diff --git a/audio/effect/all-versions/default/Android.bp b/audio/effect/all-versions/default/Android.bp
index cea085c..095bb86 100644
--- a/audio/effect/all-versions/default/Android.bp
+++ b/audio/effect/all-versions/default/Android.bp
@@ -52,6 +52,12 @@
         "libmedia_headers",
         "libmediautils_headers",
     ],
+
+    cflags: [
+        "-Wall",
+        "-Wthread-safety",
+        "-Werror",
+    ],
 }
 
 cc_library_shared {
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp
index 4a9e144..9896653 100644
--- a/audio/effect/all-versions/default/Effect.cpp
+++ b/audio/effect/all-versions/default/Effect.cpp
@@ -321,8 +321,8 @@
         status_t status = mProcessThread->join();
         ALOGE_IF(status, "processing thread exit error: %s", strerror(-status));
     }
-    if (mEfGroup) {
-        status_t status = EventFlag::deleteEventFlag(&mEfGroup);
+    if (EventFlag* evFlag = mEfGroup.load(std::memory_order_acquire)) {
+        status_t status = EventFlag::deleteEventFlag(&evFlag);
         ALOGE_IF(status, "processing MQ event flag deletion error: %s", strerror(-status));
     }
     mInBuffer.clear();
@@ -437,6 +437,7 @@
 Result Effect::analyzeStatus(const char* funcName, const char* subFuncName,
                              const char* contextDescription, status_t status) {
     if (status != OK) {
+        std::lock_guard<std::mutex> lock(mLock);
         ALOGW("Effect %p %s %s %s: %s", mHandle, funcName, subFuncName, contextDescription,
               strerror(-status));
     }
@@ -470,11 +471,14 @@
 
 Return<void> Effect::getConfigImpl(int commandCode, const char* commandName,
                                    GetConfigCallback _hidl_cb) {
-    RETURN_RESULT_IF_EFFECT_CLOSED(EffectConfig());
     uint32_t halResultSize = sizeof(effect_config_t);
     effect_config_t halConfig{};
-    status_t status =
-        (*mHandle)->command(mHandle, commandCode, 0, NULL, &halResultSize, &halConfig);
+    status_t status = OK;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_RESULT_IF_EFFECT_CLOSED(EffectConfig());
+        status = (*mHandle)->command(mHandle, commandCode, 0, NULL, &halResultSize, &halConfig);
+    }
     EffectConfig config;
     if (status == OK) {
         status = EffectUtils::effectConfigFromHal(halConfig, mIsInput, &config);
@@ -542,7 +546,10 @@
 }
 
 Return<void> Effect::prepareForProcessing(prepareForProcessing_cb _hidl_cb) {
-    RETURN_RESULT_IF_EFFECT_CLOSED(StatusMQ::Descriptor());
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_RESULT_IF_EFFECT_CLOSED(StatusMQ::Descriptor());
+    }
     status_t status;
     // Create message queue.
     if (mStatusMQ) {
@@ -556,16 +563,21 @@
         _hidl_cb(Result::INVALID_ARGUMENTS, StatusMQ::Descriptor());
         return Void();
     }
-    status = EventFlag::createEventFlag(tempStatusMQ->getEventFlagWord(), &mEfGroup);
-    if (status != OK || !mEfGroup) {
+    EventFlag* evFlag = nullptr;
+    status = EventFlag::createEventFlag(tempStatusMQ->getEventFlagWord(), &evFlag);
+    if (status != OK || !evFlag) {
         ALOGE("failed creating event flag for status MQ: %s", strerror(-status));
         _hidl_cb(Result::INVALID_ARGUMENTS, StatusMQ::Descriptor());
         return Void();
     }
+    mEfGroup.store(evFlag, std::memory_order_release);
 
