Merge "Refine ContextHub HAL API updates" into udc-dev
diff --git a/audio/aidl/Android.bp b/audio/aidl/Android.bp
index e6b0cee..bb48ecd 100644
--- a/audio/aidl/Android.bp
+++ b/audio/aidl/Android.bp
@@ -36,12 +36,13 @@
         "android.hardware.audio_defaults",
     ],
     srcs: [
+        "android/hardware/audio/common/AudioOffloadMetadata.aidl",
         "android/hardware/audio/common/PlaybackTrackMetadata.aidl",
         "android/hardware/audio/common/RecordTrackMetadata.aidl",
         "android/hardware/audio/common/SinkMetadata.aidl",
         "android/hardware/audio/common/SourceMetadata.aidl",
     ],
-    frozen: true,
+    frozen: false,
     imports: [
         "android.media.audio.common.types-V2",
     ],
@@ -77,7 +78,7 @@
 }
 
 // Note: This should always be one version ahead of the last frozen version
-latest_android_hardware_audio_common = "android.hardware.audio.common-V1"
+latest_android_hardware_audio_common = "android.hardware.audio.common-V2"
 
 // Modules that depend on android.hardware.audio.common directly can include
 // the following cc_defaults to avoid explicitly managing dependency versions
@@ -112,6 +113,7 @@
         "android/hardware/audio/core/AudioPatch.aidl",
         "android/hardware/audio/core/AudioRoute.aidl",
         "android/hardware/audio/core/IBluetooth.aidl",
+        "android/hardware/audio/core/IBluetoothA2dp.aidl",
         "android/hardware/audio/core/IConfig.aidl",
         "android/hardware/audio/core/IModule.aidl",
         "android/hardware/audio/core/IStreamCallback.aidl",
@@ -129,7 +131,7 @@
     imports: [
         "android.hardware.common-V2",
         "android.hardware.common.fmq-V1",
-        "android.hardware.audio.common-V1",
+        "android.hardware.audio.common-V2",
         "android.hardware.audio.core.sounddose-V1",
         "android.hardware.audio.effect-V1",
         "android.media.audio.common.types-V2",
@@ -253,7 +255,7 @@
     imports: [
         "android.hardware.common-V2",
         "android.hardware.common.fmq-V1",
-        "android.hardware.audio.common-V1",
+        "android.hardware.audio.common-V2",
         "android.media.audio.common.types-V2",
     ],
     backend: {
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/audio/aidl/aidl_api/android.hardware.audio.common/current/android/hardware/audio/common/AudioOffloadMetadata.aidl
similarity index 82%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.common/current/android/hardware/audio/common/AudioOffloadMetadata.aidl
index ea86c4f..000504b 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.common/current/android/hardware/audio/common/AudioOffloadMetadata.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
-@VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+package android.hardware.audio.common;
+@JavaDerive(equals=true, toString=true) @VintfStability
+parcelable AudioOffloadMetadata {
+  int sampleRate;
+  android.media.audio.common.AudioChannelLayout channelMask;
+  int averageBitRatePerSecond;
+  int delayFrames;
+  int paddingFrames;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetoothA2dp.aidl
similarity index 83%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetoothA2dp.aidl
index ea86c4f..0f4c46d 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetoothA2dp.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
+package android.hardware.audio.core;
 @VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+interface IBluetoothA2dp {
+  boolean isEnabled();
+  void setEnabled(boolean enabled);
+  boolean supportsOffloadReconfiguration();
+  void reconfigureOffload(in android.hardware.audio.core.VendorParameter[] parameters);
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
index 1eafdab..f18d6a5 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
@@ -37,6 +37,7 @@
   void setModuleDebug(in android.hardware.audio.core.ModuleDebug debug);
   @nullable android.hardware.audio.core.ITelephony getTelephony();
   @nullable android.hardware.audio.core.IBluetooth getBluetooth();
+  @nullable android.hardware.audio.core.IBluetoothA2dp getBluetoothA2dp();
   android.media.audio.common.AudioPort connectExternalDevice(in android.media.audio.common.AudioPort templateIdAndAdditionalData);
   void disconnectExternalDevice(int portId);
   android.hardware.audio.core.AudioPatch[] getAudioPatches();
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IStreamOut.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IStreamOut.aidl
index 46acc11..ec3078e 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IStreamOut.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IStreamOut.aidl
@@ -36,6 +36,7 @@
 interface IStreamOut {
   android.hardware.audio.core.IStreamCommon getStreamCommon();
   void updateMetadata(in android.hardware.audio.common.SourceMetadata sourceMetadata);
+  void updateOffloadMetadata(in android.hardware.audio.common.AudioOffloadMetadata offloadMetadata);
   float[] getHwVolume();
   void setHwVolume(in float[] channelVolumes);
   float getAudioDescriptionMixLevel();
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/EnvironmentalReverb.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/EnvironmentalReverb.aidl
index a193102..c12ebb8 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/EnvironmentalReverb.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/EnvironmentalReverb.aidl
@@ -39,6 +39,8 @@
   int roomHfLevelMb;
   int decayTimeMs;
   int decayHfRatioPm;
+  int reflectionsLevelMb;
+  int reflectionsDelayMs;
   int levelMb;
   int delayMs;
   int diffusionPm;
diff --git a/audio/aidl/android/hardware/audio/common/AudioOffloadMetadata.aidl b/audio/aidl/android/hardware/audio/common/AudioOffloadMetadata.aidl
new file mode 100644
index 0000000..5881658
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/common/AudioOffloadMetadata.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.common;
+
+import android.media.audio.common.AudioChannelLayout;
+
+/**
+ * Dynamic metadata for offloaded compressed audio.
+ * For static metadata, see android.media.audio.common.AudioOffloadInfo.
+ */
+@JavaDerive(equals=true, toString=true)
+@VintfStability
+parcelable AudioOffloadMetadata {
+    int sampleRate;
+    AudioChannelLayout channelMask;
+    /** Average bit rate in bits per second. */
+    int averageBitRatePerSecond;
+    /**
+     * Number of frames to be ignored at the beginning of the stream.
+     * The value must be non-negative. A value of 0 indicates no delay
+     * has to be applied.
+     */
+    int delayFrames;
+    /**
+     * Number of frames to be ignored at the end of the stream.
+     * The value must be non-negative. A value of 0 indicates no padding
+     * has to be applied.
+     */
+    int paddingFrames;
+}
diff --git a/audio/aidl/android/hardware/audio/core/IBluetoothA2dp.aidl b/audio/aidl/android/hardware/audio/core/IBluetoothA2dp.aidl
new file mode 100644
index 0000000..dc4b8d0
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/core/IBluetoothA2dp.aidl
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.core;
+
+import android.hardware.audio.core.VendorParameter;
+
+/**
+ * An instance of IBluetoothA2dp manages settings for the A2DP (Advanced Audio
+ * Distribution Profile) profiles. This interface is optional to implement by
+ * the vendor. It needs to be provided only if the device actually supports BT
+ * A2DP.
+ *
+ * This interface is separate from IBluetooth interface which manages SCO & HFP.
+ * The HAL module can handle both SCO and A2DP profiles or only one of them.
+ */
+@VintfStability
+interface IBluetoothA2dp {
+    /**
+     * Whether BT A2DP is enabled.
+     *
+     * Returns the current state of A2DP support. The client might need to
+     * disable (suspend) A2DP when another profile (for example, SCO) is
+     * activated.
+     *
+     * @return Whether BT A2DP is enabled.
+     */
+    boolean isEnabled();
+
+    /**
+     * Enable or disable A2DP.
+     *
+     * Sets the current state of A2DP support. The client might need to
+     * disable (suspend) A2DP when another profile (for example, SCO) is
+     * activated.
+     *
+     * @param enabled Whether BT A2DP must be enabled or suspended.
+     * @throws EX_ILLEGAL_STATE If there was an error performing the operation.
+     */
+    void setEnabled(boolean enabled);
+
+    /**
+     * Indicates whether the module supports reconfiguration of offloaded codecs.
+     *
+     * Offloaded coded implementations may need to be reconfigured when the
+     * active A2DP device changes. This method indicates whether the HAL module
+     * supports the reconfiguration event. The result returned from this method
+     * must not change over time.
+     *
+     * @return Whether reconfiguration offload of offloaded codecs is supported.
+     */
+    boolean supportsOffloadReconfiguration();
+
+    /**
+     * Instructs the HAL module to reconfigure offloaded codec.
+     *
+     * Offloaded coded implementations may need to be reconfigured when the
+     * active A2DP device changes. This method is a notification for the HAL
+     * module to commence reconfiguration.
+     *
+     * Note that 'EX_UNSUPPORTED_OPERATION' may only be thrown when
+     * 'supportsOffloadReconfiguration' returns 'false'.
+     *
+     * @param parameter Optional vendor-specific parameters, can be left empty.
+     * @throws EX_ILLEGAL_STATE If there was an error performing the operation,
+     *                          or the operation can not be commenced in the current state.
+     * @throws EX_UNSUPPORTED_OPERATION If the module does not support codec reconfiguration.
+     */
+    void reconfigureOffload(in VendorParameter[] parameters);
+}
diff --git a/audio/aidl/android/hardware/audio/core/IModule.aidl b/audio/aidl/android/hardware/audio/core/IModule.aidl
index edfb9f2..080d826 100644
--- a/audio/aidl/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/android/hardware/audio/core/IModule.aidl
@@ -21,6 +21,7 @@
 import android.hardware.audio.core.AudioPatch;
 import android.hardware.audio.core.AudioRoute;
 import android.hardware.audio.core.IBluetooth;
+import android.hardware.audio.core.IBluetoothA2dp;
 import android.hardware.audio.core.IStreamCallback;
 import android.hardware.audio.core.IStreamIn;
 import android.hardware.audio.core.IStreamOut;
@@ -103,6 +104,20 @@
     @nullable IBluetooth getBluetooth();
 
     /**
+     * Retrieve the interface to control Bluetooth A2DP.
+     *
+     * If the HAL module supports A2DP Profile functionality for Bluetooth, it
+     * must return an instance of the IBluetoothA2dp interface. The same
+     * instance must be returned during the lifetime of the HAL module. If the
+     * HAL module does not support BT A2DP, a null must be returned, without
+     * throwing any errors.
+     *
+     * @return An instance of the IBluetoothA2dp interface implementation.
+     * @throws EX_ILLEGAL_STATE If there was an error creating an instance.
+     */
+    @nullable IBluetoothA2dp getBluetoothA2dp();
+
+    /**
      * Set a device port of an external device into connected state.
      *
      * This method is used to inform the HAL module that an external device has
@@ -596,6 +611,7 @@
      * @param mute Whether the output from the module is muted.
      * @throws EX_UNSUPPORTED_OPERATION If muting of combined output
      *                                  is not supported by the module.
+     * @throws EX_ILLEGAL_STATE If any error happens while muting of combined output.
      */
     void setMasterMute(boolean mute);
 
@@ -627,6 +643,8 @@
      *                             accepted range.
      * @throws EX_UNSUPPORTED_OPERATION If attenuation of combined output
      *                                  is not supported by the module.
+     * @throws EX_ILLEGAL_STATE If any error happens while updating attenuation of
+                                combined output.
      */
     void setMasterVolume(float volume);
 
diff --git a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
index 0e58add..f26dc1c 100644
--- a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
+++ b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
@@ -16,6 +16,7 @@
 
 package android.hardware.audio.core;
 
+import android.hardware.audio.common.AudioOffloadMetadata;
 import android.hardware.audio.common.SourceMetadata;
 import android.hardware.audio.core.IStreamCommon;
 import android.media.audio.common.AudioDualMonoMode;
@@ -48,6 +49,18 @@
      */
     void updateMetadata(in SourceMetadata sourceMetadata);
 
+    /**
+     * Update offload metadata for a compressed stream.
+     *
+     * Updates the offload metadata initially provided at the stream creation.
+     *
+     * @param offloadMetadata Updated offload metadata.
+     * @throws EX_ILLEGAL_STATE If the stream is closed.
+     * @throws EX_ILLEGAL_ARGUMENT If the metadata contains invalid values.
+     * @throws EX_UNSUPPORTED_OPERATION If the stream is not for compressed offload.
+     */
+    void updateOffloadMetadata(in AudioOffloadMetadata offloadMetadata);
+
     const int HW_VOLUME_MIN = 0;
     const int HW_VOLUME_MAX = 1;
     /**
@@ -85,7 +98,8 @@
      * @throws EX_ILLEGAL_ARGUMENT If the number of elements in the provided
      *                             array does not match the channel count, or
      *                             attenuation values are out of range.
-     * @throws EX_ILLEGAL_STATE If the stream is closed.
+     * @throws EX_ILLEGAL_STATE If the stream is closed or there is any error happens
+                                when applying hardware volume.
      * @throws EX_UNSUPPORTED_OPERATION If hardware volume control is not supported.
      */
     void setHwVolume(in float[] channelVolumes);
diff --git a/audio/aidl/android/hardware/audio/effect/EnvironmentalReverb.aidl b/audio/aidl/android/hardware/audio/effect/EnvironmentalReverb.aidl
index a158dca..95d1ff6 100644
--- a/audio/aidl/android/hardware/audio/effect/EnvironmentalReverb.aidl
+++ b/audio/aidl/android/hardware/audio/effect/EnvironmentalReverb.aidl
@@ -59,6 +59,14 @@
      */
     int decayHfRatioPm;
     /**
+     * Reverb reflections level in millibels.
+     */
+    int reflectionsLevelMb;
+    /**
+     * Reverb reflections delay in milliseconds.
+     */
+    int reflectionsDelayMs;
+    /**
      * Reverb level in millibels.
      */
     int levelMb;
diff --git a/audio/aidl/default/Android.bp b/audio/aidl/default/Android.bp
index 21616be..ea00dcb 100644
--- a/audio/aidl/default/Android.bp
+++ b/audio/aidl/default/Android.bp
@@ -54,12 +54,13 @@
     ],
 }
 
-cc_library_static {
+cc_library {
     name: "libaudioserviceexampleimpl",
     defaults: [
         "aidlaudioservice_defaults",
         "latest_android_media_audio_common_types_ndk_shared",
         "latest_android_hardware_audio_core_ndk_shared",
+        "latest_android_hardware_audio_core_sounddose_ndk_shared",
     ],
     export_include_dirs: ["include"],
     srcs: [
@@ -75,6 +76,7 @@
         "Telephony.cpp",
         "usb/ModuleUsb.cpp",
         "usb/StreamUsb.cpp",
+        "usb/UsbAlsaMixerControl.cpp",
         "usb/UsbAlsaUtils.cpp",
     ],
     generated_sources: [
diff --git a/audio/aidl/default/Bluetooth.cpp b/audio/aidl/default/Bluetooth.cpp
index 38e0c21..bd9a864 100644
--- a/audio/aidl/default/Bluetooth.cpp
+++ b/audio/aidl/default/Bluetooth.cpp
@@ -19,6 +19,7 @@
 
 #include "core-impl/Bluetooth.h"
 
+using aidl::android::hardware::audio::core::VendorParameter;
 using aidl::android::media::audio::common::Boolean;
 using aidl::android::media::audio::common::Float;
 using aidl::android::media::audio::common::Int;
@@ -79,4 +80,29 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus BluetoothA2dp::isEnabled(bool* _aidl_return) {
+    *_aidl_return = mEnabled;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus BluetoothA2dp::setEnabled(bool in_enabled) {
+    mEnabled = in_enabled;
+    LOG(DEBUG) << __func__ << ": " << mEnabled;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus BluetoothA2dp::supportsOffloadReconfiguration(bool* _aidl_return) {
+    *_aidl_return = true;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus BluetoothA2dp::reconfigureOffload(
+        const std::vector<::aidl::android::hardware::audio::core::VendorParameter>& in_parameters
+                __unused) {
+    LOG(DEBUG) << __func__ << ": " << ::android::internal::ToString(in_parameters);
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/Module.cpp b/audio/aidl/default/Module.cpp
index 10aead2..c4f3844 100644
--- a/audio/aidl/default/Module.cpp
+++ b/audio/aidl/default/Module.cpp
@@ -370,29 +370,32 @@
 }
 
 ndk::ScopedAStatus Module::getTelephony(std::shared_ptr<ITelephony>* _aidl_return) {
-    if (mTelephony == nullptr) {
+    if (!mTelephony) {
         mTelephony = ndk::SharedRefBase::make<Telephony>();
-        mTelephonyBinder = mTelephony->asBinder();
-        AIBinder_setMinSchedulerPolicy(mTelephonyBinder.get(), SCHED_NORMAL,
-                                       ANDROID_PRIORITY_AUDIO);
     }
-    *_aidl_return = mTelephony;
+    *_aidl_return = mTelephony.getPtr();
     LOG(DEBUG) << __func__ << ": returning instance of ITelephony: " << _aidl_return->get();
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus Module::getBluetooth(std::shared_ptr<IBluetooth>* _aidl_return) {
-    if (mBluetooth == nullptr) {
+    if (!mBluetooth) {
         mBluetooth = ndk::SharedRefBase::make<Bluetooth>();
-        mBluetoothBinder = mBluetooth->asBinder();
-        AIBinder_setMinSchedulerPolicy(mBluetoothBinder.get(), SCHED_NORMAL,
-                                       ANDROID_PRIORITY_AUDIO);
     }
-    *_aidl_return = mBluetooth;
+    *_aidl_return = mBluetooth.getPtr();
     LOG(DEBUG) << __func__ << ": returning instance of IBluetooth: " << _aidl_return->get();
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus Module::getBluetoothA2dp(std::shared_ptr<IBluetoothA2dp>* _aidl_return) {
+    if (!mBluetoothA2dp) {
+        mBluetoothA2dp = ndk::SharedRefBase::make<BluetoothA2dp>();
+    }
+    *_aidl_return = mBluetoothA2dp.getPtr();
+    LOG(DEBUG) << __func__ << ": returning instance of IBluetoothA2dp: " << _aidl_return->get();
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus Module::connectExternalDevice(const AudioPort& in_templateIdAndAdditionalData,
                                                  AudioPort* _aidl_return) {
     const int32_t templateId = in_templateIdAndAdditionalData.id;
@@ -457,6 +460,7 @@
         connectedPort.profiles = connectedProfilesIt->second;
     }
     ports.push_back(connectedPort);
+    onExternalDeviceConnectionChanged(connectedPort, true /*connected*/);
     *_aidl_return = std::move(connectedPort);
 
     std::vector<AudioRoute> newRoutes;
@@ -510,6 +514,7 @@
                    << configIt->id;
         return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
     }
+    onExternalDeviceConnectionChanged(*portIt, false /*connected*/);
     ports.erase(portIt);
     mConnectedDevicePorts.erase(in_portId);
     LOG(DEBUG) << __func__ << ": connected device port " << in_portId << " released";
@@ -895,6 +900,21 @@
         out_suggested->gain = in_requested.gain.value();
     }
 
+    if (in_requested.ext.getTag() != AudioPortExt::Tag::unspecified) {
+        if (in_requested.ext.getTag() == out_suggested->ext.getTag()) {
+            if (out_suggested->ext.getTag() == AudioPortExt::Tag::mix) {
+                // 'AudioMixPortExt.handle' is set by the client, copy from in_requested
+                out_suggested->ext.get<AudioPortExt::Tag::mix>().handle =
+                        in_requested.ext.get<AudioPortExt::Tag::mix>().handle;
+            }
+        } else {
+            LOG(WARNING) << __func__ << ": requested ext tag "
+                         << toString(in_requested.ext.getTag()) << " do not match port's tag "
+                         << toString(out_suggested->ext.getTag());
+            requestedIsValid = false;
+        }
+    }
+
     if (existing == configs.end() && requestedIsValid && requestedIsFullySpecified) {
         out_suggested->id = getConfig().nextPortId++;
         configs.push_back(*out_suggested);
@@ -965,8 +985,17 @@
 
 ndk::ScopedAStatus Module::setMasterMute(bool in_mute) {
     LOG(DEBUG) << __func__ << ": " << in_mute;
-    mMasterMute = in_mute;
-    return ndk::ScopedAStatus::ok();
+    auto result = mDebug.simulateDeviceConnections ? ndk::ScopedAStatus::ok()
+                                                   : onMasterMuteChanged(in_mute);
+    if (result.isOk()) {
+        mMasterMute = in_mute;
+    } else {
+        LOG(ERROR) << __func__ << ": failed calling onMasterMuteChanged(" << in_mute
+                   << "), error=" << result;
+        // Reset master mute if it failed.
+        onMasterMuteChanged(mMasterMute);
+    }
+    return std::move(result);
 }
 
 ndk::ScopedAStatus Module::getMasterVolume(float* _aidl_return) {
@@ -978,8 +1007,17 @@
 ndk::ScopedAStatus Module::setMasterVolume(float in_volume) {
     LOG(DEBUG) << __func__ << ": " << in_volume;
     if (in_volume >= 0.0f && in_volume <= 1.0f) {
-        mMasterVolume = in_volume;
-        return ndk::ScopedAStatus::ok();
+        auto result = mDebug.simulateDeviceConnections ? ndk::ScopedAStatus::ok()
+                                                       : onMasterVolumeChanged(in_volume);
+        if (result.isOk()) {
+            mMasterVolume = in_volume;
+        } else {
+            // Reset master volume if it failed.
+            LOG(ERROR) << __func__ << ": failed calling onMasterVolumeChanged(" << in_volume
+                       << "), error=" << result;
+            onMasterVolumeChanged(mMasterVolume);
+        }
+        return std::move(result);
     }
     LOG(ERROR) << __func__ << ": invalid master volume value: " << in_volume;
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
@@ -1024,13 +1062,10 @@
 }
 
 ndk::ScopedAStatus Module::getSoundDose(std::shared_ptr<ISoundDose>* _aidl_return) {
-    if (mSoundDose == nullptr) {
+    if (!mSoundDose) {
         mSoundDose = ndk::SharedRefBase::make<sounddose::SoundDose>();
-        mSoundDoseBinder = mSoundDose->asBinder();
-        AIBinder_setMinSchedulerPolicy(mSoundDoseBinder.get(), SCHED_NORMAL,
-                                       ANDROID_PRIORITY_AUDIO);
     }
-    *_aidl_return = mSoundDose;
+    *_aidl_return = mSoundDose.getPtr();
     LOG(DEBUG) << __func__ << ": returning instance of ISoundDose: " << _aidl_return->get();
     return ndk::ScopedAStatus::ok();
 }
@@ -1236,14 +1271,30 @@
 }
 
 ndk::ScopedAStatus Module::populateConnectedDevicePort(AudioPort* audioPort __unused) {
-    LOG(DEBUG) << __func__ << ": do nothing and return ok";
+    LOG(VERBOSE) << __func__ << ": do nothing and return ok";
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus Module::checkAudioPatchEndpointsMatch(
         const std::vector<AudioPortConfig*>& sources __unused,
         const std::vector<AudioPortConfig*>& sinks __unused) {
-    LOG(DEBUG) << __func__ << ": do nothing and return ok";
+    LOG(VERBOSE) << __func__ << ": do nothing and return ok";
+    return ndk::ScopedAStatus::ok();
+}
+
+void Module::onExternalDeviceConnectionChanged(
+        const ::aidl::android::media::audio::common::AudioPort& audioPort __unused,
+        bool connected __unused) {
+    LOG(DEBUG) << __func__ << ": do nothing and return";
+}
+
+ndk::ScopedAStatus Module::onMasterMuteChanged(bool mute __unused) {
+    LOG(VERBOSE) << __func__ << ": do nothing and return ok";
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::onMasterVolumeChanged(float volume __unused) {
+    LOG(VERBOSE) << __func__ << ": do nothing and return ok";
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/audio/aidl/default/Stream.cpp b/audio/aidl/default/Stream.cpp
index 49ad2f2..193c793 100644
--- a/audio/aidl/default/Stream.cpp
+++ b/audio/aidl/default/Stream.cpp
@@ -24,6 +24,7 @@
 #include "core-impl/Module.h"
 #include "core-impl/Stream.h"
 
+using aidl::android::hardware::audio::common::AudioOffloadMetadata;
 using aidl::android::hardware::audio::common::SinkMetadata;
 using aidl::android::hardware::audio::common::SourceMetadata;
 using aidl::android::media::audio::common::AudioDevice;
@@ -785,6 +786,40 @@
     LOG(DEBUG) << __func__;
 }
 
+ndk::ScopedAStatus StreamOut::updateOffloadMetadata(
+        const AudioOffloadMetadata& in_offloadMetadata) {
+    LOG(DEBUG) << __func__;
+    if (isClosed()) {
+        LOG(ERROR) << __func__ << ": stream was closed";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    }
+    if (!mOffloadInfo.has_value()) {
+        LOG(ERROR) << __func__ << ": not a compressed offload stream";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    if (in_offloadMetadata.sampleRate < 0) {
+        LOG(ERROR) << __func__ << ": invalid sample rate value: " << in_offloadMetadata.sampleRate;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    if (in_offloadMetadata.averageBitRatePerSecond < 0) {
+        LOG(ERROR) << __func__
+                   << ": invalid average BPS value: " << in_offloadMetadata.averageBitRatePerSecond;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    if (in_offloadMetadata.delayFrames < 0) {
+        LOG(ERROR) << __func__
+                   << ": invalid delay frames value: " << in_offloadMetadata.delayFrames;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    if (in_offloadMetadata.paddingFrames < 0) {
+        LOG(ERROR) << __func__
+                   << ": invalid padding frames value: " << in_offloadMetadata.paddingFrames;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    mOffloadMetadata = in_offloadMetadata;
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus StreamOut::getHwVolume(std::vector<float>* _aidl_return) {
     LOG(DEBUG) << __func__;
     (void)_aidl_return;
diff --git a/audio/aidl/default/audio_effects_config.xml b/audio/aidl/default/audio_effects_config.xml
index 88c4459..c06742d 100644
--- a/audio/aidl/default/audio_effects_config.xml
+++ b/audio/aidl/default/audio_effects_config.xml
@@ -40,6 +40,7 @@
         <library name="loudness_enhancer" path="libloudnessenhanceraidl.so"/>
         <library name="nssw" path="libnssw.so"/>
         <library name="env_reverbsw" path="libenvreverbsw.so"/>
+        <library name="pre_processing" path="libpreprocessingaidl.so"/>
         <library name="preset_reverbsw" path="libpresetreverbsw.so"/>
         <library name="reverb" path="libreverbaidl.so"/>
         <library name="virtualizersw" path="libvirtualizersw.so"/>
@@ -68,9 +69,7 @@
     -->
 
     <effects>
-        <effect name="acoustic_echo_canceler" library="aecsw" uuid="bb392ec0-8d4d-11e0-a896-0002a5d5c51b"/>
-        <effect name="automatic_gain_control_v1" library="agc1sw" uuid="aa8130e0-66fc-11e0-bad0-0002a5d5c51b"/>
-        <effect name="automatic_gain_control_v2" library="agc2sw" uuid="89f38e65-d4d2-4d64-ad0e-2b3e799ea886"/>
+        <effect name="automatic_gain_control_v2" library="pre_processing" uuid="89f38e65-d4d2-4d64-ad0e-2b3e799ea886"/>
         <effectProxy name="bassboost" uuid="14804144-a5ee-4d24-aa88-0002a5d5c51b">
             <libsw library="bassboostsw" uuid="fa8181f2-588b-11ed-9b6a-0242ac120002"/>
             <libsw library="bundle" uuid="8631f300-72e2-11df-b57e-0002a5d5c51b"/>
@@ -80,7 +79,6 @@
         <effect name="haptic_generator" library="haptic_generator" uuid="97c4acd1-8b82-4f2f-832e-c2fe5d7a9931"/>
         <effect name="loudness_enhancer" library="loudness_enhancer" uuid="fa415329-2034-4bea-b5dc-5b381c8d1e2c"/>
         <effect name="env_reverb" library="env_reverbsw" uuid="fa819886-588b-11ed-9b6a-0242ac120002"/>
-        <effect name="noise_suppression" library="nssw" uuid="c06c8400-8e06-11e0-9cb6-0002a5d5c51b"/>
         <effect name="preset_reverb" library="preset_reverbsw" uuid="fa8199c6-588b-11ed-9b6a-0242ac120002"/>
         <effect name="reverb_env_aux" library="reverb" uuid="4a387fc0-8ab3-11df-8bad-0002a5d5c51b"/>
         <effect name="reverb_env_ins" library="reverb" uuid="c7a511a0-a3bb-11df-860e-0002a5d5c51b"/>
diff --git a/audio/aidl/default/envReverb/EnvReverbSw.cpp b/audio/aidl/default/envReverb/EnvReverbSw.cpp
index 46d9016..15373fe 100644
--- a/audio/aidl/default/envReverb/EnvReverbSw.cpp
+++ b/audio/aidl/default/envReverb/EnvReverbSw.cpp
@@ -66,6 +66,8 @@
         MAKE_RANGE(EnvironmentalReverb, roomHfLevelMb, -4000, 0),
         MAKE_RANGE(EnvironmentalReverb, decayTimeMs, 0, 7000),
         MAKE_RANGE(EnvironmentalReverb, decayHfRatioPm, 100, 2000),
+        MAKE_RANGE(EnvironmentalReverb, reflectionsLevelMb, -6000, 0),
+        MAKE_RANGE(EnvironmentalReverb, reflectionsDelayMs, 0, 65),
         MAKE_RANGE(EnvironmentalReverb, levelMb, -6000, 0),
         MAKE_RANGE(EnvironmentalReverb, delayMs, 0, 65),
         MAKE_RANGE(EnvironmentalReverb, diffusionPm, 0, 1000),
@@ -125,6 +127,20 @@
                     EX_ILLEGAL_ARGUMENT, "setDecayHfRatioFailed");
             return ndk::ScopedAStatus::ok();
         }
+        case EnvironmentalReverb::reflectionsLevelMb: {
+            RETURN_IF(mContext->setErReflectionsLevel(
+                              erParam.get<EnvironmentalReverb::reflectionsLevelMb>()) !=
+                              RetCode::SUCCESS,
+                      EX_ILLEGAL_ARGUMENT, "setReflectionsLevelFailed");
+            return ndk::ScopedAStatus::ok();
+        }
+        case EnvironmentalReverb::reflectionsDelayMs: {
+            RETURN_IF(mContext->setErReflectionsDelay(
+                              erParam.get<EnvironmentalReverb::reflectionsDelayMs>()) !=
+                              RetCode::SUCCESS,
+                      EX_ILLEGAL_ARGUMENT, "setReflectionsDelayFailed");
+            return ndk::ScopedAStatus::ok();
+        }
         case EnvironmentalReverb::levelMb: {
             RETURN_IF(mContext->setErLevel(erParam.get<EnvironmentalReverb::levelMb>()) !=
                               RetCode::SUCCESS,
@@ -201,6 +217,14 @@
             erParam.set<EnvironmentalReverb::decayHfRatioPm>(mContext->getErDecayHfRatio());
             break;
         }
+        case EnvironmentalReverb::reflectionsLevelMb: {
+            erParam.set<EnvironmentalReverb::reflectionsLevelMb>(mContext->getErReflectionsLevel());
+            break;
+        }
+        case EnvironmentalReverb::reflectionsDelayMs: {
+            erParam.set<EnvironmentalReverb::reflectionsDelayMs>(mContext->getErReflectionsDelay());
+            break;
+        }
         case EnvironmentalReverb::levelMb: {
             erParam.set<EnvironmentalReverb::levelMb>(mContext->getErLevel());
             break;
diff --git a/audio/aidl/default/envReverb/EnvReverbSw.h b/audio/aidl/default/envReverb/EnvReverbSw.h
index 4f11a5c..dd2cf5d 100644
--- a/audio/aidl/default/envReverb/EnvReverbSw.h
+++ b/audio/aidl/default/envReverb/EnvReverbSw.h
@@ -58,12 +58,23 @@
     int getErDensity() const { return mDensity; }
 
     RetCode setErBypass(bool bypass) {
-        // TODO : Add implementation to apply new bypass
         mBypass = bypass;
         return RetCode::SUCCESS;
     }
     bool getErBypass() const { return mBypass; }
 
+    RetCode setErReflectionsDelay(int delay) {
+        mReflectionsDelayMs = delay;
+        return RetCode::SUCCESS;
+    }
+    bool getErReflectionsDelay() const { return mReflectionsDelayMs; }
+
+    RetCode setErReflectionsLevel(int level) {
+        mReflectionsLevelMb = level;
+        return RetCode::SUCCESS;
+    }
+    bool getErReflectionsLevel() const { return mReflectionsLevelMb; }
+
   private:
     int mRoomLevel = -6000;                                        // Default room level
     int mRoomHfLevel = 0;                                          // Default room hf level
@@ -71,6 +82,8 @@
     int mDecayHfRatio = 500;                                       // Default decay hf ratio
     int mLevel = -6000;                                            // Default level
     int mDelay = 40;                                               // Default delay
+    int mReflectionsLevelMb = 0;
+    int mReflectionsDelayMs = 0;
     int mDiffusion = 1000;                                         // Default diffusion
     int mDensity = 1000;                                           // Default density
     bool mBypass = false;                                          // Default bypass
diff --git a/audio/aidl/default/equalizer/EqualizerSw.cpp b/audio/aidl/default/equalizer/EqualizerSw.cpp
index 2814322..8cfe82e 100644
--- a/audio/aidl/default/equalizer/EqualizerSw.cpp
+++ b/audio/aidl/default/equalizer/EqualizerSw.cpp
@@ -76,11 +76,10 @@
 const std::vector<Range::EqualizerRange> EqualizerSw::kRanges = {
         MAKE_RANGE(Equalizer, preset, 0, EqualizerSw::kPresets.size() - 1),
         MAKE_RANGE(Equalizer, bandLevels,
-                   std::vector<Equalizer::BandLevel>{Equalizer::BandLevel(
-                           {.index = 0, .levelMb = std::numeric_limits<int>::min()})},
                    std::vector<Equalizer::BandLevel>{
-                           Equalizer::BandLevel({.index = EqualizerSwContext::kMaxBandNumber - 1,
-                                                 .levelMb = std::numeric_limits<int>::max()})}),
+                           Equalizer::BandLevel({.index = 0, .levelMb = -15})},
+                   std::vector<Equalizer::BandLevel>{Equalizer::BandLevel(
+                           {.index = EqualizerSwContext::kMaxBandNumber - 1, .levelMb = 15})}),
         /* capability definition */
         MAKE_RANGE(Equalizer, bandFrequencies, EqualizerSw::kBandFrequency,
                    EqualizerSw::kBandFrequency),
@@ -171,6 +170,14 @@
             eqParam.set<Equalizer::centerFreqMh>(mContext->getCenterFreqs());
             break;
         }
+        case Equalizer::bandFrequencies: {
+            eqParam.set<Equalizer::bandFrequencies>(kBandFrequency);
+            break;
+        }
+        case Equalizer::presets: {
+            eqParam.set<Equalizer::presets>(kPresets);
+            break;
+        }
         default: {
             LOG(ERROR) << __func__ << " not handled tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
diff --git a/audio/aidl/default/include/core-impl/Bluetooth.h b/audio/aidl/default/include/core-impl/Bluetooth.h
index f2e762d..e2f48ba 100644
--- a/audio/aidl/default/include/core-impl/Bluetooth.h
+++ b/audio/aidl/default/include/core-impl/Bluetooth.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <aidl/android/hardware/audio/core/BnBluetooth.h>
+#include <aidl/android/hardware/audio/core/BnBluetoothA2dp.h>
 
 namespace aidl::android::hardware::audio::core {
 
@@ -32,4 +33,19 @@
     HfpConfig mHfpConfig;
 };
 
+class BluetoothA2dp : public BnBluetoothA2dp {
+  public:
+    BluetoothA2dp() = default;
+
+  private:
+    ndk::ScopedAStatus isEnabled(bool* _aidl_return) override;
+    ndk::ScopedAStatus setEnabled(bool in_enabled) override;
+    ndk::ScopedAStatus supportsOffloadReconfiguration(bool* _aidl_return) override;
+    ndk::ScopedAStatus reconfigureOffload(
+            const std::vector<::aidl::android::hardware::audio::core::VendorParameter>&
+                    in_parameters) override;
+
+    bool mEnabled = false;
+};
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/Module.h b/audio/aidl/default/include/core-impl/Module.h
index 8365b34..c35025f 100644
--- a/audio/aidl/default/include/core-impl/Module.h
+++ b/audio/aidl/default/include/core-impl/Module.h
@@ -46,11 +46,32 @@
         bool forceTransientBurst = false;
         bool forceSynchronousDrain = false;
     };
+    // Helper used for interfaces that require a persistent instance. We hold them via a strong
+    // pointer. The binder token is retained for a call to 'setMinSchedulerPolicy'.
+    template <class C>
+    struct ChildInterface : private std::pair<std::shared_ptr<C>, ndk::SpAIBinder> {
+        ChildInterface() {}
+        ChildInterface& operator=(const std::shared_ptr<C>& c) {
+            return operator=(std::shared_ptr<C>(c));
+        }
+        ChildInterface& operator=(std::shared_ptr<C>&& c) {
+            this->first = std::move(c);
+            this->second = this->first->asBinder();
+            AIBinder_setMinSchedulerPolicy(this->second.get(), SCHED_NORMAL,
+                                           ANDROID_PRIORITY_AUDIO);
+            return *this;
+        }
+        explicit operator bool() const { return !!this->first; }
+        C& operator*() const { return *(this->first); }
+        C* operator->() const { return this->first; }
+        std::shared_ptr<C> getPtr() const { return this->first; }
+    };
 
     ndk::ScopedAStatus setModuleDebug(
             const ::aidl::android::hardware::audio::core::ModuleDebug& in_debug) override;
     ndk::ScopedAStatus getTelephony(std::shared_ptr<ITelephony>* _aidl_return) override;
     ndk::ScopedAStatus getBluetooth(std::shared_ptr<IBluetooth>* _aidl_return) override;
+    ndk::ScopedAStatus getBluetoothA2dp(std::shared_ptr<IBluetoothA2dp>* _aidl_return) override;
     ndk::ScopedAStatus connectExternalDevice(
             const ::aidl::android::media::audio::common::AudioPort& in_templateIdAndAdditionalData,
             ::aidl::android::media::audio::common::AudioPort* _aidl_return) override;
@@ -151,23 +172,17 @@
     std::unique_ptr<internal::Configuration> mConfig;
     ModuleDebug mDebug;
     VendorDebug mVendorDebug;
-    // For the interfaces requiring to return the same instance, we need to hold them
-    // via a strong pointer. The binder token is retained for a call to 'setMinSchedulerPolicy'.
-    std::shared_ptr<ITelephony> mTelephony;
-    ndk::SpAIBinder mTelephonyBinder;
-    std::shared_ptr<IBluetooth> mBluetooth;
-    ndk::SpAIBinder mBluetoothBinder;
+    ChildInterface<ITelephony> mTelephony;
+    ChildInterface<IBluetooth> mBluetooth;
+    ChildInterface<IBluetoothA2dp> mBluetoothA2dp;
     // ids of ports created at runtime via 'connectExternalDevice'.
     std::set<int32_t> mConnectedDevicePorts;
     Streams mStreams;
     // Maps port ids and port config ids to patch ids.
     // Multimap because both ports and configs can be used by multiple patches.
     std::multimap<int32_t, int32_t> mPatches;
-    bool mMasterMute = false;
-    float mMasterVolume = 1.0f;
     bool mMicMute = false;
-    std::shared_ptr<sounddose::ISoundDose> mSoundDose;
-    ndk::SpAIBinder mSoundDoseBinder;
+    ChildInterface<sounddose::ISoundDose> mSoundDose;
     std::optional<bool> mIsMmapSupported;
 
   protected:
@@ -180,6 +195,13 @@
     virtual ndk::ScopedAStatus checkAudioPatchEndpointsMatch(
             const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sources,
             const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sinks);
+    virtual void onExternalDeviceConnectionChanged(
+            const ::aidl::android::media::audio::common::AudioPort& audioPort, bool connected);
+    virtual ndk::ScopedAStatus onMasterMuteChanged(bool mute);
+    virtual ndk::ScopedAStatus onMasterVolumeChanged(float volume);
+
+    bool mMasterMute = false;
+    float mMasterVolume = 1.0f;
 };
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/ModuleUsb.h b/audio/aidl/default/include/core-impl/ModuleUsb.h
index 7b177e8..1aa2244 100644
--- a/audio/aidl/default/include/core-impl/ModuleUsb.h
+++ b/audio/aidl/default/include/core-impl/ModuleUsb.h
@@ -28,10 +28,6 @@
     // IModule interfaces
     ndk::ScopedAStatus getTelephony(std::shared_ptr<ITelephony>* _aidl_return) override;
     ndk::ScopedAStatus getBluetooth(std::shared_ptr<IBluetooth>* _aidl_return) override;
-    ndk::ScopedAStatus getMasterMute(bool* _aidl_return) override;
-    ndk::ScopedAStatus setMasterMute(bool in_mute) override;
-    ndk::ScopedAStatus getMasterVolume(float* _aidl_return) override;
-    ndk::ScopedAStatus setMasterVolume(float in_volume) override;
     ndk::ScopedAStatus getMicMute(bool* _aidl_return) override;
     ndk::ScopedAStatus setMicMute(bool in_mute) override;
 
@@ -42,6 +38,11 @@
             const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sources,
             const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sinks)
             override;
+    void onExternalDeviceConnectionChanged(
+            const ::aidl::android::media::audio::common::AudioPort& audioPort,
+            bool connected) override;
+    ndk::ScopedAStatus onMasterMuteChanged(bool mute) override;
+    ndk::ScopedAStatus onMasterVolumeChanged(float volume) override;
 };
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/Stream.h b/audio/aidl/default/include/core-impl/Stream.h
index 0d4365a3..e9b1fbb 100644
--- a/audio/aidl/default/include/core-impl/Stream.h
+++ b/audio/aidl/default/include/core-impl/Stream.h
@@ -463,6 +463,9 @@
         return StreamCommonImpl<::aidl::android::hardware::audio::common::SourceMetadata>::
                 updateMetadata(in_sourceMetadata);
     }
+    ndk::ScopedAStatus updateOffloadMetadata(
+            const ::aidl::android::hardware::audio::common::AudioOffloadMetadata&
+                    in_offloadMetadata) override;
     ndk::ScopedAStatus getHwVolume(std::vector<float>* _aidl_return) override;
     ndk::ScopedAStatus setHwVolume(const std::vector<float>& in_channelVolumes) override;
     ndk::ScopedAStatus getAudioDescriptionMixLevel(float* _aidl_return) override;
@@ -500,6 +503,7 @@
                       offloadInfo);
 
     std::optional<::aidl::android::media::audio::common::AudioOffloadInfo> mOffloadInfo;
+    std::optional<::aidl::android::hardware::audio::common::AudioOffloadMetadata> mOffloadMetadata;
 
   public:
     using CreateInstance = std::function<ndk::ScopedAStatus(
diff --git a/audio/aidl/default/include/core-impl/StreamUsb.h b/audio/aidl/default/include/core-impl/StreamUsb.h
index c04dc66..f1815dd 100644
--- a/audio/aidl/default/include/core-impl/StreamUsb.h
+++ b/audio/aidl/default/include/core-impl/StreamUsb.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <mutex>
+#include <vector>
 
 #include <aidl/android/media/audio/common/AudioChannelLayout.h>
 
@@ -93,6 +94,12 @@
                  StreamContext&& context,
                  const std::optional<::aidl::android::media::audio::common::AudioOffloadInfo>&
                          offloadInfo);
+
+    ndk::ScopedAStatus getHwVolume(std::vector<float>* _aidl_return) override;
+    ndk::ScopedAStatus setHwVolume(const std::vector<float>& in_channelVolumes) override;
+
+    int mChannelCount;
+    std::vector<float> mHwVolumes;
 };
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/effect-impl/EffectUUID.h b/audio/aidl/default/include/effect-impl/EffectUUID.h
index 267f6af..bc61c0f 100644
--- a/audio/aidl/default/include/effect-impl/EffectUUID.h
+++ b/audio/aidl/default/include/effect-impl/EffectUUID.h
@@ -273,12 +273,12 @@
                                                 0x4d34,
                                                 0xacaf,
                                                 {0x00, 0x02, 0xa5, 0xd5, 0xc5, 0x1b}};
-// fa819f3e-588b-11ed-9b6a-0242ac120002
-static const AudioUuid kVisualizerTypeUUID = {static_cast<int32_t>(0xfa819f3e),
-                                              0x588b,
-                                              0x11ed,
-                                              0x9b6a,
-                                              {0x02, 0x42, 0xac, 0x12, 0x00, 0x02}};
+// e46b26a0-dddd-11db-8afd-0002a5d5c51b
+static const AudioUuid kVisualizerTypeUUID = {static_cast<int32_t>(0xe46b26a0),
+                                              0xdddd,
+                                              0x11db,
+                                              0x8afd,
+                                              {0x00, 0x02, 0xa5, 0xd5, 0xc5, 0x1b}};
 // fa81a0f6-588b-11ed-9b6a-0242ac120002
 static const AudioUuid kVisualizerSwImplUUID = {static_cast<int32_t>(0xfa81a0f6),
                                                 0x588b,
diff --git a/audio/aidl/default/usb/ModuleUsb.cpp b/audio/aidl/default/usb/ModuleUsb.cpp
index e803420..511ba74 100644
--- a/audio/aidl/default/usb/ModuleUsb.cpp
+++ b/audio/aidl/default/usb/ModuleUsb.cpp
@@ -22,6 +22,7 @@
 #include <android-base/logging.h>
 #include <tinyalsa/asoundlib.h>
 
+#include "UsbAlsaMixerControl.h"
 #include "UsbAlsaUtils.h"
 #include "core-impl/ModuleUsb.h"
 
@@ -86,26 +87,6 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus ModuleUsb::getMasterMute(bool* _aidl_return __unused) {
-    LOG(DEBUG) << __func__ << ": is not supported";
-    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
-}
-
-ndk::ScopedAStatus ModuleUsb::setMasterMute(bool in_mute __unused) {
-    LOG(DEBUG) << __func__ << ": is not supported";
-    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
-}
-
-ndk::ScopedAStatus ModuleUsb::getMasterVolume(float* _aidl_return __unused) {
-    LOG(DEBUG) << __func__ << ": is not supported";
-    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
-}
-
-ndk::ScopedAStatus ModuleUsb::setMasterVolume(float in_volume __unused) {
-    LOG(DEBUG) << __func__ << ": is not supported";
-    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
-}
-
 ndk::ScopedAStatus ModuleUsb::getMicMute(bool* _aidl_return __unused) {
     LOG(DEBUG) << __func__ << ": is not supported";
     return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
@@ -180,4 +161,26 @@
     return ndk::ScopedAStatus::ok();
 }
 
+void ModuleUsb::onExternalDeviceConnectionChanged(
+        const ::aidl::android::media::audio::common::AudioPort& audioPort, bool connected) {
+    if (audioPort.ext.getTag() != AudioPortExt::Tag::device) {
+        return;
+    }
+    const auto& address = audioPort.ext.get<AudioPortExt::Tag::device>().device.address;
+    if (address.getTag() != AudioDeviceAddress::alsa) {
+        return;
+    }
+    const int card = address.get<AudioDeviceAddress::alsa>()[0];
+    usb::UsbAlsaMixerControl::getInstance().setDeviceConnectionState(card, mMasterMute,
+                                                                     mMasterVolume, connected);
+}
+
+ndk::ScopedAStatus ModuleUsb::onMasterMuteChanged(bool mute) {
+    return usb::UsbAlsaMixerControl::getInstance().setMasterMute(mute);
+}
+
+ndk::ScopedAStatus ModuleUsb::onMasterVolumeChanged(float volume) {
+    return usb::UsbAlsaMixerControl::getInstance().setMasterVolume(volume);
+}
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/usb/StreamUsb.cpp b/audio/aidl/default/usb/StreamUsb.cpp
index bd53a0e..d6f757c 100644
--- a/audio/aidl/default/usb/StreamUsb.cpp
+++ b/audio/aidl/default/usb/StreamUsb.cpp
@@ -17,6 +17,9 @@
 #define LOG_TAG "AHAL_StreamUsb"
 #include <android-base/logging.h>
 
