diff --git a/audio/README.md b/audio/README.md
index 1938ad4..3f40d72 100644
--- a/audio/README.md
+++ b/audio/README.md
@@ -2,10 +2,29 @@
 
 Directory structure of the audio HAL related code.
 
-Run `common/all-versions/copyHAL.sh` to create a new version of the audio HAL
-based on an existing one.
+## Directory Structure for AIDL audio HAL
 
-## Directory Structure
+The AIDL version is located inside `aidl` directory. The tree below explains
+the role of each subdirectory:
+
+* `aidl_api` — snapshots of the API created each Android release. Every
+  release, the current version of the API becomes "frozen" and gets assigned
+  the next version number. If the API needs further modifications, they are
+  made on the "current" version. After making modifications, run
+  `m <package name>-update-api` to update the snapshot of the "current"
+  version.
+* `android/hardware/audio/common` — data structures and interfaces shared
+  between various HALs: BT HAL, core and effects audio HALs.
+* `android/hardware/audio/core` — data structures and interfaces of the
+  core audio HAL.
+* `default` — the default, reference implementation of the audio HAL service.
+* `vts` — VTS tests for the AIDL HAL.
+
+## Directory Structure for HIDL audio HAL
+
+Run `common/all-versions/copyHAL.sh` to create a new version of the HIDL audio
+HAL based on an existing one. Note that this isn't possible since Android T
+release. Android U and above uses AIDL audio HAL.
 
 * `2.0` — version 2.0 of the core HIDL API. Note that `.hal` files
   can not be moved into the `core` directory because that would change
diff --git a/audio/aidl/Android.bp b/audio/aidl/Android.bp
index e69306e..01af940 100644
--- a/audio/aidl/Android.bp
+++ b/audio/aidl/Android.bp
@@ -109,7 +109,6 @@
         "android.hardware.audio_defaults",
     ],
     srcs: [
-        "android/hardware/audio/core/AudioMode.aidl",
         "android/hardware/audio/core/AudioPatch.aidl",
         "android/hardware/audio/core/AudioRoute.aidl",
         "android/hardware/audio/core/IBluetooth.aidl",
@@ -227,6 +226,7 @@
     srcs: [
         "android/hardware/audio/effect/AcousticEchoCanceler.aidl",
         "android/hardware/audio/effect/AutomaticGainControl.aidl",
+        "android/hardware/audio/effect/AutomaticGainControlV1.aidl",
         "android/hardware/audio/effect/BassBoost.aidl",
         "android/hardware/audio/effect/Capability.aidl",
         "android/hardware/audio/effect/CommandId.aidl",
@@ -244,6 +244,7 @@
         "android/hardware/audio/effect/Parameter.aidl",
         "android/hardware/audio/effect/PresetReverb.aidl",
         "android/hardware/audio/effect/Processing.aidl",
+        "android/hardware/audio/effect/Range.aidl",
         "android/hardware/audio/effect/State.aidl",
         "android/hardware/audio/effect/VendorExtension.aidl",
         "android/hardware/audio/effect/Virtualizer.aidl",
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetooth.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetooth.aidl
index 289c0c2..9357a15 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetooth.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IBluetooth.aidl
@@ -44,10 +44,10 @@
     @nullable @utf8InCpp String debugName;
     @VintfStability
     enum Mode {
-      UNSPECIFIED = 0,
-      SCO = 1,
-      SCO_WB = 2,
-      SCO_SWB = 3,
+      UNSPECIFIED,
+      SCO,
+      SCO_WB,
+      SCO_SWB,
     }
   }
   @JavaDerive(equals=true, toString=true) @VintfStability
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
index 4486b66..45217e7 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/IModule.aidl
@@ -59,7 +59,7 @@
   boolean getMicMute();
   void setMicMute(boolean mute);
   android.hardware.audio.core.MicrophoneInfo[] getMicrophones();
-  void updateAudioMode(android.hardware.audio.core.AudioMode mode);
+  void updateAudioMode(android.media.audio.common.AudioMode mode);
   void updateScreenRotation(android.hardware.audio.core.IModule.ScreenRotation rotation);
   void updateScreenState(boolean isTurnedOn);
   @nullable android.hardware.audio.core.sounddose.ISoundDose getSoundDose();
@@ -68,6 +68,12 @@
   void setVendorParameters(in android.hardware.audio.core.VendorParameter[] parameters, boolean async);
   void addDeviceEffect(int portConfigId, in android.hardware.audio.effect.IEffect effect);
   void removeDeviceEffect(int portConfigId, in android.hardware.audio.effect.IEffect effect);
+  android.media.audio.common.AudioMMapPolicyInfo[] getMmapPolicyInfos(android.media.audio.common.AudioMMapPolicyType mmapPolicyType);
+  boolean supportsVariableLatency();
+  int getAAudioMixerBurstCount();
+  int getAAudioHardwareBurstMinUsec();
+  const int DEFAULT_AAUDIO_MIXER_BURST_COUNT = 2;
+  const int DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US = 1000;
   @VintfStability
   parcelable OpenInputStreamArguments {
     int portConfigId;
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/ITelephony.aidl b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/ITelephony.aidl
index 77063df..001d074 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/ITelephony.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/ITelephony.aidl
@@ -34,8 +34,8 @@
 package android.hardware.audio.core;
 @VintfStability
 interface ITelephony {
-  android.hardware.audio.core.AudioMode[] getSupportedAudioModes();
-  void switchAudioMode(android.hardware.audio.core.AudioMode mode);
+  android.media.audio.common.AudioMode[] getSupportedAudioModes();
+  void switchAudioMode(android.media.audio.common.AudioMode mode);
   android.hardware.audio.core.ITelephony.TelecomConfig setTelecomConfig(in android.hardware.audio.core.ITelephony.TelecomConfig config);
   @JavaDerive(equals=true, toString=true) @VintfStability
   parcelable TelecomConfig {
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
similarity index 74%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
index 336f9b5..ff010c6 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/AutomaticGainControlV1.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,21 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.audio.effect;
+@VintfStability
+union AutomaticGainControlV1 {
+  android.hardware.audio.effect.VendorExtension vendor;
+  int targetPeakLevelDbFs;
+  int maxCompressionGainDb;
+  boolean enableLimiter;
+  @VintfStability
+  union Id {
+    int vendorExtensionTag;
+    android.hardware.audio.effect.AutomaticGainControlV1.Tag commonTag;
+  }
+  @VintfStability
+  parcelable Capability {
+    ParcelableHolder extension;
+    android.hardware.audio.effect.Range[] ranges;
+  }
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Equalizer.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Equalizer.aidl
index d825eac..ea63de5 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Equalizer.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Equalizer.aidl
@@ -37,6 +37,7 @@
   android.hardware.audio.effect.VendorExtension vendorExtension;
   android.hardware.audio.effect.Equalizer.BandLevel[] bandLevels;
   int preset;
+  int[] centerFreqMh;
   @VintfStability
   union Id {
     int vendorExtensionTag;
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Flags.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Flags.aidl
index 285ff18..bcbf870 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Flags.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Flags.aidl
@@ -42,7 +42,7 @@
   boolean deviceIndication;
   boolean audioModeIndication;
   boolean audioSourceIndication;
-  boolean noProcessing;
+  boolean bypass;
   @Backing(type="byte") @VintfStability
   enum Type {
     INSERT = 0,
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/HapticGenerator.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/HapticGenerator.aidl
index 20f7e02..35186c3 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/HapticGenerator.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/HapticGenerator.aidl
@@ -48,9 +48,9 @@
   }
   @Backing(type="int") @VintfStability
   enum VibratorScale {
-    MUTE = (-100),
-    VERY_LOW = (-2),
-    LOW = (-1),
+    MUTE = (-100) /* -100 */,
+    VERY_LOW = (-2) /* -2 */,
+    LOW = (-1) /* -1 */,
     NONE = 0,
     HIGH = 1,
     VERY_HIGH = 2,
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
index 397f897..153e021 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/NoiseSuppression.aidl
@@ -36,6 +36,7 @@
 union NoiseSuppression {
   android.hardware.audio.effect.VendorExtension vendor;
   android.hardware.audio.effect.NoiseSuppression.Level level;
+  android.hardware.audio.effect.NoiseSuppression.Type type;
   @VintfStability
   union Id {
     int vendorExtensionTag;
@@ -50,5 +51,11 @@
     LOW,
     MEDIUM,
     HIGH,
+    VERY_HIGH,
+  }
+  @Backing(type="int") @VintfStability
+  enum Type {
+    SINGLE_CHANNEL,
+    MULTI_CHANNEL,
   }
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
similarity index 68%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
index 336f9b5..531d3a1 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Range.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2023 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,36 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.audio.effect;
+@VintfStability
+parcelable Range {
+  int tag;
+  android.hardware.audio.effect.Range.Types types;
+  @VintfStability
+  parcelable Int {
+    int min;
+    int max;
+  }
+  @VintfStability
+  parcelable Float {
+    float min;
+    float max;
+  }
+  @VintfStability
+  parcelable Long {
+    long min;
+    long max;
+  }
+  @VintfStability
+  parcelable Byte {
+    byte min;
+    byte max;
+  }
+  @VintfStability
+  union Types {
+    android.hardware.audio.effect.Range.Int rangeInt;
+    android.hardware.audio.effect.Range.Float rangeFloat;
+    android.hardware.audio.effect.Range.Long rangeLong;
+    android.hardware.audio.effect.Range.Byte rangeByte;
+  }
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Virtualizer.aidl b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Virtualizer.aidl
index 9fdd692..2f367d9 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Virtualizer.aidl
+++ b/audio/aidl/aidl_api/android.hardware.audio.effect/current/android/hardware/audio/effect/Virtualizer.aidl
@@ -36,10 +36,18 @@
 union Virtualizer {
   android.hardware.audio.effect.VendorExtension vendor;
   int strengthPm;
+  android.hardware.audio.effect.Virtualizer.ChannelAngle[] speakerAngles;
+  android.media.audio.common.AudioDeviceDescription device;
   @VintfStability
   union Id {
     int vendorExtensionTag;
     android.hardware.audio.effect.Virtualizer.Tag commonTag;
+    android.hardware.audio.effect.Virtualizer.SpeakerAnglesPayload speakerAnglesPayload;
+  }
+  @VintfStability
+  parcelable SpeakerAnglesPayload {
+    android.media.audio.common.AudioChannelLayout layout;
+    android.media.audio.common.AudioDeviceDescription device;
   }
   @VintfStability
   parcelable Capability {
@@ -47,4 +55,10 @@
     int maxStrengthPm;
     boolean strengthSupported;
   }
+  @VintfStability
+  parcelable ChannelAngle {
+    int channel;
+    int azimuthDegree;
+    int elevationDegree;
+  }
 }
diff --git a/audio/aidl/android/hardware/audio/core/AudioMode.aidl b/audio/aidl/android/hardware/audio/core/AudioMode.aidl
deleted file mode 100644
index 0943a55..0000000
--- a/audio/aidl/android/hardware/audio/core/AudioMode.aidl
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.hardware.audio.core;
-
-/**
- * The audio mode describes states of the audio system of the device that
- * can significantly affect the rules of audio routing, volume control, etc.
- * The audio mode is controlled by the framework, however the HAL has some
- * flexibility in the choice of modes to support, see 'IModule.updateAudioMode'.
- */
-@VintfStability
-@Backing(type="int")
-enum AudioMode {
-    /** No active calls. */
-    NORMAL = 0,
-    /** The device is playing the ringtone. */
-    RINGTONE = 1,
-    /** The call is handled by the telephony stack ("voice call"). */
-    IN_CALL = 2,
-    /** The call is handled by an application ("VoIP call"). */
-    IN_COMMUNICATION = 3,
-    /** Call screening is in progress. */
-    CALL_SCREEN = 4,
-}
diff --git a/audio/aidl/android/hardware/audio/core/IModule.aidl b/audio/aidl/android/hardware/audio/core/IModule.aidl
index 7bc1b9c..968b573 100644
--- a/audio/aidl/android/hardware/audio/core/IModule.aidl
+++ b/audio/aidl/android/hardware/audio/core/IModule.aidl
@@ -18,7 +18,6 @@
 
 import android.hardware.audio.common.SinkMetadata;
 import android.hardware.audio.common.SourceMetadata;
-import android.hardware.audio.core.AudioMode;
 import android.hardware.audio.core.AudioPatch;
 import android.hardware.audio.core.AudioRoute;
 import android.hardware.audio.core.IBluetooth;
@@ -33,6 +32,9 @@
 import android.hardware.audio.core.VendorParameter;
 import android.hardware.audio.core.sounddose.ISoundDose;
 import android.hardware.audio.effect.IEffect;
+import android.media.audio.common.AudioMMapPolicyInfo;
+import android.media.audio.common.AudioMMapPolicyType;
+import android.media.audio.common.AudioMode;
 import android.media.audio.common.AudioOffloadInfo;
 import android.media.audio.common.AudioPort;
 import android.media.audio.common.AudioPortConfig;
@@ -684,6 +686,7 @@
      * method.
      *
      * @param mode The current mode.
+     * @throws EX_ILLEGAL_ARGUMENT If the mode is out of range of valid values.
      */
     void updateAudioMode(AudioMode mode);
 
@@ -806,4 +809,55 @@
      * @throws EX_UNSUPPORTED_OPERATION If the module does not support device port effects.
      */
     void removeDeviceEffect(int portConfigId, in IEffect effect);
+
+    /**
+     * Provide information describing how aaudio MMAP is supported per queried aaudio
+     * MMAP policy type.
+     *
+     * If there are no devices that support aaudio MMAP for the queried aaudio MMAP policy
+     * type in the HAL module, it must return an empty vector. Otherwise, return a vector
+     * describing how the devices support aaudio MMAP.
+     *
+     * @param mmapPolicyType the aaudio mmap policy type to query.
+     * @return The vector with mmap policy information.
+     */
+    AudioMMapPolicyInfo[] getMmapPolicyInfos(AudioMMapPolicyType mmapPolicyType);
+
+    /**
+     * Indicates if this module supports variable latency control for instance
+     * over Bluetooth A2DP or LE Audio links.
+     *
+     * If supported, all instances of IStreamOut interface returned by this module must
+     * implement getRecommendedLatencyModes() and setLatencyMode() APIs.
+     *
+     * @return Whether the module supports variable latency control.
+     */
+    boolean supportsVariableLatency();
+
+    /**
+     * Default value for number of bursts per aaudio mixer cycle. This is a suggested value
+     * to return for the HAL module, unless it is known that a better option exists.
+     */
+    const int DEFAULT_AAUDIO_MIXER_BURST_COUNT = 2;
+    /**
+     * Get the number of bursts per aaudio mixer cycle.
+     *
+     * @return The number of burst per aaudio mixer cycle.
+     * @throw EX_UNSUPPORTED_OPERATION If the module does not support aaudio MMAP.
+     */
+    int getAAudioMixerBurstCount();
+
+    /**
+     * Default value for minimum duration in microseconds for a MMAP hardware burst. This
+     * is a suggested value to return for the HAL module, unless it is known that a better
+     * option exists.
+     */
+    const int DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US = 1000;
+    /**
+     * Get the minimum duration in microseconds for a MMAP hardware burst.
+     *
+     * @return The minimum number of microseconds for a MMAP hardware burst.
+     * @throw EX_UNSUPPORTED_OPERATION If the module does not support aaudio MMAP.
+     */
+    int getAAudioHardwareBurstMinUsec();
 }
diff --git a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
index b60b0fd..0e58add 100644
--- a/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
+++ b/audio/aidl/android/hardware/audio/core/IStreamOut.aidl
@@ -157,7 +157,8 @@
      *
      * Implementation for this method is mandatory only on specific spatial
      * audio streams indicated by AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can
-     * be routed to a BT classic sink.
+     * be routed to a BT sinks or if the implementation indicates support
+     * on all streams via IModule.supportsVariableLatency().
      *
      * @return Currently supported latency modes.
      * @throws EX_ILLEGAL_STATE If the stream is closed.
@@ -172,7 +173,8 @@
      *
      * Implementation for this method is mandatory only on specific spatial
      * audio streams indicated by AUDIO_OUTPUT_FLAG_SPATIALIZER flag if they can
-     * be routed to a BT classic sink.
+     * be routed to a BT sinks or if the implementation indicates support
+     * on all streams via IModule.supportsVariableLatency().
      *
      * @throws EX_ILLEGAL_ARGUMENT If the specified mode is not supported.
      * @throws EX_ILLEGAL_STATE If the stream is closed.
diff --git a/audio/aidl/android/hardware/audio/core/ITelephony.aidl b/audio/aidl/android/hardware/audio/core/ITelephony.aidl
index a817032..7fc1ace 100644
--- a/audio/aidl/android/hardware/audio/core/ITelephony.aidl
+++ b/audio/aidl/android/hardware/audio/core/ITelephony.aidl
@@ -16,7 +16,7 @@
 
 package android.hardware.audio.core;
 
-import android.hardware.audio.core.AudioMode;
+import android.media.audio.common.AudioMode;
 import android.media.audio.common.Boolean;
 import android.media.audio.common.Float;
 
@@ -52,6 +52,7 @@
      *
      * @param mode The mode to switch to.
      * @throws EX_UNSUPPORTED_OPERATION If the HAL does not support the specified mode.
+     * @throws EX_ILLEGAL_ARGUMENT If the mode is out of range of valid values.
      * @throws EX_ILLEGAL_STATE If there was an error during switching.
      */
     void switchAudioMode(AudioMode mode);
diff --git a/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl b/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl
new file mode 100644
index 0000000..d6e0648
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/effect/AutomaticGainControlV1.aidl
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.effect;
+
+import android.hardware.audio.effect.Range;
+import android.hardware.audio.effect.VendorExtension;
+
+/**
+ * Automatic Gain Control (AGC) is an audio pre-processor which automatically normalizes the output
+ * of the captured signal by boosting or lowering input from the microphone to match a preset level
+ * so that the output signal level is virtually constant. AGC can be used by applications where the
+ * input signal dynamic range is not important but where a constant strong capture level is desired.
+ *
+ * All parameters defined in union AutomaticGainControlV1 must be gettable and settable. The
+ * capabilities defined in AutomaticGainControlV1.Capability can only acquired with
+ * IEffect.getDescriptor() and not settable.
+ */
+@VintfStability
+union AutomaticGainControlV1 {
+    /**
+     * Effect parameter tag to identify the parameters for getParameter().
+     */
+    @VintfStability
+    union Id {
+        int vendorExtensionTag;
+        AutomaticGainControlV1.Tag commonTag;
+    }
+
+    /**
+     * Vendor AutomaticGainControlV1 implementation definition for additional parameters.
+     */
+    VendorExtension vendor;
+
+    /**
+     * Capability supported by AutomaticGainControlV1 implementation.
+     */
+    @VintfStability
+    parcelable Capability {
+        /**
+         * AutomaticGainControlV1 capability extension, vendor can use this extension in case
+         * existing capability definition not enough.
+         */
+        ParcelableHolder extension;
+        /**
+         * Supported range for parameters.
+         */
+        Range[] ranges;
+    }
+
+    /**
+     * Target peak level (or envelope) of the AGC implementation in dBFs (dB relative to full
+     * scale).
+     * Must be in range of AutomaticGainControlV1.Capability.ranges with targetPeakLevelDbFs tag.
+     */
+    int targetPeakLevelDbFs;
+    /*
+     * Sets the maximum gain the digital compression stage may apply, in dB. A higher number
+     * corresponds to greater compression, while a value of 0 will leave the signal uncompressed.
+     * Must be in range of AutomaticGainControlV1.Capability.ranges with maxCompressionGainDb tag.
+     */
+    int maxCompressionGainDb;
+    /**
+     * Enable or disable limiter.
+     * When enabled, the compression stage will hard limit the signal to the target level.
+     * Otherwise, the signal will be compressed but not limited above the target level.
+     */
+    boolean enableLimiter;
+}
diff --git a/audio/aidl/android/hardware/audio/effect/Equalizer.aidl b/audio/aidl/android/hardware/audio/effect/Equalizer.aidl
index 79a1c4f..7903fde 100644
--- a/audio/aidl/android/hardware/audio/effect/Equalizer.aidl
+++ b/audio/aidl/android/hardware/audio/effect/Equalizer.aidl
@@ -72,7 +72,7 @@
     }
 
     /**
-     * Supported minimal and maximal frequency for each band in millihertz.
+     * Supported minimal and maximal frequency for each band in milliHertz.
      */
     @VintfStability
     parcelable BandFrequency {
@@ -97,8 +97,14 @@
      * Level for each band.
      */
     BandLevel[] bandLevels;
+
     /**
      * Index of current preset.
      */
     int preset;
+
+    /**
+     * Get only parameter, get the center frequency for all bands in milliHertz.
+     */
+    int[] centerFreqMh;
 }
diff --git a/audio/aidl/android/hardware/audio/effect/Flags.aidl b/audio/aidl/android/hardware/audio/effect/Flags.aidl
index f449c2d..1612234 100644
--- a/audio/aidl/android/hardware/audio/effect/Flags.aidl
+++ b/audio/aidl/android/hardware/audio/effect/Flags.aidl
@@ -141,7 +141,7 @@
     boolean audioSourceIndication;
 
     /**
-     * Set to true if no processing done for this effect instance.
+     * Set to true if the effect instance bypass audio data (no processing).
      */
-    boolean noProcessing;
+    boolean bypass;
 }
diff --git a/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl b/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
index 946fa87..c4baff8 100644
--- a/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
+++ b/audio/aidl/android/hardware/audio/effect/NoiseSuppression.aidl
@@ -62,10 +62,17 @@
      * suppression, NsConfig::SuppressionLevel::k12dB for MEDIUM, and
      * NsConfig::SuppressionLevel::k18dB for HIGH.
      */
-    @VintfStability @Backing(type="int") enum Level { LOW, MEDIUM, HIGH }
+    @VintfStability @Backing(type="int") enum Level { LOW, MEDIUM, HIGH, VERY_HIGH }
 
     /**
      * The NS level.
      */
     Level level;
+
+    /**
+     * Noise suppression type.
+     */
+    @VintfStability @Backing(type="int") enum Type { SINGLE_CHANNEL, MULTI_CHANNEL }
+
+    Type type;
 }
diff --git a/audio/aidl/android/hardware/audio/effect/Range.aidl b/audio/aidl/android/hardware/audio/effect/Range.aidl
new file mode 100644
index 0000000..c052502
--- /dev/null
+++ b/audio/aidl/android/hardware/audio/effect/Range.aidl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.audio.effect;
+
+/**
+ * Define the range (min and max) of a certain field, identified by tag.
+ * Can be used by effect capabilities to define supported value ranges.
+ */
+@VintfStability
+parcelable Range {
+    /**
+     * The union tag name which the range is defined for.
+     * For example: if used in AutomaticGainControlV1.Capability, value of Range.tag could be
+     * targetLevelDbFs or compressionGainDb.
+     */
+    int tag;
+
+    @VintfStability
+    parcelable Int {
+        int min;
+        int max;
+    }
+
+    @VintfStability
+    parcelable Float {
+        float min;
+        float max;
+    }
+
+    @VintfStability
+    parcelable Long {
+        long min;
+        long max;
+    }
+
+    @VintfStability
+    parcelable Byte {
+        byte min;
+        byte max;
+    }
+
+    @VintfStability
+    union Types {
+        Int rangeInt;
+        Float rangeFloat;
+        Long rangeLong;
+        Byte rangeByte;
+    }
+
+    Types types;
+}
diff --git a/audio/aidl/android/hardware/audio/effect/Virtualizer.aidl b/audio/aidl/android/hardware/audio/effect/Virtualizer.aidl
index 5f385a6..fc453ad 100644
--- a/audio/aidl/android/hardware/audio/effect/Virtualizer.aidl
+++ b/audio/aidl/android/hardware/audio/effect/Virtualizer.aidl
@@ -17,6 +17,8 @@
 package android.hardware.audio.effect;
 
 import android.hardware.audio.effect.VendorExtension;
+import android.media.audio.common.AudioChannelLayout;
+import android.media.audio.common.AudioDeviceDescription;
 
 /**
  * Virtualizer specific definitions. An audio virtualizer is a general name for an effect to
@@ -35,6 +37,7 @@
     union Id {
         int vendorExtensionTag;
         Virtualizer.Tag commonTag;
+        SpeakerAnglesPayload speakerAnglesPayload;
     }
 
     /**
@@ -43,6 +46,25 @@
     VendorExtension vendor;
 
     /**
+     * Payload to query speaker angles for the given channel position mask and device.
+     * The Virtualizer implementation must return EX_ILLEGAL_ARGUMENT if the given payload not
+     * supported.
+     */
+    @VintfStability
+    parcelable SpeakerAnglesPayload {
+        /**
+         * Audio channel position definition. See
+         * android.media.audio.common.AudioChannelLayout.aidl. Only the channel position "CHANNEL_*"
+         * in AudioChannelLayout be used.
+         */
+        AudioChannelLayout layout;
+        /**
+         * Audio device type. See android.media.audio.common.AudioDeviceDescription.aidl.
+         */
+        AudioDeviceDescription device;
+    }
+
+    /**
      * Capability supported by Virtualizer implementation.
      */
     @VintfStability
@@ -74,4 +96,39 @@
      * the 'maxStrengthPm' capability.
      */
     int strengthPm;
+
+    /**
+     * All angles are expressed in degrees and are relative to the listener.
+     */
+    @VintfStability
+    parcelable ChannelAngle {
+        /**
+         * Audio channel layout, CHANNEL_* constants defined in
+         * android.media.audio.common.AudioChannelLayout.
+         */
+        int channel;
+
+        /**
+         * 0 is the direction the listener faces, 180 is behind the listener, and -90 is left of
+         * the listener.
+         */
+        int azimuthDegree;
+
+        /**
+         * 0 is the horizontal plane, +90 is above the listener, -90 is below.
+         */
+        int elevationDegree;
+    }
+
+    /**
+     * Get only parameter.
+     * A vector of angles per channel represented by azimuth and elevation (in degrees), client must
+     * set Parameter.Id to SpeakerAnglesPayload to get speakerAngles.
+     */
+    ChannelAngle[] speakerAngles;
+
+    /**
+     * The audio device on which virtualzation mode is forced.
+     */
+    AudioDeviceDescription device;
 }
diff --git a/audio/aidl/common/include/Utils.h b/audio/aidl/common/include/Utils.h
index 8f0c986..d87bbd4 100644
--- a/audio/aidl/common/include/Utils.h
+++ b/audio/aidl/common/include/Utils.h
@@ -16,6 +16,8 @@
 
 #pragma once
 
+#include <algorithm>
+#include <array>
 #include <initializer_list>
 #include <type_traits>
 
@@ -23,11 +25,22 @@
 #include <aidl/android/media/audio/common/AudioDeviceType.h>
 #include <aidl/android/media/audio/common/AudioFormatDescription.h>
 #include <aidl/android/media/audio/common/AudioInputFlags.h>
+#include <aidl/android/media/audio/common/AudioMode.h>
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
 #include <aidl/android/media/audio/common/PcmType.h>
 
 namespace android::hardware::audio::common {
 
+// Some values are reserved for use by the system code only.
+// HALs must not accept or emit values outside from the provided list.
+constexpr std::array<::aidl::android::media::audio::common::AudioMode, 5> kValidAudioModes = {
+        ::aidl::android::media::audio::common::AudioMode::NORMAL,
+        ::aidl::android::media::audio::common::AudioMode::RINGTONE,
+        ::aidl::android::media::audio::common::AudioMode::IN_CALL,
+        ::aidl::android::media::audio::common::AudioMode::IN_COMMUNICATION,
+        ::aidl::android::media::audio::common::AudioMode::CALL_SCREEN,
+};
+
 constexpr size_t getPcmSampleSizeInBytes(::aidl::android::media::audio::common::PcmType pcm) {
     using ::aidl::android::media::audio::common::PcmType;
     switch (pcm) {
@@ -91,6 +104,35 @@
            device == ::aidl::android::media::audio::common::AudioDeviceType::OUT_TELEPHONY_TX;
 }
 
+constexpr bool isUsbInputDeviceType(::aidl::android::media::audio::common::AudioDeviceType type) {
+    switch (type) {
+        case ::aidl::android::media::audio::common::AudioDeviceType::IN_DOCK:
+        case ::aidl::android::media::audio::common::AudioDeviceType::IN_ACCESSORY:
+        case ::aidl::android::media::audio::common::AudioDeviceType::IN_DEVICE:
+        case ::aidl::android::media::audio::common::AudioDeviceType::IN_HEADSET:
+            return true;
+        default:
+            return false;
+    }
+}
+
+constexpr bool isUsbOutputtDeviceType(::aidl::android::media::audio::common::AudioDeviceType type) {
+    switch (type) {
+        case ::aidl::android::media::audio::common::AudioDeviceType::OUT_DOCK:
+        case ::aidl::android::media::audio::common::AudioDeviceType::OUT_ACCESSORY:
+        case ::aidl::android::media::audio::common::AudioDeviceType::OUT_DEVICE:
+        case ::aidl::android::media::audio::common::AudioDeviceType::OUT_HEADSET:
+            return true;
+        default:
+            return false;
+    }
+}
+
+constexpr bool isValidAudioMode(::aidl::android::media::audio::common::AudioMode mode) {
+    return std::find(kValidAudioModes.begin(), kValidAudioModes.end(), mode) !=
+           kValidAudioModes.end();
+}
+
 // The helper functions defined below are only applicable to the case when an enum type
 // specifies zero-based bit positions, not bit masks themselves. This is why instantiation
 // is restricted to certain enum types.
diff --git a/audio/aidl/default/Android.bp b/audio/aidl/default/Android.bp
index 95043f7..21616be 100644
--- a/audio/aidl/default/Android.bp
+++ b/audio/aidl/default/Android.bp
@@ -11,12 +11,14 @@
     name: "aidlaudioservice_defaults",
     vendor: true,
     shared_libs: [
+        "libalsautilsv2",
         "libaudioaidlcommon",
         "libbase",
         "libbinder_ndk",
         "libcutils",
         "libfmq",
         "libstagefright_foundation",
+        "libtinyalsav2",
         "libutils",
         "libxml2",
         "android.hardware.common-V2-ndk",
@@ -71,6 +73,9 @@
         "Stream.cpp",
         "StreamStub.cpp",
         "Telephony.cpp",
+        "usb/ModuleUsb.cpp",
+        "usb/StreamUsb.cpp",
+        "usb/UsbAlsaUtils.cpp",
     ],
     generated_sources: [
         "audio_policy_configuration_aidl_default",
@@ -152,23 +157,7 @@
     vintf_fragments: ["android.hardware.audio.effect.service-aidl.xml"],
     defaults: ["aidlaudioeffectservice_defaults"],
     shared_libs: [
-        "libaecsw",
-        "libagcsw",
-        "libbassboostsw",
-        "libbundleaidl",
-        "libdownmixaidl",
-        "libdynamicsprocessingaidl",
-        "libenvreverbsw",
-        "libequalizersw",
-        "libhapticgeneratoraidl",
-        "libloudnessenhanceraidl",
-        "libnssw",
-        "libpresetreverbsw",
-        "libreverbaidl",
         "libtinyxml2",
-        "libvirtualizersw",
-        "libvisualizeraidl",
-        "libvolumesw",
     ],
     srcs: [
         "EffectConfig.cpp",
diff --git a/audio/aidl/default/Configuration.cpp b/audio/aidl/default/Configuration.cpp
index 6d5357b..854c7f3 100644
--- a/audio/aidl/default/Configuration.cpp
+++ b/audio/aidl/default/Configuration.cpp
@@ -76,6 +76,11 @@
                                     std::string connection = "") {
     AudioPortDeviceExt deviceExt;
     deviceExt.device.type.type = devType;
+    if (devType == AudioDeviceType::IN_MICROPHONE && connection.empty()) {
+        deviceExt.device.address = "bottom";
+    } else if (devType == AudioDeviceType::IN_MICROPHONE_BACK && connection.empty()) {
+        deviceExt.device.address = "back";
+    }
     deviceExt.device.type.connection = std::move(connection);
     deviceExt.flags = flags;
     return AudioPortExt::make<AudioPortExt::Tag::device>(deviceExt);
@@ -393,4 +398,73 @@
     return std::make_unique<Configuration>(configuration);
 }
 
+// Usb configuration:
+//
+// Device ports:
+//  * "USB Headset Out", OUT_HEADSET, CONNECTION_USB
+//    - no profiles specified
+//  * "USB Headset In", IN_HEADSET, CONNECTION_USB
+//    - no profiles specified
+//
+// Mix ports:
+//  * "usb_headset output", 1 max open, 1 max active stream
+//    - no profiles specified
+//  * "usb_headset input", 1 max open, 1 max active stream
+//    - no profiles specified
+//
+// Profiles for device port connected state:
+//  * USB Headset Out":
+//    - profile PCM 16-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//    - profile PCM 24-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//  * USB Headset In":
+//    - profile PCM 16-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//    - profile PCM 24-bit; MONO, STEREO, INDEX_MASK_1, INDEX_MASK_2; 44100, 48000
+//
+std::unique_ptr<Configuration> getUsbConfiguration() {
+    static const Configuration configuration = []() {
+        const std::vector<AudioProfile> standardPcmAudioProfiles = {
+                createProfile(PcmType::INT_16_BIT,
+                              {AudioChannelLayout::LAYOUT_MONO, AudioChannelLayout::LAYOUT_STEREO,
+                               AudioChannelLayout::INDEX_MASK_1, AudioChannelLayout::INDEX_MASK_2},
+                              {44100, 48000}),
+                createProfile(PcmType::INT_24_BIT,
+                              {AudioChannelLayout::LAYOUT_MONO, AudioChannelLayout::LAYOUT_STEREO,
+                               AudioChannelLayout::INDEX_MASK_1, AudioChannelLayout::INDEX_MASK_2},
+                              {44100, 48000})};
+        Configuration c;
+
+        // Device ports
+
+        AudioPort usbOutHeadset =
+                createPort(c.nextPortId++, "USB Headset Out", 0, false,
+                           createDeviceExt(AudioDeviceType::OUT_HEADSET, 0,
+                                           AudioDeviceDescription::CONNECTION_USB));
+        c.ports.push_back(usbOutHeadset);
+        c.connectedProfiles[usbOutHeadset.id] = standardPcmAudioProfiles;
+
+        AudioPort usbInHeadset =
+                createPort(c.nextPortId++, "USB Headset In", 0, true,
+                           createDeviceExt(AudioDeviceType::IN_HEADSET, 0,
+                                           AudioDeviceDescription::CONNECTION_USB));
+        c.ports.push_back(usbInHeadset);
+        c.connectedProfiles[usbInHeadset.id] = standardPcmAudioProfiles;
+
+        // Mix ports
+
+        AudioPort usbHeadsetOutMix =
+                createPort(c.nextPortId++, "usb_headset output", 0, false, createPortMixExt(1, 1));
+        c.ports.push_back(usbHeadsetOutMix);
+
+        AudioPort usbHeadsetInMix =
+                createPort(c.nextPortId++, "usb_headset input", 0, true, createPortMixExt(1, 1));
+        c.ports.push_back(usbHeadsetInMix);
+
+        c.routes.push_back(createRoute({usbHeadsetOutMix}, usbOutHeadset));
+        c.routes.push_back(createRoute({usbInHeadset}, usbHeadsetInMix));
+
+        return c;
+    }();
+    return std::make_unique<Configuration>(configuration);
+}
+
 }  // namespace aidl::android::hardware::audio::core::internal
diff --git a/audio/aidl/default/EffectConfig.cpp b/audio/aidl/default/EffectConfig.cpp
index e1427ec..c030b7a 100644
--- a/audio/aidl/default/EffectConfig.cpp
+++ b/audio/aidl/default/EffectConfig.cpp
@@ -79,14 +79,30 @@
     return children;
 }
 
+bool EffectConfig::resolveLibrary(const std::string& path, std::string* resolvedPath) {
+    for (auto* libraryDirectory : kEffectLibPath) {
+        std::string candidatePath = std::string(libraryDirectory) + '/' + path;
+        if (access(candidatePath.c_str(), R_OK) == 0) {
+            *resolvedPath = std::move(candidatePath);
+            return true;
+        }
+    }
+    return false;
+}
+
 bool EffectConfig::parseLibrary(const tinyxml2::XMLElement& xml) {
     const char* name = xml.Attribute("name");
     RETURN_VALUE_IF(!name, false, "noNameAttribute");
     const char* path = xml.Attribute("path");
     RETURN_VALUE_IF(!path, false, "noPathAttribute");
 
-    mLibraryMap[name] = path;
-    LOG(DEBUG) << __func__ << " " << name << " : " << path;
+    std::string resolvedPath;
+    if (!resolveLibrary(path, &resolvedPath)) {
+        LOG(ERROR) << __func__ << " can't find " << path;
+        return false;
+    }
+    mLibraryMap[name] = resolvedPath;
+    LOG(DEBUG) << __func__ << " " << name << " : " << resolvedPath;
     return true;
 }
 
diff --git a/audio/aidl/default/EffectFactory.cpp b/audio/aidl/default/EffectFactory.cpp
index 5cd87fd..638fa7f 100644
--- a/audio/aidl/default/EffectFactory.cpp
+++ b/audio/aidl/default/EffectFactory.cpp
@@ -165,7 +165,7 @@
     return status;
 }
 
-bool Factory::openEffectLibrary(const AudioUuid& impl, const std::string& libName) {
+bool Factory::openEffectLibrary(const AudioUuid& impl, const std::string& path) {
     std::function<void(void*)> dlClose = [](void* handle) -> void {
         if (handle && dlclose(handle)) {
             LOG(ERROR) << "dlclose failed " << dlerror();
@@ -173,19 +173,19 @@
     };
 
     auto libHandle =
-            std::unique_ptr<void, decltype(dlClose)>{dlopen(libName.c_str(), RTLD_LAZY), dlClose};
+            std::unique_ptr<void, decltype(dlClose)>{dlopen(path.c_str(), RTLD_LAZY), dlClose};
     if (!libHandle) {
         LOG(ERROR) << __func__ << ": dlopen failed, err: " << dlerror();
         return false;
     }
 
-    LOG(INFO) << __func__ << " dlopen lib:" << libName << "\nimpl:" << impl.toString()
+    LOG(INFO) << __func__ << " dlopen lib:" << path << "\nimpl:" << impl.toString()
               << "\nhandle:" << libHandle;
     auto interface = new effect_dl_interface_s{nullptr, nullptr, nullptr};
     mEffectLibMap.insert(
             {impl,
              std::make_tuple(std::move(libHandle),
-                             std::unique_ptr<struct effect_dl_interface_s>(interface), libName)});
+                             std::unique_ptr<struct effect_dl_interface_s>(interface), path)});
     return true;
 }
 
@@ -199,8 +199,8 @@
         id.type = typeUuid;
         id.uuid = configLib.uuid;
         id.proxy = proxyUuid;
-        LOG(DEBUG) << __func__ << ": typeUuid " << id.type.toString() << "\nimplUuid "
-                   << id.uuid.toString() << " proxyUuid "
+        LOG(DEBUG) << __func__ << " loading lib " << path->second << ": typeUuid "
+                   << id.type.toString() << "\nimplUuid " << id.uuid.toString() << " proxyUuid "
                    << (proxyUuid.has_value() ? proxyUuid->toString() : "null");
         if (openEffectLibrary(id.uuid, path->second)) {
             mIdentitySet.insert(std::move(id));
diff --git a/audio/aidl/default/EffectImpl.cpp b/audio/aidl/default/EffectImpl.cpp
index b24ca63..403a4b9 100644
--- a/audio/aidl/default/EffectImpl.cpp
+++ b/audio/aidl/default/EffectImpl.cpp
@@ -49,7 +49,6 @@
     auto context = createContext(common);
     RETURN_IF(!context, EX_NULL_POINTER, "createContextFailed");
 
-    RETURN_IF_ASTATUS_NOT_OK(setParameterCommon(common), "setCommParamErr");
     if (specific.has_value()) {
         RETURN_IF_ASTATUS_NOT_OK(setParameterSpecific(specific.value()), "setSpecParamErr");
     }
diff --git a/audio/aidl/default/EffectThread.cpp b/audio/aidl/default/EffectThread.cpp
index 2b3513d..024c0ea 100644
--- a/audio/aidl/default/EffectThread.cpp
+++ b/audio/aidl/default/EffectThread.cpp
@@ -70,26 +70,14 @@
 }
 
 RetCode EffectThread::startThread() {
-    if (!mThread.joinable()) {
-        LOG(ERROR) << __func__ << " thread already destroyed";
-        return RetCode::ERROR_THREAD;
-    }
-
-    {
-        std::lock_guard lg(mThreadMutex);
-        if (!mStop) {
-            LOG(WARNING) << __func__ << " already start";
-            return RetCode::SUCCESS;
-        }
-        mStop = false;
-    }
-
-    mCv.notify_one();
-    LOG(DEBUG) << __func__ << " done";
-    return RetCode::SUCCESS;
+    return handleStartStop(false /* stop */);
 }
 
 RetCode EffectThread::stopThread() {
+    return handleStartStop(true /* stop */);
+}
+
+RetCode EffectThread::handleStartStop(bool stop) {
     if (!mThread.joinable()) {
         LOG(ERROR) << __func__ << " thread already destroyed";
         return RetCode::ERROR_THREAD;
@@ -97,13 +85,15 @@
 
     {
         std::lock_guard lg(mThreadMutex);
-        if (mStop) {
-            LOG(WARNING) << __func__ << " already stop";
+        if (stop == mStop) {
+            LOG(WARNING) << __func__ << " already " << (stop ? "stop" : "start");
             return RetCode::SUCCESS;
         }
-        mStop = true;
+        mStop = stop;
     }
-    LOG(DEBUG) << __func__ << " done";
+
+    mCv.notify_one();
+    LOG(DEBUG) << (stop ? "stop done" : "start done");
     return RetCode::SUCCESS;
 }
 
@@ -111,34 +101,23 @@
     pthread_setname_np(pthread_self(), mName.substr(0, kMaxTaskNameLen - 1).c_str());
     setpriority(PRIO_PROCESS, 0, mPriority);
     while (true) {
-        bool needExit = false;
-        {
-            std::unique_lock l(mThreadMutex);
-            mCv.wait(l, [&]() REQUIRES(mThreadMutex) {
-                needExit = mExit;
-                return mExit || !mStop;
-            });
-        }
-        if (needExit) {
+        std::unique_lock l(mThreadMutex);
+        ::android::base::ScopedLockAssertion lock_assertion(mThreadMutex);
+        mCv.wait(l, [&]() REQUIRES(mThreadMutex) { return mExit || !mStop; });
+        if (mExit) {
             LOG(WARNING) << __func__ << " EXIT!";
             return;
         }
-
-        process();
+        process_l();
     }
 }
 
-void EffectThread::process() {
-    std::shared_ptr<EffectContext> context;
-    {
-        std::lock_guard lg(mThreadMutex);
-        context = mThreadContext;
-        RETURN_VALUE_IF(!context, void(), "nullContext");
-    }
-    std::shared_ptr<EffectContext::StatusMQ> statusMQ = context->getStatusFmq();
-    std::shared_ptr<EffectContext::DataMQ> inputMQ = context->getInputDataFmq();
-    std::shared_ptr<EffectContext::DataMQ> outputMQ = context->getOutputDataFmq();
-    auto buffer = context->getWorkBuffer();
+void EffectThread::process_l() {
+    RETURN_VALUE_IF(!mThreadContext, void(), "nullContext");
+    std::shared_ptr<EffectContext::StatusMQ> statusMQ = mThreadContext->getStatusFmq();
+    std::shared_ptr<EffectContext::DataMQ> inputMQ = mThreadContext->getInputDataFmq();
+    std::shared_ptr<EffectContext::DataMQ> outputMQ = mThreadContext->getOutputDataFmq();
+    auto buffer = mThreadContext->getWorkBuffer();
 
