* @hide */
-@Backing(type="byte") @JavaDerive(toString=true) @VintfStability
+@Backing(type="byte") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum PbReceivedStatus {
   PB_RECEIVED_OK = 1,
   PB_RECEIVED_ERROR = 2,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
index 8cfe417..75b8f6b 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.sim;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum SimLockMultiSimPolicy {
   NO_MULTISIM_POLICY,
   ONE_VALID_SIM_MUST_BE_PRESENT,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimRefreshResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimRefreshResult.aidl
index 81ba510..c546565 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimRefreshResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/SimRefreshResult.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.sim;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable SimRefreshResult {
   int type;
   int efId;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/Call.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/Call.aidl
index b45a45b..27130b4 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/Call.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/Call.aidl
@@ -48,7 +48,7 @@
   String name;
   int namePresentation;
   android.hardware.radio.voice.UusInfo[] uusInfo;
-  android.hardware.radio.voice.AudioQuality audioQuality;
+  android.hardware.radio.voice.AudioQuality audioQuality = android.hardware.radio.voice.AudioQuality.UNSPECIFIED;
   String forwardedNumber;
   const int PRESENTATION_ALLOWED = 0;
   const int PRESENTATION_RESTRICTED = 1;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
index 300b03f..0142792 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable CdmaDisplayInfoRecord {
   String alphaBuf;
   const int CDMA_ALPHA_INFO_BUFFER_LENGTH = 64;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaInformationRecord.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaInformationRecord.aidl
index 2f7f5f0..c71a8be 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaInformationRecord.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaInformationRecord.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable CdmaInformationRecord {
   int name;
   android.hardware.radio.voice.CdmaDisplayInfoRecord[] display;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
index c3b0d5a..974e795 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable CdmaNumberInfoRecord {
   String number;
   byte numberType;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
index 93c7c6b..818d107 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable CdmaRedirectingNumberInfoRecord {
   android.hardware.radio.voice.CdmaNumberInfoRecord redirectingNumber;
   int redirectingReason;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
index c38c801..3153e0a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/ClipStatus.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum ClipStatus {
   CLIP_PROVISIONED,
   CLIP_UNPROVISIONED,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
index 3099a20..a45f388 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/EmergencyCallRouting.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum EmergencyCallRouting {
   UNKNOWN,
   EMERGENCY,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
index 0cac135..17a039f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCause.aidl
@@ -33,8 +33,9 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum LastCallFailCause {
+  INVALID = 0,
   UNOBTAINABLE_NUMBER = 1,
   NO_ROUTE_TO_DESTINATION = 3,
   CHANNEL_UNACCEPTABLE = 6,
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCauseInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
index 151adf2..c36a934 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
@@ -35,6 +35,6 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable LastCallFailCauseInfo {
-  android.hardware.radio.voice.LastCallFailCause causeCode;
+  android.hardware.radio.voice.LastCallFailCause causeCode = android.hardware.radio.voice.LastCallFailCause.INVALID;
   String vendorCause;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SsInfoData.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SsInfoData.aidl
index 24365dc..2af38fe 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SsInfoData.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/SsInfoData.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable SsInfoData {
   int[] ssInfo;
   const int SS_INFO_MAX = 4;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
index 999f47c..d265374 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
@@ -39,7 +39,7 @@
   int requestType;
   int teleserviceType;
   int serviceClass;
-  android.hardware.radio.RadioError result;
+  android.hardware.radio.RadioError result = android.hardware.radio.RadioError.NONE;
   android.hardware.radio.voice.SsInfoData[] ssInfo;
   android.hardware.radio.voice.CfData[] cfData;
   const int REQUEST_TYPE_ACTIVATION = 0;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UusInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UusInfo.aidl
index 3c84c8d..79c77ee 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UusInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UusInfo.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio.voice;
 /* @hide */
-@JavaDerive(toString=true) @VintfStability
+@JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 parcelable UusInfo {
   int uusType;
   int uusDcs;
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
index 02c5370..e782e73 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioError.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.radio;
 /* @hide */
-@Backing(type="int") @JavaDerive(toString=true) @VintfStability
+@Backing(type="int") @JavaDerive(toString=true) @SuppressWarnings(value={"redundant-name"}) @VintfStability
 enum RadioError {
   NONE = 0,
   RADIO_NOT_AVAILABLE = 1,
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfo.aidl
index f03a73b..bfab0c5 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfo.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable RadioResponseInfo {
-  android.hardware.radio.RadioResponseType type;
+  android.hardware.radio.RadioResponseType type = android.hardware.radio.RadioResponseType.SOLICITED;
   int serial;
-  android.hardware.radio.RadioError error;
+  android.hardware.radio.RadioError error = android.hardware.radio.RadioError.NONE;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfoModem.aidl b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfoModem.aidl
index 2e0c315..c445fec 100644
--- a/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfoModem.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio/current/android/hardware/radio/RadioResponseInfoModem.aidl
@@ -35,8 +35,8 @@
 /* @hide */
 @JavaDerive(toString=true) @VintfStability
 parcelable RadioResponseInfoModem {
-  android.hardware.radio.RadioResponseType type;
+  android.hardware.radio.RadioResponseType type = android.hardware.radio.RadioResponseType.SOLICITED;
   int serial;
-  android.hardware.radio.RadioError error;
+  android.hardware.radio.RadioError error = android.hardware.radio.RadioError.NONE;
   boolean isEnabled;
 }
diff --git a/radio/aidl/android/hardware/radio/RadioError.aidl b/radio/aidl/android/hardware/radio/RadioError.aidl
index 9c39bc4..6ce8f67 100644
--- a/radio/aidl/android/hardware/radio/RadioError.aidl
+++ b/radio/aidl/android/hardware/radio/RadioError.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum RadioError {
     /**
      * Success
diff --git a/radio/aidl/android/hardware/radio/RadioResponseInfo.aidl b/radio/aidl/android/hardware/radio/RadioResponseInfo.aidl
index 25195aa..926ccf6 100644
--- a/radio/aidl/android/hardware/radio/RadioResponseInfo.aidl
+++ b/radio/aidl/android/hardware/radio/RadioResponseInfo.aidl
@@ -26,7 +26,7 @@
     /**
      * Response type
      */
-    RadioResponseType type;
+    RadioResponseType type = RadioResponseType.SOLICITED;
     /**
      * Serial number of the request
      */
@@ -34,5 +34,5 @@
     /**
      * Response error
      */
-    RadioError error;
+    RadioError error = RadioError.NONE;
 }
diff --git a/radio/aidl/android/hardware/radio/RadioResponseInfoModem.aidl b/radio/aidl/android/hardware/radio/RadioResponseInfoModem.aidl
index 286f397..3e76a93 100644
--- a/radio/aidl/android/hardware/radio/RadioResponseInfoModem.aidl
+++ b/radio/aidl/android/hardware/radio/RadioResponseInfoModem.aidl
@@ -26,7 +26,7 @@
     /**
      * Response type
      */
-    RadioResponseType type;
+    RadioResponseType type = RadioResponseType.SOLICITED;
     /**
      * Serial number of the request
      */
@@ -34,7 +34,7 @@
     /**
      * Response error
      */
-    RadioError error;
+    RadioError error = RadioError.NONE;
     /**
      * Whether the modem is enabled or not
      */
diff --git a/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl b/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
index e015e8e..6f043d9 100644
--- a/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataCallFailCause.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum DataCallFailCause {
     /**
      * An integer cause code defined in TS 24.008 section 6.1.3.1.3 or TS 24.301 Release 8+ Annex B.
diff --git a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
index d01f8ff..f067fb4 100644
--- a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
@@ -66,15 +66,15 @@
     /**
      * PDP_type values.
      */
-    PdpProtocolType protocol;
+    PdpProtocolType protocol = PdpProtocolType.IP;
     /**
      * PDP_type values used on roaming network.
      */
-    PdpProtocolType roamingProtocol;
+    PdpProtocolType roamingProtocol = PdpProtocolType.IP;
     /**
      * APN authentication type.
      */
-    ApnAuthType authType;
+    ApnAuthType authType = ApnAuthType.NO_PAP_NO_CHAP;
     /**
      * The username for APN, or empty string.
      */
diff --git a/radio/aidl/android/hardware/radio/data/DataThrottlingAction.aidl b/radio/aidl/android/hardware/radio/data/DataThrottlingAction.aidl
index a762e34..03c3481 100644
--- a/radio/aidl/android/hardware/radio/data/DataThrottlingAction.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataThrottlingAction.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="byte")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum DataThrottlingAction {
     /*
      * Clear all existing data throttling.
diff --git a/radio/aidl/android/hardware/radio/data/LinkAddress.aidl b/radio/aidl/android/hardware/radio/data/LinkAddress.aidl
index 7ac560f..f5d6553 100644
--- a/radio/aidl/android/hardware/radio/data/LinkAddress.aidl
+++ b/radio/aidl/android/hardware/radio/data/LinkAddress.aidl
@@ -22,6 +22,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable LinkAddress {
     const int ADDRESS_PROPERTY_NONE = 0;
     /**
diff --git a/radio/aidl/android/hardware/radio/data/PortRange.aidl b/radio/aidl/android/hardware/radio/data/PortRange.aidl
index 7326966..1d436fa 100644
--- a/radio/aidl/android/hardware/radio/data/PortRange.aidl
+++ b/radio/aidl/android/hardware/radio/data/PortRange.aidl
@@ -24,6 +24,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable PortRange {
     const int PORT_RANGE_MIN = 20;
     const int PORT_RANGE_MAX = 65535;
diff --git a/radio/aidl/android/hardware/radio/data/RouteSelectionDescriptor.aidl b/radio/aidl/android/hardware/radio/data/RouteSelectionDescriptor.aidl
index 4e9e954..4d4b6d5 100644
--- a/radio/aidl/android/hardware/radio/data/RouteSelectionDescriptor.aidl
+++ b/radio/aidl/android/hardware/radio/data/RouteSelectionDescriptor.aidl
@@ -38,7 +38,7 @@
     /**
      * Valid values are IP, IPV6, IPV4V6, and UNKNOWN.
      */
-    PdpProtocolType sessionType;
+    PdpProtocolType sessionType = PdpProtocolType.IP;
     /**
      * Session and service continuity mode as defined in 3GPP TS 23.501.
      * Valid values are SSC_MODE_
diff --git a/radio/aidl/android/hardware/radio/data/SetupDataCallResult.aidl b/radio/aidl/android/hardware/radio/data/SetupDataCallResult.aidl
index 31fb14c..687982a 100644
--- a/radio/aidl/android/hardware/radio/data/SetupDataCallResult.aidl
+++ b/radio/aidl/android/hardware/radio/data/SetupDataCallResult.aidl
@@ -27,6 +27,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable SetupDataCallResult {
     /**
      * Indicates the data connection is inactive.
@@ -64,7 +65,7 @@
     /**
      * Data call fail cause. DataCallFailCause.NONE if no error.
      */
-    DataCallFailCause cause;
+    DataCallFailCause cause = DataCallFailCause.NONE;
     /**
      * If cause is not DataCallFailCause.NONE, this field indicates the network suggested data
      * retry back-off time in milliseconds. Negative value indicates network does not give any
@@ -87,7 +88,7 @@
      * PDP protocol type. If cause is DataCallFailCause.ONLY_SINGLE_BEARER_ALLOWED, this is the
      * protocol type supported, such as "IP" or "IPV6".
      */
-    PdpProtocolType type;
+    PdpProtocolType type = PdpProtocolType.IP;
     /**
      * The network interface name.
      */
diff --git a/radio/aidl/android/hardware/radio/ims/ConnectionFailureInfo.aidl b/radio/aidl/android/hardware/radio/ims/ConnectionFailureInfo.aidl
index c96f59f..92024ac 100644
--- a/radio/aidl/android/hardware/radio/ims/ConnectionFailureInfo.aidl
+++ b/radio/aidl/android/hardware/radio/ims/ConnectionFailureInfo.aidl
@@ -22,7 +22,10 @@
 parcelable ConnectionFailureInfo {
     @VintfStability
     @Backing(type="int")
+    @SuppressWarnings(value={"redundant-name"})
     enum ConnectionFailureReason {
+        /** Do not use. */
+        INVALID = 0,
         /** Access class check failed */
         REASON_ACCESS_DENIED = 1,
         /** 3GPP Non-access stratum failure */
@@ -47,7 +50,7 @@
     /**
      * Values are REASON_* constants
      */
-    ConnectionFailureReason failureReason;
+    ConnectionFailureReason failureReason = ConnectionFailureReason.INVALID;
 
     /**
      * Failure cause code from network or modem specific to the failure
diff --git a/radio/aidl/android/hardware/radio/ims/ImsCall.aidl b/radio/aidl/android/hardware/radio/ims/ImsCall.aidl
index 427c1f5..49fd62c 100644
--- a/radio/aidl/android/hardware/radio/ims/ImsCall.aidl
+++ b/radio/aidl/android/hardware/radio/ims/ImsCall.aidl
@@ -50,16 +50,16 @@
     int index;
 
     /** The type of the call */
-    CallType callType;
+    CallType callType = CallType.NORMAL;
 
     /** The access network where the call is in progress */
-    AccessNetwork accessNetwork;
+    AccessNetwork accessNetwork = AccessNetwork.UNKNOWN;
 
     /** The state of the call */
-    CallState callState;
+    CallState callState = CallState.ACTIVE;
 
     /** The direction of the call */
-    Direction direction;
+    Direction direction = Direction.INCOMING;
 
     /** True if the call is put on HOLD by the other party */
     boolean isHeldByRemote;
diff --git a/radio/aidl/android/hardware/radio/ims/ImsDeregistrationReason.aidl b/radio/aidl/android/hardware/radio/ims/ImsDeregistrationReason.aidl
index acfe51c..bee8276 100644
--- a/radio/aidl/android/hardware/radio/ims/ImsDeregistrationReason.aidl
+++ b/radio/aidl/android/hardware/radio/ims/ImsDeregistrationReason.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @JavaDerive(toString=true)
 @Backing(type="int")
+@SuppressWarnings(value={"redundant-name"})
 enum ImsDeregistrationReason {
     /**
      * Radio shall send this reason to IMS stack to perform graceful de-registration
diff --git a/radio/aidl/android/hardware/radio/ims/ImsRegistration.aidl b/radio/aidl/android/hardware/radio/ims/ImsRegistration.aidl
index 5158386..9018273 100644
--- a/radio/aidl/android/hardware/radio/ims/ImsRegistration.aidl
+++ b/radio/aidl/android/hardware/radio/ims/ImsRegistration.aidl
@@ -23,6 +23,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable ImsRegistration {
     /** Default value */
     const int IMS_MMTEL_CAPABILITY_NONE = 0;
@@ -36,15 +37,15 @@
     const int IMS_RCS_CAPABILITIES = 1 << 3;
 
     /** Indicates the current IMS registration state. */
-    ImsRegistrationState regState;
+    ImsRegistrationState regState = ImsRegistrationState.NOT_REGISTERED;
 
     /**
      * Indicates the type of the radio access network where IMS is registered.
      */
-    AccessNetwork accessNetworkType;
+    AccessNetwork accessNetworkType = AccessNetwork.UNKNOWN;
 
     /** Indicates the expected action for the radio to do. */
-    SuggestedAction suggestedAction;
+    SuggestedAction suggestedAction = SuggestedAction.NONE;
 
     /**
      * Values are bitwise ORs of IMS_MMTEL_CAPABILITY_* constants and IMS_RCS_CAPABILITIES.
diff --git a/radio/aidl/android/hardware/radio/ims/SrvccCall.aidl b/radio/aidl/android/hardware/radio/ims/SrvccCall.aidl
index 16858f9..4fdfed0 100644
--- a/radio/aidl/android/hardware/radio/ims/SrvccCall.aidl
+++ b/radio/aidl/android/hardware/radio/ims/SrvccCall.aidl
@@ -47,16 +47,16 @@
     int index;
 
     /** The type of the call */
-    CallType callType;
+    CallType callType = CallType.NORMAL;
 
     /** Values are android.hardware.radio.voice.Call.STATE_* constants */
     int callState;
 
     /** The substate of the call */
-    CallSubState callSubstate;
+    CallSubState callSubstate = CallSubState.NONE;
 
     /** The type of the ringback tone */
-    ToneType ringbackToneType;
+    ToneType ringbackToneType = ToneType.NONE;
 
     /** true if is mpty call */
     boolean isMpty;
diff --git a/radio/aidl/android/hardware/radio/ims/media/AmrMode.aidl b/radio/aidl/android/hardware/radio/ims/media/AmrMode.aidl
index dc2a162..94070db 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AmrMode.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/AmrMode.aidl
@@ -23,7 +23,10 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum AmrMode {
+    /** Do not use. */
+    INVALID = 0,
     /** 4.75 kbps for AMR / 6.6 kbps for AMR-WB */
     AMR_MODE_0 = 1 << 0,
     /** 5.15 kbps for AMR / 8.855 kbps for AMR-WB */
diff --git a/radio/aidl/android/hardware/radio/ims/media/AmrParams.aidl b/radio/aidl/android/hardware/radio/ims/media/AmrParams.aidl
index 9d7ab05..dbf38c2 100644
--- a/radio/aidl/android/hardware/radio/ims/media/AmrParams.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/AmrParams.aidl
@@ -23,7 +23,7 @@
 @JavaDerive(toString=true)
 parcelable AmrParams {
     /** mode-set: AMR codec mode to represent the bit rate */
-    AmrMode amrMode;
+    AmrMode amrMode = AmrMode.INVALID;
     /**
      * octet-align: If it's set to true then all fields in the AMR/AMR-WB header
      * shall be aligned to octet boundaries by adding padding bits.
diff --git a/radio/aidl/android/hardware/radio/ims/media/CodecParams.aidl b/radio/aidl/android/hardware/radio/ims/media/CodecParams.aidl
index 74de6ec..6da8087 100644
--- a/radio/aidl/android/hardware/radio/ims/media/CodecParams.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/CodecParams.aidl
@@ -24,7 +24,7 @@
 @JavaDerive(toString=true)
 parcelable CodecParams {
     /** Negotiated codec type */
-    CodecType codecType;
+    CodecType codecType = CodecType.INVALID;
     /**
      * Static or dynamic payload type number negotiated through the SDP for
      * the incoming RTP packets. This value shall be matched with the PT value
diff --git a/radio/aidl/android/hardware/radio/ims/media/CodecType.aidl b/radio/aidl/android/hardware/radio/ims/media/CodecType.aidl
index 99fbac4..cf9dba4 100644
--- a/radio/aidl/android/hardware/radio/ims/media/CodecType.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/CodecType.aidl
@@ -21,6 +21,8 @@
 @Backing(type="int")
 @JavaDerive(toString=true)
 enum CodecType {
+    /** Do not use. */
+    INVALID = 0,
     /** Adaptive Multi-Rate */
     AMR = 1 << 0,
     /** Adaptive Multi-Rate Wide Band */
diff --git a/radio/aidl/android/hardware/radio/ims/media/EvsMode.aidl b/radio/aidl/android/hardware/radio/ims/media/EvsMode.aidl
index 12d981b..899f05a 100644
--- a/radio/aidl/android/hardware/radio/ims/media/EvsMode.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/EvsMode.aidl
@@ -23,7 +23,10 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum EvsMode {
+    /** Do not use. */
+    INVALID = 0,
     /** 6.6 kbps for EVS AMR-WB IO */
     EVS_MODE_0 = 1 << 0,
     /** 8.855 kbps for AMR-WB IO */
diff --git a/radio/aidl/android/hardware/radio/ims/media/EvsParams.aidl b/radio/aidl/android/hardware/radio/ims/media/EvsParams.aidl
index 52c3bf9..37c7d4b 100644
--- a/radio/aidl/android/hardware/radio/ims/media/EvsParams.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/EvsParams.aidl
@@ -24,10 +24,10 @@
 @JavaDerive(toString=true)
 parcelable EvsParams {
     /** EVS codec bandwidth */
-    EvsBandwidth bandwidth;
+    EvsBandwidth bandwidth = EvsBandwidth.NONE;
 