+#include <Utils.h>
+
+#include "UsbAlsaMixerControl.h"
 #include "UsbAlsaUtils.h"
 #include "core-impl/Module.h"
 #include "core-impl/StreamUsb.h"
@@ -30,8 +33,12 @@
 using aidl::android::media::audio::common::AudioDevice;
 using aidl::android::media::audio::common::AudioDeviceAddress;
 using aidl::android::media::audio::common::AudioOffloadInfo;
+using aidl::android::media::audio::common::AudioPortExt;
 using aidl::android::media::audio::common::MicrophoneDynamicInfo;
 using aidl::android::media::audio::common::MicrophoneInfo;
+using android::OK;
+using android::status_t;
+using android::hardware::audio::common::getChannelCount;
 
 namespace aidl::android::hardware::audio::core {
 
@@ -239,6 +246,31 @@
                   // The default worker implementation is used.
                   return new StreamOutWorker(ctx, driver);
               },
-              offloadInfo) {}
+              offloadInfo) {
+    mChannelCount = getChannelCount(mContext.getChannelLayout());
+}
+
+ndk::ScopedAStatus StreamOutUsb::getHwVolume(std::vector<float>* _aidl_return) {
+    *_aidl_return = mHwVolumes;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus StreamOutUsb::setHwVolume(const std::vector<float>& in_channelVolumes) {
+    for (const auto& device : mConnectedDevices) {
+        if (device.address.getTag() != AudioDeviceAddress::alsa) {
+            LOG(DEBUG) << __func__ << ": skip as the device address is not alsa";
+            continue;
+        }
+        const int card = device.address.get<AudioDeviceAddress::alsa>()[0];
+        if (auto result =
+                    usb::UsbAlsaMixerControl::getInstance().setVolumes(card, in_channelVolumes);
+            !result.isOk()) {
+            LOG(ERROR) << __func__ << ": failed to set volume for device, card=" << card;
+            return result;
+        }
+    }
+    mHwVolumes = in_channelVolumes;
+    return ndk::ScopedAStatus::ok();
+}
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/usb/UsbAlsaMixerControl.cpp b/audio/aidl/default/usb/UsbAlsaMixerControl.cpp
new file mode 100644
index 0000000..b5337d1
--- /dev/null
+++ b/audio/aidl/default/usb/UsbAlsaMixerControl.cpp
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "AHAL_UsbAlsaMixerControl"
+#include <android-base/logging.h>
+
+#include <cmath>
+#include <string>
+#include <vector>
+
+#include <android/binder_status.h>
+
+#include "UsbAlsaMixerControl.h"
+
+namespace aidl::android::hardware::audio::core::usb {
+
+//-----------------------------------------------------------------------------
+
+MixerControl::MixerControl(struct mixer_ctl* ctl)
+    : mCtl(ctl),
+      mNumValues(mixer_ctl_get_num_values(ctl)),
+      mMinValue(mixer_ctl_get_range_min(ctl)),
+      mMaxValue(mixer_ctl_get_range_max(ctl)) {}
+
+unsigned int MixerControl::getNumValues() const {
+    return mNumValues;
+}
+
+int MixerControl::getMaxValue() const {
+    return mMaxValue;
+}
+
+int MixerControl::getMinValue() const {
+    return mMinValue;
+}
+
+int MixerControl::setArray(const void* array, size_t count) {
+    const std::lock_guard guard(mLock);
+    return mixer_ctl_set_array(mCtl, array, count);
+}
+
+//-----------------------------------------------------------------------------
+
+// static
+const std::map<AlsaMixer::Control, std::vector<AlsaMixer::ControlNamesAndExpectedCtlType>>
+        AlsaMixer::kPossibleControls = {
+                {AlsaMixer::MASTER_SWITCH, {{"Master Playback Switch", MIXER_CTL_TYPE_BOOL}}},
+                {AlsaMixer::MASTER_VOLUME, {{"Master Playback Volume", MIXER_CTL_TYPE_INT}}},
+                {AlsaMixer::HW_VOLUME,
+                 {{"Headphone Playback Volume", MIXER_CTL_TYPE_INT},
+                  {"Headset Playback Volume", MIXER_CTL_TYPE_INT},
+                  {"PCM Playback Volume", MIXER_CTL_TYPE_INT}}}};
+
+// static
+std::map<AlsaMixer::Control, std::shared_ptr<MixerControl>> AlsaMixer::initializeMixerControls(
+        struct mixer* mixer) {
+    std::map<AlsaMixer::Control, std::shared_ptr<MixerControl>> mixerControls;
+    std::string mixerCtlNames;
+    for (const auto& [control, possibleCtls] : kPossibleControls) {
+        for (const auto& [ctlName, expectedCtlType] : possibleCtls) {
+            struct mixer_ctl* ctl = mixer_get_ctl_by_name(mixer, ctlName.c_str());
+            if (ctl != nullptr && mixer_ctl_get_type(ctl) == expectedCtlType) {
+                mixerControls.emplace(control, std::make_unique<MixerControl>(ctl));
+                if (!mixerCtlNames.empty()) {
+                    mixerCtlNames += ",";
+                }
+                mixerCtlNames += ctlName;
+                break;
+            }
+        }
+    }
+    LOG(DEBUG) << __func__ << ": available mixer control names=[" << mixerCtlNames << "]";
+    return mixerControls;
+}
+
+AlsaMixer::AlsaMixer(struct mixer* mixer)
+    : mMixer(mixer), mMixerControls(initializeMixerControls(mMixer)) {}
+
+AlsaMixer::~AlsaMixer() {
+    mixer_close(mMixer);
+}
+
+namespace {
+
+int volumeFloatToInteger(float fValue, int maxValue, int minValue) {
+    return minValue + std::ceil((maxValue - minValue) * fValue);
+}
+
+float volumeIntegerToFloat(int iValue, int maxValue, int minValue) {
+    if (iValue > maxValue) {
+        return 1.0f;
+    }
+    if (iValue < minValue) {
+        return 0.0f;
+    }
+    return static_cast<float>(iValue - minValue) / (maxValue - minValue);
+}
+
+}  // namespace
+
+ndk::ScopedAStatus AlsaMixer::setMasterMute(bool muted) {
+    auto it = mMixerControls.find(AlsaMixer::MASTER_SWITCH);
+    if (it == mMixerControls.end()) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    const int numValues = it->second->getNumValues();
+    std::vector<int> values(numValues, muted ? 0 : 1);
+    if (int err = it->second->setArray(values.data(), numValues); err != 0) {
+        LOG(ERROR) << __func__ << ": failed to set master mute, err=" << err;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus AlsaMixer::setMasterVolume(float volume) {
+    auto it = mMixerControls.find(AlsaMixer::MASTER_VOLUME);
+    if (it == mMixerControls.end()) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    const int numValues = it->second->getNumValues();
+    std::vector<int> values(numValues, volumeFloatToInteger(volume, it->second->getMaxValue(),
+                                                            it->second->getMinValue()));
+    if (int err = it->second->setArray(values.data(), numValues); err != 0) {
+        LOG(ERROR) << __func__ << ": failed to set master volume, err=" << err;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus AlsaMixer::setVolumes(std::vector<float> volumes) {
+    auto it = mMixerControls.find(AlsaMixer::HW_VOLUME);
+    if (it == mMixerControls.end()) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    const int numValues = it->second->getNumValues();
+    const int maxValue = it->second->getMaxValue();
+    const int minValue = it->second->getMinValue();
+    std::vector<int> values;
+    size_t i = 0;
+    for (; i < numValues && i < values.size(); ++i) {
+        values.emplace_back(volumeFloatToInteger(volumes[i], maxValue, minValue));
+    }
+    if (int err = it->second->setArray(values.data(), values.size()); err != 0) {
+        LOG(ERROR) << __func__ << ": failed to set volume, err=" << err;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+//-----------------------------------------------------------------------------
+
+// static
+UsbAlsaMixerControl& UsbAlsaMixerControl::getInstance() {
+    static UsbAlsaMixerControl gInstance;
+    return gInstance;
+}
+
+void UsbAlsaMixerControl::setDeviceConnectionState(int card, bool masterMuted, float masterVolume,
+                                                   bool connected) {
+    LOG(DEBUG) << __func__ << ": card=" << card << ", connected=" << connected;
+    if (connected) {
+        struct mixer* mixer = mixer_open(card);
+        if (mixer == nullptr) {
+            PLOG(ERROR) << __func__ << ": failed to open mixer for card=" << card;
+            return;
+        }
+        auto alsaMixer = std::make_shared<AlsaMixer>(mixer);
+        alsaMixer->setMasterMute(masterMuted);
+        alsaMixer->setMasterVolume(masterVolume);
+        const std::lock_guard guard(mLock);
+        mMixerControls.emplace(card, alsaMixer);
+    } else {
+        const std::lock_guard guard(mLock);
+        mMixerControls.erase(card);
+    }
+}
+
+ndk::ScopedAStatus UsbAlsaMixerControl::setMasterMute(bool mute) {
+    auto alsaMixers = getAlsaMixers();
+    for (auto it = alsaMixers.begin(); it != alsaMixers.end(); ++it) {
+        if (auto result = it->second->setMasterMute(mute); !result.isOk()) {
+            // Return illegal state if there are multiple devices connected and one of them fails
+            // to set master mute. Otherwise, return the error from calling `setMasterMute`.
+            LOG(ERROR) << __func__ << ": failed to set master mute for card=" << it->first;
+            return alsaMixers.size() > 1 ? ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE)
+                                         : std::move(result);
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus UsbAlsaMixerControl::setMasterVolume(float volume) {
+    auto alsaMixers = getAlsaMixers();
+    for (auto it = alsaMixers.begin(); it != alsaMixers.end(); ++it) {
+        if (auto result = it->second->setMasterVolume(volume); !result.isOk()) {
+            // Return illegal state if there are multiple devices connected and one of them fails
+            // to set master volume. Otherwise, return the error from calling `setMasterVolume`.
+            LOG(ERROR) << __func__ << ": failed to set master volume for card=" << it->first;
+            return alsaMixers.size() > 1 ? ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE)
+                                         : std::move(result);
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus UsbAlsaMixerControl::setVolumes(int card, std::vector<float> volumes) {
+    auto alsaMixer = getAlsaMixer(card);
+    if (alsaMixer == nullptr) {
+        LOG(ERROR) << __func__ << ": no mixer control found for card=" << card;
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    return alsaMixer->setVolumes(volumes);
+}
+
+std::shared_ptr<AlsaMixer> UsbAlsaMixerControl::getAlsaMixer(int card) {
+    const std::lock_guard guard(mLock);
+    const auto it = mMixerControls.find(card);
+    return it == mMixerControls.end() ? nullptr : it->second;
+}
+
+std::map<int, std::shared_ptr<AlsaMixer>> UsbAlsaMixerControl::getAlsaMixers() {
+    const std::lock_guard guard(mLock);
+    return mMixerControls;
+}
+
+}  // namespace aidl::android::hardware::audio::core::usb
diff --git a/audio/aidl/default/usb/UsbAlsaMixerControl.h b/audio/aidl/default/usb/UsbAlsaMixerControl.h
new file mode 100644
index 0000000..cbcddd8
--- /dev/null
+++ b/audio/aidl/default/usb/UsbAlsaMixerControl.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string>
+#include <vector>
+
+#include <android-base/thread_annotations.h>
+#include <android/binder_auto_utils.h>
+
+extern "C" {
+#include <tinyalsa/mixer.h>
+}
+
+namespace aidl::android::hardware::audio::core::usb {
+
+class MixerControl {
+  public:
+    explicit MixerControl(struct mixer_ctl* ctl);
+
+    unsigned int getNumValues() const;
+    int getMaxValue() const;
+    int getMinValue() const;
+    int setArray(const void* array, size_t count);
+
+  private:
+    std::mutex mLock;
+    // The mixer_ctl object is owned by ALSA and will be released when the mixer is closed.
+    struct mixer_ctl* mCtl GUARDED_BY(mLock);
+    const unsigned int mNumValues;
+    const int mMinValue;
+    const int mMaxValue;
+};
+
+class AlsaMixer {
+  public:
+    explicit AlsaMixer(struct mixer* mixer);
+
+    ~AlsaMixer();
+
+    bool isValid() const { return mMixer != nullptr; }
+
+    ndk::ScopedAStatus setMasterMute(bool muted);
+    ndk::ScopedAStatus setMasterVolume(float volume);
+    ndk::ScopedAStatus setVolumes(std::vector<float> volumes);
+
+  private:
+    enum Control {
+        MASTER_SWITCH,
+        MASTER_VOLUME,
+        HW_VOLUME,
+    };
+    using ControlNamesAndExpectedCtlType = std::pair<std::string, enum mixer_ctl_type>;
+    static const std::map<Control, std::vector<ControlNamesAndExpectedCtlType>> kPossibleControls;
+    static std::map<Control, std::shared_ptr<MixerControl>> initializeMixerControls(
+            struct mixer* mixer);
+
+    // The mixer object is owned by ALSA and will be released when the mixer is closed.
+    struct mixer* mMixer;
+    // `mMixerControls` will only be initialized in constructor. After that, it wil only be
+    // read but not be modified.
+    const std::map<Control, std::shared_ptr<MixerControl>> mMixerControls;
+};
+
+class UsbAlsaMixerControl {
+  public:
+    static UsbAlsaMixerControl& getInstance();
+
+    void setDeviceConnectionState(int card, bool masterMuted, float masterVolume, bool connected);
+
+    // Master volume settings will be applied to all sound cards, it is only set by the
+    // USB module.
+    ndk::ScopedAStatus setMasterMute(bool muted);
+    ndk::ScopedAStatus setMasterVolume(float volume);
+    // The volume settings can be different on sound cards. It is controlled by streams.
+    ndk::ScopedAStatus setVolumes(int card, std::vector<float> volumes);
+
+  private:
+    std::shared_ptr<AlsaMixer> getAlsaMixer(int card);
+    std::map<int, std::shared_ptr<AlsaMixer>> getAlsaMixers();
+
+    std::mutex mLock;
+    // A map whose key is the card number and value is a shared pointer to corresponding
+    // AlsaMixer object.
+    std::map<int, std::shared_ptr<AlsaMixer>> mMixerControls GUARDED_BY(mLock);
+};
+
+}  // namespace aidl::android::hardware::audio::core::usb
diff --git a/audio/aidl/default/virtualizer/VirtualizerSw.cpp b/audio/aidl/default/virtualizer/VirtualizerSw.cpp
index 5e99cba2..d75e4e0 100644
--- a/audio/aidl/default/virtualizer/VirtualizerSw.cpp
+++ b/audio/aidl/default/virtualizer/VirtualizerSw.cpp
@@ -68,11 +68,7 @@
         MAKE_RANGE(Virtualizer, strengthPm, 0, 1000),
         /* speakerAngle is get-only, set min > max */
         MAKE_RANGE(Virtualizer, speakerAngles, {Virtualizer::ChannelAngle({.channel = 1})},
-                   {Virtualizer::ChannelAngle({.channel = 0})}),
-        /* device is get-only */
-        MAKE_RANGE(Virtualizer, device,
-                   AudioDeviceDescription({.type = AudioDeviceType::IN_DEFAULT}),
-                   AudioDeviceDescription({.type = AudioDeviceType::NONE}))};
+                   {Virtualizer::ChannelAngle({.channel = 0})})};
 
 const Capability VirtualizerSw::kCapability = {
         .range = Range::make<Range::virtualizer>(VirtualizerSw::kRanges)};
@@ -174,17 +170,21 @@
 ndk::ScopedAStatus VirtualizerSw::getSpeakerAngles(const Virtualizer::SpeakerAnglesPayload payload,
                                                    Parameter::Specific* specific) {
     std::vector<Virtualizer::ChannelAngle> angles;
-    if (::android::hardware::audio::common::getChannelCount(payload.layout) == 1) {
+    const auto chNum = ::android::hardware::audio::common::getChannelCount(payload.layout);
+    if (chNum == 1) {
         angles = {{.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_LEFT,
                    .azimuthDegree = 0,
                    .elevationDegree = 0}};
-    } else {
+    } else if (chNum == 2) {
         angles = {{.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_LEFT,
                    .azimuthDegree = -90,
                    .elevationDegree = 0},
                   {.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_RIGHT,
                    .azimuthDegree = 90,
                    .elevationDegree = 0}};
+    } else {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "supportUpTo2Ch");
     }
 
     Virtualizer param = Virtualizer::make<Virtualizer::speakerAngles>(angles);
diff --git a/audio/aidl/vts/ModuleConfig.cpp b/audio/aidl/vts/ModuleConfig.cpp
index 7b002ad..b07edb7 100644
--- a/audio/aidl/vts/ModuleConfig.cpp
+++ b/audio/aidl/vts/ModuleConfig.cpp
@@ -56,7 +56,7 @@
         offloadInfo.base.sampleRate = portConfig.sampleRate.value().value;
         offloadInfo.base.channelMask = portConfig.channelMask.value();
         offloadInfo.base.format = portConfig.format.value();
-        offloadInfo.bitRatePerSecond = 256;                                // Arbitrary value.
+        offloadInfo.bitRatePerSecond = 256000;                             // Arbitrary value.
         offloadInfo.durationUs = std::chrono::microseconds(1min).count();  // Arbitrary value.
         offloadInfo.usage = AudioUsage::MEDIA;
         offloadInfo.encapsulationMode = AudioEncapsulationMode::NONE;
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index 1222fd5..1e0c900 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -53,6 +53,7 @@
 #include "TestUtils.h"
 
 using namespace android;
+using aidl::android::hardware::audio::common::AudioOffloadMetadata;
 using aidl::android::hardware::audio::common::PlaybackTrackMetadata;
 using aidl::android::hardware::audio::common::RecordTrackMetadata;
 using aidl::android::hardware::audio::common::SinkMetadata;
@@ -60,6 +61,7 @@
 using aidl::android::hardware::audio::core::AudioPatch;
 using aidl::android::hardware::audio::core::AudioRoute;
 using aidl::android::hardware::audio::core::IBluetooth;
+using aidl::android::hardware::audio::core::IBluetoothA2dp;
 using aidl::android::hardware::audio::core::IModule;
 using aidl::android::hardware::audio::core::IStreamCommon;
 using aidl::android::hardware::audio::core::IStreamIn;
@@ -88,6 +90,7 @@
 using aidl::android::media::audio::common::AudioPortConfig;
 using aidl::android::media::audio::common::AudioPortDeviceExt;
 using aidl::android::media::audio::common::AudioPortExt;
+using aidl::android::media::audio::common::AudioPortMixExt;
 using aidl::android::media::audio::common::AudioSource;
 using aidl::android::media::audio::common::AudioUsage;
 using aidl::android::media::audio::common::Boolean;
@@ -400,8 +403,9 @@
 // Can be used as a base for any test here, does not depend on the fixture GTest parameters.
 class AudioCoreModuleBase {
   public:
-    // The default buffer size is used mostly for negative tests.
+    // Default buffer sizes are used mostly for negative tests.
     static constexpr int kDefaultBufferSizeFrames = 256;
+    static constexpr int kDefaultLargeBufferSizeFrames = 48000;
 
     void SetUpImpl(const std::string& moduleName) {
         ASSERT_NO_FATAL_FAILURE(ConnectToService(moduleName));
@@ -1524,6 +1528,8 @@
     AudioPortConfig portConfig;
     AudioPortConfig suggestedConfig;
     portConfig.portId = srcMixPort.value().id;
+    const int32_t kIoHandle = 42;
+    portConfig.ext = AudioPortMixExt{.handle = kIoHandle};
     {
         bool applied = true;
         ASSERT_IS_OK(module->setAudioPortConfig(portConfig, &suggestedConfig, &applied))
@@ -1535,18 +1541,22 @@
     EXPECT_TRUE(suggestedConfig.channelMask.has_value());
     EXPECT_TRUE(suggestedConfig.format.has_value());
     EXPECT_TRUE(suggestedConfig.flags.has_value());
+    ASSERT_EQ(AudioPortExt::Tag::mix, suggestedConfig.ext.getTag());
+    EXPECT_EQ(kIoHandle, suggestedConfig.ext.get<AudioPortExt::Tag::mix>().handle);
     WithAudioPortConfig applied(suggestedConfig);
     ASSERT_NO_FATAL_FAILURE(applied.SetUp(module.get()));
     const AudioPortConfig& appliedConfig = applied.get();
     EXPECT_NE(0, appliedConfig.id);
-    EXPECT_TRUE(appliedConfig.sampleRate.has_value());
+    ASSERT_TRUE(appliedConfig.sampleRate.has_value());
     EXPECT_EQ(suggestedConfig.sampleRate.value(), appliedConfig.sampleRate.value());
-    EXPECT_TRUE(appliedConfig.channelMask.has_value());
+    ASSERT_TRUE(appliedConfig.channelMask.has_value());
     EXPECT_EQ(suggestedConfig.channelMask.value(), appliedConfig.channelMask.value());
-    EXPECT_TRUE(appliedConfig.format.has_value());
+    ASSERT_TRUE(appliedConfig.format.has_value());
     EXPECT_EQ(suggestedConfig.format.value(), appliedConfig.format.value());
-    EXPECT_TRUE(appliedConfig.flags.has_value());
+    ASSERT_TRUE(appliedConfig.flags.has_value());
     EXPECT_EQ(suggestedConfig.flags.value(), appliedConfig.flags.value());
+    ASSERT_EQ(AudioPortExt::Tag::mix, appliedConfig.ext.getTag());
+    EXPECT_EQ(kIoHandle, appliedConfig.ext.get<AudioPortExt::Tag::mix>().handle);
 }
 
 TEST_P(AudioCoreModule, SetAllAttachedDevicePortConfigs) {
@@ -2046,6 +2056,59 @@
                                           &hfpConfig));
 }
 
+class AudioCoreBluetoothA2dp : public AudioCoreModuleBase,
+                               public testing::TestWithParam<std::string> {
+  public:
+    void SetUp() override {
+        ASSERT_NO_FATAL_FAILURE(SetUpImpl(GetParam()));
+        ASSERT_IS_OK(module->getBluetoothA2dp(&bluetooth));
+    }
+
+    void TearDown() override { ASSERT_NO_FATAL_FAILURE(TearDownImpl()); }
+
+    std::shared_ptr<IBluetoothA2dp> bluetooth;
+};
+
+TEST_P(AudioCoreBluetoothA2dp, SameInstance) {
+    if (bluetooth == nullptr) {
+        GTEST_SKIP() << "BluetoothA2dp is not supported";
+    }
+    std::shared_ptr<IBluetoothA2dp> bluetooth2;
+    EXPECT_IS_OK(module->getBluetoothA2dp(&bluetooth2));
+    ASSERT_NE(nullptr, bluetooth2.get());
+    EXPECT_EQ(bluetooth->asBinder(), bluetooth2->asBinder())
+            << "getBluetoothA2dp must return the same interface instance across invocations";
+}
+
+TEST_P(AudioCoreBluetoothA2dp, Enabled) {
+    if (bluetooth == nullptr) {
+        GTEST_SKIP() << "BluetoothA2dp is not supported";
+    }
+    // Since enabling A2DP may require having an actual device connection,
+    // limit testing to setting back the current value.
+    bool enabled;
+    ASSERT_IS_OK(bluetooth->isEnabled(&enabled));
+    EXPECT_IS_OK(bluetooth->setEnabled(enabled))
+            << "setEnabled without actual state change must not fail";
+}
+
+TEST_P(AudioCoreBluetoothA2dp, OffloadReconfiguration) {
+    if (bluetooth == nullptr) {
+        GTEST_SKIP() << "BluetoothA2dp is not supported";
+    }
+    bool isSupported;
+    ASSERT_IS_OK(bluetooth->supportsOffloadReconfiguration(&isSupported));
+    bool isSupported2;
+    ASSERT_IS_OK(bluetooth->supportsOffloadReconfiguration(&isSupported2));
+    EXPECT_EQ(isSupported, isSupported2);
+    if (isSupported) {
+        static const auto kStatuses = {EX_NONE, EX_ILLEGAL_STATE};
+        EXPECT_STATUS(kStatuses, bluetooth->reconfigureOffload({}));
+    } else {
+        EXPECT_STATUS(EX_UNSUPPORTED_OPERATION, bluetooth->reconfigureOffload({}));
+    }
+}
+
 class AudioCoreTelephony : public AudioCoreModuleBase, public testing::TestWithParam<std::string> {
   public:
     void SetUp() override {
@@ -2689,7 +2752,7 @@
     aidl::android::hardware::audio::core::IModule::OpenOutputStreamArguments args;
     args.portConfigId = portConfig.getId();
     args.sourceMetadata = GenerateSourceMetadata(portConfig.get());
-    args.bufferSizeFrames = kDefaultBufferSizeFrames;
+    args.bufferSizeFrames = kDefaultLargeBufferSizeFrames;
     aidl::android::hardware::audio::core::IModule::OpenOutputStreamReturn ret;
     EXPECT_STATUS(EX_ILLEGAL_ARGUMENT, module->openOutputStream(args, &ret))
             << "when no offload info is provided for a compressed offload mix port";
@@ -2869,7 +2932,7 @@
         const auto portConfig = moduleConfig->getSingleConfigForMixPort(false, port);
         ASSERT_TRUE(portConfig.has_value()) << "No profiles specified for output mix port";
         WithStream<IStreamOut> stream(portConfig.value());
-        ASSERT_NO_FATAL_FAILURE(stream.SetUp(module.get(), kDefaultBufferSizeFrames));
+        ASSERT_NO_FATAL_FAILURE(stream.SetUp(module.get(), kDefaultLargeBufferSizeFrames));
         bool isSupported = false;
         EXPECT_NO_FATAL_FAILURE(TestAccessors<AudioPlaybackRate>(
                 stream.get(), &IStreamOut::getPlaybackRateParameters,
@@ -2894,7 +2957,7 @@
         const auto portConfig = moduleConfig->getSingleConfigForMixPort(false, port);
         ASSERT_TRUE(portConfig.has_value()) << "No profiles specified for output mix port";
         WithStream<IStreamOut> stream(portConfig.value());
-        ASSERT_NO_FATAL_FAILURE(stream.SetUp(module.get(), kDefaultBufferSizeFrames));
+        ASSERT_NO_FATAL_FAILURE(stream.SetUp(module.get(), kDefaultLargeBufferSizeFrames));
         ndk::ScopedAStatus status;
         EXPECT_STATUS(kStatuses, status = stream.get()->selectPresentation(0, 0));
         if (status.getExceptionCode() != EX_UNSUPPORTED_OPERATION) atLeastOneSupports = true;
@@ -2904,6 +2967,33 @@
     }
 }
 
+TEST_P(AudioStreamOut, UpdateOffloadMetadata) {
+    const auto offloadMixPorts =
+            moduleConfig->getOffloadMixPorts(true /*attachedOnly*/, false /*singlePort*/);
+    if (offloadMixPorts.empty()) {
+        GTEST_SKIP()
+                << "No mix port for compressed offload that could be routed to attached devices";
+    }
+    for (const auto& port : offloadMixPorts) {
+        const auto portConfig = moduleConfig->getSingleConfigForMixPort(false, port);
+        ASSERT_TRUE(portConfig.has_value()) << "No profiles specified for output mix port";
+        WithStream<IStreamOut> stream(portConfig.value());
+        ASSERT_NO_FATAL_FAILURE(stream.SetUp(module.get(), kDefaultLargeBufferSizeFrames));
+        AudioOffloadMetadata validMetadata{
+                .sampleRate = portConfig.value().sampleRate.value().value,
+                .channelMask = portConfig.value().channelMask.value(),
+                .averageBitRatePerSecond = 256000,
+                .delayFrames = 0,
+                .paddingFrames = 0};
+        EXPECT_IS_OK(stream.get()->updateOffloadMetadata(validMetadata));
+        AudioOffloadMetadata invalidMetadata{.sampleRate = -1,
+                                             .averageBitRatePerSecond = -1,
+                                             .delayFrames = -1,
+                                             .paddingFrames = -1};
+        EXPECT_STATUS(EX_ILLEGAL_ARGUMENT, stream.get()->updateOffloadMetadata(invalidMetadata));
+    }
+}
+
 class StreamLogicDefaultDriver : public StreamLogicDriver {
   public:
     StreamLogicDefaultDriver(std::shared_ptr<StateSequence> commands, size_t frameSizeBytes)
@@ -3426,6 +3516,10 @@
                          testing::ValuesIn(android::getAidlHalInstanceNames(IModule::descriptor)),
                          android::PrintInstanceNameToString);
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(AudioCoreBluetooth);
+INSTANTIATE_TEST_SUITE_P(AudioCoreBluetoothA2dpTest, AudioCoreBluetoothA2dp,
+                         testing::ValuesIn(android::getAidlHalInstanceNames(IModule::descriptor)),
+                         android::PrintInstanceNameToString);
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(AudioCoreBluetoothA2dp);
 INSTANTIATE_TEST_SUITE_P(AudioCoreTelephonyTest, AudioCoreTelephony,
                          testing::ValuesIn(android::getAidlHalInstanceNames(IModule::descriptor)),
                          android::PrintInstanceNameToString);
diff --git a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
index 98e49a2..478482d 100644
--- a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
+++ b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
@@ -1698,26 +1698,6 @@
     ASSERT_EQ(0U, framesLost);
 }
 
-TEST_P(InputStreamTest, getCapturePosition) {
-    doc::test(
-        "The capture position of a non prepared stream should not be "
-        "retrievable or 0");
-    uint64_t frames;
-    uint64_t time;
-    ASSERT_OK(stream->getCapturePosition(returnIn(res, frames, time)));
-    // Although 'getCapturePosition' is mandatory in V7, legacy implementations
-    // may return -ENOSYS (which is translated to NOT_SUPPORTED) in cases when
-    // the capture position can't be retrieved, e.g. when the stream isn't
-    // running. Because of this, we don't fail when getting NOT_SUPPORTED
-    // in this test. Behavior of 'getCapturePosition' for running streams is
-    // tested in 'PcmOnlyConfigInputStreamTest' for V7.
-    ASSERT_RESULT(okOrInvalidStateOrNotSupported, res);
-    if (res == Result::OK) {
-        ASSERT_EQ(0U, frames);
-        ASSERT_LE(0U, time);
-    }
-}
-
 //////////////////////////////////////////////////////////////////////////////
 ///////////////////////////////// StreamOut //////////////////////////////////
 //////////////////////////////////////////////////////////////////////////////
diff --git a/automotive/audiocontrol/aidl/vts/Android.bp b/automotive/audiocontrol/aidl/vts/Android.bp
index a9122ce..cfc2a3e 100644
--- a/automotive/audiocontrol/aidl/vts/Android.bp
+++ b/automotive/audiocontrol/aidl/vts/Android.bp
@@ -25,7 +25,6 @@
     name: "VtsAidlHalAudioControlTest",
     defaults: [
         "latest_android_media_audio_common_types_cpp_static",
-        "latest_android_hardware_audio_common_cpp_static",
         "VtsHalTargetTestDefaults",
         "use_libaidlvintf_gtest_helper_static",
     ],
@@ -40,6 +39,7 @@
     ],
     static_libs: [
         "android.hardware.automotive.audiocontrol-V3-cpp",
+        "android.hardware.audio.common-V1-cpp",
         "libgmock",
     ],
     test_suites: [
diff --git a/automotive/can/1.0/default/libc++fs/src/filesystem/directory_iterator.cpp b/automotive/can/1.0/default/libc++fs/src/filesystem/directory_iterator.cpp
index 624538b..37c863b 100644
--- a/automotive/can/1.0/default/libc++fs/src/filesystem/directory_iterator.cpp
+++ b/automotive/can/1.0/default/libc++fs/src/filesystem/directory_iterator.cpp
@@ -169,8 +169,8 @@
   __dir_stream& operator=(const __dir_stream&) = delete;
 
   __dir_stream(__dir_stream&& other) noexcept : __stream_(other.__stream_),
-                                                __root_(move(other.__root_)),
-                                                __entry_(move(other.__entry_)) {
+                                                __root_(std::move(other.__root_)),
+                                                __entry_(std::move(other.__entry_)) {
     other.__stream_ = nullptr;
   }
 
@@ -252,7 +252,7 @@
 
   error_code m_ec;
   if (!__imp_->advance(m_ec)) {
-    path root = move(__imp_->__root_);
+    path root = std::move(__imp_->__root_);
     __imp_.reset();
     if (m_ec)
       err.report(m_ec, "at root \"%s\"", root);
@@ -286,7 +286,7 @@
 
   __imp_ = make_shared<__shared_imp>();
   __imp_->__options_ = opt;
-  __imp_->__stack_.push(move(new_s));
+  __imp_->__stack_.push(std::move(new_s));
 }
 
 void recursive_directory_iterator::__pop(error_code* ec) {
@@ -340,7 +340,7 @@
   }
 
   if (m_ec) {
-    path root = move(stack.top().__root_);
+    path root = std::move(stack.top().__root_);
     __imp_.reset();
     err.report(m_ec, "at root \"%s\"", root);
   } else {
@@ -374,7 +374,7 @@
   if (!skip_rec) {
     __dir_stream new_it(curr_it.__entry_.path(), __imp_->__options_, m_ec);
     if (new_it.good()) {
-      __imp_->__stack_.push(move(new_it));
+      __imp_->__stack_.push(std::move(new_it));
       return true;
     }
   }
@@ -385,7 +385,7 @@
       if (ec)
         ec->clear();
     } else {
-      path at_ent = move(curr_it.__entry_.__p_);
+      path at_ent = std::move(curr_it.__entry_.__p_);
       __imp_.reset();
       err.report(m_ec, "attempting recursion into \"%s\"", at_ent);
     }
diff --git a/automotive/evs/OWNERS b/automotive/evs/OWNERS
index b973e91..15de48f 100644
--- a/automotive/evs/OWNERS
+++ b/automotive/evs/OWNERS
@@ -1,3 +1,2 @@
 ankitarora@google.com
-changyeon@google.com
 jwhpryor@google.com
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/tests/DefaultVhalImpl_test.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/tests/DefaultVhalImpl_test.cpp
index df5ada6..b5026a6 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/tests/DefaultVhalImpl_test.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/tests/DefaultVhalImpl_test.cpp
@@ -124,6 +124,17 @@
     android::ConcurrentQueue<VehiclePropValuePtr> mEventQueue;
     android::ConcurrentQueue<VehiclePropValuePtr> mHeartBeatQueue;
 
+    // Wait until receive enough events in receivedEvents.
+    void waitForEvents(std::vector<VehiclePropValuePtr>* receivedEvents, size_t count) {
+        while (receivedEvents->size() < count) {
+            mEventQueue.waitForItems();
+            auto newEvents = mEventQueue.flush();
+            for (size_t i = 0; i < newEvents.size(); i++) {
+                receivedEvents->push_back(std::move(newEvents[i]));
+            }
+        }
+    }
+
   private:
     void onHalEvent(VehiclePropValuePtr v) {
         if (v->prop != toInt(VehicleProperty::VHAL_HEARTBEAT)) {
@@ -314,26 +325,25 @@
 
     ASSERT_EQ(StatusCode::OK, status);
 
-    std::this_thread::sleep_for(std::chrono::milliseconds(500));
+    std::vector<VehiclePropValuePtr> receivedEvents;
+    waitForEvents(&receivedEvents, 5);
 
-    // Modify the speed after 0.5 seconds.
+    // Modify the speed after 5 events arrive.
     VehiclePropValue value;
     value.prop = toInt(VehicleProperty::PERF_VEHICLE_SPEED);
     value.value.floatValues.resize(1);
     value.value.floatValues[0] = 1.0f;
     ASSERT_EQ(StatusCode::OK, mHal->set(value));
 
-    std::this_thread::sleep_for(std::chrono::milliseconds(500));
-
-    auto events = mEventQueue.flush();
-    ASSERT_LE((size_t)10, events.size());
+    waitForEvents(&receivedEvents, 10);
 
     // The first event should be the default value.
-    ASSERT_EQ((size_t)1, events[0]->value.floatValues.size());
-    EXPECT_EQ(0.0f, events[0]->value.floatValues[0]);
+    ASSERT_EQ((size_t)1, receivedEvents[0]->value.floatValues.size());
+    EXPECT_EQ(0.0f, receivedEvents[0]->value.floatValues[0]);
     // The last event should be the value after update.
-    ASSERT_EQ((size_t)1, events[events.size() - 1]->value.floatValues.size());
-    EXPECT_EQ(1.0f, events[events.size() - 1]->value.floatValues[0]);
+    const auto& lastEvent = receivedEvents[receivedEvents.size() - 1];
+    ASSERT_EQ((size_t)1, lastEvent->value.floatValues.size());
+    EXPECT_EQ(1.0f, lastEvent->value.floatValues[0]);
 }
 
 TEST_F(DefaultVhalImplTest, testSubscribeInvalidProp) {
diff --git a/automotive/vehicle/2.0/default/tests/RecurrentTimer_test.cpp b/automotive/vehicle/2.0/default/tests/RecurrentTimer_test.cpp
index d7547f6..2e59dbf 100644
--- a/automotive/vehicle/2.0/default/tests/RecurrentTimer_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/RecurrentTimer_test.cpp
@@ -69,7 +69,7 @@
     std::this_thread::sleep_for(milliseconds(100));
     // This test is unstable, so set the tolerance to 50.
     ASSERT_EQ_WITH_TOLERANCE(100, counter1ms.load(), 50);
-    ASSERT_EQ_WITH_TOLERANCE(20, counter5ms.load(), 5);
+    ASSERT_EQ_WITH_TOLERANCE(20, counter5ms.load(), 10);
 }
 
 }  // anonymous namespace
diff --git a/automotive/vehicle/2.0/types.hal b/automotive/vehicle/2.0/types.hal
index 83b0d94..00d0452 100644
--- a/automotive/vehicle/2.0/types.hal
+++ b/automotive/vehicle/2.0/types.hal
@@ -829,10 +829,10 @@
     /*
      * HVAC Properties
      *
-     * Additional rules for mapping a zoned HVAC property (except
-     * HVAC_MAX_DEFROST_ON) to AreaIDs:
-     *  - Every seat in VehicleAreaSeat that is available in the car, must be
-     *    part of an AreaID in the AreaID array.
+     * Additional rules for mapping non-GLOBAL VehicleArea type HVAC properties
+     * to AreaIDs:
+     *  - Every “area” for a specific VehicleArea type that is affected by the
+     *    property, must be included in an area ID for that property.
      *
      * Example 1: A car has two front seats (ROW_1_LEFT, ROW_1_RIGHT) and three
      *  back seats (ROW_2_LEFT, ROW_2_CENTER, ROW_2_RIGHT). There are two
@@ -860,6 +860,16 @@
      *     - ROW_1_LEFT
      *     - ROW_1_RIGHT
      *     - ROW_2_LEFT | ROW_2_CENTER | ROW_2_RIGHT | ROW_3_LEFT | ROW_3_CENTER | ROW_3_RIGHT
+     *
+     * Example 3: A car has two front seats (ROW_1_LEFT, ROW_1_RIGHT) and three
+     *  back seats (ROW_2_LEFT, ROW_2_CENTER, ROW_2_RIGHT). Suppose the car
+     *  supports HVAC_AUTO_ON for just the two front seats.
+     *   - A valid mapping set of AreaIDs for HVAC_AUTO_ON would be:
+     *      - ROW_1_LEFT | ROW_1_RIGHT
+     *   - If HVAC_AUTO_ON had two separate control units for the driver side
+     *     and passenger side, an alternative mapping would be:
+     *      - ROW_1_LEFT
+     *      - ROW_1_RIGHT
      */
 
     /**
diff --git a/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h b/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
index d4ab0f7..d1762c5 100644
--- a/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
+++ b/automotive/vehicle/aidl/generated_lib/cpp/AccessForVehicleProperty.h
@@ -119,6 +119,7 @@
         {VehicleProperty::AP_POWER_STATE_REPORT, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::AP_POWER_BOOTUP_REASON, VehiclePropertyAccess::READ},
         {VehicleProperty::DISPLAY_BRIGHTNESS, VehiclePropertyAccess::READ_WRITE},
+        {VehicleProperty::PER_DISPLAY_BRIGHTNESS, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::HW_KEY_INPUT, VehiclePropertyAccess::READ},
         {VehicleProperty::HW_KEY_INPUT_V2, VehiclePropertyAccess::READ},
         {VehicleProperty::HW_MOTION_INPUT, VehiclePropertyAccess::READ},
@@ -190,6 +191,7 @@
         {VehicleProperty::GLOVE_BOX_DOOR_POS, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::GLOVE_BOX_LOCKED, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::VEHICLE_MAP_SERVICE, VehiclePropertyAccess::READ_WRITE},
+        {VehicleProperty::LOCATION_CHARACTERIZATION, VehiclePropertyAccess::READ},
         {VehicleProperty::OBD2_LIVE_FRAME, VehiclePropertyAccess::READ},
         {VehicleProperty::OBD2_FREEZE_FRAME, VehiclePropertyAccess::READ},
         {VehicleProperty::OBD2_FREEZE_FRAME_INFO, VehiclePropertyAccess::READ},
@@ -264,6 +266,8 @@
         {VehicleProperty::CRUISE_CONTROL_TYPE, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::CRUISE_CONTROL_STATE, VehiclePropertyAccess::READ},
         {VehicleProperty::CRUISE_CONTROL_COMMAND, VehiclePropertyAccess::WRITE},
+        {VehicleProperty::CRUISE_CONTROL_TARGET_SPEED, VehiclePropertyAccess::READ},
+        {VehicleProperty::ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::HANDS_ON_DETECTION_ENABLED, VehiclePropertyAccess::READ_WRITE},
         {VehicleProperty::HANDS_ON_DETECTION_DRIVER_STATE, VehiclePropertyAccess::READ},
         {VehicleProperty::HANDS_ON_DETECTION_WARNING, VehiclePropertyAccess::READ},
diff --git a/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h b/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
index d56de3f..587d8f3 100644
--- a/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
+++ b/automotive/vehicle/aidl/generated_lib/cpp/ChangeModeForVehicleProperty.h
@@ -119,6 +119,7 @@
         {VehicleProperty::AP_POWER_STATE_REPORT, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::AP_POWER_BOOTUP_REASON, VehiclePropertyChangeMode::STATIC},
         {VehicleProperty::DISPLAY_BRIGHTNESS, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::PER_DISPLAY_BRIGHTNESS, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HW_KEY_INPUT, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HW_KEY_INPUT_V2, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HW_MOTION_INPUT, VehiclePropertyChangeMode::ON_CHANGE},
@@ -190,6 +191,7 @@
         {VehicleProperty::GLOVE_BOX_DOOR_POS, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::GLOVE_BOX_LOCKED, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::VEHICLE_MAP_SERVICE, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::LOCATION_CHARACTERIZATION, VehiclePropertyChangeMode::STATIC},
         {VehicleProperty::OBD2_LIVE_FRAME, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::OBD2_FREEZE_FRAME, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::OBD2_FREEZE_FRAME_INFO, VehiclePropertyChangeMode::ON_CHANGE},
@@ -264,6 +266,8 @@
         {VehicleProperty::CRUISE_CONTROL_TYPE, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::CRUISE_CONTROL_STATE, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::CRUISE_CONTROL_COMMAND, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::CRUISE_CONTROL_TARGET_SPEED, VehiclePropertyChangeMode::ON_CHANGE},
+        {VehicleProperty::ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HANDS_ON_DETECTION_ENABLED, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HANDS_ON_DETECTION_DRIVER_STATE, VehiclePropertyChangeMode::ON_CHANGE},
         {VehicleProperty::HANDS_ON_DETECTION_WARNING, VehiclePropertyChangeMode::ON_CHANGE},
diff --git a/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java b/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
index caeb266..165c1bf 100644
--- a/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
+++ b/automotive/vehicle/aidl/generated_lib/java/AccessForVehicleProperty.java
@@ -111,6 +111,7 @@
         Map.entry(VehicleProperty.AP_POWER_STATE_REPORT, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.AP_POWER_BOOTUP_REASON, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.DISPLAY_BRIGHTNESS, VehiclePropertyAccess.READ_WRITE),
+        Map.entry(VehicleProperty.PER_DISPLAY_BRIGHTNESS, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.HW_KEY_INPUT, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.HW_KEY_INPUT_V2, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.HW_MOTION_INPUT, VehiclePropertyAccess.READ),
@@ -182,6 +183,7 @@
         Map.entry(VehicleProperty.GLOVE_BOX_DOOR_POS, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.GLOVE_BOX_LOCKED, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.VEHICLE_MAP_SERVICE, VehiclePropertyAccess.READ_WRITE),
+        Map.entry(VehicleProperty.LOCATION_CHARACTERIZATION, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.OBD2_LIVE_FRAME, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.OBD2_FREEZE_FRAME, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.OBD2_FREEZE_FRAME_INFO, VehiclePropertyAccess.READ),
@@ -256,6 +258,8 @@
         Map.entry(VehicleProperty.CRUISE_CONTROL_TYPE, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.CRUISE_CONTROL_STATE, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.CRUISE_CONTROL_COMMAND, VehiclePropertyAccess.WRITE),
+        Map.entry(VehicleProperty.CRUISE_CONTROL_TARGET_SPEED, VehiclePropertyAccess.READ),
+        Map.entry(VehicleProperty.ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_ENABLED, VehiclePropertyAccess.READ_WRITE),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_DRIVER_STATE, VehiclePropertyAccess.READ),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_WARNING, VehiclePropertyAccess.READ),
diff --git a/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java b/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
index 0beab94..7814a44 100644
--- a/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
+++ b/automotive/vehicle/aidl/generated_lib/java/ChangeModeForVehicleProperty.java
@@ -111,6 +111,7 @@
         Map.entry(VehicleProperty.AP_POWER_STATE_REPORT, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.AP_POWER_BOOTUP_REASON, VehiclePropertyChangeMode.STATIC),
         Map.entry(VehicleProperty.DISPLAY_BRIGHTNESS, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.PER_DISPLAY_BRIGHTNESS, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HW_KEY_INPUT, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HW_KEY_INPUT_V2, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HW_MOTION_INPUT, VehiclePropertyChangeMode.ON_CHANGE),
@@ -182,6 +183,7 @@
         Map.entry(VehicleProperty.GLOVE_BOX_DOOR_POS, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.GLOVE_BOX_LOCKED, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.VEHICLE_MAP_SERVICE, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.LOCATION_CHARACTERIZATION, VehiclePropertyChangeMode.STATIC),
         Map.entry(VehicleProperty.OBD2_LIVE_FRAME, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.OBD2_FREEZE_FRAME, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.OBD2_FREEZE_FRAME_INFO, VehiclePropertyChangeMode.ON_CHANGE),
@@ -256,6 +258,8 @@
         Map.entry(VehicleProperty.CRUISE_CONTROL_TYPE, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.CRUISE_CONTROL_STATE, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.CRUISE_CONTROL_COMMAND, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.CRUISE_CONTROL_TARGET_SPEED, VehiclePropertyChangeMode.ON_CHANGE),
+        Map.entry(VehicleProperty.ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_ENABLED, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_DRIVER_STATE, VehiclePropertyChangeMode.ON_CHANGE),
         Map.entry(VehicleProperty.HANDS_ON_DETECTION_WARNING, VehiclePropertyChangeMode.ON_CHANGE),
diff --git a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
index ff601e0..d921079 100644
--- a/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
+++ b/automotive/vehicle/aidl/impl/default_config/JsonConfigLoader/src/JsonConfigLoader.cpp
@@ -57,6 +57,7 @@
 using ::aidl::android::hardware::automotive::vehicle::LaneCenteringAssistState;
 using ::aidl::android::hardware::automotive::vehicle::LaneDepartureWarningState;
 using ::aidl::android::hardware::automotive::vehicle::LaneKeepAssistState;
+using ::aidl::android::hardware::automotive::vehicle::LocationCharacterization;
 using ::aidl::android::hardware::automotive::vehicle::RawPropValues;
 using ::aidl::android::hardware::automotive::vehicle::VehicleApPowerStateReport;
 using ::aidl::android::hardware::automotive::vehicle::VehicleApPowerStateReq;
@@ -136,6 +137,7 @@
 #ifdef ENABLE_VEHICLE_HAL_TEST_PROPERTIES
         // Following are test properties:
         {"ECHO_REVERSE_BYTES", ECHO_REVERSE_BYTES},
+        {"VENDOR_PROPERTY_ID", VENDOR_PROPERTY_ID},
         {"kMixedTypePropertyForTest", kMixedTypePropertyForTest},
         {"VENDOR_CLUSTER_NAVIGATION_STATE", VENDOR_CLUSTER_NAVIGATION_STATE},
         {"VENDOR_CLUSTER_REQUEST_DISPLAY", VENDOR_CLUSTER_REQUEST_DISPLAY},
@@ -199,6 +201,8 @@
             std::make_unique<ConstantParser<VehiclePropertyAccess>>();
     mConstantParsersByType["VehiclePropertyChangeMode"] =
             std::make_unique<ConstantParser<VehiclePropertyChangeMode>>();
+    mConstantParsersByType["LocationCharacterization"] =
+            std::make_unique<ConstantParser<LocationCharacterization>>();
     mConstantParsersByType["VehicleGear"] = std::make_unique<ConstantParser<VehicleGear>>();
     mConstantParsersByType["VehicleAreaWindow"] =
             std::make_unique<ConstantParser<VehicleAreaWindow>>();
diff --git a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
index 85a7486..b6d987e 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
+++ b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
@@ -3130,6 +3130,14 @@
             "property": "VehicleProperty::VEHICLE_MAP_SERVICE"
         },
         {
+            "property": "VehicleProperty::LOCATION_CHARACTERIZATION",
+            "defaultValue": {
+                "int32Values": [
+                    "LocationCharacterization::RAW_GNSS_ONLY"
+                ]
+            }
+        },
+        {
             "property": "VehicleProperty::ELECTRONIC_TOLL_COLLECTION_CARD_TYPE",
             "defaultValue": {
                 "int32Values": [
@@ -3249,6 +3257,37 @@
             ]
         },
         {
+            "property": "VehicleProperty::CRUISE_CONTROL_TARGET_SPEED",
+            "defaultValue": {
+                "floatValues": [
+                    25.0
+                ]
+            },
+            "areas": [
+                {
+                    "areaId": 0,
+                    "minFloatValue": 20.0,
+                    "maxFloatValue": 35.0
+                }
+            ]
+        },
+        {
+            "property": "VehicleProperty::ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP",
+            "defaultValue": {
+                "int32Values": [
+                    1200
+                ]
+            },
+            "configArray": [
+                1200,
+                1400,
+                1600,
+                1800,
+                2000,
+                2200
+            ]
+        },
+        {
             "property": "VehicleProperty::HANDS_ON_DETECTION_ENABLED",
             "defaultValue": {
                 "int32Values": [
diff --git a/automotive/vehicle/aidl/impl/default_config/config/TestProperties.json b/automotive/vehicle/aidl/impl/default_config/config/TestProperties.json
index 33c6cc2..fd4b002 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/TestProperties.json
+++ b/automotive/vehicle/aidl/impl/default_config/config/TestProperties.json
@@ -182,6 +182,11 @@
             "changeMode": "VehiclePropertyChangeMode::ON_CHANGE"
         },
         {
+            "property": "Constants::VENDOR_PROPERTY_ID",
+            "access": "VehiclePropertyAccess::READ_WRITE",
+            "changeMode": "VehiclePropertyChangeMode::ON_CHANGE"
+        },
+        {
             "property": "VehicleProperty::SUPPORT_CUSTOMIZE_VENDOR_PERMISSION",
             "defaultValue": {
                 "int32Values": [
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
index a9dced9..00ebdda 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
@@ -85,7 +85,8 @@
 // overwrite the default configs.
 constexpr char OVERRIDE_PROPERTY[] = "persist.vendor.vhal_init_value_override";
 constexpr char POWER_STATE_REQ_CONFIG_PROPERTY[] = "ro.vendor.fake_vhal.ap_power_state_req.config";
-
+// The value to be returned if VENDOR_PROPERTY_ID is set as the property
+constexpr int VENDOR_ERROR_CODE = 0x00ab0005;
 // A list of supported options for "--set" command.
 const std::unordered_set<std::string> SET_PROP_OPTIONS = {
         // integer.
@@ -389,6 +390,9 @@
         case ECHO_REVERSE_BYTES:
             *isSpecialValue = true;
             return getEchoReverseBytes(value);
+        case VENDOR_PROPERTY_ID:
+            *isSpecialValue = true;
+            return StatusError((StatusCode)VENDOR_ERROR_CODE);
         default:
             // Do nothing.
             break;
@@ -469,6 +473,9 @@
         case OBD2_FREEZE_FRAME_CLEAR:
             *isSpecialValue = true;
             return mFakeObd2Frame->clearObd2FreezeFrames(value);
+        case VENDOR_PROPERTY_ID:
+            *isSpecialValue = true;
+            return StatusError((StatusCode)VENDOR_ERROR_CODE);
 
