diff --git a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
index 56d8b4b..0fd8c23 100644
--- a/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
+++ b/automotive/vehicle/aidl/impl/default_config/config/DefaultProperties.json
@@ -3456,6 +3456,145 @@
             }
         },
         {
+            "property": "VehicleProperty::ULTRASONICS_SENSOR_POSITION",
+            "comment":
+                    "Default values for 12 individual ultrasonic sensors installed on the vehicle. Six sensors on the front bumper. Six sensors on the back bumper.",
+            "areas": [
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -1000,
+                            3900,
+                            0
+                        ]
+                    },
+                    "areaId": 1,
+                    "comment": "Rough numbers representing front left most sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -600,
+                            4000,
+                            0
+                        ]
+                    },
+                    "areaId": 2,
+                    "comment": "Rough numbers representing front 2nd to the left sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -200,
+                            4000,
+                            0
+                        ]
+                    },
+                    "areaId": 4,
+                    "comment": "Rough numbers representing front 3rd to the left sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            200,
+                            4000,
+                            0
+                        ]
+                    },
+                    "areaId": 8,
+                    "comment": "Rough numbers representing front 3rd to the right sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            600,
+                            4000,
+                            0
+                        ]
+                    },
+                    "areaId": 16,
+                    "comment": "Rough numbers representing front 2nd to the right sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            1000,
+                            3900,
+                            0
+                        ]
+                    },
+                    "areaId": 32,
+                    "comment": "Rough numbers representing front right most sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -1000,
+                            -900,
+                            0
+                        ]
+                    },
+                    "areaId": 64,
+                    "comment": "Rough numbers representing back left most sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -600,
+                            -1000,
+                            0
+                        ]
+                    },
+                    "areaId": 128,
+                    "comment": "Rough numbers representing back 2nd to the left sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            -200,
+                            -1000,
+                            0
+                        ]
+                    },
+                    "areaId": 256,
+                    "comment": "Rough numbers representing back 3rd to the left sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            200,
+                            -1000,
+                            0
+                        ]
+                    },
+                    "areaId": 512,
+                    "comment": "Rough numbers representing back 3rd to the right sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            600,
+                            -1000,
+                            0
+                        ]
+                    },
+                    "areaId": 1024,
+                    "comment": "Rough numbers representing back 2nd to the right sensor."
+                },
+                {
+                    "defaultValue": {
+                        "int32Values": [
+                            1000,
+                            -900,
+                            0
+                        ]
+                    },
+                    "areaId": 2048,
+                    "comment": "Rough numbers representing back right most sensor."
+                }
+            ]
+        },
+        {
             "property": "VehicleProperty::ELECTRONIC_TOLL_COLLECTION_CARD_TYPE",
             "defaultValue": {
                 "int32Values": [
diff --git a/biometrics/face/aidl/default/Face.cpp b/biometrics/face/aidl/default/Face.cpp
index 652a7e1..5ae0df6 100644
--- a/biometrics/face/aidl/default/Face.cpp
+++ b/biometrics/face/aidl/default/Face.cpp
@@ -14,11 +14,23 @@
  * limitations under the License.
  */
 
+#undef LOG_TAG
+#define LOG_TAG "FaceVirtualHal"
+
 #include "Face.h"
 #include "Session.h"
 
 #include "FakeFaceEngine.h"
 
+#include <android-base/properties.h>
+#include <face.sysprop.h>
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+
+using namespace ::android::face::virt;
+
 namespace aidl::android::hardware::biometrics::face {
 
 const int kSensorId = 4;
@@ -68,11 +80,105 @@
     return ndk::ScopedAStatus::ok();
 }
 
-ndk::ScopedAStatus Face::createSession(int32_t /*sensorId*/, int32_t /*userId*/,
+ndk::ScopedAStatus Face::createSession(int32_t sensorId, int32_t userId,
                                        const std::shared_ptr<ISessionCallback>& cb,
                                        std::shared_ptr<ISession>* return_val) {
-    *return_val = SharedRefBase::make<Session>(std::make_unique<FakeFaceEngine>(), cb);
+    mSession = SharedRefBase::make<Session>(std::make_unique<FakeFaceEngine>(), cb);
+    *return_val = mSession;
+
+    mSession->linkToDeath(cb->asBinder().get());
+
+    LOG(INFO) << __func__ << ": sensorId:" << sensorId << " userId:" << userId;
     return ndk::ScopedAStatus::ok();
 }
 