     /** mode-set: EVS codec mode to represent the bit rate */
-    EvsMode evsMode;
+    EvsMode evsMode = EvsMode.INVALID;
     /**
      * ch-aw-recv: Channel aware mode for the receive direction. Permissible values
      * are -1, 0, 2, 3, 5, and 7. If -1, channel-aware mode is disabled in the
diff --git a/radio/aidl/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl b/radio/aidl/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
index 88180d7..c7ee147 100644
--- a/radio/aidl/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
@@ -23,6 +23,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum RtcpXrReportBlockType {
     /** Disable RTCP XR */
     RTCPXR_NONE = 0,
diff --git a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
index 3c5c4dd..9aca292 100644
--- a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -29,7 +29,7 @@
     /** Media flow direction. The bitfield of MediaDirection(s) */
     int direction;
     /** Radio Access Network */
-    AccessNetwork accessNetwork;
+    AccessNetwork accessNetwork = AccessNetwork.UNKNOWN;
     /** IP address and port number of the other party for RTP media */
     RtpAddress remoteAddress;
     /** Negotiated session parameters */
diff --git a/radio/aidl/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl b/radio/aidl/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
index 19d84ff..8c494bb 100644
--- a/radio/aidl/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/CdmaSmsSubaddress.aidl
@@ -19,6 +19,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable CdmaSmsSubaddress {
     /**
      * CCITT X.213 or ISO 8348 AD2
diff --git a/radio/aidl/android/hardware/radio/messaging/ImsSmsMessage.aidl b/radio/aidl/android/hardware/radio/messaging/ImsSmsMessage.aidl
index 5f9f82b..bbcd1cb 100644
--- a/radio/aidl/android/hardware/radio/messaging/ImsSmsMessage.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/ImsSmsMessage.aidl
@@ -24,7 +24,7 @@
 @VintfStability
 @JavaDerive(toString=true)
 parcelable ImsSmsMessage {
-    RadioTechnologyFamily tech;
+    RadioTechnologyFamily tech = RadioTechnologyFamily.THREE_GPP;
     /**
      * Retry if true
      */
diff --git a/radio/aidl/android/hardware/radio/network/BarringInfo.aidl b/radio/aidl/android/hardware/radio/network/BarringInfo.aidl
index f12e35c..7be3987 100644
--- a/radio/aidl/android/hardware/radio/network/BarringInfo.aidl
+++ b/radio/aidl/android/hardware/radio/network/BarringInfo.aidl
@@ -21,6 +21,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable BarringInfo {
     /**
      * Device is not barred for the given service
diff --git a/radio/aidl/android/hardware/radio/network/CellInfo.aidl b/radio/aidl/android/hardware/radio/network/CellInfo.aidl
index 4895326..808a407 100644
--- a/radio/aidl/android/hardware/radio/network/CellInfo.aidl
+++ b/radio/aidl/android/hardware/radio/network/CellInfo.aidl
@@ -30,6 +30,6 @@
     /**
      * Connection status for the cell.
      */
-    CellConnectionStatus connectionStatus;
+    CellConnectionStatus connectionStatus = CellConnectionStatus.NONE;
     CellInfoRatSpecificInfo ratSpecificInfo;
 }
diff --git a/radio/aidl/android/hardware/radio/network/CellularIdentifierDisclosure.aidl b/radio/aidl/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
index 52b4116..c851b43 100644
--- a/radio/aidl/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
+++ b/radio/aidl/android/hardware/radio/network/CellularIdentifierDisclosure.aidl
@@ -31,9 +31,9 @@
     // The PLMN-ID to which the UE transmitted the cellular identifier
     String plmn;
     // The type of cellular identifier that was disclosed
-    CellularIdentifier identifier;
+    CellularIdentifier identifier = CellularIdentifier.UNKNOWN;
     // The NAS protocol message within which the cellular identifier was transmitted.
-    NasProtocolMessage protocolMessage;
+    NasProtocolMessage protocolMessage = NasProtocolMessage.UNKNOWN;
     // Whether or not this cellular identifier disclosure is in service of an emergency call.
     boolean isEmergency;
 }
diff --git a/radio/aidl/android/hardware/radio/network/Domain.aidl b/radio/aidl/android/hardware/radio/network/Domain.aidl
index bb169bd..e420e7b 100644
--- a/radio/aidl/android/hardware/radio/network/Domain.aidl
+++ b/radio/aidl/android/hardware/radio/network/Domain.aidl
@@ -21,6 +21,8 @@
 @Backing(type="int")
 @JavaDerive(toString=true)
 enum Domain {
+    /** Do not use. */
+    INVALID = 0,
     /**
      * Circuit-switched
      */
diff --git a/radio/aidl/android/hardware/radio/network/EmergencyMode.aidl b/radio/aidl/android/hardware/radio/network/EmergencyMode.aidl
index 7a2ed9c..bd36494 100644
--- a/radio/aidl/android/hardware/radio/network/EmergencyMode.aidl
+++ b/radio/aidl/android/hardware/radio/network/EmergencyMode.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum EmergencyMode {
     /**
      * Mode Type Emergency WWAN, indicates that the current domain selected for the Emergency call
diff --git a/radio/aidl/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl b/radio/aidl/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
index ea4bfeb..572d1e2 100644
--- a/radio/aidl/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
+++ b/radio/aidl/android/hardware/radio/network/EmergencyNetworkScanTrigger.aidl
@@ -32,5 +32,5 @@
      * Scan type indicates the type of scans to be performed i.e. limited scan, full service scan or
      * any scan.
      */
-    EmergencyScanType scanType;
+    EmergencyScanType scanType = EmergencyScanType.NO_PREFERENCE;
 }
diff --git a/radio/aidl/android/hardware/radio/network/EmergencyRegResult.aidl b/radio/aidl/android/hardware/radio/network/EmergencyRegResult.aidl
index af2750e..7fc4d26 100644
--- a/radio/aidl/android/hardware/radio/network/EmergencyRegResult.aidl
+++ b/radio/aidl/android/hardware/radio/network/EmergencyRegResult.aidl
@@ -26,17 +26,17 @@
     /**
      * Indicates the cellular access network of the current emergency capable system.
      */
-    AccessNetwork accessNetwork;
+    AccessNetwork accessNetwork = AccessNetwork.UNKNOWN;
 
     /**
      * Registration state of the current emergency capable system.
      */
-    RegState regState;
+    RegState regState = RegState.NOT_REG_MT_NOT_SEARCHING_OP;
 
     /**
      * EMC domain indicates the current domain of the acquired system.
      */
-    Domain emcDomain;
+    Domain emcDomain = Domain.INVALID;
 
     /**
      * This indicates whether the network supports voice over PS network.
diff --git a/radio/aidl/android/hardware/radio/network/EutranRegistrationInfo.aidl b/radio/aidl/android/hardware/radio/network/EutranRegistrationInfo.aidl
index fb319c1..15fabf3 100644
--- a/radio/aidl/android/hardware/radio/network/EutranRegistrationInfo.aidl
+++ b/radio/aidl/android/hardware/radio/network/EutranRegistrationInfo.aidl
@@ -54,7 +54,7 @@
      * The type of network attachment. This info is valid only on LTE network and must be present
      * when device has attached to the network.
      */
-    AttachResultType lteAttachResultType;
+    AttachResultType lteAttachResultType = AttachResultType.NONE;
 
     /** Values are bitwise ORs of EXTRA_* constants */
     int extraInfo;
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
index a4f97e3..81d21e1 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
@@ -503,7 +503,7 @@
      *
      * This is available when android.hardware.telephony is defined.
      */
-    oneway void setUsageSetting(in int serial, in UsageSetting usageSetting);
+    void setUsageSetting(in int serial, in UsageSetting usageSetting);
 
     /**
      * Get the UE usage setting for data/voice centric usage.
@@ -514,7 +514,7 @@
      *
      * This is available when android.hardware.telephony is defined.
      */
-    oneway void getUsageSetting(in int serial);
+    void getUsageSetting(in int serial);
 
     /**
      * Set the Emergency Mode
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
index 34948fb..7b6fc6e 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
@@ -306,7 +306,7 @@
      *      operation, it becomes complicated when integrity is used to determine whether an
      *      emergency call is protected or not, hence its exclusion to simplify implementation.
      *    - 4G and 5G with multiple DRBs : emergency calls are protected under that RAT only if all
-     *      DRBs are protected (including IMS DRB).
+     *      SRBs and DRBs are protected (including IMS DRB).
      *    - 4G and 5G DRB integrity: Since DRB integrity is not enabled in most networks, if both
      *      ciphering and integrity are taken into account to determine the value of
      *      isUnprotectedEmergency, the value will mostly be false, hence why it is excluded.
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
index b67e8e0..5dcdb69 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
@@ -603,7 +603,7 @@
      *   RadioError:INTERNAL_ERR
      *   RadioError:SIM_ABSENT
      */
-    oneway void setUsageSettingResponse(in RadioResponseInfo info);
+    void setUsageSettingResponse(in RadioResponseInfo info);
 
     /**
      * @param info Response info struct containing response type, serial no. and error.
@@ -617,7 +617,7 @@
      *   RadioError:INTERNAL_ERR
      *   RadioError:SIM_ABSENT
      */
-    oneway void getUsageSettingResponse(in RadioResponseInfo info, in UsageSetting usageSetting);
+    void getUsageSettingResponse(in RadioResponseInfo info, in UsageSetting usageSetting);
 
     /**
      * Response of setEmergencyMode.
diff --git a/radio/aidl/android/hardware/radio/network/NetworkScanRequest.aidl b/radio/aidl/android/hardware/radio/network/NetworkScanRequest.aidl
index 37f2cf1..30977f8 100644
--- a/radio/aidl/android/hardware/radio/network/NetworkScanRequest.aidl
+++ b/radio/aidl/android/hardware/radio/network/NetworkScanRequest.aidl
@@ -21,6 +21,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable NetworkScanRequest {
     const int RADIO_ACCESS_SPECIFIER_MAX_SIZE = 8;
 
diff --git a/radio/aidl/android/hardware/radio/network/NetworkScanResult.aidl b/radio/aidl/android/hardware/radio/network/NetworkScanResult.aidl
index 4465046..700c5e2 100644
--- a/radio/aidl/android/hardware/radio/network/NetworkScanResult.aidl
+++ b/radio/aidl/android/hardware/radio/network/NetworkScanResult.aidl
@@ -22,6 +22,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable NetworkScanResult {
     /**
      * The result contains a part of the scan results.
@@ -40,7 +41,7 @@
     /**
      * The error code of the incremental result.
      */
-    RadioError error;
+    RadioError error = RadioError.NONE;
     /**
      * List of network information as CellInfo.
      */
diff --git a/radio/aidl/android/hardware/radio/network/NrVopsInfo.aidl b/radio/aidl/android/hardware/radio/network/NrVopsInfo.aidl
index 71961a3..6fe1d27 100644
--- a/radio/aidl/android/hardware/radio/network/NrVopsInfo.aidl
+++ b/radio/aidl/android/hardware/radio/network/NrVopsInfo.aidl
@@ -23,6 +23,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable NrVopsInfo {
     /**
      * Emergency services not supported
diff --git a/radio/aidl/android/hardware/radio/network/PhysicalChannelConfig.aidl b/radio/aidl/android/hardware/radio/network/PhysicalChannelConfig.aidl
index ecb9463..b648ef8 100644
--- a/radio/aidl/android/hardware/radio/network/PhysicalChannelConfig.aidl
+++ b/radio/aidl/android/hardware/radio/network/PhysicalChannelConfig.aidl
@@ -27,11 +27,11 @@
     /**
      * Connection status for cell. Valid values are PRIMARY_SERVING and SECONDARY_SERVING
      */
-    CellConnectionStatus status;
+    CellConnectionStatus status = CellConnectionStatus.NONE;
     /**
      * The radio technology for this physical channel
      */
-    RadioTechnology rat;
+    RadioTechnology rat = RadioTechnology.UNKNOWN;
     /**
      * Downlink Absolute Radio Frequency Channel Number
      */
diff --git a/radio/aidl/android/hardware/radio/network/RadioAccessSpecifier.aidl b/radio/aidl/android/hardware/radio/network/RadioAccessSpecifier.aidl
index b3cee47..8bb4fe0 100644
--- a/radio/aidl/android/hardware/radio/network/RadioAccessSpecifier.aidl
+++ b/radio/aidl/android/hardware/radio/network/RadioAccessSpecifier.aidl
@@ -26,7 +26,7 @@
     /**
      * The type of network to scan.
      */
-    AccessNetwork accessNetwork;
+    AccessNetwork accessNetwork = AccessNetwork.UNKNOWN;
     /**
      * The frequency bands to scan. Maximum length of the vector is 8.
      */
diff --git a/radio/aidl/android/hardware/radio/network/RadioBandMode.aidl b/radio/aidl/android/hardware/radio/network/RadioBandMode.aidl
index 364a562..bd83b7d 100644
--- a/radio/aidl/android/hardware/radio/network/RadioBandMode.aidl
+++ b/radio/aidl/android/hardware/radio/network/RadioBandMode.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum RadioBandMode {
     /**
      * "Unspecified" (selected by baseband automatically)
diff --git a/radio/aidl/android/hardware/radio/network/RegState.aidl b/radio/aidl/android/hardware/radio/network/RegState.aidl
index de2d5f6..15e7160 100644
--- a/radio/aidl/android/hardware/radio/network/RegState.aidl
+++ b/radio/aidl/android/hardware/radio/network/RegState.aidl
@@ -25,6 +25,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum RegState {
     /**
      * Not registered, MT is not currently searching for a new operator to register
diff --git a/radio/aidl/android/hardware/radio/network/RegStateResult.aidl b/radio/aidl/android/hardware/radio/network/RegStateResult.aidl
index 57a73c0..a7857ef 100644
--- a/radio/aidl/android/hardware/radio/network/RegStateResult.aidl
+++ b/radio/aidl/android/hardware/radio/network/RegStateResult.aidl
@@ -32,7 +32,7 @@
      * EUTRAN, NGRAN, or another technology that does not support circuit-switched services, this
      * value reports registration in the Packet-switched domain.
      */
-    RegState regState;
+    RegState regState = RegState.NOT_REG_MT_NOT_SEARCHING_OP;
     /**
      * Indicates the radio technology, which must not be UNKNOWN if regState is REG_HOME,
      * REG_ROAMING, NOT_REG_MT_NOT_SEARCHING_OP_EM, NOT_REG_MT_SEARCHING_OP_EM, REG_DENIED_EM,
@@ -40,12 +40,12 @@
      * When the device is on carrier aggregation, vendor RIL service must properly report multiple
      * PhysicalChannelConfig elements through IRadioNetwork::currentPhysicalChannelConfigs.
      */
-    RadioTechnology rat;
+    RadioTechnology rat = RadioTechnology.UNKNOWN;
     /**
      * Cause code reported by the network in case registration fails. This will be a mobility
      * management cause code defined for MM, GMM, MME or equivalent as appropriate for the RAT.
      */
-    RegistrationFailCause reasonForDenial;
+    RegistrationFailCause reasonForDenial = RegistrationFailCause.NONE;
     /**
      * CellIdentity
      */
diff --git a/radio/aidl/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl b/radio/aidl/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
index e945d3b..ab48148 100644
--- a/radio/aidl/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
+++ b/radio/aidl/android/hardware/radio/network/SecurityAlgorithmUpdate.aidl
@@ -31,15 +31,15 @@
     /**
      * Type of connection event which is being reported on
      */
-    ConnectionEvent connectionEvent;
+    ConnectionEvent connectionEvent = ConnectionEvent.CS_SIGNALLING_GSM;
     /**
      * Encryption algorithm which was used
      */
-    SecurityAlgorithm encryption;
+    SecurityAlgorithm encryption = SecurityAlgorithm.A50;
     /**
      * Integrity algorithm which was used
      */
-    SecurityAlgorithm integrity;
+    SecurityAlgorithm integrity = SecurityAlgorithm.A50;
     /**
      * Whether or not this connection event is associated with an
      * unauthenticated / unencrypted emergency session
diff --git a/radio/aidl/android/hardware/radio/network/SignalThresholdInfo.aidl b/radio/aidl/android/hardware/radio/network/SignalThresholdInfo.aidl
index e440a64..3933889 100644
--- a/radio/aidl/android/hardware/radio/network/SignalThresholdInfo.aidl
+++ b/radio/aidl/android/hardware/radio/network/SignalThresholdInfo.aidl
@@ -24,6 +24,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable SignalThresholdInfo {
     /**
      * Received Signal Strength Indication.
@@ -121,5 +122,5 @@
     /**
      * The Radio Access Network for current threshold info.
      */
-    AccessNetwork ran;
+    AccessNetwork ran = AccessNetwork.UNKNOWN;
 }
diff --git a/radio/aidl/android/hardware/radio/sim/AppStatus.aidl b/radio/aidl/android/hardware/radio/sim/AppStatus.aidl
index 7fe8e40..602c8c5 100644
--- a/radio/aidl/android/hardware/radio/sim/AppStatus.aidl
+++ b/radio/aidl/android/hardware/radio/sim/AppStatus.aidl
@@ -22,6 +22,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable AppStatus {
     const int APP_STATE_UNKNOWN = 0;
     const int APP_STATE_DETECTED = 1;
@@ -57,7 +58,7 @@
     /**
      * Applicable only if appState == SUBSCRIPTION_PERSO
      */
-    PersoSubstate persoSubstate;
+    PersoSubstate persoSubstate = PersoSubstate.UNKNOWN;
     /**
      * e.g., from 0xA0, 0x00 -> 0x41, 0x30, 0x30, 0x30
      */
@@ -67,6 +68,6 @@
      * Applicable to USIM, CSIM and ISIM
      */
     boolean pin1Replaced;
-    PinState pin1;
-    PinState pin2;
+    PinState pin1 = PinState.UNKNOWN;
+    PinState pin2 = PinState.UNKNOWN;
 }
diff --git a/radio/aidl/android/hardware/radio/sim/CardPowerState.aidl b/radio/aidl/android/hardware/radio/sim/CardPowerState.aidl
index 2598dcb..0d5db2a 100644
--- a/radio/aidl/android/hardware/radio/sim/CardPowerState.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CardPowerState.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum CardPowerState {
     POWER_DOWN,
     POWER_UP,
diff --git a/radio/aidl/android/hardware/radio/sim/CardStatus.aidl b/radio/aidl/android/hardware/radio/sim/CardStatus.aidl
index 043bfa4..90aa8e0 100644
--- a/radio/aidl/android/hardware/radio/sim/CardStatus.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CardStatus.aidl
@@ -48,7 +48,7 @@
     /**
      * Applicable to USIM and CSIM
      */
-    PinState universalPinState;
+    PinState universalPinState = PinState.UNKNOWN;
     /**
      * Value < RadioConst:CARD_MAX_APPS, -1 if none
      */
diff --git a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
index 0002d5a..69c618f 100644
--- a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -61,7 +61,7 @@
      */
     boolean allowedCarriersPrioritized;
     /** Current restriction status as defined in CarrierRestrictionStatus enum */
-    CarrierRestrictionStatus status;
+    CarrierRestrictionStatus status = CarrierRestrictionStatus.UNKNOWN;
 
     /**  Allowed carriers. */
     CarrierInfo[] allowedCarrierInfoList = {};
@@ -71,5 +71,5 @@
      * excludedCarriers has same mcc/mnc and gid1 is ABCD. It means except the carrier whose gid1
      * is ABCD, all carriers with the same mcc/mnc are allowed.
      */
-    CarrierInfo[]  excludedCarrierInfoList = {};
-}
\ No newline at end of file
+    CarrierInfo[] excludedCarrierInfoList = {};
+}
diff --git a/radio/aidl/android/hardware/radio/sim/PbReceivedStatus.aidl b/radio/aidl/android/hardware/radio/sim/PbReceivedStatus.aidl
index f9414a8..c75a4ef 100644
--- a/radio/aidl/android/hardware/radio/sim/PbReceivedStatus.aidl
+++ b/radio/aidl/android/hardware/radio/sim/PbReceivedStatus.aidl
@@ -23,6 +23,7 @@
 @VintfStability
 @Backing(type="byte")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum PbReceivedStatus {
     /**
      * Indicates that retrieval is fine.
diff --git a/radio/aidl/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl b/radio/aidl/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
index 89d85a9..7ec5141 100644
--- a/radio/aidl/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
+++ b/radio/aidl/android/hardware/radio/sim/SimLockMultiSimPolicy.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum SimLockMultiSimPolicy {
 