 #ifdef ENABLE_VEHICLE_HAL_TEST_PROPERTIES
         case toInt(VehicleProperty::CLUSTER_REPORT_STATE):
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
index 67b1aa4..f3593aa 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
@@ -409,6 +409,11 @@
             continue;
         }
 
+        if (propId == VENDOR_PROPERTY_ID) {
+            // Ignore VENDOR_PROPERTY_ID, it has special logic.
+            continue;
+        }
+
         if (isGlobalProp(propId)) {
             if (config.initialValue == RawPropValues{}) {
                 addGetValueRequest(getValueRequests, expectedGetValueResults, requestId++,
diff --git a/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h b/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
index fc0c8db..7db4246 100644
--- a/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
+++ b/automotive/vehicle/aidl/impl/utils/common/include/VehicleHalTypes.h
@@ -44,6 +44,7 @@
 #include <aidl/android/hardware/automotive/vehicle/LaneCenteringAssistState.h>
 #include <aidl/android/hardware/automotive/vehicle/LaneDepartureWarningState.h>
 #include <aidl/android/hardware/automotive/vehicle/LaneKeepAssistState.h>
+#include <aidl/android/hardware/automotive/vehicle/LocationCharacterization.h>
 #include <aidl/android/hardware/automotive/vehicle/Obd2CommonIgnitionMonitors.h>
 #include <aidl/android/hardware/automotive/vehicle/Obd2FuelSystemStatus.h>
 #include <aidl/android/hardware/automotive/vehicle/Obd2FuelType.h>
diff --git a/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h b/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
index e6ea6fe..1400288 100644
--- a/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
+++ b/automotive/vehicle/aidl/impl/utils/test/include/TestPropertyUtils.h
@@ -84,6 +84,13 @@
                                        toInt(testpropertyutils_impl::VehicleArea::GLOBAL) |
                                        toInt(testpropertyutils_impl::VehiclePropertyType::BYTES);
 
+// This property is used for testing vendor error codes end to end.
+// 0x21402a13
+constexpr int32_t VENDOR_PROPERTY_ID = 0x2a13 |
+                                       toInt(testpropertyutils_impl::VehiclePropertyGroup::VENDOR) |
+                                       toInt(testpropertyutils_impl::VehicleArea::GLOBAL) |
+                                       toInt(testpropertyutils_impl::VehiclePropertyType::INT32);
+
 // This property is used for test purpose. End to end tests use this property to test set and get
 // method for MIXED type properties.
 constexpr int32_t kMixedTypePropertyForTest =
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/LocationCharacterization.aidl
similarity index 79%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/LocationCharacterization.aidl
index ea86c4f..27abe41 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/LocationCharacterization.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,16 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
-@VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+package android.hardware.automotive.vehicle;
+@Backing(type="int") @VintfStability
+enum LocationCharacterization {
+  PRIOR_LOCATIONS = 0x1,
+  GYROSCOPE_FUSION = 0x2,
+  ACCELEROMETER_FUSION = 0x4,
+  COMPASS_FUSION = 0x8,
+  WHEEL_SPEED_FUSION = 0x10,
+  STEERING_ANGLE_FUSION = 0x20,
+  CAR_SPEED_FUSION = 0x40,
+  DEAD_RECKONED = 0x80,
+  RAW_GNSS_ONLY = 0x100,
 }
diff --git a/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
index cc06bf3..f3c8234 100644
--- a/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl_property/aidl_api/android.hardware.automotive.vehicle.property/current/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -117,6 +117,7 @@
   AP_POWER_STATE_REPORT = (((0x0A01 + 0x10000000) + 0x01000000) + 0x00410000) /* 289475073 */,
   AP_POWER_BOOTUP_REASON = (((0x0A02 + 0x10000000) + 0x01000000) + 0x00400000) /* 289409538 */,
   DISPLAY_BRIGHTNESS = (((0x0A03 + 0x10000000) + 0x01000000) + 0x00400000) /* 289409539 */,
+  PER_DISPLAY_BRIGHTNESS = (((0x0A04 + 0x10000000) + 0x01000000) + 0x00410000) /* 289475076 */,
   HW_KEY_INPUT = (((0x0A10 + 0x10000000) + 0x01000000) + 0x00410000) /* 289475088 */,
   HW_KEY_INPUT_V2 = (((0x0A11 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.SEAT) + android.hardware.automotive.vehicle.VehiclePropertyType.MIXED) /* 367004177 */,
   HW_MOTION_INPUT = (((0x0A12 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.SEAT) + android.hardware.automotive.vehicle.VehiclePropertyType.MIXED) /* 367004178 */,
@@ -188,6 +189,7 @@
   GLOVE_BOX_DOOR_POS = (((0x0BF0 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.SEAT) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 356518896 */,
   GLOVE_BOX_LOCKED = (((0x0BF1 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.SEAT) + android.hardware.automotive.vehicle.VehiclePropertyType.BOOLEAN) /* 354421745 */,
   VEHICLE_MAP_SERVICE = (((0x0C00 + 0x10000000) + 0x01000000) + 0x00e00000) /* 299895808 */,
+  LOCATION_CHARACTERIZATION = (((0x0C10 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289410064 */,
   OBD2_LIVE_FRAME = (((0x0D00 + 0x10000000) + 0x01000000) + 0x00e00000) /* 299896064 */,
   OBD2_FREEZE_FRAME = (((0x0D01 + 0x10000000) + 0x01000000) + 0x00e00000) /* 299896065 */,
   OBD2_FREEZE_FRAME_INFO = (((0x0D02 + 0x10000000) + 0x01000000) + 0x00e00000) /* 299896066 */,
@@ -262,6 +264,8 @@
   CRUISE_CONTROL_TYPE = (((0x1010 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411088 */,
   CRUISE_CONTROL_STATE = (((0x1011 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411089 */,
   CRUISE_CONTROL_COMMAND = (((0x1012 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411090 */,
+  CRUISE_CONTROL_TARGET_SPEED = (((0x1013 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.FLOAT) /* 291508243 */,
+  ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP = (((0x1014 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411092 */,
   HANDS_ON_DETECTION_ENABLED = (((0x1016 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.BOOLEAN) /* 287313942 */,
   HANDS_ON_DETECTION_DRIVER_STATE = (((0x1017 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411095 */,
   HANDS_ON_DETECTION_WARNING = (((0x1018 + android.hardware.automotive.vehicle.VehiclePropertyGroup.SYSTEM) + android.hardware.automotive.vehicle.VehicleArea.GLOBAL) + android.hardware.automotive.vehicle.VehiclePropertyType.INT32) /* 289411096 */,
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/LocationCharacterization.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/LocationCharacterization.aidl
new file mode 100644
index 0000000..e06df40
--- /dev/null
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/LocationCharacterization.aidl
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.automotive.vehicle;
+
+/**
+ * Used by LOCATION_CHARACTERIZATION to enumerate the supported bit flags.
+ *
+ * These flags are used to indicate to what transformations are performed on the
+ * GNSS data before the location data is sent, so that location processing
+ * algorithms can take into account prior fusion.
+ *
+ * This enum can be extended in future releases to include additional bit flags.
+ */
+@VintfStability
+@Backing(type="int")
+enum LocationCharacterization {
+    /**
+     * Prior location samples have been used to refine the raw GNSS data (e.g. a
+     * Kalman Filter).
+     */
+    PRIOR_LOCATIONS = 0x1,
+    /**
+     * Gyroscope data has been used to refine the raw GNSS data.
+     */
+    GYROSCOPE_FUSION = 0x2,
+    /**
+     * Accelerometer data has been used to refine the raw GNSS data.
+     */
+    ACCELEROMETER_FUSION = 0x4,
+    /**
+     * Compass data has been used to refine the raw GNSS data.
+     */
+    COMPASS_FUSION = 0x8,
+    /**
+     * Wheel speed has been used to refine the raw GNSS data.
+     */
+    WHEEL_SPEED_FUSION = 0x10,
+    /**
+     * Steering angle has been used to refine the raw GNSS data.
+     */
+    STEERING_ANGLE_FUSION = 0x20,
+    /**
+     * Car speed has been used to refine the raw GNSS data.
+     */
+    CAR_SPEED_FUSION = 0x40,
+    /**
+     * Some effort is made to dead-reckon location. In particular, this means that
+     * relative changes in location have meaning when no GNSS satellite is
+     * available.
+     */
+    DEAD_RECKONED = 0x80,
+    /**
+     * Location is based on GNSS satellite signals without sufficient fusion of
+     * other sensors for complete dead reckoning. This flag should be set when
+     * relative changes to location cannot be relied on when no GNSS satellite is
+     * available.
+     */
+    RAW_GNSS_ONLY = 0x100,
+}
diff --git a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
index 473dffc..b628b60 100644
--- a/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
+++ b/automotive/vehicle/aidl_property/android/hardware/automotive/vehicle/VehicleProperty.aidl
@@ -619,10 +619,10 @@
     /**
      * HVAC Properties
      *
-     * Additional rules for mapping a zoned HVAC property (except
-     * HVAC_MAX_DEFROST_ON) to AreaIDs:
-     *  - Every seat in VehicleAreaSeat that is available in the car, must be
-     *    part of an AreaID in the AreaID array.
+     * Additional rules for mapping non-GLOBAL VehicleArea type HVAC properties
+     * to AreaIDs:
+     *  - Every “area” for a specific VehicleArea type that is affected by the
+     *    property, must be included in an area ID for that property.
      *
      * Example 1: A car has two front seats (ROW_1_LEFT, ROW_1_RIGHT) and three
      *  back seats (ROW_2_LEFT, ROW_2_CENTER, ROW_2_RIGHT). There are two
@@ -651,6 +651,16 @@
      *     - ROW_1_RIGHT
      *     - ROW_2_LEFT | ROW_2_CENTER | ROW_2_RIGHT | ROW_3_LEFT | ROW_3_CENTER | ROW_3_RIGHT
      *
+     * Example 3: A car has two front seats (ROW_1_LEFT, ROW_1_RIGHT) and three
+     *  back seats (ROW_2_LEFT, ROW_2_CENTER, ROW_2_RIGHT). Suppose the car
+     *  supports HVAC_AUTO_ON for just the two front seats.
+     *   - A valid mapping set of AreaIDs for HVAC_AUTO_ON would be:
+     *      - ROW_1_LEFT | ROW_1_RIGHT
+     *   - If HVAC_AUTO_ON had two separate control units for the driver side
+     *     and passenger side, an alternative mapping would be:
+     *      - ROW_1_LEFT
+     *      - ROW_1_RIGHT
+     *
      *
      * Fan speed setting
      *
@@ -1252,9 +1262,16 @@
     AP_POWER_BOOTUP_REASON = 0x0A02 + 0x10000000 + 0x01000000
             + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
     /**
-     * Property to represent brightness of the display. Some cars have single
-     * control for the brightness of all displays and this property is to share
-     * change in that control.
+     * Property to represent brightness of the display.
+     *
+     * Some cars have single control for the brightness of all displays and this
+     * property is to share change in that control. In cars which have displays
+     * whose brightness is controlled separately, they must use
+     * PER_DISPLAY_BRIGHTNESS.
+     *
+     * Only one of DISPLAY_BRIGHTNESS and PER_DISPLAY_BRIGHTNESS should be
+     * implemented. If both are available, PER_DISPLAY_BRIGHTNESS is used by
+     * AAOS.
      *
      * If this is writable, android side can set this value when user changes
      * display brightness from Settings. If this is read only, user may still
@@ -1267,6 +1284,29 @@
     DISPLAY_BRIGHTNESS = 0x0A03 + 0x10000000 + 0x01000000
             + 0x00400000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32
     /**
+     * Property to represent brightness of the displays which are controlled separately.
+     *
+     * Some cars have one or more displays whose brightness is controlled
+     * separately and this property is to inform the brightness of each
+     * passenger display. In cars where all displays' brightness is controlled
+     * together, they must use DISPLAY_BRIGHTNESS.
+     *
+     * Only one of DISPLAY_BRIGHTNESS and PER_DISPLAY_BRIGHTNESS should be
+     * implemented. If both are available, PER_DISPLAY_BRIGHTNESS is used by
+     * AAOS.
+     *
+     * The display port uniquely identifies a physical connector on the device
+     * for display output, ranging from 0 to 255.
+     *
+     * int32Values[0] : display port
+     * int32Values[1] : brightness
+     *
+     * @change_mode VehiclePropertyChangeMode.ON_CHANGE
+     * @access VehiclePropertyAccess.READ_WRITE
+     */
+    PER_DISPLAY_BRIGHTNESS = 0x0A04 + 0x10000000 + 0x01000000
+            + 0x00410000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:INT32_VEC
+    /**
      * Property to feed H/W input events to android
      *
      * int32Values[0] : action defined by VehicleHwKeyInputAction
@@ -2106,6 +2146,7 @@
      *
      * @change_mode VehiclePropertyChangeMode.ON_CHANGE
      * @access VehiclePropertyAccess.READ
+     * @unit VehicleUnit:MILLI_SECS
      */
     WINDSHIELD_WIPERS_PERIOD =
             0x0BC5 + VehiclePropertyGroup.SYSTEM + VehicleArea.WINDOW + VehiclePropertyType.INT32,
@@ -2318,6 +2359,20 @@
     VEHICLE_MAP_SERVICE = 0x0C00 + 0x10000000 + 0x01000000
             + 0x00e00000, // VehiclePropertyGroup:SYSTEM,VehicleArea:GLOBAL,VehiclePropertyType:MIXED
     /**
+     * Characterization of inputs used for computing location.
+     *
+     * This property must indicate what (if any) data and sensor inputs are considered by the system
+     * when computing the vehicle's location that is shared with Android through the GNSS HAL.
+     *
+     * The value must return a collection of bit flags. The bit flags are defined in
+     * LocationCharacterization.
+     *
+     * @change_mode VehiclePropertyChangeMode.STATIC
+     * @access VehiclePropertyAccess.READ
+     */
+    LOCATION_CHARACTERIZATION =
+            0x0C10 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.INT32,
+    /**
      * OBD2 Live Sensor Data
      *
      * Reports a snapshot of the current (live) values of the OBD2 sensors available.
@@ -3848,6 +3903,11 @@
      * maneuver is detected, ELKA alerts the driver and applies steering corrections to keep the
      * vehicle in its original lane.
      *
+     * In general, EMERGENCY_LANE_KEEP_ASSIST_ENABLED should always return true or false. If the
+     * feature is not available due to some temporary state, such as the vehicle speed being too
+     * low, that information must be conveyed through the ErrorState values in the
+     * EMERGENCY_LANE_KEEP_ASSIST_STATE property.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
@@ -3886,6 +3946,11 @@
      * When CC is enabled, the ADAS system in the vehicle should be turned on and responding to
      * commands.
      *
+     * In general, CRUISE_CONTROL_ENABLED should always return true or false. If the feature is not
+     * available due to some temporary state, such as the vehicle speed being too low, that
+     * information must be conveyed through the ErrorState values in the CRUISE_CONTROL_STATE
+     * property.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
@@ -3956,12 +4021,57 @@
             0x1012 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.INT32,
 
     /**
+     * Current target speed for Cruise Control (CC).
+     *
+     * OEMs should set the minInt32Value and maxInt32Value values for this property to define the
+     * min and max target speed values. These values must be non-negative.
+     *
+     * The maxFloatValue represents the upper bound of the target speed.
+     * The minFloatValue represents the lower bound of the target speed.
+     *
+     * When this property is not available (for example when CRUISE_CONTROL_ENABLED is false), it
+     * should return StatusCode.NOT_AVAILABLE_DISABLED.
+     *
+     * @change_mode VehiclePropertyChangeMode.ON_CHANGE
+     * @access VehiclePropertyAccess.READ
+     * @unit VehicleUnit:METER_PER_SEC
+     */
+    CRUISE_CONTROL_TARGET_SPEED =
+            0x1013 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.FLOAT,
+
+    /**
+     * Current target time gap for Adaptive Cruise Control (ACC) or Predictive Cruise Control in
+     * milliseconds.
+     *
+     * This property should specify the target time gap to a leading vehicle. This gap is defined as
+     * the time to travel the distance between the leading vehicle's rear-most point to the ACC
+     * vehicle's front-most point. The actual time gap from a leading vehicle can be above or below
+     * this value.
+     *
+     * The possible values to set for the target time gap should be specified in configArray in
+     * ascending order. All values must be positive. If the property is writable, all values must be
+     * writable.
+     *
+     * Writing to this property when it is not available should return StatusCode.NOT_AVAILABLE.
+     *
+     * @change_mode VehiclePropertyChangeMode.ON_CHANGE
+     * @access VehiclePropertyAccess.READ_WRITE
+     * @unit VehicleUnit:MILLI_SECS
+     */
+    ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP =
+            0x1014 + VehiclePropertyGroup.SYSTEM + VehicleArea.GLOBAL + VehiclePropertyType.INT32,
+
+    /**
      * Enable or disable hands on detection (HOD).
      *
      * Set true to enable HOD and false to disable HOD. When HOD is enabled, a system inside the
      * vehicle should be monitoring the presence of the driver's hands on the steering wheel and
      * send a warning if it detects that the driver's hands are no longer on the steering wheel.
      *
+     * In general, HANDS_ON_DETECTION_ENABLED should always return true or false. If the feature is
+     * not available due to some temporary state, that information must be conveyed through the
+     * ErrorState values in the HANDS_ON_DETECTION_STATE property.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
@@ -4025,6 +4135,10 @@
      * be monitoring the attention level of the driver and should send a warning if it detects that
      * the driver is distracted.
      *
+     * In general, DRIVER_ATTENTION_MONITORING_ENABLED should always return true or false. If the
+     * feature is not available due to some temporary state, that information must be conveyed
+     * through the ErrorState values in the DRIVER_ATTENTION_MONITORING_STATE property.
+     *
      * This property is defined as read_write, but OEMs have the option to implement it as read
      * only.
      *
diff --git a/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp b/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
index 51cc376..e06647d 100644
--- a/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
+++ b/automotive/vehicle/vts/src/VtsHalAutomotiveVehicle_TargetTest.cpp
@@ -498,6 +498,12 @@
                             actualPropertyType);
 }
 
+TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyLocationCharacterizationConfig) {
+    verifyProperty(VehicleProperty::LOCATION_CHARACTERIZATION, VehiclePropertyAccess::READ,
+                   VehiclePropertyChangeMode::STATIC, VehiclePropertyGroup::SYSTEM,
+                   VehicleArea::GLOBAL, VehiclePropertyType::INT32);
+}
+
 TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyEmergencyLaneKeepAssistEnabledConfig) {
     verifyProperty(VehicleProperty::EMERGENCY_LANE_KEEP_ASSIST_ENABLED,
                    VehiclePropertyAccess::READ_WRITE, VehiclePropertyChangeMode::ON_CHANGE,
@@ -534,6 +540,18 @@
                    VehicleArea::GLOBAL, VehiclePropertyType::INT32);
 }
 
+TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyCruiseControlTargetSpeedConfig) {
+    verifyProperty(VehicleProperty::CRUISE_CONTROL_TARGET_SPEED, VehiclePropertyAccess::READ,
+                   VehiclePropertyChangeMode::ON_CHANGE, VehiclePropertyGroup::SYSTEM,
+                   VehicleArea::GLOBAL, VehiclePropertyType::FLOAT);
+}
+
+TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyAdaptiveCruiseControlTargetTimeGapConfig) {
+    verifyProperty(VehicleProperty::ADAPTIVE_CRUISE_CONTROL_TARGET_TIME_GAP,
+                   VehiclePropertyAccess::READ_WRITE, VehiclePropertyChangeMode::ON_CHANGE,
+                   VehiclePropertyGroup::SYSTEM, VehicleArea::GLOBAL, VehiclePropertyType::INT32);
+}
+
 TEST_P(VtsHalAutomotiveVehicleTargetTest, verifyHandsOnDetectionEnabledConfig) {
     verifyProperty(VehicleProperty::HANDS_ON_DETECTION_ENABLED, VehiclePropertyAccess::READ_WRITE,
                    VehiclePropertyChangeMode::ON_CHANGE, VehiclePropertyGroup::SYSTEM,
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/IDiceDevice.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/AuthenticateReason.aidl
similarity index 64%
rename from security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/IDiceDevice.aidl
rename to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/AuthenticateReason.aidl
index 383f4d1..f639ead 100644
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/IDiceDevice.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/AuthenticateReason.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2021 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,33 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.dice;
+package android.hardware.biometrics.common;
 /* @hide */
-@SensitiveData @VintfStability
-interface IDiceDevice {
-  android.hardware.security.dice.Signature sign(in android.hardware.security.dice.InputValues[] id, in byte[] payload);
-  android.hardware.security.dice.Bcc getAttestationChain(in android.hardware.security.dice.InputValues[] inputValues);
-  android.hardware.security.dice.BccHandover derive(in android.hardware.security.dice.InputValues[] inputValues);
-  void demote(in android.hardware.security.dice.InputValues[] inputValues);
+@VintfStability
+union AuthenticateReason {
+  android.hardware.biometrics.common.AuthenticateReason.Vendor vendorAuthenticateReason;
+  android.hardware.biometrics.common.AuthenticateReason.Face faceAuthenticateReason;
+  android.hardware.biometrics.common.AuthenticateReason.Fingerprint fingerprintAuthenticateReason;
+  @VintfStability
+  parcelable Vendor {
+    ParcelableHolder extension;
+  }
+  @Backing(type="int") @VintfStability
+  enum Fingerprint {
+    UNKNOWN,
+  }
+  @Backing(type="int") @VintfStability
+  enum Face {
+    UNKNOWN,
+    STARTED_WAKING_UP,
+    PRIMARY_BOUNCER_SHOWN,
+    ASSISTANT_VISIBLE,
+    ALTERNATE_BIOMETRIC_BOUNCER_SHOWN,
+    NOTIFICATION_PANEL_CLICKED,
+    OCCLUDING_APP_REQUESTED,
+    PICK_UP_GESTURE_TRIGGERED,
+    QS_EXPANDED,
+    SWIPE_UP_ON_BOUNCER,
+    UDFPS_POINTER_DOWN,
+  }
 }
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Mode.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/DisplayState.aidl
similarity index 87%
rename from security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Mode.aidl
rename to biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/DisplayState.aidl
index 295c32e..176e8d6 100644
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Mode.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/DisplayState.aidl
@@ -1,11 +1,11 @@
 /*
- * Copyright 2021, The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -31,12 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.security.dice;
+package android.hardware.biometrics.common;
 /* @hide */
 @Backing(type="int") @VintfStability
-enum Mode {
-  NOT_INITIALIZED = 0,
-  NORMAL = 1,
-  DEBUG = 2,
-  RECOVERY = 3,
+enum DisplayState {
+  UNKNOWN,
+  LOCKSCREEN,
+  NO_UI,
+  SCREENSAVER,
+  AOD,
 }
diff --git a/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/OperationContext.aidl b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/OperationContext.aidl
index 305e422..378017e 100644
--- a/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/OperationContext.aidl
+++ b/biometrics/common/aidl/aidl_api/android.hardware.biometrics.common/current/android/hardware/biometrics/common/OperationContext.aidl
@@ -37,7 +37,12 @@
 parcelable OperationContext {
   int id = 0;
   android.hardware.biometrics.common.OperationReason reason = android.hardware.biometrics.common.OperationReason.UNKNOWN;
+  /**
+   * @deprecated use displayState instead.
+   */
   boolean isAod = false;
   boolean isCrypto = false;
   android.hardware.biometrics.common.WakeReason wakeReason = android.hardware.biometrics.common.WakeReason.UNKNOWN;
+  android.hardware.biometrics.common.DisplayState displayState = android.hardware.biometrics.common.DisplayState.UNKNOWN;
+  @nullable android.hardware.biometrics.common.AuthenticateReason authenticateReason;
 }
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/AuthenticateReason.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/AuthenticateReason.aidl
new file mode 100644
index 0000000..fcf5294
--- /dev/null
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/AuthenticateReason.aidl
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.common;
+
+/**
+ * Reason for an authenticate operation.
+ *
+ * @hide
+ */
+@VintfStability
+union AuthenticateReason {
+    /** Vendor reason for invoking an authenticate operation. */
+    @VintfStability
+    parcelable Vendor {
+        ParcelableHolder extension;
+    }
+
+    /** Reason for invoking fingerprint authentication. */
+    @VintfStability
+    @Backing(type="int")
+    enum Fingerprint {
+        UNKNOWN,
+    }
+
+    /** Reason for invoking face authentication. */
+    @VintfStability
+    @Backing(type="int")
+    enum Face {
+        UNKNOWN,
+        STARTED_WAKING_UP,
+        PRIMARY_BOUNCER_SHOWN,
+        ASSISTANT_VISIBLE,
+        ALTERNATE_BIOMETRIC_BOUNCER_SHOWN,
+        NOTIFICATION_PANEL_CLICKED,
+        OCCLUDING_APP_REQUESTED,
+        PICK_UP_GESTURE_TRIGGERED,
+        QS_EXPANDED,
+        SWIPE_UP_ON_BOUNCER,
+        UDFPS_POINTER_DOWN,
+    }
+
+    AuthenticateReason.Vendor vendorAuthenticateReason;
+    AuthenticateReason.Face faceAuthenticateReason;
+    AuthenticateReason.Fingerprint fingerprintAuthenticateReason;
+}
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/DisplayState.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/DisplayState.aidl
new file mode 100644
index 0000000..d01eac8
--- /dev/null
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/DisplayState.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.common;
+
+/**
+ * Display state during an operation.
+ *
+ * @hide
+ */
+@VintfStability
+@Backing(type="int")
+enum DisplayState {
+    /** The display state is unknown. */
+    UNKNOWN,
+
+    /** The display is on and showing the lockscreen (or an occluding app). */
+    LOCKSCREEN,
+
+    /** The display is off or dozing. */
+    NO_UI,
+
+    /** The display is showing a screensaver (dreaming). */
+    SCREENSAVER,
+
+    /** The display is dreaming with always on display. */
+    AOD,
+}
diff --git a/biometrics/common/aidl/android/hardware/biometrics/common/OperationContext.aidl b/biometrics/common/aidl/android/hardware/biometrics/common/OperationContext.aidl
index a8f768d..f4191d7 100644
--- a/biometrics/common/aidl/android/hardware/biometrics/common/OperationContext.aidl
+++ b/biometrics/common/aidl/android/hardware/biometrics/common/OperationContext.aidl
@@ -16,6 +16,8 @@
 
 package android.hardware.biometrics.common;
 
+import android.hardware.biometrics.common.AuthenticateReason;
+import android.hardware.biometrics.common.DisplayState;
 import android.hardware.biometrics.common.OperationReason;
 import android.hardware.biometrics.common.WakeReason;
 
@@ -43,7 +45,7 @@
      */
     OperationReason reason = OperationReason.UNKNOWN;
 
-    /* Flag indicating that the display is in AOD mode. */
+    /** @deprecated use displayState instead. */
     boolean isAod = false;
 
     /** Flag indicating that crypto was requested. */
@@ -58,4 +60,15 @@
      * policy.
      */
     WakeReason wakeReason = WakeReason.UNKNOWN;
+
+    /** The current display state. */
+    DisplayState displayState = DisplayState.UNKNOWN;
+
+    /**
+     * An associated reason for an authenticate operation.
+     *
+     * This should be interpreted as a hint to enable optimizations or tracing. The
+     * framework may choose to omit the reason at any time based on the device's policy.
+     */
+    @nullable AuthenticateReason authenticateReason;
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
index 0cc619f..7075f71 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
@@ -35,17 +35,19 @@
 /* @hide */
 @Backing(type="byte") @VintfStability
 enum AcquiredInfo {
-  UNKNOWN = 0,
-  GOOD = 1,
-  PARTIAL = 2,
-  INSUFFICIENT = 3,
-  SENSOR_DIRTY = 4,
-  TOO_SLOW = 5,
-  TOO_FAST = 6,
-  VENDOR = 7,
-  START = 8,
-  TOO_DARK = 9,
-  TOO_BRIGHT = 10,
-  IMMOBILE = 11,
-  RETRYING_CAPTURE = 12,
+  UNKNOWN,
+  GOOD,
+  PARTIAL,
+  INSUFFICIENT,
+  SENSOR_DIRTY,
+  TOO_SLOW,
+  TOO_FAST,
+  VENDOR,
+  START,
+  TOO_DARK,
+  TOO_BRIGHT,
+  IMMOBILE,
+  RETRYING_CAPTURE,
+  LIFT_TOO_SOON,
+  POWER_PRESS,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
index 45ce2eb..9eeaac5 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/Error.aidl
@@ -35,13 +35,14 @@
 /* @hide */
 @Backing(type="byte") @VintfStability
 enum Error {
-  UNKNOWN = 0,
-  HW_UNAVAILABLE = 1,
-  UNABLE_TO_PROCESS = 2,
-  TIMEOUT = 3,
-  NO_SPACE = 4,
-  CANCELED = 5,
-  UNABLE_TO_REMOVE = 6,
-  VENDOR = 7,
-  BAD_CALIBRATION = 8,
+  UNKNOWN,
+  HW_UNAVAILABLE,
+  UNABLE_TO_PROCESS,
+  TIMEOUT,
+  NO_SPACE,
+  CANCELED,
+  UNABLE_TO_REMOVE,
+  VENDOR,
+  BAD_CALIBRATION,
+  POWER_PRESS,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
index 67af20d..381aaf7 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/FingerprintSensorType.aidl
@@ -35,10 +35,10 @@
 /* @hide */
 @Backing(type="byte") @VintfStability
 enum FingerprintSensorType {
-  UNKNOWN = 0,
-  REAR = 1,
-  UNDER_DISPLAY_ULTRASONIC = 2,
-  UNDER_DISPLAY_OPTICAL = 3,
-  POWER_BUTTON = 4,
-  HOME_BUTTON = 5,
+  UNKNOWN,
+  REAR,
+  UNDER_DISPLAY_ULTRASONIC,
+  UNDER_DISPLAY_OPTICAL,
+  POWER_BUTTON,
+  HOME_BUTTON,
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
index f305855..4fdcefc 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -46,7 +46,13 @@
   void invalidateAuthenticatorId();
   void resetLockout(in android.hardware.keymaster.HardwareAuthToken hat);
   void close();
+  /**
+   * @deprecated use onPointerDownWithContext instead.
+   */
   void onPointerDown(in int pointerId, in int x, in int y, in float minor, in float major);
+  /**
+   * @deprecated use onPointerUpWithContext instead.
+   */
   void onPointerUp(in int pointerId);
   void onUiReady();
   android.hardware.biometrics.common.ICancellationSignal authenticateWithContext(in long operationId, in android.hardware.biometrics.common.OperationContext context);
@@ -55,4 +61,6 @@
   void onPointerDownWithContext(in android.hardware.biometrics.fingerprint.PointerContext context);
   void onPointerUpWithContext(in android.hardware.biometrics.fingerprint.PointerContext context);
   void onContextChanged(in android.hardware.biometrics.common.OperationContext context);
+  void onPointerCancelWithContext(in android.hardware.biometrics.fingerprint.PointerContext context);
+  void setIgnoreDisplayTouches(in boolean shouldIgnore);
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/PointerContext.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/PointerContext.aidl
index 999b324..d9bf085 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/PointerContext.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/PointerContext.aidl
@@ -35,12 +35,12 @@
 /* @hide */
 @JavaDerive(equals=true) @VintfStability
 parcelable PointerContext {
-  int pointerId = -1;
-  float x = 0.000000f;
-  float y = 0.000000f;
-  float minor = 0.000000f;
-  float major = 0.000000f;
-  float orientation = 0.000000f;
+  int pointerId = (-1) /* -1 */;
+  float x = 0f;
+  float y = 0f;
+  float minor = 0f;
+  float major = 0f;
+  float orientation = 0f;
   boolean isAod = false;
   long time = 0;
   long gestureStart = 0;
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorLocation.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorLocation.aidl
index dc6a62d..965576e 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorLocation.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorLocation.aidl
@@ -35,9 +35,13 @@
 /* @hide */
 @VintfStability
 parcelable SensorLocation {
+  /**
+   * @deprecated use the display field instead. This field was never used.
+   */
   int displayId;
   int sensorLocationX;
   int sensorLocationY;
   int sensorRadius;
   String display = "";
+  android.hardware.biometrics.fingerprint.SensorShape sensorShape = android.hardware.biometrics.fingerprint.SensorShape.CIRCLE;
 }
diff --git a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
index a77d5f2..a97d819 100644
--- a/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorProps.aidl
@@ -42,4 +42,5 @@
   boolean supportsDetectInteraction;
   boolean halHandlesDisplayTouches;
   boolean halControlsIllumination;
+  @nullable android.hardware.biometrics.fingerprint.TouchDetectionParameters touchDetectionParameters;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorShape.aidl
similarity index 88%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorShape.aidl
index ea86c4f..f673b1c 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/SensorShape.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
-@VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+package android.hardware.biometrics.fingerprint;
+/* @hide */
+@Backing(type="byte") @VintfStability
+enum SensorShape {
+  SQUARE,
+  CIRCLE,
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl
similarity index 88%
rename from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
rename to biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl
index ea86c4f..2e3ec4f 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/biometrics/fingerprint/aidl/aidl_api/android.hardware.biometrics.fingerprint/current/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
+package android.hardware.biometrics.fingerprint;
+/* @hide */
 @VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+parcelable TouchDetectionParameters {
+  float targetSize = 1.0f;
+  float minOverlap = 0.0f;
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
index d3aa98a..41b7c5e 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/AcquiredInfo.aidl
@@ -98,4 +98,15 @@
      * However, RETRYING_CAPTURE must not be sent after ACQUIRED_GOOD is sent.
      */
     RETRYING_CAPTURE,
+
+    /**
+     * Fingerprint was lifted before the capture completed.
+     */
+    LIFT_TOO_SOON,
+
+    /**
+     * Indicates a power press event has occurred. This is typically sent by fingerprint
+     * sensors that have the sensor co-located with the power button.
+     */
+    POWER_PRESS,
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
index d8d47fa..39a5676 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/Error.aidl
@@ -70,4 +70,10 @@
      * There's a problem with the sensor's calibration.
      */
     BAD_CALIBRATION,
+
+    /**
+     * Indicates a power press event has occurred. This is typically sent by fingerprint
+     * sensors that have the sensor co-located with the power button.
+     */
+    POWER_PRESS,
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
index f4f7804..83e7bbc 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/ISession.aidl
@@ -420,6 +420,8 @@
      * @param y The distance in pixels from the top edge of the display.
      * @param minor See android.view.MotionEvent#getTouchMinor
      * @param major See android.view.MotionEvent#getTouchMajor
+     *
+     * @deprecated use onPointerDownWithContext instead.
      */
     void onPointerDown(in int pointerId, in int x, in int y, in float minor, in float major);
 
@@ -434,6 +436,8 @@
      * ISession#enroll, ISession#detectInteraction.
      *
      * @param pointerId See android.view.MotionEvent#getPointerId
+     *
+     * @deprecated use onPointerUpWithContext instead.
      */
     void onPointerUp(in int pointerId);
 
@@ -469,15 +473,77 @@
     /** See ISession#detectInteraction() */
     ICancellationSignal detectInteractionWithContext(in OperationContext context);
 
-    /** See ISession#onPointerDown(int, int, int, float, float) */
+    /**
+     * onPointerDownWithContext:
+     *
+     * This operation only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_*. If invoked erroneously by the framework for sensors
+     * of other types, the HAL must treat this as a no-op and return immediately.
+     *
+     * Notifies the HAL that a finger entered the sensor area. This operation can be invoked
+     * regardless of the current state of the HAL.
+     *
+     * Note that for sensors which require illumination, for example
+     * FingerprintSensorType::UNDER_DISPLAY_OPTICAL, this is a good time to start illuminating.
+     *
+     * @param context See PointerContext
+     */
     void onPointerDownWithContext(in PointerContext context);
 
-    /** See ISession#onPointerUp(int) */
+    /**
+     * onPointerUpWithContext:
+     *
+     * This operation only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_*. If invoked for sensors of other types, the HAL must
+     * treat this as a no-op and return immediately.
+     *
+     * Notifies the HAL that a finger left the sensor area. This operation can be invoked regardless
+     * of the current state of the HAL.
+     *
+     * @param context See PointerContext
+     */
     void onPointerUpWithContext(in PointerContext context);
 
     /**
+     * onContextChanged:
+     *
      * This may be called while an authenticate, detect interaction, or enrollment operation is
      * running when the context changes.
      */
     void onContextChanged(in OperationContext context);
+
+    /**
+     * onPointerCancelWithContext:
+     *
+     * This operation only applies to sensors that are configured as
+     * FingerprintSensorType::UNDER_DISPLAY_*. If invoked for sensors of other types, the HAL must
+     * treat this as a no-op and return immediately.
+     *
+     * Notifies the HAL that if there were fingers within the sensor area, they are no longer being
+     * tracked. The fingers may or may not still be on the sensor. This operation can be invoked
+     * regardless of the current state of the HAL.
+     *
+     * @param context See PointerContext
+     */
+    void onPointerCancelWithContext(in PointerContext context);
+
+    /**
+     * setIgnoreDisplayTouches:
+     *
+     * This operation only applies to sensors that have SensorProps#halHandlesDisplayTouches
+     * set to true. For all other sensors this is a no-op.
+     *
+     * Instructs the HAL whether to ignore display touches. This can be useful to avoid unintended
+     * fingerprint captures during certain UI interactions. For example, when entering a lockscreen
+     * PIN, some of the touches might overlap with the fingerprint sensor. Those touches should be
+     * ignored to avoid unintended authentication attempts.
+     *
+     * This flag must default to false when the HAL starts.
+     *
+     * The framework is responsible for both setting the flag to true and resetting it to false
+     * whenever it's appropriate.
+     *
+     * @param shouldIgnore whether the display touches should be ignored.
+     */
+    void setIgnoreDisplayTouches(in boolean shouldIgnore);
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorLocation.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorLocation.aidl
index a065a7c..fd8c7fc 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorLocation.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorLocation.aidl
@@ -15,13 +15,16 @@
  */
 
 package android.hardware.biometrics.fingerprint;
+
+import android.hardware.biometrics.fingerprint.SensorShape;
+
 /**
  * @hide
  */
 @VintfStability
 parcelable SensorLocation {
     /**
-     * Deprecated use the display field instead. This field was never used.
+     * @deprecated use the display field instead. This field was never used.
      */
     int displayId;
 
@@ -59,4 +62,10 @@
      *      for each display from which the sensor is accessible from.
      */
     String display = "";
+
+    /**
+     * The shape of the sensor if applicable. Most useful for the sensor of type
+     * SensorType::UNDER_DISPLAY_*.
+     */
+    SensorShape sensorShape = SensorShape.CIRCLE;
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
index d4e9ec6..853aae4 100644
--- a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorProps.aidl
@@ -19,6 +19,8 @@
 import android.hardware.biometrics.common.CommonProps;
 import android.hardware.biometrics.fingerprint.FingerprintSensorType;
 import android.hardware.biometrics.fingerprint.SensorLocation;
+import android.hardware.biometrics.fingerprint.TouchDetectionParameters;
+
 /**
  * @hide
  */
@@ -72,4 +74,9 @@
      * This value must be ignored for sensors that aren't optical UDFPS.
      */
     boolean halControlsIllumination;
+
+    /**
+     * Parameters used for fingerprint touch detection.
+     */
+    @nullable TouchDetectionParameters touchDetectionParameters;
 }
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorShape.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorShape.aidl
new file mode 100644
index 0000000..1279332
--- /dev/null
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/SensorShape.aidl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.fingerprint;
+/**
+ * This is most useful for sensors configured as FingerprintSensorType::UNDER_DISPLAY_OPTICAL,
+ * as it's used to compute the on-screen sensor boundaries for the touch detection algorithm.
+ *
+ * @hide
+ */
+@VintfStability
+@Backing(type="byte")
+enum SensorShape {
+    SQUARE,
+    CIRCLE,
+}
diff --git a/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl
new file mode 100644
index 0000000..bf117a3
--- /dev/null
+++ b/biometrics/fingerprint/aidl/android/hardware/biometrics/fingerprint/TouchDetectionParameters.aidl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.biometrics.fingerprint;
+
+/**
+ * @hide
+ */
+@VintfStability
+parcelable TouchDetectionParameters {
+    /**
+     * The percentage of the sensor that is considered the target. Value is required to be within
+     * [0.0, 1.0]. The target area expands outwards from center matching the sensorShape. Some
+     * portion of the touch must be within the target to be considered a valid touch.
+     */
+    float targetSize = 1.0f;
+
+    /**
+     * The minimum percentage overlap needed on the sensor to be considered a valid touch. Value is
+     * required to be within [0.0, 1.0].
+     */
+    float minOverlap = 0.0f;
+}
diff --git a/biometrics/fingerprint/aidl/default/Fingerprint.cpp b/biometrics/fingerprint/aidl/default/Fingerprint.cpp
index be93224..7808a13 100644
--- a/biometrics/fingerprint/aidl/default/Fingerprint.cpp
+++ b/biometrics/fingerprint/aidl/default/Fingerprint.cpp
@@ -90,7 +90,8 @@
              navigationGuesture,
              detectInteraction,
              displayTouch,
-             controlIllumination}};
+             controlIllumination,
+             std::nullopt}};
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/biometrics/fingerprint/aidl/default/Session.cpp b/biometrics/fingerprint/aidl/default/Session.cpp
index 7ab5af3..38d6a13 100644
--- a/biometrics/fingerprint/aidl/default/Session.cpp
+++ b/biometrics/fingerprint/aidl/default/Session.cpp
@@ -289,4 +289,12 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus Session::onPointerCancelWithContext(const PointerContext& /*context*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Session::setIgnoreDisplayTouches(bool /*shouldIgnore*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::biometrics::fingerprint
diff --git a/biometrics/fingerprint/aidl/default/include/Session.h b/biometrics/fingerprint/aidl/default/include/Session.h
index 104d819..b596d9e 100644
--- a/biometrics/fingerprint/aidl/default/include/Session.h
+++ b/biometrics/fingerprint/aidl/default/include/Session.h
@@ -97,6 +97,10 @@
 
     ndk::ScopedAStatus onContextChanged(const common::OperationContext& context) override;
 
+    ndk::ScopedAStatus onPointerCancelWithContext(const PointerContext& context) override;
+
+    ndk::ScopedAStatus setIgnoreDisplayTouches(bool shouldIgnore) override;
+
     bool isClosed();
 
   private:
diff --git a/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp b/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
index 8ea1ddd..9451087 100644
--- a/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
+++ b/bluetooth/1.0/vts/functional/VtsHalBluetoothV1_0TargetTest.cpp
@@ -516,12 +516,15 @@
 // Return the number of completed packets reported by the controller.
 int BluetoothHidlTest::wait_for_completed_packets_event(uint16_t handle) {
   int packets_processed = 0;
-  wait_for_event(false);
-  if (event_queue.size() == 0) {
-    ALOGW("%s: WaitForCallback timed out.", __func__);
-    return packets_processed;
-  }
-  while (event_queue.size() > 0) {
+  while (true) {
+    // There should be at least one event.
+    wait_for_event(packets_processed == 0);
+    if (event_queue.empty()) {
+      if (packets_processed == 0) {
+        ALOGW("%s: WaitForCallback timed out.", __func__);
+      }
+      return packets_processed;
+    }
     hidl_vec<uint8_t> event = event_queue.front();
     event_queue.pop();
 
diff --git a/bluetooth/1.1/vts/functional/VtsHalBluetoothV1_1TargetTest.cpp b/bluetooth/1.1/vts/functional/VtsHalBluetoothV1_1TargetTest.cpp
index 9ae3837..28ac603 100644
--- a/bluetooth/1.1/vts/functional/VtsHalBluetoothV1_1TargetTest.cpp
+++ b/bluetooth/1.1/vts/functional/VtsHalBluetoothV1_1TargetTest.cpp
@@ -539,12 +539,15 @@
 // Return the number of completed packets reported by the controller.
 int BluetoothHidlTest::wait_for_completed_packets_event(uint16_t handle) {
   int packets_processed = 0;
-  wait_for_event(false);
-  if (event_queue.size() == 0) {
-    ALOGW("%s: WaitForCallback timed out.", __func__);
-    return packets_processed;
-  }
-  while (event_queue.size() > 0) {
+  while (true) {
+    // There should be at least one event.
+    wait_for_event(packets_processed == 0);
+    if (event_queue.empty()) {
+      if (packets_processed == 0) {
+        ALOGW("%s: WaitForCallback timed out.", __func__);
+      }
+      return packets_processed;
+    }
     hidl_vec<uint8_t> event = event_queue.front();
     event_queue.pop();
 