     // Only this worker will read from input data MQ and write to output data MQ.
     auto readSamples = inputMQ->availableToRead(), writeSamples = outputMQ->availableToWrite();
@@ -149,7 +128,6 @@
 
         inputMQ->read(buffer, processSamples);
 
-        // call effectProcessImpl without lock
         IEffect::Status status = effectProcessImpl(buffer, buffer, processSamples);
         outputMQ->write(buffer, status.fmqProduced);
         statusMQ->writeBlocking(&status, 1);
diff --git a/audio/aidl/default/Module.cpp b/audio/aidl/default/Module.cpp
index acad70f..2f6ab2f 100644
--- a/audio/aidl/default/Module.cpp
+++ b/audio/aidl/default/Module.cpp
@@ -27,8 +27,10 @@
 
 #include "core-impl/Bluetooth.h"
 #include "core-impl/Module.h"
+#include "core-impl/ModuleUsb.h"
 #include "core-impl/SoundDose.h"
 #include "core-impl/StreamStub.h"
+#include "core-impl/StreamUsb.h"
 #include "core-impl/Telephony.h"
 #include "core-impl/utils.h"
 
@@ -41,6 +43,10 @@
 using aidl::android::media::audio::common::AudioFormatType;
 using aidl::android::media::audio::common::AudioInputFlags;
 using aidl::android::media::audio::common::AudioIoFlags;
+using aidl::android::media::audio::common::AudioMMapPolicy;
+using aidl::android::media::audio::common::AudioMMapPolicyInfo;
+using aidl::android::media::audio::common::AudioMMapPolicyType;
+using aidl::android::media::audio::common::AudioMode;
 using aidl::android::media::audio::common::AudioOffloadInfo;
 using aidl::android::media::audio::common::AudioOutputFlags;
 using aidl::android::media::audio::common::AudioPort;
@@ -52,6 +58,7 @@
 using aidl::android::media::audio::common::PcmType;
 using android::hardware::audio::common::getFrameSizeInBytes;
 using android::hardware::audio::common::isBitPositionFlagSet;
+using android::hardware::audio::common::isValidAudioMode;
 
 namespace aidl::android::hardware::audio::core {
 
@@ -99,6 +106,42 @@
 
 }  // namespace
 
+// static
+std::shared_ptr<Module> Module::createInstance(Type type) {
+    switch (type) {
+        case Module::Type::USB:
+            return ndk::SharedRefBase::make<ModuleUsb>(type);
+        case Type::DEFAULT:
+        case Type::R_SUBMIX:
+        default:
+            return ndk::SharedRefBase::make<Module>(type);
+    }
+}
+
+// static
+StreamIn::CreateInstance Module::getStreamInCreator(Type type) {
+    switch (type) {
+        case Type::USB:
+            return StreamInUsb::createInstance;
+        case Type::DEFAULT:
+        case Type::R_SUBMIX:
+        default:
+            return StreamInStub::createInstance;
+    }
+}
+
+// static
+StreamOut::CreateInstance Module::getStreamOutCreator(Type type) {
+    switch (type) {
+        case Type::USB:
+            return StreamOutUsb::createInstance;
+        case Type::DEFAULT:
+        case Type::R_SUBMIX:
+        default:
+            return StreamOutStub::createInstance;
+    }
+}
+
 void Module::cleanUpPatch(int32_t patchId) {
     erase_all_values(mPatches, std::set<int32_t>{patchId});
 }
@@ -148,6 +191,7 @@
                 std::make_unique<StreamContext::CommandMQ>(1, true /*configureEventFlagWord*/),
                 std::make_unique<StreamContext::ReplyMQ>(1, true /*configureEventFlagWord*/),
                 portConfigIt->format.value(), portConfigIt->channelMask.value(),
+                portConfigIt->sampleRate.value().value,
                 std::make_unique<StreamContext::DataMQ>(frameSize * in_bufferSizeFrames),
                 asyncCallback, outEventCallback, params);
         if (temp.isValid()) {
@@ -254,6 +298,9 @@
             case Type::R_SUBMIX:
                 mConfig = std::move(internal::getRSubmixConfiguration());
                 break;
+            case Type::USB:
+                mConfig = std::move(internal::getUsbConfiguration());
+                break;
         }
     }
     return *mConfig;
@@ -394,6 +441,8 @@
     if (!mDebug.simulateDeviceConnections) {
         // In a real HAL here we would attempt querying the profiles from the device.
         LOG(ERROR) << __func__ << ": failed to query supported device profiles";
+        // TODO: Check the return value when it is ready for actual devices.
+        populateConnectedDevicePort(&connectedPort);
         return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
     }
 
@@ -553,10 +602,9 @@
     }
     context.fillDescriptor(&_aidl_return->desc);
     std::shared_ptr<StreamIn> stream;
-    // TODO: Add a mapping from module instance names to a corresponding 'createInstance'.
-    if (auto status = StreamInStub::createInstance(in_args.sinkMetadata, std::move(context),
-                                                   mConfig->microphones, &stream);
-        !status.isOk()) {
+    ndk::ScopedAStatus status = getStreamInCreator(mType)(in_args.sinkMetadata, std::move(context),
+                                                          mConfig->microphones, &stream);
+    if (!status.isOk()) {
         return status;
     }
     StreamWrapper streamWrapper(stream);
@@ -608,10 +656,9 @@
     }
     context.fillDescriptor(&_aidl_return->desc);
     std::shared_ptr<StreamOut> stream;
-    // TODO: Add a mapping from module instance names to a corresponding 'createInstance'.
-    if (auto status = StreamOutStub::createInstance(in_args.sourceMetadata, std::move(context),
-                                                    in_args.offloadInfo, &stream);
-        !status.isOk()) {
+    ndk::ScopedAStatus status = getStreamOutCreator(mType)(
+            in_args.sourceMetadata, std::move(context), in_args.offloadInfo, &stream);
+    if (!status.isOk()) {
         return status;
     }
     StreamWrapper streamWrapper(stream);
@@ -689,6 +736,10 @@
         }
     }
 
+    if (auto status = checkAudioPatchEndpointsMatch(sources, sinks); !status.isOk()) {
+        return status;
+    }
+
     auto& patches = getConfig().patches;
     auto existing = patches.end();
     std::optional<decltype(mPatches)> patchesBackup;
@@ -946,12 +997,16 @@
 }
 
 ndk::ScopedAStatus Module::getMicrophones(std::vector<MicrophoneInfo>* _aidl_return) {
-    *_aidl_return = mConfig->microphones;
+    *_aidl_return = getConfig().microphones;
     LOG(DEBUG) << __func__ << ": returning " << ::android::internal::ToString(*_aidl_return);
     return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus Module::updateAudioMode(AudioMode in_mode) {
+    if (!isValidAudioMode(in_mode)) {
+        LOG(ERROR) << __func__ << ": invalid mode " << toString(in_mode);
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
     // No checks for supported audio modes here, it's an informative notification.
     LOG(DEBUG) << __func__ << ": " << toString(in_mode);
     return ndk::ScopedAStatus::ok();
@@ -1074,4 +1129,121 @@
     return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
 }
 
+ndk::ScopedAStatus Module::getMmapPolicyInfos(AudioMMapPolicyType mmapPolicyType,
+                                              std::vector<AudioMMapPolicyInfo>* _aidl_return) {
+    LOG(DEBUG) << __func__ << ": mmap policy type " << toString(mmapPolicyType);
+    std::set<int32_t> mmapSinks;
+    std::set<int32_t> mmapSources;
+    auto& ports = getConfig().ports;
+    for (const auto& port : ports) {
+        if (port.flags.getTag() == AudioIoFlags::Tag::input &&
+            isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::input>(),
+                                 AudioInputFlags::MMAP_NOIRQ)) {
+            mmapSinks.insert(port.id);
+        } else if (port.flags.getTag() == AudioIoFlags::Tag::output &&
+                   isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
+                                        AudioOutputFlags::MMAP_NOIRQ)) {
+            mmapSources.insert(port.id);
+        }
+    }
+    for (const auto& route : getConfig().routes) {
+        if (mmapSinks.count(route.sinkPortId) != 0) {
+            // The sink is a mix port, add the sources if they are device ports.
+            for (int sourcePortId : route.sourcePortIds) {
+                auto sourcePortIt = findById<AudioPort>(ports, sourcePortId);
+                if (sourcePortIt == ports.end()) {
+                    // This must not happen
+                    LOG(ERROR) << __func__ << ": port id " << sourcePortId << " cannot be found";
+                    continue;
+                }
+                if (sourcePortIt->ext.getTag() != AudioPortExt::Tag::device) {
+                    // The source is not a device port, skip
+                    continue;
+                }
+                AudioMMapPolicyInfo policyInfo;
+                policyInfo.device = sourcePortIt->ext.get<AudioPortExt::Tag::device>().device;
+                // Always return AudioMMapPolicy.AUTO if the device supports mmap for
+                // default implementation.
+                policyInfo.mmapPolicy = AudioMMapPolicy::AUTO;
+                _aidl_return->push_back(policyInfo);
+            }
+        } else {
+            auto sinkPortIt = findById<AudioPort>(ports, route.sinkPortId);
+            if (sinkPortIt == ports.end()) {
+                // This must not happen
+                LOG(ERROR) << __func__ << ": port id " << route.sinkPortId << " cannot be found";
+                continue;
+            }
+            if (sinkPortIt->ext.getTag() != AudioPortExt::Tag::device) {
+                // The sink is not a device port, skip
+                continue;
+            }
+            if (count_any(mmapSources, route.sourcePortIds)) {
+                AudioMMapPolicyInfo policyInfo;
+                policyInfo.device = sinkPortIt->ext.get<AudioPortExt::Tag::device>().device;
+                // Always return AudioMMapPolicy.AUTO if the device supports mmap for
+                // default implementation.
+                policyInfo.mmapPolicy = AudioMMapPolicy::AUTO;
+                _aidl_return->push_back(policyInfo);
+            }
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::supportsVariableLatency(bool* _aidl_return) {
+    LOG(DEBUG) << __func__;
+    *_aidl_return = false;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::getAAudioMixerBurstCount(int32_t* _aidl_return) {
+    if (!isMmapSupported()) {
+        LOG(DEBUG) << __func__ << ": mmap is not supported ";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    *_aidl_return = DEFAULT_AAUDIO_MIXER_BURST_COUNT;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::getAAudioHardwareBurstMinUsec(int32_t* _aidl_return) {
+    if (!isMmapSupported()) {
+        LOG(DEBUG) << __func__ << ": mmap is not supported ";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+    }
+    *_aidl_return = DEFAULT_AAUDIO_HARDWARE_BURST_MIN_DURATION_US;
+    LOG(DEBUG) << __func__ << ": returning " << *_aidl_return;
+    return ndk::ScopedAStatus::ok();
+}
+
+bool Module::isMmapSupported() {
+    if (mIsMmapSupported.has_value()) {
+        return mIsMmapSupported.value();
+    }
+    std::vector<AudioMMapPolicyInfo> mmapPolicyInfos;
+    if (!getMmapPolicyInfos(AudioMMapPolicyType::DEFAULT, &mmapPolicyInfos).isOk()) {
+        mIsMmapSupported = false;
+    } else {
+        mIsMmapSupported =
+                std::find_if(mmapPolicyInfos.begin(), mmapPolicyInfos.end(), [](const auto& info) {
+                    return info.mmapPolicy == AudioMMapPolicy::AUTO ||
+                           info.mmapPolicy == AudioMMapPolicy::ALWAYS;
+                }) != mmapPolicyInfos.end();
+    }
+    return mIsMmapSupported.value();
+}
+
+ndk::ScopedAStatus Module::populateConnectedDevicePort(AudioPort* audioPort __unused) {
+    LOG(DEBUG) << __func__ << ": do nothing and return ok";
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Module::checkAudioPatchEndpointsMatch(
+        const std::vector<AudioPortConfig*>& sources __unused,
+        const std::vector<AudioPortConfig*>& sinks __unused) {
+    LOG(DEBUG) << __func__ << ": do nothing and return ok";
+    return ndk::ScopedAStatus::ok();
+}
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/Stream.cpp b/audio/aidl/default/Stream.cpp
index 25814e4..d62ca1d 100644
--- a/audio/aidl/default/Stream.cpp
+++ b/audio/aidl/default/Stream.cpp
@@ -135,10 +135,16 @@
         mState = StreamDescriptor::State::ERROR;
         return Status::ABORT;
     }
-    LOG(DEBUG) << __func__ << ": received command " << command.toString() << " in " << kThreadName;
+    using Tag = StreamDescriptor::Command::Tag;
+    using LogSeverity = ::android::base::LogSeverity;
+    const LogSeverity severity =
+            command.getTag() == Tag::burst || command.getTag() == Tag::getStatus
+                    ? LogSeverity::VERBOSE
+                    : LogSeverity::DEBUG;
+    LOG(severity) << __func__ << ": received command " << command.toString() << " in "
+                  << kThreadName;
     StreamDescriptor::Reply reply{};
     reply.status = STATUS_BAD_VALUE;
-    using Tag = StreamDescriptor::Command::Tag;
     switch (command.getTag()) {
         case Tag::halReservedExit:
             if (const int32_t cookie = command.get<Tag::halReservedExit>();
@@ -166,8 +172,8 @@
             break;
         case Tag::burst:
             if (const int32_t fmqByteCount = command.get<Tag::burst>(); fmqByteCount >= 0) {
-                LOG(DEBUG) << __func__ << ": '" << toString(command.getTag()) << "' command for "
-                           << fmqByteCount << " bytes";
+                LOG(VERBOSE) << __func__ << ": '" << toString(command.getTag()) << "' command for "
+                             << fmqByteCount << " bytes";
                 if (mState == StreamDescriptor::State::IDLE ||
                     mState == StreamDescriptor::State::ACTIVE ||
                     mState == StreamDescriptor::State::PAUSED ||
@@ -253,7 +259,7 @@
             break;
     }
     reply.state = mState;
-    LOG(DEBUG) << __func__ << ": writing reply " << reply.toString();
+    LOG(severity) << __func__ << ": writing reply " << reply.toString();
     if (!mReplyMQ->writeBlocking(&reply, 1)) {
         LOG(ERROR) << __func__ << ": writing of reply " << reply.toString() << " to MQ failed";
         mState = StreamDescriptor::State::ERROR;
@@ -284,8 +290,8 @@
     if (bool success =
                 actualByteCount > 0 ? mDataMQ->write(&mDataBuffer[0], actualByteCount) : true;
         success) {
-        LOG(DEBUG) << __func__ << ": writing of " << actualByteCount << " bytes into data MQ"
-                   << " succeeded; connected? " << isConnected;
+        LOG(VERBOSE) << __func__ << ": writing of " << actualByteCount << " bytes into data MQ"
+                     << " succeeded; connected? " << isConnected;
         // Frames are provided and counted regardless of connection status.
         reply->fmqByteCount += actualByteCount;
         mFrameCount += actualFrameCount;
@@ -340,7 +346,14 @@
         mState = StreamDescriptor::State::ERROR;
         return Status::ABORT;
     }
-    LOG(DEBUG) << __func__ << ": received command " << command.toString() << " in " << kThreadName;
+    using Tag = StreamDescriptor::Command::Tag;
+    using LogSeverity = ::android::base::LogSeverity;
+    const LogSeverity severity =
+            command.getTag() == Tag::burst || command.getTag() == Tag::getStatus
+                    ? LogSeverity::VERBOSE
+                    : LogSeverity::DEBUG;
+    LOG(severity) << __func__ << ": received command " << command.toString() << " in "
+                  << kThreadName;
     StreamDescriptor::Reply reply{};
     reply.status = STATUS_BAD_VALUE;
     using Tag = StreamDescriptor::Command::Tag;
@@ -383,8 +396,8 @@
         } break;
         case Tag::burst:
             if (const int32_t fmqByteCount = command.get<Tag::burst>(); fmqByteCount >= 0) {
-                LOG(DEBUG) << __func__ << ": '" << toString(command.getTag()) << "' command for "
-                           << fmqByteCount << " bytes";
+                LOG(VERBOSE) << __func__ << ": '" << toString(command.getTag()) << "' command for "
+                             << fmqByteCount << " bytes";
                 if (mState != StreamDescriptor::State::ERROR &&
                     mState != StreamDescriptor::State::TRANSFERRING &&
                     mState != StreamDescriptor::State::TRANSFER_PAUSED) {
@@ -499,7 +512,7 @@
             break;
     }
     reply.state = mState;
-    LOG(DEBUG) << __func__ << ": writing reply " << reply.toString();
+    LOG(severity) << __func__ << ": writing reply " << reply.toString();
     if (!mReplyMQ->writeBlocking(&reply, 1)) {
         LOG(ERROR) << __func__ << ": writing of reply " << reply.toString() << " to MQ failed";
         mState = StreamDescriptor::State::ERROR;
@@ -514,8 +527,8 @@
     int32_t latency = Module::kLatencyMs;
     if (bool success = readByteCount > 0 ? mDataMQ->read(&mDataBuffer[0], readByteCount) : true) {
         const bool isConnected = mIsConnected;
-        LOG(DEBUG) << __func__ << ": reading of " << readByteCount << " bytes from data MQ"
-                   << " succeeded; connected? " << isConnected;
+        LOG(VERBOSE) << __func__ << ": reading of " << readByteCount << " bytes from data MQ"
+                     << " succeeded; connected? " << isConnected;
         // Amount of data that the HAL module is going to actually use.
         size_t byteCount = std::min({clientSize, readByteCount, mDataBufferSize});
         if (byteCount >= mFrameSize && mForceTransientBurst) {
diff --git a/audio/aidl/default/StreamStub.cpp b/audio/aidl/default/StreamStub.cpp
index 5442179..85d1e16 100644
--- a/audio/aidl/default/StreamStub.cpp
+++ b/audio/aidl/default/StreamStub.cpp
@@ -22,6 +22,7 @@
 
 using aidl::android::hardware::audio::common::SinkMetadata;
 using aidl::android::hardware::audio::common::SourceMetadata;
+using aidl::android::media::audio::common::AudioDevice;
 using aidl::android::media::audio::common::AudioOffloadInfo;
 
 namespace aidl::android::hardware::audio::core {
@@ -68,6 +69,11 @@
     return ::android::OK;
 }
 
+::android::status_t DriverStub::setConnectedDevices(
+        const std::vector<AudioDevice>& connectedDevices __unused) {
+    return ::android::OK;
+}
+
 // static
 ndk::ScopedAStatus StreamInStub::createInstance(const SinkMetadata& sinkMetadata,
                                                 StreamContext&& context,
diff --git a/audio/aidl/default/Telephony.cpp b/audio/aidl/default/Telephony.cpp
index d873178..ad22470 100644
--- a/audio/aidl/default/Telephony.cpp
+++ b/audio/aidl/default/Telephony.cpp
@@ -14,14 +14,18 @@
  * limitations under the License.
  */
 
-#include <android/binder_to_string.h>
 #define LOG_TAG "AHAL_Telephony"
 #include <android-base/logging.h>
 
+#include <Utils.h>
+#include <android/binder_to_string.h>
+
 #include "core-impl/Telephony.h"
 
+using aidl::android::media::audio::common::AudioMode;
 using aidl::android::media::audio::common::Boolean;
 using aidl::android::media::audio::common::Float;
+using android::hardware::audio::common::isValidAudioMode;
 
 namespace aidl::android::hardware::audio::core {
 
@@ -38,6 +42,10 @@
 }
 
 ndk::ScopedAStatus Telephony::switchAudioMode(AudioMode in_mode) {
+    if (!isValidAudioMode(in_mode)) {
+        LOG(ERROR) << __func__ << ": invalid mode " << toString(in_mode);
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
     if (std::find(mSupportedAudioModes.begin(), mSupportedAudioModes.end(), in_mode) !=
         mSupportedAudioModes.end()) {
         LOG(DEBUG) << __func__ << ": " << toString(in_mode);
diff --git a/audio/aidl/default/acousticEchoCanceler/Android.bp b/audio/aidl/default/acousticEchoCanceler/Android.bp
index b2e2682..bfb7212 100644
--- a/audio/aidl/default/acousticEchoCanceler/Android.bp
+++ b/audio/aidl/default/acousticEchoCanceler/Android.bp
@@ -34,6 +34,7 @@
         "AcousticEchoCancelerSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/android.hardware.audio.service-aidl.xml b/audio/aidl/default/android.hardware.audio.service-aidl.xml
index 46b665f..9636a58 100644
--- a/audio/aidl/default/android.hardware.audio.service-aidl.xml
+++ b/audio/aidl/default/android.hardware.audio.service-aidl.xml
@@ -12,6 +12,11 @@
   <hal format="aidl">
     <name>android.hardware.audio.core</name>
     <version>1</version>
+    <fqname>IModule/usb</fqname>
+  </hal>
+  <hal format="aidl">
+    <name>android.hardware.audio.core</name>
+    <version>1</version>
     <fqname>IConfig/default</fqname>
   </hal>
 </manifest>
diff --git a/audio/aidl/default/automaticGainControl/Android.bp b/audio/aidl/default/automaticGainControl/Android.bp
index 4899b39..17d6416 100644
--- a/audio/aidl/default/automaticGainControl/Android.bp
+++ b/audio/aidl/default/automaticGainControl/Android.bp
@@ -34,6 +34,7 @@
         "AutomaticGainControlSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/bassboost/Android.bp b/audio/aidl/default/bassboost/Android.bp
index f22eb95..82b2f20 100644
--- a/audio/aidl/default/bassboost/Android.bp
+++ b/audio/aidl/default/bassboost/Android.bp
@@ -34,6 +34,7 @@
         "BassBoostSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/downmix/Android.bp b/audio/aidl/default/downmix/Android.bp
index 230b2d8..6d15cdb 100644
--- a/audio/aidl/default/downmix/Android.bp
+++ b/audio/aidl/default/downmix/Android.bp
@@ -34,6 +34,7 @@
         "DownmixSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/dynamicProcessing/Android.bp b/audio/aidl/default/dynamicProcessing/Android.bp
index 3697ba3..1c0312d 100644
--- a/audio/aidl/default/dynamicProcessing/Android.bp
+++ b/audio/aidl/default/dynamicProcessing/Android.bp
@@ -34,6 +34,7 @@
         "DynamicsProcessingSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/envReverb/Android.bp b/audio/aidl/default/envReverb/Android.bp
index c239ee5..dd4219a 100644
--- a/audio/aidl/default/envReverb/Android.bp
+++ b/audio/aidl/default/envReverb/Android.bp
@@ -34,6 +34,7 @@
         "EnvReverbSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/equalizer/Android.bp b/audio/aidl/default/equalizer/Android.bp
index 8de6b1a..3610563 100644
--- a/audio/aidl/default/equalizer/Android.bp
+++ b/audio/aidl/default/equalizer/Android.bp
@@ -34,6 +34,7 @@
         "EqualizerSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/equalizer/EqualizerSw.cpp b/audio/aidl/default/equalizer/EqualizerSw.cpp
index 984b943..0a6ac34 100644
--- a/audio/aidl/default/equalizer/EqualizerSw.cpp
+++ b/audio/aidl/default/equalizer/EqualizerSw.cpp
@@ -150,6 +150,10 @@
             eqParam.set<Equalizer::preset>(mContext->getEqPreset());
             break;
         }
+        case Equalizer::centerFreqMh: {
+            eqParam.set<Equalizer::centerFreqMh>(mContext->getCenterFreqs());
+            break;
+        }
         default: {
             LOG(ERROR) << __func__ << " not handled tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
diff --git a/audio/aidl/default/equalizer/EqualizerSw.h b/audio/aidl/default/equalizer/EqualizerSw.h
index 65a8002..fabcfeb 100644
--- a/audio/aidl/default/equalizer/EqualizerSw.h
+++ b/audio/aidl/default/equalizer/EqualizerSw.h
@@ -68,10 +68,16 @@
         return bandLevels;
     }
 
+    std::vector<int> getCenterFreqs() {
+        return {std::begin(kPresetsFrequencies), std::end(kPresetsFrequencies)};
+    }
+
   private:
     static const int NUM_OF_BANDS = 5;
     static const int NUM_OF_PRESETS = 10;
     static const int PRESET_CUSTOM = -1;
+    static constexpr std::array<uint16_t, NUM_OF_BANDS> kPresetsFrequencies = {60, 230, 910, 3600,
+                                                                               14000};
     // preset band level
     int mPreset = PRESET_CUSTOM;
     int32_t mBandLevels[NUM_OF_BANDS] = {3, 0, 0, 0, 3};
diff --git a/audio/aidl/default/hapticGenerator/Android.bp b/audio/aidl/default/hapticGenerator/Android.bp
index a632130..0df9a94 100644
--- a/audio/aidl/default/hapticGenerator/Android.bp
+++ b/audio/aidl/default/hapticGenerator/Android.bp
@@ -34,6 +34,7 @@
         "HapticGeneratorSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/include/core-impl/Configuration.h b/audio/aidl/default/include/core-impl/Configuration.h
index 3b4c494..1aca1fe 100644
--- a/audio/aidl/default/include/core-impl/Configuration.h
+++ b/audio/aidl/default/include/core-impl/Configuration.h
@@ -44,5 +44,6 @@
 
 std::unique_ptr<Configuration> getPrimaryConfiguration();
 std::unique_ptr<Configuration> getRSubmixConfiguration();
+std::unique_ptr<Configuration> getUsbConfiguration();
 
 }  // namespace aidl::android::hardware::audio::core::internal
diff --git a/audio/aidl/default/include/core-impl/Module.h b/audio/aidl/default/include/core-impl/Module.h
index 9e4499b..fab1c14 100644
--- a/audio/aidl/default/include/core-impl/Module.h
+++ b/audio/aidl/default/include/core-impl/Module.h
@@ -31,10 +31,14 @@
   public:
     // This value is used for all AudioPatches and reported by all streams.
     static constexpr int32_t kLatencyMs = 10;
-    enum Type : int { DEFAULT, R_SUBMIX };
+    enum Type : int { DEFAULT, R_SUBMIX, USB };
 
     explicit Module(Type type) : mType(type) {}
 
+    static std::shared_ptr<Module> createInstance(Type type);
+    static StreamIn::CreateInstance getStreamInCreator(Type type);
+    static StreamOut::CreateInstance getStreamOutCreator(Type type);
+
   private:
     struct VendorDebug {
         static const std::string kForceTransientBurstName;
@@ -92,7 +96,7 @@
     ndk::ScopedAStatus setMicMute(bool in_mute) override;
     ndk::ScopedAStatus getMicrophones(std::vector<MicrophoneInfo>* _aidl_return) override;
     ndk::ScopedAStatus updateAudioMode(
-            ::aidl::android::hardware::audio::core::AudioMode in_mode) override;
+            ::aidl::android::media::audio::common::AudioMode in_mode) override;
     ndk::ScopedAStatus updateScreenRotation(
             ::aidl::android::hardware::audio::core::IModule::ScreenRotation in_rotation) override;
     ndk::ScopedAStatus updateScreenState(bool in_isTurnedOn) override;
@@ -110,6 +114,13 @@
             int32_t in_portConfigId,
             const std::shared_ptr<::aidl::android::hardware::audio::effect::IEffect>& in_effect)
             override;
+    ndk::ScopedAStatus getMmapPolicyInfos(
+            ::aidl::android::media::audio::common::AudioMMapPolicyType mmapPolicyType,
+            std::vector<::aidl::android::media::audio::common::AudioMMapPolicyInfo>* _aidl_return)
+            override;
+    ndk::ScopedAStatus supportsVariableLatency(bool* _aidl_return) override;
+    ndk::ScopedAStatus getAAudioMixerBurstCount(int32_t* _aidl_return) override;
+    ndk::ScopedAStatus getAAudioHardwareBurstMinUsec(int32_t* _aidl_return) override;
 
     void cleanUpPatch(int32_t patchId);
     ndk::ScopedAStatus createStreamContext(
@@ -127,6 +138,7 @@
     std::set<int32_t> portIdsFromPortConfigIds(C portConfigIds);
     void registerPatch(const AudioPatch& patch);
     void updateStreamsConnectedState(const AudioPatch& oldPatch, const AudioPatch& newPatch);
+    bool isMmapSupported();
 
     // This value is used for all AudioPatches.
     static constexpr int32_t kMinimumStreamBufferSizeFrames = 16;
@@ -154,6 +166,18 @@
     bool mMicMute = false;
     std::shared_ptr<sounddose::ISoundDose> mSoundDose;
     ndk::SpAIBinder mSoundDoseBinder;
+    std::optional<bool> mIsMmapSupported;
+
+  protected:
+    // If the module is unable to populate the connected device port correctly, the returned error
+    // code must correspond to the errors of `IModule.connectedExternalDevice` method.
+    virtual ndk::ScopedAStatus populateConnectedDevicePort(
+            ::aidl::android::media::audio::common::AudioPort* audioPort);
+    // If the module finds that the patch endpoints configurations are not matched, the returned
+    // error code must correspond to the errors of `IModule.setAudioPatch` method.
+    virtual ndk::ScopedAStatus checkAudioPatchEndpointsMatch(
+            const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sources,
+            const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sinks);
 };
 
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/ModuleUsb.h b/audio/aidl/default/include/core-impl/ModuleUsb.h
new file mode 100644
index 0000000..7b177e8
--- /dev/null
+++ b/audio/aidl/default/include/core-impl/ModuleUsb.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "core-impl/Module.h"
+
+namespace aidl::android::hardware::audio::core {
+
+class ModuleUsb : public Module {
+  public:
+    explicit ModuleUsb(Module::Type type) : Module(type) {}
+
+  private:
+    // IModule interfaces
+    ndk::ScopedAStatus getTelephony(std::shared_ptr<ITelephony>* _aidl_return) override;
+    ndk::ScopedAStatus getBluetooth(std::shared_ptr<IBluetooth>* _aidl_return) override;
+    ndk::ScopedAStatus getMasterMute(bool* _aidl_return) override;
+    ndk::ScopedAStatus setMasterMute(bool in_mute) override;
+    ndk::ScopedAStatus getMasterVolume(float* _aidl_return) override;
+    ndk::ScopedAStatus setMasterVolume(float in_volume) override;
+    ndk::ScopedAStatus getMicMute(bool* _aidl_return) override;
+    ndk::ScopedAStatus setMicMute(bool in_mute) override;
+
+    // Module interfaces
+    ndk::ScopedAStatus populateConnectedDevicePort(
+            ::aidl::android::media::audio::common::AudioPort* audioPort) override;
+    ndk::ScopedAStatus checkAudioPatchEndpointsMatch(
+            const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sources,
+            const std::vector<::aidl::android::media::audio::common::AudioPortConfig*>& sinks)
+            override;
+};
+
+}  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/Stream.h b/audio/aidl/default/include/core-impl/Stream.h
index 7cd4259..f8c12e6 100644
--- a/audio/aidl/default/include/core-impl/Stream.h
+++ b/audio/aidl/default/include/core-impl/Stream.h
@@ -77,7 +77,8 @@
     StreamContext(std::unique_ptr<CommandMQ> commandMQ, std::unique_ptr<ReplyMQ> replyMQ,
                   const ::aidl::android::media::audio::common::AudioFormatDescription& format,
                   const ::aidl::android::media::audio::common::AudioChannelLayout& channelLayout,
-                  std::unique_ptr<DataMQ> dataMQ, std::shared_ptr<IStreamCallback> asyncCallback,
+                  int sampleRate, std::unique_ptr<DataMQ> dataMQ,
+                  std::shared_ptr<IStreamCallback> asyncCallback,
                   std::shared_ptr<IStreamOutEventCallback> outEventCallback,
                   DebugParameters debugParameters)
         : mCommandMQ(std::move(commandMQ)),
@@ -85,6 +86,7 @@
           mReplyMQ(std::move(replyMQ)),
           mFormat(format),
           mChannelLayout(channelLayout),
+          mSampleRate(sampleRate),
           mDataMQ(std::move(dataMQ)),
           mAsyncCallback(asyncCallback),
           mOutEventCallback(outEventCallback),
@@ -95,6 +97,7 @@
           mReplyMQ(std::move(other.mReplyMQ)),
           mFormat(other.mFormat),
           mChannelLayout(other.mChannelLayout),
+          mSampleRate(other.mSampleRate),
           mDataMQ(std::move(other.mDataMQ)),
           mAsyncCallback(std::move(other.mAsyncCallback)),
           mOutEventCallback(std::move(other.mOutEventCallback)),
@@ -105,6 +108,7 @@
         mReplyMQ = std::move(other.mReplyMQ);
         mFormat = std::move(other.mFormat);
         mChannelLayout = std::move(other.mChannelLayout);
+        mSampleRate = other.mSampleRate;
         mDataMQ = std::move(other.mDataMQ);
         mAsyncCallback = std::move(other.mAsyncCallback);
         mOutEventCallback = std::move(other.mOutEventCallback);
@@ -131,6 +135,7 @@
     }
     ReplyMQ* getReplyMQ() const { return mReplyMQ.get(); }
     int getTransientStateDelayMs() const { return mDebugParameters.transientStateDelayMs; }
+    int getSampleRate() const { return mSampleRate; }
     bool isValid() const;
     void reset();
 
@@ -140,6 +145,7 @@
     std::unique_ptr<ReplyMQ> mReplyMQ;
     ::aidl::android::media::audio::common::AudioFormatDescription mFormat;
     ::aidl::android::media::audio::common::AudioChannelLayout mChannelLayout;
+    int mSampleRate;
     std::unique_ptr<DataMQ> mDataMQ;
     std::shared_ptr<IStreamCallback> mAsyncCallback;
     std::shared_ptr<IStreamOutEventCallback> mOutEventCallback;  // Only used by output streams
@@ -151,6 +157,11 @@
     virtual ~DriverInterface() = default;
     // This function is called once, on the main thread, before starting the worker thread.
     virtual ::android::status_t init() = 0;
+    // This function is called from Binder pool thread. It must be done in a thread-safe manner
+    // if this method and other methods in this interface share data.
+    virtual ::android::status_t setConnectedDevices(
+            const std::vector<::aidl::android::media::audio::common::AudioDevice>&
+                    connectedDevices) = 0;
     // All the functions below are called on the worker thread.
     virtual ::android::status_t drain(StreamDescriptor::DrainMode mode) = 0;
     virtual ::android::status_t flush() = 0;
@@ -370,6 +381,7 @@
             const std::vector<::aidl::android::media::audio::common::AudioDevice>& devices) {
         mWorker->setIsConnected(!devices.empty());
         mConnectedDevices = devices;
+        mDriver->setConnectedDevices(devices);
     }
     ndk::ScopedAStatus updateMetadata(const Metadata& metadata);
 
diff --git a/audio/aidl/default/include/core-impl/StreamStub.h b/audio/aidl/default/include/core-impl/StreamStub.h
index 98a062a..aea9da5 100644
--- a/audio/aidl/default/include/core-impl/StreamStub.h
+++ b/audio/aidl/default/include/core-impl/StreamStub.h
@@ -24,6 +24,9 @@
   public:
     DriverStub(const StreamContext& context, bool isInput);
     ::android::status_t init() override;
+    ::android::status_t setConnectedDevices(
+            const std::vector<::aidl::android::media::audio::common::AudioDevice>& connectedDevices)
+            override;
     ::android::status_t drain(StreamDescriptor::DrainMode) override;
     ::android::status_t flush() override;
     ::android::status_t pause() override;
diff --git a/audio/aidl/default/include/core-impl/StreamUsb.h b/audio/aidl/default/include/core-impl/StreamUsb.h
new file mode 100644
index 0000000..8ac1f34
--- /dev/null
+++ b/audio/aidl/default/include/core-impl/StreamUsb.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <mutex>
+
+#include <aidl/android/media/audio/common/AudioChannelLayout.h>
+
+#include "core-impl/Stream.h"
+
+extern "C" {
+#include <tinyalsa/pcm.h>
+#include "alsa_device_proxy.h"
+}
+
+namespace aidl::android::hardware::audio::core {
+
+class DriverUsb : public DriverInterface {
+  public:
+    DriverUsb(const StreamContext& context, bool isInput);
+    ::android::status_t init() override;
+    ::android::status_t setConnectedDevices(
+            const std::vector<::aidl::android::media::audio::common::AudioDevice>& connectedDevices)
+            override;
+    ::android::status_t drain(StreamDescriptor::DrainMode) override;
+    ::android::status_t flush() override;
+    ::android::status_t pause() override;
+    ::android::status_t transfer(void* buffer, size_t frameCount, size_t* actualFrameCount,
+                                 int32_t* latencyMs) override;
+    ::android::status_t standby() override;
+
+  private:
+    ::android::status_t exitStandby();
+
+    std::mutex mLock;
+
+    const size_t mFrameSizeBytes;
+    std::optional<struct pcm_config> mConfig;
+    const bool mIsInput;
+    // Cached device addresses for connected devices.
+    std::vector<::aidl::android::media::audio::common::AudioDeviceAddress> mConnectedDevices
+            GUARDED_BY(mLock);
+    std::vector<std::shared_ptr<alsa_device_proxy>> mAlsaDeviceProxies GUARDED_BY(mLock);
+    bool mIsStandby = false;
+};
+
+class StreamInUsb final : public StreamIn {
+    ndk::ScopedAStatus getActiveMicrophones(
+            std::vector<MicrophoneDynamicInfo>* _aidl_return) override;
+
+  public:
+    static ndk::ScopedAStatus createInstance(
+            const ::aidl::android::hardware::audio::common::SinkMetadata& sinkMetadata,
+            StreamContext&& context, const std::vector<MicrophoneInfo>& microphones,
+            std::shared_ptr<StreamIn>* result);
+
+  private:
+    friend class ndk::SharedRefBase;
+    StreamInUsb(const ::aidl::android::hardware::audio::common::SinkMetadata& sinkMetadata,
+                StreamContext&& context, const std::vector<MicrophoneInfo>& microphones);
+};
+
+class StreamOutUsb final : public StreamOut {
+  public:
+    static ndk::ScopedAStatus createInstance(
+            const ::aidl::android::hardware::audio::common::SourceMetadata& sourceMetadata,
+            StreamContext&& context,
+            const std::optional<::aidl::android::media::audio::common::AudioOffloadInfo>&
+                    offloadInfo,
+            std::shared_ptr<StreamOut>* result);
+
+  private:
+    friend class ndk::SharedRefBase;
+    StreamOutUsb(const ::aidl::android::hardware::audio::common::SourceMetadata& sourceMetadata,
+                 StreamContext&& context,
+                 const std::optional<::aidl::android::media::audio::common::AudioOffloadInfo>&
+                         offloadInfo);
+};
+
+}  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/core-impl/Telephony.h b/audio/aidl/default/include/core-impl/Telephony.h
index 0936172..0f8e93f 100644
--- a/audio/aidl/default/include/core-impl/Telephony.h
+++ b/audio/aidl/default/include/core-impl/Telephony.h
@@ -27,13 +27,20 @@
     Telephony();
 
   private:
-    ndk::ScopedAStatus getSupportedAudioModes(std::vector<AudioMode>* _aidl_return) override;
-    ndk::ScopedAStatus switchAudioMode(AudioMode in_mode) override;
+    ndk::ScopedAStatus getSupportedAudioModes(
+            std::vector<::aidl::android::media::audio::common::AudioMode>* _aidl_return) override;
+    ndk::ScopedAStatus switchAudioMode(
+            ::aidl::android::media::audio::common::AudioMode in_mode) override;
     ndk::ScopedAStatus setTelecomConfig(const TelecomConfig& in_config,
                                         TelecomConfig* _aidl_return) override;
 
-    const std::vector<AudioMode> mSupportedAudioModes = {::ndk::enum_range<AudioMode>().begin(),
-                                                         ::ndk::enum_range<AudioMode>().end()};
+    const std::vector<::aidl::android::media::audio::common::AudioMode> mSupportedAudioModes = {
+            ::aidl::android::media::audio::common::AudioMode::NORMAL,
+            ::aidl::android::media::audio::common::AudioMode::RINGTONE,
+            ::aidl::android::media::audio::common::AudioMode::IN_CALL,
+            ::aidl::android::media::audio::common::AudioMode::IN_COMMUNICATION,
+            // Omit CALL_SCREEN for a better VTS coverage.
+    };
     TelecomConfig mTelecomConfig;
 };
 
diff --git a/audio/aidl/default/include/core-impl/utils.h b/audio/aidl/default/include/core-impl/utils.h
index 9d06f08..ae33227 100644
--- a/audio/aidl/default/include/core-impl/utils.h
+++ b/audio/aidl/default/include/core-impl/utils.h
@@ -17,6 +17,7 @@
 #pragma once
 
 #include <algorithm>
+#include <map>
 #include <set>
 #include <vector>
 
@@ -101,4 +102,21 @@
     return result;
 }
 
+// Assuming that M is a map whose keys' type is K and values' type is V,
+// return the corresponding value of the given key from the map or default
+// value if the key is not found.
+template <typename M, typename K, typename V>
+auto findValueOrDefault(const M& m, const K& key, V defaultValue) {
+    auto it = m.find(key);
+    return it == m.end() ? defaultValue : it->second;
+}
+
+// Assuming that M is a map whose keys' type is K, return the given key if it
+// is found from the map or default value.
+template <typename M, typename K>
+auto findKeyOrDefault(const M& m, const K& key, K defaultValue) {
+    auto it = m.find(key);
+    return it == m.end() ? defaultValue : key;
+}
+
 }  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/include/effect-impl/EffectContext.h b/audio/aidl/default/include/effect-impl/EffectContext.h
index 7bbf19e..2ab0ade 100644
--- a/audio/aidl/default/include/effect-impl/EffectContext.h
+++ b/audio/aidl/default/include/effect-impl/EffectContext.h
@@ -37,7 +37,6 @@
             DataMQ;
 
     EffectContext(size_t statusDepth, const Parameter::Common& common) {
-        mSessionId = common.session;
         auto& input = common.input;
         auto& output = common.output;
 
@@ -63,6 +62,7 @@
             LOG(ERROR) << __func__ << " created invalid FMQ";
         }
         mWorkBuffer.reserve(std::max(inBufferSizeInFloat, outBufferSizeInFloat));
+        mCommon = common;
     }
     virtual ~EffectContext() {}
 
@@ -88,7 +88,8 @@
     }
     size_t getInputFrameSize() { return mInputFrameSize; }
     size_t getOutputFrameSize() { return mOutputFrameSize; }
-    int getSessionId() { return mSessionId; }
+    int getSessionId() { return mCommon.session; }
+    int getIoHandle() { return mCommon.ioHandle; }
 
     virtual RetCode setOutputDevice(
             const std::vector<aidl::android::media::audio::common::AudioDeviceDescription>&
@@ -96,6 +97,7 @@
         mOutputDevice = device;
         return RetCode::SUCCESS;
     }
+
     virtual std::vector<aidl::android::media::audio::common::AudioDeviceDescription>
     getOutputDevice() {
         return mOutputDevice;
@@ -131,7 +133,6 @@
 
   protected:
     // common parameters
-    int mSessionId = INVALID_AUDIO_SESSION_ID;
     size_t mInputFrameSize;
     size_t mOutputFrameSize;
     Parameter::Common mCommon;
diff --git a/audio/aidl/default/include/effect-impl/EffectThread.h b/audio/aidl/default/include/effect-impl/EffectThread.h
index 4b6cecd..9b1a75b 100644
--- a/audio/aidl/default/include/effect-impl/EffectThread.h
+++ b/audio/aidl/default/include/effect-impl/EffectThread.h
@@ -54,6 +54,9 @@
      * EffectThread will make sure effectProcessImpl only be called after startThread() successful
      * and before stopThread() successful.
      *
+     * effectProcessImpl implementation must not call any EffectThread interface, otherwise it will
+     * cause deadlock.
+     *
      * @param in address of input float buffer.
      * @param out address of output float buffer.
      * @param samples number of samples to process.
@@ -62,16 +65,11 @@
     virtual IEffect::Status effectProcessImpl(float* in, float* out, int samples) = 0;
 
