diff --git a/identity/aidl/android/hardware/identity/IIdentityCredential.aidl b/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
index 84d6ed0..82b0a83 100644
--- a/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
+++ b/identity/aidl/android/hardware/identity/IIdentityCredential.aidl
@@ -438,8 +438,9 @@
      * If the method is called on an instance obtained via IPresentationSession.getCredential(),
      * STATUS_FAILED must be returned.
      *
-     * @param challenge a challenge set by the issuer to ensure freshness. Maximum size is 32 bytes
-     *     and it may be empty. Fails with STATUS_INVALID_DATA if bigger than 32 bytes.
+     * @param challenge a challenge set by the issuer to ensure freshness. Implementations must
+     *   support challenges that are at least 32 bytes. Fails with STATUS_INVALID_DATA if bigger
+     *   than 32 bytes.
      * @return a COSE_Sign1 signature described above.
      */
     byte[] deleteCredentialWithChallenge(in byte[] challenge);
@@ -463,8 +464,9 @@
      * If the method is called on an instance obtained via IPresentationSession.getCredential(),
      * STATUS_FAILED must be returned.
      *
-     * @param challenge a challenge set by the issuer to ensure freshness. Maximum size is 32 bytes
-     *     and it may be empty. Fails with STATUS_INVALID_DATA if bigger than 32 bytes.
+     * @param challenge a challenge set by the issuer to ensure freshness. Implementations must
+     *   support challenges that are at least 32 bytes. Fails with STATUS_INVALID_DATA if bigger
+     *   than 32 bytes.
      * @return a COSE_Sign1 signature described above.
      */
     byte[] proveOwnership(in byte[] challenge);
diff --git a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
index 756b008..1c80cbb 100644
--- a/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
+++ b/identity/aidl/android/hardware/identity/IWritableIdentityCredential.aidl
@@ -127,7 +127,8 @@
      *     https://developer.android.com/training/articles/security-key-attestation#certificate_schema_attestationid
      *
      * @param attestationChallenge a challenge set by the issuer to ensure freshness. If
-     *    this is empty, the call fails with STATUS_INVALID_DATA.
+     *    this is empty, the call fails with STATUS_INVALID_DATA. Implementations must
+     *    support challenges of at least 32 bytes.
      *
      * @return the X.509 certificate chain for the credentialKey
      */
diff --git a/identity/aidl/vts/Android.bp b/identity/aidl/vts/Android.bp
index c5b84a1..20faeee 100644
--- a/identity/aidl/vts/Android.bp
+++ b/identity/aidl/vts/Android.bp
@@ -58,3 +58,16 @@
         "vts",
     ],
 }
+
+java_test_host {
+    name: "IdentityCredentialImplementedTest",
+    libs: [
+        "tradefed",
+        "vts-core-tradefed-harness",
+    ],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "vts",
+    ],
+    test_config: "IdentityCredentialImplementedTest.xml",
+}
diff --git a/identity/aidl/vts/DeleteCredentialTests.cpp b/identity/aidl/vts/DeleteCredentialTests.cpp
index 7627c9c..a126463 100644
--- a/identity/aidl/vts/DeleteCredentialTests.cpp
+++ b/identity/aidl/vts/DeleteCredentialTests.cpp
@@ -146,7 +146,9 @@
                                 credentialData_, &credential)
                         .isOk());
 
-    vector<uint8_t> challenge = {65, 66, 67};
+    // Implementations must support at least 32 bytes.
+    string challengeString = "0123456789abcdef0123456789abcdef";
+    vector<uint8_t> challenge(challengeString.begin(), challengeString.end());
     vector<uint8_t> proofOfDeletionSignature;
     ASSERT_TRUE(
             credential->deleteCredentialWithChallenge(challenge, &proofOfDeletionSignature).isOk());
@@ -154,8 +156,13 @@
             support::coseSignGetPayload(proofOfDeletionSignature);
     ASSERT_TRUE(proofOfDeletion);
     string cborPretty = cppbor::prettyPrint(proofOfDeletion.value(), 32, {});
-    EXPECT_EQ("['ProofOfDeletion', 'org.iso.18013-5.2019.mdl', {0x41, 0x42, 0x43}, true, ]",
-              cborPretty);
+    EXPECT_EQ(
+            "['ProofOfDeletion', 'org.iso.18013-5.2019.mdl', {"
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, "
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66}, true, ]",
+            cborPretty);
     EXPECT_TRUE(support::coseCheckEcDsaSignature(proofOfDeletionSignature, {},  // Additional data
                                                  credentialPubKey_));
 }
diff --git a/identity/aidl/vts/IdentityCredentialImplementedTest.xml b/identity/aidl/vts/IdentityCredentialImplementedTest.xml
new file mode 100644
index 0000000..1d76a74
--- /dev/null
+++ b/identity/aidl/vts/IdentityCredentialImplementedTest.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs IdentityCredentialImplementedTest">
+  <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
+
+  <test class="com.android.tradefed.testtype.HostTest" >
+    <option name="jar" value="IdentityCredentialImplementedTest.jar" />
+  </test>
+</configuration>
diff --git a/identity/aidl/vts/ProveOwnershipTests.cpp b/identity/aidl/vts/ProveOwnershipTests.cpp
index c622193..f8ec670 100644
--- a/identity/aidl/vts/ProveOwnershipTests.cpp
+++ b/identity/aidl/vts/ProveOwnershipTests.cpp
@@ -125,14 +125,22 @@
                                 credentialData_, &credential)
                         .isOk());
 
-    vector<uint8_t> challenge = {17, 18};
+    // Implementations must support at least 32 bytes.
+    string challengeString = "0123456789abcdef0123456789abcdef";
+    vector<uint8_t> challenge(challengeString.begin(), challengeString.end());
     vector<uint8_t> proofOfOwnershipSignature;
     ASSERT_TRUE(credential->proveOwnership(challenge, &proofOfOwnershipSignature).isOk());
     optional<vector<uint8_t>> proofOfOwnership =
             support::coseSignGetPayload(proofOfOwnershipSignature);
     ASSERT_TRUE(proofOfOwnership);
     string cborPretty = cppbor::prettyPrint(proofOfOwnership.value(), 32, {});
-    EXPECT_EQ("['ProofOfOwnership', 'org.iso.18013-5.2019.mdl', {0x11, 0x12}, true, ]", cborPretty);
+    EXPECT_EQ(
+            "['ProofOfOwnership', 'org.iso.18013-5.2019.mdl', {"
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, "
+            "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
+            "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66}, true, ]",
+            cborPretty);
     EXPECT_TRUE(support::coseCheckEcDsaSignature(proofOfOwnershipSignature, {},  // Additional data
                                                  credentialPubKey_));
 }
diff --git a/identity/aidl/vts/VtsAttestationTests.cpp b/identity/aidl/vts/VtsAttestationTests.cpp
index e12fe05..7caa259 100644
--- a/identity/aidl/vts/VtsAttestationTests.cpp
+++ b/identity/aidl/vts/VtsAttestationTests.cpp
@@ -66,7 +66,8 @@
     ASSERT_TRUE(setupWritableCredential(writableCredential, credentialStore_,
                                         false /* testCredential */));
 
-    string challenge = "NotSoRandomChallenge1NotSoRandomChallenge1NotSoRandomChallenge1";
+    // Must support at least 32 bytes.
+    string challenge = "0123456789abcdef0123456789abcdef";
     vector<uint8_t> attestationChallenge(challenge.begin(), challenge.end());
     vector<Certificate> attestationCertificate;
     string applicationId = "Attestation Verification";
diff --git a/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java b/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java
new file mode 100644
index 0000000..19568af
--- /dev/null
+++ b/identity/aidl/vts/src/com/android/tests/security/identity/IdentityCredentialImplementedTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.tests.security.identity;
+
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeTrue;
+
+import android.platform.test.annotations.RequiresDevice;
+import com.android.tradefed.device.DeviceNotAvailableException;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class IdentityCredentialImplementedTest extends BaseHostJUnit4Test {
+    // Returns the ro.vendor.api_level or 0 if not set.
+    //
+    // Throws NumberFormatException if ill-formatted.
+    //
+    // Throws DeviceNotAvailableException if device is not available.
+    //
+    private int getVendorApiLevel() throws NumberFormatException, DeviceNotAvailableException {
+        String vendorApiLevelString =
+                getDevice().executeShellCommand("getprop ro.vendor.api_level").trim();
+        if (vendorApiLevelString.isEmpty()) {
+            return 0;
+        }
+        return Integer.parseInt(vendorApiLevelString);
+    }
+
+    // As of Android 13 (API level 32), Identity Credential is required at feature version 202201
+    // or newer.
+    //
+    @RequiresDevice
+    @Test
+    public void testIdentityCredentialIsImplemented() throws Exception {
+        int vendorApiLevel = getVendorApiLevel();
+        assumeTrue(vendorApiLevel >= 32);
+
+        final String minimumFeatureVersionNeeded = "202201";
+
+        String result = getDevice().executeShellCommand(
+                "pm has-feature android.hardware.identity_credential "
+                + minimumFeatureVersionNeeded);
+        if (!result.trim().equals("true")) {
+            fail("Identity Credential feature version " + minimumFeatureVersionNeeded
+                    + " required but not found");
+        }
+    }
+}
diff --git a/neuralnetworks/aidl/utils/src/Conversions.cpp b/neuralnetworks/aidl/utils/src/Conversions.cpp
index eb28db7..9b897c4 100644
--- a/neuralnetworks/aidl/utils/src/Conversions.cpp
+++ b/neuralnetworks/aidl/utils/src/Conversions.cpp
@@ -967,6 +967,11 @@
 }
 
 nn::GeneralResult<Model> unvalidatedConvert(const nn::Model& model) {
+    if (!hal::utils::hasNoPointerData(model)) {
+        return NN_ERROR(nn::ErrorStatus::INVALID_ARGUMENT)
+               << "Model cannot be unvalidatedConverted because it contains pointer-based memory";
+    }
+
     return Model{
             .main = NN_TRY(unvalidatedConvert(model.main)),
             .referenced = NN_TRY(unvalidatedConvert(model.referenced)),
@@ -982,6 +987,11 @@
 }
 
 nn::GeneralResult<Request> unvalidatedConvert(const nn::Request& request) {
+    if (!hal::utils::hasNoPointerData(request)) {
+        return NN_ERROR(nn::ErrorStatus::INVALID_ARGUMENT)
+               << "Request cannot be unvalidatedConverted because it contains pointer-based memory";
+    }
+
     return Request{
             .inputs = NN_TRY(unvalidatedConvert(request.inputs)),
             .outputs = NN_TRY(unvalidatedConvert(request.outputs)),
diff --git a/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h b/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
index ae0d092..c04294a 100644
--- a/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
+++ b/neuralnetworks/utils/common/include/nnapi/hal/CommonUtils.h
@@ -20,6 +20,7 @@
 #include <nnapi/Result.h>
 #include <nnapi/SharedMemory.h>
 #include <nnapi/Types.h>
+
 #include <functional>
 #include <vector>
 
@@ -47,81 +48,10 @@
         const nn::Capabilities::PerformanceInfo& float32Performance,
         const nn::Capabilities::PerformanceInfo& quantized8Performance);
 