+binder_status_t Face::dump(int fd, const char** /*args*/, uint32_t numArgs) {
+    if (fd < 0) {
+        LOG(ERROR) << __func__ << "fd invalid: " << fd;
+        return STATUS_BAD_VALUE;
+    } else {
+        LOG(INFO) << __func__ << " fd:" << fd << "numArgs:" << numArgs;
+    }
+
+    dprintf(fd, "----- FaceVirtualHal::dump -----\n");
+    std::vector<SensorProps> sps(1);
+    getSensorProps(&sps);
+    for (auto& sp : sps) {
+        ::android::base::WriteStringToFd(sp.toString(), fd);
+    }
+    if (mSession != nullptr) {
+        ::android::base::WriteStringToFd(mSession->toString(), fd);
+    } else {
+        dprintf(fd, "\nWARNING: no ISession found\n");
+    }
+
+    fsync(fd);
+    return STATUS_OK;
+}
+
+binder_status_t Face::handleShellCommand(int in, int out, int err, const char** args,
+                                         uint32_t numArgs) {
+    LOG(INFO) << __func__ << " in:" << in << " out:" << out << " err:" << err
+              << " numArgs:" << numArgs;
+
+    if (numArgs == 0) {
+        LOG(INFO) << __func__ << ": available commands";
+        onHelp(out);
+        return STATUS_OK;
+    }
+
+    for (auto&& str : std::vector<std::string_view>(args, args + numArgs)) {
+        std::string option = str.data();
+        if (option.find("clearconfig") != std::string::npos ||
+            option.find("resetconfig") != std::string::npos) {
+            resetConfigToDefault();
+        }
+        if (option.find("help") != std::string::npos) {
+            onHelp(out);
+        }
+    }
+
+    return STATUS_OK;
+}
+
+void Face::onHelp(int fd) {
+    dprintf(fd, "Virtual Face HAL commands:\n");
+    dprintf(fd, "         help: print this help\n");
+    dprintf(fd, "  resetconfig: reset all configuration to default\n");
+    dprintf(fd, "\n");
+    fsync(fd);
+}
+
+void Face::resetConfigToDefault() {
+    LOG(INFO) << __func__ << ": reset virtual Face HAL configuration to default";
+#define RESET_CONFIG_O(__NAME__) \
+    if (FaceHalProperties::__NAME__()) FaceHalProperties::__NAME__(std::nullopt)
+#define RESET_CONFIG_V(__NAME__) \
+    if (!FaceHalProperties::__NAME__().empty()) FaceHalProperties::__NAME__({std::nullopt})
+
+    RESET_CONFIG_O(type);
+    RESET_CONFIG_O(strength);
+    RESET_CONFIG_V(enrollments);
+    RESET_CONFIG_O(enrollment_hit);
+    RESET_CONFIG_V(features);
+    RESET_CONFIG_O(next_enrollment);
+    RESET_CONFIG_O(authenticator_id);
+    RESET_CONFIG_O(challenge);
+    RESET_CONFIG_O(lockout);
+    RESET_CONFIG_O(operation_authenticate_fails);
+    RESET_CONFIG_O(operation_detect_interaction_fails);
+    RESET_CONFIG_O(operation_enroll_fails);
+    RESET_CONFIG_V(operation_authenticate_latency);
+    RESET_CONFIG_V(operation_detect_interaction_latency);
+    RESET_CONFIG_V(operation_enroll_latency);
+    RESET_CONFIG_O(operation_authenticate_duration);
+    RESET_CONFIG_O(operation_authenticate_error);
+    RESET_CONFIG_O(operation_authenticate_acquired);
+    RESET_CONFIG_O(lockout_enable);
+    RESET_CONFIG_O(lockout_timed_enable);
+    RESET_CONFIG_O(lockout_timed_threshold);
+    RESET_CONFIG_O(lockout_timed_duration);
+    RESET_CONFIG_O(lockout_permanent_threshold);
+}
+
 }  // namespace aidl::android::hardware::biometrics::face
diff --git a/biometrics/face/aidl/default/Face.h b/biometrics/face/aidl/default/Face.h
index 786b4f8..93fddb0 100644
--- a/biometrics/face/aidl/default/Face.h
+++ b/biometrics/face/aidl/default/Face.h
@@ -17,16 +17,26 @@
 #pragma once
 