     /**
-     * The default EffectThread::process() implementation doesn't need to lock. It will only
-     * access the FMQ and mWorkBuffer in  EffectContext, since they will only be changed in
-     * EffectImpl IEffect::open() (in this case EffectThread just created and not running yet) and
-     * IEffect::command(CommandId::RESET) (in this case EffectThread already stopped).
-     *
-     * process() call effectProcessImpl for effect processing, and because effectProcessImpl is
-     * implemented by effects, process() must not hold lock before call into effectProcessImpl to
-     * avoid deadlock.
+     * process() call effectProcessImpl() for effect data processing, it is necessary for the
+     * processing to be called under Effect thread mutex mThreadMutex, to avoid the effect state
+     * change before/during data processing, and keep the thread and effect state consistent.
      */
-    virtual void process();
+    virtual void process_l() REQUIRES(mThreadMutex);
 
   private:
     const int kMaxTaskNameLen = 15;
@@ -83,5 +81,7 @@
     std::thread mThread;
     int mPriority;
     std::string mName;
+
+    RetCode handleStartStop(bool stop);
 };
 }  // namespace aidl::android::hardware::audio::effect
diff --git a/audio/aidl/default/include/effectFactory-impl/EffectConfig.h b/audio/aidl/default/include/effectFactory-impl/EffectConfig.h
index 2b904f5..c499811 100644
--- a/audio/aidl/default/include/effectFactory-impl/EffectConfig.h
+++ b/audio/aidl/default/include/effectFactory-impl/EffectConfig.h
@@ -63,6 +63,13 @@
     }
 
   private:
+    static constexpr const char* kEffectLibPath[] =
+#ifdef __LP64__
+            {"/odm/lib64/soundfx", "/vendor/lib64/soundfx", "/system/lib64/soundfx"};
+#else
+            {"/odm/lib/soundfx", "/vendor/lib/soundfx", "/system/lib/soundfx"};
+#endif
+
     int mSkippedElements;
     /* Parsed Libraries result */
     std::unordered_map<std::string, std::string> mLibraryMap;
@@ -91,6 +98,8 @@
 
     const char* dump(const tinyxml2::XMLElement& element,
                      tinyxml2::XMLPrinter&& printer = {}) const;
+
+    bool resolveLibrary(const std::string& path, std::string* resolvedPath);
 };
 
 }  // namespace aidl::android::hardware::audio::effect
diff --git a/audio/aidl/default/include/effectFactory-impl/EffectFactory.h b/audio/aidl/default/include/effectFactory-impl/EffectFactory.h
index b32ec56..fc9ef02 100644
--- a/audio/aidl/default/include/effectFactory-impl/EffectFactory.h
+++ b/audio/aidl/default/include/effectFactory-impl/EffectFactory.h
@@ -102,7 +102,7 @@
     ndk::ScopedAStatus destroyEffectImpl(const std::shared_ptr<IEffect>& in_handle);
     void cleanupEffectMap();
     bool openEffectLibrary(const ::aidl::android::media::audio::common::AudioUuid& impl,
-                           const std::string& libName);
+                           const std::string& path);
     void createIdentityWithConfig(
             const EffectConfig::LibraryUuid& configLib,
             const ::aidl::android::media::audio::common::AudioUuid& typeUuid,
diff --git a/audio/aidl/default/loudnessEnhancer/Android.bp b/audio/aidl/default/loudnessEnhancer/Android.bp
index 3a0ac73..89a72fe 100644
--- a/audio/aidl/default/loudnessEnhancer/Android.bp
+++ b/audio/aidl/default/loudnessEnhancer/Android.bp
@@ -34,6 +34,7 @@
         "LoudnessEnhancerSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/main.cpp b/audio/aidl/default/main.cpp
index b66c134..a861f9d 100644
--- a/audio/aidl/default/main.cpp
+++ b/audio/aidl/default/main.cpp
@@ -25,9 +25,11 @@
 
 #include "core-impl/Config.h"
 #include "core-impl/Module.h"
+#include "core-impl/ModuleUsb.h"
 
 using aidl::android::hardware::audio::core::Config;
 using aidl::android::hardware::audio::core::Module;
+using aidl::android::hardware::audio::core::ModuleUsb;
 
 int main() {
     // Random values are used in the implementation.
@@ -35,6 +37,8 @@
 
     // This is a debug implementation, always enable debug logging.
     android::base::SetMinimumLogSeverity(::android::base::DEBUG);
+    // For more logs, use VERBOSE, however this may hinder performance.
+    // android::base::SetMinimumLogSeverity(::android::base::VERBOSE);
     ABinderProcess_setThreadPoolMaxThreadCount(16);
 
     // Make the default config service
@@ -46,7 +50,7 @@
 
     // Make modules
     auto createModule = [](Module::Type type, const std::string& instance) {
-        auto module = ndk::SharedRefBase::make<Module>(type);
+        auto module = Module::createInstance(type);
         ndk::SpAIBinder moduleBinder = module->asBinder();
         const std::string moduleName = std::string(Module::descriptor).append("/").append(instance);
         AIBinder_setMinSchedulerPolicy(moduleBinder.get(), SCHED_NORMAL, ANDROID_PRIORITY_AUDIO);
@@ -55,7 +59,8 @@
         return std::make_pair(module, moduleBinder);
     };
     auto modules = {createModule(Module::Type::DEFAULT, "default"),
-                    createModule(Module::Type::R_SUBMIX, "r_submix")};
+                    createModule(Module::Type::R_SUBMIX, "r_submix"),
+                    createModule(Module::Type::USB, "usb")};
 
     ABinderProcess_joinThreadPool();
     return EXIT_FAILURE;  // should not reach
diff --git a/audio/aidl/default/noiseSuppression/Android.bp b/audio/aidl/default/noiseSuppression/Android.bp
index 581d4bf..dad3d49 100644
--- a/audio/aidl/default/noiseSuppression/Android.bp
+++ b/audio/aidl/default/noiseSuppression/Android.bp
@@ -34,6 +34,7 @@
         "NoiseSuppressionSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.cpp b/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.cpp
index a36cfe0..51fe4ea 100644
--- a/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.cpp
+++ b/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.cpp
@@ -90,10 +90,15 @@
     switch (tag) {
         case NoiseSuppression::level: {
             RETURN_IF(mContext->setLevel(param.get<NoiseSuppression::level>()) != RetCode::SUCCESS,
-                      EX_ILLEGAL_ARGUMENT, "levelSupported");
+                      EX_ILLEGAL_ARGUMENT, "levelNotSupported");
             return ndk::ScopedAStatus::ok();
         }
-        default: {
+        case NoiseSuppression::type: {
+            RETURN_IF(mContext->setType(param.get<NoiseSuppression::type>()) != RetCode::SUCCESS,
+                      EX_ILLEGAL_ARGUMENT, "typeNotSupported");
+            return ndk::ScopedAStatus::ok();
+        }
+        case NoiseSuppression::vendor: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
                     EX_ILLEGAL_ARGUMENT, "NoiseSuppressionTagNotSupported");
@@ -111,10 +116,11 @@
         case NoiseSuppression::Id::commonTag:
             return getParameterNoiseSuppression(specificId.get<NoiseSuppression::Id::commonTag>(),
                                                 specific);
-        default:
+        case NoiseSuppression::Id::vendorExtensionTag: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
                     EX_ILLEGAL_ARGUMENT, "NoiseSuppressionTagNotSupported");
+        }
     }
 }
 
@@ -127,7 +133,11 @@
             param.set<NoiseSuppression::level>(mContext->getLevel());
             break;
         }
-        default: {
+        case NoiseSuppression::type: {
+            param.set<NoiseSuppression::type>(mContext->getType());
+            break;
+        }
+        case NoiseSuppression::vendor: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
                     EX_ILLEGAL_ARGUMENT, "NoiseSuppressionTagNotSupported");
@@ -177,4 +187,9 @@
     return mLevel;
 }
 
+RetCode NoiseSuppressionSwContext::setType(NoiseSuppression::Type type) {
+    mType = type;
+    return RetCode::SUCCESS;
+}
+
 }  // namespace aidl::android::hardware::audio::effect
diff --git a/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.h b/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.h
index f39d8e5..a851e38 100644
--- a/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.h
+++ b/audio/aidl/default/noiseSuppression/NoiseSuppressionSw.h
@@ -35,9 +35,12 @@
 
     RetCode setLevel(NoiseSuppression::Level level);
     NoiseSuppression::Level getLevel();
+    RetCode setType(NoiseSuppression::Type type);
+    NoiseSuppression::Type getType() { return mType; }
 
   private:
     NoiseSuppression::Level mLevel = NoiseSuppression::Level::LOW;
+    NoiseSuppression::Type mType = NoiseSuppression::Type::SINGLE_CHANNEL;
 };
 
 class NoiseSuppressionSw final : public EffectImpl {
diff --git a/audio/aidl/default/presetReverb/Android.bp b/audio/aidl/default/presetReverb/Android.bp
index 4148511..18bdd17 100644
--- a/audio/aidl/default/presetReverb/Android.bp
+++ b/audio/aidl/default/presetReverb/Android.bp
@@ -34,6 +34,7 @@
         "PresetReverbSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/usb/ModuleUsb.cpp b/audio/aidl/default/usb/ModuleUsb.cpp
new file mode 100644
index 0000000..e803420
--- /dev/null
+++ b/audio/aidl/default/usb/ModuleUsb.cpp
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "AHAL_ModuleUsb"
+
+#include <vector>
+
+#include <Utils.h>
+#include <android-base/logging.h>
+#include <tinyalsa/asoundlib.h>
+
+#include "UsbAlsaUtils.h"
+#include "core-impl/ModuleUsb.h"
+
+extern "C" {
+#include "alsa_device_profile.h"
+}
+
+using aidl::android::media::audio::common::AudioChannelLayout;
+using aidl::android::media::audio::common::AudioDeviceAddress;
+using aidl::android::media::audio::common::AudioDeviceDescription;
+using aidl::android::media::audio::common::AudioDeviceType;
+using aidl::android::media::audio::common::AudioFormatDescription;
+using aidl::android::media::audio::common::AudioFormatType;
+using aidl::android::media::audio::common::AudioPort;
+using aidl::android::media::audio::common::AudioPortConfig;
+using aidl::android::media::audio::common::AudioPortExt;
+using aidl::android::media::audio::common::AudioProfile;
+using android::hardware::audio::common::isUsbInputDeviceType;
+
+namespace aidl::android::hardware::audio::core {
+
+namespace {
+
+std::vector<AudioChannelLayout> populateChannelMasksFromProfile(const alsa_device_profile* profile,
+                                                                bool isInput) {
+    std::vector<AudioChannelLayout> channels;
+    for (size_t i = 0; i < AUDIO_PORT_MAX_CHANNEL_MASKS && profile->channel_counts[i] != 0; ++i) {
+        auto layoutMask =
+                usb::getChannelLayoutMaskFromChannelCount(profile->channel_counts[i], isInput);
+        if (layoutMask.getTag() == AudioChannelLayout::Tag::layoutMask) {
+            channels.push_back(layoutMask);
+        }
+        auto indexMask = usb::getChannelIndexMaskFromChannelCount(profile->channel_counts[i]);
+        if (indexMask.getTag() == AudioChannelLayout::Tag::indexMask) {
+            channels.push_back(indexMask);
+        }
+    }
+    return channels;
+}
+
+std::vector<int> populateSampleRatesFromProfile(const alsa_device_profile* profile) {
+    std::vector<int> sampleRates;
+    for (int i = 0; i < std::min(MAX_PROFILE_SAMPLE_RATES, AUDIO_PORT_MAX_SAMPLING_RATES) &&
+                    profile->sample_rates[i] != 0;
+         i++) {
+        sampleRates.push_back(profile->sample_rates[i]);
+    }
+    return sampleRates;
+}
+
+}  // namespace
+
+ndk::ScopedAStatus ModuleUsb::getTelephony(std::shared_ptr<ITelephony>* _aidl_return) {
+    *_aidl_return = nullptr;
+    LOG(DEBUG) << __func__ << ": returning null";
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus ModuleUsb::getBluetooth(std::shared_ptr<IBluetooth>* _aidl_return) {
+    *_aidl_return = nullptr;
+    LOG(DEBUG) << __func__ << ": returning null";
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus ModuleUsb::getMasterMute(bool* _aidl_return __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::setMasterMute(bool in_mute __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::getMasterVolume(float* _aidl_return __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::setMasterVolume(float in_volume __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::getMicMute(bool* _aidl_return __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::setMicMute(bool in_mute __unused) {
+    LOG(DEBUG) << __func__ << ": is not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+ndk::ScopedAStatus ModuleUsb::populateConnectedDevicePort(AudioPort* audioPort) {
+    if (audioPort->ext.getTag() != AudioPortExt::Tag::device) {
+        LOG(ERROR) << __func__ << ": port id " << audioPort->id << " is not a device port";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    auto& devicePort = audioPort->ext.get<AudioPortExt::Tag::device>();
+    if (devicePort.device.type.connection != AudioDeviceDescription::CONNECTION_USB) {
+        LOG(ERROR) << __func__ << ": port id " << audioPort->id << " is not a usb device port";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    if (devicePort.device.address.getTag() != AudioDeviceAddress::Tag::alsa) {
+        LOG(ERROR) << __func__ << ": port id " << audioPort->id << " is not using alsa address";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    auto& alsaAddress = devicePort.device.address.get<AudioDeviceAddress::Tag::alsa>();
+    if (alsaAddress.size() != 2 || alsaAddress[0] < 0 || alsaAddress[1] < 0) {
+        LOG(ERROR) << __func__ << ": port id " << audioPort->id << " invalid alsa address";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+
+    const bool isInput = isUsbInputDeviceType(devicePort.device.type.type);
+    alsa_device_profile profile;
+    profile_init(&profile, isInput ? PCM_IN : PCM_OUT);
+    if (!profile_read_device_info(&profile)) {
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+    }
+
+    std::vector<AudioChannelLayout> channels = populateChannelMasksFromProfile(&profile, isInput);
+    std::vector<int> sampleRates = populateSampleRatesFromProfile(&profile);
+
+    for (size_t i = 0; i < std::min(MAX_PROFILE_FORMATS, AUDIO_PORT_MAX_AUDIO_PROFILES) &&
+                       profile.formats[i] != 0;
+         ++i) {
+        auto audioFormatDescription =
+                usb::legacy2aidl_pcm_format_AudioFormatDescription(profile.formats[i]);
+        if (audioFormatDescription.type == AudioFormatType::DEFAULT) {
+            LOG(WARNING) << __func__ << ": unknown pcm type=" << profile.formats[i];
+            continue;
+        }
+        AudioProfile audioProfile = {.format = audioFormatDescription,
+                                     .channelMasks = channels,
+                                     .sampleRates = sampleRates};
+        audioPort->profiles.push_back(std::move(audioProfile));
+    }
+
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus ModuleUsb::checkAudioPatchEndpointsMatch(
+        const std::vector<AudioPortConfig*>& sources, const std::vector<AudioPortConfig*>& sinks) {
+    for (const auto& source : sources) {
+        for (const auto& sink : sinks) {
+            if (source->sampleRate != sink->sampleRate ||
+                source->channelMask != sink->channelMask || source->format != sink->format) {
+                LOG(ERROR) << __func__
+                           << ": mismatch port configuration, source=" << source->toString()
+                           << ", sink=" << sink->toString();
+                return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+            }
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+}  // namespace aidl::android::hardware::audio::core
diff --git a/audio/aidl/default/usb/StreamUsb.cpp b/audio/aidl/default/usb/StreamUsb.cpp
new file mode 100644
index 0000000..22e36ac
--- /dev/null
+++ b/audio/aidl/default/usb/StreamUsb.cpp
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "AHAL_StreamUsb"
+#include <android-base/logging.h>
+
+#include "UsbAlsaUtils.h"
+#include "core-impl/Module.h"
+#include "core-impl/StreamUsb.h"
+
+extern "C" {
+#include "alsa_device_profile.h"
+}
+
+using aidl::android::hardware::audio::common::SinkMetadata;
+using aidl::android::hardware::audio::common::SourceMetadata;
+using aidl::android::media::audio::common::AudioDevice;
+using aidl::android::media::audio::common::AudioDeviceAddress;
+using aidl::android::media::audio::common::AudioOffloadInfo;
+
+namespace aidl::android::hardware::audio::core {
+
+DriverUsb::DriverUsb(const StreamContext& context, bool isInput)
+    : mFrameSizeBytes(context.getFrameSize()), mIsInput(isInput) {
+    struct pcm_config config;
+    config.channels = usb::getChannelCountFromChannelMask(context.getChannelLayout(), isInput);
+    if (config.channels == 0) {
+        LOG(ERROR) << __func__ << ": invalid channel=" << context.getChannelLayout().toString();
+        return;
+    }
+    config.format = usb::aidl2legacy_AudioFormatDescription_pcm_format(context.getFormat());
+    if (config.format == PCM_FORMAT_INVALID) {
+        LOG(ERROR) << __func__ << ": invalid format=" << context.getFormat().toString();
+        return;
+    }
+    config.rate = context.getSampleRate();
+    if (config.rate == 0) {
+        LOG(ERROR) << __func__ << ": invalid sample rate=" << config.rate;
+        return;
+    }
+    mConfig = config;
+}
+
+::android::status_t DriverUsb::init() {
+    return mConfig.has_value() ? ::android::OK : ::android::NO_INIT;
+}
+
+::android::status_t DriverUsb::setConnectedDevices(
+        const std::vector<AudioDevice>& connectedDevices) {
+    if (mIsInput && connectedDevices.size() > 1) {
+        LOG(ERROR) << __func__ << ": wrong device size(" << connectedDevices.size()
+                   << ") for input stream";
+        return ::android::BAD_VALUE;
+    }
+    for (const auto& connectedDevice : connectedDevices) {
+        if (connectedDevice.address.getTag() != AudioDeviceAddress::alsa) {
+            LOG(ERROR) << __func__ << ": bad device address" << connectedDevice.address.toString();
+            return ::android::BAD_VALUE;
+        }
+    }
+    std::lock_guard guard(mLock);
+    mAlsaDeviceProxies.clear();
+    mConnectedDevices.clear();
+    for (const auto& connectedDevice : connectedDevices) {
+        mConnectedDevices.push_back(connectedDevice.address);
+    }
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::drain(StreamDescriptor::DrainMode) {
+    usleep(1000);
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::flush() {
+    usleep(1000);
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::pause() {
+    usleep(1000);
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::transfer(void* buffer, size_t frameCount, size_t* actualFrameCount,
+                                        int32_t* latencyMs) {
+    if (!mConfig.has_value() || mConnectedDevices.empty()) {
+        return ::android::NO_INIT;
+    }
+    if (mIsStandby) {
+        if (::android::status_t status = exitStandby(); status != ::android::OK) {
+            return status;
+        }
+    }
+    std::vector<std::shared_ptr<alsa_device_proxy>> alsaDeviceProxies;
+    {
+        std::lock_guard guard(mLock);
+        alsaDeviceProxies = mAlsaDeviceProxies;
+    }
+    const size_t bytesToTransfer = frameCount * mFrameSizeBytes;
+    if (mIsInput) {
+        // For input case, only support single device.
+        proxy_read(alsaDeviceProxies[0].get(), buffer, bytesToTransfer);
+    } else {
+        for (auto& proxy : alsaDeviceProxies) {
+            proxy_write(proxy.get(), buffer, bytesToTransfer);
+        }
+    }
+    *actualFrameCount = frameCount;
+    *latencyMs = Module::kLatencyMs;
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::standby() {
+    if (!mIsStandby) {
+        std::lock_guard guard(mLock);
+        mAlsaDeviceProxies.clear();
+        mIsStandby = true;
+    }
+    return ::android::OK;
+}
+
+::android::status_t DriverUsb::exitStandby() {
+    std::vector<AudioDeviceAddress> connectedDevices;
+    {
+        std::lock_guard guard(mLock);
+        connectedDevices = mConnectedDevices;
+    }
+    std::vector<std::shared_ptr<alsa_device_proxy>> alsaDeviceProxies;
+    for (const auto& device : connectedDevices) {
+        alsa_device_profile profile;
+        profile.card = device.get<AudioDeviceAddress::alsa>()[0];
+        profile.device = device.get<AudioDeviceAddress::alsa>()[1];
+        if (!profile_read_device_info(&profile)) {
+            LOG(ERROR) << __func__
+                       << ": unable to read device info, device address=" << device.toString();
+            return ::android::UNKNOWN_ERROR;
+        }
+
+        auto proxy = std::shared_ptr<alsa_device_proxy>(new alsa_device_proxy(),
+                                                        [](alsa_device_proxy* proxy) {
+                                                            proxy_close(proxy);
+                                                            free(proxy);
+                                                        });
+        // Always ask for alsa configure as required since the configuration should be supported
+        // by the connected device. That is guaranteed by `setAudioPortConfig` and
+        // `setAudioPatch`.
+        if (int err =
+                    proxy_prepare(proxy.get(), &profile, &mConfig.value(), true /*is_bit_perfect*/);
+            err != 0) {
+            LOG(ERROR) << __func__ << ": fail to prepare for device address=" << device.toString()
+                       << " error=" << err;
+            return ::android::UNKNOWN_ERROR;
+        }
+        alsaDeviceProxies.push_back(std::move(proxy));
+    }
+    {
+        std::lock_guard guard(mLock);
+        mAlsaDeviceProxies = alsaDeviceProxies;
+    }
+    mIsStandby = false;
+    return ::android::OK;
+}
+
+// static
+ndk::ScopedAStatus StreamInUsb::createInstance(const SinkMetadata& sinkMetadata,
+                                               StreamContext&& context,
+                                               const std::vector<MicrophoneInfo>& microphones,
+                                               std::shared_ptr<StreamIn>* result) {
+    std::shared_ptr<StreamIn> stream =
+            ndk::SharedRefBase::make<StreamInUsb>(sinkMetadata, std::move(context), microphones);
+    if (auto status = initInstance(stream); !status.isOk()) {
+        return status;
+    }
+    *result = std::move(stream);
+    return ndk::ScopedAStatus::ok();
+}
+
+StreamInUsb::StreamInUsb(const SinkMetadata& sinkMetadata, StreamContext&& context,
+                         const std::vector<MicrophoneInfo>& microphones)
+    : StreamIn(
+              sinkMetadata, std::move(context),
+              [](const StreamContext& ctx) -> DriverInterface* {
+                  return new DriverUsb(ctx, true /*isInput*/);
+              },
+              [](const StreamContext& ctx, DriverInterface* driver) -> StreamWorkerInterface* {
+                  // The default worker implementation is used.
+                  return new StreamInWorker(ctx, driver);
+              },
+              microphones) {}
+
+ndk::ScopedAStatus StreamInUsb::getActiveMicrophones(
+        std::vector<MicrophoneDynamicInfo>* _aidl_return __unused) {
+    LOG(DEBUG) << __func__ << ": not supported";
+    return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+}
+
+// static
+ndk::ScopedAStatus StreamOutUsb::createInstance(const SourceMetadata& sourceMetadata,
+                                                StreamContext&& context,
+                                                const std::optional<AudioOffloadInfo>& offloadInfo,
+                                                std::shared_ptr<StreamOut>* result) {
+    if (offloadInfo.has_value()) {
+        LOG(ERROR) << __func__ << ": offload is not supported";
+        return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+    }
+    std::shared_ptr<StreamOut> stream =
+            ndk::SharedRefBase::make<StreamOutUsb>(sourceMetadata, std::move(context), offloadInfo);
+    if (auto status = initInstance(stream); !status.isOk()) {
+        return status;
+    }
+    *result = std::move(stream);
+    return ndk::ScopedAStatus::ok();
+}
+
+StreamOutUsb::StreamOutUsb(const SourceMetadata& sourceMetadata, StreamContext&& context,
+                           const std::optional<AudioOffloadInfo>& offloadInfo)
+    : StreamOut(
+              sourceMetadata, std::move(context),
+              [](const StreamContext& ctx) -> DriverInterface* {
+                  return new DriverUsb(ctx, false /*isInput*/);
+              },
+              [](const StreamContext& ctx, DriverInterface* driver) -> StreamWorkerInterface* {
+                  // The default worker implementation is used.
+                  return new StreamOutWorker(ctx, driver);
+              },
+              offloadInfo) {}
+
+}  // namespace aidl::android::hardware::audio::core
\ No newline at end of file
diff --git a/audio/aidl/default/usb/UsbAlsaUtils.cpp b/audio/aidl/default/usb/UsbAlsaUtils.cpp
new file mode 100644
index 0000000..3c79e1d
--- /dev/null
+++ b/audio/aidl/default/usb/UsbAlsaUtils.cpp
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <map>
+#include <set>
+
+#include <Utils.h>
+#include <aidl/android/media/audio/common/AudioFormatType.h>
+#include <aidl/android/media/audio/common/PcmType.h>
+
+#include "UsbAlsaUtils.h"
+#include "core-impl/utils.h"
+
+using aidl::android::media::audio::common::AudioChannelLayout;
+using aidl::android::media::audio::common::AudioFormatDescription;
+using aidl::android::media::audio::common::AudioFormatType;
+using aidl::android::media::audio::common::PcmType;
+using android::hardware::audio::common::getChannelCount;
+
+namespace aidl::android::hardware::audio::core::usb {
+
+namespace {
+
+using AudioChannelCountToMaskMap = std::map<unsigned int, AudioChannelLayout>;
+using AudioFormatDescToPcmFormatMap = std::map<AudioFormatDescription, enum pcm_format>;
+using PcmFormatToAudioFormatDescMap = std::map<enum pcm_format, AudioFormatDescription>;
+
+static const AudioChannelLayout INVALID_CHANNEL_LAYOUT =
+        AudioChannelLayout::make<AudioChannelLayout::Tag::invalid>(0);
+
+#define DEFINE_CHANNEL_LAYOUT_MASK(n) \
+    AudioChannelLayout::make<AudioChannelLayout::Tag::layoutMask>(AudioChannelLayout::LAYOUT_##n)
+
+static const std::set<AudioChannelLayout> SUPPORTED_OUT_CHANNEL_LAYOUTS = {
+        DEFINE_CHANNEL_LAYOUT_MASK(MONO),          DEFINE_CHANNEL_LAYOUT_MASK(STEREO),
+        DEFINE_CHANNEL_LAYOUT_MASK(2POINT1),       DEFINE_CHANNEL_LAYOUT_MASK(QUAD),
+        DEFINE_CHANNEL_LAYOUT_MASK(PENTA),         DEFINE_CHANNEL_LAYOUT_MASK(5POINT1),
+        DEFINE_CHANNEL_LAYOUT_MASK(6POINT1),       DEFINE_CHANNEL_LAYOUT_MASK(7POINT1),
+        DEFINE_CHANNEL_LAYOUT_MASK(7POINT1POINT4), DEFINE_CHANNEL_LAYOUT_MASK(22POINT2),
+};
+
+static const std::set<AudioChannelLayout> SUPPORTED_IN_CHANNEL_LAYOUTS = {
+        DEFINE_CHANNEL_LAYOUT_MASK(MONO),
+        DEFINE_CHANNEL_LAYOUT_MASK(STEREO),
+};
+
+#define DEFINE_CHANNEL_INDEX_MASK(n) \
+    AudioChannelLayout::make<AudioChannelLayout::Tag::indexMask>(AudioChannelLayout::INDEX_MASK_##n)
+
+static const std::set<AudioChannelLayout> SUPPORTED_INDEX_CHANNEL_LAYOUTS = {
+        DEFINE_CHANNEL_INDEX_MASK(1),  DEFINE_CHANNEL_INDEX_MASK(2),  DEFINE_CHANNEL_INDEX_MASK(3),
+        DEFINE_CHANNEL_INDEX_MASK(4),  DEFINE_CHANNEL_INDEX_MASK(5),  DEFINE_CHANNEL_INDEX_MASK(6),
+        DEFINE_CHANNEL_INDEX_MASK(7),  DEFINE_CHANNEL_INDEX_MASK(8),  DEFINE_CHANNEL_INDEX_MASK(9),
+        DEFINE_CHANNEL_INDEX_MASK(10), DEFINE_CHANNEL_INDEX_MASK(11), DEFINE_CHANNEL_INDEX_MASK(12),
+        DEFINE_CHANNEL_INDEX_MASK(13), DEFINE_CHANNEL_INDEX_MASK(14), DEFINE_CHANNEL_INDEX_MASK(15),
+        DEFINE_CHANNEL_INDEX_MASK(16), DEFINE_CHANNEL_INDEX_MASK(17), DEFINE_CHANNEL_INDEX_MASK(18),
+        DEFINE_CHANNEL_INDEX_MASK(19), DEFINE_CHANNEL_INDEX_MASK(20), DEFINE_CHANNEL_INDEX_MASK(21),
+        DEFINE_CHANNEL_INDEX_MASK(22), DEFINE_CHANNEL_INDEX_MASK(23), DEFINE_CHANNEL_INDEX_MASK(24),
+};
+
+static AudioChannelCountToMaskMap make_ChannelCountToMaskMap(
+        const std::set<AudioChannelLayout>& channelMasks) {
+    AudioChannelCountToMaskMap channelMaskToCountMap;
+    for (const auto& channelMask : channelMasks) {
+        channelMaskToCountMap.emplace(getChannelCount(channelMask), channelMask);
+    }
+    return channelMaskToCountMap;
+}
+
+const AudioChannelCountToMaskMap& getSupportedChannelOutLayoutMap() {
+    static const AudioChannelCountToMaskMap outLayouts =
+            make_ChannelCountToMaskMap(SUPPORTED_OUT_CHANNEL_LAYOUTS);
+    return outLayouts;
+}
+
+const AudioChannelCountToMaskMap& getSupportedChannelInLayoutMap() {
+    static const AudioChannelCountToMaskMap inLayouts =
+            make_ChannelCountToMaskMap(SUPPORTED_IN_CHANNEL_LAYOUTS);
+    return inLayouts;
+}
+
+const AudioChannelCountToMaskMap& getSupportedChannelIndexLayoutMap() {
+    static const AudioChannelCountToMaskMap indexLayouts =
+            make_ChannelCountToMaskMap(SUPPORTED_INDEX_CHANNEL_LAYOUTS);
+    return indexLayouts;
+}
+
+AudioFormatDescription make_AudioFormatDescription(AudioFormatType type) {
+    AudioFormatDescription result;
+    result.type = type;
+    return result;
+}
+
+AudioFormatDescription make_AudioFormatDescription(PcmType pcm) {
+    auto result = make_AudioFormatDescription(AudioFormatType::PCM);
+    result.pcm = pcm;
+    return result;
+}
+
+const AudioFormatDescToPcmFormatMap& getAudioFormatDescriptorToPcmFormatMap() {
+    static const AudioFormatDescToPcmFormatMap formatDescToPcmFormatMap = {
+            {make_AudioFormatDescription(PcmType::UINT_8_BIT), PCM_FORMAT_S8},
+            {make_AudioFormatDescription(PcmType::INT_16_BIT), PCM_FORMAT_S16_LE},
+            {make_AudioFormatDescription(PcmType::INT_24_BIT), PCM_FORMAT_S24_LE},
+            {make_AudioFormatDescription(PcmType::FIXED_Q_8_24), PCM_FORMAT_S24_3LE},
+            {make_AudioFormatDescription(PcmType::INT_32_BIT), PCM_FORMAT_S32_LE},
+            {make_AudioFormatDescription(PcmType::FLOAT_32_BIT), PCM_FORMAT_FLOAT_LE},
+    };
+    return formatDescToPcmFormatMap;
+}
+
+static PcmFormatToAudioFormatDescMap make_PcmFormatToAudioFormatDescMap(
+        const AudioFormatDescToPcmFormatMap& formatDescToPcmFormatMap) {
+    PcmFormatToAudioFormatDescMap result;
+    for (const auto& formatPair : formatDescToPcmFormatMap) {
+        result.emplace(formatPair.second, formatPair.first);
+    }
+    return result;
+}
+
+const PcmFormatToAudioFormatDescMap& getPcmFormatToAudioFormatDescMap() {
+    static const PcmFormatToAudioFormatDescMap pcmFormatToFormatDescMap =
+            make_PcmFormatToAudioFormatDescMap(getAudioFormatDescriptorToPcmFormatMap());
+    return pcmFormatToFormatDescMap;
+}
+
+}  // namespace
+
+AudioChannelLayout getChannelLayoutMaskFromChannelCount(unsigned int channelCount, int isInput) {
+    return findValueOrDefault(
+            isInput ? getSupportedChannelInLayoutMap() : getSupportedChannelOutLayoutMap(),
+            channelCount, INVALID_CHANNEL_LAYOUT);
+}
+
+AudioChannelLayout getChannelIndexMaskFromChannelCount(unsigned int channelCount) {
+    return findValueOrDefault(getSupportedChannelIndexLayoutMap(), channelCount,
+                              INVALID_CHANNEL_LAYOUT);
+}
+
+unsigned int getChannelCountFromChannelMask(const AudioChannelLayout& channelMask, bool isInput) {
+    switch (channelMask.getTag()) {
+        case AudioChannelLayout::Tag::layoutMask: {
+            return findKeyOrDefault(
+                    isInput ? getSupportedChannelInLayoutMap() : getSupportedChannelOutLayoutMap(),
+                    (unsigned int)getChannelCount(channelMask), 0u /*defaultValue*/);
+        }
+        case AudioChannelLayout::Tag::indexMask: {
+            return findKeyOrDefault(getSupportedChannelIndexLayoutMap(),
+                                    (unsigned int)getChannelCount(channelMask),
+                                    0u /*defaultValue*/);
+        }
+        case AudioChannelLayout::Tag::none:
+        case AudioChannelLayout::Tag::invalid:
+        case AudioChannelLayout::Tag::voiceMask:
+        default:
+            return 0;
+    }
+}
+
+AudioFormatDescription legacy2aidl_pcm_format_AudioFormatDescription(enum pcm_format legacy) {
+    return findValueOrDefault(getPcmFormatToAudioFormatDescMap(), legacy, AudioFormatDescription());
+}
+
+pcm_format aidl2legacy_AudioFormatDescription_pcm_format(const AudioFormatDescription& aidl) {
+    return findValueOrDefault(getAudioFormatDescriptorToPcmFormatMap(), aidl, PCM_FORMAT_INVALID);
+}
+
+}  // namespace aidl::android::hardware::audio::core::usb
\ No newline at end of file
diff --git a/audio/aidl/default/usb/UsbAlsaUtils.h b/audio/aidl/default/usb/UsbAlsaUtils.h
new file mode 100644
index 0000000..2d2f0f4
--- /dev/null
+++ b/audio/aidl/default/usb/UsbAlsaUtils.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/media/audio/common/AudioChannelLayout.h>
+#include <aidl/android/media/audio/common/AudioFormatDescription.h>
+
+extern "C" {
+#include <tinyalsa/pcm.h>
+}
+
+namespace aidl::android::hardware::audio::core::usb {
+
+::aidl::android::media::audio::common::AudioChannelLayout getChannelLayoutMaskFromChannelCount(
+        unsigned int channelCount, int isInput);
+::aidl::android::media::audio::common::AudioChannelLayout getChannelIndexMaskFromChannelCount(
+        unsigned int channelCount);
+unsigned int getChannelCountFromChannelMask(
+        const ::aidl::android::media::audio::common::AudioChannelLayout& channelMask, bool isInput);
+::aidl::android::media::audio::common::AudioFormatDescription
+legacy2aidl_pcm_format_AudioFormatDescription(enum pcm_format legacy);
+pcm_format aidl2legacy_AudioFormatDescription_pcm_format(
+        const ::aidl::android::media::audio::common::AudioFormatDescription& aidl);
+
+}  // namespace aidl::android::hardware::audio::core::usb
\ No newline at end of file
diff --git a/audio/aidl/default/virtualizer/Android.bp b/audio/aidl/default/virtualizer/Android.bp
index ba38f5c..ed0199d 100644
--- a/audio/aidl/default/virtualizer/Android.bp
+++ b/audio/aidl/default/virtualizer/Android.bp
@@ -34,6 +34,7 @@
         "VirtualizerSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/virtualizer/VirtualizerSw.cpp b/audio/aidl/default/virtualizer/VirtualizerSw.cpp
index cc51937..08535bd 100644
--- a/audio/aidl/default/virtualizer/VirtualizerSw.cpp
+++ b/audio/aidl/default/virtualizer/VirtualizerSw.cpp
@@ -30,6 +30,8 @@
 using aidl::android::hardware::audio::effect::kVirtualizerSwImplUUID;
 using aidl::android::hardware::audio::effect::State;
 using aidl::android::hardware::audio::effect::VirtualizerSw;
+using aidl::android::media::audio::common::AudioChannelLayout;
+using aidl::android::media::audio::common::AudioDeviceDescription;
 using aidl::android::media::audio::common::AudioUuid;
 
 extern "C" binder_exception_t createEffect(const AudioUuid* in_impl_uuid,
@@ -93,10 +95,18 @@
 
             RETURN_IF(mContext->setVrStrength(vrParam.get<Virtualizer::strengthPm>()) !=
                               RetCode::SUCCESS,
-                      EX_ILLEGAL_ARGUMENT, "strengthPmNotSupported");
+                      EX_ILLEGAL_ARGUMENT, "setStrengthPmFailed");
             return ndk::ScopedAStatus::ok();
         }
-        default: {
+        case Virtualizer::device: {
+            RETURN_IF(mContext->setForcedDevice(vrParam.get<Virtualizer::device>()) !=
+                              RetCode::SUCCESS,
+                      EX_ILLEGAL_ARGUMENT, "setDeviceFailed");
+            return ndk::ScopedAStatus::ok();
+        }
+        case Virtualizer::speakerAngles:
+            FALLTHROUGH_INTENDED;
+        case Virtualizer::vendor: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
                                                                     "VirtualizerTagNotSupported");
@@ -113,10 +123,13 @@
     switch (vrIdTag) {
         case Virtualizer::Id::commonTag:
             return getParameterVirtualizer(vrId.get<Virtualizer::Id::commonTag>(), specific);
-        default:
+        case Virtualizer::Id::speakerAnglesPayload:
+            return getSpeakerAngles(vrId.get<Virtualizer::Id::speakerAnglesPayload>(), specific);
+        case Virtualizer::Id::vendorExtensionTag: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
                                                                     "VirtualizerTagNotSupported");
+        }
     }
 }
 
@@ -130,7 +143,13 @@
             vrParam.set<Virtualizer::strengthPm>(mContext->getVrStrength());
             break;
         }
-        default: {
+        case Virtualizer::device: {
+            vrParam.set<Virtualizer::device>(mContext->getForcedDevice());
+            break;
+        }
+        case Virtualizer::speakerAngles:
+            FALLTHROUGH_INTENDED;
+        case Virtualizer::vendor: {
             LOG(ERROR) << __func__ << " unsupported tag: " << toString(tag);
             return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
                                                                     "VirtualizerTagNotSupported");
@@ -141,6 +160,27 @@
     return ndk::ScopedAStatus::ok();
 }
 
+ndk::ScopedAStatus VirtualizerSw::getSpeakerAngles(const Virtualizer::SpeakerAnglesPayload payload,
+                                                   Parameter::Specific* specific) {
+    std::vector<Virtualizer::ChannelAngle> angles;
+    if (::android::hardware::audio::common::getChannelCount(payload.layout) == 1) {
+        angles = {{.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_LEFT,
+                   .azimuthDegree = 0,
+                   .elevationDegree = 0}};
+    } else {
+        angles = {{.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_LEFT,
+                   .azimuthDegree = -90,
+                   .elevationDegree = 0},
+                  {.channel = (int32_t)AudioChannelLayout::CHANNEL_FRONT_RIGHT,
+                   .azimuthDegree = 90,
+                   .elevationDegree = 0}};
+    }
+
+    Virtualizer param = Virtualizer::make<Virtualizer::speakerAngles>(angles);
+    specific->set<Parameter::Specific::virtualizer>(param);
+    return ndk::ScopedAStatus::ok();
+}
+
 std::shared_ptr<EffectContext> VirtualizerSw::createContext(const Parameter::Common& common) {
     if (mContext) {
         LOG(DEBUG) << __func__ << " context already exist";
diff --git a/audio/aidl/default/virtualizer/VirtualizerSw.h b/audio/aidl/default/virtualizer/VirtualizerSw.h
index 0f294cd..1016ffc 100644
--- a/audio/aidl/default/virtualizer/VirtualizerSw.h
+++ b/audio/aidl/default/virtualizer/VirtualizerSw.h
@@ -34,9 +34,18 @@
     }
     RetCode setVrStrength(int strength);
     int getVrStrength() const { return mStrength; }
+    RetCode setForcedDevice(
+            const ::aidl::android::media::audio::common::AudioDeviceDescription& device) {
+        mForceDevice = device;
+        return RetCode::SUCCESS;
+    }
+    aidl::android::media::audio::common::AudioDeviceDescription getForcedDevice() const {
+        return mForceDevice;
+    }
 
   private:
     int mStrength = 0;
+    ::aidl::android::media::audio::common::AudioDeviceDescription mForceDevice;
 };
 
 class VirtualizerSw final : public EffectImpl {
@@ -68,5 +77,7 @@
 
     ndk::ScopedAStatus getParameterVirtualizer(const Virtualizer::Tag& tag,
                                                Parameter::Specific* specific);
+    ndk::ScopedAStatus getSpeakerAngles(const Virtualizer::SpeakerAnglesPayload payload,
+                                        Parameter::Specific* specific);
 };
 }  // namespace aidl::android::hardware::audio::effect
diff --git a/audio/aidl/default/visualizer/Android.bp b/audio/aidl/default/visualizer/Android.bp
index 5041be8..091daa2 100644
--- a/audio/aidl/default/visualizer/Android.bp
+++ b/audio/aidl/default/visualizer/Android.bp
@@ -34,6 +34,7 @@
         "VisualizerSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/default/volume/Android.bp b/audio/aidl/default/volume/Android.bp
index 505ee67..418bb8d 100644
--- a/audio/aidl/default/volume/Android.bp
+++ b/audio/aidl/default/volume/Android.bp
@@ -34,6 +34,7 @@
         "VolumeSw.cpp",
         ":effectCommonFile",
     ],
+    relative_install_path: "soundfx",
     visibility: [
         "//hardware/interfaces/audio/aidl/default",
     ],
diff --git a/audio/aidl/vts/EffectHelper.h b/audio/aidl/vts/EffectHelper.h
index 7222d4f..526a012 100644
--- a/audio/aidl/vts/EffectHelper.h
+++ b/audio/aidl/vts/EffectHelper.h
@@ -148,16 +148,22 @@
     }
     static void readFromFmq(std::unique_ptr<StatusMQ>& statusMq, size_t statusNum,
                             std::unique_ptr<DataMQ>& dataMq, size_t expectFloats,
-                            std::vector<float>& buffer) {
+                            std::vector<float>& buffer,
+                            std::optional<int> expectStatus = STATUS_OK) {
+        if (0 == statusNum) {
+            ASSERT_EQ(0ul, statusMq->availableToRead());
+            return;
+        }
         IEffect::Status status{};
         ASSERT_TRUE(statusMq->readBlocking(&status, statusNum));
-        ASSERT_EQ(STATUS_OK, status.status);
-        if (statusNum != 0) {
-            ASSERT_EQ(expectFloats, (unsigned)status.fmqProduced);
-            ASSERT_EQ(expectFloats, dataMq->availableToRead());
-            if (expectFloats != 0) {
-                ASSERT_TRUE(dataMq->read(buffer.data(), expectFloats));
-            }
+        if (expectStatus.has_value()) {
+            ASSERT_EQ(expectStatus.value(), status.status);
+        }
+
+        ASSERT_EQ(expectFloats, (unsigned)status.fmqProduced);
+        ASSERT_EQ(expectFloats, dataMq->availableToRead());
+        if (expectFloats != 0) {
+            ASSERT_TRUE(dataMq->read(buffer.data(), expectFloats));
         }
     }
     static Parameter::Common createParamCommon(
diff --git a/audio/aidl/vts/ModuleConfig.cpp b/audio/aidl/vts/ModuleConfig.cpp
index 7e4b148..7b002ad 100644
--- a/audio/aidl/vts/ModuleConfig.cpp
+++ b/audio/aidl/vts/ModuleConfig.cpp
@@ -18,6 +18,7 @@
 #include <chrono>
 