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacCapabilities.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacCapabilities.aidl
index 899b8ca..e548cd3 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacCapabilities.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacCapabilities.aidl
@@ -39,4 +39,5 @@
   android.hardware.bluetooth.audio.ChannelMode[] channelMode;
   boolean variableBitRateSupported;
   byte[] bitsPerSample;
+  boolean adaptiveBitRateSupported;
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacConfiguration.aidl
index 6adef6d..29ab8ce 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AacConfiguration.aidl
@@ -39,4 +39,5 @@
   android.hardware.bluetooth.audio.ChannelMode channelMode;
   boolean variableBitRateEnabled;
   byte bitsPerSample;
+  boolean adaptiveBitRateSupported;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl
similarity index 85%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl
index ea86c4f..c9d3cde 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,12 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
+package android.hardware.bluetooth.audio;
 @VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+parcelable AptxAdaptiveLeCapabilities {
+  byte[] pcmBitDepth;
+  int[] samplingFrequencyHz;
+  int[] frameDurationUs;
+  int[] octetsPerFrame;
+  byte[] blocksPerSdu;
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl
similarity index 85%
copy from wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
copy to bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl
index ea86c4f..76df4ed 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,8 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.wifi;
+package android.hardware.bluetooth.audio;
 @VintfStability
-parcelable WifiRadioCombinationMatrix {
-  android.hardware.wifi.WifiRadioCombination[] radioCombinations;
+parcelable AptxAdaptiveLeConfiguration {
+  byte pcmBitDepth;
+  int samplingFrequencyHz;
+  int frameDurationUs;
+  int octetsPerFrame;
+  byte blocksPerSdu;
+  int codecMode;
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
index d1723e6..3e204f9 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecType.aidl
@@ -44,4 +44,6 @@
   VENDOR = 7,
   APTX_ADAPTIVE = 8,
   OPUS = 9,
+  APTX_ADAPTIVE_LE = 10,
+  APTX_ADAPTIVE_LEX = 11,
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
index bb3d7e4..031ee67 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
@@ -36,6 +36,7 @@
 union LeAudioCodecConfiguration {
   android.hardware.bluetooth.audio.Lc3Configuration lc3Config;
   android.hardware.bluetooth.audio.LeAudioCodecConfiguration.VendorConfiguration vendorConfig;
+  android.hardware.bluetooth.audio.AptxAdaptiveLeConfiguration aptxAdaptiveLeConfig;
   @VintfStability
   parcelable VendorConfiguration {
     ParcelableHolder extension;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
index 679655c..2d9ebae 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
@@ -38,6 +38,7 @@
   android.hardware.bluetooth.audio.LeAudioConfiguration.StreamMap[] streamMap;
   int peerDelayUs;
   android.hardware.bluetooth.audio.LeAudioCodecConfiguration leAudioCodecConfig;
+  @nullable byte[] vendorSpecificMetadata;
   @VintfStability
   parcelable StreamMap {
     char streamHandle;
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusCapabilities.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusCapabilities.aidl
index 2781893..2c04b0f 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusCapabilities.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusCapabilities.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusConfiguration.aidl
index 067690e..811d32a 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/OpusConfiguration.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021 The Android Open Source Project
+ * Copyright 2022 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
index 130fef9..894a2f3 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -47,5 +47,6 @@
   union LeAudioCodecCapabilities {
     android.hardware.bluetooth.audio.Lc3Capabilities lc3Capabilities;
     android.hardware.bluetooth.audio.UnicastCapability.VendorCapabilities vendorCapabillities;
+    android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities aptxAdaptiveLeCapabilities;
   }
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacCapabilities.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacCapabilities.aidl
index c4153e9..d7d67de 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacCapabilities.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacCapabilities.aidl
@@ -29,4 +29,5 @@
     ChannelMode[] channelMode;
     boolean variableBitRateSupported;
     byte[] bitsPerSample;
+    boolean adaptiveBitRateSupported;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacConfiguration.aidl
index 30338e7..34998cd 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AacConfiguration.aidl
@@ -29,4 +29,5 @@
     ChannelMode channelMode;
     boolean variableBitRateEnabled;
     byte bitsPerSample;
+    boolean adaptiveBitRateSupported;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl
new file mode 100644
index 0000000..b3fe71c
--- /dev/null
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.bluetooth.audio;
+
+/**
+ * Used for Hardware Encoding/Decoding Aptx Adaptive LE codec capabilities.
+ */
+@VintfStability
+parcelable AptxAdaptiveLeCapabilities {
+    /*
+     * PCM is Input for encoder, Output for decoder
+     */
+    byte[] pcmBitDepth;
+    /*
+     * codec-specific parameters
+     */
+    int[] samplingFrequencyHz;
+    /*
+     * FrameDuration based on microseconds.
+     */
+    int[] frameDurationUs;
+    /*
+     * length in octets of a codec frame
+     */
+    int[] octetsPerFrame;
+    /*
+     * Number of blocks of codec frames per single SDU (Service Data Unit)
+     */
+    byte[] blocksPerSdu;
+}
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl
new file mode 100644
index 0000000..060d5d5
--- /dev/null
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.aidl
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.bluetooth.audio;
+
+/**
+ * Used for Hardware Encoding/Decoding Aptx Adaptive LE/LEX codec configuration.
+ */
+@VintfStability
+parcelable AptxAdaptiveLeConfiguration {
+    /*
+     * PCM is Input for encoder, Output for decoder
+     */
+    byte pcmBitDepth;
+    /*
+     * codec-specific parameters
+     */
+    int samplingFrequencyHz;
+    /*
+     * FrameDuration based on microseconds.
+     */
+    int frameDurationUs;
+    /*
+     * length in octets of a codec frame
+     */
+    int octetsPerFrame;
+    /*
+     * Number of blocks of codec frames per single SDU (Service Data Unit)
+     */
+    byte blocksPerSdu;
+    /*
+     * Currently being used for Aptx Adaptive LEX,
+     * RFU for Aptx Adaptive LE
+     * Based on this value, the codec will determine the quality of stream
+     * during initialization for Music/Game
+     */
+    int codecMode;
+}
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
index 3499155..1d8acdf 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecType.aidl
@@ -29,4 +29,6 @@
     VENDOR,
     APTX_ADAPTIVE,
     OPUS,
+    APTX_ADAPTIVE_LE,
+    APTX_ADAPTIVE_LEX,
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
index 421eeb2..7ce6ff3 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioCodecConfiguration.aidl
@@ -17,6 +17,7 @@
 package android.hardware.bluetooth.audio;
 
 import android.hardware.bluetooth.audio.Lc3Configuration;
+import android.hardware.bluetooth.audio.AptxAdaptiveLeConfiguration;
 
 @VintfStability
 union LeAudioCodecConfiguration {
@@ -26,4 +27,5 @@
     }
     Lc3Configuration lc3Config;
     VendorConfiguration vendorConfig;
+    AptxAdaptiveLeConfiguration aptxAdaptiveLeConfig;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
index f22f309..7302aea 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioConfiguration.aidl
@@ -44,4 +44,16 @@
     StreamMap[] streamMap;
     int peerDelayUs;
     LeAudioCodecConfiguration leAudioCodecConfig;
+
+    /*
+     * Bluetooth LTV format for vendor metadata is defined in the
+     * Section 6.12.6.9 Vendor_Specific of Bluetooth Assigned Numbers
+     *
+     * Octet 0 = Length
+     * Octet 1 = Type (Vendor specific - 0xFF)
+     * Octet 2-3 = Company_ID
+     * Company ID values are defined in Bluetooth Assigned Numbers.
+     * Octet 4 onwards = Vendor specific Metadata
+     */
+    @nullable byte[] vendorSpecificMetadata;
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
index f8a924a..07688a7 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/UnicastCapability.aidl
@@ -19,6 +19,7 @@
 import android.hardware.bluetooth.audio.AudioLocation;
 import android.hardware.bluetooth.audio.CodecType;
 import android.hardware.bluetooth.audio.Lc3Capabilities;
+import android.hardware.bluetooth.audio.AptxAdaptiveLeCapabilities;
 
 /**
  * Used to specify the le audio unicast codec capabilities for hardware offload.
@@ -33,6 +34,7 @@
     union LeAudioCodecCapabilities {
         Lc3Capabilities lc3Capabilities;
         VendorCapabilities vendorCapabillities;
+        AptxAdaptiveLeCapabilities aptxAdaptiveLeCapabilities;
     }
     CodecType codecType;
     AudioLocation supportedChannel;
diff --git a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
index 6a913f7..858fa38 100644
--- a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
+++ b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
@@ -35,6 +35,8 @@
 using aidl::android::hardware::audio::common::SourceMetadata;
 using aidl::android::hardware::bluetooth::audio::AacCapabilities;
 using aidl::android::hardware::bluetooth::audio::AacConfiguration;
+using aidl::android::hardware::bluetooth::audio::AptxAdaptiveLeCapabilities;
+using aidl::android::hardware::bluetooth::audio::AptxAdaptiveLeConfiguration;
 using aidl::android::hardware::bluetooth::audio::AptxCapabilities;
 using aidl::android::hardware::bluetooth::audio::AptxConfiguration;
 using aidl::android::hardware::bluetooth::audio::AudioCapabilities;
@@ -87,10 +89,6 @@
 static constexpr int8_t a2dp_bits_per_samples[] = {0, 16, 24, 32};
 static constexpr ChannelMode a2dp_channel_modes[] = {
     ChannelMode::UNKNOWN, ChannelMode::MONO, ChannelMode::STEREO};
-static constexpr CodecType a2dp_codec_types[] = {
-    CodecType::UNKNOWN, CodecType::SBC,          CodecType::AAC,
-    CodecType::APTX,    CodecType::APTX_HD,      CodecType::LDAC,
-    CodecType::LC3,     CodecType::APTX_ADAPTIVE};
 static std::vector<LatencyMode> latency_modes = {LatencyMode::FREE};
 // Helpers
 
@@ -238,6 +236,8 @@
                         CodecCapabilities::Capabilities::opusCapabilities);
               break;
             case CodecType::APTX_ADAPTIVE:
+            case CodecType::APTX_ADAPTIVE_LE:
+            case CodecType::APTX_ADAPTIVE_LEX:
             case CodecType::LC3:
             case CodecType::VENDOR:
             case CodecType::UNKNOWN:
@@ -387,6 +387,11 @@
       variable_bit_rate_enableds.push_back(true);
     }
 
+    std::vector<bool> adaptive_bit_rate_supporteds = {false};
+    if (aac_capability.adaptiveBitRateSupported) {
+      adaptive_bit_rate_supporteds.push_back(true);
+    }
+
     // combine those parameters into one list of
     // CodecConfiguration::CodecSpecific
     for (auto object_type : aac_capability.objectType) {
@@ -394,14 +399,18 @@
         for (auto channel_mode : aac_capability.channelMode) {
           for (int8_t bits_per_sample : aac_capability.bitsPerSample) {
             for (auto variable_bit_rate_enabled : variable_bit_rate_enableds) {
-              AacConfiguration aac_data{
-                  .objectType = object_type,
-                  .sampleRateHz = sample_rate,
-                  .channelMode = channel_mode,
-                  .variableBitRateEnabled = variable_bit_rate_enabled,
-                  .bitsPerSample = bits_per_sample};
-              aac_codec_specifics.push_back(
-                  CodecConfiguration::CodecSpecific(aac_data));
+              for (auto adaptive_bit_rate_supported :
+                   adaptive_bit_rate_supporteds) {
+                AacConfiguration aac_data{
+                    .objectType = object_type,
+                    .sampleRateHz = sample_rate,
+                    .channelMode = channel_mode,
+                    .variableBitRateEnabled = variable_bit_rate_enabled,
+                    .bitsPerSample = bits_per_sample,
+                    .adaptiveBitRateSupported = adaptive_bit_rate_supported};
+                aac_codec_specifics.push_back(
+                    CodecConfiguration::CodecSpecific(aac_data));
+              }
             }
           }
         }
@@ -845,7 +854,7 @@
   ASSERT_NE(audio_provider_, nullptr);
 
   std::vector<CodecConfiguration::CodecSpecific> codec_specifics;
-  for (auto codec_type : a2dp_codec_types) {
+  for (auto codec_type : ndk::enum_range<CodecType>()) {
     switch (codec_type) {
       case CodecType::SBC:
         codec_specifics = GetSbcCodecSpecificSupportedList(false);
@@ -866,6 +875,8 @@
         codec_specifics = GetOpusCodecSpecificSupportedList(false);
         continue;
       case CodecType::APTX_ADAPTIVE:
+      case CodecType::APTX_ADAPTIVE_LE:
+      case CodecType::APTX_ADAPTIVE_LEX:
       case CodecType::LC3:
       case CodecType::VENDOR:
       case CodecType::UNKNOWN:
@@ -1192,6 +1203,73 @@
     return le_audio_codec_configs;
   }
 
+  static constexpr int32_t apx_adaptive_le_config_codec_modes[] = {0, 1, 2, 3};
+
+  std::vector<AptxAdaptiveLeConfiguration>
+  GetUnicastAptxAdaptiveLeSupportedList(bool decoding, bool supported,
+                                        bool is_le_extended) {
+    std::vector<AptxAdaptiveLeConfiguration> le_audio_codec_configs;
+    if (!supported) {
+      AptxAdaptiveLeConfiguration aptx_adaptive_le_config{
+          .pcmBitDepth = 0, .samplingFrequencyHz = 0};
+      le_audio_codec_configs.push_back(aptx_adaptive_le_config);
+      return le_audio_codec_configs;
+    }
+
+    // There might be more than one LeAudioCodecCapabilitiesSetting
+    std::vector<AptxAdaptiveLeCapabilities> aptx_adaptive_le_capabilities;
+    for (auto& capability : temp_provider_capabilities_) {
+      if (capability.getTag() != AudioCapabilities::leAudioCapabilities) {
+        continue;
+      }
+      auto& le_audio_capability =
+          capability.get<AudioCapabilities::leAudioCapabilities>();
+      auto& unicast_capability =
+          decoding ? le_audio_capability.unicastDecodeCapability
+                   : le_audio_capability.unicastEncodeCapability;
+      if ((!is_le_extended &&
+           unicast_capability.codecType != CodecType::APTX_ADAPTIVE_LE) ||
+          (is_le_extended &&
+           unicast_capability.codecType != CodecType::APTX_ADAPTIVE_LEX)) {
+        continue;
+      }
+
+      auto& aptx_adaptive_le_capability =
+          unicast_capability.leAudioCodecCapabilities
+              .get<UnicastCapability::LeAudioCodecCapabilities::
+                       aptxAdaptiveLeCapabilities>();
+
+      aptx_adaptive_le_capabilities.push_back(aptx_adaptive_le_capability);
+    }
+
+    for (auto& aptx_adaptive_le_capability : aptx_adaptive_le_capabilities) {
+      for (int32_t samplingFrequencyHz :
+           aptx_adaptive_le_capability.samplingFrequencyHz) {
+        for (int32_t frameDurationUs :
+             aptx_adaptive_le_capability.frameDurationUs) {
+          for (int32_t octetsPerFrame :
+               aptx_adaptive_le_capability.octetsPerFrame) {
+            for (int8_t blocksPerSdu :
+                 aptx_adaptive_le_capability.blocksPerSdu) {
+              for (int32_t codecMode : apx_adaptive_le_config_codec_modes) {
+                AptxAdaptiveLeConfiguration aptx_adaptive_le_config = {
+                    .samplingFrequencyHz = samplingFrequencyHz,
+                    .frameDurationUs = frameDurationUs,
+                    .octetsPerFrame = octetsPerFrame,
+                    .blocksPerSdu = blocksPerSdu,
+                    .codecMode = codecMode,
+                };
+                le_audio_codec_configs.push_back(aptx_adaptive_le_config);
+              }
+            }
+          }
+        }
+      }
+    }
+
+    return le_audio_codec_configs;
+  }
+
   LeAudioCodecCapabilitiesSetting temp_le_audio_capabilities_;
 };
 
@@ -1268,6 +1346,87 @@
   }
 }
 
+static std::vector<uint8_t> vendorMetadata = {0x0B,  // Length
+                                              0xFF,  // Type: Vendor-specific
+                                              0x0A, 0x00,  // Company_ID
+                                              0x01, 0x02, 0x03, 0x04,  // Data
+                                              0x05, 0x06, 0x07, 0x08};
+
+/**
+ * Test whether each provider of type
+ * SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH can be started and
+ * stopped with Unicast hardware encoding config
+ */
+TEST_P(BluetoothAudioProviderLeAudioOutputHardwareAidl,
+       StartAndEndLeAudioOutputSessionWithAptxAdaptiveLeUnicastConfig) {
+  if (!IsOffloadOutputSupported()) {
+    return;
+  }
+  for (auto codec_type :
+       {CodecType::APTX_ADAPTIVE_LE, CodecType::APTX_ADAPTIVE_LEX}) {
+    bool is_le_extended = (codec_type == CodecType::APTX_ADAPTIVE_LEX);
+    auto aptx_adaptive_le_codec_configs =
+        GetUnicastAptxAdaptiveLeSupportedList(false, true, is_le_extended);
+    LeAudioConfiguration le_audio_config = {
+        .codecType = codec_type,
+        .peerDelayUs = 0,
+        .vendorSpecificMetadata = vendorMetadata,
+    };
+
+    for (auto& aptx_adaptive_le_config : aptx_adaptive_le_codec_configs) {
+      le_audio_config.leAudioCodecConfig
+          .set<LeAudioCodecConfiguration::aptxAdaptiveLeConfig>(
+              aptx_adaptive_le_config);
+      DataMQDesc mq_desc;
+      auto aidl_retval = audio_provider_->startSession(
+          audio_port_, AudioConfiguration(le_audio_config), latency_modes,
+          &mq_desc);
+
+      ASSERT_TRUE(aidl_retval.isOk());
+      EXPECT_TRUE(audio_provider_->endSession().isOk());
+    }
+  }
+}
+
+/**
+ * Test whether each provider of type
+ * SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH can be started and
+ * stopped with Unicast hardware encoding config
+ */
+TEST_P(
+    BluetoothAudioProviderLeAudioOutputHardwareAidl,
+    BluetoothAudioProviderLeAudioOutputHardwareAidl_StartAndEndLeAudioOutputSessionWithInvalidAptxAdaptiveLeAudioConfiguration) {
+  if (!IsOffloadOutputSupported()) {
+    return;
+  }
+
+  for (auto codec_type :
+       {CodecType::APTX_ADAPTIVE_LE, CodecType::APTX_ADAPTIVE_LEX}) {
+    bool is_le_extended = (codec_type == CodecType::APTX_ADAPTIVE_LEX);
+    auto aptx_adaptive_le_codec_configs =
+        GetUnicastAptxAdaptiveLeSupportedList(false, true, is_le_extended);
+    LeAudioConfiguration le_audio_config = {
+        .codecType = codec_type,
+        .peerDelayUs = 0,
+        .vendorSpecificMetadata = vendorMetadata,
+    };
+
+    for (auto& aptx_adaptive_le_config : aptx_adaptive_le_codec_configs) {
+      le_audio_config.leAudioCodecConfig
+          .set<LeAudioCodecConfiguration::aptxAdaptiveLeConfig>(
+              aptx_adaptive_le_config);
+      DataMQDesc mq_desc;
+      auto aidl_retval = audio_provider_->startSession(
+          audio_port_, AudioConfiguration(le_audio_config), latency_modes,
+          &mq_desc);
+
+      // AIDL call should fail on invalid codec
+      ASSERT_FALSE(aidl_retval.isOk());
+      EXPECT_TRUE(audio_provider_->endSession().isOk());
+    }
+  }
+}
+
 /**
  * openProvider LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH
  */
@@ -1877,7 +2036,7 @@
   ASSERT_NE(audio_provider_, nullptr);
 
   std::vector<CodecConfiguration::CodecSpecific> codec_specifics;
-  for (auto codec_type : a2dp_codec_types) {
+  for (auto codec_type : ndk::enum_range<CodecType>()) {
     switch (codec_type) {
       case CodecType::SBC:
         codec_specifics = GetSbcCodecSpecificSupportedList(false);
@@ -1898,6 +2057,8 @@
         codec_specifics = GetOpusCodecSpecificSupportedList(false);
         continue;
       case CodecType::APTX_ADAPTIVE:
+      case CodecType::APTX_ADAPTIVE_LE:
+      case CodecType::APTX_ADAPTIVE_LEX:
       case CodecType::LC3:
       case CodecType::VENDOR:
       case CodecType::UNKNOWN:
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
index faebbbf..3ed9e07 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
@@ -20,6 +20,8 @@
 
 #include <aidl/android/hardware/bluetooth/audio/AacCapabilities.h>
 #include <aidl/android/hardware/bluetooth/audio/AacObjectType.h>
+#include <aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeCapabilities.h>
+#include <aidl/android/hardware/bluetooth/audio/AptxAdaptiveLeConfiguration.h>
 #include <aidl/android/hardware/bluetooth/audio/AptxCapabilities.h>
 #include <aidl/android/hardware/bluetooth/audio/ChannelMode.h>
 #include <aidl/android/hardware/bluetooth/audio/LdacCapabilities.h>
@@ -98,6 +100,55 @@
 
 std::vector<LeAudioCodecCapabilitiesSetting> kDefaultOffloadLeAudioCapabilities;
 
+static const UnicastCapability kInvalidUnicastCapability = {
+    .codecType = CodecType::UNKNOWN};
+
+static const AptxAdaptiveLeCapabilities
+    kDefaultOffloadAptxAdaptiveLeCapability_48k = {
+        .samplingFrequencyHz = {48000},
+        .frameDurationUs = {10000},
+        .octetsPerFrame = {816}};
+
+static const AptxAdaptiveLeCapabilities
+    kDefaultOffloadAptxAdaptiveLeCapability_96k = {
+        .samplingFrequencyHz = {96000},
+        .frameDurationUs = {10000},
+        .octetsPerFrame = {816}};
+
+static const AptxAdaptiveLeCapabilities
+    kDefaultOffloadAptxAdaptiveLeXCapability_48k = {
+        .samplingFrequencyHz = {48000},
+        .frameDurationUs = {10000},
+        .octetsPerFrame = {816}};
+
+static const AptxAdaptiveLeCapabilities
+    kDefaultOffloadAptxAdaptiveLeXCapability_96k = {
+        .samplingFrequencyHz = {96000},
+        .frameDurationUs = {10000},
+        .octetsPerFrame = {816}};
+
+static const BroadcastCapability kInvalidBroadcastCapability = {
+    .codecType = CodecType::UNKNOWN};
+
+static AudioLocation stereoAudio = static_cast<AudioLocation>(
+    static_cast<uint8_t>(AudioLocation::FRONT_LEFT) |
+    static_cast<uint8_t>(AudioLocation::FRONT_RIGHT));
+
+static const std::vector<AptxAdaptiveLeCapabilities>
+    supportedAptxAdaptiveLeCapabilityList = {
+        kDefaultOffloadAptxAdaptiveLeCapability_48k,
+        kDefaultOffloadAptxAdaptiveLeCapability_96k,
+        kDefaultOffloadAptxAdaptiveLeXCapability_48k,
+        kDefaultOffloadAptxAdaptiveLeXCapability_96k};
+
+// Stores the supported setting of audio location, connected device, and the
+// channel count for each device
+std::vector<std::tuple<AudioLocation, uint8_t, uint8_t>>
+    supportedDeviceSetting = {
+        // Stereo, one connected device for both L and R
+        std::make_tuple(stereoAudio, 1, 2),
+};
+
 template <class T>
 bool BluetoothAudioCodecs::ContainedInVector(
     const std::vector<T>& vector, const typename identity<T>::type& target) {
@@ -312,6 +363,8 @@
       case CodecType::VENDOR:
       case CodecType::LC3:
       case CodecType::APTX_ADAPTIVE:
+      case CodecType::APTX_ADAPTIVE_LE:
+      case CodecType::APTX_ADAPTIVE_LEX:
         break;
     }
   }
@@ -377,6 +430,8 @@
       }
       break;
     case CodecType::APTX_ADAPTIVE:
+    case CodecType::APTX_ADAPTIVE_LE:
+    case CodecType::APTX_ADAPTIVE_LEX:
     case CodecType::LC3:
     case CodecType::UNKNOWN:
     case CodecType::VENDOR:
@@ -403,8 +458,33 @@
     kDefaultOffloadLeAudioCapabilities =
         BluetoothLeAudioCodecsProvider::GetLeAudioCodecCapabilities(
             le_audio_offload_setting);
-  }
 
+    for (auto [audioLocation, deviceCnt, channelCount] :
+         supportedDeviceSetting) {
+      for (auto capability : supportedAptxAdaptiveLeCapabilityList) {
+        for (auto codec_type :
+             {CodecType::APTX_ADAPTIVE_LE, CodecType::APTX_ADAPTIVE_LEX}) {
+          if (session_type ==
+              SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
+            UnicastCapability aptx_adaptive_le_cap = {
+                .codecType = codec_type,
+                .supportedChannel = audioLocation,
+                .deviceCount = deviceCnt,
+                .channelCountPerDevice = channelCount,
+                .leAudioCodecCapabilities =
+                    UnicastCapability::LeAudioCodecCapabilities(capability),
+            };
+
+            // Adds the capability for encode only
+            kDefaultOffloadLeAudioCapabilities.push_back(
+                {.unicastEncodeCapability = aptx_adaptive_le_cap,
+                 .unicastDecodeCapability = kInvalidUnicastCapability,
+                 .broadcastCapability = kInvalidBroadcastCapability});
+          }
+        }
+      }
+    }
+  }
   return kDefaultOffloadLeAudioCapabilities;
 }
 
diff --git a/camera/device/3.2/types.hal b/camera/device/3.2/types.hal
index 276e92a..3989161 100644
--- a/camera/device/3.2/types.hal
+++ b/camera/device/3.2/types.hal
@@ -346,15 +346,18 @@
      * An override pixel format for the buffers in this stream.
      *
      * The HAL must respect the requested format in Stream unless it is
-     * IMPLEMENTATION_DEFINED, in which case the override format here must be
-     * used by the client instead, for this stream. This allows cross-platform
-     * HALs to use a standard format since IMPLEMENTATION_DEFINED formats often
-     * require device-specific information. In all other cases, the
+     * IMPLEMENTATION_DEFINED output, in which case the override format
+     * here must be used by the client instead, for this stream. This allows
+     * cross-platform HALs to use a standard format since IMPLEMENTATION_DEFINED
+     * formats often require device-specific information. In all other cases, the
      * overrideFormat must match the requested format.
      *
      * When HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED is used, then the platform
      * gralloc module must select a format based on the usage flags provided by
      * the camera device and the other endpoint of the stream.
+     *
+     * For private reprocessing, the HAL must not override the input stream's
+     * IMPLEMENTATION_DEFINED format.
      */
     android.hardware.graphics.common@1.0::PixelFormat overrideFormat;
 
diff --git a/camera/device/aidl/android/hardware/camera/device/HalStream.aidl b/camera/device/aidl/android/hardware/camera/device/HalStream.aidl
index b8ec3de..25a80bc 100644
--- a/camera/device/aidl/android/hardware/camera/device/HalStream.aidl
+++ b/camera/device/aidl/android/hardware/camera/device/HalStream.aidl
@@ -38,7 +38,7 @@
      * An override pixel format for the buffers in this stream.
      *
      * The HAL must respect the requested format in Stream unless it is
-     * IMPLEMENTATION_DEFINED, in which case the override format here must be
+     * IMPLEMENTATION_DEFINED output, in which case the override format here must be
      * used by the client instead, for this stream. This allows cross-platform
      * HALs to use a standard format since IMPLEMENTATION_DEFINED formats often
      * require device-specific information. In all other cases, the
@@ -47,6 +47,9 @@
      * When HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED is used, then the platform
      * gralloc module must select a format based on the usage flags provided by
      * the camera device and the other endpoint of the stream.
+     *
+     * For private reprocessing, the HAL must not override the input stream's
+     * IMPLEMENTATION_DEFINED format.
      */
     android.hardware.graphics.common.PixelFormat overrideFormat;
 
diff --git a/camera/provider/aidl/vts/camera_aidl_test.cpp b/camera/provider/aidl/vts/camera_aidl_test.cpp
index d28ee0f..64507fe 100644
--- a/camera/provider/aidl/vts/camera_aidl_test.cpp
+++ b/camera/provider/aidl/vts/camera_aidl_test.cpp
@@ -2524,6 +2524,7 @@
         request.fmqSettingsSize = 0;
         request.settings.metadata =
                 std::vector(rawMetadata, rawMetadata + get_camera_metadata_size(releasedMetadata));
+        overrideRotateAndCrop(&request.settings);
         request.outputBuffers = std::vector<StreamBuffer>(1);
         StreamBuffer& outputBuffer = request.outputBuffers[0];
         if (useHalBufManager) {
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index e1ad1f3..622835e 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -78,7 +78,7 @@
         "compatibility_matrix.8.xml",
     ],
     kernel_configs: [
-        "kernel_config_current_5.10",
         "kernel_config_current_5.15",
+        "kernel_config_current_6.1",
     ],
 }
diff --git a/compatibility_matrices/compatibility_matrix.7.xml b/compatibility_matrices/compatibility_matrix.7.xml
index 5694945..67dd717 100644
--- a/compatibility_matrices/compatibility_matrix.7.xml
+++ b/compatibility_matrices/compatibility_matrix.7.xml
@@ -400,14 +400,6 @@
         </interface>
     </hal>
     <hal format="aidl" optional="true">
-        <name>android.hardware.security.dice</name>
-        <version>1</version>
-        <interface>
-            <name>IDiceDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="aidl" optional="true">
         <name>android.hardware.security.keymint</name>
         <version>1-2</version>
         <interface>
diff --git a/compatibility_matrices/compatibility_matrix.8.xml b/compatibility_matrices/compatibility_matrix.8.xml
index 1b0b496..d4fca6a 100644
--- a/compatibility_matrices/compatibility_matrix.8.xml
+++ b/compatibility_matrices/compatibility_matrix.8.xml
@@ -338,14 +338,6 @@
         </interface>
     </hal>
     <hal format="aidl" optional="true">
-        <name>android.hardware.security.dice</name>
-        <version>1</version>
-        <interface>
-            <name>IDiceDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="aidl" optional="true">
         <name>android.hardware.security.keymint</name>
         <version>1-3</version>
         <interface>
diff --git a/confirmationui/1.0/default/OWNERS b/confirmationui/1.0/default/OWNERS
index 335660d..17aed51 100644
--- a/confirmationui/1.0/default/OWNERS
+++ b/confirmationui/1.0/default/OWNERS
@@ -1,2 +1,3 @@
+# Bug component: 1124672
 jdanis@google.com
 swillden@google.com
diff --git a/confirmationui/1.0/vts/OWNERS b/confirmationui/1.0/vts/OWNERS
index e7aa8b4..aa07242 100644
--- a/confirmationui/1.0/vts/OWNERS
+++ b/confirmationui/1.0/vts/OWNERS
@@ -1,3 +1,4 @@
+# Bug component: 1124672
 jdanis@google.com
 swillden@google.com
 yim@google.com
diff --git a/confirmationui/OWNERS b/confirmationui/OWNERS
index 2bcdb0e..d3896df 100644
--- a/confirmationui/OWNERS
+++ b/confirmationui/OWNERS
@@ -1,2 +1,3 @@
+# Bug component: 1124672
 swillden@google.com
 subrahmanyaman@google.com
diff --git a/confirmationui/support/OWNERS b/confirmationui/support/OWNERS
index 335660d..17aed51 100644
--- a/confirmationui/support/OWNERS
+++ b/confirmationui/support/OWNERS
@@ -1,2 +1,3 @@
+# Bug component: 1124672
 jdanis@google.com
 swillden@google.com
diff --git a/current.txt b/current.txt
index ef1f65a..c40f9ea 100644
--- a/current.txt
+++ b/current.txt
@@ -934,5 +934,7 @@
 42abd285a4293dadb8c89bc63b90cae2872fbffe90c4517aa3ea4965e8aecff7 android.hardware.graphics.common@1.2::types
 4f1a02d21a22104c734f71cdbba19b6f7e93d4ee107ff79f0dbdd171a8430e0e android.hardware.automotive.vehicle@2.0::types
 a2fbd9747fbb9ceb8c1090b5a24138312246502d5af0654a8c2b603a9bf521fc android.hardware.gnss@1.0::IGnssCallback
+889b59e3e7a59afa67bf19882a44f51a2f9e43b6556ec52baa9ec3efd1ef7fbe android.hardware.camera.device@3.2::types
+db37a1c757e2e69b1ec9c75a981a6987bd87a131d92ab6acc00e04d19f374281 android.hardware.automotive.vehicle@2.0::types
 
 # There will be no more HIDL HALs. Use AIDL instead.
diff --git a/gatekeeper/1.0/default/OWNERS b/gatekeeper/1.0/default/OWNERS
index 335660d..c97fba6 100644
--- a/gatekeeper/1.0/default/OWNERS
+++ b/gatekeeper/1.0/default/OWNERS
@@ -1,2 +1,3 @@
+# Bug component: 1124862
 jdanis@google.com
 swillden@google.com
diff --git a/gatekeeper/1.0/software/OWNERS b/gatekeeper/1.0/software/OWNERS
index 335660d..c97fba6 100644
--- a/gatekeeper/1.0/software/OWNERS
+++ b/gatekeeper/1.0/software/OWNERS
@@ -1,2 +1,3 @@
+# Bug component: 1124862
 jdanis@google.com
 swillden@google.com
diff --git a/graphics/composer/aidl/vts/GraphicsComposerCallback.cpp b/graphics/composer/aidl/vts/GraphicsComposerCallback.cpp
index 4fb5d01..7b3a2b4 100644
--- a/graphics/composer/aidl/vts/GraphicsComposerCallback.cpp
+++ b/graphics/composer/aidl/vts/GraphicsComposerCallback.cpp
@@ -29,6 +29,11 @@
     mVsyncAllowed = allowed;
 }
 
+void GraphicsComposerCallback::setRefreshRateChangedDebugDataEnabledCallbackAllowed(bool allowed) {
+    std::scoped_lock lock(mMutex);
+    mRefreshRateChangedDebugDataEnabledCallbackAllowed = allowed;
+}
+
 std::vector<int64_t> GraphicsComposerCallback::getDisplays() const {
     std::scoped_lock lock(mMutex);
     return mDisplays;
@@ -79,6 +84,21 @@
     return ret;
 }
 
+std::vector<RefreshRateChangedDebugData>
+GraphicsComposerCallback::takeListOfRefreshRateChangedDebugData() {
+    std::scoped_lock lock(mMutex);
+
+    std::vector<RefreshRateChangedDebugData> ret;
+    ret.swap(mRefreshRateChangedDebugData);
+
+    return ret;
+}
+
+int32_t GraphicsComposerCallback::getInvalidRefreshRateDebugEnabledCallbackCount() const {
+    std::scoped_lock lock(mMutex);
+    return mInvalidRefreshRateDebugEnabledCallbackCount;
+}
+
 ::ndk::ScopedAStatus GraphicsComposerCallback::onHotplug(int64_t in_display, bool in_connected) {
     std::scoped_lock lock(mMutex);
 
@@ -125,9 +145,16 @@
 }
 
 ::ndk::ScopedAStatus GraphicsComposerCallback::onRefreshRateChangedDebug(
-        const RefreshRateChangedDebugData&) {
-    // TODO(b/202734676) Add implementation for Vts tests
-    return ::ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+        const RefreshRateChangedDebugData& data) {
+    std::scoped_lock lock(mMutex);
+
+    const auto it = std::find(mDisplays.begin(), mDisplays.end(), data.display);
+    if (mRefreshRateChangedDebugDataEnabledCallbackAllowed && it != mDisplays.end()) {
+        mRefreshRateChangedDebugData.push_back(data);
+    } else {
+        mInvalidRefreshRateDebugEnabledCallbackCount++;
+    }
+    return ::ndk::ScopedAStatus::ok();
 }
 
 ::ndk::ScopedAStatus GraphicsComposerCallback::onVsyncPeriodTimingChanged(
diff --git a/graphics/composer/aidl/vts/GraphicsComposerCallback.h b/graphics/composer/aidl/vts/GraphicsComposerCallback.h
index 9c3bc70..13e992a 100644
--- a/graphics/composer/aidl/vts/GraphicsComposerCallback.h
+++ b/graphics/composer/aidl/vts/GraphicsComposerCallback.h
@@ -26,6 +26,8 @@
   public:
     void setVsyncAllowed(bool allowed);
 
+    void setRefreshRateChangedDebugDataEnabledCallbackAllowed(bool allowed);
+
     std::vector<int64_t> getDisplays() const;
 
     int32_t getInvalidHotplugCount() const;
@@ -44,6 +46,10 @@
 
     std::optional<VsyncPeriodChangeTimeline> takeLastVsyncPeriodChangeTimeline();
 
+    std::vector<RefreshRateChangedDebugData> takeListOfRefreshRateChangedDebugData();
+
+    int32_t getInvalidRefreshRateDebugEnabledCallbackCount() const;
+
   private:
     virtual ::ndk::ScopedAStatus onHotplug(int64_t in_display, bool in_connected) override;
     virtual ::ndk::ScopedAStatus onRefresh(int64_t in_display) override;
@@ -63,9 +69,13 @@
     std::vector<int64_t> mDisplays GUARDED_BY(mMutex);
     // true only when vsync is enabled
     bool mVsyncAllowed GUARDED_BY(mMutex) = true;
+    // true only when RefreshRateChangedCallbackDebugEnabled is set to true.
+    bool mRefreshRateChangedDebugDataEnabledCallbackAllowed GUARDED_BY(mMutex) = false;
 
     std::optional<VsyncPeriodChangeTimeline> mTimeline GUARDED_BY(mMutex);
 
+    std::vector<RefreshRateChangedDebugData> mRefreshRateChangedDebugData GUARDED_BY(mMutex);
+
     int32_t mVsyncIdleCount GUARDED_BY(mMutex) = 0;
     int64_t mVsyncIdleTime GUARDED_BY(mMutex) = 0;
 
@@ -75,6 +85,7 @@
     int32_t mInvalidVsyncCount GUARDED_BY(mMutex) = 0;
     int32_t mInvalidVsyncPeriodChangeCount GUARDED_BY(mMutex) = 0;
     int32_t mInvalidSeamlessPossibleCount GUARDED_BY(mMutex) = 0;
+    int32_t mInvalidRefreshRateDebugEnabledCallbackCount GUARDED_BY(mMutex) = 0;
 };
 
 }  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/vts/VtsComposerClient.cpp b/graphics/composer/aidl/vts/VtsComposerClient.cpp
index e03ef25..25b0ca0 100644
--- a/graphics/composer/aidl/vts/VtsComposerClient.cpp
+++ b/graphics/composer/aidl/vts/VtsComposerClient.cpp
@@ -119,6 +119,24 @@
     return updateDisplayProperties(vtsDisplay, config);
 }
 
+ScopedAStatus VtsComposerClient::setPeakRefreshRateConfig(VtsDisplay* vtsDisplay) {
+    const auto displayId = vtsDisplay->getDisplayId();
+    auto [activeStatus, activeConfig] = getActiveConfig(displayId);
+    EXPECT_TRUE(activeStatus.isOk());
+    auto peakDisplayConfig = vtsDisplay->getDisplayConfig(activeConfig);
+    auto peakConfig = activeConfig;
+
+    const auto displayConfigs = vtsDisplay->getDisplayConfigs();
+    for (const auto [config, displayConfig] : displayConfigs) {
+        if (displayConfig.configGroup == peakDisplayConfig.configGroup &&
+            displayConfig.vsyncPeriod < peakDisplayConfig.vsyncPeriod) {
+            peakDisplayConfig = displayConfig;
+            peakConfig = config;
+        }
+    }
+    return setActiveConfig(vtsDisplay, peakConfig);
+}
+
 std::pair<ScopedAStatus, int32_t> VtsComposerClient::getDisplayAttribute(
         int64_t display, int32_t config, DisplayAttribute displayAttribute) {
     int32_t outDisplayAttribute;
@@ -375,10 +393,15 @@
     return mComposerCallback->getVsyncIdleTime();
 }
 
-ndk::ScopedAStatus VtsComposerClient::setRefreshRateChangedCallbackDebugEnabled(
-        int64_t /* display */, bool /* enabled */) {
-    // TODO(b/202734676) Add implementation for VTS tests
-    return ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+ndk::ScopedAStatus VtsComposerClient::setRefreshRateChangedCallbackDebugEnabled(int64_t display,
+                                                                                bool enabled) {
+    mComposerCallback->setRefreshRateChangedDebugDataEnabledCallbackAllowed(enabled);
+    return mComposerClient->setRefreshRateChangedCallbackDebugEnabled(display, enabled);
+}
+
+std::vector<RefreshRateChangedDebugData>
+VtsComposerClient::takeListOfRefreshRateChangedDebugData() {
+    return mComposerCallback->takeListOfRefreshRateChangedDebugData();
 }
 
 int64_t VtsComposerClient::getInvalidDisplayId() {
@@ -545,6 +568,10 @@
             ALOGE("Invalid seamless possible count");
             isValid = false;
         }
+        if (mComposerCallback->getInvalidRefreshRateDebugEnabledCallbackCount() != 0) {
+            ALOGE("Invalid refresh rate debug enabled callback count");
+            isValid = false;
+        }
     }
     return isValid;
 }
diff --git a/graphics/composer/aidl/vts/VtsComposerClient.h b/graphics/composer/aidl/vts/VtsComposerClient.h
index 81a62b3..ea3318c 100644
--- a/graphics/composer/aidl/vts/VtsComposerClient.h
+++ b/graphics/composer/aidl/vts/VtsComposerClient.h
@@ -77,6 +77,8 @@
 
     ScopedAStatus setActiveConfig(VtsDisplay* vtsDisplay, int32_t config);
 
+    ScopedAStatus setPeakRefreshRateConfig(VtsDisplay* vtsDisplay);
+
     std::pair<ScopedAStatus, int32_t> getDisplayAttribute(int64_t display, int32_t config,
                                                           DisplayAttribute displayAttribute);
 
@@ -183,6 +185,10 @@
 
     std::pair<ScopedAStatus, OverlayProperties> getOverlaySupport();
 
+    ndk::ScopedAStatus setRefreshRateChangedCallbackDebugEnabled(int64_t display, bool enabled);
+
+    std::vector<RefreshRateChangedDebugData> takeListOfRefreshRateChangedDebugData();
+
   private:
     ScopedAStatus addDisplayConfig(VtsDisplay* vtsDisplay, int32_t config);
     ScopedAStatus updateDisplayProperties(VtsDisplay* vtsDisplay, int32_t config);
@@ -197,9 +203,6 @@
 
     bool verifyComposerCallbackParams();
 
-    ndk::ScopedAStatus setRefreshRateChangedCallbackDebugEnabled(int64_t /* display */,
-                                                                 bool /* enabled */);
-
     // Keep track of displays and layers. When a test fails/ends,
     // the VtsComposerClient::tearDown should be called from the
     // test tearDown to clean up the resources for the test.
@@ -245,15 +248,17 @@
     };
 
     void addDisplayConfig(int32_t config, DisplayConfig displayConfig) {
-        displayConfigs.insert({config, displayConfig});
+        mDisplayConfigs.insert({config, displayConfig});
     }
 
-    DisplayConfig getDisplayConfig(int32_t config) { return displayConfigs.find(config)->second; }
+    DisplayConfig getDisplayConfig(int32_t config) { return mDisplayConfigs.find(config)->second; }
+
+    std::unordered_map<int32_t, DisplayConfig> getDisplayConfigs() { return mDisplayConfigs; }
 
   private:
     int64_t mDisplayId;
     int32_t mDisplayWidth;
     int32_t mDisplayHeight;
-    std::unordered_map<int32_t, DisplayConfig> displayConfigs;
+    std::unordered_map<int32_t, DisplayConfig> mDisplayConfigs;
 };
 }  // namespace aidl::android::hardware::graphics::composer3::vts
diff --git a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
index 70c4e4c..37576b9 100644
--- a/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
+++ b/graphics/composer/aidl/vts/VtsHalGraphicsComposer3_TargetTest.cpp
@@ -874,6 +874,13 @@
 }
 
 TEST_P(GraphicsComposerAidlTest, GetOverlaySupport) {
+    const auto& [versionStatus, version] = mComposerClient->getInterfaceVersion();
+    ASSERT_TRUE(versionStatus.isOk());
+    if (version == 1) {
+        GTEST_SUCCEED() << "Device does not support the new API for overlay support";
+        return;
+    }
+
     const auto& [status, properties] = mComposerClient->getOverlaySupport();
     if (!status.isOk() && status.getExceptionCode() == EX_SERVICE_SPECIFIC &&
         status.getServiceSpecificError() == IComposerClient::EX_UNSUPPORTED) {
@@ -1210,6 +1217,14 @@
         }
     }
 
+    bool checkIfCallbackRefreshRateChangedDebugEnabledReceived(
+            std::function<bool(RefreshRateChangedDebugData)> filter) {
+        const auto list = mComposerClient->takeListOfRefreshRateChangedDebugData();
+        return std::any_of(list.begin(), list.end(), [&](auto refreshRateChangedDebugData) {
+            return filter(refreshRateChangedDebugData);
+        });
+    }
+
     sp<GraphicBuffer> allocate(::android::PixelFormat pixelFormat) {
         return sp<GraphicBuffer>::make(
                 static_cast<uint32_t>(getPrimaryDisplay().getDisplayWidth()),
@@ -1309,7 +1324,7 @@
         return vsyncPeriod;
     }
 
-    int64_t createOnScreenLayer() {
+    int64_t createOnScreenLayer(Composition composition = Composition::DEVICE) {
         const auto& [status, layer] =
                 mComposerClient->createLayer(getPrimaryDisplayId(), kBufferSlotCount);
         EXPECT_TRUE(status.isOk());
@@ -1317,12 +1332,25 @@
                           getPrimaryDisplay().getDisplayHeight()};
         FRect cropRect{0, 0, (float)getPrimaryDisplay().getDisplayWidth(),
                        (float)getPrimaryDisplay().getDisplayHeight()};
-        configureLayer(getPrimaryDisplay(), layer, Composition::DEVICE, displayFrame, cropRect);
+        configureLayer(getPrimaryDisplay(), layer, composition, displayFrame, cropRect);
         auto& writer = getWriter(getPrimaryDisplayId());
         writer.setLayerDataspace(getPrimaryDisplayId(), layer, common::Dataspace::UNKNOWN);
         return layer;
     }
 
+    void sendBufferUpdate(int64_t layer) {
+        const auto buffer = allocate(::android::PIXEL_FORMAT_RGBA_8888);
+        ASSERT_NE(nullptr, buffer->handle);
+
+        auto& writer = getWriter(getPrimaryDisplayId());
+        writer.setLayerBuffer(getPrimaryDisplayId(), layer, /*slot*/ 0, buffer->handle,
+                              /*acquireFence*/ -1);
+
+        const sp<::android::Fence> presentFence =
+                presentAndGetFence(ComposerClientWriter::kNoTimestamp);
+        presentFence->waitForever(LOG_TAG);
+    }
+
     bool hasDisplayCapability(int64_t display, DisplayCapability cap) {
         const auto& [status, capabilities] = mComposerClient->getDisplayCapabilities(display);
         EXPECT_TRUE(status.isOk());
@@ -2261,6 +2289,179 @@
     EXPECT_TRUE(mComposerClient->setPowerMode(getPrimaryDisplayId(), PowerMode::OFF).isOk());
 }
 
+TEST_P(GraphicsComposerAidlCommandTest, SetRefreshRateChangedCallbackDebug_Unsupported) {
+    if (!hasCapability(Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG)) {
+        auto status = mComposerClient->setRefreshRateChangedCallbackDebugEnabled(
+                getPrimaryDisplayId(), /*enabled*/ true);
+        EXPECT_FALSE(status.isOk());
+        EXPECT_NO_FATAL_FAILURE(
+                assertServiceSpecificError(status, IComposerClient::EX_UNSUPPORTED));
+
+        status = mComposerClient->setRefreshRateChangedCallbackDebugEnabled(getPrimaryDisplayId(),
+                                                                            /*enabled*/ false);
+        EXPECT_FALSE(status.isOk());
+        EXPECT_NO_FATAL_FAILURE(
+                assertServiceSpecificError(status, IComposerClient::EX_UNSUPPORTED));
+    }
+}
+
+TEST_P(GraphicsComposerAidlCommandTest, SetRefreshRateChangedCallbackDebug_Enabled) {
+    if (!hasCapability(Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG)) {
+        GTEST_SUCCEED() << "Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG is not supported";
+        return;
+    }
+
+    const auto displayId = getPrimaryDisplayId();
+    EXPECT_TRUE(mComposerClient->setPowerMode(displayId, PowerMode::ON).isOk());
+    // Enable the callback
+    ASSERT_TRUE(mComposerClient
+                        ->setRefreshRateChangedCallbackDebugEnabled(displayId,
+                                                                    /*enabled*/ true)
+                        .isOk());
+    std::this_thread::sleep_for(100ms);
+
+    const bool isCallbackReceived = checkIfCallbackRefreshRateChangedDebugEnabledReceived(
+            [&](auto refreshRateChangedDebugData) {
+                return displayId == refreshRateChangedDebugData.display;
+            });
+
+    // Check that we immediately got a callback
+    EXPECT_TRUE(isCallbackReceived);
+
+    ASSERT_TRUE(mComposerClient
+                        ->setRefreshRateChangedCallbackDebugEnabled(displayId,
+                                                                    /*enabled*/ false)
+                        .isOk());
+}
+
+TEST_P(GraphicsComposerAidlCommandTest,
+       SetRefreshRateChangedCallbackDebugEnabled_noCallbackWhenIdle) {
+    if (!hasCapability(Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG)) {
+        GTEST_SUCCEED() << "Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG is not supported";
+        return;
+    }
+
+    auto display = getEditablePrimaryDisplay();
+    const auto displayId = display.getDisplayId();
+
+    if (!hasDisplayCapability(displayId, DisplayCapability::DISPLAY_IDLE_TIMER)) {
+        GTEST_SUCCEED() << "DisplayCapability::DISPLAY_IDLE_TIMER is not supported";
+        return;
+    }
+
+    EXPECT_TRUE(mComposerClient->setPowerMode(displayId, PowerMode::ON).isOk());
+    EXPECT_TRUE(mComposerClient->setPeakRefreshRateConfig(&display).isOk());
+
+    ASSERT_TRUE(mComposerClient->setIdleTimerEnabled(displayId, /*timeoutMs*/ 500).isOk());
+    // Enable the callback
+    ASSERT_TRUE(mComposerClient
+                        ->setRefreshRateChangedCallbackDebugEnabled(displayId,
+                                                                    /*enabled*/ true)
+                        .isOk());
+
+    const bool isCallbackReceived = checkIfCallbackRefreshRateChangedDebugEnabledReceived(
+            [&](auto refreshRateChangedDebugData) {
+                return displayId == refreshRateChangedDebugData.display;
+            });
+
+    int retryCount = 3;
+    do {
+        // Wait for 1s so that we enter the idle state
+        std::this_thread::sleep_for(1s);
+        if (!isCallbackReceived) {
+            // DID NOT receive a callback, we are in the idle state.
+            break;
+        }
+    } while (--retryCount > 0);
+
+    if (retryCount == 0) {
+        GTEST_SUCCEED() << "Unable to enter the idle mode";
+        return;
+    }
+
+    // Send the REFRESH_RATE_INDICATOR update
+    ASSERT_NO_FATAL_FAILURE(
+            sendBufferUpdate(createOnScreenLayer(Composition::REFRESH_RATE_INDICATOR)));
+    std::this_thread::sleep_for(1s);
+    EXPECT_FALSE(isCallbackReceived)
+            << "A callback should not be received for REFRESH_RATE_INDICATOR";
+
+    EXPECT_TRUE(mComposerClient
+                        ->setRefreshRateChangedCallbackDebugEnabled(displayId,
+                                                                    /*enabled*/ false)
+                        .isOk());
+}
+
+TEST_P(GraphicsComposerAidlCommandTest,
+       SetRefreshRateChangedCallbackDebugEnabled_SetActiveConfigWithConstraints) {
+    if (!hasCapability(Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG)) {
+        GTEST_SUCCEED() << "Capability::REFRESH_RATE_CHANGED_CALLBACK_DEBUG is not supported";
+        return;
+    }
+
+    VsyncPeriodChangeConstraints constraints;
+    constraints.seamlessRequired = false;
+    constraints.desiredTimeNanos = systemTime();
+
+    for (VtsDisplay& display : mDisplays) {
+        const auto displayId = display.getDisplayId();
+        EXPECT_TRUE(mComposerClient->setPowerMode(displayId, PowerMode::ON).isOk());
+
+        // Enable the callback
+        ASSERT_TRUE(mComposerClient
+                            ->setRefreshRateChangedCallbackDebugEnabled(displayId, /*enabled*/ true)
+                            .isOk());
+
+        forEachTwoConfigs(displayId, [&](int32_t config1, int32_t config2) {
+            const int32_t vsyncPeriod1 = display.getDisplayConfig(config1).vsyncPeriod;
+            const int32_t vsyncPeriod2 = display.getDisplayConfig(config2).vsyncPeriod;
+
+            if (vsyncPeriod1 == vsyncPeriod2) {
+                return;  // continue
+            }
+
+            EXPECT_TRUE(mComposerClient->setActiveConfig(&display, config1).isOk());
+            sendRefreshFrame(display, nullptr);
+
+            const auto& [status, timeline] =
+                    mComposerClient->setActiveConfigWithConstraints(&display, config2, constraints);
+            EXPECT_TRUE(status.isOk());
+
+            if (timeline.refreshRequired) {
+                sendRefreshFrame(display, &timeline);
+            }
+
+            const auto isCallbackReceived = checkIfCallbackRefreshRateChangedDebugEnabledReceived(
+                    [&](auto refreshRateChangedDebugData) {
+                        constexpr int kVsyncThreshold = 1000;
+                        return displayId == refreshRateChangedDebugData.display &&
+                               std::abs(vsyncPeriod2 -
+                                        refreshRateChangedDebugData.vsyncPeriodNanos) <=
+                                       kVsyncThreshold;
+                    });
+
+            int retryCount = 3;
+            do {
+                std::this_thread::sleep_for(100ms);
+                if (isCallbackReceived) {
+                    GTEST_SUCCEED() << "Received a callback successfully";
+                    break;
+                }
+            } while (--retryCount > 0);
+
+            if (retryCount == 0) {
+                GTEST_FAIL() << "failed to get a callback for the display " << displayId
+                             << " with config " << config2;
+            }
+        });
+
+        EXPECT_TRUE(
+                mComposerClient
+                        ->setRefreshRateChangedCallbackDebugEnabled(displayId, /*enabled*/ false)
+                        .isOk());
+    }
+}
+
 /*
  * Test that no two display configs are exactly the same.
  */
diff --git a/graphics/mapper/2.0/default/passthrough.cpp b/graphics/mapper/2.0/default/passthrough.cpp
index e18b88f..93d6d99 100644
--- a/graphics/mapper/2.0/default/passthrough.cpp
+++ b/graphics/mapper/2.0/default/passthrough.cpp
@@ -19,6 +19,14 @@
 using android::hardware::graphics::mapper::V2_0::IMapper;
 using android::hardware::graphics::mapper::V2_0::passthrough::GrallocLoader;
 