-// Indicates if the object contains no pointer-based data that could be relocated to shared memory.
-bool hasNoPointerData(const nn::Model& model);
-bool hasNoPointerData(const nn::Request& request);
-
-// Relocate pointer-based data to shared memory. If `model` has no Operand::LifeTime::POINTER data,
-// the function returns with a reference to `model`. If `model` has Operand::LifeTime::POINTER data,
-// the model is copied to `maybeModelInSharedOut` with the POINTER data relocated to a memory pool,
-// and the function returns with a reference to `*maybeModelInSharedOut`.
-nn::GeneralResult<std::reference_wrapper<const nn::Model>> flushDataFromPointerToShared(
-        const nn::Model* model, std::optional<nn::Model>* maybeModelInSharedOut);
-
-// Record a relocation mapping between pointer-based data and shared memory.
-// Only two specializations of this template may exist:
-// - RelocationInfo<const void*> for request inputs
-// - RelocationInfo<void*> for request outputs
-template <typename PointerType>
-struct RelocationInfo {
-    PointerType data;
-    size_t length;
-    size_t offset;
-};
-using InputRelocationInfo = RelocationInfo<const void*>;
-using OutputRelocationInfo = RelocationInfo<void*>;
-
-// Keep track of the relocation mapping between pointer-based data and shared memory pool,
-// and provide method to copy the data between pointers and the shared memory pool.
-// Only two specializations of this template may exist:
-// - RelocationTracker<InputRelocationInfo> for request inputs
-// - RelocationTracker<OutputRelocationInfo> for request outputs
-template <typename RelocationInfoType>
-class RelocationTracker {
-  public:
-    static nn::GeneralResult<std::unique_ptr<RelocationTracker>> create(
-            std::vector<RelocationInfoType> relocationInfos, nn::SharedMemory memory) {
-        auto mapping = NN_TRY(map(memory));
-        return std::make_unique<RelocationTracker<RelocationInfoType>>(
-                std::move(relocationInfos), std::move(memory), std::move(mapping));
-    }
-
-    RelocationTracker(std::vector<RelocationInfoType> relocationInfos, nn::SharedMemory memory,
-                      nn::Mapping mapping)
-        : kRelocationInfos(std::move(relocationInfos)),
-          kMemory(std::move(memory)),
-          kMapping(std::move(mapping)) {}
-
-    // Specializations defined in CommonUtils.cpp.
-    // For InputRelocationTracker, this method will copy pointer data to the shared memory pool.
-    // For OutputRelocationTracker, this method will copy shared memory data to the pointers.
-    void flush() const;
-
-  private:
-    const std::vector<RelocationInfoType> kRelocationInfos;
-    const nn::SharedMemory kMemory;
-    const nn::Mapping kMapping;
-};
-using InputRelocationTracker = RelocationTracker<InputRelocationInfo>;
-using OutputRelocationTracker = RelocationTracker<OutputRelocationInfo>;
-
-struct RequestRelocation {
-    std::unique_ptr<InputRelocationTracker> input;
-    std::unique_ptr<OutputRelocationTracker> output;
-};
-
-// Relocate pointer-based data to shared memory. If `request` has no
-// Request::Argument::LifeTime::POINTER data, the function returns with a reference to `request`. If
-// `request` has Request::Argument::LifeTime::POINTER data, the request is copied to
-// `maybeRequestInSharedOut` with the POINTER data relocated to a memory pool, and the function
-// returns with a reference to `*maybeRequestInSharedOut`. The `relocationOut` will be set to track
-// the input and output relocations.
-//
-// Unlike `flushDataFromPointerToShared`, this method will not copy the input pointer data to the
-// shared memory pool. Use `relocationOut` to flush the input or output data after the call.
-nn::GeneralResult<std::reference_wrapper<const nn::Request>> convertRequestFromPointerToShared(
-        const nn::Request* request, uint32_t alignment, uint32_t padding,
-        std::optional<nn::Request>* maybeRequestInSharedOut, RequestRelocation* relocationOut);
+using nn::convertRequestFromPointerToShared;
+using nn::flushDataFromPointerToShared;
+using nn::hasNoPointerData;
+using nn::RequestRelocation;
 
 }  // namespace android::hardware::neuralnetworks::utils
 
diff --git a/neuralnetworks/utils/common/src/CommonUtils.cpp b/neuralnetworks/utils/common/src/CommonUtils.cpp
index b249881..dd55add 100644
--- a/neuralnetworks/utils/common/src/CommonUtils.cpp
+++ b/neuralnetworks/utils/common/src/CommonUtils.cpp
@@ -31,59 +31,6 @@
 #include <vector>
 
 namespace android::hardware::neuralnetworks::utils {
-namespace {
-
-bool hasNoPointerData(const nn::Operand& operand);
-bool hasNoPointerData(const nn::Model::Subgraph& subgraph);
-bool hasNoPointerData(const nn::Request::Argument& argument);
-
-template <typename Type>
-bool hasNoPointerData(const std::vector<Type>& objects) {
-    return std::all_of(objects.begin(), objects.end(),
-                       [](const auto& object) { return hasNoPointerData(object); });
-}
-
-bool hasNoPointerData(const nn::DataLocation& location) {
-    return std::visit([](auto ptr) { return ptr == nullptr; }, location.pointer);
-}
-
-bool hasNoPointerData(const nn::Operand& operand) {
-    return hasNoPointerData(operand.location);
-}
-
-bool hasNoPointerData(const nn::Model::Subgraph& subgraph) {
-    return hasNoPointerData(subgraph.operands);
-}
-
-bool hasNoPointerData(const nn::Request::Argument& argument) {
-    return hasNoPointerData(argument.location);
-}
-
-void copyPointersToSharedMemory(nn::Operand* operand, nn::ConstantMemoryBuilder* memoryBuilder) {
-    CHECK(operand != nullptr);
-    CHECK(memoryBuilder != nullptr);
-
-    if (operand->lifetime != nn::Operand::LifeTime::POINTER) {
-        return;
-    }
-
-    const void* data = std::visit([](auto ptr) { return static_cast<const void*>(ptr); },
-                                  operand->location.pointer);
-    CHECK(data != nullptr);
-    operand->lifetime = nn::Operand::LifeTime::CONSTANT_REFERENCE;
-    operand->location = memoryBuilder->append(data, operand->location.length);
-}
-
-void copyPointersToSharedMemory(nn::Model::Subgraph* subgraph,
-                                nn::ConstantMemoryBuilder* memoryBuilder) {
-    CHECK(subgraph != nullptr);
-    std::for_each(subgraph->operands.begin(), subgraph->operands.end(),
-                  [memoryBuilder](auto& operand) {
-                      copyPointersToSharedMemory(&operand, memoryBuilder);
-                  });
-}
-
-}  // anonymous namespace
 
 nn::Capabilities::OperandPerformanceTable makeQuantized8PerformanceConsistentWithP(
         const nn::Capabilities::PerformanceInfo& float32Performance,
@@ -104,131 +51,4 @@
             .value();
 }
 