     /**
diff --git a/radio/aidl/android/hardware/radio/sim/SimRefreshResult.aidl b/radio/aidl/android/hardware/radio/sim/SimRefreshResult.aidl
index 943f1d2..618ac32 100644
--- a/radio/aidl/android/hardware/radio/sim/SimRefreshResult.aidl
+++ b/radio/aidl/android/hardware/radio/sim/SimRefreshResult.aidl
@@ -19,6 +19,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable SimRefreshResult {
     /**
      * A file on SIM has been updated.
diff --git a/radio/aidl/android/hardware/radio/voice/Call.aidl b/radio/aidl/android/hardware/radio/voice/Call.aidl
index ee0b025..9990f28 100644
--- a/radio/aidl/android/hardware/radio/voice/Call.aidl
+++ b/radio/aidl/android/hardware/radio/voice/Call.aidl
@@ -99,7 +99,7 @@
      * Vector of User-User Signaling Information
      */
     UusInfo[] uusInfo;
-    AudioQuality audioQuality;
+    AudioQuality audioQuality = AudioQuality.UNSPECIFIED;
     /**
      * Forwarded number. It can set only one forwarded number based on 3GPP rule of the CS.
      * Reference: 3GPP TS 24.008 section 10.5.4.21b
diff --git a/radio/aidl/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl b/radio/aidl/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
index 7e5a68d..90b2715 100644
--- a/radio/aidl/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
+++ b/radio/aidl/android/hardware/radio/voice/CdmaDisplayInfoRecord.aidl
@@ -26,6 +26,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable CdmaDisplayInfoRecord {
     const int CDMA_ALPHA_INFO_BUFFER_LENGTH = 64;
     /**
diff --git a/radio/aidl/android/hardware/radio/voice/CdmaInformationRecord.aidl b/radio/aidl/android/hardware/radio/voice/CdmaInformationRecord.aidl
index f5c656b..19903c6 100644
--- a/radio/aidl/android/hardware/radio/voice/CdmaInformationRecord.aidl
+++ b/radio/aidl/android/hardware/radio/voice/CdmaInformationRecord.aidl
@@ -30,6 +30,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable CdmaInformationRecord {
     const int CDMA_MAX_NUMBER_OF_INFO_RECS = 10;
     /**
diff --git a/radio/aidl/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl b/radio/aidl/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
index b04e273..3a00cae 100644
--- a/radio/aidl/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
+++ b/radio/aidl/android/hardware/radio/voice/CdmaNumberInfoRecord.aidl
@@ -24,6 +24,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable CdmaNumberInfoRecord {
     const int CDMA_NUMBER_INFO_BUFFER_LENGTH = 81;
     /**
diff --git a/radio/aidl/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl b/radio/aidl/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
index 691712e..cb30da8 100644
--- a/radio/aidl/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
+++ b/radio/aidl/android/hardware/radio/voice/CdmaRedirectingNumberInfoRecord.aidl
@@ -21,6 +21,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable CdmaRedirectingNumberInfoRecord {
     /**
      * Redirecting Number Information Record as defined in C.S0005 section 3.7.5.11
diff --git a/radio/aidl/android/hardware/radio/voice/ClipStatus.aidl b/radio/aidl/android/hardware/radio/voice/ClipStatus.aidl
index 0a2ea2c..070aff7 100644
--- a/radio/aidl/android/hardware/radio/voice/ClipStatus.aidl
+++ b/radio/aidl/android/hardware/radio/voice/ClipStatus.aidl
@@ -20,6 +20,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum ClipStatus {
     /**
      * CLIP provisioned
diff --git a/radio/aidl/android/hardware/radio/voice/EmergencyCallRouting.aidl b/radio/aidl/android/hardware/radio/voice/EmergencyCallRouting.aidl
index 9f8993d..36e0bc0 100644
--- a/radio/aidl/android/hardware/radio/voice/EmergencyCallRouting.aidl
+++ b/radio/aidl/android/hardware/radio/voice/EmergencyCallRouting.aidl
@@ -23,6 +23,7 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum EmergencyCallRouting {
     /**
      * Indicates Android does not require how to handle the corresponding emergency call; it is
diff --git a/radio/aidl/android/hardware/radio/voice/LastCallFailCause.aidl b/radio/aidl/android/hardware/radio/voice/LastCallFailCause.aidl
index 9a38197..7737e94 100644
--- a/radio/aidl/android/hardware/radio/voice/LastCallFailCause.aidl
+++ b/radio/aidl/android/hardware/radio/voice/LastCallFailCause.aidl
@@ -20,7 +20,10 @@
 @VintfStability
 @Backing(type="int")
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 enum LastCallFailCause {
+    /** Do not use. */
+    INVALID = 0,
     UNOBTAINABLE_NUMBER = 1,
     NO_ROUTE_TO_DESTINATION = 3,
     CHANNEL_UNACCEPTABLE = 6,
diff --git a/radio/aidl/android/hardware/radio/voice/LastCallFailCauseInfo.aidl b/radio/aidl/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
index 4ed17d2..6af38bb 100644
--- a/radio/aidl/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
+++ b/radio/aidl/android/hardware/radio/voice/LastCallFailCauseInfo.aidl
@@ -22,6 +22,6 @@
 @VintfStability
 @JavaDerive(toString=true)
 parcelable LastCallFailCauseInfo {
-    LastCallFailCause causeCode;
+    LastCallFailCause causeCode = LastCallFailCause.INVALID;
     String vendorCause;
 }
diff --git a/radio/aidl/android/hardware/radio/voice/SsInfoData.aidl b/radio/aidl/android/hardware/radio/voice/SsInfoData.aidl
index c965a7d..9c9dcff 100644
--- a/radio/aidl/android/hardware/radio/voice/SsInfoData.aidl
+++ b/radio/aidl/android/hardware/radio/voice/SsInfoData.aidl
@@ -19,6 +19,7 @@
 /** @hide */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable SsInfoData {
     const int SS_INFO_MAX = 4;
     /**
diff --git a/radio/aidl/android/hardware/radio/voice/StkCcUnsolSsResult.aidl b/radio/aidl/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
index 9fe4024..641994e 100644
--- a/radio/aidl/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
+++ b/radio/aidl/android/hardware/radio/voice/StkCcUnsolSsResult.aidl
@@ -84,7 +84,7 @@
      * Values are a bitfield of SUPP_SERVICE_CLASS_
      */
     int serviceClass;
-    RadioError result;
+    RadioError result = RadioError.NONE;
     /**
      * Valid only for all serviceType except SERVICE_TYPE_CF_* else empty.
      * Only one of ssInfo and cfData may contain values and the other must be empty.
diff --git a/radio/aidl/android/hardware/radio/voice/UusInfo.aidl b/radio/aidl/android/hardware/radio/voice/UusInfo.aidl
index 5d499ca..3760ac6 100644
--- a/radio/aidl/android/hardware/radio/voice/UusInfo.aidl
+++ b/radio/aidl/android/hardware/radio/voice/UusInfo.aidl
@@ -22,6 +22,7 @@
  */
 @VintfStability
 @JavaDerive(toString=true)
+@SuppressWarnings(value={"redundant-name"})
 parcelable UusInfo {
     /**
      * User specified protocol
diff --git a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
index 294c205..2d2f307 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/KeyCreationResult.aidl
@@ -125,14 +125,25 @@
      * straightforward translation of the KeyMint tag/value parameter lists to ASN.1.
      *
      * KeyDescription ::= SEQUENCE {
-     *     attestationVersion         INTEGER, # Value 300
-     *     attestationSecurityLevel   SecurityLevel, # See below
-     *     keyMintVersion             INTEGER, # Value 300
-     *     keymintSecurityLevel       SecurityLevel, # See below
-     *     attestationChallenge       OCTET_STRING, # Tag::ATTESTATION_CHALLENGE from attestParams
-     *     uniqueId                   OCTET_STRING, # Empty unless key has Tag::INCLUDE_UNIQUE_ID
-     *     softwareEnforced           AuthorizationList, # See below
-     *     hardwareEnforced           AuthorizationList, # See below
+     *     -- attestationVersion must be 400.
+     *     attestationVersion         INTEGER,
+     *     -- attestationSecurityLevel is the SecurityLevel of the location where the attested
+     *     -- key is stored. Must match keymintSecurityLevel.
+     *     attestationSecurityLevel   SecurityLevel,
+     *     -- keyMintVersion must be 400.
+     *     keyMintVersion             INTEGER,
+     *     -- keyMintSecurityLevel is the SecurityLevel of the IKeyMintDevice. Must match
+     *     -- attestationSecurityLevel.
+     *     keyMintSecurityLevel       SecurityLevel,
+     *     -- attestationChallenge contains Tag::ATTESTATION_CHALLENGE from attestParams.
+     *     attestationChallenge       OCTET_STRING,
+     *     -- uniqueId is empty unless the key has Tag::INCLUDE_UNIQUE_ID.
+     *     uniqueId                   OCTET_STRING,
+     *     -- softwareEnforced contains the authorization tags enforced by the Android system.
+     *     softwareEnforced           AuthorizationList,
+     *     -- hardwareEnforced contains the authorization tags enforced by a secure environment
+     *     -- (TEE or StrongBox).
+     *     hardwareEnforced           AuthorizationList,
      * }
      *
      * SecurityLevel ::= ENUMERATED {
@@ -142,12 +153,15 @@
      * }
      *
      * RootOfTrust ::= SEQUENCE {
+     *     -- verifiedBootKey must contain a SHA-256 digest of the public key embedded in the
+     *     -- "vbmeta" partition if the device's bootloader is locked, or 32 bytes of zeroes if the
+     *     -- device's bootloader is unlocked.
      *     verifiedBootKey            OCTET_STRING,
      *     deviceLocked               BOOLEAN,
      *     verifiedBootState          VerifiedBootState,
-     *     # verifiedBootHash must contain 32-byte value that represents the state of all binaries
-     *     # or other components validated by verified boot.  Updating any verified binary or
-     *     # component must cause this value to change.
+     *     -- verifiedBootHash must contain a SHA-256 digest of all binaries and components
+     *     -- validated by Verified Boot. Updating any verified binary or component must cause this
+     *     -- value to change.
      *     verifiedBootHash           OCTET_STRING,
      * }
      *
@@ -158,6 +172,17 @@
      *     Failed                     (3),
      * }
      *
+     * -- Modules contains version information for APEX modules.
+     * -- Note that the Modules information is DER-encoded before being hashed, which requires a
+     * -- specific ordering (lexicographic by encoded value) for the constituent Module entries.
+     * -- This ensures that the ordering of Module entries is predictable and that the resulting
+     * -- SHA-256 hash value is identical for the same set of modules.
+     * Modules ::= SET OF Module
+     * Module ::= SEQUENCE {
+     *     packageName                OCTET_STRING,
+     *     version                    INTEGER, -- As determined at boot time
+     * }
+     *
      * -- Note that the AuthorizationList SEQUENCE is also used in IKeyMintDevice::importWrappedKey
      * -- as a way of describing the authorizations associated with a key that is being securely
      * -- imported.  As such, it includes the ability to describe tags that are only relevant for
@@ -170,11 +195,11 @@
      *     purpose                    [1] EXPLICIT SET OF INTEGER OPTIONAL,
      *     algorithm                  [2] EXPLICIT INTEGER OPTIONAL,
      *     keySize                    [3] EXPLICIT INTEGER OPTIONAL,
-     *     blockMode                  [4] EXPLICIT SET OF INTEGER OPTIONAL, -- symmetric only
+     *     blockMode                  [4] EXPLICIT SET OF INTEGER OPTIONAL, -- Symmetric keys only
      *     digest                     [5] EXPLICIT SET OF INTEGER OPTIONAL,
      *     padding                    [6] EXPLICIT SET OF INTEGER OPTIONAL,
-     *     callerNonce                [7] EXPLICIT NULL OPTIONAL, -- symmetric only
-     *     minMacLength               [8] EXPLICIT INTEGER OPTIONAL, -- symmetric only
+     *     callerNonce                [7] EXPLICIT NULL OPTIONAL, -- Symmetric keys only
+     *     minMacLength               [8] EXPLICIT INTEGER OPTIONAL, -- Symmetric keys only
      *     ecCurve                    [10] EXPLICIT INTEGER OPTIONAL,
      *     rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
      *     mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
@@ -184,7 +209,7 @@
      *     originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
      *     usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
      *     usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
-     *     userSecureId               [502] EXPLICIT INTEGER OPTIONAL, -- only used on import
+     *     userSecureId               [502] EXPLICIT INTEGER OPTIONAL, -- Only used on key import
      *     noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
      *     userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
      *     authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
@@ -210,6 +235,8 @@
      *     bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
      *     deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
      *     attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
+     *     -- moduleHash contains a SHA-256 hash of DER-encoded `Modules`
+     *     moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
      * }
      */
     Certificate[] certificateChain;
diff --git a/security/keymint/aidl/default/Android.bp b/security/keymint/aidl/default/Android.bp
index ff2393c..0197141 100644
--- a/security/keymint/aidl/default/Android.bp
+++ b/security/keymint/aidl/default/Android.bp
@@ -104,6 +104,7 @@
     ],
 }
 
+// The following target declares the latest version of KeyMint.
 prebuilt_etc {
     name: "android.hardware.hardware_keystore.xml",
     sub_dir: "permissions",
@@ -111,6 +112,24 @@
     src: "android.hardware.hardware_keystore.xml",
 }
 
+// The following targets (and underlying XML files) declare specific
+// versions of KeyMint.  Vendors should use the version that matches the
+// version of the KeyMint HAL that the device implements.
+
+prebuilt_etc {
+    name: "android.hardware.hardware_keystore_V1.xml",
+    sub_dir: "permissions",
+    vendor: true,
+    src: "android.hardware.hardware_keystore_V1.xml",
+}
+
+prebuilt_etc {
+    name: "android.hardware.hardware_keystore_V2.xml",
+    sub_dir: "permissions",
+    vendor: true,
+    src: "android.hardware.hardware_keystore_V2.xml",
+}
+
 prebuilt_etc {
     name: "android.hardware.hardware_keystore_V3.xml",
     sub_dir: "permissions",
@@ -118,6 +137,13 @@
     src: "android.hardware.hardware_keystore_V3.xml",
 }
 
+prebuilt_etc {
+    name: "android.hardware.hardware_keystore_V4.xml",
+    sub_dir: "permissions",
+    vendor: true,
+    src: "android.hardware.hardware_keystore_V4.xml",
+}
+
 rust_library {
     name: "libkmr_hal_nonsecure",
     crate_name: "kmr_hal_nonsecure",
diff --git a/security/keymint/aidl/default/android.hardware.hardware_keystore_V1.xml b/security/keymint/aidl/default/android.hardware.hardware_keystore_V1.xml
new file mode 100644
index 0000000..e5a9345
--- /dev/null
+++ b/security/keymint/aidl/default/android.hardware.hardware_keystore_V1.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<permissions>
+  <feature name="android.hardware.hardware_keystore" version="100" />
+</permissions>
diff --git a/security/keymint/aidl/default/android.hardware.hardware_keystore_V2.xml b/security/keymint/aidl/default/android.hardware.hardware_keystore_V2.xml
new file mode 100644
index 0000000..2ebf1fe
--- /dev/null
+++ b/security/keymint/aidl/default/android.hardware.hardware_keystore_V2.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<permissions>
+  <feature name="android.hardware.hardware_keystore" version="200" />
+</permissions>
diff --git a/security/keymint/aidl/default/android.hardware.hardware_keystore_V4.xml b/security/keymint/aidl/default/android.hardware.hardware_keystore_V4.xml
new file mode 100644
index 0000000..1ab2133
--- /dev/null
+++ b/security/keymint/aidl/default/android.hardware.hardware_keystore_V4.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<permissions>
+  <feature name="android.hardware.hardware_keystore" version="400" />
+</permissions>
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 48b12a4..0ce6a15 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -83,6 +83,16 @@
 // additional overhead, for the digest algorithmIdentifier required by PKCS#1.
 const size_t kPkcs1UndigestedSignaturePaddingOverhead = 11;
 
+// Determine whether the key description is for an asymmetric key.
+bool is_asymmetric(const AuthorizationSet& key_desc) {
+    auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
+    if (algorithm && (algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
+        return true;
+    } else {
+        return false;
+    }
+}
+
 size_t count_tag_invalid_entries(const std::vector<KeyParameter>& authorizations) {
     return std::count_if(authorizations.begin(), authorizations.end(),
                          [](const KeyParameter& e) -> bool { return e.tag == Tag::INVALID; });
@@ -149,7 +159,7 @@
     // The multiplier should never be higher than the AIDL version, but can be less
     // (for example, if the implementation is from an earlier version but the HAL service
     // uses the default libraries and so reports the current AIDL version).
-    EXPECT_TRUE((attestation_version / 100) <= aidl_version);
+    EXPECT_LE((attestation_version / 100), aidl_version);
 }
 
 bool avb_verification_enabled() {
@@ -418,11 +428,14 @@
     vector<Certificate> attest_cert_chain;
     // If an attestation is requested, but the system is RKP-only, we need to supply an explicit
     // attestation key. Else the result is a key without an attestation.
-    // If the RKP-only value is undeterminable (i.e., when running on GSI), generate and use the
-    // attest key anyways. In the case that using an attest key is not supported
-    // (shouldSkipAttestKeyTest), assume the device has factory keys (so not RKP-only).
+    // - If the RKP-only value is undeterminable (i.e., when running on GSI), generate and use the
+    //   `ATTEST_KEY` anyways.
+    // - In the case that using an `ATTEST_KEY` is not supported
+    //   (shouldSkipAttestKeyTest), assume the device has factory keys (so not RKP-only).
+    // - If the key being generated is a symmetric key (from test cases that check that the
+    //   attestation parameters are correctly ignored), don't try to use an `ATTEST_KEY`.
     if (isRkpOnly().value_or(true) && key_desc.Contains(TAG_ATTESTATION_CHALLENGE) &&
-        !shouldSkipAttestKeyTest()) {
+        !shouldSkipAttestKeyTest() && is_asymmetric(key_desc)) {
         AuthorizationSet attest_key_desc =
                 AuthorizationSetBuilder().EcdsaKey(EcCurve::P_256).AttestKey().SetDefaultValidity();
         attest_key.emplace();
@@ -462,10 +475,7 @@
         *key_characteristics = std::move(creationResult.keyCharacteristics);
         *cert_chain = std::move(creationResult.certificateChain);
 
-        auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
-        EXPECT_TRUE(algorithm);
-        if (algorithm &&
-            (algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
+        if (is_asymmetric(key_desc)) {
             EXPECT_GE(cert_chain->size(), 1);
             if (key_desc.Contains(TAG_ATTESTATION_CHALLENGE)) {
                 if (attest_key) {
@@ -506,10 +516,7 @@
         *key_characteristics = std::move(creationResult.keyCharacteristics);
         cert_chain_ = std::move(creationResult.certificateChain);
 
-        auto algorithm = key_desc.GetTagValue(TAG_ALGORITHM);
-        EXPECT_TRUE(algorithm);
-        if (algorithm &&
-            (algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
+        if (is_asymmetric(key_desc)) {
             EXPECT_GE(cert_chain_.size(), 1);
             if (key_desc.Contains(TAG_ATTESTATION_CHALLENGE)) EXPECT_GT(cert_chain_.size(), 1);
         } else {
@@ -554,10 +561,7 @@
         for (auto& entry : key_characteristics_) {
             allAuths.push_back(AuthorizationSet(entry.authorizations));
         }
-        auto algorithm = allAuths.GetTagValue(TAG_ALGORITHM);
-        EXPECT_TRUE(algorithm);
-        if (algorithm &&
-            (algorithm.value() == Algorithm::RSA || algorithm.value() == Algorithm::EC)) {
+        if (is_asymmetric(allAuths)) {
             EXPECT_GE(cert_chain_.size(), 1);
         } else {
             // For symmetric keys there should be no certificates.
@@ -1142,13 +1146,12 @@
                 int openssl_padding = RSA_NO_PADDING;
                 switch (padding) {
                     case PaddingMode::NONE:
-                        ASSERT_TRUE(data_size <= key_len);
+                        ASSERT_LE(data_size, key_len);
                         ASSERT_EQ(key_len, signature.size());
                         openssl_padding = RSA_NO_PADDING;
                         break;
                     case PaddingMode::RSA_PKCS1_1_5_SIGN:
-                        ASSERT_TRUE(data_size + kPkcs1UndigestedSignaturePaddingOverhead <=
-                                    key_len);
+                        ASSERT_LE(data_size + kPkcs1UndigestedSignaturePaddingOverhead, key_len);
                         openssl_padding = RSA_PKCS1_PADDING;
                         break;
                     default:
@@ -1905,7 +1908,7 @@
         }
     }
 