 #include <aidl/android/hardware/biometrics/face/BnFace.h>
+#include "Session.h"
 
 namespace aidl::android::hardware::biometrics::face {
 
 class Face : public BnFace {
   public:
+    Face() : mSession(nullptr) {}
     ndk::ScopedAStatus getSensorProps(std::vector<SensorProps>* _aidl_return) override;
 
     ndk::ScopedAStatus createSession(int32_t sensorId, int32_t userId,
                                      const std::shared_ptr<ISessionCallback>& cb,
                                      std::shared_ptr<ISession>* _aidl_return) override;
+
+    binder_status_t dump(int fd, const char** args, uint32_t numArgs);
+    binder_status_t handleShellCommand(int in, int out, int err, const char** argv, uint32_t argc);
+
+  private:
+    std::shared_ptr<Session> mSession;
+    void resetConfigToDefault();
+    void onHelp(int);
 };
 
 }  // namespace aidl::android::hardware::biometrics::face
diff --git a/biometrics/face/aidl/default/FakeFaceEngine.cpp b/biometrics/face/aidl/default/FakeFaceEngine.cpp
index bdc13fd..bf75874 100644
--- a/biometrics/face/aidl/default/FakeFaceEngine.cpp
+++ b/biometrics/face/aidl/default/FakeFaceEngine.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#undef LOG_TAG
 #define LOG_TAG "FaceVirtualHalEngine"
 
 #include "FakeFaceEngine.h"
diff --git a/biometrics/face/aidl/default/Session.cpp b/biometrics/face/aidl/default/Session.cpp
index 6f3f2fc..673d879 100644
--- a/biometrics/face/aidl/default/Session.cpp
+++ b/biometrics/face/aidl/default/Session.cpp
@@ -14,20 +14,38 @@
  * limitations under the License.
  */
 
+#undef LOG_TAG
+#define LOG_TAG "FaceVirtualHalSession"
+
 #include <android-base/logging.h>
 
 #include "Session.h"
 
-#undef LOG_TAG
-#define LOG_TAG "FaceVirtualHalSession"
-
 namespace aidl::android::hardware::biometrics::face {
 
 constexpr size_t MAX_WORKER_QUEUE_SIZE = 5;
 
+void onClientDeath(void* cookie) {
+    LOG(INFO) << "FaceService has died";
+    Session* session = static_cast<Session*>(cookie);
+    if (session && !session->isClosed()) {
+        session->close();
+    }
+}
+
 Session::Session(std::unique_ptr<FakeFaceEngine> engine, std::shared_ptr<ISessionCallback> cb)
-    : mEngine(std::move(engine)), mCb(std::move(cb)), mRandom(std::mt19937::default_seed) {
+    : mEngine(std::move(engine)),
+      mCb(std::move(cb)),
+      mRandom(std::mt19937::default_seed),
+      mStateClosed(false) {
+    CHECK(mEngine);
+    CHECK(mCb);
     mThread = std::make_unique<WorkerThread>(MAX_WORKER_QUEUE_SIZE);
+    mDeathRecipient = AIBinder_DeathRecipient_new(onClientDeath);
+}
+
+binder_status_t Session::linkToDeath(AIBinder* binder) {
+    return AIBinder_linkToDeath(binder, mDeathRecipient, this);
 }
 
 ndk::ScopedAStatus Session::generateChallenge() {
@@ -144,9 +162,12 @@
 }
 
 ndk::ScopedAStatus Session::close() {
+    LOG(INFO) << "close";
     if (mCb) {
         mCb->onSessionClosed();
     }
+    AIBinder_DeathRecipient_delete(mDeathRecipient);
+    mStateClosed = true;
     return ndk::ScopedAStatus::ok();
 }
 
diff --git a/biometrics/face/aidl/default/Session.h b/biometrics/face/aidl/default/Session.h
index ce6e7f1..f79ad00 100644
--- a/biometrics/face/aidl/default/Session.h
+++ b/biometrics/face/aidl/default/Session.h
@@ -33,6 +33,11 @@
 
 using aidl::android::hardware::common::NativeHandle;
 
+enum class SessionState {
+    IDLING,
+    CLOSED,
+};
+
 class Session : public BnSession {
   public:
     explicit Session(std::unique_ptr<FakeFaceEngine> engine, std::shared_ptr<ISessionCallback> cb);
@@ -93,12 +98,28 @@
             const FaceEnrollOptions& options,
             std::shared_ptr<common::ICancellationSignal>* out) override;
 