-bool hasNoPointerData(const nn::Model& model) {
-    return hasNoPointerData(model.main) && hasNoPointerData(model.referenced);
-}
-
-bool hasNoPointerData(const nn::Request& request) {
-    return hasNoPointerData(request.inputs) && hasNoPointerData(request.outputs);
-}
-
-nn::GeneralResult<std::reference_wrapper<const nn::Model>> flushDataFromPointerToShared(
-        const nn::Model* model, std::optional<nn::Model>* maybeModelInSharedOut) {
-    CHECK(model != nullptr);
-    CHECK(maybeModelInSharedOut != nullptr);
-
-    if (hasNoPointerData(*model)) {
-        return *model;
-    }
-
-    // Make a copy of the model in order to make modifications. The modified model is returned to
-    // the caller through `maybeModelInSharedOut` if the function succeeds.
-    nn::Model modelInShared = *model;
-
-    nn::ConstantMemoryBuilder memoryBuilder(modelInShared.pools.size());
-    copyPointersToSharedMemory(&modelInShared.main, &memoryBuilder);
-    std::for_each(modelInShared.referenced.begin(), modelInShared.referenced.end(),
-                  [&memoryBuilder](auto& subgraph) {
-                      copyPointersToSharedMemory(&subgraph, &memoryBuilder);
-                  });
-
-    if (!memoryBuilder.empty()) {
-        auto memory = NN_TRY(memoryBuilder.finish());
-        modelInShared.pools.push_back(std::move(memory));
-    }
-
-    *maybeModelInSharedOut = modelInShared;
-    return **maybeModelInSharedOut;
-}
-
-template <>
-void InputRelocationTracker::flush() const {
-    // Copy from pointers to shared memory.
-    uint8_t* memoryPtr = static_cast<uint8_t*>(std::get<void*>(kMapping.pointer));
-    for (const auto& [data, length, offset] : kRelocationInfos) {
-        std::memcpy(memoryPtr + offset, data, length);
-    }
-}
-
-template <>
-void OutputRelocationTracker::flush() const {
-    // Copy from shared memory to pointers.
-    const uint8_t* memoryPtr = static_cast<const uint8_t*>(
-            std::visit([](auto ptr) { return static_cast<const void*>(ptr); }, kMapping.pointer));
-    for (const auto& [data, length, offset] : kRelocationInfos) {
-        std::memcpy(data, memoryPtr + offset, length);
-    }
-}
-
-nn::GeneralResult<std::reference_wrapper<const nn::Request>> convertRequestFromPointerToShared(
-        const nn::Request* request, uint32_t alignment, uint32_t padding,
-        std::optional<nn::Request>* maybeRequestInSharedOut, RequestRelocation* relocationOut) {
-    CHECK(request != nullptr);
-    CHECK(maybeRequestInSharedOut != nullptr);
-    CHECK(relocationOut != nullptr);
-
-    if (hasNoPointerData(*request)) {
-        return *request;
-    }
-
-    // Make a copy of the request in order to make modifications. The modified request is returned
-    // to the caller through `maybeRequestInSharedOut` if the function succeeds.
-    nn::Request requestInShared = *request;
-
-    RequestRelocation relocation;
-
-    // Change input pointers to shared memory.
-    nn::MutableMemoryBuilder inputBuilder(requestInShared.pools.size());
-    std::vector<InputRelocationInfo> inputRelocationInfos;
-    for (auto& input : requestInShared.inputs) {
-        const auto& location = input.location;
-        if (input.lifetime != nn::Request::Argument::LifeTime::POINTER) {
-            continue;
-        }
-
-        input.lifetime = nn::Request::Argument::LifeTime::POOL;
-        const void* data = std::visit([](auto ptr) { return static_cast<const void*>(ptr); },
-                                      location.pointer);
-        CHECK(data != nullptr);
-        input.location = inputBuilder.append(location.length, alignment, padding);
-        inputRelocationInfos.push_back({data, input.location.length, input.location.offset});
-    }
-
-    // Allocate input memory.
-    if (!inputBuilder.empty()) {
-        auto memory = NN_TRY(inputBuilder.finish());
-        requestInShared.pools.push_back(memory);
-        relocation.input = NN_TRY(
-                InputRelocationTracker::create(std::move(inputRelocationInfos), std::move(memory)));
-    }
-
-    // Change output pointers to shared memory.
-    nn::MutableMemoryBuilder outputBuilder(requestInShared.pools.size());
-    std::vector<OutputRelocationInfo> outputRelocationInfos;
-    for (auto& output : requestInShared.outputs) {
-        const auto& location = output.location;
-        if (output.lifetime != nn::Request::Argument::LifeTime::POINTER) {
-            continue;
-        }
-
-        output.lifetime = nn::Request::Argument::LifeTime::POOL;
-        void* data = std::get<void*>(location.pointer);
-        CHECK(data != nullptr);
-        output.location = outputBuilder.append(location.length, alignment, padding);
-        outputRelocationInfos.push_back({data, output.location.length, output.location.offset});
-    }
-
-    // Allocate output memory.
-    if (!outputBuilder.empty()) {
-        auto memory = NN_TRY(outputBuilder.finish());
-        requestInShared.pools.push_back(memory);
-        relocation.output = NN_TRY(OutputRelocationTracker::create(std::move(outputRelocationInfos),
-                                                                   std::move(memory)));
-    }
-
-    *maybeRequestInSharedOut = requestInShared;
-    *relocationOut = std::move(relocation);
-    return **maybeRequestInSharedOut;
-}
-
 }  // namespace android::hardware::neuralnetworks::utils
diff --git a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
index 94ed242..02bbf21 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.data/current/android/hardware/radio/data/DataProfileInfo.aidl
@@ -62,6 +62,6 @@
   const int ID_OEM_BASE = 1000;
   const int ID_INVALID = -1;
   const int TYPE_COMMON = 0;
-  const int TYPE_THREE_GPP = 1;
-  const int TYPE_THREE_GPP2 = 2;
+  const int TYPE_3GPP = 1;
+  const int TYPE_3GPP2 = 2;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
index b0fc349..dfec59a 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessaging.aidl
@@ -37,7 +37,6 @@
   oneway void acknowledgeIncomingGsmSmsWithPdu(in int serial, in boolean success, in String ackPdu);
   oneway void acknowledgeLastIncomingCdmaSms(in int serial, in android.hardware.radio.messaging.CdmaSmsAck smsAck);
   oneway void acknowledgeLastIncomingGsmSms(in int serial, in boolean success, in android.hardware.radio.messaging.SmsAcknowledgeFailCause cause);
-  oneway void cancelPendingUssd(in int serial);
   oneway void deleteSmsOnRuim(in int serial, in int index);
   oneway void deleteSmsOnSim(in int serial, in int index);
   oneway void getCdmaBroadcastConfig(in int serial);
@@ -50,7 +49,6 @@
   oneway void sendImsSms(in int serial, in android.hardware.radio.messaging.ImsSmsMessage message);
   oneway void sendSms(in int serial, in android.hardware.radio.messaging.GsmSmsMessage message);
   oneway void sendSmsExpectMore(in int serial, in android.hardware.radio.messaging.GsmSmsMessage message);
-  oneway void sendUssd(in int serial, in String ussd);
   oneway void setCdmaBroadcastActivation(in int serial, in boolean activate);
   oneway void setCdmaBroadcastConfig(in int serial, in android.hardware.radio.messaging.CdmaBroadcastSmsConfigInfo[] configInfo);
   oneway void setGsmBroadcastActivation(in int serial, in boolean activate);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
index 89a0f3b..8f7824f 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
@@ -40,6 +40,5 @@
   oneway void newSms(in android.hardware.radio.RadioIndicationType type, in byte[] pdu);
   oneway void newSmsOnSim(in android.hardware.radio.RadioIndicationType type, in int recordNumber);
   oneway void newSmsStatusReport(in android.hardware.radio.RadioIndicationType type, in byte[] pdu);
-  oneway void onUssd(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.messaging.UssdModeType modeType, in String msg);
   oneway void simSmsStorageFull(in android.hardware.radio.RadioIndicationType type);
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
index 156f24b..c3af7a6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
@@ -38,7 +38,6 @@
   oneway void acknowledgeLastIncomingCdmaSmsResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeLastIncomingGsmSmsResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeRequest(in int serial);
-  oneway void cancelPendingUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void deleteSmsOnRuimResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void deleteSmsOnSimResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void getCdmaBroadcastConfigResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.CdmaBroadcastSmsConfigInfo[] configs);
@@ -50,7 +49,6 @@
   oneway void sendImsSmsResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
   oneway void sendSmsExpectMoreResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
   oneway void sendSmsResponse(in android.hardware.radio.RadioResponseInfo info, in android.hardware.radio.messaging.SendSmsResult sms);
-  oneway void sendUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCdmaBroadcastActivationResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCdmaBroadcastConfigResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setGsmBroadcastActivationResponse(in android.hardware.radio.RadioResponseInfo info);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl b/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
deleted file mode 100644
index 4f29c0b..0000000
--- a/radio/aidl/aidl_api/android.hardware.radio.network/current/android/hardware/radio/network/NeighboringCell.aidl
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-///////////////////////////////////////////////////////////////////////////////
-// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
-///////////////////////////////////////////////////////////////////////////////
-
-// This file is a snapshot of an AIDL file. Do not edit it manually. There are
-// two cases:
-// 1). this is a frozen version file - do not edit this in any case.
-// 2). this is a 'current' file. If you make a backwards compatible change to
-//     the interface (from the latest frozen version), the build system will
-//     prompt you to update this file with `m <name>-update-api`.
-//
-// You must not make a backward incompatible change to any AIDL file built
-// with the aidl_interface module type with versions property set. The module
-// type is used to build AIDL files in a way that they can be used across
-// independently updatable components of the system. If a device is shipped
-// with such a backward incompatible change, it has a high risk of breaking
-// later when a module using the interface is updated, e.g., Mainline modules.
-
-package android.hardware.radio.network;
-@VintfStability
-parcelable NeighboringCell {
-  String cid;
-  int rssi;
-}
diff --git a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
index ef9c779..85cf86e 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.sim/current/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -36,6 +36,5 @@
 parcelable CarrierRestrictions {
   android.hardware.radio.sim.Carrier[] allowedCarriers;
   android.hardware.radio.sim.Carrier[] excludedCarriers;
-  boolean priority;
   boolean allowedCarriersPrioritized;
 }
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
index 34d155a..603b1d6 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoice.aidl
@@ -35,6 +35,7 @@
 @VintfStability
 interface IRadioVoice {
   oneway void acceptCall(in int serial);
+  oneway void cancelPendingUssd(in int serial);
   oneway void conference(in int serial);
   oneway void dial(in int serial, in android.hardware.radio.voice.Dial dialInfo);
   oneway void emergencyDial(in int serial, in android.hardware.radio.voice.Dial dialInfo, in int categories, in String[] urns, in android.hardware.radio.voice.EmergencyCallRouting routing, in boolean hasKnownUserIntentEmergency, in boolean isTesting);
@@ -59,6 +60,7 @@
   oneway void sendBurstDtmf(in int serial, in String dtmf, in int on, in int off);
   oneway void sendCdmaFeatureCode(in int serial, in String featureCode);
   oneway void sendDtmf(in int serial, in String s);
+  oneway void sendUssd(in int serial, in String ussd);
   oneway void separateConnection(in int serial, in int gsmIndex);
   oneway void setCallForward(in int serial, in android.hardware.radio.voice.CallForwardInfo callInfo);
   oneway void setCallWaiting(in int serial, in boolean enable, in int serviceClass);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
index af3417d..189ed43 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceIndication.aidl
@@ -44,6 +44,7 @@
   oneway void exitEmergencyCallbackMode(in android.hardware.radio.RadioIndicationType type);
   oneway void indicateRingbackTone(in android.hardware.radio.RadioIndicationType type, in boolean start);
   oneway void onSupplementaryServiceIndication(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.StkCcUnsolSsResult ss);
+  oneway void onUssd(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.UssdModeType modeType, in String msg);
   oneway void resendIncallMute(in android.hardware.radio.RadioIndicationType type);
   oneway void srvccStateNotify(in android.hardware.radio.RadioIndicationType type, in android.hardware.radio.voice.SrvccState state);
   oneway void stkCallControlAlphaNotify(in android.hardware.radio.RadioIndicationType type, in String alpha);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
index a3b5e58..7acc044 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/IRadioVoiceResponse.aidl
@@ -36,6 +36,7 @@
 interface IRadioVoiceResponse {
   oneway void acceptCallResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void acknowledgeRequest(in int serial);
+  oneway void cancelPendingUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void conferenceResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void dialResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void emergencyDialResponse(in android.hardware.radio.RadioResponseInfo info);
@@ -59,6 +60,7 @@
   oneway void sendBurstDtmfResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void sendCdmaFeatureCodeResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void sendDtmfResponse(in android.hardware.radio.RadioResponseInfo info);
+  oneway void sendUssdResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void separateConnectionResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCallForwardResponse(in android.hardware.radio.RadioResponseInfo info);
   oneway void setCallWaitingResponse(in android.hardware.radio.RadioResponseInfo info);
diff --git a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
similarity index 97%
rename from radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
rename to radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
index 5395b11..9a9d723 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.messaging/current/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.voice/current/android/hardware/radio/voice/UssdModeType.aidl
@@ -31,7 +31,7 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.radio.messaging;
+package android.hardware.radio.voice;
 @Backing(type="int") @VintfStability
 enum UssdModeType {
   NOTIFY = 0,
diff --git a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
index 84201d3..123b3ed 100644
--- a/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
+++ b/radio/aidl/android/hardware/radio/data/DataProfileInfo.aidl
@@ -16,9 +16,7 @@
 
 package android.hardware.radio.data;
 
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.data.ApnAuthType;
-import android.hardware.radio.data.ApnTypes;
 import android.hardware.radio.data.PdpProtocolType;
 import android.hardware.radio.data.TrafficDescriptor;
 
@@ -36,8 +34,8 @@
     const int ID_INVALID = 0xFFFFFFFF;
 
     const int TYPE_COMMON = 0;
-    const int TYPE_THREE_GPP = 1;
-    const int TYPE_THREE_GPP2 = 2;
+    const int TYPE_3GPP = 1;
+    const int TYPE_3GPP2 = 2;
 
     /**
      * ID of the data profile.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
index 1dbaed3..8bd84a3 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessaging.aidl
@@ -79,15 +79,6 @@
             in int serial, in boolean success, in SmsAcknowledgeFailCause cause);
 
     /**
-     * Cancel the current USSD session if one exists.
-     *
-     * @param serial Serial number of request.
-     *
-     * Response function is IRadioMessagingResponse.cancelPendingUssdResponse()
-     */
-    void cancelPendingUssd(in int serial);
-
-    /**
      * Deletes a CDMA SMS message from RUIM memory.
      *
      * @param serial Serial number of request.
@@ -212,23 +203,6 @@
     void sendSmsExpectMore(in int serial, in GsmSmsMessage message);
 
     /**
-     * Send a USSD message. If a USSD session already exists, the message must be sent in the
-     * context of that session. Otherwise, a new session must be created. The network reply must be
-     * reported via unsolOnUssd.
-     *
-     * Only one USSD session must exist at a time, and the session is assumed to exist until:
-     * a) The android system invokes cancelUssd()
-     * b) The implementation sends a unsolOnUssd() with a type code of
-     *    "0" (USSD-Notify/no further action) or "2" (session terminated)
-     *
-     * @param serial Serial number of request.
-     * @param ussd string containing the USSD request in UTF-8 format
-     *
-     * Response function is IRadioMessagingResponse.sendUssdResponse()
-     */
-    void sendUssd(in int serial, in String ussd);
-
-    /**
      * Enable or disable the reception of CDMA Cell Broadcast SMS
      *
      * @param serial Serial number of request.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
index 4b40bfb..8834cd9 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingIndication.aidl
@@ -18,7 +18,6 @@
 
 import android.hardware.radio.RadioIndicationType;
 import android.hardware.radio.messaging.CdmaSmsMessage;
-import android.hardware.radio.messaging.UssdModeType;
 
 /**
  * Interface declaring unsolicited radio indications for messaging APIs.
@@ -86,16 +85,6 @@
     void newSmsStatusReport(in RadioIndicationType type, in byte[] pdu);
 
     /**
-     * Indicates when a new USSD message is received. The USSD session is assumed to persist if the
-     * type code is REQUEST, otherwise the current session (if any) is assumed to have terminated.
-     *
-     * @param type Type of radio indication
-     * @param modeType USSD type code
-     * @param msg Message string in UTF-8, if applicable
-     */
-    void onUssd(in RadioIndicationType type, in UssdModeType modeType, in String msg);
-
-    /**
      * Indicates that SMS storage on the SIM is full. Sent when the network attempts to deliver a
      * new SMS message. Messages cannot be saved on the SIM until space is freed. In particular,
      * incoming Class 2 messages must not be stored.
diff --git a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
index 75fa390..492755f 100644
--- a/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
+++ b/radio/aidl/android/hardware/radio/messaging/IRadioMessagingResponse.aidl
@@ -92,27 +92,6 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
-     *   RadioError:SIM_BUSY
-     *   RadioError:OPERATION_NOT_ALLOWED
-     *   RadioError:MODEM_ERR
-     *   RadioError:INTERNAL_ERR
-     *   RadioError:NO_MEMORY
-     *   RadioError:INVALID_STATE
-     *   RadioError:INVALID_ARGUMENTS
-     *   RadioError:SYSTEM_ERR
-     *   RadioError:REQUEST_NOT_SUPPORTED
-     *   RadioError:INVALID_MODEM_STATE
-     *   RadioError:NO_RESOURCES
-     *   RadioError:CANCELLED
-     */
-    void cancelPendingUssdResponse(in RadioResponseInfo info);
-
-    /**
-     * @param info Response info struct containing response type, serial no. and error
-     *
-     * Valid errors returned:
-     *   RadioError:NONE
-     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:NO_MEMORY
      *   RadioError:SYSTEM_ERR
@@ -407,32 +386,6 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
-     *   RadioError:FDN_CHECK_FAILURE
-     *   RadioError:USSD_MODIFIED_TO_DIAL
-     *   RadioError:USSD_MODIFIED_TO_SS
-     *   RadioError:USSD_MODIFIED_TO_USSD
-     *   RadioError:SIM_BUSY
-     *   RadioError:OPERATION_NOT_ALLOWED
-     *   RadioError:INVALID_ARGUMENTS
-     *   RadioError:NO_MEMORY
-     *   RadioError:MODEM_ERR
-     *   RadioError:INTERNAL_ERR
-     *   RadioError:ABORTED
-     *   RadioError:SYSTEM_ERR
-     *   RadioError:INVALID_STATE
-     *   RadioError:REQUEST_NOT_SUPPORTED
-     *   RadioError:INVALID_MODEM_STATE
-     *   RadioError:NO_RESOURCES
-     *   RadioError:CANCELLED
-     */
-    void sendUssdResponse(in RadioResponseInfo info);
-
-    /**
-     * @param info Response info struct containing response type, serial no. and error
-     *
-     * Valid errors returned:
-     *   RadioError:NONE
-     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:INVALID_STATE
      *   RadioError:NO_MEMORY
diff --git a/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl b/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
index 9bd5f21..96b9d0d 100644
--- a/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
+++ b/radio/aidl/android/hardware/radio/modem/RadioCapability.aidl
@@ -16,8 +16,6 @@
 
 package android.hardware.radio.modem;
 