+// Preload the gralloc module such that GraphicBufferMapper::preloadHal is
+// meaningful
+class GrallocPreloader {
+public:
+    GrallocPreloader() { GrallocLoader::loadModule(); }
+};
+static GrallocPreloader sGrallocPreloader;
+
 extern "C" IMapper* HIDL_FETCH_IMapper(const char* /*name*/) {
     return GrallocLoader::load();
 }
diff --git a/graphics/mapper/2.1/default/passthrough.cpp b/graphics/mapper/2.1/default/passthrough.cpp
index c7f0cf5..c99c984 100644
--- a/graphics/mapper/2.1/default/passthrough.cpp
+++ b/graphics/mapper/2.1/default/passthrough.cpp
@@ -19,6 +19,14 @@
 using android::hardware::graphics::mapper::V2_1::IMapper;
 using android::hardware::graphics::mapper::V2_1::passthrough::GrallocLoader;
 
+// Preload the gralloc module such that GraphicBufferMapper::preloadHal is
+// meaningful
+class GrallocPreloader {
+public:
+    GrallocPreloader() { GrallocLoader::loadModule(); }
+};
+static GrallocPreloader sGrallocPreloader;
+
 extern "C" IMapper* HIDL_FETCH_IMapper(const char* /*name*/) {
     return GrallocLoader::load();
 }
diff --git a/health/aidl/OWNERS b/health/aidl/OWNERS
index 9bbcef8..0f1bee2 100644
--- a/health/aidl/OWNERS
+++ b/health/aidl/OWNERS
@@ -2,3 +2,4 @@
 elsk@google.com
 smoreland@google.com
 wjack@google.com
+apelosi@google.com
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryCapacityLevel.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryCapacityLevel.aidl
index e543886..4d70588 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryCapacityLevel.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryCapacityLevel.aidl
@@ -34,11 +34,11 @@
 package android.hardware.health;
 @Backing(type="int") @VintfStability
 enum BatteryCapacityLevel {
-  UNSUPPORTED = -1,
-  UNKNOWN = 0,
-  CRITICAL = 1,
-  LOW = 2,
-  NORMAL = 3,
-  HIGH = 4,
-  FULL = 5,
+  UNSUPPORTED = (-1) /* -1 */,
+  UNKNOWN,
+  CRITICAL,
+  LOW,
+  NORMAL,
+  HIGH,
+  FULL,
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
index d523fad..2dd01b1 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
@@ -36,4 +36,5 @@
 parcelable BatteryHealthData {
   long batteryManufacturingDateSeconds;
   long batteryFirstUsageSeconds;
+  long batteryStateOfHealth;
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
index 664cc70..bfa1475 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
@@ -57,9 +57,8 @@
   android.hardware.health.BatteryCapacityLevel batteryCapacityLevel;
   long batteryChargeTimeToFullNowSeconds;
   int batteryFullChargeDesignCapacityUah;
-  int batteryStateOfHealth;
   android.hardware.health.BatteryChargingState chargingState;
   android.hardware.health.BatteryChargingPolicy chargingPolicy;
   @nullable android.hardware.health.BatteryHealthData batteryHealthData;
-  const int BATTERY_CHARGE_TIME_TO_FULL_NOW_SECONDS_UNSUPPORTED = -1;
+  const int BATTERY_CHARGE_TIME_TO_FULL_NOW_SECONDS_UNSUPPORTED = (-1) /* -1 */;
 }
diff --git a/health/aidl/android/hardware/health/BatteryHealthData.aidl b/health/aidl/android/hardware/health/BatteryHealthData.aidl
index fb17f63..594bcce 100644
--- a/health/aidl/android/hardware/health/BatteryHealthData.aidl
+++ b/health/aidl/android/hardware/health/BatteryHealthData.aidl
@@ -29,4 +29,11 @@
      * The date of first usage is reported in epoch.
      */
     long batteryFirstUsageSeconds;
+    /**
+     * Measured battery state of health (remaining estimate full charge capacity
+     * relative to the rated capacity in %).
+     * Value must be 0 if batteryStatus is UNKNOWN.
+     * Otherwise, value must be in the range 0 to 100.
+     */
+    long batteryStateOfHealth;
 }
diff --git a/health/aidl/android/hardware/health/HealthInfo.aidl b/health/aidl/android/hardware/health/HealthInfo.aidl
index 238f524..af84089 100644
--- a/health/aidl/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/android/hardware/health/HealthInfo.aidl
@@ -137,13 +137,6 @@
      */
     int batteryFullChargeDesignCapacityUah;
     /**
-     * Measured battery state of health (remaining estimate full charge capacity
-     * relative to the rated capacity in %).
-     * Value must be 0 if batteryStatus is UNKNOWN.
-     * Otherwise, value must be in the range 0 to 100.
-     */
-    int batteryStateOfHealth;
-    /**
      * Battery charging state
      */
     BatteryChargingState chargingState;
diff --git a/health/aidl/default/Health.cpp b/health/aidl/default/Health.cpp
index 15a3dbc..f401643 100644
--- a/health/aidl/default/Health.cpp
+++ b/health/aidl/default/Health.cpp
@@ -148,6 +148,11 @@
         !res.isOk()) {
         LOG(WARNING) << "Cannot get First_usage_date: " << res.getDescription();
     }
+    if (auto res = GetProperty<int64_t>(&battery_monitor_, ::android::BATTERY_PROP_STATE_OF_HEALTH,
+                                        0, &out->batteryStateOfHealth);
+        !res.isOk()) {
+        LOG(WARNING) << "Cannot get Battery_state_of_health: " << res.getDescription();
+    }
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
index 6506ea2..69d4789 100644
--- a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
+++ b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
@@ -278,6 +278,10 @@
         *result_listener << " for batteryFirstUsageSeconds.";
         return false;
     }
+    if (!ExplainMatchResult(Ge(-1), arg.batteryStateOfHealth, result_listener)) {
+        *result_listener << " for batteryStateOfHealth.";
+        return false;
+    }
 
     return true;
 }
diff --git a/keymaster/4.0/vts/performance/Benchmark.cpp b/keymaster/4.0/vts/performance/Benchmark.cpp
index 96ef5bf..e5fdff2 100644
--- a/keymaster/4.0/vts/performance/Benchmark.cpp
+++ b/keymaster/4.0/vts/performance/Benchmark.cpp
@@ -315,7 +315,7 @@
 
     SecurityLevel getSecurityLevel() { return securityLevel_; }
 
-    const string& GenerateMessage(int size) {
+    const string GenerateMessage(int size) {
         for (const string& message : message_cache_) {
             if (message.size() == size) {
                 return message;
@@ -323,7 +323,7 @@
         }
         string message = string(size, 'x');
         message_cache_.push_back(message);
-        return std::move(message);
+        return message;
     }
 
     optional<BlockMode> getBlockMode(string transform) {
@@ -714,4 +714,4 @@
         return 1;
     }
     ::benchmark::RunSpecifiedBenchmarks();
-}
\ No newline at end of file
+}
diff --git a/media/omx/1.0/vts/functional/store/VtsHalMediaOmxV1_0TargetStoreTest.cpp b/media/omx/1.0/vts/functional/store/VtsHalMediaOmxV1_0TargetStoreTest.cpp
old mode 100755
new mode 100644
index 00e9837..d80e651
--- a/media/omx/1.0/vts/functional/store/VtsHalMediaOmxV1_0TargetStoreTest.cpp
+++ b/media/omx/1.0/vts/functional/store/VtsHalMediaOmxV1_0TargetStoreTest.cpp
@@ -374,21 +374,16 @@
     }
 }
 
-static int getFirstApiLevel() {
-    int boardApiLevel = android::base::GetIntProperty("ro.board.first_api_level", 0);
-    if (boardApiLevel != 0) {
-        return boardApiLevel;
-    }
-
-    return android::base::GetIntProperty("ro.product.first_api_level", __ANDROID_API_T__);
-}
-
 static bool isTV() {
     return testing::deviceSupportsFeature("android.software.leanback");
 }
 
 // list components and roles.
 TEST_P(StoreHidlTest, OmxCodecAllowedTest) {
+    static int sBoardFirstApiLevel = android::base::GetIntProperty("ro.board.first_api_level", 0);
+    if (sBoardFirstApiLevel == 0) {
+        GTEST_SKIP() << "board first API level not detected";
+    }
     hidl_vec<IOmx::ComponentInfo> componentInfos = getComponentInfoList(omx);
     for (IOmx::ComponentInfo info : componentInfos) {
         for (std::string role : info.mRoles) {
@@ -396,27 +391,27 @@
                 role.find("video_encoder") != std::string::npos) {
                 // Codec2 is not mandatory on Android TV devices that launched with Android S
                 if (isTV()) {
-                    ASSERT_LT(getFirstApiLevel(), __ANDROID_API_T__)
+                    ASSERT_LT(sBoardFirstApiLevel, __ANDROID_API_T__)
                             << " Component: " << info.mName.c_str() << " Role: " << role.c_str()
                             << " not allowed for devices launching with Android T and above";
                 } else {
                     std::string codecName = info.mName;
                     bool isAndroidCodec = (codecName.rfind("OMX.google", 0) != std::string::npos);
-                    if (isAndroidCodec && (getFirstApiLevel() <= __ANDROID_API_S__)) {
+                    if (isAndroidCodec && (sBoardFirstApiLevel <= __ANDROID_API_S__)) {
                         // refer b/230582620
                         // S AOSP build did not remove the OMX.google video codecs
                         // so it is infeasible to require no OMX.google.* video codecs
                         // on S launching devices
                     } else {
-                        ASSERT_LT(getFirstApiLevel(), __ANDROID_API_S__)
-                            << " Component: " << info.mName.c_str() << " Role: " << role.c_str()
-                            << " not allowed for devices launching with Android S and above";
+                        ASSERT_LT(sBoardFirstApiLevel, __ANDROID_API_S__)
+                                << " Component: " << info.mName.c_str() << " Role: " << role.c_str()
+                                << " not allowed for devices launching with Android S and above";
                     }
                 }
             }
             if (role.find("audio_decoder") != std::string::npos ||
                 role.find("audio_encoder") != std::string::npos) {
-                ASSERT_LT(getFirstApiLevel(), __ANDROID_API_T__)
+                ASSERT_LT(sBoardFirstApiLevel, __ANDROID_API_T__)
                         << " Component: " << info.mName.c_str() << " Role: " << role.c_str()
                         << " not allowed for devices launching with Android T and above";
             }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
index 84376b7..37e3b25 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/AmrMode.aidl
@@ -34,13 +34,13 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum AmrMode {
-  AMR_MODE_0 = (1 << 0),
-  AMR_MODE_1 = (1 << 1),
-  AMR_MODE_2 = (1 << 2),
-  AMR_MODE_3 = (1 << 3),
-  AMR_MODE_4 = (1 << 4),
-  AMR_MODE_5 = (1 << 5),
-  AMR_MODE_6 = (1 << 6),
-  AMR_MODE_7 = (1 << 7),
-  AMR_MODE_8 = (1 << 8),
+  AMR_MODE_0 = (1 << 0) /* 1 */,
+  AMR_MODE_1 = (1 << 1) /* 2 */,
+  AMR_MODE_2 = (1 << 2) /* 4 */,
+  AMR_MODE_3 = (1 << 3) /* 8 */,
+  AMR_MODE_4 = (1 << 4) /* 16 */,
+  AMR_MODE_5 = (1 << 5) /* 32 */,
+  AMR_MODE_6 = (1 << 6) /* 64 */,
+  AMR_MODE_7 = (1 << 7) /* 128 */,
+  AMR_MODE_8 = (1 << 8) /* 256 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
index 9eaf129..e4193cd 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/CodecType.aidl
@@ -34,9 +34,9 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum CodecType {
-  AMR = (1 << 0),
-  AMR_WB = (1 << 1),
-  EVS = (1 << 2),
-  PCMA = (1 << 3),
-  PCMU = (1 << 4),
+  AMR = (1 << 0) /* 1 */,
+  AMR_WB = (1 << 1) /* 2 */,
+  EVS = (1 << 2) /* 4 */,
+  PCMA = (1 << 3) /* 8 */,
+  PCMU = (1 << 4) /* 16 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
index 5e80f91..db3eb29 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsBandwidth.aidl
@@ -35,8 +35,8 @@
 @Backing(type="int") @VintfStability
 enum EvsBandwidth {
   NONE = 0,
-  NARROW_BAND = (1 << 0),
-  WIDE_BAND = (1 << 1),
-  SUPER_WIDE_BAND = (1 << 2),
-  FULL_BAND = (1 << 3),
+  NARROW_BAND = (1 << 0) /* 1 */,
+  WIDE_BAND = (1 << 1) /* 2 */,
+  SUPER_WIDE_BAND = (1 << 2) /* 4 */,
+  FULL_BAND = (1 << 3) /* 8 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
index a530a8d..fb1f14d 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/EvsMode.aidl
@@ -34,25 +34,25 @@
 package android.hardware.radio.ims.media;
 @Backing(type="int") @VintfStability
 enum EvsMode {
-  EVS_MODE_0 = (1 << 0),
-  EVS_MODE_1 = (1 << 1),
-  EVS_MODE_2 = (1 << 2),
-  EVS_MODE_3 = (1 << 3),
-  EVS_MODE_4 = (1 << 4),
-  EVS_MODE_5 = (1 << 5),
-  EVS_MODE_6 = (1 << 6),
-  EVS_MODE_7 = (1 << 7),
-  EVS_MODE_8 = (1 << 8),
-  EVS_MODE_9 = (1 << 9),
-  EVS_MODE_10 = (1 << 10),
-  EVS_MODE_11 = (1 << 11),
-  EVS_MODE_12 = (1 << 12),
-  EVS_MODE_13 = (1 << 13),
-  EVS_MODE_14 = (1 << 14),
-  EVS_MODE_15 = (1 << 15),
-  EVS_MODE_16 = (1 << 16),
-  EVS_MODE_17 = (1 << 17),
-  EVS_MODE_18 = (1 << 18),
-  EVS_MODE_19 = (1 << 19),
-  EVS_MODE_20 = (1 << 20),
+  EVS_MODE_0 = (1 << 0) /* 1 */,
+  EVS_MODE_1 = (1 << 1) /* 2 */,
+  EVS_MODE_2 = (1 << 2) /* 4 */,
+  EVS_MODE_3 = (1 << 3) /* 8 */,
+  EVS_MODE_4 = (1 << 4) /* 16 */,
+  EVS_MODE_5 = (1 << 5) /* 32 */,
+  EVS_MODE_6 = (1 << 6) /* 64 */,
+  EVS_MODE_7 = (1 << 7) /* 128 */,
+  EVS_MODE_8 = (1 << 8) /* 256 */,
+  EVS_MODE_9 = (1 << 9) /* 512 */,
+  EVS_MODE_10 = (1 << 10) /* 1024 */,
+  EVS_MODE_11 = (1 << 11) /* 2048 */,
+  EVS_MODE_12 = (1 << 12) /* 4096 */,
+  EVS_MODE_13 = (1 << 13) /* 8192 */,
+  EVS_MODE_14 = (1 << 14) /* 16384 */,
+  EVS_MODE_15 = (1 << 15) /* 32768 */,
+  EVS_MODE_16 = (1 << 16) /* 65536 */,
+  EVS_MODE_17 = (1 << 17) /* 131072 */,
+  EVS_MODE_18 = (1 << 18) /* 262144 */,
+  EVS_MODE_19 = (1 << 19) /* 524288 */,
+  EVS_MODE_20 = (1 << 20) /* 1048576 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/MediaDirection.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/MediaDirection.aidl
index d90b2a4..0e9eaee 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/MediaDirection.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/MediaDirection.aidl
@@ -35,8 +35,8 @@
 @Backing(type="int") @VintfStability
 enum MediaDirection {
   NO_FLOW = 0,
-  SEND_ONLY = 1,
-  RECEIVE_ONLY = 2,
-  SEND_RECEIVE = 3,
-  INACTIVE = 4,
+  RTP_TX = (1 << 0) /* 1 */,
+  RTP_RX = (1 << 1) /* 2 */,
+  RTCP_TX = (1 << 2) /* 4 */,
+  RTCP_RX = (1 << 3) /* 8 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
index 0663754..289c810 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtcpXrReportBlockType.aidl
@@ -35,11 +35,11 @@
 @Backing(type="int") @VintfStability
 enum RtcpXrReportBlockType {
   RTCPXR_NONE = 0,
-  RTCPXR_LOSS_RLE_REPORT_BLOCK = (1 << 0),
-  RTCPXR_DUPLICATE_RLE_REPORT_BLOCK = (1 << 1),
-  RTCPXR_PACKET_RECEIPT_TIMES_REPORT_BLOCK = (1 << 2),
-  RTCPXR_RECEIVER_REFERENCE_TIME_REPORT_BLOCK = (1 << 3),
-  RTCPXR_DLRR_REPORT_BLOCK = (1 << 4),
-  RTCPXR_STATISTICS_SUMMARY_REPORT_BLOCK = (1 << 5),
-  RTCPXR_VOIP_METRICS_REPORT_BLOCK = (1 << 6),
+  RTCPXR_LOSS_RLE_REPORT_BLOCK = (1 << 0) /* 1 */,
+  RTCPXR_DUPLICATE_RLE_REPORT_BLOCK = (1 << 1) /* 2 */,
+  RTCPXR_PACKET_RECEIPT_TIMES_REPORT_BLOCK = (1 << 2) /* 4 */,
+  RTCPXR_RECEIVER_REFERENCE_TIME_REPORT_BLOCK = (1 << 3) /* 8 */,
+  RTCPXR_DLRR_REPORT_BLOCK = (1 << 4) /* 16 */,
+  RTCPXR_STATISTICS_SUMMARY_REPORT_BLOCK = (1 << 5) /* 32 */,
+  RTCPXR_VOIP_METRICS_REPORT_BLOCK = (1 << 6) /* 64 */,
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
index 1a8921e..8a826f6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -34,7 +34,7 @@
 package android.hardware.radio.ims.media;
 @VintfStability
 parcelable RtpConfig {
-  android.hardware.radio.ims.media.MediaDirection direction;
+  int direction;
   android.hardware.radio.AccessNetwork accessNetwork;
   android.hardware.radio.ims.media.RtpAddress remoteAddress;
   android.hardware.radio.ims.media.RtpSessionParams sessionParams;
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrSignalStrength.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrSignalStrength.aidl
index 2055024..7d6ab82 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrSignalStrength.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NrSignalStrength.aidl
@@ -42,5 +42,5 @@
   int csiSinr;
   int csiCqiTableIndex;
   byte[] csiCqiReport;
-  int timingAdvance;
+  int timingAdvance = 0x7FFFFFFF;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/MediaDirection.aidl b/radio/aidl/android/hardware/radio/ims/media/MediaDirection.aidl
index 9f04d8e..e5c34c7 100644
--- a/radio/aidl/android/hardware/radio/ims/media/MediaDirection.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/MediaDirection.aidl
@@ -16,6 +16,17 @@
 
 package android.hardware.radio.ims.media;
 
+/**
+ * Directions can be combined to meet various media direction
+ * requirements depending on the scenario.
+ *
+ * Examples:
+ *     No Flow      : NO_FLOW - eg. SRVCC.
+ *     RTCP-only    : RTCP_TX | RTCP_RX - eg. Local Hold or Dual Hold.
+ *     Receive-Only : RTP_RX | RTCP_TX | RTCP_RX - eg. Remote Hold.
+ *     Send-Receive : RTP_TX | RTP_RX | RTCP_TX | RTCP_RX - eg. Active call.
+ *     Send-Only    : RTP_TX | RTCP_TX | RTCP_RX - eg. Simplex call, voice mail, etc
+ */
 @VintfStability
 @Backing(type="int")
 enum MediaDirection {
@@ -24,12 +35,16 @@
      * may release the audio resource. Eg. SRVCC.
      */
     NO_FLOW = 0,
-    /** Device sends outgoing RTP and drops incoming RTP */
-    SEND_ONLY = 1,
-    /** Device receives the downlink RTP and does not transmit any uplink RTP */
-    RECEIVE_ONLY = 2,
-    /** Device sends and receive RTP in both directions */
-    SEND_RECEIVE = 3,
-    /** No RTP flow however RTCP continues to flow. Eg. HOLD */
-    INACTIVE = 4,
+
+    /** Send RTP packets */
+    RTP_TX = 1 << 0,
+
+    /** Receive and processes RTP packets */
+    RTP_RX = 1 << 1,
+
+    /** Send RTCP packets */
+    RTCP_TX = 1 << 2,
+
+    /** Receive RTCP packets */
+    RTCP_RX = 1 << 3,
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
index f6696f7..f93b112 100644
--- a/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/RtpConfig.aidl
@@ -18,15 +18,14 @@
 
 import android.hardware.radio.AccessNetwork;
 import android.hardware.radio.ims.media.AnbrMode;
-import android.hardware.radio.ims.media.MediaDirection;
 import android.hardware.radio.ims.media.RtcpConfig;
 import android.hardware.radio.ims.media.RtpAddress;
 import android.hardware.radio.ims.media.RtpSessionParams;
 
 @VintfStability
 parcelable RtpConfig {
-    /** Media flow direction */
-    MediaDirection direction;
+    /** Media flow direction. The bitfield of MediaDirection(s) */
+    int direction;
     /** Radio Access Network */
     AccessNetwork accessNetwork;
     /** IP address and port number of the other party for RTP media */
diff --git a/radio/aidl/android/hardware/radio/network/NrSignalStrength.aidl b/radio/aidl/android/hardware/radio/network/NrSignalStrength.aidl
index 2314562..30ae067 100644
--- a/radio/aidl/android/hardware/radio/network/NrSignalStrength.aidl
+++ b/radio/aidl/android/hardware/radio/network/NrSignalStrength.aidl
@@ -77,5 +77,5 @@
      * INT_MAX: 0x7FFFFFFF denotes invalid/unreported value.
      * Reference: 3GPP 36.213 section 4.2.3
      */
-    int timingAdvance;
+    int timingAdvance = 0x7FFFFFFF;
 }
diff --git a/radio/aidl/vts/radio_imsmedia_test.cpp b/radio/aidl/vts/radio_imsmedia_test.cpp
index d9e57c9..2b6f5ef 100644
--- a/radio/aidl/vts/radio_imsmedia_test.cpp
+++ b/radio/aidl/vts/radio_imsmedia_test.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#include <aidl/android/hardware/radio/ims/media/MediaDirection.h>
 #include <android-base/logging.h>
 #include <android/binder_auto_utils.h>
 #include <android/binder_manager.h>
@@ -44,8 +45,10 @@
     int32_t sessionId = 1;
     RtpConfig modifyRtpConfig;
 
-    modifyRtpConfig.direction =
-            ::aidl::android::hardware::radio::ims::media::MediaDirection::SEND_RECEIVE;
+    modifyRtpConfig.direction = static_cast<int32_t>(MediaDirection::RTP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTP_RX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_RX);
     modifyRtpConfig.remoteAddress.ipAddress = "122.22.22.33";
     modifyRtpConfig.remoteAddress.portNumber = 1234;
 
@@ -90,8 +93,10 @@
     int32_t duration = 200;
     RtpConfig modifyRtpConfig;
 
-    modifyRtpConfig.direction =
-            ::aidl::android::hardware::radio::ims::media::MediaDirection::SEND_RECEIVE;
+    modifyRtpConfig.direction = static_cast<int32_t>(MediaDirection::RTP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTP_RX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_RX);
     modifyRtpConfig.remoteAddress.ipAddress = "122.22.22.33";
     modifyRtpConfig.remoteAddress.portNumber = 1234;
 
@@ -143,8 +148,10 @@
     std::vector<RtpHeaderExtension> extensions;
     RtpConfig modifyRtpConfig;
 
-    modifyRtpConfig.direction =
-            ::aidl::android::hardware::radio::ims::media::MediaDirection::SEND_RECEIVE;
+    modifyRtpConfig.direction = static_cast<int32_t>(MediaDirection::RTP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTP_RX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_RX);
     modifyRtpConfig.remoteAddress.ipAddress = "122.22.22.33";
     modifyRtpConfig.remoteAddress.portNumber = 1234;
 
@@ -190,8 +197,10 @@
     MediaQualityThreshold threshold;
     RtpConfig modifyRtpConfig;
 
-    modifyRtpConfig.direction =
-            ::aidl::android::hardware::radio::ims::media::MediaDirection::SEND_RECEIVE;
+    modifyRtpConfig.direction = static_cast<int32_t>(MediaDirection::RTP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTP_RX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_TX) |
+                                static_cast<int32_t>(MediaDirection::RTCP_RX);
     modifyRtpConfig.remoteAddress.ipAddress = "122.22.22.33";
     modifyRtpConfig.remoteAddress.portNumber = 1234;
 
@@ -243,13 +252,14 @@
     localEndPoint.rtcpFd = ndk::ScopedFileDescriptor(mRtcpSocketFd);
     localEndPoint.modemId = 1;
 
-    rtpConfig.direction =
-            ::aidl::android::hardware::radio::ims::media::MediaDirection::SEND_RECEIVE;
+    rtpConfig.direction = static_cast<int32_t>(MediaDirection::RTP_TX) |
+                          static_cast<int32_t>(MediaDirection::RTP_RX) |
+                          static_cast<int32_t>(MediaDirection::RTCP_TX) |
+                          static_cast<int32_t>(MediaDirection::RTCP_RX);
     rtpConfig.remoteAddress.ipAddress = "122.22.22.22";
     rtpConfig.remoteAddress.portNumber = 2222;
 
     result = radio_imsmedia->openSession(sessionId, localEndPoint, rtpConfig);
-
     return result;
 }
 
diff --git a/scripts/anapic_hidl2aidl_review.sh b/scripts/anapic_hidl2aidl_review.sh
index 330ae32..ce72160 100755
--- a/scripts/anapic_hidl2aidl_review.sh
+++ b/scripts/anapic_hidl2aidl_review.sh
@@ -1,4 +1,11 @@
 #!/bin/bash
+#
+# Create two CLs for the given HIDL interface to see the diff between the
+# hidl2aidl output and the source at the tip-of-tree.
+# The first CL contains the hidl2aidl output after removing all existing AIDL
+# files.
+# The second CL contains all of the changes on top of the raw hidl2aidl output
+# that can be used for review.
 
 if [[ $# -ne 1 ]]; then
     echo "Usage: $0 INTERFACE_NAME"
@@ -23,5 +30,6 @@
 git commit -am "convert $1" --no-edit
 git revert HEAD --no-edit
 git commit --amend --no-edit
-repo upload . --no-verify
+git diff HEAD~1 --stat
+repo upload . --no-verify --wip --hashtag=anapic_release_review
 popd
diff --git a/scripts/anapic_release_diff.sh b/scripts/anapic_release_diff.sh
new file mode 100755
index 0000000..c22d9e5
--- /dev/null
+++ b/scripts/anapic_release_diff.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# Create a CL that contains the changes between this branch and a newer branch
+# for a given AIDL interface.
+# Be sure that BRANCH_BASE is the current upstream branch in order to get a CL.
+
+if [[ $# -ne 3 ]]; then
+    echo "Usage: $0 BRANCH_BASE BRANCH_NEW PACKAGE_NAME"
+    echo "- BRANCH_BASE current branch, typically a previous release's dev branch"
+    echo "- BRANCH_NEW end branch, typically goog/master as the latest branch"
+    echo "- PACKAGE_NAME this is the AIDL package name"
+    echo "example of creating the diffs for android.hardware.boot"
+    echo "$ git checkout tm-dev ; repo start review"
+    echo "$ ./anapic_release_diff.sh goog/tm-dev goog/master android.hardware.boot"
+    exit 1
+fi
+
+# for pathmod
+source ${ANDROID_BUILD_TOP}/build/make/envsetup.sh
+
+set -ex
+
+INTERFACE_NAME_NO_VER=${3%@*}
+pushd $(pathmod $INTERFACE_NAME_NO_VER)
+git diff "$1".."$2" android | git apply
+git add -A
+git commit -am "Android $1 to $2: $3" --no-edit
+git diff HEAD~1 --stat
+repo upload . --no-verify --wip --hashtag=anapic_release_review
+popd
diff --git a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
index b9ce9d1..8c0dd6d 100644
--- a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
+++ b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
@@ -123,6 +123,9 @@
     /**
      * Transmits an APDU command (as per ISO/IEC 7816) to the SE.
      *
+     * @throws ServiceSpecificException with code CHANNEL_NOT_AVAILABLE
+     *  if there was an error in communicating with the secure element.
+     *
      * @param data APDU command to be sent
      * @return response to the command
      */
diff --git a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
index 2e96f7d..0925a21 100644
--- a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
+++ b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
@@ -136,18 +136,27 @@
             apdu[0] |= (channel_number - 4) | 0x40;
         }
 
-        EXPECT_OK(secure_element_->transmit(apdu, &response));
+        // transmit() will return an empty response with the error
+        // code CHANNEL_NOT_AVAILABLE when the SE cannot be
+        // communicated with.
+        auto status = secure_element_->transmit(apdu, &response);
+        if (!status.isOk()) {
+            return 0x6881;
+        }
+
+        // transmit() will return a response containing at least
+        // the APDU response status otherwise.
         EXPECT_GE(response.size(), 2u);
-        uint16_t status =
+        uint16_t apdu_status =
                 (response[response.size() - 2] << 8) | (response[response.size() - 1] << 0);
 
         // When the command is successful the response
         // must contain 256 bytes of data.
-        if (status == 0x9000) {
+        if (apdu_status == 0x9000) {
             EXPECT_EQ(response.size(), 258);
         }
 
-        return status;
+        return apdu_status;
     }
 
     std::shared_ptr<ISecureElement> secure_element_;
diff --git a/security/dice/aidl/Android.bp b/security/dice/aidl/Android.bp
deleted file mode 100644
index 5625d70..0000000
--- a/security/dice/aidl/Android.bp
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
-aidl_interface {
-    name: "android.hardware.security.dice",
-    vendor_available: true,
-    srcs: [
-        "android/hardware/security/dice/*.aidl",
-    ],
-    stability: "vintf",
-    backend: {
-        java: {
-            enabled: false,
-            platform_apis: false,
-        },
-        ndk: {
-            apps_enabled: false,
-            apex_available: [
-                "//apex_available:platform",
-                "com.android.compos",
-            ],
-        },
-        rust: {
-            enabled: true,
-            apex_available: [
-                "//apex_available:platform",
-                "com.android.compos",
-            ],
-        },
-    },
-    versions_with_info: [
-        {
-            version: "1",
-            imports: [],
-        },
-    ],
-
-    //     versions: ["1"],
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/.hash b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/.hash
deleted file mode 100644
index 3f08fd8..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/.hash
+++ /dev/null
@@ -1 +0,0 @@
-02994f275fd7b1b40610c10eaeb0573f4312e358
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Bcc.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Bcc.aidl
deleted file mode 100644
index 5af7358..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Bcc.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Bcc {
-  byte[] data;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/BccHandover.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/BccHandover.aidl
deleted file mode 100644
index 8baca94..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/BccHandover.aidl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable BccHandover {
-  byte[32] cdiAttest;
-  byte[32] cdiSeal;
-  android.hardware.security.dice.Bcc bcc;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Config.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Config.aidl
deleted file mode 100644
index 78dd2f8..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Config.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Config {
-  byte[] desc;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/InputValues.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/InputValues.aidl
deleted file mode 100644
index e43c429..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/InputValues.aidl
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable InputValues {
-  byte[64] codeHash;
-  android.hardware.security.dice.Config config;
-  byte[64] authorityHash;
-  @nullable byte[] authorityDescriptor;
-  android.hardware.security.dice.Mode mode = android.hardware.security.dice.Mode.NOT_INITIALIZED;
-  byte[64] hidden;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/ResponseCode.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/ResponseCode.aidl
deleted file mode 100644
index c13afa6..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/ResponseCode.aidl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2020, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-@Backing(type="int") @VintfStability
-enum ResponseCode {
-  PERMISSION_DENIED = 1,
-  SYSTEM_ERROR = 2,
-  NOT_IMPLEMENTED = 3,
-  DEMOTION_FAILED = 4,
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Signature.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Signature.aidl
deleted file mode 100644
index 294170d..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/1/android/hardware/security/dice/Signature.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Signature {
-  byte[] data;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl
deleted file mode 100644
index 5af7358..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Bcc.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Bcc {
-  byte[] data;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl
deleted file mode 100644
index 8baca94..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/BccHandover.aidl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable BccHandover {
-  byte[32] cdiAttest;
-  byte[32] cdiSeal;
-  android.hardware.security.dice.Bcc bcc;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl
deleted file mode 100644
index 78dd2f8..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Config.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Config {
-  byte[] desc;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl
deleted file mode 100644
index 383f4d1..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/IDiceDevice.aidl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@SensitiveData @VintfStability
-interface IDiceDevice {
-  android.hardware.security.dice.Signature sign(in android.hardware.security.dice.InputValues[] id, in byte[] payload);
-  android.hardware.security.dice.Bcc getAttestationChain(in android.hardware.security.dice.InputValues[] inputValues);
-  android.hardware.security.dice.BccHandover derive(in android.hardware.security.dice.InputValues[] inputValues);
-  void demote(in android.hardware.security.dice.InputValues[] inputValues);
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl
deleted file mode 100644
index e43c429..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/InputValues.aidl
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable InputValues {
-  byte[64] codeHash;
-  android.hardware.security.dice.Config config;
-  byte[64] authorityHash;
-  @nullable byte[] authorityDescriptor;
-  android.hardware.security.dice.Mode mode = android.hardware.security.dice.Mode.NOT_INITIALIZED;
-  byte[64] hidden;
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl
deleted file mode 100644
index 295c32e..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Mode.aidl
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@Backing(type="int") @VintfStability
-enum Mode {
-  NOT_INITIALIZED = 0,
-  NORMAL = 1,
-  DEBUG = 2,
-  RECOVERY = 3,
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl
deleted file mode 100644
index c13afa6..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/ResponseCode.aidl
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright 2020, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-@Backing(type="int") @VintfStability
-enum ResponseCode {
-  PERMISSION_DENIED = 1,
-  SYSTEM_ERROR = 2,
-  NOT_IMPLEMENTED = 3,
-  DEMOTION_FAILED = 4,
-}
diff --git a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl b/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl
deleted file mode 100644
index 294170d..0000000
--- a/security/dice/aidl/aidl_api/android.hardware.security.dice/current/android/hardware/security/dice/Signature.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.security.dice;
-/* @hide */
-@RustDerive(Clone=true, Eq=true, Hash=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
-parcelable Signature {
-  byte[] data;
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/Bcc.aidl b/security/dice/aidl/android/hardware/security/dice/Bcc.aidl
deleted file mode 100644
index 983915e..0000000
--- a/security/dice/aidl/android/hardware/security/dice/Bcc.aidl
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-/**
- * A DICE certificate chain following the Boot Certificate Chain (BCC) specification.
- * @hide
- */
-@VintfStability
-@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true)
-parcelable Bcc {
-    /**
-     * The DICE certificate chain CBOR encoded following the BCC specification. The CDDL
-     * specification for BCC can be found here [1].
-     *
-     * @see <a
-     *         href="https://cs.android.com/android/platform/superproject/+/master:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl">
-     *    BCC CDDL specification
-     * </a>
-     */
-    byte[] data;
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl b/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl
deleted file mode 100644
index 6ca862c..0000000
--- a/security/dice/aidl/android/hardware/security/dice/BccHandover.aidl
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-import android.hardware.security.dice.Bcc;
-
-/**
- * Represents one set of DICE artifacts.
- *
- * @hide
- */
-@VintfStability
-@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true)
-parcelable BccHandover {
-    /**
-     * CDI_attest. Must be exactly 32 bytes of data.
-     */
-    byte[32] cdiAttest;
-    /**
-     * CDI_seal. Must be exactly 32 bytes of data.
-     */
-    byte[32] cdiSeal;
-    /**
-     * CBOR encoded BCC.
-     *
-     * @see <a
-     *         href="https://cs.android.com/android/platform/superproject/+/master:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl">
-     *    BCC CDDL specification
-     * </a>
-     */
-    Bcc bcc;
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/Config.aidl b/security/dice/aidl/android/hardware/security/dice/Config.aidl
deleted file mode 100644
index 6decfc5..0000000
--- a/security/dice/aidl/android/hardware/security/dice/Config.aidl
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-/**
- * DICE config descriptor as described in at
- * <a
- * href="https://pigweed.googlesource.com/open-dice/+/refs/heads/main/docs/specification.md#input-values">
- *     input-values
- * </a>
- * @hide
- */
-@VintfStability
-@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true)
-parcelable Config {
-    /**
-     * A free form descriptor. This should follow the BCC Configuration Descriptor.
-     * @see <a
-     *         href="https://cs.android.com/android/platform/superproject/+/master:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl">
-     *     BccPayload field -4670548
-     * </a>
-     */
-    byte[] desc;
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl b/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl
deleted file mode 100644
index 709aede..0000000
--- a/security/dice/aidl/android/hardware/security/dice/IDiceDevice.aidl
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-import android.hardware.security.dice.Bcc;
-import android.hardware.security.dice.BccHandover;
-import android.hardware.security.dice.InputValues;
-import android.hardware.security.dice.Signature;
-
-/**
- * IDiceDevice specifies an interface that allows access to the Android instance's DICE artifacts.
- *
- * <h2>Features</h2>
- *
- * The dice device provides access to the component's CDI_SEAL and CDI_ATTEST secrets as well
- * as to its attestation certificate chain. The "component" is the Android instance running this
- * HAL service and the secrets and attestation chain must include all boot stage components,
- * the kernel, and the verified boot information (VBA).
- *
- * Implementations provide the following operations:
- * <li> sign - Signing a payload with a key derived from CDI_ATTEST.
- * <li> getAttestationChain - Retrieve the component's attestation certificate chain.
- * <li> derive - Retrieve the component's DICE artifacts.
- *
- * @see <a
- *         href="https://pigweed.googlesource.com/open-dice/+/refs/heads/main/docs/specification.md">
- *     Open-dice Specification
- * </a>
- * @see <a
- *         href="https://cs.android.com/android/platform/superproject/+/master:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl">
- *     Boot Certificate Chain (BCC) CDDL specification
- * </a>
- * @hide
- */
-@SensitiveData
-@VintfStability
-interface IDiceDevice {
-    /**
-     * Uses the a key derived from the component's, or a child's given by <code>inputValues</code>,
-     * attestation secret to sign the payload using RFC 8032 Pure Ed25519 and returns the
-     * signature. The payload is limited to 1024 bytes.
-     *
-     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8032">RFC 8032</a>
-     */
-    Signature sign(in InputValues[] id, in byte[] payload);
-
-    /**
-     * Returns the attestation chain of the component if <code>inputValues</code> is empty or the
-     * chain to the given child of the component identified by the <code>inputValues</code> vector.
-     *
-     * ## Error as service specific exception:
-     *     ResponseCode::PERMISSION_DENIED if the caller is not sufficiently privileged.
-     */
-    Bcc getAttestationChain(in InputValues[] inputValues);
-
-    /**
-     * This function allows a client to become a resident node. A resident node is a node that
-     * manages its own dice secrets as opposed to using them by proxy, i.e., by calling sign
-     * and getAttestationChain. Called with empty <code>inputValues</code> vectors, an
-     * implementation returns the component's DICE secrets. If the <code>inputValues</code> vector
-     * is given the appropriate derivations are performed starting from the component's level.
-     *
-     * ## Error as service specific exception:
-     *     ResponseCode::PERMISSION_DENIED if the implementation does not allow resident nodes
-     *     at the client's level.
-     */
-    BccHandover derive(in InputValues[] inputValues);
-
-    /**
-     * This demotes the implementation of this interface.
-     * When called, the implementation performs appropriate derivation steps using
-     * <code>inputValues</code>, traversing the vector in ascending order. Then it replaces its
-     * stored DICE artifacts with the newly derived ones.
-     *
-     * IMPORTANT: When the function returns, all remnants of the previous DICE artifacts must
-     * have been purged from memory.
-     *
-     * This operation is not reversible until the next reboot. Further demotion is always
-     * possible.
-     *
-     * ## Error as service specific exception:
-     *     ResponseCode::DEMOTION_FAILED if the implementation failed to demote itself
-     *     or was unable to purge previous DICE artifacts from memory.
-     */
-    void demote(in InputValues[] inputValues);
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/InputValues.aidl b/security/dice/aidl/android/hardware/security/dice/InputValues.aidl
deleted file mode 100644
index 711d523..0000000
--- a/security/dice/aidl/android/hardware/security/dice/InputValues.aidl
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-import android.hardware.security.dice.Config;
-import android.hardware.security.dice.Mode;
-
-/**
- * DICE input values for certificate and CDI generation.
- *
- * @see <a
- *         href="https://pigweed.googlesource.com/open-dice/+/refs/heads/main/docs/specification.md#input-values">
- *     Open-dice input-values
- * </a>
- * @hide
- */
-@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true)
-@VintfStability
-parcelable InputValues {
-    /**
-     * The target code hash. Must be exactly 64 bytes.
-     */
-    byte[64] codeHash;
-    /**
-     * The configuration data.
-     */
-    Config config;
-    /**
-     * The authority hash. Must be exactly 64 bytes. Must be all zero if unused.
-     */
-    byte[64] authorityHash;
-    /**
-     * Optional free form authorityDescriptor.
-     */
-    @nullable byte[] authorityDescriptor;
-    /**
-     * The mode of operation. Normal, Debug, Maintenance, or not initialized.
-     */
-    Mode mode = Mode.NOT_INITIALIZED;
-    /**
-     * Optional hidden values. Must be exactly 64 bytes. Must be all zero if unused.
-     */
-    byte[64] hidden;
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/Mode.aidl b/security/dice/aidl/android/hardware/security/dice/Mode.aidl
deleted file mode 100644
index 3b3bfdc..0000000
--- a/security/dice/aidl/android/hardware/security/dice/Mode.aidl
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-/**
- * DICE mode values as defined at
- *
- * @see <a
- *         href="https://pigweed.googlesource.com/open-dice/+/refs/heads/main/docs/specification.md#mode-value-details">
- *     open-dice mode-value-details
- * </a>
- * @hide
- */
-@Backing(type="int")
-@VintfStability
-enum Mode {
-    NOT_INITIALIZED = 0,
-    NORMAL = 1,
-    DEBUG = 2,
-    /**
-     * The recovery mode is also referred to as "maintenance" mode.
-     */
-    RECOVERY = 3,
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl b/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl
deleted file mode 100644
index 3e77cf7..0000000
--- a/security/dice/aidl/android/hardware/security/dice/ResponseCode.aidl
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright 2020, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-@Backing(type="int")
-/**
- * These response codes are used as service specific exception codes by
- * IDiceDevice.
- * @hide
- */
-@VintfStability
-enum ResponseCode {
-    /**
-     * The caller has insufficient privilege to access the DICE API.
-     */
-    PERMISSION_DENIED = 1,
-    /**
-     * An unexpected error occurred, likely with IO or IPC.
-     */
-    SYSTEM_ERROR = 2,
-    /**
-     * Returned if the called function is not implemented.
-     */
-    NOT_IMPLEMENTED = 3,
-    /**
-     * An attempt to demote the implementation failed.
-     */
-    DEMOTION_FAILED = 4,
-}
diff --git a/security/dice/aidl/android/hardware/security/dice/Signature.aidl b/security/dice/aidl/android/hardware/security/dice/Signature.aidl
deleted file mode 100644
index ea3594f..0000000
--- a/security/dice/aidl/android/hardware/security/dice/Signature.aidl
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright 2021, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.security.dice;
-
-/**
- * This parcelable represents a Signature. It is used as return value of IDiceNode::sign.
- *
- * @hide
- */
-@RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true, Hash=true)
-@VintfStability
-parcelable Signature {
-    /**
-     * The RFC 8032 PureEd25519 signature.
-     * @see <a href="https://datatracker.ietf.org/doc/html/rfc8032">RFC 8032</a>
-     */
-    byte[] data;
-}
diff --git a/security/dice/aidl/default/Android.bp b/security/dice/aidl/default/Android.bp
deleted file mode 100644
index b67a44a..0000000
--- a/security/dice/aidl/default/Android.bp
+++ /dev/null
@@ -1,30 +0,0 @@
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
-rust_binary {
-    name: "android.hardware.security.dice-service.non-secure-software",
-    srcs: ["service.rs"],
-    relative_install_path: "hw",
-    vendor: true,
-    rustlibs: [
-        "android.hardware.security.dice-V1-rust",
-        "libdiced_open_dice_cbor",
-        "libdiced_sample_inputs",
-        "libdiced_vendor",
-        "libandroid_logger",
-        "libanyhow",
-        "libbinder_rs",
-        "liblog_rust",
-        "libserde",
-    ],
-    init_rc: ["android.hardware.security.dice-service.non-secure-software.rc"],
-    vintf_fragments: [
-        "android.hardware.security.dice-service.non-secure-software.xml",
-    ],
-}
diff --git a/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.rc b/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.rc
deleted file mode 100644
index 28e43c3..0000000
--- a/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.rc
+++ /dev/null
@@ -1,9 +0,0 @@
-service vendor.dice /vendor/bin/hw/android.hardware.security.dice-service.non-secure-software
-    class early_hal
-    user nobody
-    # The diced HAL cannot be allowed to restart. When it crashes for any reason.
-    # it loses security critical state. The only remedy is to restart the device.
-    # This may be implementation depended. It is safe to restart the HAL if the
-    # state change during a call to "demote" is is preserved.
-    # see android/hardware/security/dice/IDiceDevice.aidl for details on "demote".
-    oneshot
diff --git a/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.xml b/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.xml
deleted file mode 100644
index 94ef243..0000000
--- a/security/dice/aidl/default/android.hardware.security.dice-service.non-secure-software.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<manifest version="1.0" type="device">
-    <hal format="aidl">
-        <name>android.hardware.security.dice</name>
-        <fqname>IDiceDevice/default</fqname>
-    </hal>
-</manifest>
\ No newline at end of file
diff --git a/security/dice/aidl/default/service.rs b/security/dice/aidl/default/service.rs
deleted file mode 100644
index 0197f2c..0000000
--- a/security/dice/aidl/default/service.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//! Main entry point for the android.hardware.security.dice service.
-
-use anyhow::Result;
-use diced::{
-    dice,
-    hal_node::{DiceArtifacts, DiceDevice, ResidentHal, UpdatableDiceArtifacts},
-};
-use diced_sample_inputs::make_sample_bcc_and_cdis;
-use serde::{Deserialize, Serialize};
-use std::panic;
-use std::sync::Arc;
-
-static DICE_HAL_SERVICE_NAME: &str = "android.hardware.security.dice.IDiceDevice/default";
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-struct InsecureSerializableArtifacts {
-    cdi_attest: [u8; dice::CDI_SIZE],
-    cdi_seal: [u8; dice::CDI_SIZE],
-    bcc: Vec<u8>,
-}
-
-impl DiceArtifacts for InsecureSerializableArtifacts {
-    fn cdi_attest(&self) -> &[u8; dice::CDI_SIZE] {
-        &self.cdi_attest
-    }
-    fn cdi_seal(&self) -> &[u8; dice::CDI_SIZE] {
-        &self.cdi_seal
-    }
-    fn bcc(&self) -> Vec<u8> {
-        self.bcc.clone()
-    }
-}
-
-impl UpdatableDiceArtifacts for InsecureSerializableArtifacts {
-    fn with_artifacts<F, T>(&self, f: F) -> Result<T>
-    where
-        F: FnOnce(&dyn DiceArtifacts) -> Result<T>,
-    {
-        f(self)
-    }
-    fn update(self, new_artifacts: &impl DiceArtifacts) -> Result<Self> {
-        Ok(Self {
-            cdi_attest: *new_artifacts.cdi_attest(),
-            cdi_seal: *new_artifacts.cdi_seal(),
-            bcc: new_artifacts.bcc(),
-        })
-    }
-}
-
-fn main() {
-    android_logger::init_once(
-        android_logger::Config::default()
-            .with_tag("android.hardware.security.dice")
-            .with_min_level(log::Level::Debug),
-    );
-    // Redirect panic messages to logcat.
-    panic::set_hook(Box::new(|panic_info| {
-        log::error!("{}", panic_info);
-    }));
-
-    // Saying hi.
-    log::info!("android.hardware.security.dice is starting.");
-
-    let dice_artifacts =
-        make_sample_bcc_and_cdis().expect("Failed to construct sample dice chain.");
-
-    let hal_impl = Arc::new(
-        unsafe {
-            // Safety: ResidentHal cannot be used in multi threaded processes.
-            // This service does not start a thread pool. The main thread is the only thread
-            // joining the thread pool, thereby keeping the process single threaded.
-            ResidentHal::new(InsecureSerializableArtifacts {
-                cdi_attest: dice_artifacts.cdi_values.cdi_attest,
-                cdi_seal: dice_artifacts.cdi_values.cdi_seal,
-                bcc: dice_artifacts.bcc[..].to_vec(),
-            })
-        }
-        .expect("Failed to create ResidentHal implementation."),
-    );
-
-    let hal = DiceDevice::new_as_binder(hal_impl).expect("Failed to construct hal service.");
-
-    binder::add_service(DICE_HAL_SERVICE_NAME, hal.as_binder())
-        .expect("Failed to register IDiceDevice Service");
-
-    log::info!("Joining thread pool now.");
-    binder::ProcessState::join_thread_pool();
-}
diff --git a/security/dice/aidl/vts/functional/Android.bp b/security/dice/aidl/vts/functional/Android.bp
deleted file mode 100644
index f5bc949..0000000
--- a/security/dice/aidl/vts/functional/Android.bp
+++ /dev/null
@@ -1,54 +0,0 @@
-package {
-    // See: http://go/android-license-faq
-    // A large-scale-change added 'default_applicable_licenses' to import
-    // all of the 'license_kinds' from "hardware_interfaces_license"
-    // to get the below license kinds:
-    //   SPDX-license-identifier-Apache-2.0
-    default_applicable_licenses: ["hardware_interfaces_license"],
-}
-
-rust_test {
-    name: "VtsAidlDiceTargetTest",
-    srcs: [
-        "dice_test.rs",
-    ],
-    require_root: true,
-    auto_gen_config: true,
-    test_suites: [
-        "general-tests",
-        "vts",
-    ],
-
-    rustlibs: [
-        "android.hardware.security.dice-V1-rust",
-        "libanyhow",
-        "libbinder_rs",
-        "libdiced_open_dice_cbor",
-        "libdiced_sample_inputs",
-        "libdiced_utils",
-        "libkeystore2_vintf_rust",
-    ],
-}
-
-rust_test {
-    name: "VtsAidlDiceDemoteTargetTest",
-    srcs: [
-        "dice_demote_test.rs",
-    ],
-
-    test_config: "VtsAidlDiceDemoteTargetTest.xml",
-    test_suites: [
-        "general-tests",
-        "vts",
-    ],
-
-    rustlibs: [
-        "android.hardware.security.dice-V1-rust",
-        "libanyhow",
-        "libbinder_rs",
-        "libdiced_open_dice_cbor",
-        "libdiced_sample_inputs",
-        "libdiced_utils",
-        "libkeystore2_vintf_rust",
-    ],
-}
diff --git a/security/dice/aidl/vts/functional/VtsAidlDiceDemoteTargetTest.xml b/security/dice/aidl/vts/functional/VtsAidlDiceDemoteTargetTest.xml
deleted file mode 100644
index 2991580..0000000
--- a/security/dice/aidl/vts/functional/VtsAidlDiceDemoteTargetTest.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2019 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-
-<configuration description="Config to run VtsAidlDiceDemoteTargetTest device tests.">
-
-    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
-    </target_preparer>
-
-    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
-        <option name="cleanup" value="true" />
-        <option name="push" value="VtsAidlDiceDemoteTargetTest->/data/local/tmp/VtsAidlDiceDemoteTargetTest" />
-    </target_preparer>
-
-    <test class="com.android.tradefed.testtype.rust.RustBinaryTest" >
-        <option name="test-device-path" value="/data/local/tmp" />
-        <option name="module-name" value="VtsAidlDiceDemoteTargetTest" />
-    </test>
-    <target_preparer class="com.android.tradefed.targetprep.RebootTargetPreparer" />
-
-</configuration>
\ No newline at end of file
diff --git a/security/dice/aidl/vts/functional/dice_demote_test.rs b/security/dice/aidl/vts/functional/dice_demote_test.rs
deleted file mode 100644
index 1a17ec7..0000000
--- a/security/dice/aidl/vts/functional/dice_demote_test.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use diced_sample_inputs;
-use diced_utils;
-use std::convert::TryInto;
-
-mod utils;
-use utils::with_connection;
-
-// This test calls derive with an empty argument vector, then demotes the HAL using
-// a set of three input values, and then calls derive with empty argument vector again.
-// It then performs the same three derivation steps on the result of the former and compares
-// the result to the result of the latter.
-#[test]
-fn demote_test() {
-    with_connection(|device| {
-        let input_values = diced_sample_inputs::get_input_values_vector();
-        let former = device.derive(&[]).expect("Trying to call derive.");
-        device
-            .demote(&input_values)
-            .expect("Trying to call demote with input values.");
-
-        let latter = device
-            .derive(&[])
-            .expect("Trying to call derive after demote.");
-
-        let artifacts = diced_utils::ResidentArtifacts::new(
-            former.cdiAttest[..].try_into().unwrap(),
-            former.cdiSeal[..].try_into().unwrap(),
-            &former.bcc.data,
-        )
-        .unwrap();
-
-        let artifacts = artifacts.execute_steps(input_values.iter()).unwrap();
-        let (cdi_attest, cdi_seal, bcc) = artifacts.into_tuple();
-        let from_former = diced_utils::make_bcc_handover(
-            cdi_attest[..].try_into().unwrap(),
-            cdi_seal[..].try_into().unwrap(),
-            &bcc,
-        )
-        .unwrap();
-        // TODO b/204938506 when we have a parser/verifier, check equivalence rather
-        // than bit by bit equality.
-        assert_eq!(latter, from_former);
-        Ok(())
-    })
-}
diff --git a/security/dice/aidl/vts/functional/dice_test.rs b/security/dice/aidl/vts/functional/dice_test.rs
deleted file mode 100644
index 190f187..0000000
--- a/security/dice/aidl/vts/functional/dice_test.rs
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use diced_sample_inputs;
-use diced_utils;
-use std::convert::TryInto;
-
-mod utils;
-use utils::with_connection;
-
-static TEST_MESSAGE: &[u8] = &[
-    // "My test message!"
-    0x4d, 0x79, 0x20, 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x21,
-    0x0a,
-];
-
-// This test calls derive with an empty argument vector and with a set of three input values.
-// It then performs the same three derivation steps on the result of the former and compares
-// the result to the result of the latter.
-#[test]
-fn equivalence_test() {
-    with_connection(|device| {
-        let input_values = diced_sample_inputs::get_input_values_vector();
-        let former = device.derive(&[]).expect("Trying to call derive.");
-        let latter = device
-            .derive(&input_values)
-            .expect("Trying to call derive with input values.");
-        let artifacts = diced_utils::ResidentArtifacts::new(
-            former.cdiAttest[..].try_into().unwrap(),
-            former.cdiSeal[..].try_into().unwrap(),
-            &former.bcc.data,
-        )
-        .unwrap();
-
-        let artifacts = artifacts.execute_steps(input_values.iter()).unwrap();
-        let (cdi_attest, cdi_seal, bcc) = artifacts.into_tuple();
-        let from_former = diced_utils::make_bcc_handover(
-            cdi_attest[..].try_into().unwrap(),
-            cdi_seal[..].try_into().unwrap(),
-            &bcc,
-        )
-        .unwrap();
-        // TODO b/204938506 when we have a parser/verifier, check equivalence rather
-        // than bit by bit equality.
-        assert_eq!(latter, from_former);
-        Ok(())
-    })
-}
-
-#[test]
-fn sign_and_verify() {
-    with_connection(|device| {
-        let _signature = device
-            .sign(&[], TEST_MESSAGE)
-            .expect("Trying to call sign.");
-
-        let _bcc = device
-            .getAttestationChain(&[])
-            .expect("Trying to call getAttestationChain.");
-        // TODO b/204938506 check the signature with the bcc when the verifier is available.
-        Ok(())
-    })
-}
diff --git a/security/dice/aidl/vts/functional/utils.rs b/security/dice/aidl/vts/functional/utils.rs
deleted file mode 100644
index 4e6708e..0000000
--- a/security/dice/aidl/vts/functional/utils.rs
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2021, The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-use android_hardware_security_dice::aidl::android::hardware::security::dice::IDiceDevice::IDiceDevice;
-use anyhow::Result;
-use binder::Strong;
-use keystore2_vintf::get_aidl_instances;
-use std::sync::Arc;
-
-static DICE_DEVICE_SERVICE_NAME: &str = &"android.hardware.security.dice";
-static DICE_DEVICE_INTERFACE_NAME: &str = &"IDiceDevice";
-
-/// This function iterates through all announced IDiceDevice services and runs the given test
-/// closure against connections to each of them. It also modifies the panic hook to indicate
-/// on which instance the test failed in case the test closure panics.
-pub fn with_connection<R, F>(test: F)
-where
-    F: Fn(&Strong<dyn IDiceDevice>) -> Result<R>,
-{
-    let instances = get_aidl_instances(DICE_DEVICE_SERVICE_NAME, 1, DICE_DEVICE_INTERFACE_NAME);
-    let panic_hook = Arc::new(std::panic::take_hook());
-    for i in instances.into_iter() {
-        let panic_hook_clone = panic_hook.clone();
-        let instance_clone = i.clone();
-        std::panic::set_hook(Box::new(move |v| {
-            println!("While testing instance: \"{}\"", instance_clone);
-            panic_hook_clone(v)
-        }));
-        let connection: Strong<dyn IDiceDevice> = binder::get_interface(&format!(
-            "{}.{}/{}",
-            DICE_DEVICE_SERVICE_NAME, DICE_DEVICE_INTERFACE_NAME, i
-        ))
-        .unwrap();
-        test(&connection).unwrap();
-        drop(std::panic::take_hook());
-    }
-    // Cannot call unwrap here because the panic hook is not Debug.
-    std::panic::set_hook(match Arc::try_unwrap(panic_hook) {
-        Ok(hook) => hook,
-        _ => panic!("Failed to unwrap and reset previous panic hook."),
-    })
-}
diff --git a/security/keymint/aidl/vts/functional/Android.bp b/security/keymint/aidl/vts/functional/Android.bp
index 26e91bd..ed3ca74 100644
--- a/security/keymint/aidl/vts/functional/Android.bp
+++ b/security/keymint/aidl/vts/functional/Android.bp
@@ -35,9 +35,12 @@
         "libbinder_ndk",
         "libcrypto",
         "libbase",
+        "libgatekeeper",
         "packagemanager_aidl-cpp",
     ],
     static_libs: [
+        "android.hardware.gatekeeper@1.0",
+        "android.hardware.gatekeeper-V1-ndk",
         "android.hardware.security.rkp-V3-ndk",
         "android.hardware.security.secureclock-V1-ndk",
         "libcppbor_external",
@@ -59,6 +62,7 @@
     ],
     srcs: [
         "AttestKeyTest.cpp",
+        "AuthTest.cpp",
         "DeviceUniqueAttestationTest.cpp",
         "KeyBlobUpgradeTest.cpp",
         "KeyMintTest.cpp",
diff --git a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
index e46aeee..bbf3633 100644
--- a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
+++ b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
@@ -106,7 +106,7 @@
         // with any other key purpose, but the original VTS tests incorrectly did exactly that.
         // This means that a device that launched prior to Android T (API level 33) may
         // accept or even require KeyPurpose::SIGN too.
-        if (property_get_int32("ro.board.first_api_level", 0) < 33) {
+        if (property_get_int32("ro.board.first_api_level", 0) < __ANDROID_API_T__) {
             AuthorizationSet key_desc_plus_sign = key_desc;
             key_desc_plus_sign.push_back(TAG_PURPOSE, KeyPurpose::SIGN);
 