-    // Verified boot key should be all 0's if the boot state is not verified or self signed
+    // Verified Boot key should be all zeroes if the boot state is "orange".
     std::string empty_boot_key(32, '\0');
     std::string verified_boot_key_str((const char*)verified_boot_key.data(),
                                       verified_boot_key.size());
@@ -2229,6 +2232,33 @@
 
 namespace {
 
+std::optional<std::string> validateP256Point(const std::vector<uint8_t>& x_buffer,
+                                             const std::vector<uint8_t>& y_buffer) {
+    auto group = EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
+    if (group.get() == nullptr) {
+        return "Error creating EC group by curve name for prime256v1";
+    }
+
+    auto point = EC_POINT_Ptr(EC_POINT_new(group.get()));
+    BIGNUM_Ptr x(BN_bin2bn(x_buffer.data(), x_buffer.size(), nullptr));
+    BIGNUM_Ptr y(BN_bin2bn(y_buffer.data(), y_buffer.size(), nullptr));
+    if (!EC_POINT_set_affine_coordinates_GFp(group.get(), point.get(), x.get(), y.get(), nullptr)) {
+        return "Failed to set affine coordinates.";
+    }
+    if (!EC_POINT_is_on_curve(group.get(), point.get(), nullptr)) {
+        return "Point is not on curve.";
+    }
+    if (EC_POINT_is_at_infinity(group.get(), point.get())) {
+        return "Point is at infinity.";
+    }
+    const auto* generator = EC_GROUP_get0_generator(group.get());
+    if (!EC_POINT_cmp(group.get(), generator, point.get(), nullptr)) {
+        return "Point is equal to generator.";
+    }
+
+    return std::nullopt;
+}
+
 void check_cose_key(const vector<uint8_t>& data, bool testMode) {
     auto [parsedPayload, __, payloadParseErr] = cppbor::parse(data);
     ASSERT_TRUE(parsedPayload) << "Key parse failed: " << payloadParseErr;
@@ -2262,6 +2292,24 @@
                              "  -3 : \\{(0x[0-9a-f]{2}, ){31}0x[0-9a-f]{2}\\},\n"  // pub_y: data
                              "\\}"));
     }
+
+    ASSERT_TRUE(parsedPayload->asMap()) << "CBOR item was not a map";
+
+    ASSERT_TRUE(parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_X))
+            << "CBOR map did not contain x coordinate of public key";
+    ASSERT_TRUE(parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_X)->asBstr())
+            << "x coordinate of public key was not a bstr";
+    const auto& x = parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_X)->asBstr()->value();
+
+    ASSERT_TRUE(parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_Y))
+            << "CBOR map did not contain y coordinate of public key";
+    ASSERT_TRUE(parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_Y)->asBstr())
+            << "y coordinate of public key was not a bstr";
+    const auto& y = parsedPayload->asMap()->get(CoseKey::Label::PUBKEY_Y)->asBstr()->value();
+
+    auto errorMessage = validateP256Point(x, y);
+    EXPECT_EQ(errorMessage, std::nullopt)
+            << *errorMessage << " x: " << bin2hex(x) << " y: " << bin2hex(y);
 }
 
 }  // namespace
@@ -2364,7 +2412,7 @@
         // ATTESTATION_IDS_NOT_PROVISIONED in this case.
         ASSERT_TRUE((tag == TAG_ATTESTATION_ID_IMEI || tag == TAG_ATTESTATION_ID_MEID ||
                      tag == TAG_ATTESTATION_ID_SECOND_IMEI))
-                << "incorrect error code on attestation ID mismatch";
+                << "incorrect error code on attestation ID mismatch for " << tag;
     } else {
         ADD_FAILURE() << "Error code " << result
                       << " returned on attestation ID mismatch, should be CANNOT_ATTEST_IDS";
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index e32c2db..067db78 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -2584,7 +2584,8 @@
     auto result = GenerateKey(
             AuthorizationSetBuilder().EcdsaKey(256).Digest(Digest::NONE).SetDefaultValidity());
     ASSERT_TRUE(result == ErrorCode::UNSUPPORTED_KEY_SIZE ||
-                result == ErrorCode::UNSUPPORTED_EC_CURVE);
+                result == ErrorCode::UNSUPPORTED_EC_CURVE)
+            << "unexpected result " << result;
 }
 
 /*
@@ -2605,7 +2606,7 @@
                                       .SigningKey()
                                       .Digest(Digest::NONE)
                                       .SetDefaultValidity());
-    ASSERT_TRUE(result == ErrorCode::INVALID_ARGUMENT);
+    ASSERT_EQ(result, ErrorCode::INVALID_ARGUMENT);
 }
 
 /*
@@ -3184,7 +3185,8 @@
     string result;
     ErrorCode finish_error_code = Finish(message, &result);
     EXPECT_TRUE(finish_error_code == ErrorCode::INVALID_INPUT_LENGTH ||
-                finish_error_code == ErrorCode::INVALID_ARGUMENT);
+                finish_error_code == ErrorCode::INVALID_ARGUMENT)
+            << "unexpected error code " << finish_error_code;
 
     // Very large message that should exceed the transfer buffer size of any reasonable TEE.
     message = string(128 * 1024, 'a');
@@ -3194,7 +3196,8 @@
                                               .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)));
     finish_error_code = Finish(message, &result);
     EXPECT_TRUE(finish_error_code == ErrorCode::INVALID_INPUT_LENGTH ||
-                finish_error_code == ErrorCode::INVALID_ARGUMENT);
+                finish_error_code == ErrorCode::INVALID_ARGUMENT)
+            << "unexpected error code " << finish_error_code;
 }
 
 /*
@@ -3248,7 +3251,8 @@
                                                   .Digest(Digest::NONE)
                                                   .Digest(Digest::SHA1)
                                                   .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN));
-    ASSERT_TRUE(result == ErrorCode::UNSUPPORTED_DIGEST || result == ErrorCode::INVALID_ARGUMENT);
+    ASSERT_TRUE(result == ErrorCode::UNSUPPORTED_DIGEST || result == ErrorCode::INVALID_ARGUMENT)
+            << "unexpected result " << result;
 
     ASSERT_EQ(ErrorCode::UNSUPPORTED_DIGEST,
               Begin(KeyPurpose::SIGN,
@@ -3421,7 +3425,8 @@
         }
 
         auto rc = DeleteKey();
-        ASSERT_TRUE(rc == ErrorCode::OK || rc == ErrorCode::UNIMPLEMENTED);
+        ASSERT_TRUE(rc == ErrorCode::OK || rc == ErrorCode::UNIMPLEMENTED)
+                << "unexpected result " << rc;
     }
 }
 
@@ -5705,7 +5710,8 @@
     // is checked against those values, and found absent.
     auto result = Begin(KeyPurpose::DECRYPT, params);
     EXPECT_TRUE(result == ErrorCode::UNSUPPORTED_MGF_DIGEST ||
-                result == ErrorCode::INCOMPATIBLE_MGF_DIGEST);
+                result == ErrorCode::INCOMPATIBLE_MGF_DIGEST)
+            << "unexpected result " << result;
 }
 
 /*
@@ -5970,14 +5976,16 @@
                                                      .BlockMode(BlockMode::ECB)
                                                      .Padding(PaddingMode::NONE));
     EXPECT_TRUE(result == ErrorCode::INCOMPATIBLE_BLOCK_MODE ||
-                result == ErrorCode::UNSUPPORTED_BLOCK_MODE);
+                result == ErrorCode::UNSUPPORTED_BLOCK_MODE)
+            << "unexpected result " << result;
 
     result = Begin(KeyPurpose::ENCRYPT, AuthorizationSetBuilder()
                                                 .BlockMode(BlockMode::ECB)
                                                 .Padding(PaddingMode::NONE)
                                                 .Padding(PaddingMode::PKCS7));
     EXPECT_TRUE(result == ErrorCode::INCOMPATIBLE_PADDING_MODE ||
-                result == ErrorCode::UNSUPPORTED_PADDING_MODE);
+                result == ErrorCode::UNSUPPORTED_PADDING_MODE)
+            << "unexpected result " << result;
 }
 
 /*
@@ -8760,7 +8768,8 @@
 // Re-enable and run at your own risk.
 TEST_P(DestroyAttestationIdsTest, DISABLED_DestroyTest) {
     auto result = DestroyAttestationIds();
-    EXPECT_TRUE(result == ErrorCode::OK || result == ErrorCode::UNIMPLEMENTED);
+    EXPECT_TRUE(result == ErrorCode::OK || result == ErrorCode::UNIMPLEMENTED)
+            << "unexpected result " << result;
 }
 
 INSTANTIATE_KEYMINT_AIDL_TEST(DestroyAttestationIdsTest);
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 5467679..b9c742a 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -416,6 +416,32 @@
     check_maced_pubkey(macedPubKey, testMode, nullptr);
 }
 