 #include <Utils.h>
+#include <aidl/android/media/audio/common/AudioInputFlags.h>
 #include <aidl/android/media/audio/common/AudioIoFlags.h>
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
 
@@ -32,6 +33,7 @@
 using aidl::android::media::audio::common::AudioEncapsulationMode;
 using aidl::android::media::audio::common::AudioFormatDescription;
 using aidl::android::media::audio::common::AudioFormatType;
+using aidl::android::media::audio::common::AudioInputFlags;
 using aidl::android::media::audio::common::AudioIoFlags;
 using aidl::android::media::audio::common::AudioOffloadInfo;
 using aidl::android::media::audio::common::AudioOutputFlags;
@@ -162,6 +164,20 @@
     });
 }
 
+std::vector<AudioPort> ModuleConfig::getMmapOutMixPorts(bool attachedOnly, bool singlePort) const {
+    return findMixPorts(false /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+        return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::output>(),
+                                    AudioOutputFlags::MMAP_NOIRQ);
+    });
+}
+
+std::vector<AudioPort> ModuleConfig::getMmapInMixPorts(bool attachedOnly, bool singlePort) const {
+    return findMixPorts(true /*isInput*/, attachedOnly, singlePort, [&](const AudioPort& port) {
+        return isBitPositionFlagSet(port.flags.get<AudioIoFlags::Tag::input>(),
+                                    AudioInputFlags::MMAP_NOIRQ);
+    });
+}
+
 std::vector<AudioPort> ModuleConfig::getAttachedDevicesPortsForMixPort(
         bool isInput, const AudioPortConfig& mixPortConfig) const {
     const auto mixPortIt = findById<AudioPort>(mPorts, mixPortConfig.portId);
@@ -422,3 +438,11 @@
     }
     return result;
 }
+
+bool ModuleConfig::isMmapSupported() const {
+    const std::vector<AudioPort> mmapOutMixPorts =
+            getMmapOutMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+    const std::vector<AudioPort> mmapInMixPorts =
+            getMmapInMixPorts(false /*attachedOnly*/, false /*singlePort*/);
+    return !mmapOutMixPorts.empty() || !mmapInMixPorts.empty();
+}
diff --git a/audio/aidl/vts/ModuleConfig.h b/audio/aidl/vts/ModuleConfig.h
index 7247f3b..6a22075 100644
--- a/audio/aidl/vts/ModuleConfig.h
+++ b/audio/aidl/vts/ModuleConfig.h
@@ -63,6 +63,10 @@
             bool attachedOnly, bool singlePort) const;
     std::vector<aidl::android::media::audio::common::AudioPort> getPrimaryMixPorts(
             bool attachedOnly, bool singlePort) const;
+    std::vector<aidl::android::media::audio::common::AudioPort> getMmapOutMixPorts(
+            bool attachedOnly, bool singlePort) const;
+    std::vector<aidl::android::media::audio::common::AudioPort> getMmapInMixPorts(
+            bool attachedOnly, bool singlePort) const;
 
     std::vector<aidl::android::media::audio::common::AudioPort> getAttachedDevicesPortsForMixPort(
             bool isInput, const aidl::android::media::audio::common::AudioPort& mixPort) const {
@@ -135,6 +139,8 @@
         return *config.begin();
     }
 
+    bool isMmapSupported() const;
+
     std::string toString() const;
 
   private:
diff --git a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
index d4f2811..3ca51c7 100644
--- a/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioCoreModuleTargetTest.cpp
@@ -40,6 +40,8 @@
 #include <aidl/android/hardware/audio/core/ITelephony.h>
 #include <aidl/android/hardware/audio/core/sounddose/ISoundDose.h>
 #include <aidl/android/media/audio/common/AudioIoFlags.h>
+#include <aidl/android/media/audio/common/AudioMMapPolicyInfo.h>
+#include <aidl/android/media/audio/common/AudioMMapPolicyType.h>
 #include <aidl/android/media/audio/common/AudioOutputFlags.h>
 #include <android-base/chrono_utils.h>
 #include <android/binder_enums.h>
@@ -54,7 +56,6 @@
 using aidl::android::hardware::audio::common::RecordTrackMetadata;
 using aidl::android::hardware::audio::common::SinkMetadata;
 using aidl::android::hardware::audio::common::SourceMetadata;
-using aidl::android::hardware::audio::core::AudioMode;
 using aidl::android::hardware::audio::core::AudioPatch;
 using aidl::android::hardware::audio::core::AudioRoute;
 using aidl::android::hardware::audio::core::IBluetooth;
@@ -78,6 +79,9 @@
 using aidl::android::media::audio::common::AudioFormatType;
 using aidl::android::media::audio::common::AudioIoFlags;
 using aidl::android::media::audio::common::AudioLatencyMode;
+using aidl::android::media::audio::common::AudioMMapPolicyInfo;
+using aidl::android::media::audio::common::AudioMMapPolicyType;
+using aidl::android::media::audio::common::AudioMode;
 using aidl::android::media::audio::common::AudioOutputFlags;
 using aidl::android::media::audio::common::AudioPlaybackRate;
 using aidl::android::media::audio::common::AudioPort;
@@ -93,6 +97,7 @@
 using android::hardware::audio::common::getChannelCount;
 using android::hardware::audio::common::isBitPositionFlagSet;
 using android::hardware::audio::common::isTelephonyDeviceType;
+using android::hardware::audio::common::isValidAudioMode;
 using android::hardware::audio::common::StreamLogic;
 using android::hardware::audio::common::StreamWorker;
 using ndk::enum_range;
@@ -1805,7 +1810,11 @@
 
 TEST_P(AudioCoreModule, UpdateAudioMode) {
     for (const auto mode : ::ndk::enum_range<AudioMode>()) {
-        EXPECT_IS_OK(module->updateAudioMode(mode)) << toString(mode);
+        if (isValidAudioMode(mode)) {
+            EXPECT_IS_OK(module->updateAudioMode(mode)) << toString(mode);
+        } else {
+            EXPECT_STATUS(EX_ILLEGAL_ARGUMENT, module->updateAudioMode(mode)) << toString(mode);
+        }
     }
     EXPECT_IS_OK(module->updateAudioMode(AudioMode::NORMAL));
 }
@@ -1882,6 +1891,51 @@
     }
 }
 
+TEST_P(AudioCoreModule, GetMmapPolicyInfos) {
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
+    for (const auto mmapPolicyType :
+         {AudioMMapPolicyType::DEFAULT, AudioMMapPolicyType::EXCLUSIVE}) {
+        std::vector<AudioMMapPolicyInfo> policyInfos;
+        EXPECT_IS_OK(module->getMmapPolicyInfos(mmapPolicyType, &policyInfos))
+                << toString(mmapPolicyType);
+        EXPECT_EQ(isMmapSupported, !policyInfos.empty());
+    }
+}
+
+TEST_P(AudioCoreModule, BluetoothVariableLatency) {
+    bool isSupported = false;
+    EXPECT_IS_OK(module->supportsVariableLatency(&isSupported));
+    LOG(INFO) << "supportsVariableLatency: " << isSupported;
+}
+
+TEST_P(AudioCoreModule, GetAAudioMixerBurstCount) {
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
+    int32_t mixerBursts = 0;
+    ndk::ScopedAStatus status = module->getAAudioMixerBurstCount(&mixerBursts);
+    EXPECT_EQ(isMmapSupported, status.getExceptionCode() != EX_UNSUPPORTED_OPERATION)
+            << "Support for AAudio MMAP and getting AAudio mixer burst count must be consistent";
+    if (!isMmapSupported) {
+        GTEST_SKIP() << "AAudio MMAP is not supported";
+    }
+    EXPECT_GE(mixerBursts, 0);
+}
+
+TEST_P(AudioCoreModule, GetAAudioHardwareBurstMinUsec) {
+    ASSERT_NO_FATAL_FAILURE(SetUpModuleConfig());
+    const bool isMmapSupported = moduleConfig->isMmapSupported();
+    int32_t aaudioHardwareBurstMinUsec = 0;
+    ndk::ScopedAStatus status = module->getAAudioHardwareBurstMinUsec(&aaudioHardwareBurstMinUsec);
+    EXPECT_EQ(isMmapSupported, status.getExceptionCode() != EX_UNSUPPORTED_OPERATION)
+            << "Support for AAudio MMAP and getting AAudio hardware burst minimum usec "
+            << "must be consistent";
+    if (!isMmapSupported) {
+        GTEST_SKIP() << "AAudio MMAP is not supported";
+    }
+    EXPECT_GE(aaudioHardwareBurstMinUsec, 0);
+}
+
 class AudioCoreBluetooth : public AudioCoreModuleBase, public testing::TestWithParam<std::string> {
   public:
     void SetUp() override {
@@ -1994,6 +2048,9 @@
     }
     std::vector<AudioMode> modes1;
     ASSERT_IS_OK(telephony->getSupportedAudioModes(&modes1));
+    for (const auto mode : modes1) {
+        EXPECT_TRUE(isValidAudioMode(mode)) << toString(mode);
+    }
     const std::vector<AudioMode> kMandatoryModes = {AudioMode::NORMAL, AudioMode::RINGTONE,
                                                     AudioMode::IN_CALL,
                                                     AudioMode::IN_COMMUNICATION};
@@ -2025,7 +2082,9 @@
         unsupportedModes.erase(mode);
     }
     for (const auto mode : unsupportedModes) {
-        EXPECT_STATUS(EX_UNSUPPORTED_OPERATION, telephony->switchAudioMode(mode)) << toString(mode);
+        EXPECT_STATUS(isValidAudioMode(mode) ? EX_UNSUPPORTED_OPERATION : EX_ILLEGAL_ARGUMENT,
+                      telephony->switchAudioMode(mode))
+                << toString(mode);
     }
 }
 
@@ -2314,7 +2373,7 @@
 
     void HwGainHwVolume() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, false /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2353,7 +2412,7 @@
     // it as an invalid argument, or say that offloaded effects are not supported.
     void AddRemoveEffectInvalidArguments() {
         const auto ports =
-                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, false /*attachedOnly*/);
+                moduleConfig->getMixPorts(IOTraits<Stream>::is_input, true /*attachedOnly*/);
         if (ports.empty()) {
             GTEST_SKIP() << "No mix ports";
         }
@@ -2634,7 +2693,7 @@
 }
 
 TEST_P(AudioStreamOut, AudioDescriptionMixLevel) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2662,7 +2721,7 @@
 }
 
 TEST_P(AudioStreamOut, DualMonoMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
@@ -2686,7 +2745,7 @@
 }
 
 TEST_P(AudioStreamOut, LatencyMode) {
-    const auto ports = moduleConfig->getOutputMixPorts(false /*attachedOnly*/);
+    const auto ports = moduleConfig->getOutputMixPorts(true /*attachedOnly*/);
     if (ports.empty()) {
         GTEST_SKIP() << "No output mix ports";
     }
diff --git a/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp b/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
index c5a0943..88bdd13 100644
--- a/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalAudioEffectTargetTest.cpp
@@ -590,12 +590,14 @@
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
 
     std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(close(mEffect));
     ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
@@ -617,20 +619,24 @@
     auto outputMQ = std::make_unique<EffectHelper::DataMQ>(ret.outputDataMQ);
     ASSERT_TRUE(outputMQ->isValid());
 
-    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
-    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
-    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
-    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
-    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
-    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
-
     std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
+    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
+    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
+    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
+    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 0, outputMQ, buffer.size(), buffer));
+    ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
+    ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
+
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(close(mEffect));
     ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
@@ -653,14 +659,14 @@
     ASSERT_TRUE(outputMQ->isValid());
 
     std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
 
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
@@ -686,31 +692,30 @@
     ASSERT_TRUE(outputMQ->isValid());
 
     std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
 
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
-    // expect no status and data after consume
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
-    // expect no status and data after consume
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(close(mEffect));
     ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
 }
 
-// Send data to IDLE state effects and expect it not be consumed.
-TEST_P(AudioEffectTest, NotConsumeDataInIdleState) {
+// Send data to processing state effects, stop, and restart.
+TEST_P(AudioEffectTest, ConsumeDataAndRestart) {
     ASSERT_NO_FATAL_FAILURE(create(mFactory, mEffect, mDescriptor));
 
     Parameter::Common common = EffectHelper::createParamCommon(
@@ -727,17 +732,21 @@
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
+    std::vector<float> buffer;
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
+
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
-
-    std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::START));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::PROCESSING));
-    EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer);
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ, 1, outputMQ, buffer.size(), buffer));
 
     ASSERT_NO_FATAL_FAILURE(command(mEffect, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(mEffect, State::IDLE));
@@ -765,9 +774,9 @@
     ASSERT_TRUE(outputMQ->isValid());
 
     std::vector<float> buffer;
-    EffectHelper::allocateInputData(common, inputMQ, buffer);
-    EffectHelper::writeToFmq(inputMQ, buffer);
-    EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common, inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ, buffer));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::readFromFmq(statusMQ, 0, outputMQ, 0, buffer));
 
     ASSERT_NO_FATAL_FAILURE(destroy(mFactory, mEffect));
 }
@@ -800,9 +809,10 @@
     ASSERT_TRUE(outputMQ1->isValid());
 
     std::vector<float> buffer1, buffer2;
-    EffectHelper::allocateInputData(common1, inputMQ1, buffer1);
-    EffectHelper::writeToFmq(inputMQ1, buffer1);
-    EffectHelper::readFromFmq(statusMQ1, 1, outputMQ1, buffer1.size(), buffer1);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common1, inputMQ1, buffer1));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ1, buffer1));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ1, 1, outputMQ1, buffer1.size(), buffer1));
 
     auto statusMQ2 = std::make_unique<EffectHelper::StatusMQ>(ret2.statusMQ);
     ASSERT_TRUE(statusMQ2->isValid());
@@ -810,9 +820,10 @@
     ASSERT_TRUE(inputMQ2->isValid());
     auto outputMQ2 = std::make_unique<EffectHelper::DataMQ>(ret2.outputDataMQ);
     ASSERT_TRUE(outputMQ2->isValid());
-    EffectHelper::allocateInputData(common2, inputMQ2, buffer2);
-    EffectHelper::writeToFmq(inputMQ2, buffer2);
-    EffectHelper::readFromFmq(statusMQ2, 1, outputMQ2, buffer2.size(), buffer2);
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::allocateInputData(common2, inputMQ2, buffer2));
+    EXPECT_NO_FATAL_FAILURE(EffectHelper::writeToFmq(inputMQ2, buffer2));
+    EXPECT_NO_FATAL_FAILURE(
+            EffectHelper::readFromFmq(statusMQ2, 1, outputMQ2, buffer2.size(), buffer2));
 
     ASSERT_NO_FATAL_FAILURE(command(effect1, CommandId::STOP));
     ASSERT_NO_FATAL_FAILURE(expectState(effect1, State::IDLE));
diff --git a/audio/aidl/vts/VtsHalNSTargetTest.cpp b/audio/aidl/vts/VtsHalNSTargetTest.cpp
index 93ad86d..0b92290 100644
--- a/audio/aidl/vts/VtsHalNSTargetTest.cpp
+++ b/audio/aidl/vts/VtsHalNSTargetTest.cpp
@@ -34,13 +34,14 @@
 using aidl::android::hardware::audio::effect::NoiseSuppression;
 using aidl::android::hardware::audio::effect::Parameter;
 
-enum ParamName { PARAM_INSTANCE_NAME, PARAM_LEVEL };
-using NSParamTestParam =
-        std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>, NoiseSuppression::Level>;
+enum ParamName { PARAM_INSTANCE_NAME, PARAM_LEVEL, PARAM_TYPE };
+using NSParamTestParam = std::tuple<std::pair<std::shared_ptr<IFactory>, Descriptor>,
+                                    NoiseSuppression::Level, NoiseSuppression::Type>;
 
 class NSParamTest : public ::testing::TestWithParam<NSParamTestParam>, public EffectHelper {
   public:
-    NSParamTest() : mLevel(std::get<PARAM_LEVEL>(GetParam())) {
+    NSParamTest()
+        : mLevel(std::get<PARAM_LEVEL>(GetParam())), mType(std::get<PARAM_TYPE>(GetParam())) {
         std::tie(mFactory, mDescriptor) = std::get<PARAM_INSTANCE_NAME>(GetParam());
     }
 
@@ -75,6 +76,7 @@
     std::shared_ptr<IEffect> mEffect;
     Descriptor mDescriptor;
     NoiseSuppression::Level mLevel;
+    NoiseSuppression::Type mType;
 
     void SetAndGetParameters() {
         for (auto& it : mTags) {
@@ -113,10 +115,19 @@
         ns.set<NoiseSuppression::level>(level);
         mTags.push_back({NoiseSuppression::level, ns});
     }
+    void addTypeParam(NoiseSuppression::Type type) {
+        NoiseSuppression ns;
+        ns.set<NoiseSuppression::type>(type);
+        mTags.push_back({NoiseSuppression::type, ns});
+    }
     static std::unordered_set<NoiseSuppression::Level> getLevelValues() {
         return {ndk::enum_range<NoiseSuppression::Level>().begin(),
                 ndk::enum_range<NoiseSuppression::Level>().end()};
     }
+    static std::unordered_set<NoiseSuppression::Type> getTypeValues() {
+        return {ndk::enum_range<NoiseSuppression::Type>().begin(),
+                ndk::enum_range<NoiseSuppression::Type>().end()};
+    }
 
   private:
     std::vector<std::pair<NoiseSuppression::Tag, NoiseSuppression>> mTags;
@@ -128,18 +139,27 @@
     SetAndGetParameters();
 }
 
+TEST_P(NSParamTest, SetAndGetType) {
+    EXPECT_NO_FATAL_FAILURE(addLevelParam(mLevel));
+    SetAndGetParameters();
+}
+
 INSTANTIATE_TEST_SUITE_P(
         NSParamTest, NSParamTest,
         ::testing::Combine(testing::ValuesIn(EffectFactoryHelper::getAllEffectDescriptors(
                                    IFactory::descriptor, kNoiseSuppressionTypeUUID)),
-                           testing::ValuesIn(NSParamTest::getLevelValues())),
+                           testing::ValuesIn(NSParamTest::getLevelValues()),
+                           testing::ValuesIn(NSParamTest::getTypeValues())),
         [](const testing::TestParamInfo<NSParamTest::ParamType>& info) {
             auto descriptor = std::get<PARAM_INSTANCE_NAME>(info.param).second;
             std::string level = aidl::android::hardware::audio::effect::toString(
                     std::get<PARAM_LEVEL>(info.param));
+            std::string type = aidl::android::hardware::audio::effect::toString(
+                    std::get<PARAM_TYPE>(info.param));
             std::string name = "Implementor_" + descriptor.common.implementor + "_name_" +
                                descriptor.common.name + "_UUID_" +
-                               descriptor.common.id.uuid.toString() + "_level_" + level;
+                               descriptor.common.id.uuid.toString() + "_level_" + level + "_type_" +
+                               type;
             std::replace_if(
                     name.begin(), name.end(), [](const char c) { return !std::isalnum(c); }, '_');
             return name;
diff --git a/audio/effect/all-versions/default/Effect.cpp b/audio/effect/all-versions/default/Effect.cpp
index 87e1ab7..5aecd32 100644
--- a/audio/effect/all-versions/default/Effect.cpp
+++ b/audio/effect/all-versions/default/Effect.cpp
@@ -240,16 +240,6 @@
 };
 
 bool ProcessThread::threadLoop() {
-    // For a spatializer effect, we perform scheduler adjustments to reduce glitches and power.
-    {
-        effect_descriptor_t halDescriptor{};
-        if ((*mEffect)->get_descriptor(mEffect, &halDescriptor) == NO_ERROR &&
-            memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
-            const status_t status = scheduler::updateSpatializerPriority(gettid());
-            ALOGW_IF(status != OK, "Failed to update Spatializer priority");
-        }
-    }
-
     // This implementation doesn't return control back to the Thread until it decides to stop,
     // as the Thread uses mutexes, and this can lead to priority inversion.
     while (!std::atomic_load_explicit(mStop, std::memory_order_acquire)) {
@@ -570,6 +560,15 @@
         return Void();
     }
 
+    // For a spatializer effect, we perform scheduler adjustments to reduce glitches and power.
+    // We do it here instead of the ProcessThread::threadLoop to ensure that mHandle is valid.
+    if (effect_descriptor_t halDescriptor{};
+        (*mHandle)->get_descriptor(mHandle, &halDescriptor) == NO_ERROR &&
+        memcmp(&halDescriptor.type, FX_IID_SPATIALIZER, sizeof(effect_uuid_t)) == 0) {
+        const status_t status = scheduler::updateSpatializerPriority(mProcessThread->getTid());
+        ALOGW_IF(status != OK, "Failed to update Spatializer priority");
+    }
+
     mStatusMQ = std::move(tempStatusMQ);
     _hidl_cb(Result::OK, *mStatusMQ->getDesc());
     return Void();
diff --git a/automotive/can/1.0/tools/configurator/Android.bp b/automotive/can/1.0/tools/configurator/Android.bp
index cc826bc..883d2a9 100644
--- a/automotive/can/1.0/tools/configurator/Android.bp
+++ b/automotive/can/1.0/tools/configurator/Android.bp
@@ -40,4 +40,5 @@
         "android.hardware.automotive.can@1.x-config-format",
         "android.hardware.automotive.can@libcanhaltools",
     ],
+    system_ext_specific: true,
 }
diff --git a/automotive/can/1.0/tools/configurator/canhalconfigurator.rc b/automotive/can/1.0/tools/configurator/canhalconfigurator.rc
index 12c2465..ff0efd7 100644
--- a/automotive/can/1.0/tools/configurator/canhalconfigurator.rc
+++ b/automotive/can/1.0/tools/configurator/canhalconfigurator.rc
@@ -1,3 +1,3 @@
-service canhalconfigurator /system/bin/canhalconfigurator
+service canhalconfigurator /system_ext/bin/canhalconfigurator
   class core
   oneshot
diff --git a/bluetooth/aidl/TEST_MAPPING b/bluetooth/aidl/TEST_MAPPING
new file mode 100644
index 0000000..342a1e4
--- /dev/null
+++ b/bluetooth/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit" : [
+    {
+      "name" : "VtsHalBluetoothTargetTest"
+    }
+  ]
+}
diff --git a/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHci.aidl b/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHci.aidl
index db12986..ff1f735 100644
--- a/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHci.aidl
+++ b/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHci.aidl
@@ -35,6 +35,9 @@
 
     /**
      * Initialize the Bluetooth interface and set the callbacks.
+     * Only one client can initialize the interface at a time.  When a
+     * call to initialize fails, the Status parameter of the callback
+     * will indicate the reason for the failure.
      */
     void initialize(in IBluetoothHciCallbacks callback);
 
diff --git a/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.aidl b/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.aidl
index 000333e..0148c6f 100644
--- a/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.aidl
+++ b/bluetooth/aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.aidl
@@ -39,6 +39,8 @@
     /**
      * Invoked when the Bluetooth controller initialization has been
      * completed.
+     * @param status contains a return code indicating success, or the
+     *               reason the initialization failed.
      */
     void initializationComplete(in Status status);
 
diff --git a/bluetooth/aidl/default/Android.bp b/bluetooth/aidl/default/Android.bp
index d1761f5..32d1a13 100644
--- a/bluetooth/aidl/default/Android.bp
+++ b/bluetooth/aidl/default/Android.bp
@@ -30,6 +30,14 @@
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
         "BluetoothHci.cpp",
+        ":BluetoothPacketSources",
+        "net_bluetooth_mgmt.cpp",
+    ],
+    generated_headers: [
+        "BluetoothGeneratedPackets_h",
+    ],
+    include_dirs: [
+        "packages/modules/Bluetooth/system/gd",
     ],
 }
 
@@ -37,7 +45,7 @@
     name: "android.hardware.bluetooth-service.default",
     relative_install_path: "hw",
     init_rc: ["bluetooth-service-default.rc"],
-    vintf_fragments: ["bluetooth-service-default.xml"],
+    vintf_fragments: [":manifest_android.hardware.bluetooth-service.default.xml"],
     vendor: true,
     defaults: ["android.hardware.bluetooth-service-build-defaults"],
     srcs: [
@@ -77,3 +85,8 @@
         ],
     },
 }
+
+filegroup {
+    name: "manifest_android.hardware.bluetooth-service.default.xml",
+    srcs: ["bluetooth-service-default.xml"],
+}
diff --git a/bluetooth/aidl/default/BluetoothHci.cpp b/bluetooth/aidl/default/BluetoothHci.cpp
index 4d4896d..d4e4b34 100644
--- a/bluetooth/aidl/default/BluetoothHci.cpp
+++ b/bluetooth/aidl/default/BluetoothHci.cpp
@@ -29,6 +29,11 @@
 
 #include "log/log.h"
 
+// TODO: Remove custom logging defines from PDL packets.
+#undef LOG_INFO
+#undef LOG_DEBUG
+#include "hci/hci_packets.h"
+
 namespace {
 int SetTerminalRaw(int fd) {
   termios terminal_settings;
@@ -44,6 +49,7 @@
 
 using namespace ::android::hardware::bluetooth::hci;
 using namespace ::android::hardware::bluetooth::async;
+using aidl::android::hardware::bluetooth::Status;
 
 namespace aidl::android::hardware::bluetooth::impl {
 
@@ -73,15 +79,22 @@
       ALOGE("BluetoothDeathRecipient::serviceDied called but service not dead");
       return;
     }
-    has_died_ = true;
+    {
+      std::lock_guard<std::mutex> guard(mHasDiedMutex);
+      has_died_ = true;
+    }
     mHci->close();
   }
   BluetoothHci* mHci;
   std::shared_ptr<IBluetoothHciCallbacks> mCb;
   AIBinder_DeathRecipient* clientDeathRecipient_;
-  bool getHasDied() const { return has_died_; }
+  bool getHasDied() {
+    std::lock_guard<std::mutex> guard(mHasDiedMutex);
+    return has_died_;
+  }
 
  private:
+  std::mutex mHasDiedMutex;
   bool has_died_{false};
 };
 
@@ -97,54 +110,145 @@
   mDeathRecipient = std::make_shared<BluetoothDeathRecipient>(this);
 }
 
-ndk::ScopedAStatus BluetoothHci::initialize(
-    const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
-  ALOGI(__func__);
-
-  mFd = open(mDevPath.c_str(), O_RDWR);
-  if (mFd < 0) {
+int BluetoothHci::getFdFromDevPath() {
+  int fd = open(mDevPath.c_str(), O_RDWR);
+  if (fd < 0) {
     ALOGE("Could not connect to bt: %s (%s)", mDevPath.c_str(),
           strerror(errno));
-    return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    return fd;
   }
   if (int ret = SetTerminalRaw(mFd) < 0) {
     ALOGE("Could not make %s a raw terminal %d(%s)", mDevPath.c_str(), ret,
           strerror(errno));
-    return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
+    ::close(fd);
+    return -1;
+  }
+  return fd;
+}
+
+void BluetoothHci::reset() {
+  // Send a reset command and wait until the command complete comes back.
+
+  std::vector<uint8_t> reset;
+  ::bluetooth::packet::BitInserter bi{reset};
+  ::bluetooth::hci::ResetBuilder::Create()->Serialize(bi);
+
+  auto resetPromise = std::make_shared<std::promise<void>>();
+  auto resetFuture = resetPromise->get_future();
+
+  mH4 = std::make_shared<H4Protocol>(
+      mFd,
+      [](const std::vector<uint8_t>& raw_command) {
+        ALOGI("Discarding %d bytes with command type",
+              static_cast<int>(raw_command.size()));
+      },
+      [](const std::vector<uint8_t>& raw_acl) {
+        ALOGI("Discarding %d bytes with acl type",
+              static_cast<int>(raw_acl.size()));
+      },
+      [](const std::vector<uint8_t>& raw_sco) {
+        ALOGI("Discarding %d bytes with sco type",
+              static_cast<int>(raw_sco.size()));
+      },
+      [resetPromise](const std::vector<uint8_t>& raw_event) {
+        bool valid = ::bluetooth::hci::ResetCompleteView::Create(
+                         ::bluetooth::hci::CommandCompleteView::Create(
+                             ::bluetooth::hci::EventView::Create(
+                                 ::bluetooth::hci::PacketView<true>(
+                                     std::make_shared<std::vector<uint8_t>>(
+                                         raw_event)))))
+                         .IsValid();
+        if (valid) {
+          resetPromise->set_value();
+        } else {
+          ALOGI("Discarding %d bytes with event type",
+                static_cast<int>(raw_event.size()));
+        }
+      },
+      [](const std::vector<uint8_t>& raw_iso) {
+        ALOGI("Discarding %d bytes with iso type",
+              static_cast<int>(raw_iso.size()));
+      },
+      [this]() {
+        ALOGI("HCI socket device disconnected while waiting for reset");
+        mFdWatcher.StopWatchingFileDescriptors();
+      });
+  mFdWatcher.WatchFdForNonBlockingReads(mFd,
+                                        [this](int) { mH4->OnDataReady(); });
+
+  send(PacketType::COMMAND, reset);
+  auto status = resetFuture.wait_for(std::chrono::seconds(1));
+  mFdWatcher.StopWatchingFileDescriptors();
+  if (status == std::future_status::ready) {
+    ALOGI("HCI Reset successful");
+  } else {
+    ALOGE("HCI Reset Response not received in one second");
   }
 
-  mCb = cb;
-  if (mCb == nullptr) {
+  resetPromise.reset();
+}
+
+ndk::ScopedAStatus BluetoothHci::initialize(
+    const std::shared_ptr<IBluetoothHciCallbacks>& cb) {
+  ALOGI(__func__);
+
+  if (cb == nullptr) {
     ALOGE("cb == nullptr! -> Unable to call initializationComplete(ERR)");
     return ndk::ScopedAStatus::fromServiceSpecificError(STATUS_BAD_VALUE);
   }
 
+  HalState old_state = HalState::READY;
+  {
+    std::lock_guard<std::mutex> guard(mStateMutex);
+    if (mState != HalState::READY) {
+      old_state = mState;
+    } else {
+      mState = HalState::INITIALIZING;
+    }
+  }
+
+  if (old_state != HalState::READY) {
+    ALOGE("initialize: Unexpected State %d", static_cast<int>(old_state));
+    close();
+    cb->initializationComplete(Status::ALREADY_INITIALIZED);
+    return ndk::ScopedAStatus::ok();
+  }
+
+  mCb = cb;
+  management_.reset(new NetBluetoothMgmt);
+  mFd = management_->openHci();
+  if (mFd < 0) {
+    management_.reset();
+
+    ALOGI("Unable to open Linux interface, trying default path.");
+    mFd = getFdFromDevPath();
+    if (mFd < 0) {
+      cb->initializationComplete(Status::UNABLE_TO_OPEN_INTERFACE);
+      return ndk::ScopedAStatus::ok();
+    }
+  }
+
   mDeathRecipient->LinkToDeath(mCb);
 
-  auto init_ret = cb->initializationComplete(Status::SUCCESS);
-  if (!init_ret.isOk()) {
-    if (!mDeathRecipient->getHasDied()) {
-      ALOGE("Error sending init callback, but no death notification.");
-    }
-    return ndk::ScopedAStatus::fromServiceSpecificError(
-        STATUS_FAILED_TRANSACTION);
-  }
+  // TODO: This should not be necessary when the device implements rfkill.
+  reset();
+
   mH4 = std::make_shared<H4Protocol>(
       mFd,
       [](const std::vector<uint8_t>& /* raw_command */) {
         LOG_ALWAYS_FATAL("Unexpected command!");
       },
+      [this](const std::vector<uint8_t>& raw_acl) {
+        mCb->aclDataReceived(raw_acl);
+      },
+      [this](const std::vector<uint8_t>& raw_sco) {
+        mCb->scoDataReceived(raw_sco);
+      },
       [this](const std::vector<uint8_t>& raw_event) {
         mCb->hciEventReceived(raw_event);
       },
-      [this](const std::vector<uint8_t>& raw_acl) {
-        mCb->hciEventReceived(raw_acl);
-      },
-      [this](const std::vector<uint8_t>& raw_sco) {
-        mCb->hciEventReceived(raw_sco);
-      },
       [this](const std::vector<uint8_t>& raw_iso) {
-        mCb->hciEventReceived(raw_iso);
+        mCb->isoDataReceived(raw_iso);
       },
       [this]() {
         ALOGI("HCI socket device disconnected");
@@ -152,14 +256,48 @@
       });
   mFdWatcher.WatchFdForNonBlockingReads(mFd,
                                         [this](int) { mH4->OnDataReady(); });
+
+  {
+    std::lock_guard<std::mutex> guard(mStateMutex);
+    mState = HalState::ONE_CLIENT;
+  }
+  ALOGI("initialization complete");
+  auto status = mCb->initializationComplete(Status::SUCCESS);
+  if (!status.isOk()) {
+    if (!mDeathRecipient->getHasDied()) {
+      ALOGE("Error sending init callback, but no death notification");
+    }
+    close();
+    return ndk::ScopedAStatus::fromServiceSpecificError(
+        STATUS_FAILED_TRANSACTION);
+  }
+
   return ndk::ScopedAStatus::ok();
 }
 
 ndk::ScopedAStatus BluetoothHci::close() {
   ALOGI(__func__);
-  mFdWatcher.StopWatchingFileDescriptors();
-  ::close(mFd);
+  {
+    std::lock_guard<std::mutex> guard(mStateMutex);
+    if (mState != HalState::ONE_CLIENT) {
+      ALOGI("Already closed");
+      return ndk::ScopedAStatus::ok();
+    }
+    mState = HalState::CLOSING;
+  }
 
+  mFdWatcher.StopWatchingFileDescriptors();
+
+  if (management_) {
+    management_->closeHci();
+  } else {
+    ::close(mFd);
+  }
+
+  {
+    std::lock_guard<std::mutex> guard(mStateMutex);
+    mState = HalState::READY;
+  }
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/aidl/default/BluetoothHci.h b/bluetooth/aidl/default/BluetoothHci.h
index 0ed0623..85aafc8 100644
--- a/bluetooth/aidl/default/BluetoothHci.h
+++ b/bluetooth/aidl/default/BluetoothHci.h
@@ -18,12 +18,13 @@
 
 #include <aidl/android/hardware/bluetooth/BnBluetoothHci.h>
 #include <aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.h>
-#include <log/log.h>
 
+#include <future>
 #include <string>
 
 #include "async_fd_watcher.h"
 #include "h4_protocol.h"
+#include "net_bluetooth_mgmt.h"
 
 namespace aidl::android::hardware::bluetooth::impl {
 
@@ -64,8 +65,22 @@
 
   ::android::hardware::bluetooth::async::AsyncFdWatcher mFdWatcher;
 
+  int getFdFromDevPath();
   void send(::android::hardware::bluetooth::hci::PacketType type,
             const std::vector<uint8_t>& packet);
+  std::unique_ptr<NetBluetoothMgmt> management_{};
+
+  // Send a reset command and discard all packets until a reset is received.
+  void reset();
+
+  // Don't close twice or open before close is complete
+  std::mutex mStateMutex;
+  enum class HalState {
+    READY,
+    INITIALIZING,
+    ONE_CLIENT,
+    CLOSING,
+  } mState{HalState::READY};
 };
 