-import android.hardware.radio.RadioAccessFamily;
-
 @VintfStability
 parcelable RadioCapability {
     /**
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
index 7a22a9a..cce52ff 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl
@@ -17,7 +17,6 @@
 package android.hardware.radio.network;
 
 import android.hardware.radio.AccessNetwork;
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.network.CdmaRoamingType;
 import android.hardware.radio.network.IRadioNetworkIndication;
 import android.hardware.radio.network.IRadioNetworkResponse;
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
index 6863ac3..f471433 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkIndication.aidl
@@ -21,7 +21,6 @@
 import android.hardware.radio.network.BarringInfo;
 import android.hardware.radio.network.CellIdentity;
 import android.hardware.radio.network.CellInfo;
-import android.hardware.radio.network.Domain;
 import android.hardware.radio.network.LinkCapacityEstimate;
 import android.hardware.radio.network.NetworkScanResult;
 import android.hardware.radio.network.PhoneRestrictedState;
diff --git a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
index e650321..dcf0004 100644
--- a/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
+++ b/radio/aidl/android/hardware/radio/network/IRadioNetworkResponse.aidl
@@ -16,7 +16,6 @@
 
 package android.hardware.radio.network;
 
-import android.hardware.radio.RadioAccessFamily;
 import android.hardware.radio.RadioResponseInfo;
 import android.hardware.radio.RadioTechnology;
 import android.hardware.radio.RadioTechnologyFamily;
@@ -24,8 +23,6 @@
 import android.hardware.radio.network.CdmaRoamingType;
 import android.hardware.radio.network.CellIdentity;
 import android.hardware.radio.network.CellInfo;
-import android.hardware.radio.network.LceDataInfo;
-import android.hardware.radio.network.NeighboringCell;
 import android.hardware.radio.network.OperatorInfo;
 import android.hardware.radio.network.RadioAccessSpecifier;
 import android.hardware.radio.network.RadioBandMode;
diff --git a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl b/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
deleted file mode 100644
index 270bdee..0000000
--- a/radio/aidl/android/hardware/radio/network/NeighboringCell.aidl
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.radio.network;
-
-@VintfStability
-parcelable NeighboringCell {
-    /**
-     * Combination of LAC and cell ID in 32 bits in GSM. Upper 16 bits is LAC and lower 16 bits is
-     * CID (as described in TS 27.005).
-     */
-    String cid;
-    /**
-     * Received RSSI in GSM, level index of CPICH Received Signal Code Power in UMTS
-     */
-    int rssi;
-}
diff --git a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
index 12df138..ef38fdc 100644
--- a/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
+++ b/radio/aidl/android/hardware/radio/sim/CarrierRestrictions.aidl
@@ -31,11 +31,6 @@
      */
     Carrier[] excludedCarriers;
     /**
-     * Whether this is a carrier restriction with priority or not.
-     * If this is false, allowedCarriersPrioritized is not applicable.
-     */
-    boolean priority;
-    /**
      * True means that only carriers included in the allowed list and not in the excluded list
      * are permitted. Eg. allowedCarriers match mcc/mnc, excludedCarriers has same mcc/mnc and
      * gid1 is ABCD. It means except the carrier whose gid1 is ABCD, all carriers with the
diff --git a/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl b/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
index ddc5d76..9fed78e 100644
--- a/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
+++ b/radio/aidl/android/hardware/radio/voice/EmergencyNumber.aidl
@@ -16,8 +16,6 @@
 
 package android.hardware.radio.voice;
 
-import android.hardware.radio.voice.EmergencyServiceCategory;
-
 /**
  * Emergency number contains information of number, one or more service category(s), zero or more
  * emergency uniform resource names, mobile country code (mcc), mobile network country (mnc) and
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
index b25e63d..c05d237 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoice.aidl
@@ -19,7 +19,6 @@
 import android.hardware.radio.voice.CallForwardInfo;
 import android.hardware.radio.voice.Dial;
 import android.hardware.radio.voice.EmergencyCallRouting;
-import android.hardware.radio.voice.EmergencyServiceCategory;
 import android.hardware.radio.voice.IRadioVoiceIndication;
 import android.hardware.radio.voice.IRadioVoiceResponse;
 import android.hardware.radio.voice.TtyMode;
@@ -45,6 +44,15 @@
     void acceptCall(in int serial);
 
     /**
+     * Cancel the current USSD session if one exists.
+     *
+     * @param serial Serial number of request.
+     *
+     * Response function is IRadioVoiceResponse.cancelPendingUssdResponse()
+     */
+    void cancelPendingUssd(in int serial);
+
+    /**
      * Conference holding and active (like AT+CHLD=3)
      *
      * @param serial Serial number of request.
@@ -325,6 +333,23 @@
     void sendDtmf(in int serial, in String s);
 
     /**
+     * Send a USSD message. If a USSD session already exists, the message must be sent in the
+     * context of that session. Otherwise, a new session must be created. The network reply must be
+     * reported via unsolOnUssd.
+     *
+     * Only one USSD session must exist at a time, and the session is assumed to exist until:
+     * a) The android system invokes cancelUssd()
+     * b) The implementation sends a unsolOnUssd() with a type code of
+     *    "0" (USSD-Notify/no further action) or "2" (session terminated)
+     *
+     * @param serial Serial number of request.
+     * @param ussd string containing the USSD request in UTF-8 format
+     *
+     * Response function is IRadioVoiceResponse.sendUssdResponse()
+     */
+    void sendUssd(in int serial, in String ussd);
+
+    /**
      * Separate a party from a multiparty call placing the multiparty call (less the specified
      * party) on hold and leaving the specified party as the only other member of the current
      * (active) call. Like AT+CHLD=2x.
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
index 25e87b3..437fef6 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoiceIndication.aidl
@@ -24,6 +24,7 @@
 import android.hardware.radio.voice.EmergencyNumber;
 import android.hardware.radio.voice.SrvccState;
 import android.hardware.radio.voice.StkCcUnsolSsResult;
+import android.hardware.radio.voice.UssdModeType;
 
 /**
  * Interface declaring unsolicited radio indications for voice APIs.
@@ -138,6 +139,16 @@
     void onSupplementaryServiceIndication(in RadioIndicationType type, in StkCcUnsolSsResult ss);
 
     /**
+     * Indicates when a new USSD message is received. The USSD session is assumed to persist if the
+     * type code is REQUEST, otherwise the current session (if any) is assumed to have terminated.
+     *
+     * @param type Type of radio indication
+     * @param modeType USSD type code
+     * @param msg Message string in UTF-8, if applicable
+     */
+    void onUssd(in RadioIndicationType type, in UssdModeType modeType, in String msg);
+
+    /**
      * Indicates that framework/application must reset the uplink mute state.
      *
      * @param type Type of radio indication
diff --git a/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl b/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
index d126fc1..cf1b953 100644
--- a/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
+++ b/radio/aidl/android/hardware/radio/voice/IRadioVoiceResponse.aidl
@@ -62,6 +62,27 @@
      *
      * Valid errors returned:
      *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:SIM_BUSY
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:MODEM_ERR
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:NO_MEMORY
+     *   RadioError:INVALID_STATE
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:NO_RESOURCES
+     *   RadioError:CANCELLED
+     */
+    void cancelPendingUssdResponse(in RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE (radio resetting)
      *   RadioError:NO_MEMORY
      *   RadioError:MODEM_ERR
@@ -569,6 +590,32 @@
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:RADIO_NOT_AVAILABLE
+     *   RadioError:FDN_CHECK_FAILURE
+     *   RadioError:USSD_MODIFIED_TO_DIAL
+     *   RadioError:USSD_MODIFIED_TO_SS
+     *   RadioError:USSD_MODIFIED_TO_USSD
+     *   RadioError:SIM_BUSY
+     *   RadioError:OPERATION_NOT_ALLOWED
+     *   RadioError:INVALID_ARGUMENTS
+     *   RadioError:NO_MEMORY
+     *   RadioError:MODEM_ERR
+     *   RadioError:INTERNAL_ERR
+     *   RadioError:ABORTED
+     *   RadioError:SYSTEM_ERR
+     *   RadioError:INVALID_STATE
+     *   RadioError:REQUEST_NOT_SUPPORTED
+     *   RadioError:INVALID_MODEM_STATE
+     *   RadioError:NO_RESOURCES
+     *   RadioError:CANCELLED
+     */
+    void sendUssdResponse(in RadioResponseInfo info);
+
+    /**
+     * @param info Response info struct containing response type, serial no. and error
+     *
+     * Valid errors returned:
+     *   RadioError:NONE
+     *   RadioError:RADIO_NOT_AVAILABLE
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:INVALID_STATE
      *   RadioError:NO_RESOURCES
diff --git a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl b/radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
similarity index 95%
rename from radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
rename to radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
index c3c111e..48d1fca 100644
--- a/radio/aidl/android/hardware/radio/messaging/UssdModeType.aidl
+++ b/radio/aidl/android/hardware/radio/voice/UssdModeType.aidl
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-package android.hardware.radio.messaging;
+package android.hardware.radio.voice;
 
 @VintfStability
 @Backing(type="int")
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
index 419e9fb..047f836 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioMessaging.h
@@ -33,7 +33,6 @@
     ::ndk::ScopedAStatus acknowledgeLastIncomingGsmSms(
             int32_t serial, bool success,
             ::aidl::android::hardware::radio::messaging::SmsAcknowledgeFailCause cause) override;
-    ::ndk::ScopedAStatus cancelPendingUssd(int32_t serial) override;
     ::ndk::ScopedAStatus deleteSmsOnRuim(int32_t serial, int32_t index) override;
     ::ndk::ScopedAStatus deleteSmsOnSim(int32_t serial, int32_t index) override;
     ::ndk::ScopedAStatus getCdmaBroadcastConfig(int32_t serial) override;
@@ -56,7 +55,6 @@
     ::ndk::ScopedAStatus sendSmsExpectMore(
             int32_t serial,
             const ::aidl::android::hardware::radio::messaging::GsmSmsMessage& message) override;
-    ::ndk::ScopedAStatus sendUssd(int32_t serial, const std::string& ussd) override;
     ::ndk::ScopedAStatus setCdmaBroadcastActivation(int32_t serial, bool activate) override;
     ::ndk::ScopedAStatus setCdmaBroadcastConfig(
             int32_t serial,
diff --git a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
index a0e1e82..0f1d5fd 100644
--- a/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
+++ b/radio/aidl/compat/libradiocompat/include/libradiocompat/RadioVoice.h
@@ -26,6 +26,7 @@
     std::shared_ptr<::aidl::android::hardware::radio::voice::IRadioVoiceResponse> respond();
 
     ::ndk::ScopedAStatus acceptCall(int32_t serial) override;
+    ::ndk::ScopedAStatus cancelPendingUssd(int32_t serial) override;
     ::ndk::ScopedAStatus conference(int32_t serial) override;
     ::ndk::ScopedAStatus dial(
             int32_t serial, const ::aidl::android::hardware::radio::voice::Dial& dialInfo) override;
@@ -58,6 +59,7 @@
                                        int32_t off) override;
     ::ndk::ScopedAStatus sendCdmaFeatureCode(int32_t serial, const std::string& fcode) override;
     ::ndk::ScopedAStatus sendDtmf(int32_t serial, const std::string& s) override;
+    ::ndk::ScopedAStatus sendUssd(int32_t serial, const std::string& ussd) override;
     ::ndk::ScopedAStatus separateConnection(int32_t serial, int32_t gsmIndex) override;
     ::ndk::ScopedAStatus setCallForward(
             int32_t serial,
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
index e5c33b3..eb87828 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioIndication-messaging.cpp
@@ -73,13 +73,6 @@
     return {};
 }
 