-    // Create and launch the thread.
-    mProcessThread = new ProcessThread(&mStopProcessThread, mHandle, &mHalInBufferPtr,
-                                       &mHalOutBufferPtr, tempStatusMQ.get(), mEfGroup, this);
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        // Create and launch the thread.
+        mProcessThread = new ProcessThread(&mStopProcessThread, mHandle, &mHalInBufferPtr,
+                                           &mHalOutBufferPtr, tempStatusMQ.get(), evFlag, this);
+    }
     status = mProcessThread->run("effect", PRIORITY_URGENT_AUDIO);
     if (status != OK) {
         ALOGW("failed to start effect processing thread: %s", strerror(-status));
@@ -575,11 +587,15 @@
 
     // For a spatializer effect, we perform scheduler adjustments to reduce glitches and power.
     // We do it here instead of the ProcessThread::threadLoop to ensure that mHandle is valid.
-    if (effect_descriptor_t halDescriptor{};
-        (*mHandle)->get_descriptor(mHandle, &halDescriptor) == NO_ERROR &&
-        memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
-        const status_t status = scheduler::updateSpatializerPriority(mProcessThread->getTid());
-        ALOGW_IF(status != OK, "Failed to update Spatializer priority");
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_RESULT_IF_EFFECT_CLOSED(StatusMQ::Descriptor());
+        if (effect_descriptor_t halDescriptor{};
+            (*mHandle)->get_descriptor(mHandle, &halDescriptor) == NO_ERROR &&
+            memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
+            const status_t status = scheduler::updateSpatializerPriority(mProcessThread->getTid());
+            ALOGW_IF(status != OK, "Failed to update Spatializer priority");
+        }
     }
 
     mStatusMQ = std::move(tempStatusMQ);
@@ -589,7 +605,10 @@
 
 Return<Result> Effect::setProcessBuffers(const AudioBuffer& inBuffer,
                                          const AudioBuffer& outBuffer) {
-    RETURN_IF_EFFECT_CLOSED();
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_IF_EFFECT_CLOSED();
+    }
     AudioBufferManager& manager = AudioBufferManager::getInstance();
     sp<AudioBufferWrapper> tempInBuffer, tempOutBuffer;
     if (!manager.wrap(inBuffer, &tempInBuffer)) {
@@ -614,8 +633,12 @@
 }
 
 Result Effect::sendCommand(int commandCode, const char* commandName, uint32_t size, void* data) {
-    RETURN_IF_EFFECT_CLOSED();
-    status_t status = (*mHandle)->command(mHandle, commandCode, size, data, 0, NULL);
+    status_t status = OK;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_IF_EFFECT_CLOSED();
+        status = (*mHandle)->command(mHandle, commandCode, size, data, 0, NULL);
+    }
     return analyzeCommandStatus(commandName, sContextCallToCommand, status);
 }
 
@@ -626,9 +649,13 @@
 
 Result Effect::sendCommandReturningData(int commandCode, const char* commandName, uint32_t size,
                                         void* data, uint32_t* replySize, void* replyData) {
-    RETURN_IF_EFFECT_CLOSED();
     uint32_t expectedReplySize = *replySize;
-    status_t status = (*mHandle)->command(mHandle, commandCode, size, data, replySize, replyData);
+    status_t status = OK;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_IF_EFFECT_CLOSED();
+        status = (*mHandle)->command(mHandle, commandCode, size, data, replySize, replyData);
+    }
     if (status == OK && *replySize != expectedReplySize) {
         status = -ENODATA;
     }
@@ -651,8 +678,12 @@
                                                  uint32_t size, void* data, uint32_t* replySize,
                                                  void* replyData, uint32_t minReplySize,
                                                  CommandSuccessCallback onSuccess) {
-    RETURN_IF_EFFECT_CLOSED();
-    status_t status = (*mHandle)->command(mHandle, commandCode, size, data, replySize, replyData);
+    status_t status = OK;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_IF_EFFECT_CLOSED();
+        status = (*mHandle)->command(mHandle, commandCode, size, data, replySize, replyData);
+    }
     Result retval;
     if (status == OK && minReplySize >= sizeof(uint32_t) && *replySize >= minReplySize) {
         uint32_t commandStatus = *reinterpret_cast<uint32_t*>(replyData);
@@ -860,10 +891,14 @@
 }
 