 }  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/bluetooth-service-default.rc b/bluetooth/aidl/default/bluetooth-service-default.rc
index 1841c77..dc78698 100644
--- a/bluetooth/aidl/default/bluetooth-service-default.rc
+++ b/bluetooth/aidl/default/bluetooth-service-default.rc
@@ -1,4 +1,4 @@
-service bluetooth_hal_service /vendor/bin/hw/android.hardware.bluetooth-service.default
+service vendor.bluetooth-default /vendor/bin/hw/android.hardware.bluetooth-service.default
     class hal
     capabilities BLOCK_SUSPEND NET_ADMIN SYS_NICE
     user bluetooth
diff --git a/bluetooth/aidl/default/net_bluetooth_mgmt.cpp b/bluetooth/aidl/default/net_bluetooth_mgmt.cpp
new file mode 100644
index 0000000..937cd57
--- /dev/null
+++ b/bluetooth/aidl/default/net_bluetooth_mgmt.cpp
@@ -0,0 +1,296 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.bluetooth.service.default"
+
+#include "net_bluetooth_mgmt.h"
+
+#include <fcntl.h>
+#include <log/log.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include <cerrno>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+// Definitions imported from <linux/net/bluetooth/bluetooth.h>
+#define BTPROTO_HCI 1
+
+// Definitions imported from <linux/net/bluetooth/hci_sock.h>
+#define HCI_CHANNEL_USER 1
+#define HCI_CHANNEL_CONTROL 3
+#define HCI_DEV_NONE 0xffff
+
+struct sockaddr_hci {
+  sa_family_t hci_family;
+  unsigned short hci_dev;
+  unsigned short hci_channel;
+};
+
+// Definitions imported from <linux/net/bluetooth/mgmt.h>
+#define MGMT_OP_READ_INDEX_LIST 0x0003
+#define MGMT_EV_INDEX_ADDED 0x0004
+#define MGMT_EV_CMD_COMPLETE 0x0001
+#define MGMT_PKT_SIZE_MAX 1024
+#define MGMT_INDEX_NONE 0xFFFF
+
+struct mgmt_pkt {
+  uint16_t opcode;
+  uint16_t index;
+  uint16_t len;
+  uint8_t data[MGMT_PKT_SIZE_MAX];
+} __attribute__((packed));
+
+struct mgmt_ev_read_index_list {
+  uint16_t opcode;
+  uint8_t status;
+  uint16_t num_controllers;
+  uint16_t index[];
+} __attribute__((packed));
+
+// Definitions imported from <linux/rfkill.h>
+#define RFKILL_STATE_SOFT_BLOCKED 0
+#define RFKILL_STATE_UNBLOCKED 1
+#define RFKILL_STATE_HARD_BLOCKED 2
+
+#define RFKILL_TYPE_BLUETOOTH 2
+
+#define RFKILL_OP_ADD 0
+#define RFKILL_OP_CHANGE 2
+
+struct rfkill_event {
+  uint32_t idx;
+  uint8_t type;
+  uint8_t op;
+  uint8_t soft;
+  uint8_t hard;
+} __attribute__((packed));
+
+namespace aidl::android::hardware::bluetooth::impl {
+
+// Wait indefinitely for the selected HCI interface to be enabled in the
+// bluetooth driver.
+int NetBluetoothMgmt::waitHciDev(int hci_interface) {
+  ALOGI("waiting for hci interface %d", hci_interface);
+
+  int ret = -1;
+  struct mgmt_pkt cmd;
+  struct pollfd pollfd;
+  struct sockaddr_hci hci_addr = {
+      .hci_family = AF_BLUETOOTH,
+      .hci_dev = HCI_DEV_NONE,
+      .hci_channel = HCI_CHANNEL_CONTROL,
+  };
+
+  // Open and bind a socket to the bluetooth control interface in the
+  // kernel driver, used to send control commands and receive control
+  // events.
+  int fd = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+  if (fd < 0) {
+    ALOGE("unable to open raw bluetooth socket: %s", strerror(errno));
+    return -1;
+  }
+
+  if (bind(fd, (struct sockaddr*)&hci_addr, sizeof(hci_addr)) < 0) {
+    ALOGE("unable to bind bluetooth control channel: %s", strerror(errno));
+    goto end;
+  }
+
+  // Send the control command [Read Index List].
+  cmd = {
+      .opcode = MGMT_OP_READ_INDEX_LIST,
+      .index = MGMT_INDEX_NONE,
+      .len = 0,
+  };
+
+  if (write(fd, &cmd, 6) != 6) {
+    ALOGE("error writing mgmt command: %s", strerror(errno));
+    goto end;
+  }
+
+  // Poll the control socket waiting for the command response,
+  // and subsequent [Index Added] events. The loops continue without
+  // timeout until the selected hci interface is detected.
+  pollfd = {.fd = fd, .events = POLLIN};
+
+  for (;;) {
+    ret = poll(&pollfd, 1, -1);
+
+    // Poll interrupted, try again.
+    if (ret == -1 && (errno == EINTR || errno == EAGAIN)) {
+      continue;
+    }
+
+    // Poll failure, abandon.
+    if (ret == -1) {
+      ALOGE("poll error: %s", strerror(errno));
+      break;
+    }
+
+    // Spurious wakeup, try again.
+    if (ret == 0 || (pollfd.revents & POLLIN) == 0) {
+      continue;
+    }
+
+    // Read the next control event.
+    struct mgmt_pkt ev {};
+    ret = read(fd, &ev, sizeof(ev));
+    if (ret < 0) {
+      ALOGE("error reading mgmt event: %s", strerror(errno));
+      goto end;
+    }
+
+    // Received [Read Index List] command response.
+    if (ev.opcode == MGMT_EV_CMD_COMPLETE) {
+      struct mgmt_ev_read_index_list* data =
+          (struct mgmt_ev_read_index_list*)ev.data;
+
+      for (int i = 0; i < data->num_controllers; i++) {
+        if (data->index[i] == hci_interface) {
+          ALOGI("hci interface %d found", hci_interface);
+          ret = 0;
+          goto end;
+        }
+      }
+    }
+
+    // Received [Index Added] event.
+    if (ev.opcode == MGMT_EV_INDEX_ADDED && ev.index == hci_interface) {
+      ALOGI("hci interface %d added", hci_interface);
+      ret = 0;
+      goto end;
+    }
+  }
+
+end:
+  ::close(fd);
+  return ret;
+}
+
+int NetBluetoothMgmt::openRfkill() {
+  int fd = open("/dev/rfkill", O_RDWR);
+  if (fd < 0) {
+    ALOGE("unable to open /dev/rfkill: %s", strerror(errno));
+    return -1;
+  }
+
+  if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) {
+    ALOGE("unable to set rfkill control device to non-blocking: %s",
+          strerror(errno));
+    ::close(fd);
+    return -1;
+  }
+
+  for (;;) {
+    struct rfkill_event event {};
+    ssize_t res = read(fd, &event, sizeof(event));
+    if (res < 0) {
+      ALOGE("error reading rfkill events: %s", strerror(errno));
+      break;
+    }
+
+    ALOGI("index:%d type:%d op:%d", event.idx, event.type, event.op);
+
+    if (event.op == RFKILL_OP_ADD && event.type == RFKILL_TYPE_BLUETOOTH) {
+      rfkill_bt_index_ = event.idx;
+      rfkill_fd_ = fd;
+      return 0;
+    }
+  }
+
+  ::close(fd);
+  return -1;
+}
+
+// Block or unblock Bluetooth.
+int NetBluetoothMgmt::rfkill(int block) {
+  if (rfkill_fd_ == -1) {
+    openRfkill();
+  }
+
+  if (rfkill_fd_ == -1) {
+    ALOGE("rfkill unavailable");
+    return -1;
+  }
+
+  struct rfkill_event event = {
+      .idx = static_cast<uint32_t>(rfkill_bt_index_),
+      .type = RFKILL_TYPE_BLUETOOTH,
+      .op = RFKILL_OP_CHANGE,
+      .soft = static_cast<uint8_t>(block),
+      .hard = 0,
+  };
+
+  int res = write(rfkill_fd_, &event, sizeof(event));
+  if (res < 0) {
+    ALOGE("error writing rfkill command: %s", strerror(errno));
+    return -1;
+  }
+
+  return 0;
+}
+
+int NetBluetoothMgmt::openHci(int hci_interface) {
+  ALOGI("opening hci interface %d", hci_interface);
+
+  // Block Bluetooth.
+  rfkill(1);
+
+  // Wait for the HCI interface to complete initialization or to come online.
+  if (waitHciDev(hci_interface)) {
+    ALOGE("hci interface %d not found", hci_interface);
+    return -1;
+  }
+
+  // Open the raw HCI socket.
+  int fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
+  if (fd < 0) {
+    ALOGE("unable to open raw bluetooth socket: %s", strerror(errno));
+    return -1;
+  }
+
+  struct sockaddr_hci hci_addr = {
+      .hci_family = AF_BLUETOOTH,
+      .hci_dev = static_cast<uint16_t>(hci_interface),
+      .hci_channel = HCI_CHANNEL_USER,
+  };
+
+  // Bind the socket to the selected interface.
+  if (bind(fd, (struct sockaddr*)&hci_addr, sizeof(hci_addr)) < 0) {
+    ALOGE("unable to bind bluetooth user channel: %s", strerror(errno));
+    ::close(fd);
+    return -1;
+  }
+
+  ALOGI("hci interface %d ready", hci_interface);
+  bt_fd_ = fd;
+  return fd;
+}
+
+void NetBluetoothMgmt::closeHci() {
+  if (bt_fd_ != -1) {
+    ::close(bt_fd_);
+    bt_fd_ = -1;
+  }
+
+  // Unblock Bluetooth.
+  rfkill(0);
+}
+
+}  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/default/net_bluetooth_mgmt.h b/bluetooth/aidl/default/net_bluetooth_mgmt.h
new file mode 100644
index 0000000..5c473f2
--- /dev/null
+++ b/bluetooth/aidl/default/net_bluetooth_mgmt.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unistd.h>
+
+namespace aidl::android::hardware::bluetooth::impl {
+
+class NetBluetoothMgmt {
+ public:
+  NetBluetoothMgmt() {}
+  ~NetBluetoothMgmt() {
+    ::close(rfkill_fd_);
+    ::close(bt_fd_);
+  }
+
+  int openHci(int hci_interface = 0);
+  void closeHci();
+
+ private:
+  int waitHciDev(int hci_interface);
+  int openRfkill();
+  int rfkill(int block);
+
+  // Index of the first rfkill device of type bluetooth.
+  int rfkill_bt_index_{-1};
+  // File descriptor opened to /dev/rfkill.
+  int rfkill_fd_{-1};
+  // File descriptor opened to the bluetooth user channel.
+  int bt_fd_{-1};
+};
+
+}  // namespace aidl::android::hardware::bluetooth::impl
diff --git a/bluetooth/aidl/vts/Android.bp b/bluetooth/aidl/vts/Android.bp
new file mode 100644
index 0000000..414f707
--- /dev/null
+++ b/bluetooth/aidl/vts/Android.bp
@@ -0,0 +1,48 @@
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsHalBluetoothTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: ["VtsHalBluetoothTargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+    ],
+    static_libs: [
+        "android.hardware.bluetooth-V1-ndk",
+        "libbluetooth-types",
+    ],
+    test_config: "VtsHalBluetoothTargetTest.xml",
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+    tidy: true,
+    tidy_checks: [
+        "-*",
+        "readability-inconsistent-declaration-parameter-name",
+        "readability-*",
+        "-readability-function-size",
+        "-readability-identifier-length",
+        "-readability-implicit-bool-conversion",
+        "-readability-magic-numbers",
+        "-readability-use-anyofallof",
+    ],
+    tidy_checks_as_errors: [
+        "readability-*",
+    ],
+    tidy_flags: [
+        "--header-filter=^.*tools\\/rootcanal\\/(model|include|net|desktop)\\/(.(?!\\.pb\\.h))*$",
+    ],
+}
diff --git a/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp
new file mode 100644
index 0000000..3704c3d
--- /dev/null
+++ b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.cpp
@@ -0,0 +1,924 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/bluetooth/BnBluetoothHciCallbacks.h>
+#include <aidl/android/hardware/bluetooth/IBluetoothHci.h>
+#include <aidl/android/hardware/bluetooth/IBluetoothHciCallbacks.h>
+#include <aidl/android/hardware/bluetooth/Status.h>
+#include <android/binder_auto_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <binder/IServiceManager.h>
+#include <binder/ProcessState.h>
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <future>
+#include <mutex>
+#include <queue>
+#include <thread>
+#include <vector>
+
+using aidl::android::hardware::bluetooth::IBluetoothHci;
+using aidl::android::hardware::bluetooth::IBluetoothHciCallbacks;
+using aidl::android::hardware::bluetooth::Status;
+using ndk::ScopedAStatus;
+using ndk::SpAIBinder;
+
+// Bluetooth Core Specification 3.0 + HS
+static constexpr uint8_t kHciMinimumHciVersion = 5;
+// Bluetooth Core Specification 3.0 + HS
+static constexpr uint8_t kHciMinimumLmpVersion = 5;
+
+static constexpr size_t kNumHciCommandsBandwidth = 100;
+static constexpr size_t kNumScoPacketsBandwidth = 100;
+static constexpr size_t kNumAclPacketsBandwidth = 100;
+static constexpr std::chrono::milliseconds kWaitForInitTimeout(2000);
+static constexpr std::chrono::milliseconds kWaitForHciEventTimeout(2000);
+static constexpr std::chrono::milliseconds kWaitForScoDataTimeout(1000);
+static constexpr std::chrono::milliseconds kWaitForAclDataTimeout(1000);
+static constexpr std::chrono::milliseconds kInterfaceCloseDelayMs(200);
+
+static constexpr uint8_t kCommandHciShouldBeUnknown[] = {
+    0xff, 0x3B, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07};
+static constexpr uint8_t kCommandHciReadLocalVersionInformation[] = {0x01, 0x10,
+                                                                     0x00};
+static constexpr uint8_t kCommandHciReadBufferSize[] = {0x05, 0x10, 0x00};
+static constexpr uint8_t kCommandHciWriteLoopbackModeLocal[] = {0x02, 0x18,
+                                                                0x01, 0x01};
+static constexpr uint8_t kCommandHciReset[] = {0x03, 0x0c, 0x00};
+static constexpr uint8_t kCommandHciSynchronousFlowControlEnable[] = {
+    0x2f, 0x0c, 0x01, 0x01};
+static constexpr uint8_t kCommandHciWriteLocalName[] = {0x13, 0x0c, 0xf8};
+static constexpr uint8_t kHciStatusSuccess = 0x00;
+static constexpr uint8_t kHciStatusUnknownHciCommand = 0x01;
+
+static constexpr uint8_t kEventConnectionComplete = 0x03;
+static constexpr uint8_t kEventCommandComplete = 0x0e;
+static constexpr uint8_t kEventCommandStatus = 0x0f;
+static constexpr uint8_t kEventNumberOfCompletedPackets = 0x13;
+static constexpr uint8_t kEventLoopbackCommand = 0x19;
+
+static constexpr size_t kEventCodeByte = 0;
+static constexpr size_t kEventLengthByte = 1;
+static constexpr size_t kEventFirstPayloadByte = 2;
+static constexpr size_t kEventCommandStatusStatusByte = 2;
+static constexpr size_t kEventCommandStatusOpcodeLsByte = 4;    // Bytes 4 and 5
+static constexpr size_t kEventCommandCompleteOpcodeLsByte = 3;  // Bytes 3 and 4
+static constexpr size_t kEventCommandCompleteStatusByte = 5;
+static constexpr size_t kEventCommandCompleteFirstParamByte = 6;
+static constexpr size_t kEventLocalHciVersionByte =
+    kEventCommandCompleteFirstParamByte;
+static constexpr size_t kEventLocalLmpVersionByte =
+    kEventLocalHciVersionByte + 3;
+
+static constexpr size_t kEventConnectionCompleteParamLength = 11;
+static constexpr size_t kEventConnectionCompleteType = 11;
+static constexpr size_t kEventConnectionCompleteTypeSco = 0;
+static constexpr size_t kEventConnectionCompleteTypeAcl = 1;
+static constexpr size_t kEventConnectionCompleteHandleLsByte = 3;
+
+static constexpr size_t kEventNumberOfCompletedPacketsNumHandles = 2;
+
+static constexpr size_t kAclBroadcastFlagOffset = 6;
+static constexpr uint8_t kAclBroadcastFlagPointToPoint = 0x0;
+static constexpr uint8_t kAclBroadcastPointToPoint =
+    (kAclBroadcastFlagPointToPoint << kAclBroadcastFlagOffset);
+
+static constexpr uint8_t kAclPacketBoundaryFlagOffset = 4;
+static constexpr uint8_t kAclPacketBoundaryFlagFirstAutoFlushable = 0x2;
+static constexpr uint8_t kAclPacketBoundaryFirstAutoFlushable =
+    kAclPacketBoundaryFlagFirstAutoFlushable << kAclPacketBoundaryFlagOffset;
+
+// To discard Qualcomm ACL debugging
+static constexpr uint16_t kAclHandleQcaDebugMessage = 0xedc;
+
+class ThroughputLogger {
+ public:
+  ThroughputLogger(std::string task)
+      : total_bytes_(0),
+        task_(task),
+        start_time_(std::chrono::steady_clock::now()) {}
+
+  ~ThroughputLogger() {
+    if (total_bytes_ == 0) {
+      return;
+    }
+    std::chrono::duration<double> duration =
+        std::chrono::steady_clock::now() - start_time_;
+    double s = duration.count();
+    if (s == 0) {
+      return;
+    }
+    double rate_kb = (static_cast<double>(total_bytes_) / s) / 1024;
+    ALOGD("%s %.1f KB/s (%zu bytes in %.3fs)", task_.c_str(), rate_kb,
+          total_bytes_, s);
+  }
+
+  void setTotalBytes(size_t total_bytes) { total_bytes_ = total_bytes; }
+
+ private:
+  size_t total_bytes_;
+  std::string task_;
+  std::chrono::steady_clock::time_point start_time_;
+};
+
+// The main test class for Bluetooth HAL.
+class BluetoothAidlTest : public ::testing::TestWithParam<std::string> {
+ public:
+  virtual void SetUp() override {
+    // currently test passthrough mode only
+    hci = IBluetoothHci::fromBinder(
+        SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    ASSERT_NE(hci, nullptr);
+    ALOGI("%s: getService() for bluetooth hci is %s", __func__,
+          hci->isRemote() ? "remote" : "local");
+
+    // Lambda function
+    auto on_binder_death = [](void* /*cookie*/) { FAIL(); };
+
+    bluetooth_hci_death_recipient =
+        AIBinder_DeathRecipient_new(on_binder_death);
+    ASSERT_NE(bluetooth_hci_death_recipient, nullptr);
+    ASSERT_EQ(STATUS_OK,
+              AIBinder_linkToDeath(hci->asBinder().get(),
+                                   bluetooth_hci_death_recipient, 0));
+
+    hci_cb = ndk::SharedRefBase::make<BluetoothHciCallbacks>(*this);
+    ASSERT_NE(hci_cb, nullptr);
+
+    max_acl_data_packet_length = 0;
+    max_sco_data_packet_length = 0;
+    max_acl_data_packets = 0;
+    max_sco_data_packets = 0;
+
+    event_cb_count = 0;
+    acl_cb_count = 0;
+    sco_cb_count = 0;
+
+    ASSERT_TRUE(hci->initialize(hci_cb).isOk());
+    auto future = initialized_promise.get_future();
+    auto timeout_status = future.wait_for(kWaitForInitTimeout);
+    ASSERT_EQ(timeout_status, std::future_status::ready);
+    ASSERT_TRUE(future.get());
+  }
+
+  virtual void TearDown() override {
+    ALOGI("TearDown");
+    // Should not be checked in production code
+    ASSERT_TRUE(hci->close().isOk());
+    std::this_thread::sleep_for(kInterfaceCloseDelayMs);
+    handle_no_ops();
+    discard_qca_debugging();
+    EXPECT_EQ(static_cast<size_t>(0), event_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), sco_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), acl_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), iso_queue.size());
+  }
+
+  void setBufferSizes();
+  void setSynchronousFlowControlEnable();
+
+  // Functions called from within tests in loopback mode
+  void sendAndCheckHci(int num_packets);
+  void sendAndCheckSco(int num_packets, size_t size, uint16_t handle);
+  void sendAndCheckAcl(int num_packets, size_t size, uint16_t handle);
+
+  // Helper functions to try to get a handle on verbosity
+  void enterLoopbackMode();
+  void handle_no_ops();
+  void discard_qca_debugging();
+  void wait_for_event(bool timeout_is_error);
+  void wait_for_command_complete_event(std::vector<uint8_t> cmd);
+  int wait_for_completed_packets_event(uint16_t handle);
+
+  // A simple test implementation of BluetoothHciCallbacks.
+  class BluetoothHciCallbacks
+      : public aidl::android::hardware::bluetooth::BnBluetoothHciCallbacks {
+    BluetoothAidlTest& parent_;
+
+   public:
+    BluetoothHciCallbacks(BluetoothAidlTest& parent) : parent_(parent){};
+
+    virtual ~BluetoothHciCallbacks() = default;
+
+    ndk::ScopedAStatus initializationComplete(Status status) {
+      parent_.initialized_promise.set_value(status == Status::SUCCESS);
+      ALOGV("%s (status = %d)", __func__, static_cast<int>(status));
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus hciEventReceived(const std::vector<uint8_t>& event) {
+      parent_.event_cb_count++;
+      parent_.event_queue.push(event);
+      ALOGV("Event received (length = %d)", static_cast<int>(event.size()));
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus aclDataReceived(const std::vector<uint8_t>& data) {
+      parent_.acl_cb_count++;
+      parent_.acl_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus scoDataReceived(const std::vector<uint8_t>& data) {
+      parent_.sco_cb_count++;
+      parent_.sco_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus isoDataReceived(const std::vector<uint8_t>& data) {
+      parent_.iso_cb_count++;
+      parent_.iso_queue.push(data);
+      return ScopedAStatus::ok();
+    };
+  };
+
+  template <class T>
+  class WaitQueue {
+   public:
+    WaitQueue(){};
+
+    virtual ~WaitQueue() = default;
+
+    bool empty() const {
+      std::lock_guard<std::mutex> lock(m_);
+      return q_.empty();
+    };
+
+    size_t size() const {
+      std::lock_guard<std::mutex> lock(m_);
+      return q_.size();
+    };
+
+    void push(const T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      q_.push(v);
+      ready_.notify_one();
+    };
+
+    bool pop(T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      if (q_.empty()) {
+        return false;
+      }
+      v = std::move(q_.front());
+      q_.pop();
+      return true;
+    };
+
+    bool front(T& v) {
+      std::lock_guard<std::mutex> lock(m_);
+      if (q_.empty()) {
+        return false;
+      }
+      v = q_.front();
+      return true;
+    };
+
+    void wait() {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        ready_.wait(lock);
+      }
+    };
+
+    bool waitWithTimeout(std::chrono::milliseconds timeout) {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        if (ready_.wait_for(lock, timeout) == std::cv_status::timeout) {
+          return false;
+        }
+      }
+      return true;
+    };
+
+    bool tryPopWithTimeout(T& v, std::chrono::milliseconds timeout) {
+      std::unique_lock<std::mutex> lock(m_);
+      while (q_.empty()) {
+        if (ready_.wait_for(lock, timeout) == std::cv_status::timeout) {
+          return false;
+        }
+      }
+      v = std::move(q_.front());
+      q_.pop();
+      return true;
+    };
+
+   private:
+    mutable std::mutex m_;
+    std::queue<T> q_;
+    std::condition_variable_any ready_;
+  };
+
+  std::shared_ptr<IBluetoothHci> hci;
+  std::shared_ptr<BluetoothHciCallbacks> hci_cb;
+  AIBinder_DeathRecipient* bluetooth_hci_death_recipient;
+  WaitQueue<std::vector<uint8_t>> event_queue;
+  WaitQueue<std::vector<uint8_t>> acl_queue;
+  WaitQueue<std::vector<uint8_t>> sco_queue;
+  WaitQueue<std::vector<uint8_t>> iso_queue;
+
+  std::promise<bool> initialized_promise;
+  int event_cb_count;
+  int sco_cb_count;
+  int acl_cb_count;
+  int iso_cb_count;
+
+  int max_acl_data_packet_length;
+  int max_sco_data_packet_length;
+  int max_acl_data_packets;
+  int max_sco_data_packets;
+
+  std::vector<uint16_t> sco_connection_handles;
+  std::vector<uint16_t> acl_connection_handles;
+};
+
+// Discard NO-OPs from the event queue.
+void BluetoothAidlTest::handle_no_ops() {
+  while (!event_queue.empty()) {
+    std::vector<uint8_t> event;
+    event_queue.front(event);
+    ASSERT_GE(event.size(),
+              static_cast<size_t>(kEventCommandCompleteStatusByte));
+    bool event_is_no_op =
+        (event[kEventCodeByte] == kEventCommandComplete) &&
+        (event[kEventCommandCompleteOpcodeLsByte] == 0x00) &&
+        (event[kEventCommandCompleteOpcodeLsByte + 1] == 0x00);
+    event_is_no_op |= (event[kEventCodeByte] == kEventCommandStatus) &&
+                      (event[kEventCommandStatusOpcodeLsByte] == 0x00) &&
+                      (event[kEventCommandStatusOpcodeLsByte + 1] == 0x00);
+    if (event_is_no_op) {
+      event_queue.pop(event);
+    } else {
+      break;
+    }
+  }
+}
+
+// Discard Qualcomm ACL debugging
+void BluetoothAidlTest::discard_qca_debugging() {
+  while (!acl_queue.empty()) {
+    std::vector<uint8_t> acl_packet;
+    acl_queue.front(acl_packet);
+    uint16_t connection_handle = acl_packet[1] & 0xF;
+    connection_handle <<= 8;
+    connection_handle |= acl_packet[0];
+    bool packet_is_no_op = connection_handle == kAclHandleQcaDebugMessage;
+    if (packet_is_no_op) {
+      acl_queue.pop(acl_packet);
+    } else {
+      break;
+    }
+  }
+}
+
+// Receive an event, discarding NO-OPs.
+void BluetoothAidlTest::wait_for_event(bool timeout_is_error = true) {
+  // Wait until we get something that's not a no-op.
+  while (true) {
+    bool event_ready = event_queue.waitWithTimeout(kWaitForHciEventTimeout);
+    ASSERT_TRUE(event_ready || !timeout_is_error);
+    if (event_queue.empty()) {
+      // waitWithTimeout timed out
+      return;
+    }
+    handle_no_ops();
+    if (!event_queue.empty()) {
+      // There's an event in the queue that's not a no-op.
+      return;
+    }
+  }
+}
+
+// Wait until a command complete is received.
+void BluetoothAidlTest::wait_for_command_complete_event(
+    std::vector<uint8_t> cmd) {
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+  std::vector<uint8_t> event;
+  ASSERT_FALSE(event_queue.empty());
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventCommandCompleteStatusByte));
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+}
+
+// Send the command to read the controller's buffer sizes.
+void BluetoothAidlTest::setBufferSizes() {
+  std::vector<uint8_t> cmd{
+      kCommandHciReadBufferSize,
+      kCommandHciReadBufferSize + sizeof(kCommandHciReadBufferSize)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+  if (event_queue.empty()) {
+    return;
+  }
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+
+  max_acl_data_packet_length =
+      event[kEventCommandCompleteStatusByte + 1] +
+      (event[kEventCommandCompleteStatusByte + 2] << 8);
+  max_sco_data_packet_length = event[kEventCommandCompleteStatusByte + 3];
+  max_acl_data_packets = event[kEventCommandCompleteStatusByte + 4] +
+                         (event[kEventCommandCompleteStatusByte + 5] << 8);
+  max_sco_data_packets = event[kEventCommandCompleteStatusByte + 6] +
+                         (event[kEventCommandCompleteStatusByte + 7] << 8);
+
+  ALOGD("%s: ACL max %d num %d SCO max %d num %d", __func__,
+        static_cast<int>(max_acl_data_packet_length),
+        static_cast<int>(max_acl_data_packets),
+        static_cast<int>(max_sco_data_packet_length),
+        static_cast<int>(max_sco_data_packets));
+}
+
+// Enable flow control packets for SCO
+void BluetoothAidlTest::setSynchronousFlowControlEnable() {
+  std::vector<uint8_t> cmd{kCommandHciSynchronousFlowControlEnable,
+                           kCommandHciSynchronousFlowControlEnable +
+                               sizeof(kCommandHciSynchronousFlowControlEnable)};
+  hci->sendHciCommand(cmd);
+
+  wait_for_command_complete_event(cmd);
+}
+
+// Send an HCI command (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckHci(int num_packets) {
+  ThroughputLogger logger = {__func__};
+  int command_size = 0;
+  for (int n = 0; n < num_packets; n++) {
+    // Send an HCI packet
+    std::vector<uint8_t> write_name{
+        kCommandHciWriteLocalName,
+        kCommandHciWriteLocalName + sizeof(kCommandHciWriteLocalName)};
+    // With a name
+    char new_name[] = "John Jacob Jingleheimer Schmidt ___________________0";
+    size_t new_name_length = strlen(new_name);
+    for (size_t i = 0; i < new_name_length; i++) {
+      write_name.push_back(static_cast<uint8_t>(new_name[i]));
+    }
+    // And the packet number
+    size_t i = new_name_length - 1;
+    for (int digits = n; digits > 0; digits = digits / 10, i--) {
+      write_name[i] = static_cast<uint8_t>('0' + digits % 10);
+    }
+    // And padding
+    for (size_t i = 0; i < 248 - new_name_length; i++) {
+      write_name.push_back(static_cast<uint8_t>(0));
+    }
+
+    hci->sendHciCommand(write_name);
+
+    // Check the loopback of the HCI packet
+    ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+    std::vector<uint8_t> event;
+    ASSERT_TRUE(event_queue.pop(event));
+
+    size_t compare_length = (write_name.size() > static_cast<size_t>(0xff)
+                                 ? static_cast<size_t>(0xff)
+                                 : write_name.size());
+    ASSERT_GT(event.size(), compare_length + kEventFirstPayloadByte - 1);
+
+    ASSERT_EQ(kEventLoopbackCommand, event[kEventCodeByte]);
+    ASSERT_EQ(compare_length, event[kEventLengthByte]);
+
+    // Don't compare past the end of the event.
+    if (compare_length + kEventFirstPayloadByte > event.size()) {
+      compare_length = event.size() - kEventFirstPayloadByte;
+      ALOGE("Only comparing %d bytes", static_cast<int>(compare_length));
+    }
+
+    if (n == num_packets - 1) {
+      command_size = write_name.size();
+    }
+
+    for (size_t i = 0; i < compare_length; i++) {
+      ASSERT_EQ(write_name[i], event[kEventFirstPayloadByte + i]);
+    }
+  }
+  logger.setTotalBytes(command_size * num_packets * 2);
+}
+
+// Send a SCO data packet (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckSco(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send a SCO packet
+    std::vector<uint8_t> sco_packet;
+    sco_packet.push_back(static_cast<uint8_t>(handle & 0xff));
+    sco_packet.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8));
+    sco_packet.push_back(static_cast<uint8_t>(size & 0xff));
+    for (size_t i = 0; i < size; i++) {
+      sco_packet.push_back(static_cast<uint8_t>(i + n));
+    }
+    hci->sendScoData(sco_packet);
+
+    // Check the loopback of the SCO packet
+    std::vector<uint8_t> sco_loopback;
+    ASSERT_TRUE(
+        sco_queue.tryPopWithTimeout(sco_loopback, kWaitForScoDataTimeout));
+
+    ASSERT_EQ(sco_packet.size(), sco_loopback.size());
+    size_t successful_bytes = 0;
+
+    for (size_t i = 0; i < sco_packet.size(); i++) {
+      if (sco_packet[i] == sco_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              sco_packet[i], sco_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              sco_packet[i + 1], sco_loopback[i + 1]);
+        break;
+      }
+    }
+    ASSERT_EQ(sco_packet.size(), successful_bytes + 1);
+  }
+  logger.setTotalBytes(num_packets * size * 2);
+}
+
+// Send an ACL data packet (in Loopback mode) and check the response.
+void BluetoothAidlTest::sendAndCheckAcl(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send an ACL packet
+    std::vector<uint8_t> acl_packet;
+    acl_packet.push_back(static_cast<uint8_t>(handle & 0xff));
+    acl_packet.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8) |
+                         kAclBroadcastPointToPoint |
+                         kAclPacketBoundaryFirstAutoFlushable);
+    acl_packet.push_back(static_cast<uint8_t>(size & 0xff));
+    acl_packet.push_back(static_cast<uint8_t>((size & 0xff00) >> 8));
+    for (size_t i = 0; i < size; i++) {
+      acl_packet.push_back(static_cast<uint8_t>(i + n));
+    }
+    hci->sendAclData(acl_packet);
+
+    std::vector<uint8_t> acl_loopback;
+    // Check the loopback of the ACL packet
+    ASSERT_TRUE(
+        acl_queue.tryPopWithTimeout(acl_loopback, kWaitForAclDataTimeout));
+
+    ASSERT_EQ(acl_packet.size(), acl_loopback.size());
+    size_t successful_bytes = 0;
+
+    for (size_t i = 0; i < acl_packet.size(); i++) {
+      if (acl_packet[i] == acl_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              acl_packet[i], acl_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              acl_packet[i + 1], acl_loopback[i + 1]);
+        break;
+      }
+    }
+    ASSERT_EQ(acl_packet.size(), successful_bytes + 1);
+  }
+  logger.setTotalBytes(num_packets * size * 2);
+}
+
+// Return the number of completed packets reported by the controller.
+int BluetoothAidlTest::wait_for_completed_packets_event(uint16_t handle) {
+  int packets_processed = 0;
+  while (true) {
+    // There should be at least one event.
+    wait_for_event(packets_processed == 0);
+    if (event_queue.empty()) {
+      if (packets_processed == 0) {
+        ALOGW("%s: waitForBluetoothCallback timed out.", __func__);
+      }
+      return packets_processed;
+    }
+    std::vector<uint8_t> event;
+    EXPECT_TRUE(event_queue.pop(event));
+
+    EXPECT_EQ(kEventNumberOfCompletedPackets, event[kEventCodeByte]);
+    EXPECT_EQ(1, event[kEventNumberOfCompletedPacketsNumHandles]);
+
+    uint16_t event_handle = event[3] + (event[4] << 8);
+    EXPECT_EQ(handle, event_handle);
+
+    packets_processed += event[5] + (event[6] << 8);
+  }
+  return packets_processed;
+}
+
+// Send local loopback command and initialize SCO and ACL handles.
+void BluetoothAidlTest::enterLoopbackMode() {
+  std::vector<uint8_t> cmd{kCommandHciWriteLoopbackModeLocal,
+                           kCommandHciWriteLoopbackModeLocal +
+                               sizeof(kCommandHciWriteLoopbackModeLocal)};
+  hci->sendHciCommand(cmd);
+
+  // Receive connection complete events with data channels
+  int connection_event_count = 0;
+  bool command_complete_received = false;
+  while (true) {
+    wait_for_event(false);
+    if (event_queue.empty()) {
+      // Fail if there was no event received or no connections completed.
+      ASSERT_TRUE(command_complete_received);
+      ASSERT_LT(0, connection_event_count);
+      return;
+    }
+    std::vector<uint8_t> event;
+    ASSERT_TRUE(event_queue.pop(event));
+    ASSERT_GT(event.size(),
+              static_cast<size_t>(kEventCommandCompleteStatusByte));
+    if (event[kEventCodeByte] == kEventConnectionComplete) {
+      ASSERT_GT(event.size(),
+                static_cast<size_t>(kEventConnectionCompleteType));
+      ASSERT_EQ(event[kEventLengthByte], kEventConnectionCompleteParamLength);
+      uint8_t connection_type = event[kEventConnectionCompleteType];
+
+      ASSERT_TRUE(connection_type == kEventConnectionCompleteTypeSco ||
+                  connection_type == kEventConnectionCompleteTypeAcl);
+
+      // Save handles
+      uint16_t handle = event[kEventConnectionCompleteHandleLsByte] |
+                        event[kEventConnectionCompleteHandleLsByte + 1] << 8;
+      if (connection_type == kEventConnectionCompleteTypeSco) {
+        sco_connection_handles.push_back(handle);
+      } else {
+        acl_connection_handles.push_back(handle);
+      }
+
+      ALOGD("Connect complete type = %d handle = %d",
+            event[kEventConnectionCompleteType], handle);
+      connection_event_count++;
+    } else {
+      ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+      ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+      ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+      ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+      command_complete_received = true;
+    }
+  }
+}
+
+// Empty test: Initialize()/Close() are called in SetUp()/TearDown().
+TEST_P(BluetoothAidlTest, InitializeAndClose) {}
+
+// Send an HCI Reset with sendHciCommand and wait for a command complete event.
+TEST_P(BluetoothAidlTest, HciReset) {
+  std::vector<uint8_t> reset{kCommandHciReset,
+                             kCommandHciReset + sizeof(kCommandHciReset)};
+  hci->sendHciCommand(reset);
+
+  wait_for_command_complete_event(reset);
+}
+
+// Read and check the HCI version of the controller.
+TEST_P(BluetoothAidlTest, HciVersionTest) {
+  std::vector<uint8_t> cmd{kCommandHciReadLocalVersionInformation,
+                           kCommandHciReadLocalVersionInformation +
+                               sizeof(kCommandHciReadLocalVersionInformation)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventLocalLmpVersionByte));
+
+  ASSERT_EQ(kEventCommandComplete, event[kEventCodeByte]);
+  ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+  ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+  ASSERT_EQ(kHciStatusSuccess, event[kEventCommandCompleteStatusByte]);
+
+  ASSERT_LE(kHciMinimumHciVersion, event[kEventLocalHciVersionByte]);
+  ASSERT_LE(kHciMinimumLmpVersion, event[kEventLocalLmpVersionByte]);
+}
+
+// Send an unknown HCI command and wait for the error message.
+TEST_P(BluetoothAidlTest, HciUnknownCommand) {
+  std::vector<uint8_t> cmd{
+      kCommandHciShouldBeUnknown,
+      kCommandHciShouldBeUnknown + sizeof(kCommandHciShouldBeUnknown)};
+  hci->sendHciCommand(cmd);
+
+  ASSERT_NO_FATAL_FAILURE(wait_for_event());
+
+  std::vector<uint8_t> event;
+  ASSERT_TRUE(event_queue.pop(event));
+
+  ASSERT_GT(event.size(), static_cast<size_t>(kEventCommandCompleteStatusByte));
+  if (event[kEventCodeByte] == kEventCommandComplete) {
+    ASSERT_EQ(cmd[0], event[kEventCommandCompleteOpcodeLsByte]);
+    ASSERT_EQ(cmd[1], event[kEventCommandCompleteOpcodeLsByte + 1]);
+    ASSERT_EQ(kHciStatusUnknownHciCommand,
+              event[kEventCommandCompleteStatusByte]);
+  } else {
+    ASSERT_EQ(kEventCommandStatus, event[kEventCodeByte]);
+    ASSERT_EQ(cmd[0], event[kEventCommandStatusOpcodeLsByte]);
+    ASSERT_EQ(cmd[1], event[kEventCommandStatusOpcodeLsByte + 1]);
+    ASSERT_EQ(kHciStatusUnknownHciCommand,
+              event[kEventCommandStatusStatusByte]);
+  }
+}
+
+// Enter loopback mode, but don't send any packets.
+TEST_P(BluetoothAidlTest, WriteLoopbackMode) { enterLoopbackMode(); }
+
+// Enter loopback mode and send a single command.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleCommand) {
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  sendAndCheckHci(1);
+}
+
+// Enter loopback mode and send a single SCO packet.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleSco) {
+  setBufferSizes();
+  setSynchronousFlowControlEnable();
+
+  enterLoopbackMode();
+
+  if (!sco_connection_handles.empty()) {
+    ASSERT_LT(0, max_sco_data_packet_length);
+    sendAndCheckSco(1, max_sco_data_packet_length, sco_connection_handles[0]);
+    int sco_packets_sent = 1;
+    int completed_packets =
+        wait_for_completed_packets_event(sco_connection_handles[0]);
+    if (sco_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            sco_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Enter loopback mode and send a single ACL packet.
+TEST_P(BluetoothAidlTest, LoopbackModeSingleAcl) {
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  if (!acl_connection_handles.empty()) {
+    ASSERT_LT(0, max_acl_data_packet_length);
+    sendAndCheckAcl(1, max_acl_data_packet_length - 1,
+                    acl_connection_handles[0]);
+    int acl_packets_sent = 1;
+    int completed_packets =
+        wait_for_completed_packets_event(acl_connection_handles[0]);
+    if (acl_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            acl_packets_sent, completed_packets);
+    }
+  }
+  ASSERT_GE(acl_cb_count, 1);
+}
+
+// Enter loopback mode and send command packets for bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeCommandBandwidth) {
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  sendAndCheckHci(kNumHciCommandsBandwidth);
+}
+
+// Enter loopback mode and send SCO packets for bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeScoBandwidth) {
+  setBufferSizes();
+  setSynchronousFlowControlEnable();
+
+  enterLoopbackMode();
+
+  if (!sco_connection_handles.empty()) {
+    ASSERT_LT(0, max_sco_data_packet_length);
+    sendAndCheckSco(kNumScoPacketsBandwidth, max_sco_data_packet_length,
+                    sco_connection_handles[0]);
+    int sco_packets_sent = kNumScoPacketsBandwidth;
+    int completed_packets =
+        wait_for_completed_packets_event(sco_connection_handles[0]);
+    if (sco_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            sco_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Enter loopback mode and send packets for ACL bandwidth measurements.
+TEST_P(BluetoothAidlTest, LoopbackModeAclBandwidth) {
+  setBufferSizes();
+
+  enterLoopbackMode();
+
+  if (!acl_connection_handles.empty()) {
+    ASSERT_LT(0, max_acl_data_packet_length);
+    sendAndCheckAcl(kNumAclPacketsBandwidth, max_acl_data_packet_length - 1,
+                    acl_connection_handles[0]);
+    int acl_packets_sent = kNumAclPacketsBandwidth;
+    int completed_packets =
+        wait_for_completed_packets_event(acl_connection_handles[0]);
+    if (acl_packets_sent != completed_packets) {
+      ALOGW("%s: packets_sent (%d) != completed_packets (%d)", __func__,
+            acl_packets_sent, completed_packets);
+    }
+  }
+}
+
+// Set all bits in the event mask
+TEST_P(BluetoothAidlTest, SetEventMask) {
+  std::vector<uint8_t> set_event_mask{
+      0x01, 0x0c, 0x08 /*parameter bytes*/, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff};
+  hci->sendHciCommand({set_event_mask});
+  wait_for_command_complete_event(set_event_mask);
+}
+
+// Set all bits in the LE event mask
+TEST_P(BluetoothAidlTest, SetLeEventMask) {
+  std::vector<uint8_t> set_event_mask{
+      0x20, 0x0c, 0x08 /*parameter bytes*/, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+      0xff, 0xff};
+  hci->sendHciCommand({set_event_mask});
+  wait_for_command_complete_event(set_event_mask);
+}
+
+// Call initialize twice, second one should fail.
+TEST_P(BluetoothAidlTest, CallInitializeTwice) {
+  class SecondCb
+      : public aidl::android::hardware::bluetooth::BnBluetoothHciCallbacks {
+   public:
+    ndk::ScopedAStatus initializationComplete(Status status) {
+      EXPECT_EQ(status, Status::ALREADY_INITIALIZED);
+      init_promise.set_value();
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus hciEventReceived(const std::vector<uint8_t>& /*event*/) {
+      ADD_FAILURE();
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus aclDataReceived(const std::vector<uint8_t>& /*data*/) {
+      ADD_FAILURE();
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus scoDataReceived(const std::vector<uint8_t>& /*data*/) {
+      ADD_FAILURE();
+      return ScopedAStatus::ok();
+    };
+
+    ndk::ScopedAStatus isoDataReceived(const std::vector<uint8_t>& /*data*/) {
+      ADD_FAILURE();
+      return ScopedAStatus::ok();
+    };
+    std::promise<void> init_promise;
+  };
+
+  std::shared_ptr<SecondCb> second_cb = ndk::SharedRefBase::make<SecondCb>();
+  ASSERT_NE(second_cb, nullptr);
+
+  auto future = second_cb->init_promise.get_future();
+  ASSERT_TRUE(hci->initialize(second_cb).isOk());
+  auto status = future.wait_for(std::chrono::seconds(1));
+  ASSERT_EQ(status, std::future_status::ready);
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(BluetoothAidlTest);
+INSTANTIATE_TEST_SUITE_P(PerInstance, BluetoothAidlTest,
+                         testing::ValuesIn(android::getAidlHalInstanceNames(
+                             IBluetoothHci::descriptor)),
+                         android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+  ABinderProcess_startThreadPool();
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  ALOGI("Test result = %d", status);
+  return status;
+}
diff --git a/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml
new file mode 100644
index 0000000..3a42ae6
--- /dev/null
+++ b/bluetooth/aidl/vts/VtsHalBluetoothTargetTest.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2023 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalBluetoothTargetTest.">
+    <option name="test-suite-tag" value="apct" />
+    <option name="test-suite-tag" value="apct-native" />
+
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer">
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
+        <option name="run-command" value="settings put global ble_scan_always_enabled 0" />
+        <option name="run-command" value="cmd bluetooth_manager disable" />
+        <option name="run-command" value="cmd bluetooth_manager wait-for-state:STATE_OFF" />
+        <option name="teardown-command" value="cmd bluetooth_manager enable" />
+        <option name="teardown-command" value="cmd bluetooth_manager wait-for-state:STATE_ON" />
+        <option name="teardown-command" value="settings put global ble_scan_always_enabled 1" />
+    </target_preparer>
+
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="VtsHalBluetoothTargetTest->/data/local/tmp/VtsHalBluetoothTargetTest" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.GTest" >
+        <option name="native-test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="VtsHalBluetoothTargetTest" />
+    </test>
+</configuration>
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LatencyMode.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LatencyMode.aidl
index 5583679..1140f9e 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LatencyMode.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LatencyMode.aidl
@@ -34,7 +34,9 @@
 package android.hardware.bluetooth.audio;
 @Backing(type="int") @VintfStability
 enum LatencyMode {
-  UNKNOWN = 0,
-  LOW_LATENCY = 1,
-  FREE = 2,
+  UNKNOWN,
+  LOW_LATENCY,
+  FREE,
+  DYNAMIC_SPATIAL_AUDIO_SOFTWARE,
+  DYNAMIC_SPATIAL_AUDIO_HARDWARE,
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
index 7d53b0c..2945710 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
@@ -41,5 +41,6 @@
     char streamHandle;
     int audioChannelAllocation;
     android.hardware.bluetooth.audio.LeAudioCodecConfiguration leAudioCodecConfig;
+    char pcmStreamId;
   }
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LatencyMode.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LatencyMode.aidl
index 0c354f7..ec181c1 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LatencyMode.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LatencyMode.aidl
@@ -22,4 +22,6 @@
     UNKNOWN,
     LOW_LATENCY,
     FREE,
+    DYNAMIC_SPATIAL_AUDIO_SOFTWARE,
+    DYNAMIC_SPATIAL_AUDIO_HARDWARE
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
index e9a1a0c..16503fb 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/LeAudioBroadcastConfiguration.aidl
@@ -35,6 +35,10 @@
          */
         int audioChannelAllocation;
         LeAudioCodecConfiguration leAudioCodecConfig;
+        /*
+         * Pcm stream id to identify the source for given streamHandle.
+         */
+        char pcmStreamId;
     }
     CodecType codecType;
     BroadcastStreamMap[] streamMap;
diff --git a/bluetooth/audio/aidl/default/Android.bp b/bluetooth/audio/aidl/default/Android.bp
index cbf23dc..e4c2844 100644
--- a/bluetooth/audio/aidl/default/Android.bp
+++ b/bluetooth/audio/aidl/default/Android.bp
@@ -29,7 +29,7 @@
         "libcutils",
         "libfmq",
         "liblog",
-        "android.hardware.bluetooth.audio-V2-ndk",
+        "android.hardware.bluetooth.audio-V3-ndk",
         "libbluetooth_audio_session_aidl",
     ],
 }
diff --git a/bluetooth/audio/aidl/default/bluetooth_audio.xml b/bluetooth/audio/aidl/default/bluetooth_audio.xml
index c4b1872..c0bc55e 100644
--- a/bluetooth/audio/aidl/default/bluetooth_audio.xml
+++ b/bluetooth/audio/aidl/default/bluetooth_audio.xml
@@ -1,7 +1,7 @@
 <manifest version="1.0" type="device">
     <hal format="aidl">
         <name>android.hardware.bluetooth.audio</name>
-        <version>2</version>
+        <version>3</version>
         <fqname>IBluetoothAudioProviderFactory/default</fqname>
     </hal>
 </manifest>
diff --git a/bluetooth/audio/aidl/vts/Android.bp b/bluetooth/audio/aidl/vts/Android.bp
index 3aed1b3..e03fb58 100644
--- a/bluetooth/audio/aidl/vts/Android.bp
+++ b/bluetooth/audio/aidl/vts/Android.bp
@@ -17,7 +17,7 @@
     srcs: ["VtsHalBluetoothAudioTargetTest.cpp"],
     shared_libs: [
         "android.hardware.audio.common-V1-ndk",
-        "android.hardware.bluetooth.audio-V2-ndk",
+        "android.hardware.bluetooth.audio-V3-ndk",
         "android.hardware.common-V2-ndk",
         "android.hardware.common.fmq-V1-ndk",
         "libbase",
diff --git a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
index e9b74b7..6a913f7 100644
--- a/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
+++ b/bluetooth/audio/aidl/vts/VtsHalBluetoothAudioTargetTest.cpp
@@ -1566,9 +1566,14 @@
   };
 
   for (auto& lc3_config : lc3_codec_configs) {
+    le_audio_broadcast_config.streamMap.resize(1);
     le_audio_broadcast_config.streamMap[0]
         .leAudioCodecConfig.set<LeAudioCodecConfiguration::lc3Config>(
             lc3_config);
+    le_audio_broadcast_config.streamMap[0].streamHandle = 0x0;
+    le_audio_broadcast_config.streamMap[0].pcmStreamId = 0x0;
+    le_audio_broadcast_config.streamMap[0].audioChannelAllocation = 0x1 << 0;
+
     DataMQDesc mq_desc;
     auto aidl_retval = audio_provider_->startSession(
         audio_port_, AudioConfiguration(le_audio_broadcast_config),
diff --git a/bluetooth/audio/utils/Android.bp b/bluetooth/audio/utils/Android.bp
index 70797a7..914d2b2 100644
--- a/bluetooth/audio/utils/Android.bp
+++ b/bluetooth/audio/utils/Android.bp
@@ -55,7 +55,7 @@
         "libbinder_ndk",
         "libfmq",
         "liblog",
-        "android.hardware.bluetooth.audio-V2-ndk",
+        "android.hardware.bluetooth.audio-V3-ndk",
         "libhidlbase",
         "libxml2",
     ],
@@ -75,7 +75,7 @@
     shared_libs: [
         "libbase",
         "libbinder_ndk",
-        "android.hardware.bluetooth.audio-V2-ndk",
+        "android.hardware.bluetooth.audio-V3-ndk",
         "libxml2",
     ],
     test_suites: [
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
index 1dec900..0a804bb 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.cpp
@@ -200,13 +200,21 @@
         GetUnicastCapability(scenario.getEncode());
     UnicastCapability unicast_decode_capability =
         GetUnicastCapability(scenario.getDecode());
-    // encode and decode cannot be unknown at the same time
-    if (unicast_encode_capability.codecType == CodecType::UNKNOWN &&
-        unicast_decode_capability.codecType == CodecType::UNKNOWN) {
-      continue;
-    }
     BroadcastCapability broadcast_capability = {.codecType =
                                                     CodecType::UNKNOWN};
+
+    if (scenario.hasBroadcast()) {
+      broadcast_capability = GetBroadcastCapability(scenario.getBroadcast());
+    }
+
+    // At least one capability should be valid
+    if (unicast_encode_capability.codecType == CodecType::UNKNOWN &&
+        unicast_decode_capability.codecType == CodecType::UNKNOWN &&
+        broadcast_capability.codecType == CodecType::UNKNOWN) {
+      LOG(ERROR) << __func__ << ": None of the capability is valid.";
+      continue;
+    }
+
     le_audio_codec_capabilities.push_back(
         {.unicastEncodeCapability = unicast_encode_capability,
          .unicastDecodeCapability = unicast_decode_capability,
@@ -252,6 +260,54 @@
   return {.codecType = CodecType::UNKNOWN};
 }
 