-Return<void> RadioIndication::onUssd(V1_0::RadioIndicationType type, V1_0::UssdModeType modeType,
-                                     const hidl_string& msg) {
-    LOG_CALL << type;
-    messagingCb()->onUssd(toAidl(type), aidl::UssdModeType(modeType), msg);
-    return {};
-}
-
 Return<void> RadioIndication::simSmsStorageFull(V1_0::RadioIndicationType type) {
     LOG_CALL << type;
     messagingCb()->simSmsStorageFull(toAidl(type));
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
index 4d94e17..56d49f1 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioMessaging.cpp
@@ -54,12 +54,6 @@
     return ok();
 }
 
-ScopedAStatus RadioMessaging::cancelPendingUssd(int32_t serial) {
-    LOG_CALL << serial;
-    mHal1_5->cancelPendingUssd(serial);
-    return ok();
-}
-
 ScopedAStatus RadioMessaging::deleteSmsOnRuim(int32_t serial, int32_t index) {
     LOG_CALL << serial << ' ' << index;
     mHal1_5->deleteSmsOnRuim(serial, index);
@@ -148,12 +142,6 @@
     return ok();
 }
 
-ScopedAStatus RadioMessaging::sendUssd(int32_t serial, const std::string& ussd) {
-    LOG_CALL << serial << ' ' << ussd;
-    mHal1_5->sendUssd(serial, ussd);
-    return ok();
-}
-
 ScopedAStatus RadioMessaging::setCdmaBroadcastActivation(int32_t serial, bool activate) {
     LOG_CALL << serial << ' ' << activate;
     mHal1_5->setCdmaBroadcastActivation(serial, activate);
diff --git a/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp b/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
index 24ad3d7..7a9273f 100644
--- a/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
+++ b/radio/aidl/compat/libradiocompat/messaging/RadioResponse-messaging.cpp
@@ -57,12 +57,6 @@
     return {};
 }
 
-Return<void> RadioResponse::cancelPendingUssdResponse(const V1_0::RadioResponseInfo& info) {
-    LOG_CALL << info.serial;
-    messagingCb()->cancelPendingUssdResponse(toAidl(info));
-    return {};
-}
-
 Return<void> RadioResponse::deleteSmsOnRuimResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     messagingCb()->deleteSmsOnRuimResponse(toAidl(info));
@@ -166,12 +160,6 @@
     return {};
 }
 
-Return<void> RadioResponse::sendUssdResponse(const V1_0::RadioResponseInfo& info) {
-    LOG_CALL << info.serial;
-    messagingCb()->sendUssdResponse(toAidl(info));
-    return {};
-}
-
 Return<void> RadioResponse::setCdmaBroadcastActivationResponse(
         const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
diff --git a/radio/aidl/compat/libradiocompat/network/structs.cpp b/radio/aidl/compat/libradiocompat/network/structs.cpp
index 87a021f..c1d9b35 100644
--- a/radio/aidl/compat/libradiocompat/network/structs.cpp
+++ b/radio/aidl/compat/libradiocompat/network/structs.cpp
@@ -650,13 +650,6 @@
     };
 }
 
-aidl::NeighboringCell toAidl(const V1_0::NeighboringCell& cell) {
-    return {
-            .cid = cell.cid,
-            .rssi = cell.rssi,
-    };
-}
-
 aidl::LceDataInfo toAidl(const V1_0::LceDataInfo& info) {
     return {
             .lastHopCapacityKbps = static_cast<int32_t>(info.lastHopCapacityKbps),
diff --git a/radio/aidl/compat/libradiocompat/network/structs.h b/radio/aidl/compat/libradiocompat/network/structs.h
index 854cb38..aaa49a0 100644
--- a/radio/aidl/compat/libradiocompat/network/structs.h
+++ b/radio/aidl/compat/libradiocompat/network/structs.h
@@ -20,7 +20,6 @@
 #include <aidl/android/hardware/radio/network/CellInfo.h>
 #include <aidl/android/hardware/radio/network/LceDataInfo.h>
 #include <aidl/android/hardware/radio/network/LinkCapacityEstimate.h>
-#include <aidl/android/hardware/radio/network/NeighboringCell.h>
 #include <aidl/android/hardware/radio/network/NetworkScanRequest.h>
 #include <aidl/android/hardware/radio/network/NetworkScanResult.h>
 #include <aidl/android/hardware/radio/network/OperatorInfo.h>
@@ -92,8 +91,6 @@
 ::aidl::android::hardware::radio::network::RegStateResult toAidl(const V1_5::RegStateResult& res);
 ::aidl::android::hardware::radio::network::RegStateResult toAidl(const V1_6::RegStateResult& res);
 
-::aidl::android::hardware::radio::network::NeighboringCell toAidl(const V1_0::NeighboringCell& c);
-
 ::aidl::android::hardware::radio::network::LceDataInfo toAidl(const V1_0::LceDataInfo& info);
 
 }  // namespace android::hardware::radio::compat
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
index 359fce0..23878ed 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioIndication-voice.cpp
@@ -102,6 +102,13 @@
     return {};
 }
 
+Return<void> RadioIndication::onUssd(V1_0::RadioIndicationType type, V1_0::UssdModeType modeType,
+                                     const hidl_string& msg) {
+    LOG_CALL << type;
+    voiceCb()->onUssd(toAidl(type), aidl::UssdModeType(modeType), msg);
+    return {};
+}
+
 Return<void> RadioIndication::resendIncallMute(V1_0::RadioIndicationType type) {
     LOG_CALL << type;
     voiceCb()->resendIncallMute(toAidl(type));
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
index d233548..5307e11 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioResponse-voice.cpp
@@ -42,6 +42,12 @@
     return {};
 }
 
+Return<void> RadioResponse::cancelPendingUssdResponse(const V1_0::RadioResponseInfo& info) {
+    LOG_CALL << info.serial;
+    voiceCb()->cancelPendingUssdResponse(toAidl(info));
+    return {};
+}
+
 Return<void> RadioResponse::conferenceResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     voiceCb()->conferenceResponse(toAidl(info));
@@ -198,6 +204,12 @@
     return {};
 }
 
+Return<void> RadioResponse::sendUssdResponse(const V1_0::RadioResponseInfo& info) {
+    LOG_CALL << info.serial;
+    voiceCb()->sendUssdResponse(toAidl(info));
+    return {};
+}
+
 Return<void> RadioResponse::separateConnectionResponse(const V1_0::RadioResponseInfo& info) {
     LOG_CALL << info.serial;
     voiceCb()->separateConnectionResponse(toAidl(info));
diff --git a/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp b/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
index 71d1a56..9088f01 100644
--- a/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
+++ b/radio/aidl/compat/libradiocompat/voice/RadioVoice.cpp
@@ -40,6 +40,12 @@
     return ok();
 }
 
+ScopedAStatus RadioVoice::cancelPendingUssd(int32_t serial) {
+    LOG_CALL << serial;
+    mHal1_5->cancelPendingUssd(serial);
+    return ok();
+}
+
 ScopedAStatus RadioVoice::conference(int32_t serial) {
     LOG_CALL << serial;
     mHal1_5->conference(serial);
@@ -201,6 +207,12 @@
     return ok();
 }
 
+ScopedAStatus RadioVoice::sendUssd(int32_t serial, const std::string& ussd) {
+    LOG_CALL << serial << ' ' << ussd;
+    mHal1_5->sendUssd(serial, ussd);
+    return ok();
+}
+
 ScopedAStatus RadioVoice::separateConnection(int32_t serial, int32_t gsmIndex) {
     LOG_CALL << serial;
     mHal1_5->separateConnection(serial, gsmIndex);
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index 616e339..f38a958 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -83,7 +83,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
@@ -157,7 +157,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
@@ -326,7 +326,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
@@ -369,7 +369,7 @@
     dataProfileInfo.authType = ApnAuthType::NO_PAP_NO_CHAP;
     dataProfileInfo.user = std::string("username");
     dataProfileInfo.password = std::string("password");
-    dataProfileInfo.type = DataProfileInfo::TYPE_THREE_GPP;
+    dataProfileInfo.type = DataProfileInfo::TYPE_3GPP;
     dataProfileInfo.maxConnsTime = 300;
     dataProfileInfo.maxConns = 20;
     dataProfileInfo.waitTime = 0;
diff --git a/radio/aidl/vts/radio_messaging_indication.cpp b/radio/aidl/vts/radio_messaging_indication.cpp
index c69611f..481239e 100644
--- a/radio/aidl/vts/radio_messaging_indication.cpp
+++ b/radio/aidl/vts/radio_messaging_indication.cpp
@@ -48,12 +48,6 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingIndication::onUssd(RadioIndicationType /*type*/,
-                                                    UssdModeType /*modeType*/,
-                                                    const std::string& /*msg*/) {
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus RadioMessagingIndication::simSmsStorageFull(RadioIndicationType /*type*/) {
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_messaging_response.cpp b/radio/aidl/vts/radio_messaging_response.cpp
index 451a10c..49c0806 100644
--- a/radio/aidl/vts/radio_messaging_response.cpp
+++ b/radio/aidl/vts/radio_messaging_response.cpp
@@ -44,13 +44,6 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::cancelPendingUssdResponse(
-        const RadioResponseInfo& info) {
-    rspInfo = info;
-    parent_messaging.notify(info.serial);
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus RadioMessagingResponse::deleteSmsOnRuimResponse(const RadioResponseInfo& info) {
     rspInfo = info;
     parent_messaging.notify(info.serial);
@@ -130,12 +123,6 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus RadioMessagingResponse::sendUssdResponse(const RadioResponseInfo& info) {
-    rspInfo = info;
-    parent_messaging.notify(info.serial);
-    return ndk::ScopedAStatus::ok();
-}
-
 ndk::ScopedAStatus RadioMessagingResponse::setCdmaBroadcastActivationResponse(
         const RadioResponseInfo& info) {
     rspInfo = info;
diff --git a/radio/aidl/vts/radio_messaging_test.cpp b/radio/aidl/vts/radio_messaging_test.cpp
index 0abdfbc..9f1718b 100644
--- a/radio/aidl/vts/radio_messaging_test.cpp
+++ b/radio/aidl/vts/radio_messaging_test.cpp
@@ -418,7 +418,9 @@
     EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
 
     if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
-        // TODO(shuoq): Will add error check when we know the expected error from QC
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_messaging->rspInfo.error,
+                                     {RadioError::INVALID_ARGUMENTS, RadioError::NO_SMS_TO_ACK},
+                                     CHECK_GENERAL_ERROR));
     }
     LOG(DEBUG) << "acknowledgeIncomingGsmSmsWithPdu finished";
 }
@@ -727,44 +729,3 @@
     }
     LOG(DEBUG) << "reportSmsMemoryStatus finished";
 }
-
-/*
- * Test IRadioMessaging.sendUssd() for the response returned.
- */
-TEST_P(RadioMessagingTest, sendUssd) {
-    LOG(DEBUG) << "sendUssd";
-    serial = GetRandomSerialNumber();
-    radio_messaging->sendUssd(serial, std::string("test"));
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
-
-    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
-        ASSERT_TRUE(CheckAnyOfErrors(
-                radioRsp_messaging->rspInfo.error,
-                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
-                CHECK_GENERAL_ERROR));
-    }
-    LOG(DEBUG) << "sendUssd finished";
-}
-
-/*
- * Test IRadioMessaging.cancelPendingUssd() for the response returned.
- */
-TEST_P(RadioMessagingTest, cancelPendingUssd) {
-    LOG(DEBUG) << "cancelPendingUssd";
-    serial = GetRandomSerialNumber();
-
-    radio_messaging->cancelPendingUssd(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_messaging->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_messaging->rspInfo.serial);
-
-    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
-        ASSERT_TRUE(CheckAnyOfErrors(
-                radioRsp_messaging->rspInfo.error,
-                {RadioError::NONE, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
-                CHECK_GENERAL_ERROR));
-    }
-    LOG(DEBUG) << "cancelPendingUssd finished";
-}
diff --git a/radio/aidl/vts/radio_messaging_utils.h b/radio/aidl/vts/radio_messaging_utils.h
index 7bb99cd..7b66192 100644
--- a/radio/aidl/vts/radio_messaging_utils.h
+++ b/radio/aidl/vts/radio_messaging_utils.h
@@ -49,8 +49,6 @@
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
-    virtual ndk::ScopedAStatus cancelPendingUssdResponse(const RadioResponseInfo& info) override;
-
     virtual ndk::ScopedAStatus deleteSmsOnRuimResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus deleteSmsOnSimResponse(const RadioResponseInfo& info) override;
@@ -84,8 +82,6 @@
     virtual ndk::ScopedAStatus sendSmsResponse(const RadioResponseInfo& info,
                                                const SendSmsResult& sms) override;
 