@@ -142,11 +142,14 @@
         return false;
     }
 
-    // Check if chipset has received a waiver allowing it to be launched with
-    // Android S (or later) with Keymaster 4.0 in StrongBox
+    // Check if chipset has received a waiver allowing it to be launched with Android S or T with
+    // Keymaster 4.0 in StrongBox.
     bool is_chipset_allowed_km4_strongbox(void) const {
         std::array<char, PROPERTY_VALUE_MAX> buffer;
 
+        const int32_t first_api_level = property_get_int32("ro.board.first_api_level", 0);
+        if (first_api_level <= 0 || first_api_level > __ANDROID_API_T__) return false;
+
         auto res = property_get("ro.vendor.qti.soc_model", buffer.data(), nullptr);
         if (res <= 0) return false;
 
@@ -1014,6 +1017,14 @@
                     .Authorization(TAG_ATTESTATION_ID_MEID, "mismatching-meid")
                     .Authorization(TAG_ATTESTATION_ID_MANUFACTURER, "malformed-manufacturer")
                     .Authorization(TAG_ATTESTATION_ID_MODEL, "malicious-model");
+
+    // TODO(b/262255219): Remove this condition when StrongBox supports 2nd IMEI attestation.
+    if (SecLevel() != SecurityLevel::STRONGBOX) {
+        if (isSecondImeiIdAttestationRequired()) {
+            attestation_id_tags.Authorization(TAG_ATTESTATION_ID_SECOND_IMEI,
+                                              "invalid-second-imei");
+        }
+    }
     vector<uint8_t> key_blob;
     vector<KeyCharacteristics> key_characteristics;
 
@@ -1042,6 +1053,178 @@
     CheckedDeleteKey(&attest_key.keyBlob);
 }
 
+TEST_P(AttestKeyTest, SecondIMEIAttestationIDSuccess) {
+    if (is_gsi_image()) {
+        // GSI sets up a standard set of device identifiers that may not match
+        // the device identifiers held by the device.
+        GTEST_SKIP() << "Test not applicable under GSI";
+    }
+
+    // TODO(b/262255219): Remove this condition when StrongBox supports 2nd IMEI attestation.
+    if (SecLevel() == SecurityLevel::STRONGBOX) {
+        GTEST_SKIP() << "Test not applicable for SecurityLevel::STRONGBOX";
+    }
+
+    // Skip the test if there is no second IMEI exists.
+    string second_imei = get_imei(1);
+    if (second_imei.empty() || second_imei.compare("null") == 0) {
+        GTEST_SKIP() << "Test not applicable as there is no second IMEI";
+    }
+
+    if (!isSecondImeiIdAttestationRequired()) {
+        GTEST_SKIP() << "Test not applicable for KeyMint-Version < 3 or first-api-level < 34";
+    }
+
+    // Create attestation key.
+    AttestationKey attest_key;
+    vector<KeyCharacteristics> attest_key_characteristics;
+    vector<Certificate> attest_key_cert_chain;
+    ASSERT_EQ(ErrorCode::OK,
+              GenerateAttestKey(AuthorizationSetBuilder()
+                                        .EcdsaKey(EcCurve::P_256)
+                                        .AttestKey()
+                                        .SetDefaultValidity(),
+                                {} /* attestation signing key */, &attest_key.keyBlob,
+                                &attest_key_characteristics, &attest_key_cert_chain));
+    attest_key.issuerSubjectName = make_name_from_str("Android Keystore Key");
+    EXPECT_EQ(attest_key_cert_chain.size(), 1);
+    EXPECT_TRUE(IsSelfSigned(attest_key_cert_chain));
+
+    // Use attestation key to sign an ECDSA key, but include an attestation ID field.
+    AuthorizationSetBuilder builder = AuthorizationSetBuilder()
+                                              .EcdsaSigningKey(EcCurve::P_256)
+                                              .Authorization(TAG_NO_AUTH_REQUIRED)
+                                              .AttestationChallenge("challenge")
+                                              .AttestationApplicationId("foo")
+                                              .SetDefaultValidity();
+    // b/264979486 - second imei doesn't depend on first imei.
+    // Add second IMEI as attestation id without adding first IMEI as
+    // attestation id.
+    builder.Authorization(TAG_ATTESTATION_ID_SECOND_IMEI, second_imei.data(), second_imei.size());
+
+    vector<uint8_t> attested_key_blob;
+    vector<KeyCharacteristics> attested_key_characteristics;
+    vector<Certificate> attested_key_cert_chain;
+    auto result = GenerateKey(builder, attest_key, &attested_key_blob,
+                              &attested_key_characteristics, &attested_key_cert_chain);
+
+    if (result == ErrorCode::CANNOT_ATTEST_IDS && !isDeviceIdAttestationRequired()) {
+        GTEST_SKIP()
+                << "Test not applicable as device does not support SECOND-IMEI ID attestation.";
+    }
+
+    ASSERT_EQ(result, ErrorCode::OK);
+
+    device_id_attestation_vsr_check(result);
+
+    CheckedDeleteKey(&attested_key_blob);
+
+    AuthorizationSet hw_enforced = HwEnforcedAuthorizations(attested_key_characteristics);
+    AuthorizationSet sw_enforced = SwEnforcedAuthorizations(attested_key_characteristics);
+
+    // The attested key characteristics will not contain APPLICATION_ID_* fields (their
+    // spec definitions all have "Must never appear in KeyCharacteristics"), but the
+    // attestation extension should contain them, so make sure the extra tag is added.
+    vector<uint8_t> imei_blob(second_imei.data(), second_imei.data() + second_imei.size());
+    KeyParameter imei_tag = Authorization(TAG_ATTESTATION_ID_SECOND_IMEI, imei_blob);
+    hw_enforced.push_back(imei_tag);
+
+    EXPECT_TRUE(verify_attestation_record(AidlVersion(), "challenge", "foo", sw_enforced,
+                                          hw_enforced, SecLevel(),
+                                          attested_key_cert_chain[0].encodedCertificate));
+
+    CheckedDeleteKey(&attest_key.keyBlob);
+}
+
+TEST_P(AttestKeyTest, MultipleIMEIAttestationIDSuccess) {
+    if (is_gsi_image()) {
+        // GSI sets up a standard set of device identifiers that may not match
+        // the device identifiers held by the device.
+        GTEST_SKIP() << "Test not applicable under GSI";
+    }
+
+    // TODO(b/262255219): Remove this condition when StrongBox supports 2nd IMEI attestation.
+    if (SecLevel() == SecurityLevel::STRONGBOX) {
+        GTEST_SKIP() << "Test not applicable for SecurityLevel::STRONGBOX";
+    }
+
+    // Skip the test if there is no first IMEI exists.
+    string imei = get_imei(0);
+    if (imei.empty() || imei.compare("null") == 0) {
+        GTEST_SKIP() << "Test not applicable as there is no first IMEI";
+    }
+
+    // Skip the test if there is no second IMEI exists.
+    string second_imei = get_imei(1);
+    if (second_imei.empty() || second_imei.compare("null") == 0) {
+        GTEST_SKIP() << "Test not applicable as there is no second IMEI";
+    }
+
+    if (!isSecondImeiIdAttestationRequired()) {
+        GTEST_SKIP() << "Test not applicable for KeyMint-Version < 3 or first-api-level < 34";
+    }
+
+    // Create attestation key.
+    AttestationKey attest_key;
+    vector<KeyCharacteristics> attest_key_characteristics;
+    vector<Certificate> attest_key_cert_chain;
+    ASSERT_EQ(ErrorCode::OK,
+              GenerateAttestKey(AuthorizationSetBuilder()
+                                        .EcdsaKey(EcCurve::P_256)
+                                        .AttestKey()
+                                        .SetDefaultValidity(),
+                                {} /* attestation signing key */, &attest_key.keyBlob,
+                                &attest_key_characteristics, &attest_key_cert_chain));
+    attest_key.issuerSubjectName = make_name_from_str("Android Keystore Key");
+    EXPECT_EQ(attest_key_cert_chain.size(), 1);
+    EXPECT_TRUE(IsSelfSigned(attest_key_cert_chain));
+
+    // Use attestation key to sign an ECDSA key, but include both IMEI attestation ID fields.
+    AuthorizationSetBuilder builder = AuthorizationSetBuilder()
+                                              .EcdsaSigningKey(EcCurve::P_256)
+                                              .Authorization(TAG_NO_AUTH_REQUIRED)
+                                              .AttestationChallenge("challenge")
+                                              .AttestationApplicationId("foo")
+                                              .SetDefaultValidity();
+    builder.Authorization(TAG_ATTESTATION_ID_IMEI, imei.data(), imei.size());
+    builder.Authorization(TAG_ATTESTATION_ID_SECOND_IMEI, second_imei.data(), second_imei.size());
+
+    vector<uint8_t> attested_key_blob;
+    vector<KeyCharacteristics> attested_key_characteristics;
+    vector<Certificate> attested_key_cert_chain;
+    auto result = GenerateKey(builder, attest_key, &attested_key_blob,
+                              &attested_key_characteristics, &attested_key_cert_chain);
+
+    if (result == ErrorCode::CANNOT_ATTEST_IDS && !isDeviceIdAttestationRequired()) {
+        GTEST_SKIP() << "Test not applicable as device does not support IMEI ID attestation.";
+    }
+
+    ASSERT_EQ(result, ErrorCode::OK);
+
+    device_id_attestation_vsr_check(result);
+
+    CheckedDeleteKey(&attested_key_blob);
+
+    AuthorizationSet hw_enforced = HwEnforcedAuthorizations(attested_key_characteristics);
+    AuthorizationSet sw_enforced = SwEnforcedAuthorizations(attested_key_characteristics);
+
+    // The attested key characteristics will not contain APPLICATION_ID_* fields (their
+    // spec definitions all have "Must never appear in KeyCharacteristics"), but the
+    // attestation extension should contain them, so make sure the extra tag is added.
+    vector<uint8_t> imei_blob(imei.data(), imei.data() + imei.size());
+    KeyParameter imei_tag = Authorization(TAG_ATTESTATION_ID_IMEI, imei_blob);
+    hw_enforced.push_back(imei_tag);
+    vector<uint8_t> sec_imei_blob(second_imei.data(), second_imei.data() + second_imei.size());
+    KeyParameter sec_imei_tag = Authorization(TAG_ATTESTATION_ID_SECOND_IMEI, sec_imei_blob);
+    hw_enforced.push_back(sec_imei_tag);
+
+    EXPECT_TRUE(verify_attestation_record(AidlVersion(), "challenge", "foo", sw_enforced,
+                                          hw_enforced, SecLevel(),
+                                          attested_key_cert_chain[0].encodedCertificate));
+
+    CheckedDeleteKey(&attest_key.keyBlob);
+}
+
 INSTANTIATE_KEYMINT_AIDL_TEST(AttestKeyTest);
 
 }  // namespace aidl::android::hardware::security::keymint::test
diff --git a/security/keymint/aidl/vts/functional/AuthTest.cpp b/security/keymint/aidl/vts/functional/AuthTest.cpp
new file mode 100644
index 0000000..a31ac01
--- /dev/null
+++ b/security/keymint/aidl/vts/functional/AuthTest.cpp
@@ -0,0 +1,412 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "keymint_1_test"
+#include <cutils/log.h>
+
+#include <iostream>
+#include <optional>
+
+#include "KeyMintAidlTestBase.h"
+
+#include <aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.h>
+#include <aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.h>
+#include <aidl/android/hardware/gatekeeper/IGatekeeper.h>
+#include <aidl/android/hardware/security/secureclock/ISecureClock.h>
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+
+using aidl::android::hardware::gatekeeper::GatekeeperEnrollResponse;
+using aidl::android::hardware::gatekeeper::GatekeeperVerifyResponse;
+using aidl::android::hardware::gatekeeper::IGatekeeper;
+using aidl::android::hardware::security::keymint::HardwareAuthToken;
+using aidl::android::hardware::security::secureclock::ISecureClock;
+
+#include <android/hardware/gatekeeper/1.0/IGatekeeper.h>
+#include <android/hardware/gatekeeper/1.0/types.h>
+#include <gatekeeper/password_handle.h>  // for password_handle_t
+#include <hardware/hw_auth_token.h>
+
+using ::android::sp;
+using IHidlGatekeeper = ::android::hardware::gatekeeper::V1_0::IGatekeeper;
+using HidlGatekeeperResponse = ::android::hardware::gatekeeper::V1_0::GatekeeperResponse;
+using HidlGatekeeperStatusCode = ::android::hardware::gatekeeper::V1_0::GatekeeperStatusCode;
+
+namespace aidl::android::hardware::security::keymint::test {
+
+class AuthTest : public KeyMintAidlTestBase {
+  public:
+    void SetUp() {
+        KeyMintAidlTestBase::SetUp();
+
+        // Find the default Gatekeeper instance.
+        string gk_name = string(IGatekeeper::descriptor) + "/default";
+        if (AServiceManager_isDeclared(gk_name.c_str())) {
+            // Enroll a user with AIDL Gatekeeper.
+            ::ndk::SpAIBinder binder(AServiceManager_waitForService(gk_name.c_str()));
+            gk_ = IGatekeeper::fromBinder(binder);
+        } else {
+            // Prior to Android U, Gatekeeper was HIDL not AIDL and so may not be present.
+            // Try to enroll user with HIDL Gatekeeper instead.
+            string gk_name = "default";
+            hidl_gk_ = IHidlGatekeeper::getService(gk_name.c_str());
+            if (hidl_gk_ == nullptr) {
+                std::cerr << "No HIDL Gatekeeper instance for '" << gk_name << "' found.\n";
+                return;
+            }
+            std::cerr << "No AIDL Gatekeeper instance for '" << gk_name << "' found, using HIDL.\n";
+        }
+
+        // If the device needs timestamps, find the default ISecureClock instance.
+        if (timestamp_token_required_) {
+            string clock_name = string(ISecureClock::descriptor) + "/default";
+            if (AServiceManager_isDeclared(clock_name.c_str())) {
+                ::ndk::SpAIBinder binder(AServiceManager_waitForService(clock_name.c_str()));
+                clock_ = ISecureClock::fromBinder(binder);
+            } else {
+                std::cerr << "No ISecureClock instance for '" << clock_name << "' found.\n";
+            }
+        }
+
+        // Enroll a password for a user.
+        uid_ = 10001;
+        password_ = "correcthorsebatterystaple";
+        std::optional<GatekeeperEnrollResponse> rsp = doEnroll(password_);
+        ASSERT_TRUE(rsp.has_value());
+        sid_ = rsp->secureUserId;
+        handle_ = rsp->data;
+    }
+
+    void TearDown() {
+        if (gk_ == nullptr) return;
+        gk_->deleteUser(uid_);
+    }
+
+    bool GatekeeperAvailable() { return (gk_ != nullptr) || (hidl_gk_ != nullptr); }
+
+    std::optional<GatekeeperEnrollResponse> doEnroll(const std::vector<uint8_t>& newPwd,
+                                                     const std::vector<uint8_t>& curHandle = {},
+                                                     const std::vector<uint8_t>& curPwd = {}) {
+        if (gk_ != nullptr) {
+            while (true) {
+                GatekeeperEnrollResponse rsp;
+                Status status = gk_->enroll(uid_, curHandle, curPwd, newPwd, &rsp);
+                if (!status.isOk() && status.getExceptionCode() == EX_SERVICE_SPECIFIC &&
+                    status.getServiceSpecificError() == IGatekeeper::ERROR_RETRY_TIMEOUT) {
+                    sleep(1);
+                    continue;
+                }
+                if (status.isOk()) {
+                    return std::move(rsp);
+                } else {
+                    GTEST_LOG_(ERROR) << "doEnroll(AIDL) failed: " << status;
+                    return std::nullopt;
+                }
+            }
+        } else if (hidl_gk_ != nullptr) {
+            while (true) {
+                HidlGatekeeperResponse rsp;
+                auto status = hidl_gk_->enroll(
+                        uid_, curHandle, curPwd, newPwd,
+                        [&rsp](const HidlGatekeeperResponse& cbRsp) { rsp = cbRsp; });
+                if (!status.isOk()) {
+                    GTEST_LOG_(ERROR) << "doEnroll(HIDL) failed";
+                    return std::nullopt;
+                }
+                if (rsp.code == HidlGatekeeperStatusCode::ERROR_RETRY_TIMEOUT) {
+                    sleep(1);
+                    continue;
+                }
+                if (rsp.code != HidlGatekeeperStatusCode::STATUS_OK) {
+                    GTEST_LOG_(ERROR) << "doEnroll(HIDL) failed with " << int(rsp.code);
+                    return std::nullopt;
+                }
+                // "Parse" the returned data to get at the secure user ID.
+                if (rsp.data.size() != sizeof(::gatekeeper::password_handle_t)) {
+                    GTEST_LOG_(ERROR)
+                            << "HAL returned password handle of invalid length " << rsp.data.size();
+                    return std::nullopt;
+                }
+                const ::gatekeeper::password_handle_t* handle =
+                        reinterpret_cast<const ::gatekeeper::password_handle_t*>(rsp.data.data());
+
+                // Translate HIDL response to look like an AIDL response.
+                GatekeeperEnrollResponse aidl_rsp;
+                aidl_rsp.statusCode = IGatekeeper::STATUS_OK;
+                aidl_rsp.data = rsp.data;
+                aidl_rsp.secureUserId = handle->user_id;
+                return aidl_rsp;
+            }
+        } else {
+            return std::nullopt;
+        }
+    }
+
+    std::optional<GatekeeperEnrollResponse> doEnroll(const string& newPwd,
+                                                     const std::vector<uint8_t>& curHandle = {},
+                                                     const string& curPwd = {}) {
+        return doEnroll(std::vector<uint8_t>(newPwd.begin(), newPwd.end()), curHandle,
+                        std::vector<uint8_t>(curPwd.begin(), curPwd.end()));
+    }
+
+    std::optional<HardwareAuthToken> doVerify(uint64_t challenge,
+                                              const std::vector<uint8_t>& handle,
+                                              const std::vector<uint8_t>& pwd) {
+        if (gk_ != nullptr) {
+            while (true) {
+                GatekeeperVerifyResponse rsp;
+                Status status = gk_->verify(uid_, challenge, handle, pwd, &rsp);
+                if (!status.isOk() && status.getExceptionCode() == EX_SERVICE_SPECIFIC &&
+                    status.getServiceSpecificError() == IGatekeeper::ERROR_RETRY_TIMEOUT) {
+                    sleep(1);
+                    continue;
+                }
+                if (status.isOk()) {
+                    return rsp.hardwareAuthToken;
+                } else {
+                    GTEST_LOG_(ERROR) << "doVerify(AIDL) failed: " << status;
+                    return std::nullopt;
+                }
+            }
+        } else if (hidl_gk_ != nullptr) {
+            while (true) {
+                HidlGatekeeperResponse rsp;
+                auto status = hidl_gk_->verify(
+                        uid_, challenge, handle, pwd,
+                        [&rsp](const HidlGatekeeperResponse& cbRsp) { rsp = cbRsp; });
+                if (!status.isOk()) {
+                    GTEST_LOG_(ERROR) << "doVerify(HIDL) failed";
+                    return std::nullopt;
+                }
+                if (rsp.code == HidlGatekeeperStatusCode::ERROR_RETRY_TIMEOUT) {
+                    sleep(1);
+                    continue;
+                }
+                if (rsp.code != HidlGatekeeperStatusCode::STATUS_OK) {
+                    GTEST_LOG_(ERROR) << "doVerify(HIDL) failed with " << int(rsp.code);
+                    return std::nullopt;
+                }
+                // "Parse" the returned data to get auth token contents.
+                if (rsp.data.size() != sizeof(hw_auth_token_t)) {
+                    GTEST_LOG_(ERROR) << "Incorrect size of AuthToken payload.";
+                    return std::nullopt;
+                }
+                const hw_auth_token_t* hwAuthToken =
+                        reinterpret_cast<const hw_auth_token_t*>(rsp.data.data());
+                HardwareAuthToken authToken;
+                authToken.timestamp.milliSeconds = betoh64(hwAuthToken->timestamp);
+                authToken.challenge = hwAuthToken->challenge;
+                authToken.userId = hwAuthToken->user_id;
+                authToken.authenticatorId = hwAuthToken->authenticator_id;
+                authToken.authenticatorType = static_cast<HardwareAuthenticatorType>(
+                        betoh32(hwAuthToken->authenticator_type));
+                authToken.mac.assign(&hwAuthToken->hmac[0], &hwAuthToken->hmac[32]);
+                return authToken;
+            }
+        } else {
+            return std::nullopt;
+        }
+    }
+    std::optional<HardwareAuthToken> doVerify(uint64_t challenge,
+                                              const std::vector<uint8_t>& handle,
+                                              const string& pwd) {
+        return doVerify(challenge, handle, std::vector<uint8_t>(pwd.begin(), pwd.end()));
+    }
+
+    // Variants of the base class methods but with authentication information included.
+    string ProcessMessage(const vector<uint8_t>& key_blob, KeyPurpose operation,
+                          const string& message, const AuthorizationSet& in_params,
+                          AuthorizationSet* out_params, const HardwareAuthToken& hat) {
+        AuthorizationSet begin_out_params;
+        ErrorCode result = Begin(operation, key_blob, in_params, out_params, hat);
+        EXPECT_EQ(ErrorCode::OK, result);
+        if (result != ErrorCode::OK) {
+            return "";
+        }
+
+        std::optional<secureclock::TimeStampToken> time_token = std::nullopt;
+        if (timestamp_token_required_ && clock_ != nullptr) {
+            // Ask a secure clock instance for a timestamp, including the per-op challenge.
+            secureclock::TimeStampToken token;
+            EXPECT_EQ(ErrorCode::OK,
+                      GetReturnErrorCode(clock_->generateTimeStamp(challenge_, &token)));
+            time_token = token;
+        }
+
+        string output;
+        EXPECT_EQ(ErrorCode::OK, Finish(message, {} /* signature */, &output, hat, time_token));
+        return output;
+    }
+
+    string EncryptMessage(const vector<uint8_t>& key_blob, const string& message,
+                          const AuthorizationSet& in_params, AuthorizationSet* out_params,
+                          const HardwareAuthToken& hat) {
+        SCOPED_TRACE("EncryptMessage");
+        return ProcessMessage(key_blob, KeyPurpose::ENCRYPT, message, in_params, out_params, hat);
+    }
+
+    string DecryptMessage(const vector<uint8_t>& key_blob, const string& ciphertext,
+                          const AuthorizationSet& params, const HardwareAuthToken& hat) {
+        SCOPED_TRACE("DecryptMessage");
+        AuthorizationSet out_params;
+        string plaintext =
+                ProcessMessage(key_blob, KeyPurpose::DECRYPT, ciphertext, params, &out_params, hat);
+        EXPECT_TRUE(out_params.empty());
+        return plaintext;
+    }
+
+  protected:
+    std::shared_ptr<IGatekeeper> gk_;
+    sp<IHidlGatekeeper> hidl_gk_;
+    std::shared_ptr<ISecureClock> clock_;
+    string password_;
+    uint32_t uid_;
+    long sid_;
+    std::vector<uint8_t> handle_;
+};
+
+// Test use of a key that requires user-authentication within recent history.
+TEST_P(AuthTest, TimeoutAuthentication) {
+    if (!GatekeeperAvailable()) {
+        GTEST_SKIP() << "No Gatekeeper available";
+    }
+    if (timestamp_token_required_ && clock_ == nullptr) {
+        GTEST_SKIP() << "Device requires timestamps and no ISecureClock available";
+    }
+
+    // Create an AES key that requires authentication within the last 3 seconds.
+    const uint32_t timeout_secs = 3;
+    auto builder = AuthorizationSetBuilder()
+                           .AesEncryptionKey(256)
+                           .BlockMode(BlockMode::ECB)
+                           .Padding(PaddingMode::PKCS7)
+                           .Authorization(TAG_USER_SECURE_ID, sid_)
+                           .Authorization(TAG_USER_AUTH_TYPE, HardwareAuthenticatorType::PASSWORD)
+                           .Authorization(TAG_AUTH_TIMEOUT, timeout_secs);
+    vector<uint8_t> keyblob;
+    vector<KeyCharacteristics> key_characteristics;
+    vector<Certificate> cert_chain;
+    ASSERT_EQ(ErrorCode::OK,
+              GenerateKey(builder, std::nullopt, &keyblob, &key_characteristics, &cert_chain));
+
+    // Attempt to use the AES key without authentication.
+    const string message = "Hello World!";
+    AuthorizationSet out_params;
+    auto params = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::PKCS7);
+    EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+              Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params));
+
+    // Verify to get a HAT, arbitrary challenge.
+    const uint64_t challenge = 42;
+    const std::optional<HardwareAuthToken> hat = doVerify(challenge, handle_, password_);
+    ASSERT_TRUE(hat.has_value());
+    EXPECT_EQ(hat->userId, sid_);
+
+    // Adding the auth token makes it possible to use the AES key.
+    const string ciphertext = EncryptMessage(keyblob, message, params, &out_params, hat.value());
+    const string plaintext = DecryptMessage(keyblob, ciphertext, params, hat.value());
+    EXPECT_EQ(message, plaintext);
+
+    // Altering a single bit in the MAC means no auth.
+    HardwareAuthToken dodgy_hat = hat.value();
+    ASSERT_GT(dodgy_hat.mac.size(), 0);
+    dodgy_hat.mac[0] ^= 0x01;
+    EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+              Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, dodgy_hat));
+
+    // Wait for long enough that the hardware auth token expires.
+    sleep(timeout_secs + 1);
+    if (!timestamp_token_required_) {
+        // KeyMint implementation has its own clock, and can immediately detect timeout.
+        EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+                  Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
+    } else {
+        // KeyMint implementation has no clock, so only detects timeout via timestamp token provided
+        // on update()/finish().
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
+        secureclock::TimeStampToken time_token;
+        EXPECT_EQ(ErrorCode::OK,
+                  GetReturnErrorCode(clock_->generateTimeStamp(challenge_, &time_token)));
+
+        string output;
+        EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+                  Finish(message, {} /* signature */, &output, hat, time_token));
+    }
+}
+
+// Test use of a key that requires an auth token for each action on the operation, with
+// a per-operation challenge value included.
+TEST_P(AuthTest, AuthPerOperation) {
+    if (!GatekeeperAvailable()) {
+        GTEST_SKIP() << "No Gatekeeper available";
+    }
+
+    // Create an AES key that requires authentication per-action.
+    auto builder = AuthorizationSetBuilder()
+                           .AesEncryptionKey(256)
+                           .BlockMode(BlockMode::ECB)
+                           .Padding(PaddingMode::PKCS7)
+                           .Authorization(TAG_USER_SECURE_ID, sid_)
+                           .Authorization(TAG_USER_AUTH_TYPE, HardwareAuthenticatorType::PASSWORD);
+    vector<uint8_t> keyblob;
+    vector<KeyCharacteristics> key_characteristics;
+    vector<Certificate> cert_chain;
+    ASSERT_EQ(ErrorCode::OK,
+              GenerateKey(builder, std::nullopt, &keyblob, &key_characteristics, &cert_chain));
+
+    // Attempt to use the AES key without authentication fails after begin.
+    const string message = "Hello World!";
+    AuthorizationSet out_params;
+    auto params = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::PKCS7);
+    EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params));
+    string output;
+    EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED, Finish(message, {} /* signature */, &output));
+
+    // Verify to get a HAT, but with an arbitrary challenge.
+    const uint64_t unrelated_challenge = 42;
+    const std::optional<HardwareAuthToken> unrelated_hat =
+            doVerify(unrelated_challenge, handle_, password_);
+    ASSERT_TRUE(unrelated_hat.has_value());
+    EXPECT_EQ(unrelated_hat->userId, sid_);
+
+    // Attempt to use the AES key with an unrelated authentication fails after begin.
+    EXPECT_EQ(ErrorCode::OK,
+              Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, unrelated_hat.value()));
+    EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+              Finish(message, {} /* signature */, &output, unrelated_hat.value()));
+
+    // Now get a HAT with the challenge from an in-progress operation.
+    EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params));
+    const std::optional<HardwareAuthToken> hat = doVerify(challenge_, handle_, password_);
+    ASSERT_TRUE(hat.has_value());
+    EXPECT_EQ(hat->userId, sid_);
+    string ciphertext;
+    EXPECT_EQ(ErrorCode::OK, Finish(message, {} /* signature */, &ciphertext, hat.value()));
+
+    // Altering a single bit in the MAC means no auth.
+    EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params));
+    std::optional<HardwareAuthToken> dodgy_hat = doVerify(challenge_, handle_, password_);
+    ASSERT_TRUE(dodgy_hat.has_value());
+    EXPECT_EQ(dodgy_hat->userId, sid_);
+    ASSERT_GT(dodgy_hat->mac.size(), 0);
+    dodgy_hat->mac[0] ^= 0x01;
+    EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
+              Finish(message, {} /* signature */, &ciphertext, hat.value()));
+}
+
+INSTANTIATE_KEYMINT_AIDL_TEST(AuthTest);
+
+}  // namespace aidl::android::hardware::security::keymint::test
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 588a1d4..fb5ef49 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -108,27 +108,6 @@
     return true;
 }
 
-// Extract attestation record from cert. Returned object is still part of cert; don't free it
-// separately.
-ASN1_OCTET_STRING* get_attestation_record(X509* certificate) {
-    ASN1_OBJECT_Ptr oid(OBJ_txt2obj(kAttestionRecordOid, 1 /* dotted string format */));
-    EXPECT_TRUE(!!oid.get());
-    if (!oid.get()) return nullptr;
-
-    int location = X509_get_ext_by_OBJ(certificate, oid.get(), -1 /* search from beginning */);
-    EXPECT_NE(-1, location) << "Attestation extension not found in certificate";
-    if (location == -1) return nullptr;
-
-    X509_EXTENSION* attest_rec_ext = X509_get_ext(certificate, location);
-    EXPECT_TRUE(!!attest_rec_ext)
-            << "Found attestation extension but couldn't retrieve it?  Probably a BoringSSL bug.";
-    if (!attest_rec_ext) return nullptr;
-
-    ASN1_OCTET_STRING* attest_rec = X509_EXTENSION_get_data(attest_rec_ext);
-    EXPECT_TRUE(!!attest_rec) << "Attestation extension contained no data";
-    return attest_rec;
-}
-
 void check_attestation_version(uint32_t attestation_version, int32_t aidl_version) {
     // Version numbers in attestation extensions should be a multiple of 100.
     EXPECT_EQ(attestation_version % 100, 0);
@@ -214,7 +193,15 @@
  * which is mandatory for KeyMint version 2 or first_api_level 33 or greater.
  */
 bool KeyMintAidlTestBase::isDeviceIdAttestationRequired() {
-    return AidlVersion() >= 2 || property_get_int32("ro.vendor.api_level", 0) >= 33;
+    return AidlVersion() >= 2 || property_get_int32("ro.vendor.api_level", 0) >= __ANDROID_API_T__;
+}
+
+/**
+ * An API to determine second IMEI ID attestation is required or not,
+ * which is supported for KeyMint version 3 or first_api_level greater than 33.
+ */
+bool KeyMintAidlTestBase::isSecondImeiIdAttestationRequired() {
+    return AidlVersion() >= 3 && property_get_int32("ro.vendor.api_level", 0) > __ANDROID_API_T__;
 }
 
 bool KeyMintAidlTestBase::Curve25519Supported() {
@@ -544,12 +531,13 @@
 
 ErrorCode KeyMintAidlTestBase::Begin(KeyPurpose purpose, const vector<uint8_t>& key_blob,
                                      const AuthorizationSet& in_params,
-                                     AuthorizationSet* out_params) {
+                                     AuthorizationSet* out_params,
+                                     std::optional<HardwareAuthToken> hat) {
     SCOPED_TRACE("Begin");
     Status result;
     BeginResult out;
 
-    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), std::nullopt, &out);
+    result = keymint_->begin(purpose, key_blob, in_params.vector_data(), hat, &out);
 
     if (result.isOk()) {
         *out_params = out.params;
@@ -603,8 +591,9 @@
     return GetReturnErrorCode(result);
 }
 
-ErrorCode KeyMintAidlTestBase::Finish(const string& input, const string& signature,
-                                      string* output) {
+ErrorCode KeyMintAidlTestBase::Finish(const string& input, const string& signature, string* output,
+                                      std::optional<HardwareAuthToken> hat,
+                                      std::optional<secureclock::TimeStampToken> time_token) {
     SCOPED_TRACE("Finish");
     Status result;
 
@@ -613,8 +602,8 @@
 
     vector<uint8_t> oPut;
     result = op_->finish(vector<uint8_t>(input.begin(), input.end()),
-                         vector<uint8_t>(signature.begin(), signature.end()), {} /* authToken */,
-                         {} /* timestampToken */, {} /* confirmationToken */, &oPut);
+                         vector<uint8_t>(signature.begin(), signature.end()), hat, time_token,
+                         {} /* confirmationToken */, &oPut);
 
     if (result.isOk()) output->append(oPut.begin(), oPut.end());
 
@@ -837,7 +826,7 @@
         int vendor_api_level = property_get_int32("ro.vendor.api_level", 0);
         if (SecLevel() == SecurityLevel::STRONGBOX) {
             // This is known to be broken on older vendor implementations.
-            if (vendor_api_level < 33) {
+            if (vendor_api_level < __ANDROID_API_T__) {
                 compare_output = false;
             } else {
                 additional_information = " (b/194134359) ";
@@ -1743,38 +1732,33 @@
     EXPECT_EQ(security_level, att_keymint_security_level);
     EXPECT_EQ(security_level, att_attestation_security_level);
 
-    // TODO(b/136282179): When running under VTS-on-GSI the TEE-backed
-    // keymint implementation will report YYYYMM dates instead of YYYYMMDD
-    // for the BOOT_PATCH_LEVEL.
-    if (avb_verification_enabled()) {
-        for (int i = 0; i < att_hw_enforced.size(); i++) {
-            if (att_hw_enforced[i].tag == TAG_BOOT_PATCHLEVEL ||
-                att_hw_enforced[i].tag == TAG_VENDOR_PATCHLEVEL) {
-                std::string date =
-                        std::to_string(att_hw_enforced[i].value.get<KeyParameterValue::integer>());
+    for (int i = 0; i < att_hw_enforced.size(); i++) {
+        if (att_hw_enforced[i].tag == TAG_BOOT_PATCHLEVEL ||
+            att_hw_enforced[i].tag == TAG_VENDOR_PATCHLEVEL) {
+            std::string date =
+                    std::to_string(att_hw_enforced[i].value.get<KeyParameterValue::integer>());
 