+BroadcastCapability BluetoothLeAudioCodecsProvider::GetBroadcastCapability(
+    const std::string& coding_direction) {
+  if (coding_direction == "invalid") {
+    return {.codecType = CodecType::UNKNOWN};
+  }
+
+  auto configuration_iter = configuration_map_.find(coding_direction);
+  if (configuration_iter == configuration_map_.end()) {
+    return {.codecType = CodecType::UNKNOWN};
+  }
+
+  auto codec_configuration_iter = codec_configuration_map_.find(
+      configuration_iter->second.getCodecConfiguration());
+  if (codec_configuration_iter == codec_configuration_map_.end()) {
+    return {.codecType = CodecType::UNKNOWN};
+  }
+
+  auto strategy_configuration_iter = strategy_configuration_map_.find(
+      configuration_iter->second.getStrategyConfiguration());
+  if (strategy_configuration_iter == strategy_configuration_map_.end()) {
+    return {.codecType = CodecType::UNKNOWN};
+  }
+
+  CodecType codec_type =
+      GetCodecType(codec_configuration_iter->second.getCodec());
+  std::vector<std::optional<Lc3Capabilities>> bcastLc3Cap(
+      1, std::optional(ComposeLc3Capability(codec_configuration_iter->second)));
+
+  if (codec_type == CodecType::LC3) {
+    return ComposeBroadcastCapability(
+        codec_type,
+        GetAudioLocation(
+            strategy_configuration_iter->second.getAudioLocation()),
+        strategy_configuration_iter->second.getChannelCount(), bcastLc3Cap);
+  }
+  return {.codecType = CodecType::UNKNOWN};
+}
+
+template <class T>
+BroadcastCapability BluetoothLeAudioCodecsProvider::ComposeBroadcastCapability(
+    const CodecType& codec_type, const AudioLocation& audio_location,
+    const uint8_t& channel_count, const std::vector<T>& capability) {
+  return {.codecType = codec_type,
+          .supportedChannel = audio_location,
+          .channelCountPerStream = channel_count,
+          .leAudioCodecCapabilities = std::optional(capability)};
+}
+
 template <class T>
 UnicastCapability BluetoothLeAudioCodecsProvider::ComposeUnicastCapability(
     const CodecType& codec_type, const AudioLocation& audio_location,
@@ -322,6 +378,10 @@
       // 1. two connected device, one for L one for R
       // 2. one connected device for both L and R
       return true;
+    } else if (strategy_configuration.getConnectedDevice() == 0 &&
+               strategy_configuration.getChannelCount() == 2) {
+      // Broadcast
+      return true;
     }
   } else if (strategy_configuration.getAudioLocation() ==
              setting::AudioLocation::MONO) {
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
index e879984..06e4595 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProvider.h
@@ -20,6 +20,7 @@
 #include <android-base/logging.h>
 
 #include <unordered_map>
+#include <vector>
 
 #include "aidl_android_hardware_bluetooth_audio_setting.h"
 
@@ -66,12 +67,20 @@
 
   static UnicastCapability GetUnicastCapability(
       const std::string& coding_direction);
+  static BroadcastCapability GetBroadcastCapability(
+      const std::string& coding_direction);
+
   template <class T>
   static inline UnicastCapability ComposeUnicastCapability(
       const CodecType& codec_type, const AudioLocation& audio_location,
       const uint8_t& device_cnt, const uint8_t& channel_count,
       const T& capability);
 
+  template <class T>
+  static inline BroadcastCapability ComposeBroadcastCapability(
+      const CodecType& codec_type, const AudioLocation& audio_location,
+      const uint8_t& channel_count, const std::vector<T>& capability);
+
   static inline Lc3Capabilities ComposeLc3Capability(
       const setting::CodecConfiguration& codec_configuration);
 
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
index 5393cd7..dba2749 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothLeAudioCodecsProviderTest.cpp
@@ -46,7 +46,11 @@
 // Define valid components for each list
 // Scenario
 static const Scenario kValidScenario(std::make_optional("OneChanStereo_16_1"),
-                                     std::make_optional("OneChanStereo_16_1"));
+                                     std::make_optional("OneChanStereo_16_1"),
+                                     std::nullopt);
+static const Scenario kValidBroadcastScenario(
+    std::nullopt, std::nullopt, std::make_optional("BcastStereo_16_2"));
+
 // Configuration
 static const Configuration kValidConfigOneChanStereo_16_1(
     std::make_optional("OneChanStereo_16_1"), std::make_optional("LC3_16k_1"),
@@ -69,11 +73,15 @@
     std::make_optional("MONO_ONE_CIS_PER_DEVICE"),
     std::make_optional(AudioLocation::MONO), std::make_optional(1),
     std::make_optional(1));
+static const StrategyConfiguration kValidStrategyBroadcastStereo(
+    std::make_optional("BROADCAST_STEREO"),
+    std::make_optional(AudioLocation::STEREO), std::make_optional(0),
+    std::make_optional(2));
 
 // Define valid test list built from above valid components
 // Scenario, Configuration, CodecConfiguration, StrategyConfiguration
-static const std::vector<ScenarioList> kValidScenarioList = {
-    ScenarioList(std::vector<Scenario>{kValidScenario})};
+static const std::vector<ScenarioList> kValidScenarioList = {ScenarioList(
+    std::vector<Scenario>{kValidScenario, kValidBroadcastScenario})};
 static const std::vector<ConfigurationList> kValidConfigurationList = {
     ConfigurationList(
         std::vector<Configuration>{kValidConfigOneChanStereo_16_1})};
@@ -84,7 +92,7 @@
     kValidStrategyConfigurationList = {
         StrategyConfigurationList(std::vector<StrategyConfiguration>{
             kValidStrategyStereoOneCis, kValidStrategyStereoTwoCis,
-            kValidStrategyMonoOneCis})};
+            kValidStrategyMonoOneCis, kValidStrategyBroadcastStereo})};
 
 class BluetoothLeAudioCodecsProviderTest
     : public ::testing::TestWithParam<OffloadSetting> {
@@ -151,13 +159,15 @@
   static std::vector<ScenarioList> CreateInvalidScenarios() {
     std::vector<ScenarioList> invalid_scenario_test_cases;
     invalid_scenario_test_cases.push_back(ScenarioList(std::vector<Scenario>{
-        Scenario(std::nullopt, std::make_optional("OneChanStereo_16_1"))}));
-
-    invalid_scenario_test_cases.push_back(ScenarioList(std::vector<Scenario>{
-        Scenario(std::make_optional("OneChanStereo_16_1"), std::nullopt)}));
+        Scenario(std::nullopt, std::make_optional("OneChanStereo_16_1"),
+                 std::nullopt)}));
 
     invalid_scenario_test_cases.push_back(ScenarioList(
-        std::vector<Scenario>{Scenario(std::nullopt, std::nullopt)}));
+        std::vector<Scenario>{Scenario(std::make_optional("OneChanStereo_16_1"),
+                                       std::nullopt, std::nullopt)}));
+
+    invalid_scenario_test_cases.push_back(ScenarioList(std::vector<Scenario>{
+        Scenario(std::nullopt, std::nullopt, std::nullopt)}));
 
     invalid_scenario_test_cases.push_back(
         ScenarioList(std::vector<Scenario>{}));
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
index c7904b3..c8d1af0 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xml
@@ -40,6 +40,8 @@
     <scenario encode="OneChanStereo_16_2" decode="OneChanMono_16_2"/>
     <scenario encode="TwoChanStereo_16_2" decode="OneChanMono_16_2"/>
     <scenario encode="OneChanMono_16_2" decode="OneChanMono_16_2"/>
+    <!-- broadcast -->
+    <scenario encode="invalid" decode="invalid" broadcast="BcastStereo_16_2"/>
   </scenarioList>
   <configurationList>
     <configuration name="OneChanMono_16_1" codecConfiguration="LC3_16k_1" strategyConfiguration="MONO_ONE_CIS_PER_DEVICE"/>
@@ -48,6 +50,7 @@
     <configuration name="OneChanMono_16_2" codecConfiguration="LC3_16k_2" strategyConfiguration="MONO_ONE_CIS_PER_DEVICE"/>
     <configuration name="TwoChanStereo_16_2" codecConfiguration="LC3_16k_2" strategyConfiguration="STEREO_TWO_CISES_PER_DEVICE"/>
     <configuration name="OneChanStereo_16_2" codecConfiguration="LC3_16k_2" strategyConfiguration="STEREO_ONE_CIS_PER_DEVICE"/>
+    <configuration name="BcastStereo_16_2" codecConfiguration="LC3_16k_2" strategyConfiguration="BROADCAST_STEREO"/>
   </configurationList>
   <codecConfigurationList>
     <codecConfiguration name="LC3_16k_1" codec="LC3" samplingFrequency="16000" frameDurationUs="7500" octetsPerCodecFrame="30"/>
@@ -57,5 +60,6 @@
     <strategyConfiguration name="STEREO_ONE_CIS_PER_DEVICE" audioLocation="STEREO" connectedDevice="2" channelCount="1"/>
     <strategyConfiguration name="STEREO_TWO_CISES_PER_DEVICE" audioLocation="STEREO" connectedDevice="1" channelCount="2"/>
     <strategyConfiguration name="MONO_ONE_CIS_PER_DEVICE" audioLocation="MONO" connectedDevice="1" channelCount="1"/>
+    <strategyConfiguration name="BROADCAST_STEREO" audioLocation="STEREO" connectedDevice="0" channelCount="2"/>
   </strategyConfigurationList>
 </leAudioOffloadSetting>
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
index 213e597..8c2d6a1 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/le_audio_codec_capabilities.xsd
@@ -32,6 +32,7 @@
     <xs:complexType>
       <xs:attribute name="encode" type="xs:string"/>
       <xs:attribute name="decode" type="xs:string"/>
+      <xs:attribute name="broadcast" type="xs:string"/>
     </xs:complexType>
   </xs:element>
   <xs:element name="configuration">
diff --git a/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt b/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
index 06aa21a..886350e 100644
--- a/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
+++ b/bluetooth/audio/utils/le_audio_codec_capabilities/schema/current.txt
@@ -64,8 +64,10 @@
 
   public class Scenario {
     ctor public Scenario();
+    method public String getBroadcast();
     method public String getDecode();
     method public String getEncode();
+    method public void setBroadcast(String);
     method public void setDecode(String);
     method public void setEncode(String);
   }
diff --git a/bluetooth/hci/h4_protocol.cc b/bluetooth/hci/h4_protocol.cc
index 97ba7aa..51a624f 100644
--- a/bluetooth/hci/h4_protocol.cc
+++ b/bluetooth/hci/h4_protocol.cc
@@ -58,10 +58,8 @@
   while (1) {
     ret = TEMP_FAILURE_RETRY(writev(uart_fd_, iov, 2));
     if (ret == -1) {
-      if (errno == EAGAIN) {
-        ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
-        continue;
-      }
+      LOG_ALWAYS_FATAL("%s error writing to UART (%s)", __func__,
+                       strerror(errno));
     } else if (ret == 0) {
       // Nothing written :(
       ALOGE("%s zero bytes written - something went wrong...", __func__);
diff --git a/bluetooth/hci/test/h4_protocol_unittest.cc b/bluetooth/hci/test/h4_protocol_unittest.cc
index d6f74fc..d3fab61 100644
--- a/bluetooth/hci/test/h4_protocol_unittest.cc
+++ b/bluetooth/hci/test/h4_protocol_unittest.cc
@@ -50,6 +50,9 @@
 static char iso_data[100] =
     "A plane angle is the inclination to one another of two lines in a ...";
 
+// 5 seconds.  Just don't hang.
+static constexpr size_t kTimeoutMs = 5000;
+
 MATCHER_P3(PacketMatches, header_, header_length, payload,
            "Match header_length bytes of header and then the payload") {
   size_t payload_length = strlen(payload);
@@ -131,9 +134,9 @@
         .WillOnce(Notify(promise));
   }
 
-  void WaitForTimeout(size_t timeout_ms, std::promise<void>* promise) {
+  void WaitForTimeout(std::promise<void>* promise) {
     auto future = promise->get_future();
-    auto status = future.wait_for(std::chrono::milliseconds(timeout_ms));
+    auto status = future.wait_for(std::chrono::milliseconds(kTimeoutMs));
     EXPECT_EQ(status, std::future_status::ready);
   }
 
@@ -263,10 +266,10 @@
   WriteInboundIsoData(iso_data);
   CallDataReady();
 
-  WaitForTimeout(100, &acl_promise);
-  WaitForTimeout(100, &sco_promise);
-  WaitForTimeout(100, &event_promise);
-  WaitForTimeout(100, &iso_promise);
+  WaitForTimeout(&acl_promise);
+  WaitForTimeout(&sco_promise);
+  WaitForTimeout(&event_promise);
+  WaitForTimeout(&iso_promise);
 }
 
 TEST_F(H4ProtocolTest, TestMultiplePackets) {
@@ -363,28 +366,28 @@
     std::promise<void> promise;
     ExpectInboundAclData(payload, &promise);
     WriteInboundAclData(payload);
-    WaitForTimeout(100, &promise);
+    WaitForTimeout(&promise);
   }
 
   void WriteAndExpectInboundScoData(char* payload) {
     std::promise<void> promise;
     ExpectInboundScoData(payload, &promise);
     WriteInboundScoData(payload);
-    WaitForTimeout(100, &promise);
+    WaitForTimeout(&promise);
   }
 
   void WriteAndExpectInboundEvent(char* payload) {
     std::promise<void> promise;
     ExpectInboundEvent(payload, &promise);
     WriteInboundEvent(payload);
-    WaitForTimeout(100, &promise);
+    WaitForTimeout(&promise);
   }
 
   void WriteAndExpectInboundIsoData(char* payload) {
     std::promise<void> promise;
     ExpectInboundIsoData(payload, &promise);
     WriteInboundIsoData(payload);
-    WaitForTimeout(100, &promise);
+    WaitForTimeout(&promise);
   }
 
   void WriteAndExpectManyInboundAclDataPackets(char* payload) {
@@ -436,6 +439,5 @@
   EXPECT_CALL(disconnect_cb_, Call()).WillOnce(Notify(&promise));
   close(chip_uart_fd_);
 
-  // Fail if it takes longer than 100 ms.
-  WaitForTimeout(100, &promise);
+  WaitForTimeout(&promise);
 }
diff --git a/camera/common/1.0/default/OWNERS b/camera/OWNERS
similarity index 65%
rename from camera/common/1.0/default/OWNERS
rename to camera/OWNERS
index f48a95c..b946264 100644
--- a/camera/common/1.0/default/OWNERS
+++ b/camera/OWNERS
@@ -1 +1,3 @@
+# Bug component: 41727
+
 include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/1.0/default/OWNERS b/camera/device/1.0/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/1.0/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.2/default/OWNERS b/camera/device/3.2/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.2/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.3/default/OWNERS b/camera/device/3.3/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.3/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.4/default/OWNERS b/camera/device/3.4/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.4/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.5/default/OWNERS b/camera/device/3.5/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.5/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/device/3.6/default/OWNERS b/camera/device/3.6/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/device/3.6/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/2.4/default/OWNERS b/camera/provider/2.4/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/provider/2.4/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/2.4/vts/OWNERS b/camera/provider/2.4/vts/OWNERS
deleted file mode 100644
index eb4f0e4..0000000
--- a/camera/provider/2.4/vts/OWNERS
+++ /dev/null
@@ -1,8 +0,0 @@
-# Bug component: 41727
-
-# Camera team
-include platform/frameworks/av:/camera/OWNERS
-
-# VTS team
-yim@google.com
-zhuoyao@google.com
diff --git a/camera/provider/2.4/vts/functional/OWNERS b/camera/provider/2.4/vts/functional/OWNERS
deleted file mode 100644
index 479f465..0000000
--- a/camera/provider/2.4/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 41727
-epeev@google.com
diff --git a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
index b0ae20e..5ea6ae2 100644
--- a/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
+++ b/camera/provider/2.4/vts/functional/VtsHalCameraProviderV2_4TargetTest.cpp
@@ -6318,8 +6318,6 @@
                                                  std::vector<AvailableStream>& outputStreams,
                                                  const AvailableStream* threshold,
                                                  bool maxResolution) {
-    AvailableStream depthPreviewThreshold = {kMaxPreviewWidth, kMaxPreviewHeight,
-                                             static_cast<int32_t>(PixelFormat::Y16)};
     if (nullptr == staticMeta) {
         return Status::ILLEGAL_ARGUMENT;
     }
@@ -6345,8 +6343,12 @@
     }
 
     if(foundDepth == 0 && (0 == (depthEntry.count % 4))) {
-        fillOutputStreams(&depthEntry, outputStreams, &depthPreviewThreshold,
-                ANDROID_DEPTH_AVAILABLE_DEPTH_STREAM_CONFIGURATIONS_OUTPUT);
+        AvailableStream depthPreviewThreshold = {kMaxPreviewWidth, kMaxPreviewHeight,
+                                                 static_cast<int32_t>(PixelFormat::Y16)};
+        const AvailableStream* depthThreshold =
+                (threshold != nullptr) ? threshold : &depthPreviewThreshold;
+        fillOutputStreams(&depthEntry, outputStreams, depthThreshold,
+                          ANDROID_DEPTH_AVAILABLE_DEPTH_STREAM_CONFIGURATIONS_OUTPUT);
     }
 
     return Status::OK;
diff --git a/camera/provider/2.5/default/OWNERS b/camera/provider/2.5/default/OWNERS
deleted file mode 100644
index f48a95c..0000000
--- a/camera/provider/2.5/default/OWNERS
+++ /dev/null
@@ -1 +0,0 @@
-include platform/frameworks/av:/camera/OWNERS
diff --git a/camera/provider/aidl/vts/OWNERS b/camera/provider/aidl/vts/OWNERS
deleted file mode 100644
index 27d370b..0000000
--- a/camera/provider/aidl/vts/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-# Camera team
-include platform/frameworks/av:/camera/OWNERS
-
-# VTS team
-yim@google.com
-zhuoyao@google.com
\ No newline at end of file
diff --git a/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp b/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
index 70ab7a0..2c98db8 100644
--- a/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
+++ b/camera/provider/aidl/vts/VtsAidlHalCameraProvider_TargetTest.cpp
@@ -1846,7 +1846,6 @@
 // Generate and verify 10-bit dynamic range request
 TEST_P(CameraAidlTest, process10BitDynamicRangeRequest) {
     std::vector<std::string> cameraDeviceNames = getCameraDeviceNames(mProvider);
-    int64_t bufferId = 1;
     CameraMetadata settings;
 
     for (const auto& name : cameraDeviceNames) {
@@ -1927,12 +1926,12 @@
             // Stream as long as needed to fill the Hal inflight queue
             std::vector<CaptureRequest> requests(halStreams[0].maxBuffers);
 
-            for (int32_t frameNumber = 0; frameNumber < requests.size(); frameNumber++) {
+            for (int32_t requestId = 0; requestId < requests.size(); requestId++) {
                 std::shared_ptr<InFlightRequest> inflightReq = std::make_shared<InFlightRequest>(
                         static_cast<ssize_t>(halStreams.size()), false, supportsPartialResults,
                         partialResultCount, std::unordered_set<std::string>(), resultQueue);
 
-                CaptureRequest& request = requests[frameNumber];
+                CaptureRequest& request = requests[requestId];
                 std::vector<StreamBuffer>& outputBuffers = request.outputBuffers;
                 outputBuffers.resize(halStreams.size());
 
@@ -1941,6 +1940,7 @@
                 std::vector<buffer_handle_t> graphicBuffers;
                 graphicBuffers.reserve(halStreams.size());
 
+                auto bufferId = requestId + 1; // Buffer id value 0 is not valid
                 for (const auto& halStream : halStreams) {
                     buffer_handle_t buffer_handle;
                     if (useHalBufManager) {
@@ -1959,14 +1959,13 @@
                         outputBuffers[k] = {halStream.id, bufferId,
                             android::makeToAidl(buffer_handle), BufferStatus::OK, NativeHandle(),
                             NativeHandle()};
-                        bufferId++;
                     }
                     k++;
                 }
 
                 request.inputBuffer = {
                         -1, 0, NativeHandle(), BufferStatus::ERROR, NativeHandle(), NativeHandle()};
-                request.frameNumber = frameNumber;
+                request.frameNumber = bufferId;
                 request.fmqSettingsSize = 0;
                 request.settings = settings;
                 request.inputWidth = 0;
@@ -1974,7 +1973,7 @@
 
                 {
                     std::unique_lock<std::mutex> l(mLock);
-                    mInflightMap[frameNumber] = inflightReq;
+                    mInflightMap[bufferId] = inflightReq;
                 }
 
             }
@@ -1990,7 +1989,10 @@
                     std::vector<int32_t> {halStreams[0].id});
             ASSERT_TRUE(returnStatus.isOk());
 
-            for (int32_t frameNumber = 0; frameNumber < requests.size(); frameNumber++) {
+            // We are keeping frame numbers and buffer ids consistent. Buffer id value of 0
+            // is used to indicate a buffer that is not present/available so buffer ids as well
+            // as frame numbers begin with 1.
+            for (int32_t frameNumber = 1; frameNumber <= requests.size(); frameNumber++) {
                 const auto& inflightReq = mInflightMap[frameNumber];
                 std::unique_lock<std::mutex> l(mLock);
                 while (!inflightReq->errorCodeValid &&
diff --git a/camera/provider/aidl/vts/camera_aidl_test.cpp b/camera/provider/aidl/vts/camera_aidl_test.cpp
index 2c2f1b2..12a26d2 100644
--- a/camera/provider/aidl/vts/camera_aidl_test.cpp
+++ b/camera/provider/aidl/vts/camera_aidl_test.cpp
@@ -167,7 +167,7 @@
         ScopedAStatus physicalCameraDeviceStatusChange(
                 const std::string&, const std::string&,
                 ::aidl::android::hardware::camera::common::CameraDeviceStatus) override {
-            return ndk::ScopedAStatus();
+            return ScopedAStatus::ok();
         }
 
         std::vector<std::string> externalCameraDeviceNames;
@@ -751,8 +751,6 @@
                                                  std::vector<AvailableStream>& outputStreams,
                                                  const AvailableStream* threshold,
                                                  bool maxResolution) {
-    AvailableStream depthPreviewThreshold = {kMaxPreviewWidth, kMaxPreviewHeight,
-                                             static_cast<int32_t>(PixelFormat::Y16)};
     if (nullptr == staticMeta) {
         return Status::ILLEGAL_ARGUMENT;
     }
@@ -778,7 +776,11 @@
     }
 
     if (foundDepth == 0 && (0 == (depthEntry.count % 4))) {
-        fillOutputStreams(&depthEntry, outputStreams, &depthPreviewThreshold,
+        AvailableStream depthPreviewThreshold = {kMaxPreviewWidth, kMaxPreviewHeight,
+                                                 static_cast<int32_t>(PixelFormat::Y16)};
+        const AvailableStream* depthThreshold =
+                (threshold != nullptr) ? threshold : &depthPreviewThreshold;
+        fillOutputStreams(&depthEntry, outputStreams, depthThreshold,
                           ANDROID_DEPTH_AVAILABLE_DEPTH_STREAM_CONFIGURATIONS_OUTPUT);
     }
 
diff --git a/camera/provider/aidl/vts/device_cb.cpp b/camera/provider/aidl/vts/device_cb.cpp
index 4698b4a..3ec96a1 100644
--- a/camera/provider/aidl/vts/device_cb.cpp
+++ b/camera/provider/aidl/vts/device_cb.cpp
@@ -429,10 +429,11 @@
         CameraAidlTest::InFlightRequest::StreamBufferAndTimestamp streamBufferAndTimestamp;
         auto outstandingBuffers = mUseHalBufManager ? mOutstandingBufferIds :
             request->mOutstandingBufferIds;
+        auto bufferId = mUseHalBufManager ? buffer.bufferId : results.frameNumber;
         auto outputBuffer = outstandingBuffers.empty() ? ::android::makeFromAidl(buffer.buffer) :
-            outstandingBuffers[buffer.streamId][buffer.bufferId];
+            outstandingBuffers[buffer.streamId][bufferId];
         streamBufferAndTimestamp.buffer = {buffer.streamId,
-                                           buffer.bufferId,
+                                           bufferId,
                                            outputBuffer,
                                            buffer.status,
                                            ::android::makeFromAidl(buffer.acquireFence),
diff --git a/cas/aidl/default/OWNERS b/cas/aidl/OWNERS
similarity index 100%
rename from cas/aidl/default/OWNERS
rename to cas/aidl/OWNERS
diff --git a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ICas.aidl b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ICas.aidl
index 28c9eb0..903ab92 100644
--- a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ICas.aidl
+++ b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ICas.aidl
@@ -36,6 +36,7 @@
 @VintfStability
 interface ICas {
   void closeSession(in byte[] sessionId);
+  byte[] openSessionDefault();
   byte[] openSession(in android.hardware.cas.SessionIntent intent, in android.hardware.cas.ScramblingMode mode);
   void processEcm(in byte[] sessionId, in byte[] ecm);
   void processEmm(in byte[] emm);
diff --git a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ScramblingMode.aidl b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ScramblingMode.aidl
index a0b08c9..9d542cc 100644
--- a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ScramblingMode.aidl
+++ b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/ScramblingMode.aidl
@@ -36,18 +36,18 @@
 @Backing(type="int") @VintfStability
 enum ScramblingMode {
   RESERVED = 0,
-  DVB_CSA1 = 1,
-  DVB_CSA2 = 2,
-  DVB_CSA3_STANDARD = 3,
-  DVB_CSA3_MINIMAL = 4,
-  DVB_CSA3_ENHANCE = 5,
-  DVB_CISSA_V1 = 6,
-  DVB_IDSA = 7,
-  MULTI2 = 8,
-  AES128 = 9,
-  AES_ECB = 10,
-  AES_SCTE52 = 11,
-  TDES_ECB = 12,
-  TDES_SCTE52 = 13,
-  AES_CBC = 14,
+  DVB_CSA1,
+  DVB_CSA2,
+  DVB_CSA3_STANDARD,
+  DVB_CSA3_MINIMAL,
+  DVB_CSA3_ENHANCE,
+  DVB_CISSA_V1,
+  DVB_IDSA,
+  MULTI2,
+  AES128,
+  AES_ECB,
+  AES_SCTE52,
+  TDES_ECB,
+  TDES_SCTE52,
+  AES_CBC,
 }
diff --git a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/SessionIntent.aidl b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/SessionIntent.aidl
index ade3001..00a2fd7 100644
--- a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/SessionIntent.aidl
+++ b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/SessionIntent.aidl
@@ -35,8 +35,8 @@
 /* @hide */
 @Backing(type="int") @VintfStability
 enum SessionIntent {
-  LIVE = 0,
-  PLAYBACK = 1,
-  RECORD = 2,
-  TIMESHIFT = 3,
+  LIVE,
+  PLAYBACK,
+  RECORD,
+  TIMESHIFT,
 }
diff --git a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/Status.aidl b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/Status.aidl
index 343c810..3691009 100644
--- a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/Status.aidl
+++ b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/Status.aidl
@@ -36,25 +36,25 @@
 @VintfStability
 parcelable Status {
   const int OK = 0;
-  const int ERROR_CAS_NO_LICENSE = -1;
-  const int ERROR_CAS_LICENSE_EXPIRED = -2;
-  const int ERROR_CAS_SESSION_NOT_OPENED = -3;
-  const int ERROR_CAS_CANNOT_HANDLE = -4;
-  const int ERROR_CAS_INVALID_STATE = -5;
-  const int BAD_VALUE = -6;
-  const int ERROR_CAS_NOT_PROVISIONED = -7;
-  const int ERROR_CAS_RESOURCE_BUSY = -8;
-  const int ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION = -9;
-  const int ERROR_CAS_TAMPER_DETECTED = -10;
-  const int ERROR_CAS_DEVICE_REVOKED = -11;
-  const int ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED = -12;
-  const int ERROR_CAS_DECRYPT = -13;
-  const int ERROR_CAS_UNKNOWN = -14;
-  const int ERROR_CAS_NEED_ACTIVATION = -15;
-  const int ERROR_CAS_NEED_PAIRING = -16;
-  const int ERROR_CAS_NO_CARD = -17;
-  const int ERROR_CAS_CARD_MUTE = -18;
-  const int ERROR_CAS_CARD_INVALID = -19;
-  const int ERROR_CAS_BLACKOUT = -20;
-  const int ERROR_CAS_REBOOTING = -21;
+  const int ERROR_CAS_NO_LICENSE = 1;
+  const int ERROR_CAS_LICENSE_EXPIRED = 2;
+  const int ERROR_CAS_SESSION_NOT_OPENED = 3;
+  const int ERROR_CAS_CANNOT_HANDLE = 4;
+  const int ERROR_CAS_INVALID_STATE = 5;
+  const int BAD_VALUE = 6;
+  const int ERROR_CAS_NOT_PROVISIONED = 7;
+  const int ERROR_CAS_RESOURCE_BUSY = 8;
+  const int ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION = 9;
+  const int ERROR_CAS_TAMPER_DETECTED = 10;
+  const int ERROR_CAS_DEVICE_REVOKED = 11;
+  const int ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED = 12;
+  const int ERROR_CAS_DECRYPT = 13;
+  const int ERROR_CAS_UNKNOWN = 14;
+  const int ERROR_CAS_NEED_ACTIVATION = 15;
+  const int ERROR_CAS_NEED_PAIRING = 16;
+  const int ERROR_CAS_NO_CARD = 17;
+  const int ERROR_CAS_CARD_MUTE = 18;
+  const int ERROR_CAS_CARD_INVALID = 19;
+  const int ERROR_CAS_BLACKOUT = 20;
+  const int ERROR_CAS_REBOOTING = 21;
 }
diff --git a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/StatusEvent.aidl b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/StatusEvent.aidl
index 165c0d4..0cf37dd 100644
--- a/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/StatusEvent.aidl
+++ b/cas/aidl/aidl_api/android.hardware.cas/current/android/hardware/cas/StatusEvent.aidl
@@ -35,6 +35,6 @@
 /* @hide */
 @Backing(type="byte") @VintfStability
 enum StatusEvent {
-  PLUGIN_PHYSICAL_MODULE_CHANGED = 0,
-  PLUGIN_SESSION_NUMBER_CHANGED = 1,
+  PLUGIN_PHYSICAL_MODULE_CHANGED,
+  PLUGIN_SESSION_NUMBER_CHANGED,
 }
diff --git a/cas/aidl/android/hardware/cas/ICas.aidl b/cas/aidl/android/hardware/cas/ICas.aidl
index e6494ae..272cb10 100644
--- a/cas/aidl/android/hardware/cas/ICas.aidl
+++ b/cas/aidl/android/hardware/cas/ICas.aidl
@@ -35,6 +35,14 @@
     void closeSession(in byte[] sessionId);
 
     /**
+     * Open a session to descramble one or more streams without specifying intention
+     * and scrambling mode.
+     *
+     * @return sessionId The id of the newly opened session.
+     */
+    byte[] openSessionDefault();
+
+    /**
      * Open a session to descramble one or more streams by specifying intention
      * and scrambling mode.
      *
diff --git a/cas/aidl/android/hardware/cas/Status.aidl b/cas/aidl/android/hardware/cas/Status.aidl
index e7ae8ff..ba0bd65 100644
--- a/cas/aidl/android/hardware/cas/Status.aidl
+++ b/cas/aidl/android/hardware/cas/Status.aidl
@@ -31,50 +31,50 @@
      * The CAS plugin must return ERROR_CAS_NO_LICENSE, when descrambling is
      * attempted and no license keys have been provided.
      */
-    const int ERROR_CAS_NO_LICENSE = -1;
+    const int ERROR_CAS_NO_LICENSE = 1;
 
     /**
      * ERROR_CAS_LICENSE_EXPIRED must be returned when an attempt is made
      * to use a license and the keys in that license have expired.
      */
-    const int ERROR_CAS_LICENSE_EXPIRED = -2;
+    const int ERROR_CAS_LICENSE_EXPIRED = 2;
 
     /**
      * The CAS plugin must return ERROR_CAS_SESSION_NOT_OPENED when an
      * attempt is made to use a session that has not been opened.
      */
-    const int ERROR_CAS_SESSION_NOT_OPENED = -3;
+    const int ERROR_CAS_SESSION_NOT_OPENED = 3;
 
     /**
      * The CAS plugin must return ERROR_CAS_CANNOT_HANDLE when an unsupported
      * data format or operation is attempted.
      */
-    const int ERROR_CAS_CANNOT_HANDLE = -4;
+    const int ERROR_CAS_CANNOT_HANDLE = 4;
 
     /**
      * ERROR_CAS_INVALID_STATE must be returned when the device is in a state
      * where it is not able to perform descrambling.
      */
-    const int ERROR_CAS_INVALID_STATE = -5;
+    const int ERROR_CAS_INVALID_STATE = 5;
 
     /**
      * The CAS plugin must return BAD_VALUE whenever an illegal parameter is
      * passed to one of the interface functions.
      */
-    const int BAD_VALUE = -6;
+    const int BAD_VALUE = 6;
 
     /**
      * The CAS plugin must return ERROR_CAS_NOT_PROVISIONED when the device
      * has not yet been provisioned.
      */
-    const int ERROR_CAS_NOT_PROVISIONED = -7;
+    const int ERROR_CAS_NOT_PROVISIONED = 7;
 
     /**
      * ERROR_CAS_RESOURCE_BUSY must be returned when resources, such as CAS
      * sessions or secure buffers are not available to perform a requested
      * operation because they are already in use.
      */
-    const int ERROR_CAS_RESOURCE_BUSY = -8;
+    const int ERROR_CAS_RESOURCE_BUSY = 8;
 
     /**
      * The CAS Plugin must return ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION
@@ -82,72 +82,72 @@
      * sufficient to meet the requirements in the license policy. HDCP is an
      * example of a form of output protection.
      */
-    const int ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION = -9;
+    const int ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION = 9;
 
     /**
      * The CAS Plugin must return ERROR_CAS_TAMPER_DETECTED if an attempt to
      * tamper with the CAS system is detected.
      */
-    const int ERROR_CAS_TAMPER_DETECTED = -10;
+    const int ERROR_CAS_TAMPER_DETECTED = 10;
 
     /**
      * The CAS Plugin must return ERROR_CAS_DEVICE_REVOKED if the response
      * indicates that the device has been revoked. Device revocation means
      * that the device is no longer permitted to play content.
      */
-    const int ERROR_CAS_DEVICE_REVOKED = -11;
+    const int ERROR_CAS_DEVICE_REVOKED = 11;
 
     /**
      * The CAS plugin must return ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED when
      * descrambling is failing because the session is not initialized properly.
      */
-    const int ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED = -12;
+    const int ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED = 12;
 
     /**
      * The CAS Plugin must return ERROR_CAS_DECRYPT if the DescramblerPlugin's
      * descramble operation fails.
      */
-    const int ERROR_CAS_DECRYPT = -13;
+    const int ERROR_CAS_DECRYPT = 13;
 
     /**
      * ERROR_CAS_UNKNOWN must be returned when a fatal failure occurs and no
      * other defined error is appropriate.
      */
-    const int ERROR_CAS_UNKNOWN = -14;
+    const int ERROR_CAS_UNKNOWN = 14;
 
     /**
      * ERROR_CAS_NEED_ACTIVATION is used to trigger device activation process.
      */
-    const int ERROR_CAS_NEED_ACTIVATION = -15;
+    const int ERROR_CAS_NEED_ACTIVATION = 15;
 
     /**
      * ERROR_CAS_NEED_PAIRING is used to trigger pairing process.
      */
-    const int ERROR_CAS_NEED_PAIRING = -16;
+    const int ERROR_CAS_NEED_PAIRING = 16;
 
     /**
      * ERROR_CAS_NO_CARD is used to report no smart card for descrambling.
      */
-    const int ERROR_CAS_NO_CARD = -17;
+    const int ERROR_CAS_NO_CARD = 17;
 
     /**
      * ERROR_CAS_CARD_MUTE is used to report smart card is muted for
      * descrambling.
      */
-    const int ERROR_CAS_CARD_MUTE = -18;
+    const int ERROR_CAS_CARD_MUTE = 18;
 
     /**
      *  ERROR_CAS_CARD_INVALID is used to report smart card isn't valid.
      */
-    const int ERROR_CAS_CARD_INVALID = -19;
+    const int ERROR_CAS_CARD_INVALID = 19;
 
     /**
      *  ERROR_CAS_BLACKOUT is used to report geographical blackout.
      */
-    const int ERROR_CAS_BLACKOUT = -20;
+    const int ERROR_CAS_BLACKOUT = 20;
 
     /**
      * ERROR_CAS_REBOOTING is used to report CAS is during rebooting.
      */
-    const int ERROR_CAS_REBOOTING = -21;
+    const int ERROR_CAS_REBOOTING = 21;
 }
diff --git a/cas/aidl/default/CasImpl.cpp b/cas/aidl/default/CasImpl.cpp
index 2d31b35..f08fcc0 100755
--- a/cas/aidl/default/CasImpl.cpp
+++ b/cas/aidl/default/CasImpl.cpp
@@ -128,6 +128,19 @@
     return toStatus(holder->setPrivateData(pvtData));
 }
 
+ScopedAStatus CasImpl::openSessionDefault(vector<uint8_t>* sessionId) {
+    ALOGV("%s", __FUNCTION__);
+
+    shared_ptr<CasPlugin> holder = atomic_load(&mPluginHolder);
+    status_t err = INVALID_OPERATION;
+    if (holder.get() != nullptr) {
+        err = holder->openSession(sessionId);
+        holder.reset();
+    }
+
+    return toStatus(err);
+}
+
 ScopedAStatus CasImpl::openSession(SessionIntent intent, ScramblingMode mode,
                                    vector<uint8_t>* sessionId) {
     ALOGV("%s", __FUNCTION__);
diff --git a/cas/aidl/default/CasImpl.h b/cas/aidl/default/CasImpl.h
index 84a8115..2488a7f 100755
--- a/cas/aidl/default/CasImpl.h
+++ b/cas/aidl/default/CasImpl.h
@@ -53,6 +53,8 @@
 
     virtual ScopedAStatus setPrivateData(const vector<uint8_t>& pvtData) override;
 
+    virtual ScopedAStatus openSessionDefault(vector<uint8_t>* sessionId) override;
+
     virtual ScopedAStatus openSession(SessionIntent intent, ScramblingMode mode,
                                       vector<uint8_t>* sessionId) override;
 
diff --git a/cas/aidl/default/FactoryLoader.h b/cas/aidl/default/FactoryLoader.h
index f90b109..6a562f6 100755
--- a/cas/aidl/default/FactoryLoader.h
+++ b/cas/aidl/default/FactoryLoader.h
@@ -139,6 +139,7 @@
             queryPluginsFromPath(pluginPath, results);
         }
     }
+    closedir(pDir);
     return true;
 }
 
diff --git a/cas/aidl/vts/functional/VtsHalCasAidlTargetTest.cpp b/cas/aidl/vts/functional/VtsHalCasAidlTargetTest.cpp
index 266b55d..4c904a8 100644
--- a/cas/aidl/vts/functional/VtsHalCasAidlTargetTest.cpp
+++ b/cas/aidl/vts/functional/VtsHalCasAidlTargetTest.cpp
@@ -286,6 +286,7 @@
     } OobInputTestParams;
 
     AssertionResult createCasPlugin(int32_t caSystemId);
+    AssertionResult openCasSessionDefault(vector<uint8_t>* sessionId);
     AssertionResult openCasSession(vector<uint8_t>* sessionId, SessionIntent intent,
                                    ScramblingMode mode);
     AssertionResult descrambleTestInputBuffer(const shared_ptr<IDescrambler>& descrambler,
@@ -331,6 +332,10 @@
     return AssertionResult(mDescrambler != nullptr);
 }
 
+AssertionResult MediaCasAidlTest::openCasSessionDefault(vector<uint8_t>* sessionId) {
+    return AssertionResult(mMediaCas->openSessionDefault(sessionId).isOk());
+}
+
 AssertionResult MediaCasAidlTest::openCasSession(vector<uint8_t>* sessionId, SessionIntent intent,
                                                  ScramblingMode mode) {
     return AssertionResult(mMediaCas->openSession(intent, mode, sessionId).isOk());
@@ -485,6 +490,32 @@
     ADD_FAILURE() << "ClearKey plugin not installed";
 }
 