-    virtual ndk::ScopedAStatus sendUssdResponse(const RadioResponseInfo& info) override;
-
     virtual ndk::ScopedAStatus setCdmaBroadcastActivationResponse(
             const RadioResponseInfo& info) override;
 
@@ -132,9 +128,6 @@
     virtual ndk::ScopedAStatus newSmsStatusReport(RadioIndicationType type,
                                                   const std::vector<uint8_t>& pdu) override;
 
-    virtual ndk::ScopedAStatus onUssd(RadioIndicationType type, UssdModeType modeType,
-                                      const std::string& msg) override;
-
     virtual ndk::ScopedAStatus simSmsStorageFull(RadioIndicationType type) override;
 };
 
diff --git a/radio/aidl/vts/radio_network_test.cpp b/radio/aidl/vts/radio_network_test.cpp
index 1c2d50f..391d63c 100644
--- a/radio/aidl/vts/radio_network_test.cpp
+++ b/radio/aidl/vts/radio_network_test.cpp
@@ -1529,6 +1529,7 @@
     }
     LOG(DEBUG) << "getOperator finished";
 }
+
 /*
  * Test IRadioNetwork.getNetworkSelectionMode() for the response returned.
  */
@@ -1611,29 +1612,6 @@
 }
 
 /*
- * Test IRadioNetwork.getNeighboringCids() for the response returned.
- */
-TEST_P(RadioNetworkTest, getNeighboringCids) {
-    // TODO: add API for getNeighboringCids
-    /**
-    LOG(DEBUG) << "getNeighboringCids";
-    serial = GetRandomSerialNumber();
-
-    radio_network->getNeighboringCids(serial);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_network->rspInfo.serial);
-
-    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
-        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_network->rspInfo.error,
-                                     {RadioError::NONE, RadioError::SIM_ABSENT},
-                                     CHECK_GENERAL_ERROR));
-    }
-    LOG(DEBUG) << "getNeighboringCids finished";
-    **/
-}
-
-/*
  * Test IRadioNetwork.setLocationUpdates() for the response returned.
  */
 TEST_P(RadioNetworkTest, setLocationUpdates) {
@@ -1718,7 +1696,6 @@
     LOG(DEBUG) << "setCellInfoListRate";
     serial = GetRandomSerialNumber();
 
-    // TODO(sanketpadawe): RIL crashes with value of rate = 10
     radio_network->setCellInfoListRate(serial, 10);
     EXPECT_EQ(std::cv_status::no_timeout, wait());
     EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_network->rspInfo.type);
diff --git a/radio/aidl/vts/radio_sim_test.cpp b/radio/aidl/vts/radio_sim_test.cpp
index 146e86c..64474c9 100644
--- a/radio/aidl/vts/radio_sim_test.cpp
+++ b/radio/aidl/vts/radio_sim_test.cpp
@@ -387,7 +387,6 @@
     carrierRestrictions.allowedCarriers[0].mnc = std::string("456");
     carrierRestrictions.allowedCarriers[0].matchType = Carrier::MATCH_TYPE_ALL;
     carrierRestrictions.allowedCarriers[0].matchData = std::string();
-    carrierRestrictions.priority = true;
     carrierRestrictions.allowedCarriersPrioritized = true;
     SimLockMultiSimPolicy multisimPolicy = SimLockMultiSimPolicy::NO_MULTISIM_POLICY;
 
@@ -650,12 +649,10 @@
 }
 
 /*
- * The following test is disabled due to b/109889468
- *
  * Test IRadioSim.getImsiForApp() for the response returned.
  */
-TEST_P(RadioSimTest, DISABLED_getImsiForApp) {
-    LOG(DEBUG) << "DISABLED_getImsiForApp";
+TEST_P(RadioSimTest, getImsiForApp) {
+    LOG(DEBUG) << "getImsiForApp";
     serial = GetRandomSerialNumber();
 
     // Check success returned while getting imsi for 3GPP and 3GPP2 apps only
@@ -679,7 +676,7 @@
             }
         }
     }
-    LOG(DEBUG) << "DISABLED_getImsiForApp finished";
+    LOG(DEBUG) << "getImsiForApp finished";
 }
 
 /*
@@ -723,8 +720,6 @@
     EXPECT_EQ(std::cv_status::no_timeout, wait());
     EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
     EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
-
-    // TODO(sanketpadawe): Add test for error code
     LOG(DEBUG) << "iccTransmitApduBasicChannel finished";
 }
 
@@ -775,8 +770,6 @@
     EXPECT_EQ(std::cv_status::no_timeout, wait());
     EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_sim->rspInfo.type);
     EXPECT_EQ(serial, radioRsp_sim->rspInfo.serial);
-
-    // TODO(sanketpadawe): Add test for error code
     LOG(DEBUG) << "iccTransmitApduLogicalChannel finished";
 }
 
diff --git a/radio/aidl/vts/radio_voice_indication.cpp b/radio/aidl/vts/radio_voice_indication.cpp
index d814c18..3fee326 100644
--- a/radio/aidl/vts/radio_voice_indication.cpp
+++ b/radio/aidl/vts/radio_voice_indication.cpp
@@ -65,6 +65,12 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus RadioVoiceIndication::onUssd(RadioIndicationType /*type*/,
+                                                UssdModeType /*modeType*/,
+                                                const std::string& /*msg*/) {
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus RadioVoiceIndication::resendIncallMute(RadioIndicationType /*type*/) {
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_voice_response.cpp b/radio/aidl/vts/radio_voice_response.cpp
index 95b2d4e..dd7b1bf 100644
--- a/radio/aidl/vts/radio_voice_response.cpp
+++ b/radio/aidl/vts/radio_voice_response.cpp
@@ -28,6 +28,12 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus RadioVoiceResponse::cancelPendingUssdResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus RadioVoiceResponse::conferenceResponse(const RadioResponseInfo& info) {
     rspInfo = info;
     parent_voice.notify(info.serial);
@@ -182,6 +188,12 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus RadioVoiceResponse::sendUssdResponse(const RadioResponseInfo& info) {
+    rspInfo = info;
+    parent_voice.notify(info.serial);
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus RadioVoiceResponse::separateConnectionResponse(const RadioResponseInfo& info) {
     rspInfo = info;
     parent_voice.notify(info.serial);
diff --git a/radio/aidl/vts/radio_voice_test.cpp b/radio/aidl/vts/radio_voice_test.cpp
index 0556938..eec28b1 100644
--- a/radio/aidl/vts/radio_voice_test.cpp
+++ b/radio/aidl/vts/radio_voice_test.cpp
@@ -324,7 +324,7 @@
  * Test IRadioVoice.getTtyMode() for the response returned.
  */
 TEST_P(RadioVoiceTest, getTtyMode) {
-    LOG(DEBUG) << "getTTYMode";
+    LOG(DEBUG) << "getTtyMode";
     serial = GetRandomSerialNumber();
 
     radio_voice->getTtyMode(serial);
@@ -335,7 +335,7 @@
     if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
         EXPECT_EQ(RadioError::NONE, radioRsp_voice->rspInfo.error);
     }
-    LOG(DEBUG) << "getTTYMode finished";
+    LOG(DEBUG) << "getTtyMode finished";
 }
 
 /*
@@ -902,3 +902,44 @@
     }
     LOG(DEBUG) << "sendBurstDtmf finished";
 }
+
+/*
+ * Test IRadioVoice.sendUssd() for the response returned.
+ */
+TEST_P(RadioVoiceTest, sendUssd) {
+    LOG(DEBUG) << "sendUssd";
+    serial = GetRandomSerialNumber();
+    radio_voice->sendUssd(serial, std::string("test"));
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::INVALID_ARGUMENTS, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "sendUssd finished";
+}
+
+/*
+ * Test IRadioVoice.cancelPendingUssd() for the response returned.
+ */
+TEST_P(RadioVoiceTest, cancelPendingUssd) {
+    LOG(DEBUG) << "cancelPendingUssd";
+    serial = GetRandomSerialNumber();
+
+    radio_voice->cancelPendingUssd(serial);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
+    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_voice->rspInfo.type);
+    EXPECT_EQ(serial, radioRsp_voice->rspInfo.serial);
+
+    if (cardStatus.cardState == CardStatus::STATE_ABSENT) {
+        ASSERT_TRUE(CheckAnyOfErrors(
+                radioRsp_voice->rspInfo.error,
+                {RadioError::NONE, RadioError::INVALID_STATE, RadioError::MODEM_ERR},
+                CHECK_GENERAL_ERROR));
+    }
+    LOG(DEBUG) << "cancelPendingUssd finished";
+}
diff --git a/radio/aidl/vts/radio_voice_utils.h b/radio/aidl/vts/radio_voice_utils.h
index d61bf1e..0c3df7f 100644
--- a/radio/aidl/vts/radio_voice_utils.h
+++ b/radio/aidl/vts/radio_voice_utils.h
@@ -43,6 +43,8 @@
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
+    virtual ndk::ScopedAStatus cancelPendingUssdResponse(const RadioResponseInfo& info) override;
+
     virtual ndk::ScopedAStatus conferenceResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus dialResponse(const RadioResponseInfo& info) override;
@@ -103,6 +105,8 @@
 
     virtual ndk::ScopedAStatus sendDtmfResponse(const RadioResponseInfo& info) override;
 
+    virtual ndk::ScopedAStatus sendUssdResponse(const RadioResponseInfo& info) override;
+
     virtual ndk::ScopedAStatus separateConnectionResponse(const RadioResponseInfo& info) override;
 
     virtual ndk::ScopedAStatus setCallForwardResponse(const RadioResponseInfo& info) override;
@@ -164,6 +168,9 @@
     virtual ndk::ScopedAStatus onSupplementaryServiceIndication(
             RadioIndicationType type, const StkCcUnsolSsResult& ss) override;
 