+/**
+ * Generate and validate at most 2**16 production-mode keys. This aims to catch issues that do not
+ * deterministically show up. In practice, this will test far fewer keys, but a certain number are
+ * tested at a minimum.
+ */
+TEST_P(GenerateKeyTests, generateManyEcdsaP256KeysInProdMode) {
+    const auto start = std::chrono::steady_clock::now();
+    const auto time_bound = std::chrono::seconds(5);
+    const auto upper_bound = 1 << 16;
+    const auto lower_bound = 1 << 8;
+    for (auto iteration = 0; iteration < upper_bound; iteration++) {
+        MacedPublicKey macedPubKey;
+        bytevec privateKeyBlob;
+        bool testMode = false;
+        auto status =
+                provisionable_->generateEcdsaP256KeyPair(testMode, &macedPubKey, &privateKeyBlob);
+        ASSERT_TRUE(status.isOk());
+        vector<uint8_t> coseKeyData;
+        check_maced_pubkey(macedPubKey, testMode, &coseKeyData);
+        const auto current_time = std::chrono::steady_clock::now() - start;
+        if (iteration >= lower_bound && current_time >= time_bound) {
+            break;
+        }
+    }
+}
+
 class CertificateRequestTestBase : public VtsRemotelyProvisionedComponentTests {
   protected:
     CertificateRequestTestBase()
diff --git a/security/see/Android.bp b/security/see/Android.bp
new file mode 100644
index 0000000..ba873e0
--- /dev/null
+++ b/security/see/Android.bp
@@ -0,0 +1,5 @@
+dirgroup {
+    name: "trusty_dirgroup_hardware_interfaces_security_see",
+    dirs: ["."],
+    visibility: ["//trusty/vendor/google/aosp/scripts"],
+}
diff --git a/security/see/OWNERS b/security/see/OWNERS
new file mode 100644
index 0000000..d1a606f
--- /dev/null
+++ b/security/see/OWNERS
@@ -0,0 +1,5 @@
+# include OWNERS from the top level trusty repo
+include trusty:main:/OWNERS
+
+paulcrowley@google.com
+swillden@google.com
diff --git a/security/see/authmgr/aidl/Android.bp b/security/see/authmgr/aidl/Android.bp
new file mode 100644
index 0000000..a32d4e9
--- /dev/null
+++ b/security/see/authmgr/aidl/Android.bp
@@ -0,0 +1,57 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+aidl_interface {
+    name: "android.hardware.security.see.authmgr",
+    vendor_available: true,
+    srcs: [
+        "android/hardware/security/see/authmgr/*.aidl",
+    ],
+    stability: "vintf",
+    frozen: false,
+    backend: {
+        java: {
+            platform_apis: true,
+        },
+        ndk: {
+            enabled: true,
+        },
+        rust: {
+            enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.virt",
+            ],
+        },
+    },
+}
+
+// A rust_defaults that includes the latest authmgr AIDL library.
+// Modules that depend on authmgr directly can include this rust_defaults to avoid
+// managing dependency versions explicitly.
+rust_defaults {
+    name: "authmgr_use_latest_hal_aidl_rust",
+    rustlibs: [
+        "android.hardware.security.see.authmgr-V1-rust",
+    ],
+}
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceChainEntry.aidl
similarity index 87%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceChainEntry.aidl
index ea3a173..b775f95 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceChainEntry.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+package android.hardware.security.see.authmgr;
+@RustDerive(Clone=true, Eq=true, PartialEq=true) @VintfStability
+parcelable DiceChainEntry {
+  byte[] diceChainEntry;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl
similarity index 82%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl
index d88d5c8..0f61900 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-parcelable MemoryBufferParameter {
-  android.hardware.security.see.hwcrypto.MemoryBufferParameter.MemoryBuffer bufferHandle;
-  int sizeBytes;
-  union MemoryBuffer {
-    ParcelFileDescriptor input;
-    ParcelFileDescriptor output;
-  }
+package android.hardware.security.see.authmgr;
+@RustDerive(Clone=true, Eq=true, PartialEq=true) @VintfStability
+parcelable DiceLeafArtifacts {
+  android.hardware.security.see.authmgr.DiceChainEntry diceLeaf;
+  android.hardware.security.see.authmgr.DicePolicy diceLeafPolicy;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DicePolicy.aidl
similarity index 87%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DicePolicy.aidl
index ea3a173..f434c3c 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/DicePolicy.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+package android.hardware.security.see.authmgr;
+@RustDerive(Clone=true, Eq=true, PartialEq=true) @VintfStability
+parcelable DicePolicy {
+  byte[] dicePolicy;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/Error.aidl
similarity index 64%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/Error.aidl
index 5c26cc2..9e6a501 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/Error.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,7 +31,24 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.authmgr;
+@Backing(type="int") @VintfStability
+enum Error {
+  OK = 0,
+  AUTHENTICATION_ALREADY_STARTED = (-1) /* -1 */,
+  INSTANCE_ALREADY_AUTHENTICATED = (-2) /* -2 */,
+  INVALID_DICE_CERT_CHAIN = (-3) /* -3 */,
+  INVALID_DICE_LEAF = (-4) /* -4 */,
+  INVALID_DICE_POLICY = (-5) /* -5 */,
+  DICE_POLICY_MATCHING_FAILED = (-6) /* -6 */,
+  SIGNATURE_VERIFICATION_FAILED = (-7) /* -7 */,
+  CONNECTION_HANDOVER_FAILED = (-8) /* -8 */,
+  CONNECTION_NOT_AUTHENTICATED = (-9) /* -9 */,
+  NO_CONNECTION_TO_AUTHORIZE = (-10) /* -10 */,
+  INVALID_INSTANCE_IDENTIFIER = (-11) /* -11 */,
+  MEMORY_ALLOCATION_FAILED = (-12) /* -12 */,
+  INSTANCE_PENDING_DELETION = (-13) /* -13 */,
+  CLIENT_PENDING_DELETION = (-14) /* -14 */,
+  AUTHENTICATION_NOT_STARTED = (-15) /* -15 */,
+  INSTANCE_CONTEXT_CREATION_DENIED = (-16) /* -16 */,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl
similarity index 87%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl
index ea3a173..18d90eb 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+package android.hardware.security.see.authmgr;
+@RustDerive(Clone=true, Eq=true, PartialEq=true) @VintfStability
+parcelable ExplicitKeyDiceCertChain {
+  byte[] diceCertChain;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl
similarity index 70%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl
index 5c26cc2..a120b49 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,7 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.authmgr;
+@VintfStability
+interface IAuthMgrAuthorization {
+  byte[32] initAuthentication(in android.hardware.security.see.authmgr.ExplicitKeyDiceCertChain diceCertChain, in @nullable byte[] instanceIdentifier);
+  void completeAuthentication(in android.hardware.security.see.authmgr.SignedConnectionRequest signedConnectionRequest, in android.hardware.security.see.authmgr.DicePolicy dicePolicy);
+  void authorizeAndConnectClientToTrustedService(in byte[] clientID, String serviceName, in byte[32] token, in android.hardware.security.see.authmgr.DiceLeafArtifacts clientDiceArtifacts);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl
similarity index 86%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl
index ea3a173..46d8373 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/authmgr/aidl/aidl_api/android.hardware.security.see.authmgr/current/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 The Android Open Source Project
+ * Copyright (C) 2024 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+package android.hardware.security.see.authmgr;
+@RustDerive(Clone=true, Eq=true, PartialEq=true) @VintfStability
+parcelable SignedConnectionRequest {
+  byte[] signedConnectionRequest;
 }
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceChainEntry.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceChainEntry.aidl
new file mode 100644
index 0000000..3b4a35b
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceChainEntry.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+/**
+ * A CBOR encoded DICE certificate.
+ */
+@VintfStability
+@RustDerive(Clone=true, Eq=true, PartialEq=true)
+parcelable DiceChainEntry {
+    /**
+     * Data is CBOR encoded according to the `DiceChainEntry` CDDL in
+     * hardware/interfaces/security/rkp/aidl/android/hardware/security/keymint/
+     * generateCertificateRequestV2.cddl
+     */
+    byte[] diceChainEntry;
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl
new file mode 100644
index 0000000..333096f
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DiceLeafArtifacts.aidl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+import android.hardware.security.see.authmgr.DiceChainEntry;
+import android.hardware.security.see.authmgr.DicePolicy;
+
+/**
+ * This contains the DICE certificate and the DICE policy created for the client by the AuthMgr FE.
+ */
+@VintfStability
+@RustDerive(Clone=true, Eq=true, PartialEq=true)
+parcelable DiceLeafArtifacts {
+    DiceChainEntry diceLeaf;
+    DicePolicy diceLeafPolicy;
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DicePolicy.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DicePolicy.aidl
new file mode 100644
index 0000000..4b55330
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/DicePolicy.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+/**
+ * DICE policy - CBOR encoded according to DicePolicy.cddl.
+ */
+@VintfStability
+@RustDerive(Clone=true, Eq=true, PartialEq=true)
+parcelable DicePolicy {
+    /**
+     * Data is CBOR encoded according to the `DicePolicy` CDDL in
+     * hardware/interfaces/security/authgraph/aidl/android/hardware/security/authgraph/
+     * DicePolicy.cddl
+     */
+    byte[] dicePolicy;
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/Error.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/Error.aidl
new file mode 100644
index 0000000..f7c3592
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/Error.aidl
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+/**
+ * AuthMgr error codes. Aidl will return these error codes as service specific errors in
+ * EX_SERVICE_SPECIFIC.
+ */
+@VintfStability
+@Backing(type="int")
+enum Error {
+    /** Success */
+    OK = 0,
+
+    /** Duplicated attempt to start authentication from the same transport ID */
+    AUTHENTICATION_ALREADY_STARTED = -1,
+
+    /** Duplicated authenticated attempt with the same instance ID */
+    INSTANCE_ALREADY_AUTHENTICATED = -2,
+
+    /** Invalid DICE certificate chain of the AuthMgr FE */
+    INVALID_DICE_CERT_CHAIN = -3,
+
+    /** Invalid DICE leaf of the client */
+    INVALID_DICE_LEAF = -4,
+
+    /** Invalid DICE policy */
+    INVALID_DICE_POLICY = -5,
+
+    /** The DICE chain to policy matching failed */
+    DICE_POLICY_MATCHING_FAILED = -6,
+
+    /** Invalid signature */
+    SIGNATURE_VERIFICATION_FAILED = -7,
+
+    /** Failed to handover the connection to the trusted service */
+    CONNECTION_HANDOVER_FAILED = -8,
+
+    /**
+     * An authentication required request (e.g. phase 2) is invoked on a non-authenticated
+     * connection
+     */
+    CONNECTION_NOT_AUTHENTICATED = -9,
+
+    /** There is no pending connection with a matching token to authorize in phase 2 */
+    NO_CONNECTION_TO_AUTHORIZE = -10,
+
+    /** Invalid instance identifier */
+    INVALID_INSTANCE_IDENTIFIER = -11,
+
+    /** Failed to allocate memory */
+    MEMORY_ALLOCATION_FAILED = -12,
+
+    /** An instance which is pending deletion is trying to authenticate */
+    INSTANCE_PENDING_DELETION = -13,
+
+    /** A client which is pending deletion is trying to authorize */
+    CLIENT_PENDING_DELETION = -14,
+
+    /** Trying to complete authentication for an instance for which authentication is not started */
+    AUTHENTICATION_NOT_STARTED = -15,
+
+    /** Creation of the pVM instance's context in the secure storage is not allowed */
+    INSTANCE_CONTEXT_CREATION_DENIED = -16,
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl
new file mode 100644
index 0000000..de23530
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/ExplicitKeyDiceCertChain.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+/**
+ * DICE certificate chain - CBOR encoded according to ExplicitKeyDiceCertChain.cddl.
+ */
+@VintfStability
+@RustDerive(Clone=true, Eq=true, PartialEq=true)
+parcelable ExplicitKeyDiceCertChain {
+    /**
+     * Data is CBOR encoded according to the `ExplicitKeyDiceCertChain` CDDL in
+     * hardware/interfaces/security/authgraph/aidl/android/hardware/security/authgraph/
+     * ExplicitKeyDiceCertChain.cddl
+     */
+    byte[] diceCertChain;
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl
new file mode 100644
index 0000000..43c3bde
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/IAuthMgrAuthorization.aidl
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+import android.hardware.security.see.authmgr.DiceLeafArtifacts;
+import android.hardware.security.see.authmgr.DicePolicy;
+import android.hardware.security.see.authmgr.ExplicitKeyDiceCertChain;
+import android.hardware.security.see.authmgr.SignedConnectionRequest;
+
+/**
+ * This is the interface to be implemented by an AuthMgr backend component (AuthMgr BE), in order to
+ * allow the AuthMgr frontend component (AuthMgr FE) in a pVM instance to authenticate itself and
+ * to authorize one or more clients in the pVM instance, in order to let the clients access
+ * trusted services in the Trusted Execution Environment (TEE).
+ *
+ * The following assumptions must be true for the underlying IPC mechanism and the transport layer:
+ *     1. Both parties should be able to retrieve a non-spoofable identifier of the other party from
+ *        the transport layer (a.k.a transport ID or vM ID), which stays the same throughout a given
+ *        boot cycle of a pVM instance. This is important to prevent person-in-the-middle (PITM)
+ *        attacks and to authorize a new connection from a pVM instance based on an already
+ *        authenicated connection from the same pVM instance.
+ *
+ *     2. Each of AuthMgr FE and the AuthMgr BE should be able to hand over a connection that is
+ *        setup between them to another party so that such connection can be used for communication
+ *        between the two new parties subsequently. This is important to be able to handover an
+ *        authorized connection established between the AuthMgr FE and the AuthMgr BE to a client in
+ *        in a pVM instance and a trusted service in TEE respectively.
+ *
+ *     3. This API should be exposed over an IPC mechanism that supports statefull connections. This
+ *        is important for the AuthMgr FE to setup an authenicated connection once per boot cycle
+ *        and reuse it to authorize multiple client connections afterwards, if needed.
+ *
+ *      4. AuthMgr FE has a mechanism for discovering and establishing a connection to the trusted
+ *         AuthMgr BE. Based on this assumptionson, mutual authentication is not covered by this
+ *         API.
+ *
+ * The AuthMgr authorization protocol consists of two phases:
+ *     1. Phase 1 authenticates the AuthMgr FE to the AuthMgr BE via the first two methods of this
+ *        API: `initAuthentication` and `completeAuthentication`. At the end of the successful
+ *        excecution of phase 1, the AuthMgr FE and the AuthMgr BE have an authenticated connection
+ *        established between them. Phase 1 also enforces rollback protection on AuthMgr FE in
+ *        addition to authentication.
+ *
+ *        Authentication is performed by verifying the AuthMgr FE's signature on the challenge
+ *        issued by the AuthMgr BE. The public signing key of the AuthMgr FE is obtained from the
+ *        validated DICE certificate chain for verifying the signature. Rollback protection is
+ *        enforced by matching the DICE certificate chain against the stored DICE policy.
+ *        AuthMgr FE uses this authenticated connection throughout the boot cycle of the pVM to send
+ *        phase 2 requests to the AuthMgr BE. Therefore, phase 1 needs to be executed only once per
+ *        boot cycle of the pVM. AuthMgr BE should take measures to prevent any duplicate
+ *        authentication attempts from the same instance or from any impersonating instances.
+ *
+ *     2. Phase 2 authorizes a client in the pVM to access trusted service(s) in the TEE and
+ *        establishes a new connection between the client and the trusted service based on the trust
+ *        in the authenticated connection established in phase 1. The client and the trusted service
+ *        can communicate independently from the AuthMgr(s) after the successful execution of
+ *        phase 2 of the authorization protocol.
+ *
+ *        The AuthMgr FE first opens a new vsock connection to the AuthMgr BE and sends a one-time
+ *        token over that connection. The AuthMgr FE then invokes the third method of this API
+ *        (`authorizeAndConnectClientToTrustedService`) on the authenticated connection established
+ *        with the AuthMgr BE in phase 1. Rollback protection is enforced on the client by matching
+ *        the client's DICE certificate against the stored DICE policy. The new connection is
+ *        authorized by matching the token sent over the new connection and the token sent over the
+ *        authenicated connection.
+ *
+ * AuthMgr BE should make sure that "use-after-destroy" threats are prevented in the implementation
+ * of this authorization protocol. This means that even if a client/pVM instance is created with the
+ * same identifier(s) of a deleted client/pVM instance, the new client should not be able to access
+ * the deleted client's secrets/resources created in the trusted services. The following
+ * requirements should be addressed in order to ensure this:
+ * 1) Each client should be identified by a unique identifier at the AuthMgr BE. The uniqueness
+ *    should be guaranteed across factory resets.
+ * 2) The client's unique identifier should be used when constructing the file path to store the
+ *    client's context, including the client's DICE policy, in the AuthMgr BE's secure storage.
+ * 3) The client's unique identifier should be conveyed to the trusted service(s) that the client
+ *    accesses, when an authorized connection is setup between the client and the trusted service in
+ *    phase 2. The trusted service(s) should mix in this unique client identifier when providing the
+ *    critical services to the clients (e.g. deriving HW-backed keys by the HWCrypto service,
+ *    storing data by the SecureStorage service).
+ *
+ * An example approach to build a unique identifier for a client is as follows:
+ * The AuthMgr BE stores a `global sequence number` in the secure storage that does not get
+ * wiped upon factory reset. Everytime the AuthMgr BE sees a new instance or a client, it assigns
+ * the current `global sequence number` as the unique sequence number of the instance or the client
+ * and increments the `global sequence number`.
+ */
+@VintfStability
+interface IAuthMgrAuthorization {
+    /**
+     * AuthMgr FE initiates the challenge-response protocol with the AuthMgr BE in order to
+     * authenticate the AuthMgr FE to the AuthMgr BE. AuthMgr BE creates and returns a challenge
+     * (a cryptographic random of 32 bytes) to the AuthMgr FE.
+     *
+     * The AuthMgr BE extracts the instance identifier from the DICE certificate chain of the
+     * AuthMgr FE (given in the input: `diceCertChain`). If the instance identifier is not included
+     * in the DICE certificate chain, then it should be sent in the optional
+     * input: `instanceIdentifier`. The instance identifier is used by the AuthMgr BE in this step
+     * to detect and reject any duplicate authentication attempts.
+     * The instance identifier is used in step 2 to build the file path in the secure storage to
+     * store the instance's context.
+     *
+     * If authentication is already started (but not completed) from the same transport ID, return
+     * the error code `AUTHENTICATION_ALREADY_STARTED`.
+     *
+     * @param diceCertChain - DICE certificate chain of the AuthMgr FE.
+     *
+     * @param instanceIdentifier - optional parameter to send the instance identifier, if it is not
+     *                             included in the DICE certificate chain
+     *
+     * @return challenge to be included in the signed response sent by the AuthMgr FE in
+     *         `completeAuthentication`
+     *
+     * @throws ServiceSpecificException:
+     *         Error::INSTANCE_ALREADY_AUTHENTICATED - when a pVM instance with the same
+     *         `instanceIdentifier` or the same transport id has already been authenticated.
+     *         Error::AUTHENTICATION_ALREADY_STARTED - when a pVM instance with the same
+     *         the same transport id has already started authentication
+     */
+    byte[32] initAuthentication(in ExplicitKeyDiceCertChain diceCertChain,
+            in @nullable byte[] instanceIdentifier);
+
+    /**
+     * AuthMgr FE invokes this method to complete phase 1 of the authorization protocol. The AuthMgr
+     * BE verifies the signature in `signedConnectionRequest` with the public signing key of the
+     * AuthMgr FE obtained from the DICE certificate chain.
+     *
+     * As per the CDDL for `SignedConnectionRequest` in SignedConnectionRequest.cddl, the AuthMgr FE
+     * includes the challenge sent by the AuthMgr BE and the unique transport IDs of the AuthMgr FE
+     * and AuthMgr BE in the signed response. This is to prevent replay attacks in the presence of
+     * more than one AuthMgr BE, where one AuthMgr BE may impersonate a pVM instance/AuthMgr FE to
+     * another AuthMgr BE. Both transport IDs are included for completeness, although it is
+     * sufficient to include either of them for the purpose of preventing such attacks.
+     *
+     * AuthMgr BE validates the DICE certificate chain by verifying all the signatures in the chain
+     * and by checking wither the root public key is trusted.
+     *
+     * The AuthMgr BE matches the DICE certificate chain of the AuthMgr FE to the DICE policy given
+     * in the input: `dicePolicy`. If this is the first invocation of this method during the
+     * lifetime of the AuthMgr FE, the AuthMgr BE stores the DICE policy in the secure storage as
+     * part of the pVM instance's context, upon successful matching of DICE chain to the policy.
+     * The file path for the storage of the pVM context is constructed using the instance
+     * identifier. Note that the creation of a pVM instance's context in the secure storage is
+     * allowed only during the factory, for the first version of this API. In the future, we expect
+     * to allow the creation of a pVM instance's context in the secure storage even after the device
+     * leaves the factory, based on hard-coded DICE policies and/or via a separate
+     * `IAuthMgrInstanceContextMaintenance` API.
+     *
+     * In the subsequent invocations of this method, the AuthMgr BE matches the given DICE chain
+     * to the stored DICE policy in order to enforce rollback protection. If that succeeds and if
+     * the given DICE poliy is different from the stored DICE policy, the AuthMgr BE replaces the
+     * stored DICE policy with the given DICE policy.
+     *
+     * Upon successful execution of this method, the AuthMgr BE should store some state associated
+     * with the connection, in order to distinguish authenicated connections from any
+     * non-authenticated connections. The state associated with the connection may cache certain
+     * artifacts such as instance identifier, instance sequence number, transport ID, DICE chain
+     * and DICE policy of the AuthMgr FE, so that they can be reused when serving phase 2 requests.
+     * The requests for phase 2 of the authorization protocol are allowed only on authenticated
+     * connections.
+     *
+     * @param signedConnectionRequest - signature from AuthMgr FE (CBOR encoded according to
+     *                                  SignedConnectionRequest.cddl)
+     *
+     * @param dicePolicy - DICE policy of the AuthMgr FE
+     *
+     * @throws ServiceSpecificException:
+     *         Error::AUTHENTICATION_NOT_STARTED - when the authentication process has not been
+     *             started for the pVM instance.
+     *         Error::INSTANCE_ALREADY_AUTHENTICATED - when a pVM instance with the same
+     *         `instanceIdentifier` or the same transport id has already been authenticated.
+     *         Error::SIGNATURE_VERIFICATION_FAILED - when the signature verification fails.
+     *         Error::INVALID_DICE_CERT_CHAIN - when the DICE certificate chain validation fails.
+     *         Error::DICE_POLICY_MATCHING_FAILED - when the DICE certificate chain to DICE policy
+     *             matching fails for the pVM instance.
+     *         Error::INSTANCE_CONTEXT_CREATION_DENIED - when the creation of the pVM instances's
+     *             context in the AuthMgr BE is not allowed.
+     *         Error::INSTANCE_PENDING_DELETION - when a pVM that is being deleted is trying to
+     *             authenticate.
+     *
+     */
+    void completeAuthentication(
+            in SignedConnectionRequest signedConnectionRequest, in DicePolicy dicePolicy);
+
+    /**
+     * When the AuthMgr FE receives a request from a client to access a trusted service, the
+     * AuthMgr FE first creates a new (out-of-band) connection with the AuthMgr BE and sends a
+     * one-time cryptographic token of 32 bytes over that new connection.
+     *
+     * The AuthMgr FE then invokes this method on the authenticated connection established with the
+     * AuthMgr BE in phase 1. When this method is invoked, the AuthMgr BE checks whether the
+     * underlying connection of this method call is already authenticated.
+     *
+     * The AuthMgr FE acts as the DICE manager for all the clients in the pVM and generates the DICE
+     * leaf certificate and the DICE leaf policy for the client, which are sent in the input:
+     * `clientDiceArtifacts`.
+     *
+     * The AuthMgr BE matches the client's DICE leaf certificate to the client's DICE policy.
+     * If this is the first invocation of this method in the lifetime of the client, the AuthMgr BE
+     * stores the client's DICE policy in the secure storage as part of the client's context, upon
+     * successful matching of the DICE certificate to the policy. The file path for the storage of
+     * the client's context should be constructed using the unique id assigned to the pVM instance
+     * by the AuthMgr BE (e.g. instance sequence number)  and the client ID. There is no use
+     * case for deleting a client context or a pVM context created in the secure storage, for the
+     * first version of this API, outside of the factory reset. In the future, we expect to
+     * expose APIs for those tasks.
+     *
+     * In the subsequent invocations of this method, the AuthMgr BE matches the given DICE leaf
+     * certificate to the stored DICE policy in order to enforce rollback protection. If that
+     * succeeds and if the given DICE policy is different from the stored DICE policy, the AuthMgr
+     * BE replaces the stored DICE policy with the given DICE policy.
+     *
+     * If the same client requests multiple trusted services or connects to the same trusted service
+     * multiple times during the same boot cycle of the pVM instance, it is recommended to validate
+     * the client's DICE artifacts only once for a given client as an optimization.
+     *
+     * The AuthMgr BE keeps track of the aforementioned new connections that are pending
+     * authorization along with the tokens sent over them and the transport ID of the pVM instance
+     * which created those connections.
+     *
+     * The AuthMgr FE sends the same token that was sent over an aforementioned new connection
+     * in the input: `token` of this method call, in order to authorize the new connection, based on
+     * the trust in the authenticated connection established in phase 1.
+     *
+     * Once the validation of the client's DICE artifacts is completed, the AuthMgr BE retrieves the
+     * pending new connection to be authorized, which is associated with a token that matches the
+     * token sent in this method call and a transport ID that matches the transport ID associated
+     * with the connection underlying this method call.
+     *
+     * Next the AuthMgr BE connects to the trusted service requested by the client in order to
+     * handover the new authorized connection to the trusted service. Once the connection
+     * handover is successful, the AuthMgr BE returns OK to the AuthMgr FE. Then the AuthMgr FE
+     * returns to the client a handle to the new connection (created at the beginning of phase 2).
+     * At this point, an authorized connection is setup between the client and the trusted service,
+     * which they can use to communicate independently of the AuthMgr FE and the AuthMgr BE.
+     *
+     * @param clientID - the identifier of the client in the pVM instance, which is unique in the
+     *                   context of the pVM instance
+     *
+     * @param service name - the name of the trusted service requested by the client
+     *
+     * @param token - the one-time token used to authorize the new connection created between the
+     *                AuthMgr FE and the AuthMgr BE
+     *
+     * @param clientDiceArtifacts - DICE leaf certificate and the DICE leaf policy of the client
+     *
+     * @throws ServiceSpecificException:
+     *         Error::CONNECTION_NOT_AUTHENTICATED - when the underlying connection of this method
+     *             call is not authenticated.
+     *         Error::DICE_POLICY_MATCHING_FAILED - when the DICE certificate chain to DICE policy
+     *             matching fails for the client.
+     *         Error::NO_CONNECTION_TO_AUTHORIZE - when there is no pending new connection that
+     *             is associated with a token and a transport ID that matches those of this
+     *             method call.
+     *         Error::CONNECTION_HANDOVER_FAILED - when the hanover of the authorized connection to
+     *             the trusted service fails.
+     *         Error::CLIENT_PENDING_DELETION - when a client that is being deleted is trying to be
+     *             authorized.
+     */
+    void authorizeAndConnectClientToTrustedService(in byte[] clientID, String serviceName,
+            in byte[32] token, in DiceLeafArtifacts clientDiceArtifacts);
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl
new file mode 100644
index 0000000..f258603
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.security.see.authmgr;
+
+/**
+ * The response from the AuthMgr FE which includes the challenge sent by the AuthMgr BE and other
+ * information signed by the AuthMgr FE's signing key.
+ */
+
+@VintfStability
+@RustDerive(Clone=true, Eq=true, PartialEq=true)
+parcelable SignedConnectionRequest {
+    /* Data is CBOR encoded according the CDDL in ./SignedConnectionRequest.cddl */
+    byte[] signedConnectionRequest;
+}
diff --git a/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.cddl b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.cddl
new file mode 100644
index 0000000..a74ccd7
--- /dev/null
+++ b/security/see/authmgr/aidl/android/hardware/security/see/authmgr/SignedConnectionRequest.cddl
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+SignedConnectionRequestProtected = {
+    1 : AlgorithmEdDSA / AlgorithmES256,
+}
+
+SignedConnectionRequest = [ ; COSE_Sign1 (untagged) [RFC9052 s4.2]
+    protected: bstr .cbor SignedConnectionRequesProtected,
+    unprotected: {},
+    payload: bstr .cbor ConnectionRequest,
+    signature: bstr     ; PureEd25519(privateKey, SignedResponseSigStruct) /
+                        ; ECDSA(privateKey, SignedResponseSigStruct)
+]
+
+ConnectionRequestSigStruct = [ ; Sig_structure for SignedConnectionRequest [ RFC9052 s4.4]
+    context: "Signature1",
+    body_protected: bstr .cbor SignedConnectionRequesProtected,
+    external_aad: bstr .cbor ExternalAADForDICESignedConnectionRequest,
+    payload: bstr .cbor ConnectionRequest,
+]
+
+; The payload structure signed by the DICE signing key
+ConnectionRequest [
+    challenge: bstr .size 32,
+    transport_type: TransportType,  ; this indicates what CBOR structure should be exected for the
+                                    ; next element (i.e. transport_id_info)
+    transport_id_info: TransportIdInfo, ; this information is used to detect person-in-the-middle
+                                        ; attacks
+]
+
+; The unique id assigned to the `ConnectionRequest` payload structure
+ConnectionRequestUuid = h'34c82916 9579 4d86 baef 592a066419e4' ; bstr .size 16 (UUID v4 - RFC 9562)
+
+; An integer that identifies the type of the transport used for communication between clients and
+; trusted services
+TransportType = &(
+    FFA: 1,
+    ; Any other transport type(s) also be defined here
+)
+
+; Identity information of the peers provided by the transport layer
+TransportIdInfo = &(
+    FFATransportId,
+    ; Any other type(s) containing transport layer identity information should also be defiend here
+)
+
+; Transport ids (a.k.a VM IDs) provided by the FFA transport
+FFATransportId = [
+    feID: uint .size 2, ; FF-A partition ID of the AuthMgr FE
+    beID: uint .size 2, ; FF-A partition ID of the AuthMgr BE
+]
+
+; External AAD to be added to any Sig_structure signed by the DICE signing key, with the mandatory
+; field of `uuid_of_payload_struct` of type UUID v4 (RFC 9562). This field is required to ensure
+; that both the signer and the verifier refer to the same payload structure, given that there are
+; various payload structures signed by the DICE signing key in different protocols in Android.
+ExternalAADForDICESigned = [
+    uuid_of_payload_struct: buuid,
+]
+
+; RFC8610 - Section 3.6
+buuid = #6.37(bstr .size 16)
+
+ExternalAADForDICESignedConnectionRequest = [ ; ExternalAADForDICESigned for ConnectionRequest
+    uuid_of_payload_struct: #6.37(ConnectionRequestUuid),
+]
+
+AlgorithmES256 = -7              ; [RFC9053 s2.1]
+AlgorithmEdDSA = -8              ; [RFC9053 s2.2]
diff --git a/security/see/authmgr/aidl/vts/Android.bp b/security/see/authmgr/aidl/vts/Android.bp
new file mode 100644
index 0000000..3d6fce2
--- /dev/null
+++ b/security/see/authmgr/aidl/vts/Android.bp
@@ -0,0 +1,36 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["Android-Apache-2.0"],
+    default_team: "trendy_team_trusty",
+}
+
+rust_test {
+    name: "VtsAidlAuthMgrNonExistentTest",
+    srcs: ["test.rs"],
+    require_root: true,
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+    rustlibs: [
+        "libbinder_rs",
+    ],
+}
diff --git a/security/see/authmgr/aidl/vts/test.rs b/security/see/authmgr/aidl/vts/test.rs
new file mode 100644
index 0000000..45533a7
--- /dev/null
+++ b/security/see/authmgr/aidl/vts/test.rs
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! Test for asserting the non-existence of an IAuthMgrAuthorization.aidl
+
+#![cfg(test)]
+
+use binder;
+
+const AUTHMGR_INTERFACE_NAME: &str = "android.hardware.security.see.authmgr.IAuthMgrAuthorization";
+
+#[test]
+fn test_authmgr_non_existence() {
+    let authmgr_instances =  match binder::get_declared_instances(AUTHMGR_INTERFACE_NAME) {
+        Ok(vec) => vec,
+        Err(e) => {
+            panic!("failed to retrieve the declared interfaces for AuthMgr: {:?}", e);
+        }
+    };
+    assert!(authmgr_instances.is_empty());
+}
diff --git a/staging/security/see/hwcrypto/aidl/Android.bp b/security/see/hwcrypto/aidl/Android.bp
similarity index 76%
rename from staging/security/see/hwcrypto/aidl/Android.bp
rename to security/see/hwcrypto/aidl/Android.bp
index 0a7e8be..e15f494 100644
--- a/staging/security/see/hwcrypto/aidl/Android.bp
+++ b/security/see/hwcrypto/aidl/Android.bp
@@ -8,10 +8,8 @@
 }
 