+    binder_status_t linkToDeath(AIBinder* binder);
+
+    virtual std::string toString() const {
+        std::ostringstream os;
+        os << std::endl << "----- Face::Session:: -----" << std::endl;
+        os << "mStateClosed:" << mStateClosed << std::endl;
+        os << mEngine->toString();
+
+        return os.str();
+    }
+
+    bool isClosed() { return mStateClosed; }
+
   private:
     std::unique_ptr<FakeFaceEngine> mEngine;
     std::shared_ptr<ISessionCallback> mCb;
     std::mt19937 mRandom;
     std::unique_ptr<WorkerThread> mThread;
-    std::shared_ptr<CancellationSignal> mCancellationSignal;
+
+    // Binder death handler.
+    AIBinder_DeathRecipient* mDeathRecipient;
+    bool mStateClosed;
 };
 
 }  // namespace aidl::android::hardware::biometrics::face
diff --git a/bluetooth/finder/aidl/default/service.cpp b/bluetooth/finder/aidl/default/service.cpp
index a117df8..fe8904b 100644
--- a/bluetooth/finder/aidl/default/service.cpp
+++ b/bluetooth/finder/aidl/default/service.cpp
@@ -35,12 +35,16 @@
       ndk::SharedRefBase::make<BluetoothFinder>();
   std::string instance =
       std::string() + BluetoothFinder::descriptor + "/default";
-  auto result =
-      AServiceManager_addService(service->asBinder().get(), instance.c_str());
-  if (result == STATUS_OK) {
-    ABinderProcess_joinThreadPool();
+  if (AServiceManager_isDeclared(instance.c_str())) {
+    auto result =
+        AServiceManager_addService(service->asBinder().get(), instance.c_str());
+    if (result != STATUS_OK) {
+      ALOGE("Could not register as a service!");
+    }
   } else {
-    ALOGE("Could not register as a service!");
+    ALOGE("Could not register as a service because it's not declared.");
   }
+  // Keep running
+  ABinderProcess_joinThreadPool();
   return 0;
 }
diff --git a/bluetooth/lmp_event/aidl/default/src/main.rs b/bluetooth/lmp_event/aidl/default/src/main.rs
index cbdd4d1..dfb097f 100644
--- a/bluetooth/lmp_event/aidl/default/src/main.rs
+++ b/bluetooth/lmp_event/aidl/default/src/main.rs
@@ -41,10 +41,11 @@
     let lmp_event_service = lmp_event::LmpEvent::new();
     let lmp_event_service_binder = BnBluetoothLmpEvent::new_binder(lmp_event_service, BinderFeatures::default());
 
-    binder::add_service(
-        &format!("{}/default", lmp_event::LmpEvent::get_descriptor()),
-        lmp_event_service_binder.as_binder(),
-    ).expect("Failed to register service");
-
+    let descriptor = format!("{}/default", lmp_event::LmpEvent::get_descriptor());
+    if binder::is_declared(&descriptor).expect("Failed to check if declared") {
+        binder::add_service(&descriptor, lmp_event_service_binder.as_binder()).expect("Failed to register service");
+    } else {
+        info!("{LOG_TAG}: Failed to register service. Not declared.");
+    }
     binder::ProcessState::join_thread_pool()
 }
diff --git a/bluetooth/ranging/aidl/default/service.cpp b/bluetooth/ranging/aidl/default/service.cpp
index 83e539e..35a3f55 100644
--- a/bluetooth/ranging/aidl/default/service.cpp
+++ b/bluetooth/ranging/aidl/default/service.cpp
@@ -37,12 +37,16 @@
       ndk::SharedRefBase::make<BluetoothChannelSounding>();
   std::string instance =
       std::string() + BluetoothChannelSounding::descriptor + "/default";
-  auto result =
-      AServiceManager_addService(service->asBinder().get(), instance.c_str());
-  if (result == STATUS_OK) {
-    ABinderProcess_joinThreadPool();
+  if (AServiceManager_isDeclared(instance.c_str())) {
+    auto result =
+        AServiceManager_addService(service->asBinder().get(), instance.c_str());
+    if (result != STATUS_OK) {
+      ALOGE("Could not register as a service!");
+    }
   } else {
-    ALOGE("Could not register as a service!");
+    ALOGE("Could not register as a service because it's not declared.");
   }
+  // Keep running
+  ABinderProcess_joinThreadPool();
   return 0;
 }
diff --git a/health/aidl/default/Health.cpp b/health/aidl/default/Health.cpp
index 8174bc8..37662ea 100644
--- a/health/aidl/default/Health.cpp
+++ b/health/aidl/default/Health.cpp
@@ -36,6 +36,11 @@
     LinkedCallback* linked = reinterpret_cast<LinkedCallback*>(cookie);
     linked->OnCallbackDied();
 }
+// Delete the owned cookie.
+void onCallbackUnlinked(void* cookie) {
+    LinkedCallback* linked = reinterpret_cast<LinkedCallback*>(cookie);
+    delete linked;
+}
 }  // namespace
 