+TEST_P(MediaCasAidlTest, TestClearKeyDefaultSessionClosedAfterRelease) {
+    description("Test that all sessions are closed after a MediaCas object is released");
+
+    ASSERT_TRUE(createCasPlugin(CLEAR_KEY_SYSTEM_ID));
+
+    EXPECT_TRUE(mMediaCas->provision(PROVISION_STR).isOk());
+
+    vector<uint8_t> sessionId;
+    ASSERT_TRUE(openCasSessionDefault(&sessionId));
+
+    vector<uint8_t> streamSessionId;
+    ASSERT_TRUE(openCasSessionDefault(&streamSessionId));
+
+    EXPECT_TRUE(mMediaCas->release().isOk());
+
+    if (mDescrambler != nullptr) {
+        auto status = mDescrambler->setMediaCasSession(sessionId);
+        EXPECT_FALSE(status.isOk());
+        EXPECT_EQ(Status::ERROR_CAS_SESSION_NOT_OPENED, status.getServiceSpecificError());
+
+        status = mDescrambler->setMediaCasSession(streamSessionId);
+        EXPECT_FALSE(status.isOk());
+        EXPECT_EQ(Status::ERROR_CAS_SESSION_NOT_OPENED, status.getServiceSpecificError());
+    }
+}
+
 TEST_P(MediaCasAidlTest, TestClearKeySessionClosedAfterRelease) {
     description("Test that all sessions are closed after a MediaCas object is released");
 
diff --git a/compatibility_matrices/Android.bp b/compatibility_matrices/Android.bp
index 37c2820..e1ad1f3 100644
--- a/compatibility_matrices/Android.bp
+++ b/compatibility_matrices/Android.bp
@@ -22,17 +22,6 @@
 }
 
 vintf_compatibility_matrix {
-    name: "framework_compatibility_matrix.3.xml",
-    stem: "compatibility_matrix.3.xml",
-    srcs: [
-        "compatibility_matrix.3.xml",
-    ],
-    kernel_configs: [
-        "kernel_config_p_4.14",
-    ],
-}
-
-vintf_compatibility_matrix {
     name: "framework_compatibility_matrix.4.xml",
     stem: "compatibility_matrix.4.xml",
     srcs: [
@@ -83,10 +72,10 @@
 }
 
 vintf_compatibility_matrix {
-    name: "framework_compatibility_matrix.current.xml",
-    stem: "compatibility_matrix.current.xml",
+    name: "framework_compatibility_matrix.8.xml",
+    stem: "compatibility_matrix.8.xml",
     srcs: [
-        "compatibility_matrix.current.xml",
+        "compatibility_matrix.8.xml",
     ],
     kernel_configs: [
         "kernel_config_current_5.10",
diff --git a/compatibility_matrices/Android.mk b/compatibility_matrices/Android.mk
index d19f0da..6e4c419 100644
--- a/compatibility_matrices/Android.mk
+++ b/compatibility_matrices/Android.mk
@@ -98,12 +98,11 @@
 endif # DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE
 
 my_system_matrix_deps := \
-    framework_compatibility_matrix.3.xml \
     framework_compatibility_matrix.4.xml \
     framework_compatibility_matrix.5.xml \
     framework_compatibility_matrix.6.xml \
     framework_compatibility_matrix.7.xml \
-    framework_compatibility_matrix.current.xml \
+    framework_compatibility_matrix.8.xml \
     framework_compatibility_matrix.device.xml \
 
 my_framework_matrix_deps += \
diff --git a/compatibility_matrices/compatibility_matrix.3.xml b/compatibility_matrices/compatibility_matrix.3.xml
deleted file mode 100644
index 0964c99..0000000
--- a/compatibility_matrices/compatibility_matrix.3.xml
+++ /dev/null
@@ -1,481 +0,0 @@
-<compatibility-matrix version="1.0" type="framework" level="3">
-    <hal format="hidl" optional="false">
-        <name>android.hardware.audio</name>
-        <version>4.0</version>
-        <interface>
-            <name>IDevicesFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.audio.effect</name>
-        <version>4.0</version>
-        <interface>
-            <name>IEffectsFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.authsecret</name>
-        <version>1.0</version>
-        <interface>
-            <name>IAuthSecret</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.automotive.audiocontrol</name>
-        <version>1.0</version>
-        <interface>
-            <name>IAudioControl</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.automotive.evs</name>
-        <version>1.0</version>
-        <interface>
-            <name>IEvsEnumerator</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.automotive.vehicle</name>
-        <version>2.0</version>
-        <interface>
-            <name>IVehicle</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.biometrics.fingerprint</name>
-        <version>2.1</version>
-        <interface>
-            <name>IBiometricsFingerprint</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.bluetooth</name>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothHci</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.bluetooth.a2dp</name>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothAudioOffload</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.boot</name>
-        <version>1.0</version>
-        <interface>
-            <name>IBootControl</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.broadcastradio</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>IBroadcastRadioFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.broadcastradio</name>
-        <version>2.0</version>
-        <interface>
-            <name>IBroadcastRadio</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.camera.provider</name>
-        <version>2.4</version>
-        <interface>
-            <name>ICameraProvider</name>
-            <regex-instance>[^/]+/[0-9]+</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.cas</name>
-        <version>1.0</version>
-        <interface>
-            <name>IMediaCasService</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.configstore</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>ISurfaceFlingerConfigs</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.confirmationui</name>
-        <version>1.0</version>
-        <interface>
-            <name>IConfirmationUI</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.contexthub</name>
-        <version>1.0</version>
-        <interface>
-            <name>IContexthub</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.drm</name>
-        <version>1.0</version>
-        <interface>
-            <name>ICryptoFactory</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-        <interface>
-            <name>IDrmFactory</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.drm</name>
-        <version>1.1</version>
-        <interface>
-            <name>ICryptoFactory</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-        <interface>
-            <name>IDrmFactory</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.dumpstate</name>
-        <version>1.0</version>
-        <interface>
-            <name>IDumpstateDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.gatekeeper</name>
-        <version>1.0</version>
-        <interface>
-            <name>IGatekeeper</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.gnss</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>IGnss</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <!-- Either the AIDL or the HIDL allocator HAL must exist on the device.
-         If the HIDL composer HAL exists, it must be at least version 2.0.
-         See DeviceManifestTest.GrallocHal -->
-    <hal format="hidl" optional="true">
-        <name>android.hardware.graphics.allocator</name>
-        <version>2.0</version>
-        <interface>
-            <name>IAllocator</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.graphics.composer</name>
-        <version>2.1-2</version>
-        <interface>
-            <name>IComposer</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.graphics.mapper</name>
-        <version>2.0-1</version>
-        <interface>
-            <name>IMapper</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <!-- Either the AIDL or the HIDL health HAL must exist on the device.
-         If the HIDL health HAL exists, it must be at least version 2.0.
-         See DeviceManifestTest.HealthHal -->
-    <hal format="hidl" optional="true">
-        <name>android.hardware.health</name>
-        <version>2.0</version>
-        <interface>
-            <name>IHealth</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.ir</name>
-        <version>1.0</version>
-        <interface>
-            <name>IConsumerIr</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.keymaster</name>
-        <version>3.0</version>
-        <version>4.0</version>
-        <interface>
-            <name>IKeymasterDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.keymaster</name>
-        <version>4.0</version>
-        <interface>
-            <name>IKeymasterDevice</name>
-            <instance>strongbox</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.light</name>
-        <version>2.0</version>
-        <interface>
-            <name>ILight</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="false">
-        <name>android.hardware.media.omx</name>
-        <version>1.0</version>
-        <interface>
-            <name>IOmx</name>
-            <instance>default</instance>
-        </interface>
-        <interface>
-            <name>IOmxStore</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.memtrack</name>
-        <version>1.0</version>
-        <interface>
-            <name>IMemtrack</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.neuralnetworks</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>IDevice</name>
-            <regex-instance>.*</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.nfc</name>
-        <version>1.1</version>
-        <interface>
-            <name>INfc</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.oemlock</name>
-        <version>1.0</version>
-        <interface>
-            <name>IOemLock</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.power</name>
-        <version>1.0-3</version>
-        <interface>
-            <name>IPower</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.radio</name>
-        <!-- ref: b/123249760. 1.3 added here since 1.3 and 1.4 introduced in Q -->
-        <version>1.0-3</version>
-        <interface>
-            <name>IRadio</name>
-            <instance>slot1</instance>
-            <instance>slot2</instance>
-            <instance>slot3</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.radio</name>
-        <version>1.0-2</version>
-        <interface>
-            <name>ISap</name>
-            <instance>slot1</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.radio.config</name>
-        <version>1.0</version>
-        <interface>
-            <name>IRadioConfig</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.renderscript</name>
-        <version>1.0</version>
-        <interface>
-            <name>IDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.secure_element</name>
-        <version>1.0</version>
-        <interface>
-            <name>ISecureElement</name>
-            <regex-instance>eSE[1-9][0-9]*</regex-instance>
-            <regex-instance>SIM[1-9][0-9]*</regex-instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.sensors</name>
-        <version>1.0</version>
-        <interface>
-            <name>ISensors</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.soundtrigger</name>
-        <version>2.0-1</version>
-        <interface>
-            <name>ISoundTriggerHw</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.tetheroffload.config</name>
-        <version>1.0</version>
-        <interface>
-            <name>IOffloadConfig</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.tetheroffload.control</name>
-        <version>1.0</version>
-        <interface>
-            <name>IOffloadControl</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.thermal</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>IThermal</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.tv.cec</name>
-        <version>1.0</version>
-        <interface>
-            <name>IHdmiCec</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.tv.input</name>
-        <version>1.0</version>
-        <interface>
-            <name>ITvInput</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.usb</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>IUsb</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.usb.gadget</name>
-        <version>1.0</version>
-        <interface>
-            <name>IUsbGadget</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.vibrator</name>
-        <version>1.0-2</version>
-        <interface>
-            <name>IVibrator</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.vr</name>
-        <version>1.0</version>
-        <interface>
-            <name>IVr</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.weaver</name>
-        <version>1.0</version>
-        <interface>
-            <name>IWeaver</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.wifi</name>
-        <version>1.0-2</version>
-        <interface>
-            <name>IWifi</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.wifi.hostapd</name>
-        <version>1.0</version>
-        <interface>
-            <name>IHostapd</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.wifi.offload</name>
-        <version>1.0</version>
-        <interface>
-            <name>IOffload</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.wifi.supplicant</name>
-        <version>1.0-1</version>
-        <interface>
-            <name>ISupplicant</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-</compatibility-matrix>
diff --git a/compatibility_matrices/compatibility_matrix.7.xml b/compatibility_matrices/compatibility_matrix.7.xml
index 26b8d63..5694945 100644
--- a/compatibility_matrices/compatibility_matrix.7.xml
+++ b/compatibility_matrices/compatibility_matrix.7.xml
@@ -7,7 +7,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hardware.audio</name>
         <version>6.0</version>
         <version>7.0-1</version>
@@ -16,7 +16,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hardware.audio.effect</name>
         <version>6.0</version>
         <version>7.0</version>
@@ -238,7 +238,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hardware.gatekeeper</name>
         <version>1.0</version>
         <interface>
@@ -316,7 +316,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hardware.graphics.mapper</name>
         <!-- New, non-Go devices should use 4.0, tested in vts_treble_vintf_vendor_test -->
         <version>2.1</version>
@@ -682,7 +682,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="false">
+    <hal format="hidl" optional="true">
         <name>android.hardware.thermal</name>
         <version>2.0</version>
         <interface>
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.8.xml
similarity index 97%
rename from compatibility_matrices/compatibility_matrix.current.xml
rename to compatibility_matrices/compatibility_matrix.8.xml
index 59c87ec..c7b05e8 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.8.xml
@@ -167,7 +167,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.bluetooth.audio</name>
-        <version>2</version>
+        <version>3</version>
         <interface>
             <name>IBluetoothAudioProviderFactory</name>
             <instance>default</instance>
@@ -212,14 +212,6 @@
             <regex-instance>[^/]+/[0-9]+</regex-instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.cas</name>
-        <version>1.1-2</version>
-        <interface>
-            <name>IMediaCasService</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.cas</name>
         <interface>
@@ -357,7 +349,7 @@
     </hal>
     <hal format="aidl" optional="false">
         <name>android.hardware.health</name>
-        <version>1</version>
+        <version>1-2</version>
         <interface>
             <name>IHealth</name>
             <instance>default</instance>
@@ -511,6 +503,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.power.stats</name>
+        <version>2</version>
         <interface>
             <name>IPowerStats</name>
             <instance>default</instance>
@@ -692,7 +685,15 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="false">
+    <hal format="aidl" optional="true">
+        <name>android.hardware.tetheroffload</name>
+        <version>1</version>
+        <interface>
+            <name>IOffload</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
         <name>android.hardware.thermal</name>
         <version>1</version>
         <interface>
@@ -702,6 +703,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.tv.hdmi.cec</name>
+        <version>1</version>
         <interface>
             <name>IHdmiCec</name>
             <instance>default</instance>
@@ -709,6 +711,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.tv.hdmi.earc</name>
+        <version>1</version>
         <interface>
             <name>IEArc</name>
             <instance>default</instance>
@@ -716,6 +719,7 @@
     </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.tv.hdmi.connection</name>
+        <version>1</version>
         <interface>
             <name>IHdmiConnection</name>
             <instance>default</instance>
@@ -752,14 +756,6 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="true">
-        <name>android.hardware.usb.gadget</name>
-        <version>1.0-2</version>
-        <interface>
-            <name>IUsbGadget</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
     <hal format="aidl" optional="true">
         <name>android.hardware.usb.gadget</name>
         <interface>
@@ -799,7 +795,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="aidl" optional="true">
+    <hal format="aidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.wifi</name>
         <version>1</version>
         <interface>
@@ -807,7 +803,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl" optional="true">
+    <hal format="hidl" optional="true" updatable-via-apex="true">
         <name>android.hardware.wifi</name>
         <version>1.3-6</version>
         <interface>
@@ -843,7 +839,6 @@
         <name>mapper</name>
         <version>5.0</version>
         <interface>
-            <name>I</name>
             <regex-instance>.*</regex-instance>
         </interface>
     </hal>
diff --git a/compatibility_matrices/exclude/fcm_exclude.cpp b/compatibility_matrices/exclude/fcm_exclude.cpp
index 3c0c5f1..b17c0e2 100644
--- a/compatibility_matrices/exclude/fcm_exclude.cpp
+++ b/compatibility_matrices/exclude/fcm_exclude.cpp
@@ -84,6 +84,24 @@
             "android.hardware.nfc@1.0",
             // TODO(b/171260715) Remove when HAL definition is removed
             "android.hardware.radio.deprecated@1.0",
+
+            // TODO(b/205175891): File individual bugs for these HALs deprecated in P
+            "android.hardware.audio.effect@4.0",
+            "android.hardware.audio@4.0",
+            "android.hardware.bluetooth.a2dp@1.0",
+            "android.hardware.cas@1.0",
+            "android.hardware.configstore@1.0",
+            "android.hardware.gnss@1.0",
+            "android.hardware.gnss@1.1",
+            "android.hardware.graphics.mapper@2.0",
+            "android.hardware.nfc@1.1",
+            "android.hardware.radio.config@1.0",
+            "android.hardware.radio@1.0",
+            "android.hardware.radio@1.1",
+            "android.hardware.radio@1.3",
+            "android.hardware.thermal@1.0",
+            "android.hardware.thermal@1.1",
+            "android.hardware.wifi.offload@1.0",
     };
 
     auto package_has_prefix = [&](const std::string& prefix) {
diff --git a/confirmationui/aidl/android/hardware/confirmationui/IConfirmationResultCallback.aidl b/confirmationui/aidl/android/hardware/confirmationui/IConfirmationResultCallback.aidl
index 2165fdd..92328a8 100644
--- a/confirmationui/aidl/android/hardware/confirmationui/IConfirmationResultCallback.aidl
+++ b/confirmationui/aidl/android/hardware/confirmationui/IConfirmationResultCallback.aidl
@@ -26,16 +26,16 @@
 interface IConfirmationResultCallback {
     /**
      * This callback is called by the confirmation provider when it stops prompting the user.
-     * Iff the user has confirmed the prompted text, error is ErrorCode::OK and the
+     * Iff the user has confirmed the prompted text, error is IConfirmationUI::OK and the
      * parameters formattedMessage and confirmationToken hold the values needed to request
      * a signature from keymaster.
      * In all other cases formattedMessage and confirmationToken must be of length 0.
      *
-     * @param error - OK: IFF the user has confirmed the prompt.
-     *              - CANCELED: If the user has pressed the cancel button.
-     *              - ABORTED: If IConfirmationUI::abort() was called.
-     *              - SYSTEM_ERROR: If an unexpected System error occurred that prevented the TUI
-     *                             from being shut down gracefully.
+     * @param error - IConfirmationUI::OK: IFF the user has confirmed the prompt.
+     *              - IConfirmationUI::CANCELED: If the user has pressed the cancel button.
+     *              - IConfirmationUI::ABORTED: If IConfirmationUI::abort() was called.
+     *              - IConfirmationUI::SYSTEM_ERROR: If an unexpected System error occurred that
+     * prevented the TUI from being shut down gracefully.
      *
      * @param formattedMessage holds the prompt text and extra data.
      *                         The message is CBOR (RFC 7049) encoded and has the following format:
@@ -59,7 +59,7 @@
      *                          the "", concatenated with the formatted message as returned in the
      *                          formattedMessage argument. The HMAC is keyed with a 256-bit secret
      *                          which is shared with Keymaster. In test mode the test key MUST be
-     *                          used (see types.hal TestModeCommands and
+     *                          used (see TestModeCommands.aidl and
      * IConfirmationUI::TEST_KEY_BYTE).
      */
     void result(in int error, in byte[] formattedMessage, in byte[] confirmationToken);
diff --git a/confirmationui/aidl/android/hardware/confirmationui/IConfirmationUI.aidl b/confirmationui/aidl/android/hardware/confirmationui/IConfirmationUI.aidl
index f071126..20032ce 100644
--- a/confirmationui/aidl/android/hardware/confirmationui/IConfirmationUI.aidl
+++ b/confirmationui/aidl/android/hardware/confirmationui/IConfirmationUI.aidl
@@ -91,7 +91,7 @@
     /**
      * Aborts a pending user prompt. This allows the framework to gracefully end a TUI dialog.
      * If a TUI operation was pending the corresponding call back is informed with
-     * ErrorCode::Aborted.
+     * IConfirmationUI::ABORTED.
      */
     void abort();
 
@@ -139,7 +139,7 @@
      *                      is an IETF BCP 47 tag.
      *
      * @param uiOptions A set of uiOptions manipulating how the confirmation prompt is displayed.
-     *                  Refer to UIOption in types.hal for possible options.
+     *                  Refer to UIOption in UIOptions.aidl for possible options.
      */
     void promptUserConfirmation(in IConfirmationResultCallback resultCB, in byte[] promptText,
             in byte[] extraData, in @utf8InCpp String locale, in UIOption[] uiOptions);
diff --git a/confirmationui/aidl/android/hardware/confirmationui/TestModeCommands.aidl b/confirmationui/aidl/android/hardware/confirmationui/TestModeCommands.aidl
index 5b1d8fb..70f69c9 100644
--- a/confirmationui/aidl/android/hardware/confirmationui/TestModeCommands.aidl
+++ b/confirmationui/aidl/android/hardware/confirmationui/TestModeCommands.aidl
@@ -34,15 +34,15 @@
 enum TestModeCommands {
     /**
      * Simulates the user pressing the OK button on the UI. If no operation is pending
-     * ResponseCode::Ignored must be returned. A pending operation is finalized successfully
+     * IConfirmationUI::IGNORED must be returned. A pending operation is finalized successfully
      * see IConfirmationResultCallback::result, however, the test key
      * (see IConfirmationUI::TEST_KEY_BYTE) MUST be used to generate the confirmation token.
      */
     OK_EVENT = 0,
     /**
      * Simulates the user pressing the CANCEL button on the UI. If no operation is pending
-     * Result::Ignored must be returned. A pending operation is finalized as specified in
-     * IConfirmationResultCallback.hal.
+     * IConfirmationUI::IGNORED must be returned. A pending operation is finalized as specified in
+     * IConfirmationResultCallback.aidl.
      */
     CANCEL_EVENT = 1,
 }
diff --git a/drm/README.md b/drm/README.md
new file mode 100644
index 0000000..d56288e
--- /dev/null
+++ b/drm/README.md
@@ -0,0 +1,13 @@
+# DRM HAL
+
+This is the underlying HAL implementation for `MediaDrm`/`MediaCrypto` (and
+their NDK counterparts).
+
+## Plugin-vendor-specific VTS modules
+
+The interface `DrmHalVTSVendorModule_V1` is compatible with all versions of the
+DRM HAL (hidl 1.0-1.4, aidl).
+
+Please see `./1.0/vts/doc/Drm_Vendor_Modules_v1.pdf`.
+
+TODO(b/266091099): convert `Drm_Vendor_Modules_v1.pdf` to Markdown.
\ No newline at end of file
diff --git a/drm/aidl/vts/drm_hal_common.cpp b/drm/aidl/vts/drm_hal_common.cpp
index 7de8167..f0445a5 100644
--- a/drm/aidl/vts/drm_hal_common.cpp
+++ b/drm/aidl/vts/drm_hal_common.cpp
@@ -187,6 +187,12 @@
     auto svc = GetParamService();
     const string drmInstance = HalFullName(kDrmIface, svc);
 
+    if (!vendorModule) {
+        ASSERT_NE(drmInstance, HalFullName(kDrmIface, "widevine")) << "Widevine requires vendor module.";
+        ASSERT_NE(drmInstance, HalFullName(kDrmIface, "clearkey")) << "Clearkey requires vendor module.";
+        GTEST_SKIP() << "No vendor module installed";
+    }
+
     if (drmInstance.find("IDrmFactory") != std::string::npos) {
         drmFactory = IDrmFactory::fromBinder(
                 ::ndk::SpAIBinder(AServiceManager_waitForService(drmInstance.c_str())));
@@ -195,12 +201,6 @@
         cryptoPlugin = createCryptoPlugin();
     }
 
-    if (!vendorModule) {
-        ASSERT_NE(drmInstance, "widevine") << "Widevine requires vendor module.";
-        ASSERT_NE(drmInstance, "clearkey") << "Clearkey requires vendor module.";
-        GTEST_SKIP() << "No vendor module installed";
-    }
-
     ASSERT_EQ(HalBaseName(drmInstance), vendorModule->getServiceName());
     contentConfigurations = vendorModule->getContentConfigurations();
 
@@ -263,6 +263,9 @@
 }
 
 bool DrmHalTest::isCryptoSchemeSupported(Uuid uuid, SecurityLevel level, std::string mime) {
+    if (drmFactory == nullptr) {
+        return false;
+    }
     CryptoSchemes schemes{};
     auto ret = drmFactory->getSupportedCryptoSchemes(&schemes);
     EXPECT_OK(ret);
diff --git a/fastboot/aidl/default/Android.bp b/fastboot/aidl/default/Android.bp
index 0c96b33..cb38dcc 100644
--- a/fastboot/aidl/default/Android.bp
+++ b/fastboot/aidl/default/Android.bp
@@ -26,7 +26,7 @@
     name: "android.hardware.fastboot-service.example_recovery",
     init_rc: ["android.hardware.fastboot-service.example_recovery.rc"],
     vintf_fragments: ["android.hardware.fastboot-service.example.xml"],
-    recovery_available: true,
+    recovery: true,
     srcs: [
         "Fastboot.cpp",
         "main.cpp",
diff --git a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
index 04bacf0..227210b 100644
--- a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
+++ b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperEnrollResponse.aidl
@@ -22,11 +22,12 @@
 @VintfStability
 parcelable GatekeeperEnrollResponse {
     /**
-     * Request completion status
+     * Request completion status. The status code can be IGatekeeper::STATUS_OK
+     * or IGatekeeper::ERROR_RETRY_TIMEOUT.
      */
     int statusCode;
     /**
-     * Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
+     * Retry timeout in ms, if code == IGatekeeper::ERROR_RETRY_TIMEOUT
      * otherwise unused (0)
      */
     int timeoutMs;
diff --git a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
index bcf2d76..f8dbeeb 100644
--- a/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
+++ b/gatekeeper/aidl/android/hardware/gatekeeper/GatekeeperVerifyResponse.aidl
@@ -24,11 +24,12 @@
 @VintfStability
 parcelable GatekeeperVerifyResponse {
     /**
-     * Request completion status
+     * Request completion status. The status code can be IGatekeeper::STATUS_OK
+     * or IGatekeeper::ERROR_RETRY_TIMEOUT or IGatekeeper::STATUS_REENROLL.
      */
     int statusCode;
     /**
-     * Retry timeout in ms, if code == ERROR_RETRY_TIMEOUT
+     * Retry timeout in ms, if code == IGatekeeper::ERROR_RETRY_TIMEOUT
      * otherwise unused (0)
      */
     int timeoutMs;
diff --git a/gatekeeper/aidl/android/hardware/gatekeeper/IGatekeeper.aidl b/gatekeeper/aidl/android/hardware/gatekeeper/IGatekeeper.aidl
index 927293e..215c6e6 100644
--- a/gatekeeper/aidl/android/hardware/gatekeeper/IGatekeeper.aidl
+++ b/gatekeeper/aidl/android/hardware/gatekeeper/IGatekeeper.aidl
@@ -30,7 +30,7 @@
     const int STATUS_REENROLL = 1;
     /* operation is successful */
     const int STATUS_OK = 0;
-    /* operation is successful. */
+    /* operation failed. */
     const int ERROR_GENERAL_FAILURE = -1;
     /* operation should  be retried after timeout. */
     const int ERROR_RETRY_TIMEOUT = -2;
diff --git a/gnss/aidl/vts/gnss_hal_test_cases.cpp b/gnss/aidl/vts/gnss_hal_test_cases.cpp
index 3696233..c7fc32a 100644
--- a/gnss/aidl/vts/gnss_hal_test_cases.cpp
+++ b/gnss/aidl/vts/gnss_hal_test_cases.cpp
@@ -526,6 +526,11 @@
 
     EXPECT_EQ(gnssPowerIndicationCallback->capabilities_cbq_.calledCount(), 1);
 
+    if (gnssPowerIndicationCallback->last_capabilities_ == 0) {
+        // Skipping the test since GnssPowerIndication is not supported.
+        return;
+    }
+
     // Request and verify a GnssPowerStats is received
     gnssPowerIndicationCallback->gnss_power_stats_cbq_.reset();
     iGnssPowerIndication->requestGnssPowerStats();
diff --git a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
index 02f6212..f1d61f8 100644
--- a/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
+++ b/graphics/composer/2.3/utils/hal/include/composer-hal/2.3/ComposerCommandEngine.h
@@ -73,9 +73,7 @@
     }
 
     bool executeSetLayerPerFrameMetadataBlobs(uint16_t length) {
-        // must have at least one metadata blob
-        // of at least size 1 in queue (i.e {/*numBlobs=*/1, key, size, blob})
-        if (length < 4) {
+        if (length == 0) {
             return false;
         }
 
diff --git a/graphics/mapper/stable-c/README.md b/graphics/mapper/stable-c/README.md
index 30f3ccc..0b9b499 100644
--- a/graphics/mapper/stable-c/README.md
+++ b/graphics/mapper/stable-c/README.md
@@ -15,7 +15,6 @@
         <name>mapper</name>
         <version>5.0</version>
         <interface>
-            <name>I</name>
             <instance>minigbm</instance>
         </interface>
     </hal>
diff --git a/graphics/mapper/stable-c/implutils/impltests.cpp b/graphics/mapper/stable-c/implutils/impltests.cpp
index f12b069..01a1db9 100644
--- a/graphics/mapper/stable-c/implutils/impltests.cpp
+++ b/graphics/mapper/stable-c/implutils/impltests.cpp
@@ -359,35 +359,35 @@
     auto mpbuf = encode<StandardMetadataType::BUFFER_ID>(42);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeBufferId(42, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Name) {
     auto mpbuf = encode<StandardMetadataType::NAME>("Hello, Interop!");
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeName("Hello, Interop!", &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Width) {
     auto mpbuf = encode<StandardMetadataType::WIDTH>(128);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeWidth(128, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Height) {
     auto mpbuf = encode<StandardMetadataType::HEIGHT>(64);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeHeight(64, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, LayerCount) {
     auto mpbuf = encode<StandardMetadataType::LAYER_COUNT>(3);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeLayerCount(3, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatRequested) {
@@ -395,21 +395,21 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatRequested(
                                 hardware::graphics::common::V1_2::PixelFormat::RGBX_8888, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatFourcc) {
     auto mpbuf = encode<StandardMetadataType::PIXEL_FORMAT_FOURCC>(DRM_FORMAT_ABGR8888);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatFourCC(DRM_FORMAT_ABGR8888, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PixelFormatModifier) {
     auto mpbuf = encode<StandardMetadataType::PIXEL_FORMAT_MODIFIER>(123456);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePixelFormatModifier(123456, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Usage) {
@@ -420,21 +420,21 @@
                       static_cast<uint64_t>(
                               hardware::graphics::common::V1_2::BufferUsage::COMPOSER_OVERLAY),
                       &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, AllocationSize) {
     auto mpbuf = encode<StandardMetadataType::ALLOCATION_SIZE>(10200);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeAllocationSize(10200, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, ProtectedContent) {
     auto mpbuf = encode<StandardMetadataType::PROTECTED_CONTENT>(1);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeProtectedContent(1, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Compression) {
@@ -443,14 +443,14 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR,
               gralloc4::encodeCompression(gralloc4::Compression_DisplayStreamCompression, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Interlaced) {
     auto mpbuf = encode<StandardMetadataType::INTERLACED>(gralloc4::Interlaced_TopBottom);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeInterlaced(gralloc4::Interlaced_TopBottom, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, ChromeSitting) {
@@ -459,14 +459,14 @@
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR,
               gralloc4::encodeChromaSiting(gralloc4::ChromaSiting_SitedInterstitial, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, PlaneLayouts) {
     auto mpbuf = encode<StandardMetadataType::PLANE_LAYOUTS>(fakePlaneLayouts());
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodePlaneLayouts(fakePlaneLayouts(), &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Crop) {
@@ -474,21 +474,21 @@
     auto mpbuf = encode<StandardMetadataType::CROP>(cropRects);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeCrop(cropRects, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Dataspace) {
     auto mpbuf = encode<StandardMetadataType::DATASPACE>(Dataspace::DISPLAY_P3);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeDataspace(Dataspace::DISPLAY_P3, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, BlendMode) {
     auto mpbuf = encode<StandardMetadataType::BLEND_MODE>(BlendMode::PREMULTIPLIED);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeBlendMode(BlendMode::PREMULTIPLIED, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2086) {
@@ -498,7 +498,7 @@
     auto mpbuf = encode<StandardMetadataType::SMPTE2086>(hdrdata);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2086(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Cta861_3) {
@@ -506,29 +506,29 @@
     auto mpbuf = encode<StandardMetadataType::CTA861_3>(hdrdata);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeCta861_3(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2094_10) {
     auto mpbuf = encode<StandardMetadataType::SMPTE2094_10>(std::nullopt);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_10(std::nullopt, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 
     std::vector<uint8_t> hdrdata{1, 2, 3, 4, 5, 6};
     mpbuf = encode<StandardMetadataType::SMPTE2094_10>(hdrdata);
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_10(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
 
 TEST(MetadataGralloc4Interop, Smpte2094_40) {
     auto mpbuf = encode<StandardMetadataType::SMPTE2094_40>(std::nullopt);
     hidl_vec<uint8_t> g4buf;
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_40(std::nullopt, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 
     std::vector<uint8_t> hdrdata{1, 2, 3, 4, 5, 6};
     mpbuf = encode<StandardMetadataType::SMPTE2094_40>(hdrdata);
     ASSERT_EQ(NO_ERROR, gralloc4::encodeSmpte2094_40(hdrdata, &g4buf));
-    EXPECT_EQ(mpbuf, g4buf);
+    EXPECT_EQ(g4buf, mpbuf);
 }
diff --git a/health/aidl/Android.bp b/health/aidl/Android.bp
index 64d83f3..6d4f914 100644
--- a/health/aidl/Android.bp
+++ b/health/aidl/Android.bp
@@ -74,7 +74,7 @@
     name: "android.hardware.health-translate-ndk",
     defaults: ["android.hardware.health-translate-ndk_defaults"],
     shared_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
     ],
 }
 
@@ -91,7 +91,7 @@
     name: "android.hardware.health-translate-java",
     srcs: ["android/hardware/health/Translate.java"],
     libs: [
-        "android.hardware.health-V1-java",
+        "android.hardware.health-V2-java",
         "android.hardware.health-V2.0-java",
         "android.hardware.health-V2.1-java",
     ],
diff --git a/health/aidl/OWNERS b/health/aidl/OWNERS
index fcad499..9bbcef8 100644
--- a/health/aidl/OWNERS
+++ b/health/aidl/OWNERS
@@ -1,4 +1,4 @@
 # Bug component: 30545
 elsk@google.com
 smoreland@google.com
-stayfan@google.com
+wjack@google.com
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
similarity index 91%
rename from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
rename to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
index 336f9b5..42fbf95 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingPolicy.aidl
@@ -31,12 +31,11 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
+package android.hardware.health;
 @Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+enum BatteryChargingPolicy {
+  INVALID = 0,
+  DEFAULT = 1,
+  LONG_LIFE = 2,
+  ADAPTIVE = 3,
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
similarity index 88%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
index 336f9b5..e21eb28 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryChargingState.aidl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2022 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
+package android.hardware.health;
 @Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+enum BatteryChargingState {
+  INVALID = 0,
+  NORMAL = 1,
+  TOO_COLD = 2,
+  TOO_HOT = 3,
+  LONG_LIFE = 4,
+  ADAPTIVE = 5,
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
index 4ce7952..8d13198 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealth.aidl
@@ -41,4 +41,7 @@
   OVER_VOLTAGE = 5,
   UNSPECIFIED_FAILURE = 6,
   COLD = 7,
+  FAIR = 8,
+  NOT_AVAILABLE = 11,
+  INCONSISTENT = 12,
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
similarity index 89%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
index 336f9b5..d523fad 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/BatteryHealthData.aidl
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.health;
+@VintfStability
+parcelable BatteryHealthData {
+  long batteryManufacturingDateSeconds;
+  long batteryFirstUsageSeconds;
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
index 97d9e84..664cc70 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
@@ -57,5 +57,9 @@
   android.hardware.health.BatteryCapacityLevel batteryCapacityLevel;
   long batteryChargeTimeToFullNowSeconds;
   int batteryFullChargeDesignCapacityUah;
+  int batteryStateOfHealth;
+  android.hardware.health.BatteryChargingState chargingState;
+  android.hardware.health.BatteryChargingPolicy chargingPolicy;
+  @nullable android.hardware.health.BatteryHealthData batteryHealthData;
   const int BATTERY_CHARGE_TIME_TO_FULL_NOW_SECONDS_UNSUPPORTED = -1;
 }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
index 7016ae4..b49dfff 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/IHealth.aidl
@@ -46,6 +46,9 @@
   android.hardware.health.StorageInfo[] getStorageInfo();
   android.hardware.health.DiskStats[] getDiskStats();
   android.hardware.health.HealthInfo getHealthInfo();
+  void setChargingPolicy(android.hardware.health.BatteryChargingPolicy in_value);
+  android.hardware.health.BatteryChargingPolicy getChargingPolicy();
+  android.hardware.health.BatteryHealthData getBatteryHealthData();
   const int STATUS_UNKNOWN = 2;
   const int STATUS_CALLBACK_DIED = 4;
 }
diff --git a/health/aidl/android/hardware/health/BatteryChargingPolicy.aidl b/health/aidl/android/hardware/health/BatteryChargingPolicy.aidl
new file mode 100644
index 0000000..0aeee41
--- /dev/null
+++ b/health/aidl/android/hardware/health/BatteryChargingPolicy.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.health;
+
+/**
+ * Battery charging policy.
+ */
+@VintfStability
+@Backing(type="int")
+enum BatteryChargingPolicy {
+    INVALID = 0,
+    /**
+     * default policy
+     */
+    DEFAULT = 1,
+    /**
+     * @see BatteryChargingState.LONG_LIFE
+     */
+    LONG_LIFE = 2,
+    /**
+     * @see BatteryChargingState.ADAPTIVE
+     */
+    ADAPTIVE = 3,
+}
diff --git a/health/aidl/android/hardware/health/BatteryChargingState.aidl b/health/aidl/android/hardware/health/BatteryChargingState.aidl
new file mode 100644
index 0000000..af62077
--- /dev/null
+++ b/health/aidl/android/hardware/health/BatteryChargingState.aidl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.health;
+
+/**
+ * Possible values for Battery Health.
+ * Note: These are currently in sync with BatteryManager and must not
+ * be extended / altered.
+ */
+@VintfStability
+@Backing(type="int")
+enum BatteryChargingState {
+    INVALID = 0,
+    /**
+     * Default state.
+     */
+    NORMAL = 1,
+    /**
+     * Reported when the battery is too cold to charge at a normal
+     * rate or stopped charging due to low temperature.
+     */
+    TOO_COLD = 2,
+    /**
+     * Reported when the battery is too hot to charge at a normal
+     * rate or stopped charging due to hot temperature.
+     */
+    TOO_HOT = 3,
+    /**
+     * The device is using a special charging profile that designed
+     * to prevent accelerated aging.
+     */
+    LONG_LIFE = 4,
+    /**
+     * The device is using a special charging profile designed to
+     * improve battery cycle life, performances or both.
+     */
+    ADAPTIVE = 5,
+}
diff --git a/health/aidl/android/hardware/health/BatteryHealth.aidl b/health/aidl/android/hardware/health/BatteryHealth.aidl
index 2b6e51f..65abdc2 100644
--- a/health/aidl/android/hardware/health/BatteryHealth.aidl
+++ b/health/aidl/android/hardware/health/BatteryHealth.aidl
@@ -24,8 +24,15 @@
 @VintfStability
 @Backing(type="int")
 enum BatteryHealth {
+    /**
+     * Battery health is not supported from the device.
+     */
     UNKNOWN = 1,
     GOOD = 2,
+    /**
+     * Must be consistent with BatteryChargingState.
+     * If BatteryHealth is OVERHEAT, then BatteryChargingState must be TOO_HOT.
+     */
     OVERHEAT = 3,
     DEAD = 4,
     OVER_VOLTAGE = 5,
@@ -33,5 +40,28 @@
      * Battery experienced an unknown/unspecified failure.
      */
     UNSPECIFIED_FAILURE = 6,
+    /**
+     * Must be consistent with BatteryChargingState.
+     * If BatteryHealth is COLD, then BatteryChargingState must be TOO_COLD.
+     */
     COLD = 7,
+    /**
+     * Battery health is marginal.
+     */
+    FAIR = 8,
+    /**
+     * The reserve data below 10 are used to recognize the battery real health.
+     */
+    /**
+     * There is not enough information to determine an accurate
+     * value. The value might become UNSPECIFIED_FAILURE, DEAD
+     * or any other state except for UNKNOWN later.
+     */
+    NOT_AVAILABLE = 11,
+    /**
+     * The internal data is inconsistent and the battery needs to
+     * go through a recalibration process. The value might become
+     * UNSPECIFIED_FAILURE, DEAD or any other state except for UNKNOWN later.
+     */
+    INCONSISTENT = 12,
 }
diff --git a/health/aidl/android/hardware/health/BatteryHealthData.aidl b/health/aidl/android/hardware/health/BatteryHealthData.aidl
new file mode 100644
index 0000000..fb17f63
--- /dev/null
+++ b/health/aidl/android/hardware/health/BatteryHealthData.aidl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.health;
+
+/*
+ * Battery health data
+ */
+@VintfStability
+parcelable BatteryHealthData {
+    /**
+     * Battery manufacturing date is reported in epoch.
+     */
+    long batteryManufacturingDateSeconds;
+    /**
+     * The date of first usage is reported in epoch.
+     */
+    long batteryFirstUsageSeconds;
+}
diff --git a/health/aidl/android/hardware/health/HealthInfo.aidl b/health/aidl/android/hardware/health/HealthInfo.aidl
index 5b98baf..238f524 100644
--- a/health/aidl/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/android/hardware/health/HealthInfo.aidl
@@ -17,7 +17,10 @@
 package android.hardware.health;
 
 import android.hardware.health.BatteryCapacityLevel;
+import android.hardware.health.BatteryChargingPolicy;
+import android.hardware.health.BatteryChargingState;
 import android.hardware.health.BatteryHealth;
+import android.hardware.health.BatteryHealthData;
 import android.hardware.health.BatteryStatus;
 import android.hardware.health.DiskStats;
 import android.hardware.health.StorageInfo;
@@ -133,4 +136,23 @@
      * Value must be less than 100 000 000 µAh if known.
      */
     int batteryFullChargeDesignCapacityUah;
+    /**
+     * Measured battery state of health (remaining estimate full charge capacity
+     * relative to the rated capacity in %).
+     * Value must be 0 if batteryStatus is UNKNOWN.
+     * Otherwise, value must be in the range 0 to 100.
+     */
+    int batteryStateOfHealth;
+    /**
+     * Battery charging state
+     */
+    BatteryChargingState chargingState;
+    /**
+     * Battery charging policy. See {@link BatteryChargingPolicy} for more details.
+     */
+    BatteryChargingPolicy chargingPolicy;
+    /**
+     * Battery health data
+     */
+    @nullable BatteryHealthData batteryHealthData;
 }
diff --git a/health/aidl/android/hardware/health/IHealth.aidl b/health/aidl/android/hardware/health/IHealth.aidl
index d541eca..bdfe07a 100644
--- a/health/aidl/android/hardware/health/IHealth.aidl
+++ b/health/aidl/android/hardware/health/IHealth.aidl
@@ -16,6 +16,8 @@
 
 package android.hardware.health;
 
+import android.hardware.health.BatteryChargingPolicy;
+import android.hardware.health.BatteryHealthData;
 import android.hardware.health.BatteryStatus;
 import android.hardware.health.DiskStats;
 import android.hardware.health.HealthInfo;
@@ -102,7 +104,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCurrentNowMicroamps();
 
@@ -120,7 +122,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCurrentAverageMicroamps();
 
@@ -134,7 +136,7 @@
      *           if this property is not supported
      *                 (e.g. the file that stores this property does not exist),
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     int getCapacity();
 
@@ -146,7 +148,7 @@
      *         - Return exception with code EX_UNSUPPORTED_OPERATION
      *           if this property is not supported,
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     long getEnergyCounterNwh();
 
@@ -197,7 +199,47 @@
      *         - Return exception with code EX_UNSUPPORTED_OPERATION
      *           if this API is not supported,
      *         - Return service specific error with code STATUS_UNKNOWN
-     *           for for other errors.
+     *           for other errors.
      */
     HealthInfo getHealthInfo();
+
+    /**
+     * Set battery charging policy
+     *
+     * @return If error, return service specific error with code:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return status with code INVALID_OPERATION
+     *           if the operation failed.
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    void setChargingPolicy(BatteryChargingPolicy in_value);
+
+    /**
+     * Get current battery charging policy
+     *
+     * @return current battery charging policy if successful.
+     *         If error:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    BatteryChargingPolicy getChargingPolicy();
+
+    /**
+     * Get battery health data
+     *
+     * @return Battery health data if successful.
+     *         If error:
+     *         - Return exception with code EX_UNSUPPORTED_OPERATION
+     *           if this property is not supported
+     *                 (e.g. the file that stores this property does not exist),
+     *         - Return service specific error with code STATUS_UNKNOWN
+     *           for other errors.
+     */
+    BatteryHealthData getBatteryHealthData();
 }
diff --git a/health/aidl/default/Android.bp b/health/aidl/default/Android.bp
index 4eb3cb1..b51e4f3 100644
--- a/health/aidl/default/Android.bp
+++ b/health/aidl/default/Android.bp
@@ -29,7 +29,7 @@
         "libcutils",
         "liblog",
         "libutils",
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
 