 aidl_interface {
-    name: "android.hardware.security.see",
-    unstable: false,
-    // TODO Remove this owner field when this interface is moved out of /staging
-    owner: "google_while_staging",
+    name: "android.hardware.security.see.hwcrypto",
+    stability: "vintf",
     host_supported: true,
     srcs: [
         "android/hardware/security/see/hwcrypto/*.aidl",
@@ -22,10 +20,15 @@
             enabled: false,
         },
         cpp: {
-            enabled: false,
+            enabled: true,
         },
         rust: {
             enabled: true,
         },
+        ndk: {
+            enabled: true,
+        },
     },
+    frozen: false,
+    system_ext_specific: true,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
index 0a7e7a2..fd2904b 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 union CryptoOperation {
   android.hardware.security.see.hwcrypto.MemoryBufferParameter setMemoryBuffer;
   android.hardware.security.see.hwcrypto.OperationParameters setOperationParameters;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
index 05780e1..66bed55 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable CryptoOperationErrorAdditionalInfo {
   long failingCommandIndex;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
index 1088e27..7996b9a 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable CryptoOperationResult {
   @nullable android.hardware.security.see.hwcrypto.ICryptoOperationContext context;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
index f3b9b43..75bb0dc 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable CryptoOperationSet {
   @nullable android.hardware.security.see.hwcrypto.ICryptoOperationContext context;
   android.hardware.security.see.hwcrypto.CryptoOperation[] operations;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
index 472215f..7646656 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
@@ -32,5 +32,6 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 interface ICryptoOperationContext {
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
similarity index 94%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
index 6837a2f..83b8496 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 interface IHwCryptoKey {
   android.hardware.security.see.hwcrypto.IHwCryptoKey.DiceCurrentBoundKeyResult deriveCurrentDicePolicyBoundKey(in android.hardware.security.see.hwcrypto.IHwCryptoKey.DiceBoundDerivationKey derivationKey);
   android.hardware.security.see.hwcrypto.IHwCryptoKey.DiceBoundKeyResult deriveDicePolicyBoundKey(in android.hardware.security.see.hwcrypto.IHwCryptoKey.DiceBoundDerivationKey derivationKey, in byte[] dicePolicyForKeyVersion);
@@ -40,10 +41,14 @@
   android.hardware.security.see.hwcrypto.IOpaqueKey importClearKey(in android.hardware.security.see.hwcrypto.types.ExplicitKeyMaterial keyMaterial, in android.hardware.security.see.hwcrypto.KeyPolicy newKeyPolicy);
   byte[] getCurrentDicePolicy();
   android.hardware.security.see.hwcrypto.IOpaqueKey keyTokenImport(in android.hardware.security.see.hwcrypto.types.OpaqueKeyToken requestedKey, in byte[] sealingDicePolicy);
+  android.hardware.security.see.hwcrypto.IOpaqueKey getKeyslotData(android.hardware.security.see.hwcrypto.IHwCryptoKey.KeySlot slotId);
   enum DeviceKeyId {
     DEVICE_BOUND_KEY,
     BATCH_KEY,
   }
+  enum KeySlot {
+    KEYMINT_SHARED_HMAC_KEY,
+  }
   union DiceBoundDerivationKey {
     android.hardware.security.see.hwcrypto.IOpaqueKey opaqueKey;
     android.hardware.security.see.hwcrypto.IHwCryptoKey.DeviceKeyId keyId;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
index 5c26cc2..7c87dd3 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 interface IHwCryptoOperations {
   android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
similarity index 90%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
index c74e71f..1121f01 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
@@ -32,9 +32,11 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 interface IOpaqueKey {
   byte[] exportWrappedKey(in android.hardware.security.see.hwcrypto.IOpaqueKey wrappingKey);
   android.hardware.security.see.hwcrypto.KeyPolicy getKeyPolicy();
   byte[] getPublicKey();
   android.hardware.security.see.hwcrypto.types.OpaqueKeyToken getShareableToken(in byte[] sealingDicePolicy);
+  void setProtectionId(in android.hardware.security.see.hwcrypto.types.ProtectionId protectionId, in android.hardware.security.see.hwcrypto.types.OperationType[] allowedOperations);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
index 0e3896e..ca114c3 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable KeyPolicy {
   android.hardware.security.see.hwcrypto.types.KeyUse usage;
   android.hardware.security.see.hwcrypto.types.KeyLifetime keyLifetime = android.hardware.security.see.hwcrypto.types.KeyLifetime.EPHEMERAL;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
index d88d5c8..1c49297 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable MemoryBufferParameter {
   android.hardware.security.see.hwcrypto.MemoryBufferParameter.MemoryBuffer bufferHandle;
   int sizeBytes;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl
similarity index 95%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl
index 017e51c..d6f57ab 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/OperationParameters.aidl
@@ -32,7 +32,9 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 union OperationParameters {
   android.hardware.security.see.hwcrypto.types.SymmetricAuthOperationParameters symmetricAuthCrypto;
   android.hardware.security.see.hwcrypto.types.SymmetricOperationParameters symmetricCrypto;
+  android.hardware.security.see.hwcrypto.types.HmacOperationParameters hmac;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl
index 0fd1ee7..7b9924e 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/PatternParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto;
+@VintfStability
 parcelable PatternParameters {
   long numberBlocksProcess;
   long numberBlocksCopy;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
index e7501ff..6ad2c09 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union AesCipherMode {
   android.hardware.security.see.hwcrypto.types.CipherModeParameters cbc;
   android.hardware.security.see.hwcrypto.types.CipherModeParameters ctr;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
index 4084abb..68ad142 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union AesGcmMode {
   android.hardware.security.see.hwcrypto.types.AesGcmMode.AesGcmModeParameters gcmTag16;
   parcelable AesGcmModeParameters {
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl
index f4bf786..78b1ff8 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/AesKey.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union AesKey {
   byte[16] aes128 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
   byte[32] aes256;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
index 7a77521..83713ff 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable CipherModeParameters {
   byte[16] nonce;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
similarity index 95%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
index 933fb67..45cb234 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
@@ -32,6 +32,8 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union ExplicitKeyMaterial {
   android.hardware.security.see.hwcrypto.types.AesKey aes;
+  android.hardware.security.see.hwcrypto.types.HmacKey hmac;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
similarity index 96%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
index cd8b3c6..969e9c8 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable HalErrorCode {
   const int NO_ERROR = 0;
   const int GENERIC_ERROR = (-1) /* -1 */;
@@ -41,4 +42,5 @@
   const int ALLOCATION_ERROR = (-5) /* -5 */;
   const int INVALID_KEY = (-6) /* -6 */;
   const int BAD_PARAMETER = (-7) /* -7 */;
+  const int UNAUTHORIZED = (-8) /* -8 */;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
similarity index 90%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
index ea3a173..4d4e65d 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
@@ -32,8 +32,8 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+@VintfStability
+union HmacKey {
+  byte[32] sha256 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+  byte[64] sha512;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
similarity index 93%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
copy to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
index ea3a173..33a518d 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
@@ -32,8 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-enum KeyPermissions {
-  ALLOW_EPHEMERAL_KEY_WRAPPING,
-  ALLOW_HARDWARE_KEY_WRAPPING,
-  ALLOW_PORTABLE_KEY_WRAPPING,
+@VintfStability
+parcelable HmacOperationParameters {
+  android.hardware.security.see.hwcrypto.IOpaqueKey key;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
similarity index 97%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
index db5964c..ddee337 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
@@ -32,7 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
+@Backing(type="byte") @VintfStability
 enum KeyLifetime {
   EPHEMERAL,
   HARDWARE,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
index ea3a173..919be32 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 enum KeyPermissions {
   ALLOW_EPHEMERAL_KEY_WRAPPING,
   ALLOW_HARDWARE_KEY_WRAPPING,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl
index 59b83c4..07a7ce4 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyType.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 enum KeyType {
   AES_128_CBC_NO_PADDING,
   AES_128_CBC_PKCS7_PADDING,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
similarity index 97%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
index e888bdf..b607fd5 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
@@ -32,7 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-@Backing(type="int")
+@Backing(type="int") @VintfStability
 enum KeyUse {
   ENCRYPT = 1,
   DECRYPT = 2,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
similarity index 96%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
index 59c8757..184e21f 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
@@ -32,7 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-@RustDerive(Clone=true, Copy=true)
+@RustDerive(Clone=true, Copy=true) @VintfStability
 parcelable MemoryBufferReference {
   int startOffset;
   int sizeBytes;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
index fc2dd63..6dfefcb 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable OpaqueKeyToken {
   byte[] keyToken;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl
index aad3ac1..858ef1c 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationData.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union OperationData {
   android.hardware.security.see.hwcrypto.types.MemoryBufferReference memoryBufferReference;
   byte[] dataBuffer;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl
index ca8b3eb..03c2bba 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/OperationType.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 enum OperationType {
   READ,
   WRITE,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl
similarity index 95%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl
index db5964c..cb963ee 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl
@@ -32,9 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+@VintfStability
+enum ProtectionId {
+  WIDEVINE_OUTPUT_BUFFER = 1,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
index d3d1763..e42190e 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union SymmetricAuthCryptoParameters {
   android.hardware.security.see.hwcrypto.types.AesGcmMode aes;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
index 8a8ef09..78c4a4f 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable SymmetricAuthOperationParameters {
   android.hardware.security.see.hwcrypto.IOpaqueKey key;
   android.hardware.security.see.hwcrypto.types.SymmetricOperation direction;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
index cc93094..8fd5e85 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 union SymmetricCryptoParameters {
   android.hardware.security.see.hwcrypto.types.AesCipherMode aes;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
index 1a17525..40fd2d5 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 enum SymmetricOperation {
   ENCRYPT,
   DECRYPT,
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
index 769833b..7007074 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
@@ -32,6 +32,7 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable SymmetricOperationParameters {
   android.hardware.security.see.hwcrypto.IOpaqueKey key;
   android.hardware.security.see.hwcrypto.types.SymmetricOperation direction;
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/Void.aidl b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/Void.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/Void.aidl
rename to security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/Void.aidl
index b37848b..80c91ee 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/Void.aidl
+++ b/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see.hwcrypto/current/android/hardware/security/see/hwcrypto/types/Void.aidl
@@ -32,5 +32,6 @@
 // later when a module using the interface is updated, e.g., Mainline modules.
 
 package android.hardware.security.see.hwcrypto.types;
+@VintfStability
 parcelable Void {
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
similarity index 99%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
index 2fdbc78..0859d2a 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperation.aidl
@@ -25,6 +25,7 @@
  * Type that describes the different operations that can be performed along with its required
  * parameters. It will be used to construct a vector of operation that are executed sequentially.
  */
+@VintfStability
 union CryptoOperation {
     /*
      * Sets a memory buffer to operate on. References to positions of this memory buffer can be used
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
index f3ac8ea..cc94b02 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationErrorAdditionalInfo.aidl
@@ -18,6 +18,7 @@
 /*
  * Type that provides more information about failures when processing a list of commands.
  */
+@VintfStability
 parcelable CryptoOperationErrorAdditionalInfo {
     /*
      * Index indicating the first step of <code>CryptoOperationSet::operations</code> that failed
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
index 07c2983..5c3b81e 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationResult.aidl
@@ -20,6 +20,7 @@
 /*
  * Type that describes the result of a set of crypto operations.
  */
+@VintfStability
 parcelable CryptoOperationResult {
     /*
      * Token that can be passed on a CryptoOperationSet to issue more operations on the same context
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
index 9aff1e8..285ed36 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/CryptoOperationSet.aidl
@@ -21,6 +21,7 @@
 /*
  * Type that describes a set of crypto operations to execute
  */
+@VintfStability
 parcelable CryptoOperationSet {
     /*
      * Token to be used to issue the operations. If NULL, a new context will be created and
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
index 68d0c03..8cfa735 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/ICryptoOperationContext.aidl
@@ -22,4 +22,5 @@
  * operation in progress context includes any memory buffer previously mapped by a
  * <code>CryptoOperation::SetMemoryBuffer</code> call.
  */
+@VintfStability
 interface ICryptoOperationContext {}
diff --git a/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
new file mode 100644
index 0000000..44ec32f
--- /dev/null
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
@@ -0,0 +1,298 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.security.see.hwcrypto;
+
+import android.hardware.security.see.hwcrypto.IHwCryptoOperations;
+import android.hardware.security.see.hwcrypto.IOpaqueKey;
+import android.hardware.security.see.hwcrypto.KeyPolicy;
+import android.hardware.security.see.hwcrypto.types.ExplicitKeyMaterial;
+import android.hardware.security.see.hwcrypto.types.OpaqueKeyToken;
+
+/*
+ * Higher level interface to access and generate keys.
+ */
+@VintfStability
+interface IHwCryptoKey {
+    /*
+     * Identifier for the requested device provided key. The currently supported identifiers are:
+     *
+     */
+    enum DeviceKeyId {
+        /*
+         * This is a key unique to the device.
+         */
+        DEVICE_BOUND_KEY,
+        /*
+         * This is a shared by a set of devices.
+         */
+        BATCH_KEY,
+    }
+
+    /*
+     * Identifier for the requested key slot. The currently supported identifiers are:
+     *
+     */
+    enum KeySlot {
+        /*
+         * This is the shared HMAC key that will now be computed by HwCryptoKey after participating
+         * in the ISharedSecret protocol that can be shared with KeyMint and authenticators. See
+         * ISharedSecret.aidl for more information.
+         */
+        KEYMINT_SHARED_HMAC_KEY,
+    }
+
+    union DiceBoundDerivationKey {
+        /*
+         * Opaque to be used to derive the DICE bound key.
+         */
+        IOpaqueKey opaqueKey;
+
+        /*
+         * Device provided key to be used to derive the DICE bound key.
+         */
+        DeviceKeyId keyId;
+    }
+
+    parcelable DiceCurrentBoundKeyResult {
+        /*
+         * Key cryptographically bound to a DICE policy.
+         */
+        IOpaqueKey diceBoundKey;
+
+        /*
+         * Current dice policy which was used to generate the returned key. This policy is opaque
+         * from this service perspective (it will be sent to an Authentication Manager Service to be
+         * verified). It follows the structure defined on DicePolicy.cddl, located under
+         * hardware/interfaces/security/authgraph/aidl/android/hardware/security/authgraph/ with the
+         * caveat that it could be encrypted if the client does not have enough permissions to see
+         * the device dice policy information.
+         */
+        byte[] dicePolicyForKeyVersion;
+    }
+
+    parcelable DiceBoundKeyResult {
+        /*
+         * Key cryptographically bound to a DICE policy.
+         */
+        IOpaqueKey diceBoundKey;
+
+        /*
+         * Indicates if the diceBoundKey returned was created using a current DICE policy. The
+         * caller can use this to detect if an old policy was provided and rotate its keys if so
+         * desired. Old, valid policies remain usable, but care needs to be taken to not continue to
+         * use a potentially compromised key.
+         */
+        boolean dicePolicyWasCurrent;
+    }
+
+    parcelable ClearKeyPolicy {
+        /*
+         * Indicates the desired key size. It will be used to calculate how many bytes of key
+         * material should be returned.
+         */
+        int keySizeBytes;
+    }
+
+    union DerivedKeyPolicy {
+        /*
+         * If used we will derive a clear key and pass it back as an array of bytes on
+         * <code>HwCryptoKeyMaterial::explicitKey</code>.
+         */
+        ClearKeyPolicy clearKey;
+
+        /*
+         * Policy for the newly derived opaque key. Defines how the key can be used and its type.
+         */
+        byte[] opaqueKey;
+    }
+
+    parcelable DerivedKeyParameters {
+        /*
+         * Key to be used to derive the new key using HKDF.
+         */
+        IOpaqueKey derivationKey;
+
+        /*
+         * Policy for the newly derived key. Depending on its type, either a clear or opaque key
+         * will be derived.
+         */
+        DerivedKeyPolicy keyPolicy;
+
+        /*
+         * An arbitrary set of bytes incorporated into the key derivation. May have an
+         * implementation-specific maximum length, but it is guaranteed to accept at least 32 bytes.
+         */
+        byte[] context;
+    }
+
+    union DerivedKey {
+        /*
+         * Derived key in clear format.
+         */
+        byte[] explicitKey = {};
+
+        /*
+         * Derived key as a key token to be used only through the HWCrypto service.
+         */
+        IOpaqueKey opaque;
+    }
+
+    /*
+     * Derives a versioned key tied to the caller's current DICE policy. It will return this current
+     * policy back to the caller along with the generated key.
+     *
+     * @param derivationKey:
+     *     Key to be used to derive the new key using HKDF.
+     *
+     * @return:
+     *     A DiceCurrentBoundKeyResult containint the versioned key tied the current client version
+     *     on success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    DiceCurrentBoundKeyResult deriveCurrentDicePolicyBoundKey(
+            in DiceBoundDerivationKey derivationKey);
+
+    /*
+     * Derive a versioned key by checking the provided DICE policy against the caller and then using
+     * it as a context for deriving the returned key.
+     *
+     * @param derivationKey:
+     *     Key to be used to derive the new key using HKDF.
+     *
+     * @param dicePolicyForKeyVersion:
+     *     Policy used to derive keys tied to specific versions. Using this parameter the caller can
+     *     tie a derived key to a minimum version of itself, so in the future only itself or a more
+     *     recent version can derive the same key. This parameter is opaque to the caller and it
+     *     could be encrypted in the case the client doesn't have permission to know the dice chain.
+     *     When implementing this function, this parameter shall be one of the components fed to the
+     *     KDF context and it needs to be checked against the caller DICE certificate before being
+     *     used.
+     *
+     * @return:
+     *      A DiceBoundKeyResult containing the versioned key tied to the provided DICE policy on
+     *      success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    DiceBoundKeyResult deriveDicePolicyBoundKey(
+            in DiceBoundDerivationKey derivationKey, in byte[] dicePolicyForKeyVersion);
+
+    /*
+     * Derive a new key based on the given key, policy and context.
+     *
+     * @param parameters:
+     *      Parameters used for the key derivation. See <code>DerivedKeyParameters</code> on this
+     *      file for more information.
+     *
+     * @return:
+     *      A HwCryptoKeyMaterial containing the derived key on success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    DerivedKey deriveKey(in DerivedKeyParameters parameters);
+
+    /*
+     * Returns an interface used to work on opaque keys. This interface can also be used to operate
+     * on any opaque key generated by hwkeyDeriveVersioned, even if this key has been generated
+     * after retrieving a IHwCryptoOperations binder object, as long as the parent
+     * IHwCryptoDeviceKeyAccess is not dropped between retrieving the IHwCryptoOperations binder
+     * object and deriving the key. IHwCryptoOperations can also be used to create opaque keys that
+     * are not bound to the device.
+     *
+     * @return:
+     *      IHwCryptoOperations on success
+     */
+    IHwCryptoOperations getHwCryptoOperations();
+
+    /*
+     * Imports a SW clear key into the secure environment.
+     *
+     * @param keyMaterial:
+     *     key to be imported.
+     *
+     * @param newKeyPolicy:
+     *      Policy of the new key. Defines how the newly created key can be used. Because any clear
+     *      key imported into the system is considered to have a <code>KeyLifetime::PORTABLE</code>
+     *      lifetime, a call to this function will return an error if
+     *      <code>newKeyPolicy.newKeyPolicy</code> is not set to portable.
+     *
+     * @return:
+     *      IOpaqueKey on success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    IOpaqueKey importClearKey(in ExplicitKeyMaterial keyMaterial, in KeyPolicy newKeyPolicy);
+
+    /*
+     * Returns the client current DICE policy. This policy is encrypted and considered opaque from
+     * the client perspective. This policy is the same used to create DICE bound keys and will also
+     * be used to seal secrets that can only be retrieved by the DICE policy owner. The first use of
+     * this seal operation will be <code>IOpaqueKey::getShareableToken</code> and will call this
+     * <code>IHwCryptoKey::keyTokenImport</code>. To start this process, the intended key receiver
+     * function and then pass the generated DICE policy to the owner of the key that the receiver
+     * wants to import. The key owner will then call <code>IOpaqueKey::getShareableToken</code>
+     * passing the receiver DICE policy to insure that only that receiver can import the key.
+     *
+     * @return:
+     *      byte[] on success, which is the caller encrypted DICE policy.
+     */
+    byte[] getCurrentDicePolicy();
+
+    /*
+     * Imports a key from a different client service instance. Because IOpaqueKey are binder objects
+     * that cannot be directly shared between binder rpc clients, this method provide a way to send
+     * a key to another client. Keys to be imported by the receiver are represented by a token
+     * created using <code>IOpaqueKey::getShareableToken</code>. The flow to create this token is
+     * described in <code>IHwCryptoKey::getCurrentDicePolicy</code>.
+     *
+     * @param requested_key:
+     *      Handle to the key to be imported to the caller service.
+     *
+     * @param sealingDicePolicy:
+     *      DICE policy used to seal the exported key.
+     *
+     * @return:
+     *      An IOpaqueKey that can be directly be used on the local HWCrypto service on success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    IOpaqueKey keyTokenImport(in OpaqueKeyToken requestedKey, in byte[] sealingDicePolicy);
+
+    /*
+     * Gets the keyslot key material referenced by slotId. This interface is used to access device
+     * specific keys with known types and uses. Because the returned key is opaque, it can only be
+     * used through the different HwCrypto interfaces. Because the keys live in a global namespace
+     * the identity of the caller needs to be checked to verify that it has permission to access the
+     * requested key.
+     *
+     * @param slotId:
+     *      Identifier for the requested keyslot
+     *
+     * @return:
+     *      An IOpaqueKey corresponding to the requested key slot on success.
+     *
+     * @throws:
+     *      ServiceSpecificException <code>UNAUTHORIZED</code> if the caller cannot access the
+     *      requested key, another specific error based on <code>HalErrorCode</code> otherwise.
+     */
+    IOpaqueKey getKeyslotData(KeySlot slotId);
+}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
similarity index 84%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
index 4d394ed..9df6d67 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
@@ -24,20 +24,25 @@
  * cryptographic keys. Interactions with this interface are done through a command-base API,
  * which allow callers to execute a large set of operations on a single call.
  */
+@VintfStability
 interface IHwCryptoOperations {
     /*
-     * processCommandList() - Executes a list of cryptographic commands in order
+     * Executes a list of cryptographic commands in order
      *
-     * @operations:
+     * @param operations:
      *      Parameter containing 1 or more set of commands to execute. Additionally, each set can
      *      also contain a context on which the commands will be executed.
-     * @additionalErrorInfo:
+     *
+     * @param additionalErrorInfo:
      *      Structure containing additional info when errors are encountered. Only valid if the
      *      function failed its execution.
-     * Return:
+     *
+     * @return:
      *      CryptoOperationResult[] on success, which can contain a context to continue executing
-     *      each of the provided operations sets, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
+     *      each of the provided operations sets.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
      */
     CryptoOperationResult[] processCommandList(inout CryptoOperationSet[] operations,
             out CryptoOperationErrorAdditionalInfo additionalErrorInfo);
diff --git a/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
new file mode 100644
index 0000000..318a27e
--- /dev/null
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.security.see.hwcrypto;
+
+import android.hardware.security.see.hwcrypto.KeyPolicy;
+import android.hardware.security.see.hwcrypto.types.OpaqueKeyToken;
+import android.hardware.security.see.hwcrypto.types.OperationType;
+import android.hardware.security.see.hwcrypto.types.ProtectionId;
+
+@VintfStability
+interface IOpaqueKey {
+    /*
+     * Exports this key as a wrapped (encrypted) blob.
+     *
+     * @param wrapping_key:
+     *     wrapping key. It needs to be an opaque key and its policy needs to indicate that it can
+     *     be used for key wrapping.
+     *
+     * @return:
+     *      Wrapped key blob as a byte array on success. Format of the blob is opaque to the service
+     *      but has to match the command accepted by
+     *      <code>IHwCryptoKeyGeneration::importWrappedKey</code>
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    byte[] exportWrappedKey(in IOpaqueKey wrappingKey);
+
+    /*
+     * Returns the key policy.
+     *
+     * @return:
+     *      A <code>KeyPolicy</code> on success
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    KeyPolicy getKeyPolicy();
+
+    /*
+     * Returns the public key portion of this OpaqueKey. This operation is only valid for asymmetric
+     * keys.
+     *
+     * @return:
+     *      public key as a byte array on success. Format used for the returned public key is COSE.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    byte[] getPublicKey();
+
+    /*
+     * Returns a token that can shared with another HWCrypto client.
+     *
+     * @param sealingDicePolicy:
+     *      Token to be used to protect the returned OpaqueKeyToken. It will be used so only
+     *      the owner of the sealingDicePolicy can import the key.
+     *
+     * @return:
+     *      <code>OpaqueKeyMaterial</code> token on success.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    OpaqueKeyToken getShareableToken(in byte[] sealingDicePolicy);
+
+    /*
+     * Sets the protectionID associated with the buffers where the operation will be performed. A
+     * protection ID serves as a limitation on the key so it can only operate on buffers with a
+     * matching protection ID. The client calling this functions needs to have the necessary
+     * permissions to read and/or write to this buffer. Setting this parameter means that if the key
+     * is shared with a different client, the client receiving the key will be limited in which
+     * buffers can be used to read/write data for this operation.
+     *
+     * @param protectionId:
+     *      ID of the given use case to provide protection for. The method of protecting the buffer
+     *      will be platform dependent.
+     *
+     * @param allowedOperations:
+     *      array of allowed operations. Allowed operations are either READ or WRITE.
+     *
+     * @throws:
+     *      ServiceSpecificException based on <code>HalErrorCode</code> if any error occurs.
+     */
+    void setProtectionId(in ProtectionId protectionId, in OperationType[] allowedOperations);
+}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
index 9266bfa..a20e99b 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.aidl
@@ -23,6 +23,7 @@
 /*
  * Parcelable that specified how a key can be used.
  */
+@VintfStability
 parcelable KeyPolicy {
     /*
      * Enum specifying the operations the key can perform (encryption, decryption, etc.).
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.cddl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.cddl
similarity index 100%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.cddl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/KeyPolicy.cddl
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
index c5a6a5c..efc5767 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
@@ -18,6 +18,7 @@
 /*
  * Parcelable representing a memory buffer.
  */
+@VintfStability
 parcelable MemoryBufferParameter {
     union MemoryBuffer {
         ParcelFileDescriptor input;
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl
similarity index 85%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl
index 9e2fc6c..bf0b720 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/OperationParameters.aidl
@@ -15,12 +15,14 @@
  */
 package android.hardware.security.see.hwcrypto;
 