-                // strptime seems to require delimiters, but the tag value will
-                // be YYYYMMDD
-                if (date.size() != 8) {
-                    ADD_FAILURE() << "Tag " << att_hw_enforced[i].tag
-                                  << " with invalid format (not YYYYMMDD): " << date;
-                    return false;
-                }
-                date.insert(6, "-");
-                date.insert(4, "-");
-                struct tm time;
-                strptime(date.c_str(), "%Y-%m-%d", &time);
-
-                // Day of the month (0-31)
-                EXPECT_GE(time.tm_mday, 0);
-                EXPECT_LT(time.tm_mday, 32);
-                // Months since Jan (0-11)
-                EXPECT_GE(time.tm_mon, 0);
-                EXPECT_LT(time.tm_mon, 12);
-                // Years since 1900
-                EXPECT_GT(time.tm_year, 110);
-                EXPECT_LT(time.tm_year, 200);
+            // strptime seems to require delimiters, but the tag value will
+            // be YYYYMMDD
+            if (date.size() != 8) {
+                ADD_FAILURE() << "Tag " << att_hw_enforced[i].tag
+                              << " with invalid format (not YYYYMMDD): " << date;
+                return false;
             }
+            date.insert(6, "-");
+            date.insert(4, "-");
+            struct tm time;
+            strptime(date.c_str(), "%Y-%m-%d", &time);
+
+            // Day of the month (0-31)
+            EXPECT_GE(time.tm_mday, 0);
+            EXPECT_LT(time.tm_mday, 32);
+            // Months since Jan (0-11)
+            EXPECT_GE(time.tm_mon, 0);
+            EXPECT_LT(time.tm_mon, 12);
+            // Years since 1900
+            EXPECT_GT(time.tm_year, 110);
+            EXPECT_LT(time.tm_year, 200);
         }
     }
 
@@ -1896,6 +1880,27 @@
     return X509_Ptr(d2i_X509(nullptr /* allocate new */, &p, blob.size()));
 }
 
+// Extract attestation record from cert. Returned object is still part of cert; don't free it
+// separately.
+ASN1_OCTET_STRING* get_attestation_record(X509* certificate) {
+    ASN1_OBJECT_Ptr oid(OBJ_txt2obj(kAttestionRecordOid, 1 /* dotted string format */));
+    EXPECT_TRUE(!!oid.get());
+    if (!oid.get()) return nullptr;
+
+    int location = X509_get_ext_by_OBJ(certificate, oid.get(), -1 /* search from beginning */);
+    EXPECT_NE(-1, location) << "Attestation extension not found in certificate";
+    if (location == -1) return nullptr;
+
+    X509_EXTENSION* attest_rec_ext = X509_get_ext(certificate, location);
+    EXPECT_TRUE(!!attest_rec_ext)
+            << "Found attestation extension but couldn't retrieve it?  Probably a BoringSSL bug.";
+    if (!attest_rec_ext) return nullptr;
+
+    ASN1_OCTET_STRING* attest_rec = X509_EXTENSION_get_data(attest_rec_ext);
+    EXPECT_TRUE(!!attest_rec) << "Attestation extension contained no data";
+    return attest_rec;
+}
+
 vector<uint8_t> make_name_from_str(const string& name) {
     X509_NAME_Ptr x509_name(X509_NAME_new());
     EXPECT_TRUE(x509_name.get() != nullptr);
@@ -2040,7 +2045,7 @@
 }
 
 void device_id_attestation_vsr_check(const ErrorCode& result) {
-    if (get_vsr_api_level() >= 34) {
+    if (get_vsr_api_level() > __ANDROID_API_T__) {
         ASSERT_FALSE(result == ErrorCode::INVALID_TAG)
                 << "It is a specification violation for INVALID_TAG to be returned due to ID "
                 << "mismatch in a Device ID Attestation call. INVALID_TAG is only intended to "
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
index fae9459..a6a9df6 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
@@ -85,6 +85,7 @@
     uint32_t boot_patch_level(const vector<KeyCharacteristics>& key_characteristics);
     uint32_t boot_patch_level();
     bool isDeviceIdAttestationRequired();
+    bool isSecondImeiIdAttestationRequired();
 
     bool Curve25519Supported();
 
@@ -160,7 +161,8 @@
                     const AuthorizationSet& in_params, AuthorizationSet* out_params,
                     std::shared_ptr<IKeyMintOperation>& op);
     ErrorCode Begin(KeyPurpose purpose, const vector<uint8_t>& key_blob,
-                    const AuthorizationSet& in_params, AuthorizationSet* out_params);
+                    const AuthorizationSet& in_params, AuthorizationSet* out_params,
+                    std::optional<HardwareAuthToken> hat = std::nullopt);
     ErrorCode Begin(KeyPurpose purpose, const AuthorizationSet& in_params,
                     AuthorizationSet* out_params);
     ErrorCode Begin(KeyPurpose purpose, const AuthorizationSet& in_params);
@@ -168,7 +170,9 @@
     ErrorCode UpdateAad(const string& input);
     ErrorCode Update(const string& input, string* output);
 
-    ErrorCode Finish(const string& message, const string& signature, string* output);
+    ErrorCode Finish(const string& message, const string& signature, string* output,
+                     std::optional<HardwareAuthToken> hat = std::nullopt,
+                     std::optional<secureclock::TimeStampToken> time_token = std::nullopt);
     ErrorCode Finish(const string& message, string* output) {
         return Finish(message, {} /* signature */, output);
     }
@@ -397,6 +401,7 @@
 
 string bin2hex(const vector<uint8_t>& data);
 X509_Ptr parse_cert_blob(const vector<uint8_t>& blob);
+ASN1_OCTET_STRING* get_attestation_record(X509* certificate);
 vector<uint8_t> make_name_from_str(const string& name);
 void check_maced_pubkey(const MacedPublicKey& macedPubKey, bool testMode,
                         vector<uint8_t>* payload_value);
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 1b9e758..9e66f08 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -1136,7 +1136,7 @@
  * that has been generated using an associate IRemotelyProvisionedComponent.
  */
 TEST_P(NewKeyGenerationTest, RsaWithRkpAttestation) {
-    if (get_vsr_api_level() < 32 || AidlVersion() < 2) {
+    if (get_vsr_api_level() < __ANDROID_API_T__ || AidlVersion() < 2) {
         GTEST_SKIP() << "Only required for VSR 12+ and KeyMint 2+";
     }
 
@@ -1214,7 +1214,7 @@
  * that has been generated using an associate IRemotelyProvisionedComponent.
  */
 TEST_P(NewKeyGenerationTest, EcdsaWithRkpAttestation) {
-    if (get_vsr_api_level() < 32 || AidlVersion() < 2) {
+    if (get_vsr_api_level() < __ANDROID_API_T__ || AidlVersion() < 2) {
         GTEST_SKIP() << "Only required for VSR 12+ and KeyMint 2+";
     }
 
@@ -8629,7 +8629,7 @@
 
 TEST_P(VsrRequirementTest, Vsr13Test) {
     int vsr_api_level = get_vsr_api_level();
-    if (vsr_api_level < 33) {
+    if (vsr_api_level < __ANDROID_API_T__) {
         GTEST_SKIP() << "Applies only to VSR API level 33, this device is: " << vsr_api_level;
     }
     EXPECT_GE(AidlVersion(), 2) << "VSR 13+ requires KeyMint version 2";
@@ -8637,7 +8637,7 @@
 
 TEST_P(VsrRequirementTest, Vsr14Test) {
     int vsr_api_level = get_vsr_api_level();
-    if (vsr_api_level < 34) {
+    if (vsr_api_level < __ANDROID_API_U__) {
         GTEST_SKIP() << "Applies only to VSR API level 34, this device is: " << vsr_api_level;
     }
     EXPECT_GE(AidlVersion(), 3) << "VSR 14+ requires KeyMint version 3";
diff --git a/security/keymint/aidl/vts/performance/KeyMintBenchmark.cpp b/security/keymint/aidl/vts/performance/KeyMintBenchmark.cpp
index 0c61c25..49fd0c9 100644
--- a/security/keymint/aidl/vts/performance/KeyMintBenchmark.cpp
+++ b/security/keymint/aidl/vts/performance/KeyMintBenchmark.cpp
@@ -68,7 +68,7 @@
 
     int getError() { return static_cast<int>(error_); }
 
-    const string& GenerateMessage(int size) {
+    const string GenerateMessage(int size) {
         for (const string& message : message_cache_) {
             if (message.size() == size) {
                 return message;
@@ -76,7 +76,7 @@
         }
         string message = string(size, 'x');
         message_cache_.push_back(message);
-        return std::move(message);
+        return message;
     }
 
     optional<BlockMode> getBlockMode(string transform) {
diff --git a/security/keymint/support/attestation_record.cpp b/security/keymint/support/attestation_record.cpp
index 2462228..5a26611 100644
--- a/security/keymint/support/attestation_record.cpp
+++ b/security/keymint/support/attestation_record.cpp
@@ -105,6 +105,7 @@
     ASN1_INTEGER* boot_patchlevel;
     ASN1_NULL* device_unique_attestation;
     ASN1_NULL* identity_credential;
+    ASN1_OCTET_STRING* attestation_id_second_imei;
 } KM_AUTH_LIST;
 
 ASN1_SEQUENCE(KM_AUTH_LIST) = {
@@ -170,6 +171,8 @@
                      TAG_DEVICE_UNIQUE_ATTESTATION.maskedTag()),
         ASN1_EXP_OPT(KM_AUTH_LIST, identity_credential, ASN1_NULL,
                      TAG_IDENTITY_CREDENTIAL_KEY.maskedTag()),
+        ASN1_EXP_OPT(KM_AUTH_LIST, attestation_id_second_imei, ASN1_OCTET_STRING,
+                     TAG_ATTESTATION_ID_SECOND_IMEI.maskedTag()),
 } ASN1_SEQUENCE_END(KM_AUTH_LIST);
 IMPLEMENT_ASN1_FUNCTIONS(KM_AUTH_LIST);
 
@@ -323,6 +326,7 @@
     copyAuthTag(record->boot_patchlevel, TAG_BOOT_PATCHLEVEL, auth_list);
     copyAuthTag(record->device_unique_attestation, TAG_DEVICE_UNIQUE_ATTESTATION, auth_list);
     copyAuthTag(record->identity_credential, TAG_IDENTITY_CREDENTIAL_KEY, auth_list);
+    copyAuthTag(record->attestation_id_second_imei, TAG_ATTESTATION_ID_SECOND_IMEI, auth_list);
 
     return ErrorCode::OK;
 }
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 573f10b..bf40976 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -23,6 +23,7 @@
 #include <aidl/android/hardware/security/keymint/SecurityLevel.h>
 #include <android/binder_manager.h>
 #include <binder/IServiceManager.h>
+#include <cppbor.h>
 #include <cppbor_parse.h>
 #include <gmock/gmock.h>
 #include <keymaster/cppcose/cppcose.h>
@@ -797,6 +798,128 @@
               BnRemotelyProvisionedComponent::STATUS_TEST_KEY_IN_PRODUCTION_REQUEST);
 }
 
+void parse_root_of_trust(const vector<uint8_t>& attestation_cert,
+                         vector<uint8_t>* verified_boot_key, VerifiedBoot* verified_boot_state,
+                         bool* device_locked, vector<uint8_t>* verified_boot_hash) {
+    X509_Ptr cert(parse_cert_blob(attestation_cert));
+    ASSERT_TRUE(cert.get());
+
+    ASN1_OCTET_STRING* attest_rec = get_attestation_record(cert.get());
+    ASSERT_TRUE(attest_rec);
+
+    auto error = parse_root_of_trust(attest_rec->data, attest_rec->length, verified_boot_key,
+                                     verified_boot_state, device_locked, verified_boot_hash);
+    ASSERT_EQ(error, ErrorCode::OK);
+}
+
+/**
+ * Generate a CSR and verify DeviceInfo against IDs attested by KeyMint.
+ */
+TEST_P(CertificateRequestV2Test, DeviceInfo) {
+    // See if there is a matching IKeyMintDevice for this IRemotelyProvisionedComponent.
+    std::shared_ptr<IKeyMintDevice> keyMint;
+    if (!matching_keymint_device(GetParam(), &keyMint)) {
+        // No matching IKeyMintDevice.
+        GTEST_SKIP() << "Skipping key use test as no matching KeyMint device found";
+        return;
+    }
+    KeyMintHardwareInfo info;
+    ASSERT_TRUE(keyMint->getHardwareInfo(&info).isOk());
+
+    // Get IDs attested by KeyMint.
+    MacedPublicKey macedPubKey;
+    bytevec privateKeyBlob;
+    auto irpcStatus =
+            provisionable_->generateEcdsaP256KeyPair(false, &macedPubKey, &privateKeyBlob);
+    ASSERT_TRUE(irpcStatus.isOk());
+
+    AttestationKey attestKey;
+    attestKey.keyBlob = std::move(privateKeyBlob);
+    attestKey.issuerSubjectName = make_name_from_str("Android Keystore Key");
+
+    // Generate an ECDSA key that is attested by the generated P256 keypair.
+    AuthorizationSet keyDesc = AuthorizationSetBuilder()
+                                       .Authorization(TAG_NO_AUTH_REQUIRED)
+                                       .EcdsaSigningKey(EcCurve::P_256)
+                                       .AttestationChallenge("foo")
+                                       .AttestationApplicationId("bar")
+                                       .Digest(Digest::NONE)
+                                       .SetDefaultValidity();
+    KeyCreationResult creationResult;
+    auto kmStatus = keyMint->generateKey(keyDesc.vector_data(), attestKey, &creationResult);
+    ASSERT_TRUE(kmStatus.isOk());
+
+    vector<KeyCharacteristics> key_characteristics = std::move(creationResult.keyCharacteristics);
+    vector<Certificate> key_cert_chain = std::move(creationResult.certificateChain);
+    // We didn't provision the attestation key.
+    ASSERT_EQ(key_cert_chain.size(), 1);
+
+    // Parse attested patch levels.
+    auto auths = HwEnforcedAuthorizations(key_characteristics);
+
+    auto attestedSystemPatchLevel = auths.GetTagValue(TAG_OS_PATCHLEVEL);
+    auto attestedVendorPatchLevel = auths.GetTagValue(TAG_VENDOR_PATCHLEVEL);
+    auto attestedBootPatchLevel = auths.GetTagValue(TAG_BOOT_PATCHLEVEL);
+
+    ASSERT_TRUE(attestedSystemPatchLevel.has_value());
+    ASSERT_TRUE(attestedVendorPatchLevel.has_value());
+    ASSERT_TRUE(attestedBootPatchLevel.has_value());
+
+    // Parse attested AVB values.
+    vector<uint8_t> key;
+    VerifiedBoot attestedVbState;
+    bool attestedBootloaderState;
+    vector<uint8_t> attestedVbmetaDigest;
+    parse_root_of_trust(key_cert_chain[0].encodedCertificate, &key, &attestedVbState,
+                        &attestedBootloaderState, &attestedVbmetaDigest);
+
+    // Get IDs from DeviceInfo.
+    bytevec csr;
+    irpcStatus =
+            provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge_, &csr);
+    ASSERT_TRUE(irpcStatus.isOk()) << irpcStatus.getMessage();
+
+    auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), challenge_);
+    ASSERT_TRUE(result) << result.message();
+
+    std::unique_ptr<cppbor::Array> csrPayload = std::move(*result);
+    ASSERT_TRUE(csrPayload);
+
+    auto deviceInfo = csrPayload->get(2)->asMap();
+    ASSERT_TRUE(deviceInfo);
+
+    auto vbState = deviceInfo->get("vb_state")->asTstr();
+    auto bootloaderState = deviceInfo->get("bootloader_state")->asTstr();
+    auto vbmetaDigest = deviceInfo->get("vbmeta_digest")->asBstr();
+    auto systemPatchLevel = deviceInfo->get("system_patch_level")->asUint();
+    auto vendorPatchLevel = deviceInfo->get("vendor_patch_level")->asUint();
+    auto bootPatchLevel = deviceInfo->get("boot_patch_level")->asUint();
+    auto securityLevel = deviceInfo->get("security_level")->asTstr();
+
+    ASSERT_TRUE(vbState);
+    ASSERT_TRUE(bootloaderState);
+    ASSERT_TRUE(vbmetaDigest);
+    ASSERT_TRUE(systemPatchLevel);
+    ASSERT_TRUE(vendorPatchLevel);
+    ASSERT_TRUE(bootPatchLevel);
+    ASSERT_TRUE(securityLevel);
+
+    auto kmDeviceName = device_suffix(GetParam());
+
+    // Compare DeviceInfo against IDs attested by KeyMint.
+    ASSERT_TRUE((securityLevel->value() == "tee" && kmDeviceName == "default") ||
+                (securityLevel->value() == "strongbox" && kmDeviceName == "strongbox"));
+    ASSERT_TRUE((vbState->value() == "green" && attestedVbState == VerifiedBoot::VERIFIED) ||
+                (vbState->value() == "yellow" && attestedVbState == VerifiedBoot::SELF_SIGNED) ||
+                (vbState->value() == "orange" && attestedVbState == VerifiedBoot::UNVERIFIED));
+    ASSERT_TRUE((bootloaderState->value() == "locked" && attestedBootloaderState) ||
+                (bootloaderState->value() == "unlocked" && !attestedBootloaderState));
+    ASSERT_EQ(vbmetaDigest->value(), attestedVbmetaDigest);
+    ASSERT_EQ(systemPatchLevel->value(), attestedSystemPatchLevel.value());
+    ASSERT_EQ(vendorPatchLevel->value(), attestedVendorPatchLevel.value());
+    ASSERT_EQ(bootPatchLevel->value(), attestedBootPatchLevel.value());
+}
+
 INSTANTIATE_REM_PROV_AIDL_TEST(CertificateRequestV2Test);
 
 using VsrRequirementTest = VtsRemotelyProvisionedComponentTests;
diff --git a/staging/threadnetwork/aidl/Android.bp b/staging/threadnetwork/aidl/Android.bp
index fcd3ab8..b59d6da 100644
--- a/staging/threadnetwork/aidl/Android.bp
+++ b/staging/threadnetwork/aidl/Android.bp
@@ -1,3 +1,12 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
 aidl_interface {
     name: "android.hardware.threadnetwork",
     host_supported: true,
diff --git a/staging/threadnetwork/aidl/default/Android.bp b/staging/threadnetwork/aidl/default/Android.bp
index c701295..8fc22ad 100644
--- a/staging/threadnetwork/aidl/default/Android.bp
+++ b/staging/threadnetwork/aidl/default/Android.bp
@@ -12,6 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
 cc_defaults {
     name: "threadnetwork_service_default",
     vendor: true,
diff --git a/staging/threadnetwork/aidl/vts/Android.bp b/staging/threadnetwork/aidl/vts/Android.bp
index 70386d9..e2609ed 100644
--- a/staging/threadnetwork/aidl/vts/Android.bp
+++ b/staging/threadnetwork/aidl/vts/Android.bp
@@ -14,6 +14,15 @@
 // limitations under the License.
 //
 
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
 cc_test {
     name: "VtsHalThreadNetworkTargetTest",
     defaults: [
diff --git a/tetheroffload/aidl/Android.bp b/tetheroffload/aidl/Android.bp
index 1d80586..b3b6ebf 100644
--- a/tetheroffload/aidl/Android.bp
+++ b/tetheroffload/aidl/Android.bp
@@ -4,6 +4,7 @@
 
 aidl_interface {
     name: "android.hardware.tetheroffload",
+    owner: "google",
     vendor_available: true,
     srcs: ["android/hardware/tetheroffload/*.aidl"],
     stability: "vintf",
@@ -23,5 +24,4 @@
             apps_enabled: false,
         },
     },
-    frozen: false,
 }
diff --git a/thermal/utils/Android.bp b/thermal/utils/Android.bp
new file mode 100644
index 0000000..72e1e34
--- /dev/null
+++ b/thermal/utils/Android.bp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library_static {
+    name: "libthermalutils",
+    vendor_available: true,
+    export_include_dirs: ["include"],
+    srcs: [
+        "ThermalHidlWrapper.cpp",
+    ],
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+
+    shared_libs: [
+        "android.hardware.thermal@2.0",
+        "android.hardware.thermal-V1-ndk",
+    ],
+}
diff --git a/thermal/utils/ThermalHidlWrapper.cpp b/thermal/utils/ThermalHidlWrapper.cpp
new file mode 100644
index 0000000..05a992a
--- /dev/null
+++ b/thermal/utils/ThermalHidlWrapper.cpp
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "include/thermalutils/ThermalHidlWrapper.h"
+
+#include <hidl/HidlTransportSupport.h>
+
+#include <cmath>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace thermal {
+
+using ::android::hardware::Void;
+
+namespace {
+
+template <typename T, typename U>
+Return<void> setFailureAndCallback(T _hidl_cb, hidl_vec<U> data, std::string_view debug_msg) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::FAILURE;
+    status.debugMessage = debug_msg.data();
+    _hidl_cb(status, data);
+    return Void();
+}
+
+template <typename T>
+Return<void> setFailureAndCallback(T _hidl_cb, std::string_view debug_msg) {
+    ThermalStatus status;
+    status.code = ThermalStatusCode::FAILURE;
+    status.debugMessage = debug_msg.data();
+    _hidl_cb(status);
+    return Void();
+}
+
+template <typename T, typename U>
+Return<void> setInitFailureAndCallback(T _hidl_cb, hidl_vec<U> data) {
+    return setFailureAndCallback(
+            _hidl_cb, data, "Thermal AIDL HAL client used by HIDL wrapper was not initialized");
+}
+
+template <typename T>
+Return<void> setInitFailureAndCallback(T _hidl_cb) {
+    return setFailureAndCallback(
+            _hidl_cb, "Thermal AIDL HAL client used by HIDL wrapper was not initialized");
+}
+
+template <typename T, typename U>
+Return<void> setUnsupportedFailureAndCallback(T _hidl_cb, hidl_vec<U> data) {
+    return setFailureAndCallback(_hidl_cb, data, "Operation unsupported by Thermal HIDL wrapper");
+}
+
+TemperatureType_2_0 convertAidlTemperatureType(const TemperatureType& type) {
+    if (type < TemperatureType::CPU || type > TemperatureType::NPU) {
+        return TemperatureType_2_0::UNKNOWN;
+    }
+    return static_cast<TemperatureType_2_0>(type);
+}
+
+CoolingType_2_0 convertAidlCoolingType(const CoolingType& type) {
+    if (type < CoolingType::FAN || type > CoolingType::COMPONENT) {
+        return CoolingType_2_0::COMPONENT;
+    }
+    return static_cast<CoolingType_2_0>(type);
+}
+
+Temperature_2_0 convertAidlTemperature(const Temperature& temperature) {
+    Temperature_2_0 t = Temperature_2_0{
+            convertAidlTemperatureType(temperature.type), temperature.name, temperature.value,
+            static_cast<ThrottlingSeverity_2_0>(temperature.throttlingStatus)};
+    return t;
+}
+
+CoolingDevice_2_0 convertAidlCoolingDevice(const CoolingDevice& cooling_device) {
+    CoolingDevice_2_0 t =
+            CoolingDevice_2_0{convertAidlCoolingType(cooling_device.type), cooling_device.name,
+                              static_cast<uint64_t>(cooling_device.value)};
+    return t;
+}
+TemperatureThreshold_2_0 convertAidlTemperatureThreshold(const TemperatureThreshold& threshold) {
+    TemperatureThreshold_2_0 t =
+            TemperatureThreshold_2_0{convertAidlTemperatureType(threshold.type), threshold.name,
+                                     threshold.hotThrottlingThresholds.data(),
+                                     threshold.coldThrottlingThresholds.data(), NAN};
+    return t;
+}
+
+}  // namespace
+
+// Methods from ::android::hardware::thermal::V1_0::IThermal follow.
+Return<void> ThermalHidlWrapper::getTemperatures(getTemperatures_cb _hidl_cb) {
+    hidl_vec<Temperature_1_0> ret_1_0;
+    setUnsupportedFailureAndCallback(_hidl_cb, ret_1_0);
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::getCpuUsages(
+        std::function<void(const ThermalStatus&, const hidl_vec<CpuUsage>&)> _hidl_cb) {
+    hidl_vec<CpuUsage> ret_1_0;
+    setUnsupportedFailureAndCallback(_hidl_cb, ret_1_0);
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::getCoolingDevices(
+        std::function<void(const ThermalStatus&, const hidl_vec<CoolingDevice_1_0>&)> _hidl_cb) {
+    hidl_vec<CoolingDevice_1_0> ret_1_0;
+    setUnsupportedFailureAndCallback(_hidl_cb, ret_1_0);
+    return Void();
+}
+
+// Methods from ::android::hardware::thermal::V2_0::IThermal follow.
+Return<void> ThermalHidlWrapper::getCurrentTemperatures(
+        bool filterType, TemperatureType_2_0 type,
+        std::function<void(const ThermalStatus&, const hidl_vec<Temperature_2_0>&)> _hidl_cb) {
+    hidl_vec<Temperature_2_0> ret_2_0;
+    if (!thermal_service_) {
+        setInitFailureAndCallback(_hidl_cb, ret_2_0);
+    }
+
+    std::vector<Temperature> ret_aidl;
+    ThermalStatus status;
+    ::ndk::ScopedAStatus a_status;
+    if (filterType) {
+        a_status = thermal_service_->getTemperaturesWithType(static_cast<TemperatureType>(type),
+                                                             &ret_aidl);
+    } else {
+        a_status = thermal_service_->getTemperatures(&ret_aidl);
+    }
+    if (a_status.isOk()) {
+        std::vector<Temperature_2_0> ret;
+        for (const auto& temperature : ret_aidl) {
+            ret.push_back(convertAidlTemperature(temperature));
+        }
+        _hidl_cb(status, hidl_vec<Temperature_2_0>(ret));
+    } else {
+        setFailureAndCallback(_hidl_cb, ret_2_0, a_status.getMessage());
+    }
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::getTemperatureThresholds(
+        bool filterType, TemperatureType_2_0 type,
+        std::function<void(const ThermalStatus&, const hidl_vec<TemperatureThreshold_2_0>&)>
+                _hidl_cb) {
+    hidl_vec<TemperatureThreshold_2_0> ret_2_0;
+    if (!thermal_service_) {
+        setInitFailureAndCallback(_hidl_cb, ret_2_0);
+    }
+
+    std::vector<TemperatureThreshold> ret_aidl;
+    ThermalStatus status;
+    ::ndk::ScopedAStatus a_status;
+    if (filterType) {
+        a_status = thermal_service_->getTemperatureThresholdsWithType(
+                static_cast<TemperatureType>(type), &ret_aidl);
+    } else {
+        a_status = thermal_service_->getTemperatureThresholds(&ret_aidl);
+    }
+    if (a_status.isOk()) {
+        std::vector<TemperatureThreshold_2_0> ret;
+        for (const auto& threshold : ret_aidl) {
+            ret.push_back(convertAidlTemperatureThreshold(threshold));
+        }
+        _hidl_cb(status, hidl_vec<TemperatureThreshold_2_0>(ret));
+    } else {
+        setFailureAndCallback(_hidl_cb, ret_2_0, a_status.getMessage());
+    }
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::registerThermalChangedCallback(
+        const sp<IThermalChangedCallback_2_0>& callback, bool filterType, TemperatureType_2_0 type,
+        std::function<void(const ThermalStatus&)> _hidl_cb) {
+    if (!thermal_service_) {
+        setInitFailureAndCallback(_hidl_cb);
+    }
+    if (callback == nullptr) {
+        setFailureAndCallback(_hidl_cb, "Invalid nullptr callback");
+        return Void();
+    }
+    std::lock_guard<std::mutex> _lock(callback_wrappers_mutex_);
+    for (const auto& callback_wrapper : callback_wrappers_) {
+        if (::android::hardware::interfacesEqual(callback_wrapper->callback_2_0_.get(),
+                                                 callback.get())) {
+            setFailureAndCallback(_hidl_cb, "The callback was already registered through wrapper");
+            return Void();
+        }
+    }
+    std::shared_ptr<IThermalChangedCallbackWrapper> callback_wrapper =
+            ndk::SharedRefBase::make<IThermalChangedCallbackWrapper>(callback);
+    ::ndk::ScopedAStatus a_status;
+    ThermalStatus status;
+    if (filterType) {
+        a_status = thermal_service_->registerThermalChangedCallbackWithType(
+                callback_wrapper, static_cast<TemperatureType>(type));
+    } else {
+        a_status = thermal_service_->registerThermalChangedCallback(callback_wrapper);
+    }
+    if (a_status.isOk()) {
+        callback_wrappers_.push_back(callback_wrapper);
+        _hidl_cb(status);
+    } else {
+        setFailureAndCallback(_hidl_cb, a_status.getMessage());
+    }
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::unregisterThermalChangedCallback(
+        const sp<IThermalChangedCallback_2_0>& callback,
+        std::function<void(const ThermalStatus&)> _hidl_cb) {
+    if (!thermal_service_) {
+        setInitFailureAndCallback(_hidl_cb);
+    }
+    if (callback == nullptr) {
+        setFailureAndCallback(_hidl_cb, "Invalid nullptr callback");
+        return Void();
+    }
+    std::lock_guard<std::mutex> _lock(callback_wrappers_mutex_);
+    for (auto it = callback_wrappers_.begin(); it != callback_wrappers_.end(); it++) {
+        auto callback_wrapper = *it;
+        if (::android::hardware::interfacesEqual(callback_wrapper->callback_2_0_.get(),
+                                                 callback.get())) {
+            ::ndk::ScopedAStatus a_status;
+            ThermalStatus status;
+            a_status = thermal_service_->unregisterThermalChangedCallback(callback_wrapper);
+            if (a_status.isOk()) {
+                callback_wrappers_.erase(it);
+                _hidl_cb(status);
+            } else {
+                setFailureAndCallback(_hidl_cb, a_status.getMessage());
+            }
+            return Void();
+        }
+    }
+    setFailureAndCallback(_hidl_cb, "The callback was not registered through wrapper before");
+    return Void();
+}
+
+Return<void> ThermalHidlWrapper::getCurrentCoolingDevices(
+        bool filterType, CoolingType_2_0 type,
+        std::function<void(const ThermalStatus&, const hidl_vec<CoolingDevice_2_0>&)> _hidl_cb) {
+    hidl_vec<CoolingDevice_2_0> ret_2_0;
+    if (!thermal_service_) {
+        setInitFailureAndCallback(_hidl_cb, ret_2_0);
+    }
+
+    std::vector<CoolingDevice> ret_aidl;
+    ThermalStatus status;
+    ::ndk::ScopedAStatus a_status;
+    if (filterType) {
+        a_status = thermal_service_->getCoolingDevicesWithType(static_cast<CoolingType>(type),
+                                                               &ret_aidl);
+    } else {
+        a_status = thermal_service_->getCoolingDevices(&ret_aidl);
+    }
+    if (a_status.isOk()) {
+        std::vector<CoolingDevice_2_0> ret;
+        for (const auto& cooling_device : ret_aidl) {
+            ret.push_back(convertAidlCoolingDevice(cooling_device));
+        }
+        _hidl_cb(status, hidl_vec<CoolingDevice_2_0>(ret));
+    } else {
+        setFailureAndCallback(_hidl_cb, ret_2_0, a_status.getMessage());
+    }
+    return Void();
+}
+
+// Methods from ::android::hidl::base::V1_0::IBase follow.
+Return<void> ThermalHidlWrapper::debug(const hidl_handle& handle,
+                                       const hidl_vec<hidl_string>& args) {
+    if (handle != nullptr && handle->numFds >= 1) {
+        int fd = handle->data[0];
+        char** arr = new char*[args.size()];
+        for (size_t i = 0; i < args.size(); i++) {
+            arr[i] = strdup(args[i].c_str());
+        }
+        thermal_service_->dump(fd, (const char**)arr, args.size());
+    }
+    return Void();
+}
+
+::ndk::ScopedAStatus ThermalHidlWrapper::IThermalChangedCallbackWrapper::notifyThrottling(
+        const Temperature& temperature) {
+    callback_2_0_->notifyThrottling(convertAidlTemperature(temperature));
+    return ::ndk::ScopedAStatus::ok();
+}
+
+}  // namespace thermal
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/thermal/utils/include/thermalutils/ThermalHidlWrapper.h b/thermal/utils/include/thermalutils/ThermalHidlWrapper.h
new file mode 100644
index 0000000..1fec100
--- /dev/null
+++ b/thermal/utils/include/thermalutils/ThermalHidlWrapper.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <aidl/android/hardware/thermal/BnThermalChangedCallback.h>
+#include <aidl/android/hardware/thermal/IThermal.h>
+#include <android/hardware/thermal/2.0/IThermal.h>
+#include <android/hardware/thermal/2.0/IThermalChangedCallback.h>
+#include <android/hardware/thermal/2.0/types.h>
+#include <hidl/Status.h>
+
+#include <utility>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace thermal {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_handle;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+
+using IThermal_Aidl = ::aidl::android::hardware::thermal::IThermal;
+using ::android::hardware::thermal::V1_0::CpuUsage;
+using CoolingType_2_0 = ::android::hardware::thermal::V2_0::CoolingType;
+using CoolingDevice_1_0 = ::android::hardware::thermal::V1_0::CoolingDevice;
+using CoolingDevice_2_0 = ::android::hardware::thermal::V2_0::CoolingDevice;
+using IThermal_2_0 = ::android::hardware::thermal::V2_0::IThermal;
+using IThermalChangedCallback_2_0 = ::android::hardware::thermal::V2_0::IThermalChangedCallback;
+using Temperature_1_0 = ::android::hardware::thermal::V1_0::Temperature;
+using Temperature_2_0 = ::android::hardware::thermal::V2_0::Temperature;
+using TemperatureType_2_0 = ::android::hardware::thermal::V2_0::TemperatureType;
+
+using ::android::hardware::thermal::V1_0::ThermalStatus;
+using ::android::hardware::thermal::V1_0::ThermalStatusCode;
+
+using TemperatureThreshold_2_0 = ::android::hardware::thermal::V2_0::TemperatureThreshold;
+using ThrottlingSeverity_2_0 = ::android::hardware::thermal::V2_0::ThrottlingSeverity;
+
+// This wrapper converts all Thermal HIDL 2.0 calls to AIDL calls and converts AIDL response to
+// HIDL 2.0 response.
+//
+// For Thermal HIDL 1.0 calls, it returns unsupported error.
+class ThermalHidlWrapper : public IThermal_2_0 {
+  public:
+    explicit ThermalHidlWrapper(::std::shared_ptr<IThermal_Aidl> thermal_service)
+        : thermal_service_(std::move(thermal_service)) {}
+
+    // Methods from ::android::hardware::thermal::V1_0::IThermal follow.
+    Return<void> getTemperatures(getTemperatures_cb _hidl_cb) override;
+    Return<void> getCpuUsages(getCpuUsages_cb _hidl_cb) override;
+    Return<void> getCoolingDevices(getCoolingDevices_cb _hidl_cb) override;
+
+    // Methods from ::android::hardware::thermal::V2_0::IThermal follow.
+    Return<void> getCurrentTemperatures(bool filterType, TemperatureType_2_0 type,
+                                        getCurrentTemperatures_cb _hidl_cb) override;
+    Return<void> getTemperatureThresholds(bool filterType, TemperatureType_2_0 type,
+                                          getTemperatureThresholds_cb _hidl_cb) override;
+    Return<void> registerThermalChangedCallback(
+            const sp<IThermalChangedCallback_2_0>& callback, bool filterType,
+            TemperatureType_2_0 type, registerThermalChangedCallback_cb _hidl_cb) override;
+    Return<void> unregisterThermalChangedCallback(
+            const sp<IThermalChangedCallback_2_0>& callback,
+            unregisterThermalChangedCallback_cb _hidl_cb) override;
+    Return<void> getCurrentCoolingDevices(bool filterType, CoolingType_2_0 type,
+                                          getCurrentCoolingDevices_cb _hidl_cb) override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+    Return<void> debug(const hidl_handle& handle, const hidl_vec<hidl_string>& args) override;
+
+  private:
+    class IThermalChangedCallbackWrapper : public BnThermalChangedCallback {
+      public:
+        explicit IThermalChangedCallbackWrapper(const sp<IThermalChangedCallback_2_0>& callback_2_0)
+            : callback_2_0_(callback_2_0) {}
+        ::ndk::ScopedAStatus notifyThrottling(const Temperature& temperature) override;
+        sp<IThermalChangedCallback_2_0> callback_2_0_;
+    };
+
+    // Reference to thermal service.
+    ::std::shared_ptr<IThermal_Aidl> thermal_service_;
+    // Mutex lock for read/write on callback wrappers.
+    std::mutex callback_wrappers_mutex_;
+    // All thermal changed callback wrappers registered.
+    ::std::vector<std::shared_ptr<IThermalChangedCallbackWrapper>> callback_wrappers_;
+};
+
+}  // namespace thermal
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/thermal/utils/tests/Android.bp b/thermal/utils/tests/Android.bp
new file mode 100644
index 0000000..fd74e8b
--- /dev/null
+++ b/thermal/utils/tests/Android.bp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "ThermalHidlWrapperTest",
+    srcs: ["ThermalHidlWrapperTest.cpp"],
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+        "android.hardware.thermal@1.0",
+        "android.hardware.thermal@2.0",
+        "android.hardware.thermal-V1-ndk",
+    ],
+    static_libs: [
+        "libthermalutils",
+        "libgtest",
+    ],
+    test_suites: [
+        "device-tests",
+    ],
+}
diff --git a/thermal/utils/tests/ThermalHidlWrapperTest.cpp b/thermal/utils/tests/ThermalHidlWrapperTest.cpp
new file mode 100644
index 0000000..1723a1a
--- /dev/null
+++ b/thermal/utils/tests/ThermalHidlWrapperTest.cpp
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "thermal_hidl_wrapper_test"
+#include <VtsHalHidlTargetCallbackBase.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/thermal/BnThermal.h>
+#include <aidl/android/hardware/thermal/BnThermalChangedCallback.h>
+#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android/binder_ibinder.h>
+#include <android/binder_interface_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <android/binder_status.h>
+#include <android/hardware/thermal/2.0/IThermal.h>
+#include <android/hardware/thermal/2.0/IThermalChangedCallback.h>
+#include <android/hardware/thermal/2.0/types.h>
+#include <gtest/gtest.h>
+#include <hidl/GtestPrinter.h>
+#include <hidl/ServiceManagement.h>
+#include <thermalutils/ThermalHidlWrapper.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <memory>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace aidl::android::hardware::thermal {
+
+namespace {
+
+using ::android::sp;
+using ::android::hardware::hidl_enum_range;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+using ::android::hardware::thermal::V1_0::ThermalStatus;
+using ::android::hardware::thermal::V1_0::ThermalStatusCode;
+using ::android::hardware::thermal::V2_0::CoolingDevice;
+using ::android::hardware::thermal::V2_0::CoolingType;
+using IThermal_2_0 = ::android::hardware::thermal::V2_0::IThermal;
+using ::android::hardware::thermal::V2_0::IThermalChangedCallback;
+using ::android::hardware::thermal::V2_0::Temperature;
+using ::android::hardware::thermal::V2_0::TemperatureThreshold;
+using ::android::hardware::thermal::V2_0::TemperatureType;
+using ::android::hardware::thermal::V2_0::ThrottlingSeverity;
+
+constexpr char kCallbackNameNotifyThrottling[] = "notifyThrottling";
+static const Temperature kThrottleTemp = {
+        .type = TemperatureType::SKIN,
+        .name = "test temperature sensor",
+        .value = 98.6,
+        .throttlingStatus = ThrottlingSeverity::CRITICAL,
+};
+
+class ThermalCallbackArgs {
+  public:
+    Temperature temperature;
+};
+
+// Callback class for receiving thermal event notifications from main class
+class ThermalCallback : public ::testing::VtsHalHidlTargetCallbackBase<ThermalCallbackArgs>,
+                        public IThermalChangedCallback {
+  public:
+    Return<void> notifyThrottling(const Temperature& temperature) override {
+        ThermalCallbackArgs args;
+        args.temperature = temperature;
+        NotifyFromCallback(kCallbackNameNotifyThrottling, args);
+        return Void();
+    }
+};
+
+// The main test class for THERMAL HIDL HAL 2.0.
+class ThermalHidlWrapperTest : public ::testing::TestWithParam<std::string> {
+  public:
+    void SetUp() override {
+        AIBinder* binder = AServiceManager_waitForService(GetParam().c_str());
+        ASSERT_NE(binder, nullptr);
+        mThermal = sp<ThermalHidlWrapper>::make(IThermal::fromBinder(ndk::SpAIBinder(binder)));
+        ASSERT_NE(mThermal, nullptr);
+        mThermalCallback = new (std::nothrow) ThermalCallback();
+        ASSERT_NE(mThermalCallback, nullptr);
+        auto ret = mThermal->registerThermalChangedCallback(
+                mThermalCallback, false, TemperatureType::SKIN,
+                [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+        // Expect to fail if register again
+        ret = mThermal->registerThermalChangedCallback(
+                mThermalCallback, false, TemperatureType::SKIN,
+                [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+    }
+
+    void TearDown() override {
+        auto ret = mThermal->unregisterThermalChangedCallback(
+                mThermalCallback,
+                [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+        // Expect to fail if unregister again
+        ret = mThermal->unregisterThermalChangedCallback(
+                mThermalCallback,
+                [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+        ASSERT_TRUE(ret.isOk());
+    }
+
+  protected:
+    sp<IThermal_2_0> mThermal;
+    sp<ThermalCallback> mThermalCallback;
+};  // class ThermalHidlWrapperTest
+
+// Test ThermalChangedCallback::notifyThrottling().
+// This just calls into and back from our local ThermalChangedCallback impl.
+TEST_P(ThermalHidlWrapperTest, NotifyThrottlingTest) {
+    sp<ThermalCallback> thermalCallback = new (std::nothrow) ThermalCallback();
+    auto ret = thermalCallback->notifyThrottling(kThrottleTemp);
+    ASSERT_TRUE(ret.isOk());
+    auto res = thermalCallback->WaitForCallback(kCallbackNameNotifyThrottling);
+    EXPECT_TRUE(res.no_timeout);
+    ASSERT_TRUE(res.args);
+    EXPECT_EQ(kThrottleTemp, res.args->temperature);
+}
+
+// Test Thermal->registerThermalChangedCallback.
+TEST_P(ThermalHidlWrapperTest, RegisterThermalChangedCallbackTest) {
+    // Expect to fail with same callback
+    auto ret = mThermal->registerThermalChangedCallback(
+            mThermalCallback, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::FAILURE, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to fail with null callback
+    ret = mThermal->registerThermalChangedCallback(
+            nullptr, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::FAILURE, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    sp<ThermalCallback> localThermalCallback = new (std::nothrow) ThermalCallback();
+    // Expect to succeed with different callback
+    ret = mThermal->registerThermalChangedCallback(
+            localThermalCallback, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Remove the local callback
+    ret = mThermal->unregisterThermalChangedCallback(
+            localThermalCallback,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to fail with null callback
+    ret = mThermal->unregisterThermalChangedCallback(nullptr, [](ThermalStatus status) {
+        EXPECT_EQ(ThermalStatusCode::FAILURE, status.code);
+    });
+    ASSERT_TRUE(ret.isOk());
+}
+
+// Test Thermal->unregisterThermalChangedCallback.
+TEST_P(ThermalHidlWrapperTest, UnregisterThermalChangedCallbackTest) {
+    sp<ThermalCallback> localThermalCallback = new (std::nothrow) ThermalCallback();
+    // Expect to fail as the callback was not registered before
+    auto ret = mThermal->unregisterThermalChangedCallback(
+            localThermalCallback,
+            [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Register a local callback
+    ret = mThermal->registerThermalChangedCallback(
+            localThermalCallback, false, TemperatureType::SKIN,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to succeed with callback removed
+    ret = mThermal->unregisterThermalChangedCallback(
+            localThermalCallback,
+            [](ThermalStatus status) { EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+    // Expect to fail as the callback has been unregistered already
+    ret = mThermal->unregisterThermalChangedCallback(
+            localThermalCallback,
+            [](ThermalStatus status) { EXPECT_NE(ThermalStatusCode::SUCCESS, status.code); });
+    ASSERT_TRUE(ret.isOk());
+}
+
+// Sanity test for Thermal::getCurrentTemperatures().
+TEST_P(ThermalHidlWrapperTest, TemperatureTest) {
+    mThermal->getCurrentTemperatures(false, TemperatureType::SKIN,
+                                     [](ThermalStatus status, hidl_vec<Temperature> temperatures) {
+                                         if (temperatures.size()) {
+                                             EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                                         } else {
+                                             EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                                         }
+                                         for (int i = 0; i < temperatures.size(); ++i) {
+                                             EXPECT_LT(0u, temperatures[i].name.size());
+                                         }
+                                     });
+    auto types = hidl_enum_range<TemperatureType>();
+    for (const auto& type : types) {
+        mThermal->getCurrentTemperatures(
+                true, type, [&type](ThermalStatus status, hidl_vec<Temperature> temperatures) {
+                    if (temperatures.size()) {
+                        EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                    } else {
+                        EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                    }
+                    for (int i = 0; i < temperatures.size(); ++i) {
+                        EXPECT_EQ(type, temperatures[i].type);
+                        EXPECT_LT(0u, temperatures[i].name.size());
+                    }
+                });
+    }
+}
+
+// Sanity test for Thermal::getTemperatureThresholds().
+TEST_P(ThermalHidlWrapperTest, TemperatureThresholdTest) {
+    mThermal->getTemperatureThresholds(
+            false, TemperatureType::SKIN,
+            [](ThermalStatus status, hidl_vec<TemperatureThreshold> temperatures) {
+                if (temperatures.size()) {
+                    EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                } else {
+                    EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                }
+            });
+    for (int i = static_cast<int>(TemperatureType::UNKNOWN);
+         i <= static_cast<int>(TemperatureType::POWER_AMPLIFIER); ++i) {
+        auto type = static_cast<TemperatureType>(i);
+        mThermal->getTemperatureThresholds(
+                true, type,
+                [&type](ThermalStatus status, hidl_vec<TemperatureThreshold> temperatures) {
+                    if (temperatures.size()) {
+                        EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                    } else {
+                        EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                    }
+                    for (int i = 0; i < temperatures.size(); ++i) {
+                        EXPECT_EQ(type, temperatures[i].type);
+                    }
+                });
+    }
+}
+
+// Sanity test for Thermal::getCurrentCoolingDevices().
+TEST_P(ThermalHidlWrapperTest, CoolingDeviceTest) {
+    mThermal->getCurrentCoolingDevices(
+            false, CoolingType::CPU,
+            [](ThermalStatus status, hidl_vec<CoolingDevice> cooling_devices) {
+                if (cooling_devices.size()) {
+                    EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                } else {
+                    EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                }
+                for (int i = 0; i < cooling_devices.size(); ++i) {
+                    EXPECT_LT(0u, cooling_devices[i].name.size());
+                }
+            });
+    for (int i = 0; i <= static_cast<int>(CoolingType::COMPONENT); ++i) {
+        auto type = static_cast<CoolingType>(i);
+        mThermal->getCurrentCoolingDevices(
+                true, type, [&type](ThermalStatus status, hidl_vec<CoolingDevice> cooling_devices) {
+                    if (cooling_devices.size()) {
+                        EXPECT_EQ(ThermalStatusCode::SUCCESS, status.code);
+                    } else {
+                        EXPECT_NE(ThermalStatusCode::SUCCESS, status.code);
+                    }
+                    for (int i = 0; i < cooling_devices.size(); ++i) {
+                        EXPECT_EQ(type, cooling_devices[i].type);
+                        EXPECT_LT(0u, cooling_devices[i].name.size());
+                    }
+                });
+    }
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(ThermalHidlWrapperTest);
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, ThermalHidlWrapperTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IThermal::descriptor)),
+        ::android::hardware::PrintInstanceNameToString);
+
+}  // namespace
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    return RUN_ALL_TESTS();
+}
+
+}  // namespace aidl::android::hardware::thermal
diff --git a/tv/cec/1.0/default/HdmiCecDefault.cpp b/tv/cec/1.0/default/HdmiCecDefault.cpp
index 26ccb7d..2a5197c 100644
--- a/tv/cec/1.0/default/HdmiCecDefault.cpp
+++ b/tv/cec/1.0/default/HdmiCecDefault.cpp
@@ -278,6 +278,10 @@
 
 Return<bool> HdmiCecDefault::isConnected(int32_t portId) {
     uint16_t addr;
+    if (portId < 0 || portId >= mHdmiCecPorts.size()) {
+        LOG(ERROR) << "Port id is out of bounds, portId = " << portId;
+        return false;
+    }
     int ret = ioctl(mHdmiCecPorts[portId]->mCecFd, CEC_ADAP_G_PHYS_ADDR, &addr);
     if (ret) {
         LOG(ERROR) << "Is connected failed, Error = " << strerror(errno);
diff --git a/tv/tuner/1.0/default/Dvr.cpp b/tv/tuner/1.0/default/Dvr.cpp
index 40879f2..9d6d86d 100644
--- a/tv/tuner/1.0/default/Dvr.cpp
+++ b/tv/tuner/1.0/default/Dvr.cpp
@@ -164,7 +164,7 @@
         return false;
     }
 
-    mDvrMQ = move(tmpDvrMQ);
+    mDvrMQ = std::move(tmpDvrMQ);
 
     if (EventFlag::createEventFlag(mDvrMQ->getEventFlagWord(), &mDvrEventFlag) != OK) {
         return false;
diff --git a/tv/tuner/1.1/default/Dvr.cpp b/tv/tuner/1.1/default/Dvr.cpp
index fdb66c1..8262b4d 100644
--- a/tv/tuner/1.1/default/Dvr.cpp
+++ b/tv/tuner/1.1/default/Dvr.cpp
@@ -183,7 +183,7 @@
         return false;
     }
 