 /*
@@ -57,6 +62,7 @@
     : instance_name_(instance_name),
       healthd_config_(std::move(config)),
       death_recipient_(AIBinder_DeathRecipient_new(&OnCallbackDiedWrapped)) {
+    AIBinder_DeathRecipient_setOnUnlinked(death_recipient_.get(), onCallbackUnlinked);
     battery_monitor_.init(healthd_config_.get());
 }
 
@@ -286,7 +292,7 @@
         if (!linked_callback_result.ok()) {
             return ndk::ScopedAStatus::fromStatus(-linked_callback_result.error().code());
         }
-        callbacks_.emplace_back(std::move(*linked_callback_result));
+        callbacks_[*linked_callback_result] = callback;
         // unlock
     }
 
@@ -314,12 +320,24 @@
 
     std::lock_guard<decltype(callbacks_lock_)> lock(callbacks_lock_);
 
-    auto matches = [callback](const auto& linked) {
-        return linked->callback()->asBinder() == callback->asBinder();  // compares binder object
+    auto matches = [callback](const auto& cb) {
+        return cb->asBinder() == callback->asBinder();  // compares binder object
     };
-    auto it = std::remove_if(callbacks_.begin(), callbacks_.end(), matches);
-    bool removed = (it != callbacks_.end());
-    callbacks_.erase(it, callbacks_.end());  // calls unlinkToDeath on deleted callbacks.
+    bool removed = false;
+    for (auto it = callbacks_.begin(); it != callbacks_.end();) {
+        if (it->second->asBinder() == callback->asBinder()) {
+            auto status = AIBinder_unlinkToDeath(callback->asBinder().get(), death_recipient_.get(),
+                                                 reinterpret_cast<void*>(it->first));
+            if (status != STATUS_OK && status != STATUS_DEAD_OBJECT) {
+                LOG(WARNING) << __func__
+                             << "Cannot unlink to death: " << ::android::statusToString(status);
+            }
+            it = callbacks_.erase(it);
+            removed = true;
+        } else {
+            it++;
+        }
+    }
     return removed ? ndk::ScopedAStatus::ok()
                    : ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
 }
@@ -347,8 +365,8 @@
 void Health::OnHealthInfoChanged(const HealthInfo& health_info) {
     // Notify all callbacks
     std::unique_lock<decltype(callbacks_lock_)> lock(callbacks_lock_);
-    for (const auto& linked : callbacks_) {
-        auto res = linked->callback()->healthInfoChanged(health_info);
+    for (const auto& [_, callback] : callbacks_) {
+        auto res = callback->healthInfoChanged(health_info);
         if (!res.isOk()) {
             LOG(DEBUG) << "Cannot call healthInfoChanged:" << res.getDescription()
                        << ". Do nothing here if callback is dead as it will be cleaned up later.";
diff --git a/health/aidl/default/LinkedCallback.cpp b/health/aidl/default/LinkedCallback.cpp
index 26e99f9..df471a3 100644
--- a/health/aidl/default/LinkedCallback.cpp
+++ b/health/aidl/default/LinkedCallback.cpp
@@ -24,35 +24,24 @@
 
 namespace aidl::android::hardware::health {
 
-::android::base::Result<std::unique_ptr<LinkedCallback>> LinkedCallback::Make(
+::android::base::Result<LinkedCallback*> LinkedCallback::Make(
         std::shared_ptr<Health> service, std::shared_ptr<IHealthInfoCallback> callback) {
-    std::unique_ptr<LinkedCallback> ret(new LinkedCallback());
+    LinkedCallback* ret(new LinkedCallback());
+    // pass ownership of this object to the death recipient
     binder_status_t linkRet =
             AIBinder_linkToDeath(callback->asBinder().get(), service->death_recipient_.get(),
-                                 reinterpret_cast<void*>(ret.get()));
+                                 reinterpret_cast<void*>(ret));
     if (linkRet != ::STATUS_OK) {
         LOG(WARNING) << __func__ << "Cannot link to death: " << linkRet;
         return ::android::base::Error(-linkRet);
     }
     ret->service_ = service;
-    ret->callback_ = std::move(callback);
+    ret->callback_ = callback;
     return ret;
 }
 