+import android.hardware.security.see.hwcrypto.types.HmacOperationParameters;
 import android.hardware.security.see.hwcrypto.types.SymmetricAuthOperationParameters;
 import android.hardware.security.see.hwcrypto.types.SymmetricOperationParameters;
 
 /*
  * Type that describes the parameters for the different operations that can be performed.
  */
+@VintfStability
 union OperationParameters {
     /*
      * Parameters for authenticated symmetric cryptography (AES GCM).
@@ -31,4 +33,9 @@
      * Parameters for non-authenticated symmetric cryptography (AES/TDES).
      */
     SymmetricOperationParameters symmetricCrypto;
+
+    /*
+     * Parameters for hash based message authenticated code operations.
+     */
+    HmacOperationParameters hmac;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl
index 3f62abe..9f8950f 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/PatternParameters.aidl
@@ -18,6 +18,7 @@
 /*
  * Parcelable that specifies a pattern to process data.
  */
+@VintfStability
 parcelable PatternParameters {
     /*
      * Number of blocks that will be processed. The size of the block matches the size of the
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
index ac31557..8ce83aa 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesCipherMode.aidl
@@ -21,6 +21,7 @@
 /*
  * Type used for the parameters needed to run a non-authenticated AES operation.
  */
+@VintfStability
 union AesCipherMode {
     /*
      * Cipher Block Chaining mode. Padding will either be none or PKCS#7 depending on the key policy
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
index 4025553..1c6551c 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesGcmMode.aidl
@@ -18,6 +18,7 @@
 /*
  * Type used for the parameters needed to run an authenticated AES operation (GCM).
  */
+@VintfStability
 union AesGcmMode {
     parcelable AesGcmModeParameters {
         /*
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
index cf9082d..ae62ef9 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
@@ -18,6 +18,7 @@
 /*
  * Type that represents an AES key.
  */
+@VintfStability
 union AesKey {
     /*
      * Raw AES 128 bit key material.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
similarity index 88%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
index bfa5daa..e7ede57 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
@@ -19,6 +19,10 @@
 /*
  * Type encapsulating nonce used on non-authenticated AES symmetric encryption.
  */
+@VintfStability
 parcelable CipherModeParameters {
+    /*
+     * nonce to be used as IV for AES-CBC or as the nonce in AES-CTR
+     */
     byte[16] nonce;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
similarity index 81%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
index 4298ba9..a5bf594 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ExplicitKeyMaterial.aidl
@@ -16,10 +16,20 @@
 package android.hardware.security.see.hwcrypto.types;
 
 import android.hardware.security.see.hwcrypto.types.AesKey;
+import android.hardware.security.see.hwcrypto.types.HmacKey;
 
 /*
  * Type encapsulating a clear key.
  */
+@VintfStability
 union ExplicitKeyMaterial {
+    /*
+     * AES key in clear format.
+     */
     AesKey aes;
+
+    /*
+     * HMAC key in clear format.
+     */
+    HmacKey hmac;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
similarity index 93%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
index e8e8539..df12262 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HalErrorCode.aidl
@@ -18,6 +18,7 @@
 /*
  * Service error codes. Will be returned as service specific errors.
  */
+@VintfStability
 parcelable HalErrorCode {
     /* Success */
     const int NO_ERROR = 0;
@@ -42,4 +43,7 @@
 
     /* Bad parameter supplied for the desired operation */
     const int BAD_PARAMETER = -7;
+
+    /* Caller is not authorized to make this call */
+    const int UNAUTHORIZED = -8;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
similarity index 69%
copy from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
copy to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
index cf9082d..b1a988e 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/AesKey.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacKey.aidl
@@ -16,16 +16,18 @@
 package android.hardware.security.see.hwcrypto.types;
 
 /*
- * Type that represents an AES key.
+ * Type that represents an Hmac key.
  */
-union AesKey {
+@VintfStability
+union HmacKey {
     /*
-     * Raw AES 128 bit key material.
+     * Raw Hmac key for use with sha256.
      */
-    byte[16] aes128 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+    byte[32] sha256 = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+            0, 0, 0, 0, 0, 0};
 
     /*
-     * Raw AES 256 bit key material.
+     * Raw Hmac key for use with sha512.
      */
-    byte[32] aes256;
+    byte[64] sha512;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
similarity index 74%
copy from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
copy to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
index bfa5daa..faa3072 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/CipherModeParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/HmacOperationParameters.aidl
@@ -1,4 +1,3 @@
-
 /*
  * Copyright 2024 The Android Open Source Project
  *
@@ -16,9 +15,14 @@
  */
 package android.hardware.security.see.hwcrypto.types;
 
+import android.hardware.security.see.hwcrypto.IOpaqueKey;
 /*
- * Type encapsulating nonce used on non-authenticated AES symmetric encryption.
+ * Data needed to perform HMAC operations.
  */
-parcelable CipherModeParameters {
-    byte[16] nonce;
+@VintfStability
+parcelable HmacOperationParameters {
+    /*
+     * Key to be used for the HMAC operation.
+     */
+    IOpaqueKey key;
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
index 9958a0b..b03b850 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
@@ -20,6 +20,7 @@
  * represented as a bitmask to allow us to internally combine them on a single property to describe
  * a set of allowed lifetimes.
  */
+@VintfStability
 @Backing(type="byte")
 enum KeyLifetime {
     /*
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
index a1e4f21..c48ef8b 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyPermissions.aidl
@@ -18,6 +18,7 @@
 /*
  * Additional characteristics and permissions of the key.
  */
+@VintfStability
 enum KeyPermissions {
     /*
      * Key can be wrapped by an ephemeral key.
diff --git a/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl
new file mode 100644
index 0000000..ed90899
--- /dev/null
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.security.see.hwcrypto.types;
+
+/*
+ * Enum describing all supported key types. Key types are strongly bound to the algorithm to
+ * prevent reusing the same key on different algorithms (e.g. using the same key for 2 different AES
+ * 128 Cipher modes).
+ */
+@VintfStability
+enum KeyType {
+    /*
+     * AES with key size 128 bits using CBC mode of operation and no padding.
+     */
+    AES_128_CBC_NO_PADDING,
+
+    /*
+     * AES with key size 128 bits using CBC mode of operation and PKCS7 padding.
+     */
+    AES_128_CBC_PKCS7_PADDING,
+
+    /*
+     * AES with key size 128 bits using counter mode.
+     */
+    AES_128_CTR,
+
+    /*
+     * AES with key size 128 bits using GCM mode for authenticated encryption.
+     */
+    AES_128_GCM,
+
+    /*
+     * AES with key size 128 bits for CMAC calculation.
+     */
+    AES_128_CMAC,
+
+    /*
+     * AES with key size 256 bits using CBC mode of operation and no padding.
+     */
+    AES_256_CBC_NO_PADDING,
+
+    /*
+     * AES with key size 256 bits using CBC mode of operation and PKCS7 padding.
+     */
+    AES_256_CBC_PKCS7_PADDING,
+
+    /*
+     * AES with key size 128 bits using counter mode.
+     */
+    AES_256_CTR,
+
+    /*
+     * AES with key size 128 bits using GCM mode for authenticated encryption.
+     */
+    AES_256_GCM,
+
+    /*
+     * AES with key size 128 bits for CMAC calculation.
+     */
+    AES_256_CMAC,
+
+    /*
+     * Key of length of 32 bytes for HMAC operations using SHA256.
+     */
+    HMAC_SHA256,
+
+    /*
+     * Key of length of 64 bytes for HMAC operations using SHA512.
+     */
+    HMAC_SHA512,
+
+    /*
+     * RSA of key size of 2048 bits for signing using PSS.
+     */
+    RSA2048_PSS_SHA256,
+
+    /*
+     * RSA of key size of 2048 bits for signing with padding PKCS 1.5 and SHA256 as the digest
+     * algorithm.
+     */
+    RSA2048_PKCS1_5_SHA256,
+
+    /*
+     * ECC key for signing using curve P-256 and no padding.
+     */
+    ECC_NIST_P256_SIGN_NO_PADDING,
+
+    /*
+     * ECC key for signing using curve P-256 and SHA256 as hashing algorithm.
+     */
+    ECC_NIST_P256_SIGN_SHA256,
+
+    /*
+     * ECC key for signing using curve P-521 and no padding.
+     */
+    ECC_NIST_P521_SIGN_NO_PADDING,
+
+    /*
+     * ECC key for signing using curve P-512 and SHA512 as hashing algorithm.
+     */
+    ECC_NIST_P521_SIGN_SHA512,
+
+    /*
+     * ECC key for signing using EdDSA.
+     */
+    ECC_ED25519_SIGN,
+}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
similarity index 77%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
index 76bfd62..60bfd06 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyUse.aidl
@@ -18,12 +18,24 @@
 /*
  * Enum describing the allowed operations that can be performed with the given key.
  */
+@VintfStability
 @Backing(type="int")
 enum KeyUse {
+    /* Key can be used to encrypt */
     ENCRYPT = 1,
+
+    /* Key can be used to decrypt */
     DECRYPT = 2,
+
+    /* Key can be used to encrypt or decrypt */
     ENCRYPT_DECRYPT = ENCRYPT | DECRYPT,
+
+    /* Key can be used to sign */
     SIGN = 4,
+
+    /* Key can be used to derive other keys */
     DERIVE = 8,
+
+    /* Key can be used to wrap other keys */
     WRAP = 16,
 }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
index 1175dc5..0f3c099 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/MemoryBufferReference.aidl
@@ -18,6 +18,7 @@
 /*
  * Structure representing a section of a memory buffer.
  */
+@VintfStability
 @RustDerive(Copy=true, Clone=true)
 parcelable MemoryBufferReference {
     /*
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
index db95c18..25cc6fb 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OpaqueKeyToken.aidl
@@ -20,6 +20,7 @@
  * valid on the current boot, and its reuse after a session is closed (or between sessions) is not
  * guaranteed.
  */
+@VintfStability
 parcelable OpaqueKeyToken {
     /*
      * Opaque type used to send IOpaqueKeys keys to different clients. Its format is implementation
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl
index 642d05e..8dfca72 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationData.aidl
@@ -20,6 +20,7 @@
 /*
  * Union holding buffers to be used by the cryptographic operation.
  */
+@VintfStability
 union OperationData {
     /*
      * Reference (offset, size) to the active operations' MemoryBuffer.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl
similarity index 90%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl
index 76878a3..2dc9ae9 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/OperationType.aidl
@@ -18,7 +18,11 @@
 /*
  * Enum describing the different types of operations allowed on a buffer.
  */
+@VintfStability
 enum OperationType {
+    /* Read operations allowed*/
     READ,
+
+    /* Write operations allowed*/
     WRITE,
 }
diff --git a/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl
new file mode 100644
index 0000000..8fd0551
--- /dev/null
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/ProtectionId.aidl
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.security.see.hwcrypto.types;
+
+/*
+ * Enum describing the different types of protected buffers. Protected buffers are named by its
+ * corresponding use case and its underlaying implementation is platform dependant.
+ */
+@VintfStability
+enum ProtectionId {
+    /*
+     * ProtectionID used by HwCrypto to enable Keys that can be used for Widevine video buffers.
+     * These buffers should not be readable by non-trusted entities and HwCrypto should not allow
+     * any read access to them through its interface.
+     */
+    WIDEVINE_OUTPUT_BUFFER = 1,
+}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
index 278e48d..79c39f9 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthCryptoParameters.aidl
@@ -20,6 +20,7 @@
 /*
  * Data needed to perform authenticated symmetric cryptographic operations.
  */
+@VintfStability
 union SymmetricAuthCryptoParameters {
     /*
      * AES (Advanced Encryption Standard) GCM parameters.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
index 46568c3..844a3bc 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricAuthOperationParameters.aidl
@@ -23,6 +23,7 @@
  * Parameters needed to perform an authenticated symmetric cryptographic operation. Currently only
  * AES-GCM is supported.
  */
+@VintfStability
 parcelable SymmetricAuthOperationParameters {
     /*
      * Key to be used on the operation.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
index 2350242..679fe6a 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricCryptoParameters.aidl
@@ -20,6 +20,7 @@
 /*
  * Data needed to perform non-authenticated symmetric cryptographic operations.
  */
+@VintfStability
 union SymmetricCryptoParameters {
     /*
      * AES (Advanced Encryption Standard) parameters.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
similarity index 92%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
index 2717472..d88d4e9 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperation.aidl
@@ -18,4 +18,4 @@
 /*
  * Enum describing the type of symmetric operation desired.
  */
-enum SymmetricOperation { ENCRYPT, DECRYPT }
+@VintfStability enum SymmetricOperation { ENCRYPT, DECRYPT }
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
similarity index 98%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
index 1d1554d..509d416 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/SymmetricOperationParameters.aidl
@@ -22,6 +22,7 @@
 /*
  * Parameters needed to perform a non-authenticated symmetric cryptographic operation.
  */
+@VintfStability
 parcelable SymmetricOperationParameters {
     /*
      * Key to be used on the operation.
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl
similarity index 92%
rename from staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl
rename to security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl
index f9f608d..243fb45 100644
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl
+++ b/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/Void.aidl
@@ -15,4 +15,8 @@
  */
 package android.hardware.security.see.hwcrypto.types;
 
+/*
+ * Type used to represent no data.
+ */
+@VintfStability
 parcelable Void {}
diff --git a/staging/security/see/storage/aidl/Android.bp b/security/see/storage/aidl/Android.bp
similarity index 91%
rename from staging/security/see/storage/aidl/Android.bp
rename to security/see/storage/aidl/Android.bp
index f669be8..279cb90 100644
--- a/staging/security/see/storage/aidl/Android.bp
+++ b/security/see/storage/aidl/Android.bp
@@ -4,7 +4,7 @@
 