-    mDvrMQ = move(tmpDvrMQ);
+    mDvrMQ = std::move(tmpDvrMQ);
 
     if (EventFlag::createEventFlag(mDvrMQ->getEventFlagWord(), &mDvrEventFlag) != OK) {
         return false;
diff --git a/usb/gadget/1.1/default/lib/MonitorFfs.cpp b/usb/gadget/1.1/default/lib/MonitorFfs.cpp
index 0cdf038..6d09a8a 100644
--- a/usb/gadget/1.1/default/lib/MonitorFfs.cpp
+++ b/usb/gadget/1.1/default/lib/MonitorFfs.cpp
@@ -59,9 +59,9 @@
 
     if (addEpollFd(epollFd, eventFd) == -1) abort();
 
-    mEpollFd = move(epollFd);
-    mInotifyFd = move(inotifyFd);
-    mEventFd = move(eventFd);
+    mEpollFd = std::move(epollFd);
+    mInotifyFd = std::move(inotifyFd);
+    mEventFd = std::move(eventFd);
     gadgetPullup = false;
 }
 
diff --git a/usb/gadget/1.2/default/lib/MonitorFfs.cpp b/usb/gadget/1.2/default/lib/MonitorFfs.cpp
index 0cdf038..6d09a8a 100644
--- a/usb/gadget/1.2/default/lib/MonitorFfs.cpp
+++ b/usb/gadget/1.2/default/lib/MonitorFfs.cpp
@@ -59,9 +59,9 @@
 
     if (addEpollFd(epollFd, eventFd) == -1) abort();
 
-    mEpollFd = move(epollFd);
-    mInotifyFd = move(inotifyFd);
-    mEventFd = move(eventFd);
+    mEpollFd = std::move(epollFd);
+    mInotifyFd = std::move(inotifyFd);
+    mEventFd = std::move(eventFd);
     gadgetPullup = false;
 }
 
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/.hash b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/.hash
index 856fa7c..42772bb 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/.hash
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/.hash
@@ -1 +1 @@
-39791e3a4bb9892a340e94e44860048624d2f66e
+590d9f45625a2c353011cf85f18d1d08593b8a0a
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index e2c06e5..0cc01c5 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/2/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -49,7 +49,7 @@
   SUPPORTED_RANGE_DATA_NTF_CONFIG = 229,
   SUPPORTED_RSSI_REPORTING = 230,
   SUPPORTED_DIAGNOSTICS = 231,
-  SUPPORTED_MIN_SLOT_DURATION_MS = 232,
+  SUPPORTED_MIN_SLOT_DURATION_RSTU = 232,
   SUPPORTED_MAX_RANGING_SESSION_NUMBER = 233,
   SUPPORTED_CHANNELS_AOA = 234,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index e2c06e5..0cc01c5 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -49,7 +49,7 @@
   SUPPORTED_RANGE_DATA_NTF_CONFIG = 229,
   SUPPORTED_RSSI_REPORTING = 230,
   SUPPORTED_DIAGNOSTICS = 231,
-  SUPPORTED_MIN_SLOT_DURATION_MS = 232,
+  SUPPORTED_MIN_SLOT_DURATION_RSTU = 232,
   SUPPORTED_MAX_RANGING_SESSION_NUMBER = 233,
   SUPPORTED_CHANNELS_AOA = 234,
 }
diff --git a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
index 2f534df..768ef8c 100644
--- a/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
+++ b/uwb/aidl/aidl_api/android.hardware.uwb.fira_android/current/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
@@ -36,4 +36,5 @@
 enum UwbVendorStatusCodes {
   STATUS_ERROR_CCC_SE_BUSY = 80,
   STATUS_ERROR_CCC_LIFECYCLE = 81,
+  STATUS_REGULATION_UWB_OFF = 82,
 }
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
index bf59318..891b6f0 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorCapabilityTlvTypes.aidl
@@ -186,9 +186,9 @@
     SUPPORTED_DIAGNOSTICS = 0xE7,
 
     /**
-     * 4 byte value to indicate supported min slot duration in ms.
+     * 4 byte value to indicate supported min slot duration in rstu.
      */
-    SUPPORTED_MIN_SLOT_DURATION_MS = 0xE8,
+    SUPPORTED_MIN_SLOT_DURATION_RSTU = 0xE8,
 
     /**
      * Int value to indicate supported max number of fira ranging sessions
diff --git a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
index 8505b8a..f1eea9d 100644
--- a/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
+++ b/uwb/aidl/android/hardware/uwb/fira_android/UwbVendorStatusCodes.aidl
@@ -33,4 +33,6 @@
     STATUS_ERROR_CCC_SE_BUSY = 0x50,
     /** CCC Lifecycle error */
     STATUS_ERROR_CCC_LIFECYCLE = 0x51,
+    /** UWB Regulation Off */
+    STATUS_REGULATION_UWB_OFF = 0x52,
 }
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
index b27b06f..2ff6896 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/IWifiChip.aidl
@@ -58,7 +58,7 @@
   String[] getP2pIfaceNames();
   @PropagateAllowBlocking android.hardware.wifi.IWifiStaIface getStaIface(in String ifname);
   String[] getStaIfaceNames();
-  android.hardware.wifi.WifiRadioCombinationMatrix getSupportedRadioCombinationsMatrix();
+  android.hardware.wifi.WifiRadioCombination[] getSupportedRadioCombinations();
   android.hardware.wifi.WifiChipCapabilities getWifiChipCapabilities();
   android.hardware.wifi.WifiUsableChannel[] getUsableChannels(in android.hardware.wifi.WifiBand band, in android.hardware.wifi.WifiIfaceMode ifaceModeMask, in android.hardware.wifi.IWifiChip.UsableChannelFilter filterMask);
   void setAfcChannelAllowance(in android.hardware.wifi.AvailableAfcFrequencyInfo[] availableAfcFrequencyInfo);
diff --git a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCipherSuiteType.aidl b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCipherSuiteType.aidl
index d1149c4..6f3158e 100644
--- a/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCipherSuiteType.aidl
+++ b/wifi/aidl/aidl_api/android.hardware.wifi/current/android/hardware/wifi/NanCipherSuiteType.aidl
@@ -39,6 +39,6 @@
   SHARED_KEY_256_MASK = (1 << 1) /* 2 */,
   PUBLIC_KEY_2WDH_128_MASK = (1 << 2) /* 4 */,
   PUBLIC_KEY_2WDH_256_MASK = (1 << 3) /* 8 */,
-  PUBLIC_KEY_PASN_128_MASK = (1 << 4) /* 16 */,
-  PUBLIC_KEY_PASN_256_MASK = (1 << 5) /* 32 */,
+  PUBLIC_KEY_PASN_128_MASK = (1 << 6) /* 64 */,
+  PUBLIC_KEY_PASN_256_MASK = (1 << 7) /* 128 */,
 }
diff --git a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
index de2449e..c0e41cd 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiChip.aidl
@@ -31,7 +31,7 @@
 import android.hardware.wifi.WifiDebugRingBufferStatus;
 import android.hardware.wifi.WifiDebugRingBufferVerboseLevel;
 import android.hardware.wifi.WifiIfaceMode;
-import android.hardware.wifi.WifiRadioCombinationMatrix;
+import android.hardware.wifi.WifiRadioCombination;
 import android.hardware.wifi.WifiUsableChannel;
 
 /**
@@ -737,8 +737,7 @@
      * Retrieve the list of all the possible radio combinations supported by this
      * chip.
      *
-     * @return A list of all the possible radio combinations represented by
-     *         |WifiRadioCombinationMatrix|.
+     * @return A list of all the possible radio combinations.
      *         For example, in case of a chip which has two radios, where one radio is
      *         capable of 2.4GHz 2X2 only and another radio which is capable of either
      *         5GHz or 6GHz 2X2, the number of possible radio combinations in this case
@@ -759,7 +758,7 @@
      *         |WifiStatusCode.FAILURE_UNKNOWN|
      *
      */
-    WifiRadioCombinationMatrix getSupportedRadioCombinationsMatrix();
+    WifiRadioCombination[] getSupportedRadioCombinations();
 
     /**
      * Get capabilities supported by this chip.
diff --git a/wifi/aidl/android/hardware/wifi/IWifiNanIface.aidl b/wifi/aidl/android/hardware/wifi/IWifiNanIface.aidl
index 5f3ce6c..3ce8d02 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiNanIface.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiNanIface.aidl
@@ -79,6 +79,7 @@
      * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyCreateDataInterfaceResponse|.
      *
      * @param cmdId Command Id to use for this invocation.
+     * @param ifaceName The name of the interface, e.g. "aware0".
      * @throws ServiceSpecificException with one of the following values:
      *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
      *         |WifiStatusCode.ERROR_UNKNOWN|
@@ -90,6 +91,7 @@
      * Asynchronous response is with |IWifiNanIfaceEventCallback.notifyDeleteDataInterfaceResponse|.
      *
      * @param cmdId Command Id to use for this invocation.
+     * @param ifaceName The name of the interface, e.g. "aware0".
      * @throws ServiceSpecificException with one of the following values:
      *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
      *         |WifiStatusCode.ERROR_UNKNOWN|
diff --git a/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl b/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
index 8a61a9c..3649b7b 100644
--- a/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
+++ b/wifi/aidl/android/hardware/wifi/IWifiNanIfaceEventCallback.aidl
@@ -132,7 +132,7 @@
     /**
      * Callback providing status on a completed followup message transmit operation.
      *
-     * @param cmdId Command Id corresponding to the original |transmitFollowupRequest| request.
+     * @param id Command ID corresponding to the original |transmitFollowupRequest| request.
      * @param status NanStatus of the operation. Possible status codes are:
      *               |NanStatusCode.SUCCESS|
      *               |NanStatusCode.NO_OTA_ACK|
@@ -151,7 +151,7 @@
      * Callback invoked in response to a capability request
      * |IWifiNanIface.getCapabilitiesRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      * @param capabilities Capability data.
@@ -162,7 +162,7 @@
     /**
      * Callback invoked in response to a config request |IWifiNanIface.configRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -175,7 +175,7 @@
      * Callback invoked in response to a create data interface request
      * |IWifiNanIface.createDataInterfaceRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -187,7 +187,7 @@
      * Callback invoked in response to a delete data interface request
      * |IWifiNanIface.deleteDataInterfaceRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -198,7 +198,7 @@
     /**
      * Callback invoked in response to a disable request |IWifiNanIface.disableRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.PROTOCOL_FAILURE|
@@ -208,7 +208,7 @@
     /**
      * Callback invoked in response to an enable request |IWifiNanIface.enableRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.ALREADY_ENABLED|
@@ -223,7 +223,7 @@
      * Callback invoked in response to an initiate data path request
      * |IWifiNanIface.initiateDataPathRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -238,7 +238,7 @@
      * Callback invoked in response to a respond to data path indication request
      * |IWifiNanIface.respondToDataPathIndicationRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -252,7 +252,7 @@
      * Callback invoked to notify the status of the start publish request
      * |IWifiNanIface.startPublishRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -267,7 +267,7 @@
      * Callback invoked to notify the status of the start subscribe request
      * |IWifiNanIface.startSubscribeRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -282,7 +282,7 @@
      * Callback invoked in response to a stop publish request
      * |IWifiNanIface.stopPublishRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_SESSION_ID|
@@ -294,7 +294,7 @@
      * Callback invoked in response to a stop subscribe request
      * |IWifiNanIface.stopSubscribeRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_SESSION_ID|
@@ -306,7 +306,7 @@
      * Callback invoked in response to a terminate data path request
      * |IWifiNanIface.terminateDataPathRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -320,7 +320,7 @@
      * Callback invoked in response to a suspension request
      * |IWifiNanIface.suspendRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_SESSION_ID|
@@ -333,7 +333,7 @@
      * Callback invoked in response to a resume request
      * |IWifiNanIface.resumeRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_SESSION_ID|
@@ -346,7 +346,7 @@
      * Callback invoked in response to a transmit followup request
      * |IWifiNanIface.transmitFollowupRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -377,7 +377,7 @@
      * Callback invoked in response to an initiate NAN pairing request
      * |IWifiNanIface.initiatePairingRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -392,7 +392,7 @@
      * Callback invoked in response to a respond to NAN pairing indication request
      * |IWifiNanIface.respondToPairingIndicationRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -422,7 +422,7 @@
      * Callback invoked in response to an initiate NAN pairing bootstrapping request
      * |IWifiNanIface.initiateBootstrappingRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
@@ -438,7 +438,7 @@
      * Callback invoked in response to a respond to pairing bootstrapping indication request
      * |IWifiNanIface.respondToBootstrappingIndicationRequest|.
      *
-     * @param cmdId Command Id corresponding to the original request.
+     * @param id Command ID corresponding to the original request.
      * @param status NanStatus of the operation. Possible status codes are:
      *        |NanStatusCode.SUCCESS|
      *        |NanStatusCode.INVALID_ARGS|
diff --git a/wifi/aidl/android/hardware/wifi/MacAddress.aidl b/wifi/aidl/android/hardware/wifi/MacAddress.aidl
index d59dfe3..d238565 100644
--- a/wifi/aidl/android/hardware/wifi/MacAddress.aidl
+++ b/wifi/aidl/android/hardware/wifi/MacAddress.aidl
@@ -20,8 +20,6 @@
  * Byte array representing a Mac Address. Use when we need to
  * pass an array of Mac Addresses to a method, as variable-sized
  * 2D arrays are not supported in AIDL.
- *
- * TODO (b/210705533): Replace this type with a 2D byte array.
  */
 @VintfStability
 parcelable MacAddress {
diff --git a/wifi/aidl/android/hardware/wifi/NanBootstrappingConfirmInd.aidl b/wifi/aidl/android/hardware/wifi/NanBootstrappingConfirmInd.aidl
index 7d7a436..e72c940 100644
--- a/wifi/aidl/android/hardware/wifi/NanBootstrappingConfirmInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanBootstrappingConfirmInd.aidl
@@ -16,10 +16,12 @@
 
 package android.hardware.wifi;
 
-import android.hardware.wifi.NanBootstrappingMethod;
 import android.hardware.wifi.NanBootstrappingResponseCode;
 import android.hardware.wifi.NanStatus;
 
+/**
+ * See Wi-Fi Aware R4.0 section 9.5.21.7
+ */
 @VintfStability
 parcelable NanBootstrappingConfirmInd {
     /**
@@ -44,7 +46,7 @@
     int comeBackDelay;
 
     /**
-     * Cookie received from the comeback response.
+     * Cookie received from peer with |comeBackDelay| for follow up |NanBootstrappingRequest|
      */
     byte[] cookie;
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanBootstrappingMethod.aidl b/wifi/aidl/android/hardware/wifi/NanBootstrappingMethod.aidl
index 8960794..da2ff25 100644
--- a/wifi/aidl/android/hardware/wifi/NanBootstrappingMethod.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanBootstrappingMethod.aidl
@@ -17,7 +17,8 @@
 package android.hardware.wifi;
 
 /**
- * Pairing bootstrapping method flag
+ * Pairing bootstrapping method flag.
+ * See Wi-Fi Aware R4.0 section 9.5.21.7 table 128
  */
 @VintfStability
 @Backing(type="int")
diff --git a/wifi/aidl/android/hardware/wifi/NanBootstrappingRequest.aidl b/wifi/aidl/android/hardware/wifi/NanBootstrappingRequest.aidl
index 5297b9f..4836612 100644
--- a/wifi/aidl/android/hardware/wifi/NanBootstrappingRequest.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanBootstrappingRequest.aidl
@@ -18,6 +18,9 @@
 
 import android.hardware.wifi.NanBootstrappingMethod;
 
+/**
+ * See Wi-Fi Aware R4.0 section 9.5.21.7
+ */
 @VintfStability
 parcelable NanBootstrappingRequest {
     /**
@@ -39,7 +42,7 @@
     NanBootstrappingMethod requestBootstrappingMethod;
 
     /**
-     * Cookie for the follow up request
+     * Cookie received from previous |NanBootstrappingConfirmInd| for comeback request.
      */
     byte[] cookie;
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanBootstrappingRequestInd.aidl b/wifi/aidl/android/hardware/wifi/NanBootstrappingRequestInd.aidl
index e11122f..9094579 100644
--- a/wifi/aidl/android/hardware/wifi/NanBootstrappingRequestInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanBootstrappingRequestInd.aidl
@@ -21,7 +21,7 @@
 /**
  * NAN Data path request indication message structure.
  * Event indication received by an intended Responder when a NAN
- * data request initiated by an Initiator.
+ * data request is initiated by an Initiator. See Wi-Fi Aware R4.0 section 9.5.21.7
  */
 @VintfStability
 parcelable NanBootstrappingRequestInd {
diff --git a/wifi/aidl/android/hardware/wifi/NanBootstrappingResponse.aidl b/wifi/aidl/android/hardware/wifi/NanBootstrappingResponse.aidl
index 0a7d621..dbe8923 100644
--- a/wifi/aidl/android/hardware/wifi/NanBootstrappingResponse.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanBootstrappingResponse.aidl
@@ -16,8 +16,9 @@
 
 package android.hardware.wifi;
 
-import android.hardware.wifi.NanBootstrappingMethod;
-
+/**
+ * See Wi-Fi Aware R4.0 section 9.5.21.7
+ */
 @VintfStability
 parcelable NanBootstrappingResponse {
     /**
diff --git a/wifi/aidl/android/hardware/wifi/NanCipherSuiteType.aidl b/wifi/aidl/android/hardware/wifi/NanCipherSuiteType.aidl
index 0d2fc99..91b5caf 100644
--- a/wifi/aidl/android/hardware/wifi/NanCipherSuiteType.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanCipherSuiteType.aidl
@@ -17,13 +17,19 @@
 package android.hardware.wifi;
 
 /**
- * Cipher suite flags. Wi-Fi Aware Specification 4.0 section 7.1.2
+ * Cipher suite flags. Wi-Fi Aware Specification 4.0 section 9.5.21.1.
  */
 @VintfStability
 @Backing(type="int")
 enum NanCipherSuiteType {
     NONE = 0,
+    /**
+     *  NCS-SK-128
+     */
     SHARED_KEY_128_MASK = 1 << 0,
+    /**
+     *  NCS-SK-256
+     */
     SHARED_KEY_256_MASK = 1 << 1,
     /**
      *  NCS-PK-2WDH-128
@@ -34,11 +40,15 @@
      */
     PUBLIC_KEY_2WDH_256_MASK = 1 << 3,
     /**
+     * bit 4 and bit 5 are reserved for NCS-GTK-CCMP-128 and NCS-GTK-CCMP-256. Which are not used
+     * from framework
+     */
+    /**
      *  NCS-PK-PASN-128
      */
-    PUBLIC_KEY_PASN_128_MASK = 1 << 4,
+    PUBLIC_KEY_PASN_128_MASK = 1 << 6,
     /**
      *  NCS-PK-PASN-256
      */
-    PUBLIC_KEY_PASN_256_MASK = 1 << 5,
+    PUBLIC_KEY_PASN_256_MASK = 1 << 7,
 }
diff --git a/wifi/aidl/android/hardware/wifi/NanIdentityResolutionAttribute.aidl b/wifi/aidl/android/hardware/wifi/NanIdentityResolutionAttribute.aidl
index 917feff..807081b 100644
--- a/wifi/aidl/android/hardware/wifi/NanIdentityResolutionAttribute.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanIdentityResolutionAttribute.aidl
@@ -17,7 +17,8 @@
 package android.hardware.wifi;
 
 /**
- * NIRA for pairing identity resolution
+ * NIRA for pairing identity resolution.
+ * See Wi-Fi Aware R4.0 section 9.5.21.6
  */
 @VintfStability
 parcelable NanIdentityResolutionAttribute {
diff --git a/wifi/aidl/android/hardware/wifi/NanMatchInd.aidl b/wifi/aidl/android/hardware/wifi/NanMatchInd.aidl
index be2fa31..314d599 100644
--- a/wifi/aidl/android/hardware/wifi/NanMatchInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanMatchInd.aidl
@@ -123,7 +123,7 @@
     NanRangingIndication rangingIndicationType;
     /**
      * Security Context Identifier attribute contains PMKID. Shall be included in NDP setup and
-     * response messages. Security Context Identifie identifies the Security Context. For NAN
+     * response messages. Security Context Identifier identifies the Security Context. For NAN
      * Shared Key Cipher Suite, this field contains the 16 octet PMKID identifying the PMK used for
      * setting up the Secure Data Path.
      */
diff --git a/wifi/aidl/android/hardware/wifi/NanPairingAkm.aidl b/wifi/aidl/android/hardware/wifi/NanPairingAkm.aidl
index 31eeb2b..a823a3f 100644
--- a/wifi/aidl/android/hardware/wifi/NanPairingAkm.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPairingAkm.aidl
@@ -17,6 +17,6 @@
 package android.hardware.wifi;
 
 /**
- * THe AKM used of NAN pairing
+ * The AKM used in the NAN pairing.
  */
 @VintfStability @Backing(type="int") enum NanPairingAkm { SAE = 0, PASN=1 }
diff --git a/wifi/aidl/android/hardware/wifi/NanPairingConfig.aidl b/wifi/aidl/android/hardware/wifi/NanPairingConfig.aidl
index 4f9c3ae..20122e2 100644
--- a/wifi/aidl/android/hardware/wifi/NanPairingConfig.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPairingConfig.aidl
@@ -16,8 +16,6 @@
 
 package android.hardware.wifi;
 
-import android.hardware.wifi.NanBootstrappingMethod;
-
 /**
  * The NAN pairing config
  */
diff --git a/wifi/aidl/android/hardware/wifi/NanPairingConfirmInd.aidl b/wifi/aidl/android/hardware/wifi/NanPairingConfirmInd.aidl
index cd98c72..a5670ec 100644
--- a/wifi/aidl/android/hardware/wifi/NanPairingConfirmInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPairingConfirmInd.aidl
@@ -16,7 +16,6 @@
 
 package android.hardware.wifi;
 
-import android.hardware.wifi.NanDataPathChannelInfo;
 import android.hardware.wifi.NanPairingRequestType;
 import android.hardware.wifi.NanStatus;
 import android.hardware.wifi.NpkSecurityAssociation;
@@ -24,7 +23,7 @@
 /**
  * NAN pairing confirmation indication structure. Event indication is
  * received on both initiator and responder side when negotiation for a
- * pairing finishes on success or failure.
+ * pairing finishes on success or failure. See Wi-Fi Aware R4.0 section 7.6.1.4
  */
 @VintfStability
 parcelable NanPairingConfirmInd {
diff --git a/wifi/aidl/android/hardware/wifi/NanPairingRequest.aidl b/wifi/aidl/android/hardware/wifi/NanPairingRequest.aidl
index 6f1a072..0c2080b 100644
--- a/wifi/aidl/android/hardware/wifi/NanPairingRequest.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPairingRequest.aidl
@@ -20,9 +20,10 @@
 import android.hardware.wifi.NanPairingSecurityConfig;
 
 /**
- * NAN pairing initiate request
- * Which can be used for setup(the initial pairing request) or
- * verification(re-pairing for paired devices)
+ * NAN pairing initiate request.
+ * Can be used for setup (the initial pairing request) or
+ * verification (re-pairing for paired devices).
+ * See Wi-Fi Aware R4.0 section 7.6.1.1
  */
 @VintfStability
 parcelable NanPairingRequest {
diff --git a/wifi/aidl/android/hardware/wifi/NanPairingRequestInd.aidl b/wifi/aidl/android/hardware/wifi/NanPairingRequestInd.aidl
index f247e45..ec8548f 100644
--- a/wifi/aidl/android/hardware/wifi/NanPairingRequestInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanPairingRequestInd.aidl
@@ -22,7 +22,7 @@
 /**
  * NAN pairing request indication message structure.
  * Event indication received by an intended Responder when a
- * pairing request initiated by an Initiator.
+ * pairing request is initiated by an Initiator. See Wi-Fi Aware R4.0 section 7.6.1.3
  */
 @VintfStability
 parcelable NanPairingRequestInd {
diff --git a/wifi/aidl/android/hardware/wifi/NanRespondToPairingIndicationRequest.aidl b/wifi/aidl/android/hardware/wifi/NanRespondToPairingIndicationRequest.aidl
index 456b430..fab2a40 100644
--- a/wifi/aidl/android/hardware/wifi/NanRespondToPairingIndicationRequest.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanRespondToPairingIndicationRequest.aidl
@@ -21,6 +21,7 @@
 
 /**
  * Response to a pairing request from a peer.
+ * See Wi-Fi Aware R4.0 section 7.6.1.2
  */
 @VintfStability
 parcelable NanRespondToPairingIndicationRequest {
diff --git a/wifi/aidl/android/hardware/wifi/NanSuspensionModeChangeInd.aidl b/wifi/aidl/android/hardware/wifi/NanSuspensionModeChangeInd.aidl
index afabe8c..057e63b 100644
--- a/wifi/aidl/android/hardware/wifi/NanSuspensionModeChangeInd.aidl
+++ b/wifi/aidl/android/hardware/wifi/NanSuspensionModeChangeInd.aidl
@@ -22,7 +22,7 @@
 @VintfStability
 parcelable NanSuspensionModeChangeInd {
     /**
-     * Indication whether the device has entered or existed the NAN suspension mode(deep sleep)
+     * Indication whether the device has entered or exited the NAN suspension mode(deep sleep)
      */
     boolean isSuspended;
 }
diff --git a/wifi/aidl/android/hardware/wifi/NpkSecurityAssociation.aidl b/wifi/aidl/android/hardware/wifi/NpkSecurityAssociation.aidl
index 32e8409..6d85eea 100644
--- a/wifi/aidl/android/hardware/wifi/NpkSecurityAssociation.aidl
+++ b/wifi/aidl/android/hardware/wifi/NpkSecurityAssociation.aidl
@@ -20,7 +20,7 @@
 import android.hardware.wifi.NanPairingAkm;
 
 /**
- * The security sssociation info after Aware Pairing setup.
+ * The security association info after Aware Pairing setup.
  */
 @VintfStability
 parcelable NpkSecurityAssociation {
@@ -37,7 +37,7 @@
      */
     byte[32] npk;
     /**
-     * The AKM is used for key exchange in this security sssociation
+     * The AKM is used for key exchange in this security association
      */
     NanPairingAkm akm;
     /**
diff --git a/wifi/aidl/android/hardware/wifi/Ssid.aidl b/wifi/aidl/android/hardware/wifi/Ssid.aidl
index fd985a3..230cef6 100644
--- a/wifi/aidl/android/hardware/wifi/Ssid.aidl
+++ b/wifi/aidl/android/hardware/wifi/Ssid.aidl
@@ -20,8 +20,6 @@
  * Byte array representing an Ssid. Use when we need to
  * pass an array of Ssid's to a method, as variable-sized
  * 2D arrays are not supported in AIDL.
- *
- * TODO (b/210705533): Replace this type with a 2D byte array.
  */
 @VintfStability
 parcelable Ssid {
diff --git a/wifi/aidl/android/hardware/wifi/WifiRadioCombinationMatrix.aidl b/wifi/aidl/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
deleted file mode 100644
index b79a818..0000000
--- a/wifi/aidl/android/hardware/wifi/WifiRadioCombinationMatrix.aidl
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.wifi;
-
-import android.hardware.wifi.WifiRadioCombination;
-
-/**
- * Wifi radio combinations matrix retrieved via
- * |IWifiChip.getSupportedRadioCombinationsMatrix|.
- */
-@VintfStability
-parcelable WifiRadioCombinationMatrix {
-    /**
-     * List of all the possible radio combinations that the chip can operate.
-     */
-    WifiRadioCombination[] radioCombinations;
-}
diff --git a/wifi/aidl/default/aidl_struct_util.cpp b/wifi/aidl/default/aidl_struct_util.cpp
index efd6598..5bfdcbb 100644
--- a/wifi/aidl/default/aidl_struct_util.cpp
+++ b/wifi/aidl/default/aidl_struct_util.cpp
@@ -2996,14 +2996,13 @@
 
 bool convertLegacyRadioCombinationsMatrixToAidl(
         legacy_hal::wifi_radio_combination_matrix* legacy_matrix,
-        WifiRadioCombinationMatrix* aidl_matrix) {
-    if (!aidl_matrix || !legacy_matrix) {
+        std::vector<WifiRadioCombination>* aidl_combinations) {
+    if (!aidl_combinations || !legacy_matrix) {
         return false;
     }
-    *aidl_matrix = {};
+    *aidl_combinations = {};
 
     int num_combinations = legacy_matrix->num_radio_combinations;
-    std::vector<WifiRadioCombination> radio_combinations_vec;
     if (!num_combinations) {
         LOG(ERROR) << "zero radio combinations";
         return false;
@@ -3029,13 +3028,12 @@
             radio_configurations_vec.push_back(radioConfiguration);
         }
         radioCombination.radioConfigurations = radio_configurations_vec;
-        radio_combinations_vec.push_back(radioCombination);
+        aidl_combinations->push_back(radioCombination);
         l_radio_combinations_ptr =
                 (wifi_radio_combination*)((u8*)l_radio_combinations_ptr +
                                           sizeof(wifi_radio_combination) +
                                           (sizeof(wifi_radio_configuration) * num_configurations));
     }
-    aidl_matrix->radioCombinations = radio_combinations_vec;
     return true;
 }
 
@@ -3300,6 +3298,64 @@
     return channel_category_mask;
 }
 
+bool convertLegacyIfaceMaskToIfaceConcurrencyType(u32 mask,
+                                                  std::vector<IfaceConcurrencyType>* types) {
+    if (!mask) return false;
+
+#ifndef BIT
+#define BIT(x) (1 << (x))
+#endif
+    if (mask & BIT(WIFI_INTERFACE_TYPE_STA)) types->push_back(IfaceConcurrencyType::STA);
+    if (mask & BIT(WIFI_INTERFACE_TYPE_AP)) types->push_back(IfaceConcurrencyType::AP);
+    if (mask & BIT(WIFI_INTERFACE_TYPE_AP_BRIDGED))
+        types->push_back(IfaceConcurrencyType::AP_BRIDGED);
+    if (mask & BIT(WIFI_INTERFACE_TYPE_P2P)) types->push_back(IfaceConcurrencyType::P2P);
+    if (mask & BIT(WIFI_INTERFACE_TYPE_NAN)) types->push_back(IfaceConcurrencyType::NAN_IFACE);
+
+    return true;
+}
+
+bool convertLegacyIfaceCombinationsMatrixToChipMode(
+        legacy_hal::wifi_iface_concurrency_matrix& legacy_matrix, IWifiChip::ChipMode* chip_mode) {
+    if (!chip_mode) {
+        LOG(ERROR) << "chip_mode is null";
+        return false;
+    }
+    *chip_mode = {};
+
+    int num_combinations = legacy_matrix.num_iface_combinations;
+    std::vector<IWifiChip::ChipConcurrencyCombination> driver_Combinations_vec;
+    if (!num_combinations) {
+        LOG(ERROR) << "zero iface combinations";
+        return false;
+    }
+
+    for (int i = 0; i < num_combinations; i++) {
+        IWifiChip::ChipConcurrencyCombination chipComb;
+        std::vector<IWifiChip::ChipConcurrencyCombinationLimit> limits;
+        wifi_iface_combination* comb = &legacy_matrix.iface_combinations[i];
+        if (!comb->num_iface_limits) continue;
+        for (u32 j = 0; j < comb->num_iface_limits; j++) {
+            IWifiChip::ChipConcurrencyCombinationLimit chipLimit;
+            chipLimit.maxIfaces = comb->iface_limits[j].max_limit;
+            std::vector<IfaceConcurrencyType> types;
+            if (!convertLegacyIfaceMaskToIfaceConcurrencyType(comb->iface_limits[j].iface_mask,
+                                                              &types)) {
+                LOG(ERROR) << "Failed to convert from iface_mask:"
+                           << comb->iface_limits[j].iface_mask;
+                return false;
+            }
+            chipLimit.types = types;
+            limits.push_back(chipLimit);
+        }
+        chipComb.limits = limits;
+        driver_Combinations_vec.push_back(chipComb);
+    }
+
+    chip_mode->availableCombinations = driver_Combinations_vec;
+    return true;
+}
+
 }  // namespace aidl_struct_util
 }  // namespace wifi
 }  // namespace hardware
diff --git a/wifi/aidl/default/aidl_struct_util.h b/wifi/aidl/default/aidl_struct_util.h
index 904ba81..3da94dc 100644
--- a/wifi/aidl/default/aidl_struct_util.h
+++ b/wifi/aidl/default/aidl_struct_util.h
@@ -64,9 +64,11 @@
         std::vector<legacy_hal::wifi_coex_unsafe_channel>* legacy_unsafe_channels);
 bool convertLegacyRadioCombinationsMatrixToAidl(
         legacy_hal::wifi_radio_combination_matrix* legacy_matrix,
-        WifiRadioCombinationMatrix* aidl_matrix);
+        std::vector<WifiRadioCombination>* aidl_combinations);
 WifiBand convertLegacyMacBandToAidlWifiBand(uint32_t band);
 WifiAntennaMode convertLegacyAntennaConfigurationToAidl(uint32_t antenna_cfg);
+bool convertLegacyIfaceCombinationsMatrixToChipMode(
+        legacy_hal::wifi_iface_concurrency_matrix& legacy_matrix, IWifiChip::ChipMode* chip_mode);
 
 // STA iface conversion methods.
 bool convertLegacyFeaturesToAidlStaCapabilities(uint64_t legacy_feature_set, uint32_t* aidl_caps);
diff --git a/wifi/aidl/default/tests/aidl_struct_util_unit_tests.cpp b/wifi/aidl/default/tests/aidl_struct_util_unit_tests.cpp
index 9997937..4bd77ac 100644
--- a/wifi/aidl/default/tests/aidl_struct_util_unit_tests.cpp
+++ b/wifi/aidl/default/tests/aidl_struct_util_unit_tests.cpp
@@ -753,21 +753,22 @@
             sizeof(radio_configurations_array3) / sizeof(radio_configurations_array3[0]),
             radio_configurations_array3);
 
-    WifiRadioCombinationMatrix converted_matrix{};
-    aidl_struct_util::convertLegacyRadioCombinationsMatrixToAidl(legacy_matrix, &converted_matrix);
+    std::vector<WifiRadioCombination> converted_combinations;
+    aidl_struct_util::convertLegacyRadioCombinationsMatrixToAidl(legacy_matrix,
+                                                                 &converted_combinations);
 
     // Verify the conversion
-    EXPECT_EQ(legacy_matrix->num_radio_combinations, converted_matrix.radioCombinations.size());
+    EXPECT_EQ(legacy_matrix->num_radio_combinations, converted_combinations.size());
     verifyRadioCombination(
-            &converted_matrix.radioCombinations[0],
+            &converted_combinations[0],
             sizeof(radio_configurations_array1) / sizeof(radio_configurations_array1[0]),
             radio_configurations_array1);
     verifyRadioCombination(
-            &converted_matrix.radioCombinations[1],
+            &converted_combinations[1],
             sizeof(radio_configurations_array2) / sizeof(radio_configurations_array2[0]),
             radio_configurations_array2);
     verifyRadioCombination(
-            &converted_matrix.radioCombinations[2],
+            &converted_combinations[2],
             sizeof(radio_configurations_array3) / sizeof(radio_configurations_array3[0]),
             radio_configurations_array3);
 }
diff --git a/wifi/aidl/default/wifi_chip.cpp b/wifi/aidl/default/wifi_chip.cpp
index b4c2ccd..89edaa4 100644
--- a/wifi/aidl/default/wifi_chip.cpp
+++ b/wifi/aidl/default/wifi_chip.cpp
@@ -377,6 +377,35 @@
       debug_ring_buffer_cb_registered_(false),
       subsystemCallbackHandler_(handler) {
     setActiveWlanIfaceNameProperty(kNoActiveWlanIfaceNamePropertyValue);
+    using_dynamic_iface_combination_ = false;
+}
+
+void WifiChip::retrieveDynamicIfaceCombination() {
+    if (using_dynamic_iface_combination_) return;
+
+    legacy_hal::wifi_iface_concurrency_matrix legacy_matrix;
+    legacy_hal::wifi_error legacy_status;
+
+    std::tie(legacy_status, legacy_matrix) =
+            legacy_hal_.lock()->getSupportedIfaceConcurrencyMatrix();
+    if (legacy_status != legacy_hal::WIFI_SUCCESS) {
+        LOG(ERROR) << "Failed to get SupportedIfaceCombinations matrix from legacy HAL: "
+                   << legacyErrorToString(legacy_status);
+        return;
+    }
+
+    IWifiChip::ChipMode aidl_chip_mode;
+    if (!aidl_struct_util::convertLegacyIfaceCombinationsMatrixToChipMode(legacy_matrix,
+                                                                          &aidl_chip_mode)) {
+        LOG(ERROR) << "Failed convertLegacyIfaceCombinationsMatrixToChipMode() ";
+        return;
+    }
+
+    LOG(INFO) << "Reloading iface concurrency combination from driver";
+    aidl_chip_mode.id = feature_flags::chip_mode_ids::kV3;
+    modes_.clear();
+    modes_.push_back(aidl_chip_mode);
+    using_dynamic_iface_combination_ = true;
 }
 
 std::shared_ptr<WifiChip> WifiChip::create(
@@ -682,10 +711,10 @@
                            &WifiChip::triggerSubsystemRestartInternal);
 }
 
-ndk::ScopedAStatus WifiChip::getSupportedRadioCombinationsMatrix(
-        WifiRadioCombinationMatrix* _aidl_return) {
+ndk::ScopedAStatus WifiChip::getSupportedRadioCombinations(
+        std::vector<WifiRadioCombination>* _aidl_return) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
-                           &WifiChip::getSupportedRadioCombinationsMatrixInternal, _aidl_return);
+                           &WifiChip::getSupportedRadioCombinationsInternal, _aidl_return);
 }
 
 ndk::ScopedAStatus WifiChip::getWifiChipCapabilities(WifiChipCapabilities* _aidl_return) {
@@ -1411,26 +1440,26 @@
     return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
 }
 
-std::pair<WifiRadioCombinationMatrix, ndk::ScopedAStatus>
-WifiChip::getSupportedRadioCombinationsMatrixInternal() {
+std::pair<std::vector<WifiRadioCombination>, ndk::ScopedAStatus>
+WifiChip::getSupportedRadioCombinationsInternal() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::wifi_radio_combination_matrix* legacy_matrix;
+    std::vector<WifiRadioCombination> aidl_combinations;
 
     std::tie(legacy_status, legacy_matrix) =
             legacy_hal_.lock()->getSupportedRadioCombinationsMatrix();
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         LOG(ERROR) << "Failed to get SupportedRadioCombinations matrix from legacy HAL: "
                    << legacyErrorToString(legacy_status);
-        return {WifiRadioCombinationMatrix{}, createWifiStatusFromLegacyError(legacy_status)};
+        return {aidl_combinations, createWifiStatusFromLegacyError(legacy_status)};
     }
 
-    WifiRadioCombinationMatrix aidl_matrix;
     if (!aidl_struct_util::convertLegacyRadioCombinationsMatrixToAidl(legacy_matrix,
-                                                                      &aidl_matrix)) {
+                                                                      &aidl_combinations)) {
         LOG(ERROR) << "Failed convertLegacyRadioCombinationsMatrixToAidl() ";
-        return {WifiRadioCombinationMatrix(), createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS)};
+        return {aidl_combinations, createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS)};
     }
-    return {aidl_matrix, ndk::ScopedAStatus::ok()};
+    return {aidl_combinations, ndk::ScopedAStatus::ok()};
 }
 
 std::pair<WifiChipCapabilities, ndk::ScopedAStatus> WifiChip::getWifiChipCapabilitiesInternal() {
@@ -1509,6 +1538,8 @@
                      version_info.first.firmwareDescription.c_str());
         property_set("vendor.wlan.driver.version", version_info.first.driverDescription.c_str());
     }
+    // Get the driver supported interface combination.
+    retrieveDynamicIfaceCombination();
 
     return ndk::ScopedAStatus::ok();
 }
diff --git a/wifi/aidl/default/wifi_chip.h b/wifi/aidl/default/wifi_chip.h
index ff4ee9c..eca68ed 100644
--- a/wifi/aidl/default/wifi_chip.h
+++ b/wifi/aidl/default/wifi_chip.h
@@ -144,8 +144,8 @@
     ndk::ScopedAStatus setAfcChannelAllowance(
             const std::vector<AvailableAfcFrequencyInfo>& availableAfcFrequencyInfo) override;
     ndk::ScopedAStatus triggerSubsystemRestart() override;
-    ndk::ScopedAStatus getSupportedRadioCombinationsMatrix(
-            WifiRadioCombinationMatrix* _aidl_return) override;
+    ndk::ScopedAStatus getSupportedRadioCombinations(
+            std::vector<WifiRadioCombination>* _aidl_return) override;
     ndk::ScopedAStatus getWifiChipCapabilities(WifiChipCapabilities* _aidl_return) override;
     ndk::ScopedAStatus enableStaChannelForPeerNetwork(
             ChannelCategoryMask in_channelCategoryEnableFlag) override;
@@ -258,10 +258,11 @@
     void invalidateAndClearBridgedAp(const std::string& br_name);
     bool findUsingNameFromBridgedApInstances(const std::string& name);
     ndk::ScopedAStatus triggerSubsystemRestartInternal();
-    std::pair<WifiRadioCombinationMatrix, ndk::ScopedAStatus>
-    getSupportedRadioCombinationsMatrixInternal();
+    std::pair<std::vector<WifiRadioCombination>, ndk::ScopedAStatus>
+    getSupportedRadioCombinationsInternal();
     std::pair<WifiChipCapabilities, ndk::ScopedAStatus> getWifiChipCapabilitiesInternal();
     ndk::ScopedAStatus setMloModeInternal(const ChipMloMode in_mode);
+    void retrieveDynamicIfaceCombination();
     void setWeakPtr(std::weak_ptr<WifiChip> ptr);
 
     int32_t chip_id_;
@@ -283,6 +284,7 @@
     // registration mechanism. Use this to check if we have already
     // registered a callback.
     bool debug_ring_buffer_cb_registered_;
+    bool using_dynamic_iface_combination_;
     aidl_callback_util::AidlCallbackHandler<IWifiChipEventCallback> event_cb_handler_;
     std::weak_ptr<WifiChip> weak_ptr_this_;
 
diff --git a/wifi/aidl/default/wifi_legacy_hal.cpp b/wifi/aidl/default/wifi_legacy_hal.cpp
index dbf5a68..209670b 100644
--- a/wifi/aidl/default/wifi_legacy_hal.cpp
+++ b/wifi/aidl/default/wifi_legacy_hal.cpp
@@ -1885,6 +1885,14 @@
     return global_func_table_.wifi_set_mlo_mode(global_handle_, mode);
 }
 
+std::pair<wifi_error, wifi_iface_concurrency_matrix>
+WifiLegacyHal::getSupportedIfaceConcurrencyMatrix() {
+    wifi_iface_concurrency_matrix iface_concurrency_matrix;
+    wifi_error status = global_func_table_.wifi_get_supported_iface_concurrency_matrix(
+            global_handle_, &iface_concurrency_matrix);
+    return {status, iface_concurrency_matrix};
+}
+
 void WifiLegacyHal::invalidate() {
     global_handle_ = nullptr;
     iface_name_to_handle_.clear();
diff --git a/wifi/aidl/default/wifi_legacy_hal.h b/wifi/aidl/default/wifi_legacy_hal.h
index 1d59b17..5168a8b 100644
--- a/wifi/aidl/default/wifi_legacy_hal.h
+++ b/wifi/aidl/default/wifi_legacy_hal.h
@@ -290,6 +290,7 @@
 using ::WIFI_ERROR_UNKNOWN;
 using ::wifi_gscan_capabilities;
 using ::wifi_hal_fn;
+using ::wifi_iface_concurrency_matrix;
 using ::WIFI_INDOOR_CHANNEL;
 using ::wifi_information_element;
 using ::WIFI_INTERFACE_IBSS;
@@ -779,6 +780,7 @@
     std::pair<wifi_error, wifi_chip_capabilities> getWifiChipCapabilities();
     wifi_error enableStaChannelForPeerNetwork(uint32_t channelCategoryEnableFlag);
     wifi_error setMloMode(wifi_mlo_mode mode);
+    std::pair<wifi_error, wifi_iface_concurrency_matrix> getSupportedIfaceConcurrencyMatrix();
 
   private:
     // Retrieve interface handles for all the available interfaces.
diff --git a/wifi/aidl/default/wifi_legacy_hal_factory.cpp b/wifi/aidl/default/wifi_legacy_hal_factory.cpp
index 60f81ed..0359d6f 100644
--- a/wifi/aidl/default/wifi_legacy_hal_factory.cpp
+++ b/wifi/aidl/default/wifi_legacy_hal_factory.cpp
@@ -128,7 +128,7 @@
 void WifiLegacyHalFactory::initVendorHalsDescriptorList() {
     xmlDocPtr xml;
     xmlNodePtr node, cnode;
-    char* version;
+    char* version = NULL;
     std::string path;
     xmlChar* value;
     wifi_hal_lib_desc desc;
@@ -200,6 +200,10 @@
         }
     skip:
         xmlFreeDoc(xml);
+        if (version) {
+            xmlFree(version);
+            version = NULL;
+        }
     }
     ::closedir(dirPtr);
 }
diff --git a/wifi/aidl/default/wifi_legacy_hal_stubs.cpp b/wifi/aidl/default/wifi_legacy_hal_stubs.cpp
index 77d1cb5..b5196c9 100644
--- a/wifi/aidl/default/wifi_legacy_hal_stubs.cpp
+++ b/wifi/aidl/default/wifi_legacy_hal_stubs.cpp
@@ -178,6 +178,7 @@
     populateStubFor(&hal_fn->wifi_nan_resume_request);
     populateStubFor(&hal_fn->wifi_set_scan_mode);
     populateStubFor(&hal_fn->wifi_set_mlo_mode);
+    populateStubFor(&hal_fn->wifi_get_supported_iface_concurrency_matrix);
     return true;
 }
 
diff --git a/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp b/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
index f908be6..d0b7014 100644
--- a/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
+++ b/wifi/aidl/vts/functional/wifi_chip_aidl_test.cpp
@@ -41,7 +41,7 @@
 using aidl::android::hardware::wifi::WifiDebugRingBufferStatus;
 using aidl::android::hardware::wifi::WifiDebugRingBufferVerboseLevel;
 using aidl::android::hardware::wifi::WifiIfaceMode;
-using aidl::android::hardware::wifi::WifiRadioCombinationMatrix;
+using aidl::android::hardware::wifi::WifiRadioCombination;
 using aidl::android::hardware::wifi::WifiStatusCode;
 using aidl::android::hardware::wifi::WifiUsableChannel;
 
@@ -242,14 +242,14 @@
 }
 
 /*
- * GetSupportedRadioCombinationsMatrix
+ * GetSupportedRadioCombinations
  */
-TEST_P(WifiChipAidlTest, GetSupportedRadioCombinationsMatrix) {
-    WifiRadioCombinationMatrix combination_matrix = {};
+TEST_P(WifiChipAidlTest, GetSupportedRadioCombinations) {
+    std::vector<WifiRadioCombination> combinations;
     configureChipForConcurrencyType(IfaceConcurrencyType::STA);
-    auto status = wifi_chip_->getSupportedRadioCombinationsMatrix(&combination_matrix);
+    auto status = wifi_chip_->getSupportedRadioCombinations(&combinations);
     if (checkStatusCode(&status, WifiStatusCode::ERROR_NOT_SUPPORTED)) {
-        GTEST_SKIP() << "Skipping this test since getSupportedRadioCombinationsMatrix() "
+        GTEST_SKIP() << "Skipping this test since getSupportedRadioCombinations() "
                         "is not supported by vendor.";
     }
     EXPECT_TRUE(status.isOk());
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
index ee0eff5..a260408 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
@@ -536,16 +536,11 @@
  * Connect
  */
 TEST_P(SupplicantP2pIfaceAidlTest, Connect) {
-    /*
-     * Auto-join is not enabled before R. After enabling auto-join,
-     * this should always succeed.
-     */
     std::string pin;
     EXPECT_TRUE(p2p_iface_
-                    ->connect(kTestMacAddr, WpsProvisionMethod::PBC,
-                              kTestConnectPin, false, false,
-                              kTestConnectGoIntent, &pin)
-                    .isOk());
+                        ->connect(kTestMacAddr, WpsProvisionMethod::PBC, kTestConnectPin, true,
+                                  false, kTestConnectGoIntent, &pin)
+                        .isOk());
 }
 
 /*
@@ -554,10 +549,9 @@
 TEST_P(SupplicantP2pIfaceAidlTest, CancelConnect) {
     std::string pin;
     EXPECT_TRUE(p2p_iface_
-                    ->connect(kTestMacAddr, WpsProvisionMethod::PBC,
-                              kTestConnectPin, false, false,
-                              kTestConnectGoIntent, &pin)
-                    .isOk());
+                        ->connect(kTestMacAddr, WpsProvisionMethod::PBC, kTestConnectPin, true,
+                                  false, kTestConnectGoIntent, &pin)
+                        .isOk());
     EXPECT_TRUE(p2p_iface_->cancelConnect().isOk());
 }