 LinkedCallback::LinkedCallback() = default;
 
-LinkedCallback::~LinkedCallback() {
-    if (callback_ == nullptr) {
-        return;
-    }
-    auto status =
-            AIBinder_unlinkToDeath(callback_->asBinder().get(), service()->death_recipient_.get(),
-                                   reinterpret_cast<void*>(this));
-    if (status != STATUS_OK && status != STATUS_DEAD_OBJECT) {
-        LOG(WARNING) << __func__ << "Cannot unlink to death: " << ::android::statusToString(status);
-    }
-}
-
 std::shared_ptr<Health> LinkedCallback::service() {
     auto service_sp = service_.lock();
     CHECK_NE(nullptr, service_sp);
@@ -60,7 +49,10 @@
 }
 
 void LinkedCallback::OnCallbackDied() {
-    service()->unregisterCallback(callback_);
+    auto sCb = callback_.lock();
+    if (sCb) {
+        service()->unregisterCallback(sCb);
+    }
 }
 
 }  // namespace aidl::android::hardware::health
diff --git a/health/aidl/default/LinkedCallback.h b/health/aidl/default/LinkedCallback.h
index da494c9..8c9c997 100644
--- a/health/aidl/default/LinkedCallback.h
+++ b/health/aidl/default/LinkedCallback.h
@@ -32,19 +32,10 @@
 class LinkedCallback {
   public:
     // Automatically linkToDeath upon construction with the returned object as the cookie.
-    // service->death_reciepient() should be from CreateDeathRecipient().
-    // Not using a strong reference to |service| to avoid circular reference. The lifetime
-    // of |service| must be longer than this LinkedCallback object.
-    static ::android::base::Result<std::unique_ptr<LinkedCallback>> Make(
+    // The deathRecipient owns the LinkedCallback object and will delete it with
+    // cookie when it's unlinked.
+    static ::android::base::Result<LinkedCallback*> Make(
             std::shared_ptr<Health> service, std::shared_ptr<IHealthInfoCallback> callback);
-
-    // Automatically unlinkToDeath upon destruction. So, it is always safe to reinterpret_cast
-    // the cookie back to the LinkedCallback object.
-    ~LinkedCallback();
-
-    // The wrapped IHealthInfoCallback object.
-    const std::shared_ptr<IHealthInfoCallback>& callback() const { return callback_; }
-
     // On callback died, unreigster it from the service.
     void OnCallbackDied();
 
@@ -55,7 +46,7 @@
     std::shared_ptr<Health> service();
 
     std::weak_ptr<Health> service_;
-    std::shared_ptr<IHealthInfoCallback> callback_;
+    std::weak_ptr<IHealthInfoCallback> callback_;
 };
 
 }  // namespace aidl::android::hardware::health
diff --git a/health/aidl/default/include/health-impl/Health.h b/health/aidl/default/include/health-impl/Health.h
index dc3a0ef..429ae2a 100644
--- a/health/aidl/default/include/health-impl/Health.h
+++ b/health/aidl/default/include/health-impl/Health.h
@@ -16,6 +16,7 @@
 
 #pragma once
 
+#include <map>
 #include <memory>
 #include <optional>
 
@@ -112,7 +113,7 @@
     ndk::ScopedAIBinder_DeathRecipient death_recipient_;
     int binder_fd_ = -1;
     std::mutex callbacks_lock_;
-    std::vector<std::unique_ptr<LinkedCallback>> callbacks_;
+    std::map<LinkedCallback*, std::shared_ptr<IHealthInfoCallback>> callbacks_;
 };
 