 Return<void> Effect::getDescriptor(getDescriptor_cb _hidl_cb) {
-    RETURN_RESULT_IF_EFFECT_CLOSED(EffectDescriptor());
     effect_descriptor_t halDescriptor;
     memset(&halDescriptor, 0, sizeof(effect_descriptor_t));
-    status_t status = (*mHandle)->get_descriptor(mHandle, &halDescriptor);
+    status_t status = OK;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_RESULT_IF_EFFECT_CLOSED(EffectDescriptor());
+        status = (*mHandle)->get_descriptor(mHandle, &halDescriptor);
+    }
     EffectDescriptor descriptor;
     if (status == OK) {
         status = EffectUtils::effectDescriptorFromHal(halDescriptor, &descriptor);
@@ -874,10 +909,6 @@
 
 Return<void> Effect::command(uint32_t commandId, const hidl_vec<uint8_t>& data,
                              uint32_t resultMaxSize, command_cb _hidl_cb) {
-    if (mHandle == kInvalidEffectHandle) {
-        _hidl_cb(-ENODATA, hidl_vec<uint8_t>());
-        return Void();
-    }
     uint32_t halDataSize;
     std::unique_ptr<uint8_t[]> halData = hidlVecToHal(data, &halDataSize);
     uint32_t halResultSize = resultMaxSize;
@@ -897,8 +928,15 @@
             }
             [[fallthrough]];  // allow 'gtid' overload (checked halDataSize and resultMaxSize).
         default:
-            status = (*mHandle)->command(mHandle, commandId, halDataSize, dataPtr, &halResultSize,
-                                         resultPtr);
+            {
+                std::lock_guard<std::mutex> lock(mLock);
+                if (mHandle == kInvalidEffectHandle) {
+                    _hidl_cb(-ENODATA, hidl_vec<uint8_t>());
+                    return Void();
+                }
+                status = (*mHandle)->command(mHandle, commandId, halDataSize, dataPtr,
+                                            &halResultSize, resultPtr);
+            }
             break;
     }
     hidl_vec<uint8_t> result;
@@ -967,11 +1005,17 @@
         return {Result::INVALID_STATE, kInvalidEffectHandle};
     }
     mStopProcessThread.store(true, std::memory_order_release);
-    if (mEfGroup) {
-        mEfGroup->wake(static_cast<uint32_t>(MessageQueueFlagBits::REQUEST_QUIT));
+    EventFlag* evFlag = mEfGroup.load(std::memory_order_acquire);
+    if (evFlag) {
+        evFlag->wake(static_cast<uint32_t>(
+            MessageQueueFlagBits::REQUEST_QUIT));
     }
-    effect_handle_t handle = mHandle;
-    mHandle = kInvalidEffectHandle;
+    effect_handle_t handle;
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        handle = mHandle;
+        mHandle = kInvalidEffectHandle;
+    }
 #if MAJOR_VERSION <= 5
     return {Result::OK, handle};
 #elif MAJOR_VERSION >= 6
@@ -984,7 +1028,10 @@
 }
 
 Return<Result> Effect::close() {
-    RETURN_IF_EFFECT_CLOSED();
+    {
+        std::lock_guard<std::mutex> lock(mLock);
+        RETURN_IF_EFFECT_CLOSED();
+    }
     auto [result, _] = closeImpl();
     return result;
 }
diff --git a/audio/effect/all-versions/default/Effect.h b/audio/effect/all-versions/default/Effect.h
index 2bcecec..cc76784 100644
--- a/audio/effect/all-versions/default/Effect.h
+++ b/audio/effect/all-versions/default/Effect.h
@@ -25,6 +25,7 @@
 #include <memory>
 #include <tuple>
 #include <vector>
+#include <mutex>
 