+    virtual ndk::ScopedAStatus onUssd(RadioIndicationType type, UssdModeType modeType,
+                                      const std::string& msg) override;
+
     virtual ndk::ScopedAStatus resendIncallMute(RadioIndicationType type) override;
 
     virtual ndk::ScopedAStatus srvccStateNotify(RadioIndicationType type,
diff --git a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
index b0761bf..586e659 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/DeviceInfo.aidl
@@ -30,26 +30,22 @@
      * DeviceInfo is a CBOR Map structure described by the following CDDL.
      *
      *     DeviceInfo = {
-     *         ? "brand" : tstr,
-     *         ? "manufacturer" : tstr,
-     *         ? "product" : tstr,
-     *         ? "model" : tstr,
-     *         ? "board" : tstr,
-     *         ? "vb_state" : "green" / "yellow" / "orange",    // Taken from the AVB values
-     *         ? "bootloader_state" : "locked" / "unlocked",    // Taken from the AVB values
-     *         ? "vbmeta_digest": bstr,                         // Taken from the AVB values
-     *         ? "os_version" : tstr,                    // Same as android.os.Build.VERSION.release
-     *         ? "system_patch_level" : uint,                   // YYYYMMDD
-     *         ? "boot_patch_level" : uint,                     // YYYYMMDD
-     *         ? "vendor_patch_level" : uint,                   // YYYYMMDD
-     *         "version" : 1,                      // The CDDL schema version.
-     *         "security_level" : "tee" / "strongbox"
-     *         "att_id_state": "locked" / "open",  // Attestation IDs State. If "locked", this
-     *                                             // indicates a device's attestable IDs are
-     *                                             // factory-locked and immutable. If "open",
-     *                                             // this indicates the device is still in a
-     *                                             // provisionable state and the attestable IDs
-     *                                             // are not yet frozen.
+     *         "brand" : tstr,
+     *         "manufacturer" : tstr,
+     *         "product" : tstr,
+     *         "model" : tstr,
+     *         "device" : tstr,
+     *         "vb_state" : "green" / "yellow" / "orange",    // Taken from the AVB values
+     *         "bootloader_state" : "locked" / "unlocked",    // Taken from the AVB values
+     *         "vbmeta_digest": bstr,                         // Taken from the AVB values
+     *         "os_version" : tstr,                      // Same as android.os.Build.VERSION.release
+     *         "system_patch_level" : uint,                   // YYYYMMDD
+     *         "boot_patch_level" : uint,                     // YYYYMMDD
+     *         "vendor_patch_level" : uint,                   // YYYYMMDD
+     *         "version" : 2,                                 // The CDDL schema version.
+     *         "security_level" : "tee" / "strongbox",
+     *         "fused": 1 / 0,  // 1 if secure boot is enforced for the processor that the IRPC
+     *                          // implementation is contained in. 0 otherwise.
      *     }
      */
     byte[] deviceInfo;
diff --git a/security/keymint/aidl/android/hardware/security/keymint/MacedPublicKey.aidl b/security/keymint/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
index 62a48e9..ad97443 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/MacedPublicKey.aidl
@@ -37,10 +37,10 @@
      *
      *     PublicKey = {               // COSE_Key
      *         1 : 2,                  // Key type : EC2
-     *         3 : -8                  // Algorithm : ES256
-     *         -1 : 6,                 // Curve : P256
-     *         -2 : bstr               // X coordinate, little-endian
-     *         -3 : bstr               // Y coordinate, little-endian
+     *         3 : -7,                 // Algorithm : ES256
+     *         -1 : 1,                 // Curve : P256
+     *         -2 : bstr,              // X coordinate, little-endian
+     *         -3 : bstr,              // Y coordinate, little-endian
      *         ? -70000 : nil          // Presence indicates this is a test key.  If set, K_mac is
      *                                 // all zeros.
      *     },
diff --git a/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl b/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
index 24cdbc1..a14fc88 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/ProtectedData.aidl
@@ -169,7 +169,6 @@
      *     PubKeyEd25519 = {                // COSE_Key
      *         1 : 1,                         // Key type : octet key pair
      *         3 : AlgorithmEdDSA,            // Algorithm : EdDSA
-     *         4 : 2,                         // Ops: Verify
      *         -1 : 6,                        // Curve : Ed25519
      *         -2 : bstr                      // X coordinate, little-endian
      *     }
@@ -184,7 +183,6 @@
      *     PubKeyECDSA256 = {                 // COSE_Key
      *         1 : 2,                         // Key type : EC2
      *         3 : AlgorithmES256,            // Algorithm : ECDSA w/ SHA-256
-     *         4 : 2,                         // Ops: Verify
      *         -1 : 1,                        // Curve: P256
      *         -2 : bstr,                     // X coordinate
      *         -3 : bstr                      // Y coordinate
diff --git a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index 829780d..3a7e000 100644
--- a/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/keymint/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -57,6 +57,22 @@
 using namespace remote_prov;
 using namespace keymaster;
 
+std::set<std::string> getAllowedVbStates() {
+    return {"green", "yellow", "orange"};
+}
+
+std::set<std::string> getAllowedBootloaderStates() {
+    return {"locked", "unlocked"};
+}
+
+std::set<std::string> getAllowedSecurityLevels() {
+    return {"tee", "strongbox"};
+}
+
+std::set<std::string> getAllowedAttIdStates() {
+    return {"locked", "open"};
+}
+
 bytevec string_to_bytevec(const char* s) {
     const uint8_t* p = reinterpret_cast<const uint8_t*>(s);
     return bytevec(p, p + strlen(s));
@@ -406,6 +422,8 @@
         ASSERT_TRUE(deviceInfoMap) << "Failed to parse deviceInfo: " << deviceInfoErrMsg;
         ASSERT_TRUE(deviceInfoMap->asMap());
 
+        checkDeviceInfo(deviceInfoMap->asMap());
+
         auto& signingKey = bccContents->back().pubKey;
         auto macKey = verifyAndParseCoseSign1(signedMac->asArray(), signingKey,
                                               cppbor::Array()  // SignedMacAad
@@ -432,6 +450,76 @@
         }
     }
 
+    void checkType(const cppbor::Map* devInfo, uint8_t majorType, std::string entryName) {
+        const auto& val = devInfo->get(entryName);
+        ASSERT_TRUE(val) << entryName << " does not exist";
+        ASSERT_EQ(val->type(), majorType) << entryName << " has the wrong type.";
+        switch (majorType) {
+            case cppbor::TSTR:
+                ASSERT_GT(val->asTstr()->value().size(), 0);
+                break;
+            case cppbor::BSTR:
+                ASSERT_GT(val->asBstr()->value().size(), 0);
+                break;
+            default:
+                break;
+        }
+    }
+
+    void checkDeviceInfo(const cppbor::Map* deviceInfo) {
+        const auto& version = deviceInfo->get("version");
+        ASSERT_TRUE(version);
+        ASSERT_TRUE(version->asUint());
+        RpcHardwareInfo info;
+        provisionable_->getHardwareInfo(&info);
+        ASSERT_EQ(version->asUint()->value(), info.versionNumber);
+        std::set<std::string> allowList;
+        switch (version->asUint()->value()) {
+            // These fields became mandated in version 2.
+            case 2:
+                checkType(deviceInfo, cppbor::TSTR, "brand");
+                checkType(deviceInfo, cppbor::TSTR, "manufacturer");
+                checkType(deviceInfo, cppbor::TSTR, "product");
+                checkType(deviceInfo, cppbor::TSTR, "model");
+                checkType(deviceInfo, cppbor::TSTR, "device");
+                // TODO: Refactor the KeyMint code that validates these fields and include it here.
+                checkType(deviceInfo, cppbor::TSTR, "vb_state");
+                allowList = getAllowedVbStates();
+                ASSERT_NE(allowList.find(deviceInfo->get("vb_state")->asTstr()->value()),
+                          allowList.end());
+                checkType(deviceInfo, cppbor::TSTR, "bootloader_state");
+                allowList = getAllowedBootloaderStates();
+                ASSERT_NE(allowList.find(deviceInfo->get("bootloader_state")->asTstr()->value()),
+                          allowList.end());
+                checkType(deviceInfo, cppbor::BSTR, "vbmeta_digest");
+                checkType(deviceInfo, cppbor::TSTR, "os_version");
+                checkType(deviceInfo, cppbor::UINT, "system_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "boot_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "vendor_patch_level");
+                checkType(deviceInfo, cppbor::UINT, "fused");
+                ASSERT_LT(deviceInfo->get("fused")->asUint()->value(), 2);  // Must be 0 or 1.
+                checkType(deviceInfo, cppbor::TSTR, "security_level");
+                allowList = getAllowedSecurityLevels();
+                ASSERT_NE(allowList.find(deviceInfo->get("security_level")->asTstr()->value()),
+                          allowList.end());
+                break;
+            case 1:
+                checkType(deviceInfo, cppbor::TSTR, "security_level");
+                allowList = getAllowedSecurityLevels();
+                ASSERT_NE(allowList.find(deviceInfo->get("security_level")->asTstr()->value()),
+                          allowList.end());
+                if (version->asUint()->value() == 1) {
+                    checkType(deviceInfo, cppbor::TSTR, "att_id_state");
+                    allowList = getAllowedAttIdStates();
+                    ASSERT_NE(allowList.find(deviceInfo->get("att_id_state")->asTstr()->value()),
+                              allowList.end());
+                }
+                break;
+            default:
+                FAIL() << "Unrecognized version: " << version->asUint()->value();
+        }
+    }
+
     bytevec eekId_;
     size_t testEekLength_;
     EekChain testEekChain_;
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index 0cbee51..35cb891 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -26,6 +26,11 @@
 
 namespace aidl::android::hardware::security::keymint::remote_prov {
 
+constexpr uint32_t kBccPayloadIssuer = 1;
+constexpr uint32_t kBccPayloadSubject = 2;
+constexpr int32_t kBccPayloadSubjPubKey = -4670552;
+constexpr int32_t kBccPayloadKeyUsage = -4670553;
+
 bytevec kTestMacKey(32 /* count */, 0 /* byte value */);
 
 bytevec randomBytes(size_t numBytes) {
@@ -98,6 +103,18 @@
     return prodEek;
 }
 
+ErrMsgOr<bytevec> validatePayloadAndFetchPubKey(const cppbor::Map* payload) {
+    const auto& issuer = payload->get(kBccPayloadIssuer);
+    if (!issuer || !issuer->asTstr()) return "Issuer is not present or not a tstr.";
+    const auto& subject = payload->get(kBccPayloadSubject);
+    if (!subject || !subject->asTstr()) return "Subject is not present or not a tstr.";
+    const auto& keyUsage = payload->get(kBccPayloadKeyUsage);
+    if (!keyUsage || !keyUsage->asBstr()) return "Key usage is not present or not a bstr.";
+    const auto& serializedKey = payload->get(kBccPayloadSubjPubKey);
+    if (!serializedKey || !serializedKey->asBstr()) return "Key is not present or not a bstr.";
+    return serializedKey->asBstr()->value();
+}
+
 ErrMsgOr<bytevec> verifyAndParseCoseSign1Cwt(const cppbor::Array* coseSign1,
                                              const bytevec& signingCoseKey, const bytevec& aad) {
     if (!coseSign1 || coseSign1->size() != kCoseSign1EntryCount) {
@@ -126,18 +143,16 @@
         return "Unsupported signature algorithm";
     }
 
-    // TODO(jbires): Handle CWTs as the CoseSign1 payload in a less hacky way. Since the CWT payload
-    //               is extremely remote provisioning specific, probably just make a separate
-    //               function there.
     auto [parsedPayload, __, payloadErrMsg] = cppbor::parse(payload);
     if (!parsedPayload) return payloadErrMsg + " when parsing key";
     if (!parsedPayload->asMap()) return "CWT must be a map";
-    auto serializedKey = parsedPayload->asMap()->get(-4670552)->clone();
-    if (!serializedKey || !serializedKey->asBstr()) return "Could not find key entry";
+    auto serializedKey = validatePayloadAndFetchPubKey(parsedPayload->asMap());
+    if (!serializedKey) {
+        return "CWT validation failed: " + serializedKey.moveMessage();
+    }
 
     bool selfSigned = signingCoseKey.empty();
-    auto key =
-            CoseKey::parseEd25519(selfSigned ? serializedKey->asBstr()->value() : signingCoseKey);
+    auto key = CoseKey::parseEd25519(selfSigned ? *serializedKey : signingCoseKey);
     if (!key) return "Bad signing key: " + key.moveMessage();
 
     bytevec signatureInput =
@@ -148,7 +163,7 @@
         return "Signature verification failed";
     }
 
-    return serializedKey->asBstr()->value();
+    return serializedKey.moveValue();
 }
 
 ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc) {
@@ -156,8 +171,11 @@
 
     std::vector<BccEntryData> result;
 
+    const auto& devicePubKey = bcc->get(0);
+    if (!devicePubKey->asMap()) return "Invalid device public key at the 1st entry in the BCC";
+
     bytevec prevKey;
-    // TODO(jbires): Actually process the pubKey at the start of the new bcc entry
+
     for (size_t i = 1; i < bcc->size(); ++i) {
         const cppbor::Array* entry = bcc->get(i)->asArray();
         if (!entry || entry->size() != kCoseSign1EntryCount) {
@@ -177,6 +195,13 @@
 
         // This entry's public key is the signing key for the next entry.
         prevKey = payload.moveValue();
+        if (i == 1) {
+            auto [parsedRootKey, _, errMsg] = cppbor::parse(prevKey);
+            if (!parsedRootKey || !parsedRootKey->asMap()) return "Invalid payload entry in BCC.";
+            if (*parsedRootKey != *devicePubKey) {
+                return "Device public key doesn't match BCC root.";
+            }
+        }
     }
 
     return result;
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
index 8cb7e22..1606b7b 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.cpp
@@ -69,37 +69,6 @@
 // disable.
 bool waitForSupplicantStop() { return waitForSupplicantState(false); }
 