 aidl_interface {
     name: "android.hardware.security.see.storage",
-    unstable: true,
+    stability: "vintf",
     host_supported: true,
     srcs: [
         "android/hardware/security/see/storage/*.aidl",
@@ -23,4 +23,5 @@
             enabled: true,
         },
     },
+    frozen: false,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Availability.aidl
similarity index 92%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Availability.aidl
index db5964c..62af569 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Availability.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+package android.hardware.security.see.storage;
+@VintfStability
+enum Availability {
+  BEFORE_USERDATA,
+  AFTER_USERDATA,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/CreationMode.aidl
similarity index 92%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/CreationMode.aidl
index db5964c..f999205 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/CreationMode.aidl
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+package android.hardware.security.see.storage;
+@VintfStability
+enum CreationMode {
+  NO_CREATE,
+  CREATE_EXCLUSIVE,
+  CREATE,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/FileMode.aidl
similarity index 92%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/FileMode.aidl
index db5964c..604e61f 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/FileMode.aidl
@@ -31,10 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+package android.hardware.security.see.storage;
+@VintfStability
+enum FileMode {
+  READ_ONLY,
+  WRITE_ONLY,
+  READ_WRITE,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Filesystem.aidl
similarity index 81%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Filesystem.aidl
index 5c26cc2..df08380 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Filesystem.aidl
@@ -31,7 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.storage;
+@VintfStability
+parcelable Filesystem {
+  android.hardware.security.see.storage.Integrity integrity = android.hardware.security.see.storage.Integrity.TAMPER_PROOF_AT_REST;
+  android.hardware.security.see.storage.Availability availability = android.hardware.security.see.storage.Availability.BEFORE_USERDATA;
+  boolean persistent;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IDir.aidl
similarity index 91%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IDir.aidl
index db5964c..7068ea2 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IDir.aidl
@@ -31,10 +31,8 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+package android.hardware.security.see.storage;
+@VintfStability
+interface IDir {
+  @utf8InCpp String[] readNextFilenames(int maxCount);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IFile.aidl
similarity index 83%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IFile.aidl
index d88d5c8..734ec0c 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/MemoryBufferParameter.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IFile.aidl
@@ -31,12 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-parcelable MemoryBufferParameter {
-  android.hardware.security.see.hwcrypto.MemoryBufferParameter.MemoryBuffer bufferHandle;
-  int sizeBytes;
-  union MemoryBuffer {
-    ParcelFileDescriptor input;
-    ParcelFileDescriptor output;
-  }
+package android.hardware.security.see.storage;
+@VintfStability
+interface IFile {
+  byte[] read(long size, long offset);
+  long write(long offset, in byte[] buffer);
+  long getSize();
+  void setSize(long newSize);
+  void rename(in @utf8InCpp String destPath, in android.hardware.security.see.storage.CreationMode destCreateMode);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/ISecureStorage.aidl
similarity index 78%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/ISecureStorage.aidl
index 5c26cc2..c99c039 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/ISecureStorage.aidl
@@ -31,7 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.storage;
+@VintfStability
+interface ISecureStorage {
+  android.hardware.security.see.storage.IStorageSession startSession(in android.hardware.security.see.storage.Filesystem filesystem);
+  const int ERR_UNSUPPORTED_PROPERTIES = 1;
+  const int ERR_NOT_FOUND = 2;
+  const int ERR_ALREADY_EXISTS = 3;
+  const int ERR_BAD_TRANSACTION = 4;
+  const int ERR_AB_UPDATE_IN_PROGRESS = 5;
+  const int ERR_FS_TAMPERED = 6;
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IStorageSession.aidl
similarity index 72%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IStorageSession.aidl
index 5c26cc2..11b4b9a 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/IStorageSession.aidl
@@ -31,7 +31,14 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.storage;
+@VintfStability
+interface IStorageSession {
+  void commitChanges();
+  void stageChangesForCommitOnAbUpdateComplete();
+  void abandonChanges();
+  android.hardware.security.see.storage.IFile openFile(in @utf8InCpp String filePath, in android.hardware.security.see.storage.OpenOptions options);
+  void deleteFile(in @utf8InCpp String filePath);
+  void renameFile(in @utf8InCpp String currentPath, in @utf8InCpp String destPath, in android.hardware.security.see.storage.CreationMode destCreateMode);
+  android.hardware.security.see.storage.IDir openDir(in @utf8InCpp String path);
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Integrity.aidl
similarity index 92%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Integrity.aidl
index db5964c..801da04 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/types/KeyLifetime.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/Integrity.aidl
@@ -31,10 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto.types;
-@Backing(type="byte")
-enum KeyLifetime {
-  EPHEMERAL,
-  HARDWARE,
-  PORTABLE,
+package android.hardware.security.see.storage;
+@VintfStability
+enum Integrity {
+  TAMPER_PROOF_AT_REST,
+  TAMPER_DETECT,
 }
diff --git a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/OpenOptions.aidl
similarity index 81%
copy from staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
copy to security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/OpenOptions.aidl
index 5c26cc2..eda2404 100644
--- a/staging/security/see/hwcrypto/aidl/aidl_api/android.hardware.security.see/current/android/hardware/security/see/hwcrypto/IHwCryptoOperations.aidl
+++ b/security/see/storage/aidl/aidl_api/android.hardware.security.see.storage/current/android/hardware/security/see/storage/OpenOptions.aidl
@@ -31,7 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.see.hwcrypto;
-interface IHwCryptoOperations {
-  android.hardware.security.see.hwcrypto.CryptoOperationResult[] processCommandList(inout android.hardware.security.see.hwcrypto.CryptoOperationSet[] operations, out android.hardware.security.see.hwcrypto.CryptoOperationErrorAdditionalInfo additionalErrorInfo);
+package android.hardware.security.see.storage;
+@VintfStability
+parcelable OpenOptions {
+  android.hardware.security.see.storage.CreationMode createMode = android.hardware.security.see.storage.CreationMode.NO_CREATE;
+  android.hardware.security.see.storage.FileMode accessMode = android.hardware.security.see.storage.FileMode.READ_WRITE;
+  boolean truncateOnOpen;
 }
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl
index 21a275c..e2954d5 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/Availability.aidl
@@ -16,6 +16,7 @@
 package android.hardware.security.see.storage;
 
 /** Determines how early during the boot process file is able to be accessed. */
+@VintfStability
 enum Availability {
     /** Available before userdata is mounted, but after android has booted. */
     BEFORE_USERDATA,
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl
index 1c65038..652d5c6 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/CreationMode.aidl
@@ -15,6 +15,7 @@
  */
 package android.hardware.security.see.storage;
 
+@VintfStability
 enum CreationMode {
     /** Returns an error if the file does not already exist. */
     NO_CREATE,
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl
similarity index 97%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl
index 18a2eae..b167a17 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/FileMode.aidl
@@ -15,6 +15,7 @@
  */
 package android.hardware.security.see.storage;
 
+@VintfStability
 enum FileMode {
     /** The file may only be read from. */
     READ_ONLY,
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl
index ea8db53..eacd4fe 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/Filesystem.aidl
@@ -21,6 +21,7 @@
 /**
  * Specifies minimum security requirements for a Secure Storage filesystem.
  */
+@VintfStability
 parcelable Filesystem {
     Integrity integrity = Integrity.TAMPER_PROOF_AT_REST;
     Availability availability = Availability.BEFORE_USERDATA;
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl
index 5d9a761..ddf8ed1 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/IDir.aidl
@@ -16,6 +16,7 @@
 package android.hardware.security.see.storage;
 
 /** The interface for an open directory */
+@VintfStability
 interface IDir {
     /**
      * Gets the next batch of filenames in this directory.
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl
similarity index 99%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl
index fd2032e..414d423 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/IFile.aidl
@@ -18,6 +18,7 @@
 import android.hardware.security.see.storage.CreationMode;
 
 /** The interface for an open file */
+@VintfStability
 interface IFile {
     /**
      * Read bytes from this file.
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl
similarity index 71%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl
index 022de9a..d2ac4d3 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/ISecureStorage.aidl
@@ -23,6 +23,7 @@
  *
  * Creates sessions which can be used to access storage.
  */
+@VintfStability
 interface ISecureStorage {
     const int ERR_UNSUPPORTED_PROPERTIES = 1;
     const int ERR_NOT_FOUND = 2;
@@ -34,6 +35,13 @@
     /**
      * Starts a storage session for a filesystem.
      *
+     * Clients should be prepared for `startSession` and any methods called on the `IStorageSession`
+     * or its sub-interfaces to return `WOULD_BLOCK` (a `binder::Status` with an exception code of
+     * `EX_TRANSACTION_FAILED` and a transaction error code of `android::WOULD_BLOCK`), which
+     * indicates that the requested storage is not currently available. Possible cases that might
+     * cause this return code might be accessing the data partition during boot stages where it
+     * isn't yet mounted or attempting to commit changes while an A/B update is in progress.
+     *
      * @filesystem:
      *     The minimum filesystem properties requested.
      *
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl
similarity index 87%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl
index 1b70a0e..9a8d0d7 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/IStorageSession.aidl
@@ -31,6 +31,7 @@
  *
  * Any changes still pending when the session is dropped will be abandoned.
  */
+@VintfStability
 interface IStorageSession {
     /**
      * Commits any pending changes made through this session to storage.
@@ -44,6 +45,21 @@
     void commitChanges();
 
     /**
+     * If an A/B update is in progress, stages any pending changes made through this session to be
+     * committed when the A/B update completes successfully. If the update fails, the changes will
+     * be discarded.
+     *
+     * If no A/B update is in progess, behaves identically to `commitChanges`.
+     *
+     * After this call returns successfully, the session will no longer have pending changes. Files
+     * may then still be modified through this session to create another commit.
+     *
+     * May return service-specific errors:
+     *   - ERR_BAD_TRANSACTION
+     */
+    void stageChangesForCommitOnAbUpdateComplete();
+
+    /**
      * Abandons any pending changes made through this session.
      *
      * The session can then be reused to make new changes.
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl
index 2f7f7ab..6f86ab0 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/Integrity.aidl
@@ -15,6 +15,7 @@
  */
 package android.hardware.security.see.storage;
 
+@VintfStability
 enum Integrity {
     /** REE may prevent operations, but cannot alter data once written. */
     TAMPER_PROOF_AT_REST,
diff --git a/staging/security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl b/security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl
similarity index 98%
rename from staging/security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl
rename to security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl
index 9fdf9e5..110b370 100644
--- a/staging/security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl
+++ b/security/see/storage/aidl/android/hardware/security/see/storage/OpenOptions.aidl
@@ -18,6 +18,7 @@
 import android.hardware.security.see.storage.CreationMode;
 import android.hardware.security.see.storage.FileMode;
 
+@VintfStability
 parcelable OpenOptions {
     /** Controls creation behavior of the to-be-opened file. See `CreationMode` docs for details. */
     CreationMode createMode = CreationMode.NO_CREATE;
diff --git a/staging/security/see/Android.bp b/staging/security/see/Android.bp
new file mode 100644
index 0000000..a83b65d
--- /dev/null
+++ b/staging/security/see/Android.bp
@@ -0,0 +1,5 @@
+dirgroup {
+    name: "trusty_dirgroup_hardware_interfaces_staging_security_see",
+    dirs: ["."],
+    visibility: ["//trusty/vendor/google/aosp/scripts"],
+}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl b/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
deleted file mode 100644
index e472f4c..0000000
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IHwCryptoKey.aidl
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * Copyright 2023 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.hardware.security.see.hwcrypto;
-
-import android.hardware.security.see.hwcrypto.IHwCryptoOperations;
-import android.hardware.security.see.hwcrypto.IOpaqueKey;
-import android.hardware.security.see.hwcrypto.KeyPolicy;
-import android.hardware.security.see.hwcrypto.types.ExplicitKeyMaterial;
-import android.hardware.security.see.hwcrypto.types.OpaqueKeyToken;
-
-/*
- * Higher level interface to access and generate keys.
- */
-interface IHwCryptoKey {
-    /*
-     * Identifier for the requested device provided key. The currently supported identifiers are:
-     *
-     * DEVICE_BOUND_KEY:
-     *      This is a key unique to the device.
-     * BATCH_KEY:
-     *      This is a shared by a set of devices.
-     */
-    enum DeviceKeyId {
-        DEVICE_BOUND_KEY,
-        BATCH_KEY,
-    }
-    union DiceBoundDerivationKey {
-        /*
-         * Opaque to be used to derive the DICE bound key.
-         */
-        IOpaqueKey opaqueKey;
-
-        /*
-         * Device provided key to be used to derive the DICE bound key.
-         */
-        DeviceKeyId keyId;
-    }
-
-    parcelable DiceCurrentBoundKeyResult {
-        /*
-         * Key cryptographically bound to a DICE policy.
-         */
-        IOpaqueKey diceBoundKey;
-
-        /*
-         * Current dice policy which was used to generate the returned key. This policy is
-         * opaque from this service perspective (it will be sent to an Authentication Manager
-         * Service to be verified). It follows the structure defined on DicePolicy.cddl, located
-         * under hardware/interfaces/security/authgraph/aidl/android/hardware/security/authgraph/
-         * with the caveat that it could be encrypted if the client does not have enough permissions
-         * to see the device dice policy information.
-         */
-        byte[] dicePolicyForKeyVersion;
-    }
-
-    parcelable DiceBoundKeyResult {
-        /*
-         * Key cryptographically bound to a DICE policy.
-         */
-        IOpaqueKey diceBoundKey;
-
-        /*
-         * Indicates if the diceBoundKey returned was created using a current DICE policy. The
-         * caller can use this to detect if an old policy was provided and rotate its keys if so
-         * desired. Old, valid policies remain usable, but care needs to be taken to not continue to
-         * use a potentially compromised key.
-         */
-        boolean dicePolicyWasCurrent;
-    }
-
-    parcelable ClearKeyPolicy {
-        /*
-         * Indicates the desired key size. It will be used to calculate how many bytes of key
-         * material should be returned.
-         */
-        int keySizeBytes;
-    }
-
-    union DerivedKeyPolicy {
-        /*
-         * If used we will derive a clear key and pass it back as an array of bytes on
-         * <code>HwCryptoKeyMaterial::explicitKey</code>.
-         */
-        ClearKeyPolicy clearKey;
-
-        /*
-         * Policy for the newly derived opaque key. Defines how the key can be used and its type.
-         */
-        byte[] opaqueKey;
-    }
-
-    parcelable DerivedKeyParameters {
-        /*
-         * Key to be used to derive the new key using HKDF.
-         */
-        IOpaqueKey derivationKey;
-
-        /*
-         * Policy for the newly derived key. Depending on its type, either a clear or opaque key
-         * will be derived.
-         */
-        DerivedKeyPolicy keyPolicy;
-
-        /*
-         * An arbitrary set of bytes incorporated into the key derivation. May have
-         * an implementation-specific maximum length, but it is guaranteed to accept
-         * at least 32 bytes.
-         */
-        byte[] context;
-    }
-
-    union DerivedKey {
-        /*
-         * Derived key in clear format.
-         */
-        byte[] explicitKey = {};
-
-        /*
-         * Derived key as a key token to be used only through the HWCrypto service.
-         */
-        IOpaqueKey opaque;
-    }
-
-    /*
-     * deriveCurrentDicePolicyBoundKey() - Derives a versioned key tied to the caller's current DICE
-     *                              policy. It will return this current policy back to the caller
-     *                              along with the generated key.
-     *
-     * @derivationKey:
-     *     Key to be used to derive the new key using HKDF.
-     *
-     * Return:
-     *      Ok(DiceCurrentBoundKeyResult) on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    DiceCurrentBoundKeyResult deriveCurrentDicePolicyBoundKey(
-            in DiceBoundDerivationKey derivationKey);
-
-    /*
-     * deriveDicePolicyBoundKey() - Derive a versioned key by checking the provided DICE policy
-     *                              against the caller and then using it as a context for deriving
-     *                              the returned key.
-     *
-     * @derivationKey:
-     *     Key to be used to derive the new key using HKDF.
-     *
-     * @dicePolicyForKeyVersion:
-     *     Policy used to derive keys tied to specific versions. Using this parameter
-     *     the caller can tie a derived key to a minimum version of itself, so in the future only
-     *     itself or a more recent version can derive the same key. This parameter is opaque to the
-     *     caller and it could be encrypted in the case the client doesn't have permission to know
-     *     the dice chain.
-     *     When implementing this function, this parameter shall be one of the components fed
-     *     to the KDF context and it needs to be checked against the caller DICE certificate before
-     *     being used.
-     *
-     * Return:
-     *      Ok(DiceBoundKeyResult) on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    DiceBoundKeyResult deriveDicePolicyBoundKey(
-            in DiceBoundDerivationKey derivationKey, in byte[] dicePolicyForKeyVersion);
-
-    /*
-     * deriveKey() - Derive a new key based on the given key, policy and context.
-     *
-     * @parameters:
-     *      Parameters used for the key derivation. See <code>DerivedKeyParameters</code> on this
-     *      file for more information.
-     *
-     * Return:
-     *      Ok(HwCryptoKeyMaterial) on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    DerivedKey deriveKey(in DerivedKeyParameters parameters);
-
-    /*
-     * getHwCryptoOperations() - Returns an interface used to work on opaque keys. This interface
-     *                           can also be used to operate on any opaque key generated by
-     *                           hwkeyDeriveVersioned, even if this key has been generated after
-     *                           retrieving a IHwCryptoOperations binder object, as long as the
-     *                           parent IHwCryptoDeviceKeyAccess is not dropped between retrieving
-     *                           the IHwCryptoOperations binder object and deriving the key.
-     *                           IHwCryptoOperations can also be used to create opaque keys that
-     *                           are not bound to the device.
-     *
-     * Return:
-     *      IHwCryptoOperations on success
-     */
-    IHwCryptoOperations getHwCryptoOperations();
-
-    /*
-     * importClearKey() - Imports a SW clear key into the secure environment.
-     *
-     * @keyMaterial:
-     *     key to be imported.
-     * @newKeyPolicy:
-     *      Policy of the new key. Defines how the newly created key can be used. Because any
-     *      clear key imported into the system is considered to have a
-     *      <code>KeyLifetime::PORTABLE</code> lifetime, a call to this function will return an
-     *      error if <code>newKeyPolicy.newKeyPolicy</code> is not set to portable.
-     *
-     * Return:
-     *      IOpaqueKey on success, service specific error based on <code>HalErrorCode</code>
-     *      otherwise.
-     */
-    IOpaqueKey importClearKey(in ExplicitKeyMaterial keyMaterial, in KeyPolicy newKeyPolicy);
-
-    /*
-     * getCurrentDicePolicy() - Returns the client current DICE policy. This policy is encrypted and
-     *                          considered opaque from the client perspective. This policy is the
-     *                          same used to create DICE bound keys and will also be used to seal
-     *                          secrets that can only be retrieved by the DICE policy owner. The
-     *                          first use of this seal operation will be
-     *                          <code>IOpaqueKey::getShareableToken</code> and
-     *                          <code>IHwCryptoKey::keyTokenImport</code>. To start this process,
-     *                          the intended key receiver will call this function and then pass the
-     *                          generated DICE policy to the owner of the key that the receiver
-     *                          wants to import. The key owner will then call
-     *                          <code>IOpaqueKey::getShareableToken</code> passing the receiver DICE
-     *                          policy to insure that only that receiver can import the key.
-     *
-     * Return:
-     *      byte[] on success, which is the caller encrypted DICE policy.
-     */
-    byte[] getCurrentDicePolicy();
-
-    /*
-     * key_token_import() - Imports a key from a different client service instance. Because
-     *                      IOpaqueKey are binder objects that cannot be directly shared between
-     *                      binder rpc clients, this method provide a way to send a key to another
-     *                      client. Keys to be imported by the receiver are represented by a token
-     *                      created using <code>IOpaqueKey::getShareableToken</code>. The flow
-     *                      to create this token is described in
-     *                      <code>IHwCryptoKey::getCurrentDicePolicy</code>.
-     *
-     * @requested_key:
-     *      Handle to the key to be imported to the caller service.
-     * @sealingDicePolicy:
-     *      DICE policy used to seal the exported key.
-     * Return:
-     *      A IOpaqueKey that can be directly be used on the local HWCrypto service on
-     *      success, service specific error based on <code>HalErrorCode</code> otherwise.
-     */
-    IOpaqueKey keyTokenImport(in OpaqueKeyToken requestedKey, in byte[] sealingDicePolicy);
-}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl b/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
deleted file mode 100644
index eba4d1c..0000000
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/IOpaqueKey.aidl
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright 2024 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.hardware.security.see.hwcrypto;
-
-import android.hardware.security.see.hwcrypto.KeyPolicy;
-import android.hardware.security.see.hwcrypto.types.OpaqueKeyToken;
-import android.hardware.security.see.hwcrypto.types.OperationType;
-
-interface IOpaqueKey {
-    /*
-     * exportWrappedKey() - Exports this key as a wrapped (encrypted) blob.
-     *
-     * @wrapping_key:
-     *     wrapping key. It needs to be an opaque key and its policy needs to indicate that it can
-     *     be used for key wrapping.
-     *
-     * Return:
-     *      Wrapped key blob as a byte array on success. Format of the blob is opaque to the service
-     *      but has to match the command accepted by
-     *      <code>IHwCryptoKeyGeneration::importWrappedKey</code>, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    byte[] exportWrappedKey(in IOpaqueKey wrappingKey);
-
-    /*
-     * getKeyPolicy() - Returns the key policy.
-     *
-     * Return:
-     *      A <code>KeyPolicy</code> on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    KeyPolicy getKeyPolicy();
-
-    /*
-     * getPublicKey() - Returns the public key portion of this OpaqueKey. This operation is only
-     *                  valid for asymmetric keys
-     *
-     * Return:
-     *      public key as a byte array on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise. Format used for the returned public key is COSE.
-     */
-    byte[] getPublicKey();
-
-    /*
-     * getShareableToken() - Returns a token that can shared with another HWCrypto client.
-     *
-     * @sealingDicePolicy:
-     *      Token to be used to protect the returned OpaqueKeyToken. It will be used so only
-     *      the owner of the sealingDicePolicy can import the key.
-     * Return:
-     *      <code>OpaqueKeyMaterial</code> token on success, service specific error based on
-     *      <code>HalErrorCode</code> otherwise.
-     */
-    OpaqueKeyToken getShareableToken(in byte[] sealingDicePolicy);
-}
diff --git a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl b/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl
deleted file mode 100644
index 3cf4670..0000000
--- a/staging/security/see/hwcrypto/aidl/android/hardware/security/see/hwcrypto/types/KeyType.aidl
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright 2024 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.hardware.security.see.hwcrypto.types;
-
-/*
- * Enum describing all supported key types. Key types are strongly bound to the algorithm to
- * prevent reusing the same key on different algorithms (e.g. using the same key for 2 different AES
- * 128 Cipher modes).
- */
-enum KeyType {
-    AES_128_CBC_NO_PADDING,
-    AES_128_CBC_PKCS7_PADDING,
-    AES_128_CTR,
-    AES_128_GCM,
-    AES_128_CMAC,
-    AES_256_CBC_NO_PADDING,
-    AES_256_CBC_PKCS7_PADDING,
-    AES_256_CTR,
-    AES_256_GCM,
-    AES_256_CMAC,
-    HMAC_SHA256,
-    HMAC_SHA512,
-    RSA2048_PSS_SHA256,
-    RSA2048_PKCS1_5_SHA256,
-    ECC_NIST_P256_SIGN_NO_PADDING,
-    ECC_NIST_P256_SIGN_SHA256,
-    ECC_NIST_P521_SIGN_NO_PADDING,
-    ECC_NIST_P521_SIGN_SHA512,
-    ECC_ED25519_SIGN,
-}