 }  // namespace aidl::android::hardware::health
diff --git a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpReceptionStats.aidl b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpReceptionStats.aidl
index 82b798b..216da4c 100644
--- a/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpReceptionStats.aidl
+++ b/radio/aidl/aidl_api/android.hardware.radio.ims.media/current/android/hardware/radio/ims/media/RtpReceptionStats.aidl
@@ -35,8 +35,8 @@
 @VintfStability
 parcelable RtpReceptionStats {
   int rtpTimestamp;
-  int rtpSequenceNumber;
-  int timeDurationMs;
+  int rtcpSrTimestamp;
+  long rtcpSrNtpTimestamp;
   int jitterBufferMs;
   int roundTripTimeMs;
 }
diff --git a/radio/aidl/android/hardware/radio/ims/media/IImsMediaSession.aidl b/radio/aidl/android/hardware/radio/ims/media/IImsMediaSession.aidl
index 0fe6740..69ca780 100644
--- a/radio/aidl/android/hardware/radio/ims/media/IImsMediaSession.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/IImsMediaSession.aidl
@@ -110,8 +110,7 @@
      * Adjust the delay in the jitter buffer to synchronize the audio with the time of video
      * frames
      *
-     * @param delayMs The delay to apply to the jitter buffer. If it is positive, the jitter
-     * buffer increases the delay, if it is negative, the jitter buffer decreases the delay.
+     * @param delayMs The additional delay to the jitter buffer in milliseconds.
      *
      * This is available when android.hardware.telephony.ims is defined.
      */
diff --git a/radio/aidl/android/hardware/radio/ims/media/RtpReceptionStats.aidl b/radio/aidl/android/hardware/radio/ims/media/RtpReceptionStats.aidl
index 1239d13..81c0bb2 100644
--- a/radio/aidl/android/hardware/radio/ims/media/RtpReceptionStats.aidl
+++ b/radio/aidl/android/hardware/radio/ims/media/RtpReceptionStats.aidl
@@ -20,12 +20,19 @@
 parcelable RtpReceptionStats {
     /** The timestamp of the latest RTP packet received */
     int rtpTimestamp;
-    /** The sequence number of latest RTP packet received */
-    int rtpSequenceNumber;
-    /** The system clock time in millisecond of latest RTP packet received */
-    int timeDurationMs;
-    /** The jitter buffer size in millisecond when latest RTP packet received */
+
+    /** The timestamp of the latest RTCP-SR packet received */
+    int rtcpSrTimestamp;
+
+    /** The NTP timestamp of latest RTCP-SR packet received */
+    long rtcpSrNtpTimestamp;
+
+    /**
+     * The mean jitter buffer delay of a media stream from received to playback, measured in
+     *  milliseconds, within the reporting interval
+     */
     int jitterBufferMs;
+
     /** The round trip time delay in millisecond when latest RTP packet received */
     int roundTripTimeMs;
 }
diff --git a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
index 54f187c..808ed18 100644
--- a/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
+++ b/security/keymint/aidl/vts/functional/BootloaderStateTest.cpp
@@ -149,7 +149,9 @@
                                                  digest512.data());
 
     ASSERT_TRUE((attestedVbmetaDigest_ == digest256) || (attestedVbmetaDigest_ == digest512))
-            << "Attested digest does not match computed digest.";
+            << "Attested vbmeta digest (" << bin2hex(attestedVbmetaDigest_)
+            << ") does not match computed digest (sha256: " << bin2hex(digest256)
+            << ", sha512: " << bin2hex(digest512) << ").";
 }
 
 INSTANTIATE_KEYMINT_AIDL_TEST(BootloaderStateTest);
diff --git a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
index 5c13ed0..ff94639 100644
--- a/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
+++ b/tv/tuner/aidl/vts/functional/VtsHalTvTunerTestConfigurations.h
@@ -731,9 +731,20 @@
     if (videoFilterIds.empty() || audioFilterIds.empty() || frontendMap.empty()) {
         return;
     }
-    if (hasSwFe && !hasHwFe && dvrMap.empty()) {
-        ALOGD("Cannot configure Live. Only software frontends and no dvr connections");
-        return;
+    if (!hasHwFe) {
+        if (hasSwFe) {
+            if (dvrMap.empty()) {
+                ALOGD("Cannot configure Live. Only software frontends and no dvr connections.");
+                return;
+            }
+            // Live is available if there is SW FE and some DVR is attached.
+        } else {
+            // We will arrive here because frontendMap won't be empty since
+            // there will be at least a default frontend declared. But the
+            // default frontend doesn't count as "hasSwFe".
+            ALOGD("Cannot configure Live. No frontend declared at all.");
+            return;
+        }
     }
     ALOGD("Can support live");
     live.hasFrontendConnection = true;