-// Helper function to initialize the driver and firmware to STA mode
-// using the vendor HAL HIDL interface.
-void initilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
-    if (getWifi(wifi_instance_name) != nullptr) {
-        sp<IWifiChip> wifi_chip = getWifiChip(wifi_instance_name);
-        ChipModeId mode_id;
-        EXPECT_TRUE(configureChipToSupportIfaceType(
-            wifi_chip, ::android::hardware::wifi::V1_0::IfaceType::STA, &mode_id));
-    } else {
-        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
-    }
-}
-
-// Helper function to deinitialize the driver and firmware
-// using the vendor HAL HIDL interface.
-void deInitilializeDriverAndFirmware(const std::string& wifi_instance_name) {
-    // Skip if wifi instance is not set.
-    if (wifi_instance_name == "") {
-        return;
-    }
-    if (getWifi(wifi_instance_name) != nullptr) {
-        stopWifi(wifi_instance_name);
-    } else {
-        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
-    }
-}
-
 // Helper function to find any iface of the desired type exposed.
 bool findIfaceOfType(sp<ISupplicant> supplicant, IfaceType desired_type,
                      ISupplicant::IfaceInfo* out_info) {
@@ -156,14 +125,46 @@
     SupplicantManager supplicant_manager;
 
     ASSERT_TRUE(supplicant_manager.StopSupplicant());
-    deInitilializeDriverAndFirmware(wifi_instance_name);
+    deInitializeDriverAndFirmware(wifi_instance_name);
     ASSERT_FALSE(supplicant_manager.IsSupplicantRunning());
 }
 
+// Helper function to initialize the driver and firmware to STA mode
+// using the vendor HAL HIDL interface.
+void initializeDriverAndFirmware(const std::string& wifi_instance_name) {
+    // Skip if wifi instance is not set.
+    if (wifi_instance_name == "") {
+        return;
+    }
+    if (getWifi(wifi_instance_name) != nullptr) {
+        sp<IWifiChip> wifi_chip = getWifiChip(wifi_instance_name);
+        ChipModeId mode_id;
+        EXPECT_TRUE(configureChipToSupportIfaceType(
+            wifi_chip, ::android::hardware::wifi::V1_0::IfaceType::STA,
+            &mode_id));
+    } else {
+        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
+    }
+}
+
+// Helper function to deinitialize the driver and firmware
+// using the vendor HAL HIDL interface.
+void deInitializeDriverAndFirmware(const std::string& wifi_instance_name) {
+    // Skip if wifi instance is not set.
+    if (wifi_instance_name == "") {
+        return;
+    }
+    if (getWifi(wifi_instance_name) != nullptr) {
+        stopWifi(wifi_instance_name);
+    } else {
+        LOG(WARNING) << __func__ << ": Vendor HAL not supported";
+    }
+}
+
 void startSupplicantAndWaitForHidlService(
     const std::string& wifi_instance_name,
     const std::string& supplicant_instance_name) {
-    initilializeDriverAndFirmware(wifi_instance_name);
+    initializeDriverAndFirmware(wifi_instance_name);
 
     SupplicantManager supplicant_manager;
     ASSERT_TRUE(supplicant_manager.StartSupplicant());
diff --git a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
index 22cea8c..7228623 100644
--- a/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
+++ b/wifi/supplicant/1.0/vts/functional/supplicant_hidl_test_utils.h
@@ -42,6 +42,11 @@
     const std::string& wifi_instance_name,
     const std::string& supplicant_instance_name);
 
+// Used to initialize/deinitialize the driver and firmware at the
+// beginning and end of each test.
+void initializeDriverAndFirmware(const std::string& wifi_instance_name);
+void deInitializeDriverAndFirmware(const std::string& wifi_instance_name);
+
 // Helper functions to obtain references to the various HIDL interface objects.
 // Note: We only have a single instance of each of these objects currently.
 // These helper functions should be modified to return vectors if we support
diff --git a/wifi/supplicant/aidl/vts/functional/Android.bp b/wifi/supplicant/aidl/vts/functional/Android.bp
index 65f9652..8e142ec 100644
--- a/wifi/supplicant/aidl/vts/functional/Android.bp
+++ b/wifi/supplicant/aidl/vts/functional/Android.bp
@@ -33,11 +33,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
@@ -55,11 +67,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
@@ -77,11 +101,23 @@
     shared_libs: [
         "libbinder",
         "libbinder_ndk",
+        "libvndksupport",
     ],
     static_libs: [
+        "android.hardware.wifi@1.0",
+        "android.hardware.wifi@1.1",
+        "android.hardware.wifi@1.2",
+        "android.hardware.wifi@1.3",
+        "android.hardware.wifi@1.4",
+        "android.hardware.wifi@1.5",
+        "android.hardware.wifi.supplicant@1.0",
+        "android.hardware.wifi.supplicant@1.1",
         "android.hardware.wifi.supplicant-V1-ndk",
         "libwifi-system",
         "libwifi-system-iface",
+        "VtsHalWifiV1_0TargetTestUtil",
+        "VtsHalWifiV1_5TargetTestUtil",
+        "VtsHalWifiSupplicantV1_0TargetTestUtil",
     ],
     test_suites: [
         "general-tests",
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
index d9d8179..d5bdde2 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_p2p_iface_aidl_test.cpp
@@ -165,8 +165,7 @@
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
@@ -180,13 +179,13 @@
             GTEST_SKIP() << "Wi-Fi Direct is not supported, skip this test.";
         }
 
-        EXPECT_TRUE(supplicant_->addP2pInterface(getP2pIfaceName(), &p2p_iface_)
+        EXPECT_TRUE(supplicant_->getP2pInterface(getP2pIfaceName(), &p2p_iface_)
                         .isOk());
         ASSERT_NE(p2p_iface_, nullptr);
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
index 6e6955f..b24f502 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_iface_aidl_test.cpp
@@ -197,21 +197,20 @@
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
                                          true,  // show timestamps
                                          true)
                         .isOk());
-        EXPECT_TRUE(supplicant_->addStaInterface(getStaIfaceName(), &sta_iface_)
+        EXPECT_TRUE(supplicant_->getStaInterface(getStaIfaceName(), &sta_iface_)
                         .isOk());
         ASSERT_NE(sta_iface_, nullptr);
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
index 3d8242b..a19b300 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
@@ -99,15 +99,14 @@
    public:
     void SetUp() override {
         initializeService();
-        supplicant_ = ISupplicant::fromBinder(ndk::SpAIBinder(
-            AServiceManager_waitForService(GetParam().c_str())));
+        supplicant_ = getSupplicant(GetParam().c_str());
         ASSERT_NE(supplicant_, nullptr);
         ASSERT_TRUE(supplicant_
                         ->setDebugParams(DebugLevel::EXCESSIVE,
                                          true,  // show timestamps
                                          true)
                         .isOk());
-        EXPECT_TRUE(supplicant_->addStaInterface(getStaIfaceName(), &sta_iface_)
+        EXPECT_TRUE(supplicant_->getStaInterface(getStaIfaceName(), &sta_iface_)
                         .isOk());
         ASSERT_NE(sta_iface_, nullptr);
         EXPECT_TRUE(sta_iface_->addNetwork(&sta_network_).isOk());
@@ -115,7 +114,7 @@
     }
 
     void TearDown() override {
-        stopSupplicant();
+        stopSupplicantService();
         startWifiFramework();
     }
 
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
index b7e1a80..17e0394 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_test_utils.h
@@ -19,8 +19,14 @@
 
 #include <VtsCoreUtil.h>
 #include <android-base/logging.h>
+#include <android/hardware/wifi/1.0/IWifi.h>
+#include <hidl/ServiceManagement.h>
+#include <supplicant_hidl_test_utils.h>
 #include <wifi_system/supplicant_manager.h>
 
+using aidl::android::hardware::wifi::supplicant::IfaceInfo;
+using aidl::android::hardware::wifi::supplicant::ISupplicant;
+using aidl::android::hardware::wifi::supplicant::ISupplicantP2pIface;
 using aidl::android::hardware::wifi::supplicant::ISupplicantStaIface;
 using aidl::android::hardware::wifi::supplicant::KeyMgmtMask;
 using android::wifi_system::SupplicantManager;
@@ -37,6 +43,14 @@
     return std::string(buffer.data());
 }
 
+std::string getWifiInstanceName() {
+    const std::vector<std::string> instances =
+        android::hardware::getAllHalInstanceNames(
+            ::android::hardware::wifi::V1_0::IWifi::descriptor);
+    EXPECT_NE(0, instances.size());
+    return instances.size() != 0 ? instances[0] : "";
+}
+
 bool keyMgmtSupported(std::shared_ptr<ISupplicantStaIface> iface,
                       KeyMgmtMask expected) {
     KeyMgmtMask caps;
@@ -53,60 +67,44 @@
     return keyMgmtSupported(iface, filsMask);
 }
 
-bool waitForSupplicantState(bool is_running) {
+void startSupplicant() {
+    initializeDriverAndFirmware(getWifiInstanceName());
     SupplicantManager supplicant_manager;
-    int count = 50; /* wait at most 5 seconds for completion */
-    while (count-- > 0) {
-        if (supplicant_manager.IsSupplicantRunning() == is_running) {
-            return true;
-        }
-        usleep(100000);
-    }
-    LOG(ERROR) << "Supplicant not " << (is_running ? "running" : "stopped");
-    return false;
+    ASSERT_TRUE(supplicant_manager.StartSupplicant());
+    ASSERT_TRUE(supplicant_manager.IsSupplicantRunning());
 }
 
-bool waitForFrameworkReady() {
-    int waitCount = 15;
-    do {
-        // Check whether package service is ready or not.
-        if (!testing::checkSubstringInCommandOutput(
-                "/system/bin/service check package", ": not found")) {
-            return true;
-        }
-        LOG(INFO) << "Framework is not ready";
-        sleep(1);
-    } while (waitCount-- > 0);
-    return false;
-}
-
-bool waitForSupplicantStart() { return waitForSupplicantState(true); }
-
-bool waitForSupplicantStop() { return waitForSupplicantState(false); }
-
-void stopSupplicant() {
-    SupplicantManager supplicant_manager;
-    ASSERT_TRUE(supplicant_manager.StopSupplicant());
-    ASSERT_FALSE(supplicant_manager.IsSupplicantRunning());
-}
-
-bool startWifiFramework() {
-    std::system("svc wifi enable");
-    std::system("cmd wifi set-scan-always-available enabled");
-    return waitForSupplicantStart();
-}
-
-bool stopWifiFramework() {
-    std::system("svc wifi disable");
-    std::system("cmd wifi set-scan-always-available disabled");
-    return waitForSupplicantStop();
-}
+// Wrapper around the implementation in supplicant_hidl_test_util.
+void stopSupplicantService() { stopSupplicant(getWifiInstanceName()); }
 
 void initializeService() {
     ASSERT_TRUE(stopWifiFramework());
     std::system("/system/bin/start");
     ASSERT_TRUE(waitForFrameworkReady());
-    stopSupplicant();
+    stopSupplicantService();
+    startSupplicant();
+}
+
+void addStaIface(const std::shared_ptr<ISupplicant> supplicant) {
+    ASSERT_TRUE(supplicant.get());
+    std::shared_ptr<ISupplicantStaIface> iface;
+    ASSERT_TRUE(supplicant->addStaInterface(getStaIfaceName(), &iface).isOk());
+}
+
+void addP2pIface(const std::shared_ptr<ISupplicant> supplicant) {
+    ASSERT_TRUE(supplicant.get());
+    std::shared_ptr<ISupplicantP2pIface> iface;
+    ASSERT_TRUE(supplicant->addP2pInterface(getP2pIfaceName(), &iface).isOk());
+}
+
+std::shared_ptr<ISupplicant> getSupplicant(const char* supplicant_name) {
+    std::shared_ptr<ISupplicant> supplicant = ISupplicant::fromBinder(
+        ndk::SpAIBinder(AServiceManager_waitForService(supplicant_name)));
+    addStaIface(supplicant);
+    if (testing::deviceSupportsFeature("android.hardware.wifi.direct")) {
+        addP2pIface(supplicant);
+    }
+    return supplicant;
 }
 
 #endif  // SUPPLICANT_TEST_UTILS_H
\ No newline at end of file