 #include <fmq/EventFlag.h>
 #include <fmq/MessageQueue.h>
@@ -194,13 +195,14 @@
     static const char* sContextCallFunction;
 
     const bool mIsInput;
-    effect_handle_t mHandle;
+    std::mutex mLock;
+    effect_handle_t mHandle GUARDED_BY(mLock);
     sp<AudioBufferWrapper> mInBuffer;
     sp<AudioBufferWrapper> mOutBuffer;
     std::atomic<audio_buffer_t*> mHalInBufferPtr;
     std::atomic<audio_buffer_t*> mHalOutBufferPtr;
     std::unique_ptr<StatusMQ> mStatusMQ;
-    EventFlag* mEfGroup;
+    std::atomic<EventFlag*> mEfGroup;
     std::atomic<bool> mStopProcessThread;
     sp<Thread> mProcessThread;
 
diff --git a/security/keymint/aidl/default/Android.bp b/security/keymint/aidl/default/Android.bp
index 0197141..0d03651 100644
--- a/security/keymint/aidl/default/Android.bp
+++ b/security/keymint/aidl/default/Android.bp
@@ -192,7 +192,6 @@
     ],
     prebuilts: [
         "keymint_aidl_nonsecure_init_rc",
-        "keymint_aidl_nonsecure_vintf",
         "android.hardware.hardware_keystore.xml", // permissions
     ],
 }
@@ -210,14 +209,3 @@
     out: ["android.hardware.security.keymint-service.nonsecure.apex.rc"],
     cmd: "sed -E 's%/vendor/bin/%/apex/com.android.hardware.keymint/bin/%' $(in) > $(out)",
 }
-
-prebuilt_etc {
-    name: "keymint_aidl_nonsecure_vintf",
-    sub_dir: "vintf",
-    vendor: true,
-    srcs: [
-        "android.hardware.security.keymint-service.xml",
-        "android.hardware.security.sharedsecret-service.xml",
-        "android.hardware.security.secureclock-service.xml",
-    ],
-}
diff --git a/security/see/authmgr/aidl/README.md b/security/see/authmgr/aidl/README.md
new file mode 100644
index 0000000..97b2b1d
--- /dev/null
+++ b/security/see/authmgr/aidl/README.md
@@ -0,0 +1,21 @@
+# AuthMgr
+
+The AuthMgr protocol authenticates and authorizes clients before they can
+access trusted HALs, AIDL-defined services in trusted execution environments.
+Version 1 was designed to allow applications running in a protected virtual
+machine (pVM) to access services running in a TEE in ARM TrustZone. An
+implementation of `IAuthMgrAuthorization` is referred to as an AuthMgr Backend.
+An implementation of a client of the AuthMgr Backend is referred to as an
+AuthMgr Frontend.
+
+
+## Additional Requirements by Android Version
+
+The comments on `IAuthMgrAuthorization` describe the requirements for implementing
+an AuthMgr Backend (implementor of the interface) itself. There are some additional
+requirements that are specific to Android release versions.
+
+### Android 16
+If implementing `IAuthMgrAuthorization` in Android 16 only one AuthMgr Backend is
+supported and dynamic service discovery is not supported. The AuthMgr Backend
+service must be exposed on secure partition ID 0x8001 over VSOCK port 1.
\ No newline at end of file
diff --git a/wifi/apex/Android.bp b/wifi/apex/Android.bp
index f8c8e6f..5052ebb 100644
--- a/wifi/apex/Android.bp
+++ b/wifi/apex/Android.bp
@@ -15,13 +15,6 @@
     installable: false,
 }
 
-prebuilt_etc {
-    name: "com.android.hardware.wifi.xml",
-    src: ":default-android.hardware.wifi-service.xml",
-    installable: false,
-    sub_dir: "vintf",
-}
-
 apex {
     name: "com.android.hardware.wifi",
     manifest: "apex_manifest.json",
@@ -36,7 +29,6 @@
     ],
     prebuilts: [
         "com.android.hardware.wifi.rc",
-        "com.android.hardware.wifi.xml",
     ],
     overrides: [
         "android.hardware.wifi-service",