         // TODO(b/177269435): remove when BatteryMonitor works with AIDL HealthInfo.
         "libhidlbase",
@@ -48,7 +48,7 @@
     name: "libhealth_aidl_charger_defaults",
     shared_libs: [
         // common
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libbase",
         "libcutils",
         "liblog",
@@ -195,7 +195,7 @@
         "service_fuzzer_defaults",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libbase",
         "liblog",
         "fuzz_libhealth_aidl_impl",
diff --git a/health/aidl/default/Health.cpp b/health/aidl/default/Health.cpp
index d41d01a..15a3dbc 100644
--- a/health/aidl/default/Health.cpp
+++ b/health/aidl/default/Health.cpp
@@ -115,6 +115,42 @@
                        BatteryStatus::UNKNOWN, out);
 }
 
+ndk::ScopedAStatus Health::setChargingPolicy(BatteryChargingPolicy in_value) {
+    ::android::status_t err = battery_monitor_.setChargingPolicy(static_cast<int>(in_value));
+
+    switch (err) {
+        case ::android::OK:
+            return ndk::ScopedAStatus::ok();
+        case ::android::NAME_NOT_FOUND:
+            return ndk::ScopedAStatus::fromExceptionCode(EX_UNSUPPORTED_OPERATION);
+        case ::android::BAD_VALUE:
+            return ndk::ScopedAStatus::fromStatus(::android::INVALID_OPERATION);
+        default:
+            return ndk::ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    IHealth::STATUS_UNKNOWN, ::android::statusToString(err).c_str());
+    }
+}
+
+ndk::ScopedAStatus Health::getChargingPolicy(BatteryChargingPolicy* out) {
+    return GetProperty(&battery_monitor_, ::android::BATTERY_PROP_CHARGING_POLICY,
+                       BatteryChargingPolicy::DEFAULT, out);
+}
+
+ndk::ScopedAStatus Health::getBatteryHealthData(BatteryHealthData* out) {
+    if (auto res =
+                GetProperty<int64_t>(&battery_monitor_, ::android::BATTERY_PROP_MANUFACTURING_DATE,
+                                     0, &out->batteryManufacturingDateSeconds);
+        !res.isOk()) {
+        LOG(WARNING) << "Cannot get Manufacturing_date: " << res.getDescription();
+    }
+    if (auto res = GetProperty<int64_t>(&battery_monitor_, ::android::BATTERY_PROP_FIRST_USAGE_DATE,
+                                        0, &out->batteryFirstUsageSeconds);
+        !res.isOk()) {
+        LOG(WARNING) << "Cannot get First_usage_date: " << res.getDescription();
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
 ndk::ScopedAStatus Health::getDiskStats(std::vector<DiskStats>*) {
     // This implementation does not support DiskStats. An implementation may extend this
     // class and override this function to support disk stats.
diff --git a/health/aidl/default/android.hardware.health-service.example.xml b/health/aidl/default/android.hardware.health-service.example.xml
index 98026cb..1fe9b8d 100644
--- a/health/aidl/default/android.hardware.health-service.example.xml
+++ b/health/aidl/default/android.hardware.health-service.example.xml
@@ -1,7 +1,7 @@
 <manifest version="1.0" type="device">
     <hal format="aidl">
         <name>android.hardware.health</name>
-        <version>1</version>
+        <version>2</version>
         <fqname>IHealth/default</fqname>
     </hal>
 </manifest>
diff --git a/health/aidl/default/include/health-impl/Health.h b/health/aidl/default/include/health-impl/Health.h
index 6bd4946..dc3a0ef 100644
--- a/health/aidl/default/include/health-impl/Health.h
+++ b/health/aidl/default/include/health-impl/Health.h
@@ -72,6 +72,10 @@
     ndk::ScopedAStatus getDiskStats(std::vector<DiskStats>* out) override;
     ndk::ScopedAStatus getStorageInfo(std::vector<StorageInfo>* out) override;
 
+    ndk::ScopedAStatus setChargingPolicy(BatteryChargingPolicy in_value) override;
+    ndk::ScopedAStatus getChargingPolicy(BatteryChargingPolicy* out) override;
+    ndk::ScopedAStatus getBatteryHealthData(BatteryHealthData* out) override;
+
     // A subclass may override these to provide a different implementation.
     binder_status_t dump(int fd, const char** args, uint32_t num_args) override;
 
diff --git a/health/aidl/vts/functional/Android.bp b/health/aidl/vts/functional/Android.bp
index f9da79f..b735a87 100644
--- a/health/aidl/vts/functional/Android.bp
+++ b/health/aidl/vts/functional/Android.bp
@@ -39,7 +39,7 @@
         "libbinder_ndk",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "libgmock",
     ],
     header_libs: [
diff --git a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
index 3e07188..6506ea2 100644
--- a/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
+++ b/health/aidl/vts/functional/VtsHalHealthTargetTest.cpp
@@ -225,6 +225,81 @@
     ASSERT_THAT(value, IsValidEnum<BatteryStatus>());
 }
 
+/*
+ * Tests the values returned by getChargingPolicy() from interface IHealth.
+ */
+TEST_P(HealthAidl, getChargingPolicy) {
+    int32_t version = 0;
+    auto status = health->getInterfaceVersion(&version);
+    ASSERT_TRUE(status.isOk()) << status;
+    if (version < 2) {
+        GTEST_SKIP() << "Support in health hal v2 for EU Ecodesign";
+    }
+    BatteryChargingPolicy value;
+    status = health->getChargingPolicy(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(value, IsValidEnum<BatteryChargingPolicy>());
+}
+
+/*
+ * Tests that setChargingPolicy() writes the value and compared the returned
+ * value by getChargingPolicy() from interface IHealth.
+ */
+TEST_P(HealthAidl, setChargingPolicy) {
+    int32_t version = 0;
+    auto status = health->getInterfaceVersion(&version);
+    ASSERT_TRUE(status.isOk()) << status;
+    if (version < 2) {
+        GTEST_SKIP() << "Support in health hal v2 for EU Ecodesign";
+    }
+
+    BatteryChargingPolicy value;
+
+    /* set ChargingPolicy*/
+    status = health->setChargingPolicy(static_cast<BatteryChargingPolicy>(2));  // LONG_LIFE
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+
+    /* get ChargingPolicy*/
+    status = health->getChargingPolicy(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(static_cast<int>(value), Eq(2));
+}
+
+MATCHER(IsValidHealthData, "") {
+    *result_listener << "value is " << arg.toString() << ".";
+    if (!ExplainMatchResult(Ge(-1), arg.batteryManufacturingDateSeconds, result_listener)) {
+        *result_listener << " for batteryManufacturingDateSeconds.";
+        return false;
+    }
+    if (!ExplainMatchResult(Ge(-1), arg.batteryFirstUsageSeconds, result_listener)) {
+        *result_listener << " for batteryFirstUsageSeconds.";
+        return false;
+    }
+
+    return true;
+}
+
+/*
+ * Tests the values returned by getBatteryHealthData() from interface IHealth.
+ */
+TEST_P(HealthAidl, getBatteryHealthData) {
+    int32_t version = 0;
+    auto status = health->getInterfaceVersion(&version);
+    ASSERT_TRUE(status.isOk()) << status;
+    if (version < 2) {
+        GTEST_SKIP() << "Support in health hal v2 for EU Ecodesign";
+    }
+
+    BatteryHealthData value;
+    status = health->getBatteryHealthData(&value);
+    ASSERT_THAT(status, AnyOf(IsOk(), ExceptionIs(EX_UNSUPPORTED_OPERATION)));
+    if (!status.isOk()) return;
+    ASSERT_THAT(value, IsValidHealthData());
+}
+
 MATCHER(IsValidStorageInfo, "") {
     *result_listener << "value is " << arg.toString() << ".";
     if (!ExplainMatchResult(InClosedRange(0, 3), arg.eol, result_listener)) {
diff --git a/health/utils/libhealthshim/Android.bp b/health/utils/libhealthshim/Android.bp
index 3a1415f..14c32ae 100644
--- a/health/utils/libhealthshim/Android.bp
+++ b/health/utils/libhealthshim/Android.bp
@@ -34,7 +34,7 @@
         "-Werror",
     ],
     static_libs: [
-        "android.hardware.health-V1-ndk",
+        "android.hardware.health-V2-ndk",
         "android.hardware.health-translate-ndk",
         "android.hardware.health@1.0",
         "android.hardware.health@2.0",
diff --git a/health/utils/libhealthshim/include/health-shim/shim.h b/health/utils/libhealthshim/include/health-shim/shim.h
index f36fa5d..ff6849b 100644
--- a/health/utils/libhealthshim/include/health-shim/shim.h
+++ b/health/utils/libhealthshim/include/health-shim/shim.h
@@ -45,6 +45,9 @@
     ndk::ScopedAStatus getStorageInfo(std::vector<StorageInfo>* _aidl_return) override;
     ndk::ScopedAStatus getDiskStats(std::vector<DiskStats>* _aidl_return) override;
     ndk::ScopedAStatus getHealthInfo(HealthInfo* _aidl_return) override;
+    ndk::ScopedAStatus setChargingPolicy(BatteryChargingPolicy in_value) override;
+    ndk::ScopedAStatus getChargingPolicy(BatteryChargingPolicy* _aidl_return) override;
+    ndk::ScopedAStatus getBatteryHealthData(BatteryHealthData* _aidl_return) override;
 
   private:
     ::android::sp<HidlHealth> service_;
diff --git a/health/utils/libhealthshim/shim.cpp b/health/utils/libhealthshim/shim.cpp
index 1329679..6a5f512 100644
--- a/health/utils/libhealthshim/shim.cpp
+++ b/health/utils/libhealthshim/shim.cpp
@@ -217,4 +217,20 @@
     return ReturnAndResultToStatus(ret, out_result);
 }
 
+ScopedAStatus HealthShim::setChargingPolicy(BatteryChargingPolicy in_value) {
+    in_value = static_cast<BatteryChargingPolicy>(0);
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
+ScopedAStatus HealthShim::getChargingPolicy(BatteryChargingPolicy* out) {
+    *out = static_cast<BatteryChargingPolicy>(0);
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
+ScopedAStatus HealthShim::getBatteryHealthData(BatteryHealthData* out) {
+    out->batteryManufacturingDateSeconds = 0;
+    out->batteryFirstUsageSeconds = 0;
+    return ResultToStatus(Result::NOT_SUPPORTED);
+}
+
 }  // namespace aidl::android::hardware::health
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index fb5048a..728cc91 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -4866,6 +4866,11 @@
     if (vsr_api_level < 33) {
         GTEST_SKIP() << "Applies only to VSR API level 33, this device is: " << vsr_api_level;
     }
+    char soc_model[PROPERTY_VALUE_MAX] = {};
+    property_get("ro.soc.model", soc_model, "");
+    if (!strcmp(soc_model, "SM8550")) {
+        GTEST_SKIP() << "Skip QTI SM8550 chipset, the SOC model of this device is: " << soc_model;
+    }
     FAIL() << "VSR 13+ requires KeyMint version 2";
 }
 
diff --git a/neuralnetworks/1.2/utils/src/BurstUtils.cpp b/neuralnetworks/1.2/utils/src/BurstUtils.cpp
index b589c46..c4c096d 100644
--- a/neuralnetworks/1.2/utils/src/BurstUtils.cpp
+++ b/neuralnetworks/1.2/utils/src/BurstUtils.cpp
@@ -190,12 +190,13 @@
     size_t index = 0;
 
     // validate packet information
-    if (data.size() == 0 || data[index].getDiscriminator() != discriminator::packetInformation) {
+    if (index >= data.size() ||
+        data.at(index).getDiscriminator() != discriminator::packetInformation) {
         return NN_ERROR() << "FMQ Request packet ill-formed";
     }
 
     // unpackage packet information
-    const FmqRequestDatum::PacketInformation& packetInfo = data[index].packetInformation();
+    const FmqRequestDatum::PacketInformation& packetInfo = data.at(index).packetInformation();
     index++;
     const uint32_t packetSize = packetInfo.packetSize;
     const uint32_t numberOfInputOperands = packetInfo.numberOfInputOperands;
@@ -212,13 +213,14 @@
     inputs.reserve(numberOfInputOperands);
     for (size_t operand = 0; operand < numberOfInputOperands; ++operand) {
         // validate input operand information
-        if (data[index].getDiscriminator() != discriminator::inputOperandInformation) {
+        if (index >= data.size() ||
+            data.at(index).getDiscriminator() != discriminator::inputOperandInformation) {
             return NN_ERROR() << "FMQ Request packet ill-formed";
         }
 
         // unpackage operand information
         const FmqRequestDatum::OperandInformation& operandInfo =
-                data[index].inputOperandInformation();
+                data.at(index).inputOperandInformation();
         index++;
         const bool hasNoValue = operandInfo.hasNoValue;
         const V1_0::DataLocation location = operandInfo.location;
@@ -229,12 +231,13 @@
         dimensions.reserve(numberOfDimensions);
         for (size_t i = 0; i < numberOfDimensions; ++i) {
             // validate dimension
-            if (data[index].getDiscriminator() != discriminator::inputOperandDimensionValue) {
+            if (index >= data.size() ||
+                data.at(index).getDiscriminator() != discriminator::inputOperandDimensionValue) {
                 return NN_ERROR() << "FMQ Request packet ill-formed";
             }
 
             // unpackage dimension
-            const uint32_t dimension = data[index].inputOperandDimensionValue();
+            const uint32_t dimension = data.at(index).inputOperandDimensionValue();
             index++;
 
             // store result
@@ -251,13 +254,14 @@
     outputs.reserve(numberOfOutputOperands);
     for (size_t operand = 0; operand < numberOfOutputOperands; ++operand) {
         // validate output operand information
-        if (data[index].getDiscriminator() != discriminator::outputOperandInformation) {
+        if (index >= data.size() ||
+            data.at(index).getDiscriminator() != discriminator::outputOperandInformation) {
             return NN_ERROR() << "FMQ Request packet ill-formed";
         }
 
         // unpackage operand information
         const FmqRequestDatum::OperandInformation& operandInfo =
-                data[index].outputOperandInformation();
+                data.at(index).outputOperandInformation();
         index++;
         const bool hasNoValue = operandInfo.hasNoValue;
         const V1_0::DataLocation location = operandInfo.location;
@@ -268,12 +272,13 @@
         dimensions.reserve(numberOfDimensions);
         for (size_t i = 0; i < numberOfDimensions; ++i) {
             // validate dimension
-            if (data[index].getDiscriminator() != discriminator::outputOperandDimensionValue) {
+            if (index >= data.size() ||
+                data.at(index).getDiscriminator() != discriminator::outputOperandDimensionValue) {
                 return NN_ERROR() << "FMQ Request packet ill-formed";
             }
 
             // unpackage dimension
-            const uint32_t dimension = data[index].outputOperandDimensionValue();
+            const uint32_t dimension = data.at(index).outputOperandDimensionValue();
             index++;
 
             // store result
@@ -290,12 +295,13 @@
     slots.reserve(numberOfPools);
     for (size_t pool = 0; pool < numberOfPools; ++pool) {
         // validate input operand information
-        if (data[index].getDiscriminator() != discriminator::poolIdentifier) {
+        if (index >= data.size() ||
+            data.at(index).getDiscriminator() != discriminator::poolIdentifier) {
             return NN_ERROR() << "FMQ Request packet ill-formed";
         }
 
         // unpackage operand information
-        const int32_t poolId = data[index].poolIdentifier();
+        const int32_t poolId = data.at(index).poolIdentifier();
         index++;
 
         // store result
@@ -303,17 +309,17 @@
     }
 
     // validate measureTiming
-    if (data[index].getDiscriminator() != discriminator::measureTiming) {
+    if (index >= data.size() || data.at(index).getDiscriminator() != discriminator::measureTiming) {
         return NN_ERROR() << "FMQ Request packet ill-formed";
     }
 
     // unpackage measureTiming
-    const V1_2::MeasureTiming measure = data[index].measureTiming();
+    const V1_2::MeasureTiming measure = data.at(index).measureTiming();
     index++;
 
     // validate packet information
     if (index != packetSize) {
-        return NN_ERROR() << "FMQ Result packet ill-formed";
+        return NN_ERROR() << "FMQ Request packet ill-formed";
     }
 
     // return request
@@ -328,12 +334,13 @@
     size_t index = 0;
 
     // validate packet information
-    if (data.size() == 0 || data[index].getDiscriminator() != discriminator::packetInformation) {
+    if (index >= data.size() ||
+        data.at(index).getDiscriminator() != discriminator::packetInformation) {
         return NN_ERROR() << "FMQ Result packet ill-formed";
     }
 
     // unpackage packet information
-    const FmqResultDatum::PacketInformation& packetInfo = data[index].packetInformation();
+    const FmqResultDatum::PacketInformation& packetInfo = data.at(index).packetInformation();
     index++;
     const uint32_t packetSize = packetInfo.packetSize;
     const V1_0::ErrorStatus errorStatus = packetInfo.errorStatus;
@@ -349,12 +356,13 @@
     outputShapes.reserve(numberOfOperands);
     for (size_t operand = 0; operand < numberOfOperands; ++operand) {
         // validate operand information
-        if (data[index].getDiscriminator() != discriminator::operandInformation) {
+        if (index >= data.size() ||
+            data.at(index).getDiscriminator() != discriminator::operandInformation) {
             return NN_ERROR() << "FMQ Result packet ill-formed";
         }
 
         // unpackage operand information
-        const FmqResultDatum::OperandInformation& operandInfo = data[index].operandInformation();
+        const FmqResultDatum::OperandInformation& operandInfo = data.at(index).operandInformation();
         index++;
         const bool isSufficient = operandInfo.isSufficient;
         const uint32_t numberOfDimensions = operandInfo.numberOfDimensions;
@@ -364,12 +372,13 @@
         dimensions.reserve(numberOfDimensions);
         for (size_t i = 0; i < numberOfDimensions; ++i) {
             // validate dimension
-            if (data[index].getDiscriminator() != discriminator::operandDimensionValue) {
+            if (index >= data.size() ||
+                data.at(index).getDiscriminator() != discriminator::operandDimensionValue) {
                 return NN_ERROR() << "FMQ Result packet ill-formed";
             }
 
             // unpackage dimension
-            const uint32_t dimension = data[index].operandDimensionValue();
+            const uint32_t dimension = data.at(index).operandDimensionValue();
             index++;
 
             // store result
@@ -381,12 +390,13 @@
     }
 
     // validate execution timing
-    if (data[index].getDiscriminator() != discriminator::executionTiming) {
+    if (index >= data.size() ||
+        data.at(index).getDiscriminator() != discriminator::executionTiming) {
         return NN_ERROR() << "FMQ Result packet ill-formed";
     }
 
     // unpackage execution timing
-    const V1_2::Timing timing = data[index].executionTiming();
+    const V1_2::Timing timing = data.at(index).executionTiming();
     index++;
 
     // validate packet information
diff --git a/power/stats/aidl/default/Android.bp b/power/stats/aidl/default/Android.bp
index 66be5f9..d3ab29b 100644
--- a/power/stats/aidl/default/Android.bp
+++ b/power/stats/aidl/default/Android.bp
@@ -30,7 +30,7 @@
     shared_libs: [
         "libbase",
         "libbinder_ndk",
-        "android.hardware.power.stats-V1-ndk",
+        "android.hardware.power.stats-V2-ndk",
     ],
     srcs: [
         "main.cpp",
diff --git a/power/stats/aidl/default/power.stats-default.xml b/power/stats/aidl/default/power.stats-default.xml
index 3b1a216..b64ea7e 100644
--- a/power/stats/aidl/default/power.stats-default.xml
+++ b/power/stats/aidl/default/power.stats-default.xml
@@ -1,6 +1,7 @@
 <manifest version="1.0" type="device">
     <hal format="aidl">
         <name>android.hardware.power.stats</name>
+        <version>2</version>
         <fqname>IPowerStats/default</fqname>
     </hal>
 </manifest>
diff --git a/radio/1.4/vts/functional/radio_hidl_hal_api.cpp b/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
index b0b984c..8f357a0 100644
--- a/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
+++ b/radio/1.4/vts/functional/radio_hidl_hal_api.cpp
@@ -232,7 +232,8 @@
     EXPECT_EQ(serial, radioRsp_v1_4->rspInfo.serial);
     ALOGI("setPreferredNetworkTypeBitmap, rspInfo.error = %s\n",
           toString(radioRsp_v1_4->rspInfo.error).c_str());
-    EXPECT_EQ(RadioError::NONE, radioRsp_v1_4->rspInfo.error);
+    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_v1_4->rspInfo.error,
+                                 {RadioError::NONE, RadioError::MODE_NOT_SUPPORTED}));
     if (radioRsp_v1_4->rspInfo.error == RadioError::NONE) {
          // give some time for modem to set the value.
         sleep(3);
diff --git a/radio/aidl/vts/radio_data_test.cpp b/radio/aidl/vts/radio_data_test.cpp
index f38a958..1cc6a36 100644
--- a/radio/aidl/vts/radio_data_test.cpp
+++ b/radio/aidl/vts/radio_data_test.cpp
@@ -143,9 +143,20 @@
 
     TrafficDescriptor trafficDescriptor;
     OsAppId osAppId;
-    std::string osAppIdString("osAppId");
-    std::vector<unsigned char> osAppIdVec(osAppIdString.begin(), osAppIdString.end());
-    osAppId.osAppId = osAppIdVec;
+    osAppId.osAppId = {static_cast<unsigned char>(-105), static_cast<unsigned char>(-92),
+                       static_cast<unsigned char>(-104), static_cast<unsigned char>(-29),
+                       static_cast<unsigned char>(-4),   static_cast<unsigned char>(-110),
+                       static_cast<unsigned char>(92),   static_cast<unsigned char>(-108),
+                       static_cast<unsigned char>(-119), static_cast<unsigned char>(-122),
+                       static_cast<unsigned char>(3),    static_cast<unsigned char>(51),
+                       static_cast<unsigned char>(-48),  static_cast<unsigned char>(110),
+                       static_cast<unsigned char>(78),   static_cast<unsigned char>(71),
+                       static_cast<unsigned char>(10),   static_cast<unsigned char>(69),
+                       static_cast<unsigned char>(78),   static_cast<unsigned char>(84),
+                       static_cast<unsigned char>(69),   static_cast<unsigned char>(82),
+                       static_cast<unsigned char>(80),   static_cast<unsigned char>(82),
+                       static_cast<unsigned char>(73),   static_cast<unsigned char>(83),
+                       static_cast<unsigned char>(69)};
     trafficDescriptor.osAppId = osAppId;
 
     DataProfileInfo dataProfileInfo;
diff --git a/scripts/anapic_hidl2aidl_review.sh b/scripts/anapic_hidl2aidl_review.sh
new file mode 100755
index 0000000..330ae32
--- /dev/null
+++ b/scripts/anapic_hidl2aidl_review.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 INTERFACE_NAME"
+    echo "- INTERFACE_NAME fully qualified HIDL interface name with version"
+    echo "example of creating the diffs for android.hardware.boot@1.2"
+    echo "$ ./anapic_hidl2aidl_review.sh android.hardware.boot@1.2"
+    exit 1
+fi
+
+# for pathmod
+source ${ANDROID_BUILD_TOP}/build/make/envsetup.sh
+
+set -ex
+type hidl2aidl 2>/dev/null || m hidl2aidl
+
+INTERFACE_NAME_NO_VER=${1%@*}
+pushd $(pathmod $INTERFACE_NAME_NO_VER)
+rm -rf android
+hidl2aidl -o . "$1"
+rm -rf conversion.log translate include
+git add -A
+git commit -am "convert $1" --no-edit
+git revert HEAD --no-edit
+git commit --amend --no-edit
+repo upload . --no-verify
+popd
diff --git a/secure_element/1.0/vts/OWNERS b/secure_element/1.0/vts/OWNERS
deleted file mode 100644
index c7963e7..0000000
--- a/secure_element/1.0/vts/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-alisher@google.com
-jackcwyu@google.com
-georgekgchang@google.com
-zachoverflow@google.com
diff --git a/secure_element/1.0/vts/functional/OWNERS b/secure_element/1.0/vts/functional/OWNERS
deleted file mode 100644
index a7ee7e9..0000000
--- a/secure_element/1.0/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 456592
-jackcwyu@google.com
diff --git a/secure_element/1.1/vts/OWNERS b/secure_element/1.1/vts/OWNERS
deleted file mode 100644
index c7963e7..0000000
--- a/secure_element/1.1/vts/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-alisher@google.com
-jackcwyu@google.com
-georgekgchang@google.com
-zachoverflow@google.com
diff --git a/secure_element/1.1/vts/functional/OWNERS b/secure_element/1.1/vts/functional/OWNERS
deleted file mode 100644
index a7ee7e9..0000000
--- a/secure_element/1.1/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 456592
-jackcwyu@google.com
diff --git a/secure_element/1.2/vts/OWNERS b/secure_element/1.2/vts/OWNERS
deleted file mode 100644
index c7963e7..0000000
--- a/secure_element/1.2/vts/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-alisher@google.com
-jackcwyu@google.com
-georgekgchang@google.com
-zachoverflow@google.com
diff --git a/secure_element/1.2/vts/functional/OWNERS b/secure_element/1.2/vts/functional/OWNERS
deleted file mode 100644
index a7ee7e9..0000000
--- a/secure_element/1.2/vts/functional/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-# Bug component: 456592
-jackcwyu@google.com
diff --git a/secure_element/OWNERS b/secure_element/OWNERS
new file mode 100644
index 0000000..492696b
--- /dev/null
+++ b/secure_element/OWNERS
@@ -0,0 +1,5 @@
+# Bug component: 456592
+alisher@google.com
+jackcwyu@google.com
+georgekgchang@google.com
+henrichataing@google.com
diff --git a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
index 7c5a704..b9ce9d1 100644
--- a/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
+++ b/secure_element/aidl/android/hardware/secure_element/ISecureElement.aidl
@@ -113,7 +113,8 @@
      * Reset the Secure Element.
      *
      * HAL should trigger reset to the secure element. It could hardware power cycle or
-     * a soft reset depends on the hardware design.
+     * a soft reset depends on the hardware design. All channels opened are
+     * closed by this operation.
      * HAL service must send onStateChange() with connected equal to true
      * after resetting and all the re-initialization has been successfully completed.
      */
diff --git a/secure_element/aidl/default/main.cpp b/secure_element/aidl/default/main.cpp
index 9b5a8fc..0822402 100644
--- a/secure_element/aidl/default/main.cpp
+++ b/secure_element/aidl/default/main.cpp
@@ -418,29 +418,37 @@
                                      test_applet});
     }
 
-    ScopedAStatus init(const std::shared_ptr<ISecureElementCallback>& clientCallback) override {
-        LOG(INFO) << __func__ << " callback: " << clientCallback.get();
-        if (!clientCallback) {
+    ScopedAStatus init(const std::shared_ptr<ISecureElementCallback>& client_callback) override {
+        LOG(INFO) << __func__ << " callback: " << client_callback.get();
+        if (client_callback == nullptr) {
             return ScopedAStatus::fromExceptionCode(EX_NULL_POINTER);
         }
-        client_callback_ = clientCallback;
+        for (auto& channel : channels_) {
+            channel = Channel();
+        }
+        client_callback_ = client_callback;
         client_callback_->onStateChange(true, "init");
         return ScopedAStatus::ok();
     }
 
     ScopedAStatus getAtr(std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         *aidl_return = atr_;
         return ScopedAStatus::ok();
     }
 
     ScopedAStatus reset() override {
         LOG(INFO) << __func__;
-        CHECK(client_callback_ != nullptr) << " init not invoked";
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         client_callback_->onStateChange(false, "reset");
         client_callback_->onStateChange(true, "reset");
         // All channels are closed after reset.
-        for (auto channel : channels_) {
+        for (auto& channel : channels_) {
             channel = Channel();
         }
         return ScopedAStatus::ok();
@@ -448,6 +456,9 @@
 
     ScopedAStatus isCardPresent(bool* aidl_return) override {
         LOG(INFO) << __func__;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
         *aidl_return = true;
         return ScopedAStatus::ok();
     }
@@ -456,6 +467,9 @@
                                    std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__ << " aid: " << HexString(aid.data(), aid.size()) << " (" << aid.size()
                   << ") p2 " << p2;
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
 
         std::vector<uint8_t> select_response;
         std::shared_ptr<se::Applet> applet = nullptr;
@@ -508,6 +522,10 @@
         LOG(INFO) << __func__ << " aid: " << HexString(aid.data(), aid.size()) << " (" << aid.size()
                   << ") p2 " << p2;
 
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
+
         size_t channel_number = 1;
         std::vector<uint8_t> select_response;
         std::shared_ptr<se::Applet> applet = nullptr;
@@ -562,9 +580,13 @@
 
     ScopedAStatus closeChannel(int8_t channel_number) override {
         LOG(INFO) << __func__ << " channel number: " << static_cast<int>(channel_number);
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
+
         // The selected basic or logical channel is not opened.
         if (channel_number >= channels_.size() || !channels_[channel_number].opened) {
-            return ScopedAStatus::ok();
+            return ScopedAStatus::fromServiceSpecificError(FAILED);
         }
 
         // TODO(b/123254068) - this is not an implementation of the OMAPI protocol
@@ -580,6 +602,9 @@
                            std::vector<uint8_t>* aidl_return) override {
         LOG(INFO) << __func__ << " data: " << HexString(data.data(), data.size()) << " ("
                   << data.size() << ")";
+        if (client_callback_ == nullptr) {
+            return ScopedAStatus::fromExceptionCode(EX_ILLEGAL_STATE);
+        }
 
         se::Apdu apdu(data);
         uint8_t channel_number = apdu.get_channel_number();
@@ -648,7 +673,7 @@
 
     // Channel 0 is the basic channel, channels 1-19 are the logical channels.
     std::array<Channel, 20> channels_{};
-    std::shared_ptr<ISecureElementCallback> client_callback_;
+    std::shared_ptr<ISecureElementCallback> client_callback_{nullptr};
 
     // Secure element abstraction.
 
diff --git a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
index a85a8bc..2e96f7d 100644
--- a/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
+++ b/secure_element/aidl/vts/VtsHalSecureElementTargetTest.cpp
@@ -18,6 +18,7 @@
 #include <aidl/Vintf.h>
 #include <aidl/android/hardware/secure_element/BnSecureElementCallback.h>
 #include <aidl/android/hardware/secure_element/ISecureElement.h>
+#include <android-base/logging.h>
 #include <android/binder_manager.h>
 #include <android/binder_process.h>
 #include <gmock/gmock.h>
@@ -44,10 +45,29 @@
         EXPECT_TRUE(status_impl.isOk()) << status_impl.getDescription(); \
     } while (false)
 
-static const std::vector<uint8_t> kDataApdu = {0x00, 0x08, 0x00, 0x00, 0x00};
-static const std::vector<uint8_t> kAndroidTestAid = {0xA0, 0x00, 0x00, 0x04, 0x76, 0x41,
-                                                     0x6E, 0x64, 0x72, 0x6F, 0x69, 0x64,
-                                                     0x43, 0x54, 0x53, 0x31};
+#define EXPECT_ERR(status)                                                \
+    do {                                                                  \
+        auto status_impl = (status);                                      \
+        EXPECT_FALSE(status_impl.isOk()) << status_impl.getDescription(); \
+    } while (false)
+
+// APDU defined in CTS tests.
+// The applet selected with kSelectableAid will return 256 bytes of data
+// in response.
+static const std::vector<uint8_t> kDataApdu = {
+        0x00, 0x08, 0x00, 0x00, 0x00,
+};
+
+// Selectable test AID defined in CTS tests.
+static const std::vector<uint8_t> kSelectableAid = {
+        0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64,
+        0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, 0x31,
+};
+// Non-selectable test AID defined in CTS tests.
+static const std::vector<uint8_t> kNonSelectableAid = {
+        0xA0, 0x00, 0x00, 0x04, 0x76, 0x41, 0x6E, 0x64,
+        0x72, 0x6F, 0x69, 0x64, 0x43, 0x54, 0x53, 0xFF,
+};
 
 class MySecureElementCallback : public BnSecureElementCallback {
   public:
@@ -75,91 +95,194 @@
 
 class SecureElementAidl : public ::testing::TestWithParam<std::string> {
   public:
-    virtual void SetUp() override {
+    void SetUp() override {
         SpAIBinder binder = SpAIBinder(AServiceManager_waitForService(GetParam().c_str()));
-        se = ISecureElement::fromBinder(binder);
-        ASSERT_NE(se, nullptr);
 
-        cb = SharedRefBase::make<MySecureElementCallback>();
-        EXPECT_OK(se->init(cb));
+        secure_element_ = ISecureElement::fromBinder(binder);
+        ASSERT_NE(secure_element_, nullptr);
 
-        cb->expectCallbackHistory({true});
+        secure_element_callback_ = SharedRefBase::make<MySecureElementCallback>();
+        ASSERT_NE(secure_element_callback_, nullptr);
+
+        EXPECT_OK(secure_element_->init(secure_element_callback_));
+        secure_element_callback_->expectCallbackHistory({true});
+
+        // Check if the basic channel is supported by the bound SE.
+        std::vector<uint8_t> basic_channel_response;
+        auto status =
+                secure_element_->openBasicChannel(kSelectableAid, 0x00, &basic_channel_response);
+        if (status.isOk()) {
+            basic_channel_supported_ = true;
+            secure_element_->closeChannel(0);
+        }
     }
 
-    std::shared_ptr<ISecureElement> se;
-    std::shared_ptr<MySecureElementCallback> cb;
+    void TearDown() override {
+        EXPECT_OK(secure_element_->reset());
+        secure_element_ = nullptr;
+        secure_element_callback_ = nullptr;
+    }
+
+    // Call transmit with kDataApdu and the selected channel number.
+    // Return the response sstatus code.
+    uint16_t transmit(uint8_t channel_number) {
+        std::vector<uint8_t> apdu = kDataApdu;
+        std::vector<uint8_t> response;
+
+        // Edit the channel number into the CLA header byte.
+        if (channel_number < 4) {
+            apdu[0] |= channel_number;
+        } else {
+            apdu[0] |= (channel_number - 4) | 0x40;
+        }
+
+        EXPECT_OK(secure_element_->transmit(apdu, &response));
+        EXPECT_GE(response.size(), 2u);
+        uint16_t status =
+                (response[response.size() - 2] << 8) | (response[response.size() - 1] << 0);
+
+        // When the command is successful the response
+        // must contain 256 bytes of data.
+        if (status == 0x9000) {
+            EXPECT_EQ(response.size(), 258);
+        }
+
+        return status;
+    }
+
+    std::shared_ptr<ISecureElement> secure_element_;
+    std::shared_ptr<MySecureElementCallback> secure_element_callback_;
+    bool basic_channel_supported_{false};
 };
 
+TEST_P(SecureElementAidl, init) {
+    // init(nullptr) shall fail.
+    EXPECT_ERR(secure_element_->init(nullptr));
+
+    // init with a valid callback pointer shall succeed.
+    EXPECT_OK(secure_element_->init(secure_element_callback_));
+    secure_element_callback_->expectCallbackHistory({true, true});
+}
+
+TEST_P(SecureElementAidl, reset) {
+    std::vector<uint8_t> basic_channel_response;
+    LogicalChannelResponse logical_channel_response;
+
+    // reset called after init shall succeed.
+    if (basic_channel_supported_) {
+        EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &basic_channel_response));
+    }
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &logical_channel_response));
+
+    EXPECT_OK(secure_element_->reset());
+    secure_element_callback_->expectCallbackHistory({true, false, true});
+
+    // All opened channels must be closed.
+    if (basic_channel_supported_) {
+        EXPECT_NE(transmit(0), 0x9000);
+    }
+    EXPECT_NE(transmit(logical_channel_response.channelNumber), 0x9000);
+}
+
 TEST_P(SecureElementAidl, isCardPresent) {
     bool res = false;
-    EXPECT_OK(se->isCardPresent(&res));
+
+    // isCardPresent called after init shall succeed.
+    EXPECT_OK(secure_element_->isCardPresent(&res));
     EXPECT_TRUE(res);
 }
 
-TEST_P(SecureElementAidl, transmit) {
-    LogicalChannelResponse response;
-    EXPECT_OK(se->openLogicalChannel(kAndroidTestAid, 0x00, &response));
-
-    EXPECT_GE(response.selectResponse.size(), 2u);
-    EXPECT_GE(response.channelNumber, 1);
-
-    std::vector<uint8_t> command = kDataApdu;
-    command[0] |= response.channelNumber;
-
-    std::vector<uint8_t> transmitResponse;
-    EXPECT_OK(se->transmit(command, &transmitResponse));
-
-    EXPECT_LE(transmitResponse.size(), 3);
-    EXPECT_GE(transmitResponse.size(), 2);
-    EXPECT_EQ(transmitResponse[transmitResponse.size() - 1], 0x00);
-    EXPECT_EQ(transmitResponse[transmitResponse.size() - 2], 0x90);
-
-    EXPECT_OK(se->closeChannel(response.channelNumber));
-}
-
-TEST_P(SecureElementAidl, openBasicChannel) {
-    std::vector<uint8_t> response;
-    auto status = se->openBasicChannel(kAndroidTestAid, 0x00, &response);
-
-    if (!status.isOk()) {
-        EXPECT_EQ(status.getServiceSpecificError(), ISecureElement::CHANNEL_NOT_AVAILABLE)
-                << status.getDescription();
-        return;
-    }
-
-    EXPECT_GE(response.size(), 2u);
-    EXPECT_OK(se->closeChannel(0));
-}
-
 TEST_P(SecureElementAidl, getAtr) {
     std::vector<uint8_t> atr;
-    EXPECT_OK(se->getAtr(&atr));
-    if (atr.size() == 0) {
+
+    // getAtr called after init shall succeed.
+    // The ATR has size between 0 and 32 bytes.
+    EXPECT_OK(secure_element_->getAtr(&atr));
+    EXPECT_LE(atr.size(), 32u);
+}
+
+TEST_P(SecureElementAidl, openBasicChannel) {
+    std::vector<uint8_t> response;
+
+    if (!basic_channel_supported_) {
         return;
     }
-    EXPECT_LE(atr.size(), 32u);
-    EXPECT_GE(atr.size(), 1u);
+
+    // openBasicChannel called with an invalid AID shall fail.
+    EXPECT_ERR(secure_element_->openBasicChannel(kNonSelectableAid, 0x00, &response));
+
+    // openBasicChannel called after init shall succeed.
+    // The response size must be larger than 2 bytes as it includes the
+    // status code.
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
+    EXPECT_GE(response.size(), 2u);
+
+    // transmit called on the basic channel should succeed.
+    EXPECT_EQ(transmit(0), 0x9000);
+
+    // openBasicChannel called a second time shall fail.
+    // The basic channel can only be opened once.
+    EXPECT_ERR(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
+
+    // openBasicChannel called after closing the basic channel shall succeed.
+    EXPECT_OK(secure_element_->closeChannel(0));
+    EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &response));
 }
 
-TEST_P(SecureElementAidl, openCloseLogicalChannel) {
+TEST_P(SecureElementAidl, openLogicalChannel) {
     LogicalChannelResponse response;
-    EXPECT_OK(se->openLogicalChannel(kAndroidTestAid, 0x00, &response));
+
+    // openLogicalChannel called with an invalid AID shall fail.
+    EXPECT_ERR(secure_element_->openLogicalChannel(kNonSelectableAid, 0x00, &response));
+
+    // openLogicalChannel called after init shall succeed.
+    // The response size must be larger than 2 bytes as it includes the
+    // status code. The channel number must be in the range 1-19.
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &response));
     EXPECT_GE(response.selectResponse.size(), 2u);
-    EXPECT_GE(response.channelNumber, 1);
-    EXPECT_OK(se->closeChannel(response.channelNumber));
+    EXPECT_GE(response.channelNumber, 1u);
+    EXPECT_LE(response.channelNumber, 19u);
+
+    // transmit called on the logical channel should succeed.
+    EXPECT_EQ(transmit(response.channelNumber), 0x9000);
 }
 
-TEST_P(SecureElementAidl, openInvalidAid) {
-    LogicalChannelResponse response;
-    auto status = se->openLogicalChannel({0x42}, 0x00, &response);
-    EXPECT_EQ(status.getServiceSpecificError(), ISecureElement::NO_SUCH_ELEMENT_ERROR)
-            << status.getDescription();
+TEST_P(SecureElementAidl, closeChannel) {
+    std::vector<uint8_t> basic_channel_response;
+    LogicalChannelResponse logical_channel_response;
+
+    // closeChannel called on non-existing basic or logical channel
+    // shall fail.
+    EXPECT_ERR(secure_element_->closeChannel(0));
+    EXPECT_ERR(secure_element_->closeChannel(1));
+
+    // closeChannel called on basic channel closes the basic channel.
+    if (basic_channel_supported_) {
+        EXPECT_OK(secure_element_->openBasicChannel(kSelectableAid, 0x00, &basic_channel_response));
+        EXPECT_OK(secure_element_->closeChannel(0));
+
+        // transmit called on the basic channel should fail.
+        EXPECT_NE(transmit(0), 0x9000);
+    }
+
+    // closeChannel called on logical channel closes the logical channel.
+    EXPECT_OK(secure_element_->openLogicalChannel(kSelectableAid, 0x00, &logical_channel_response));
+    EXPECT_OK(secure_element_->closeChannel(logical_channel_response.channelNumber));
+
+    // transmit called on the logical channel should fail.
+    EXPECT_NE(transmit(logical_channel_response.channelNumber), 0x9000);
 }
 
-TEST_P(SecureElementAidl, Reset) {
-    cb->expectCallbackHistory({true});
-    EXPECT_OK(se->reset());
-    cb->expectCallbackHistory({true, false, true});
+TEST_P(SecureElementAidl, transmit) {
+    std::vector<uint8_t> response;
+
+    // transmit called after init shall succeed.
+    // Note: no channel is opened for this test and the transmit
+    // response will have the status SW_LOGICAL_CHANNEL_NOT_SUPPORTED.
+    // The transmit response shall be larger than 2 bytes as it includes the
+    // status code.
+    EXPECT_OK(secure_element_->transmit(kDataApdu, &response));
+    EXPECT_GE(response.size(), 2u);
 }
 
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(SecureElementAidl);
diff --git a/security/OWNERS b/security/OWNERS
index fbaf854..619139b 100644
--- a/security/OWNERS
+++ b/security/OWNERS
@@ -6,9 +6,11 @@
 #
 # This will get them auto-assigned to the on-call triage engineer, ensuring quickest response.
 
+ascull@google.com
 drysdale@google.com
 eranm@google.com
 hasinitg@google.com
 jbires@google.com
+sethmo@google.com
 swillden@google.com
 zeuthen@google.com
diff --git a/security/dice/aidl/default/service.rs b/security/dice/aidl/default/service.rs
index eebf333..0197f2c 100644
--- a/security/dice/aidl/default/service.rs
+++ b/security/dice/aidl/default/service.rs
@@ -21,7 +21,6 @@
 };
 use diced_sample_inputs::make_sample_bcc_and_cdis;
 use serde::{Deserialize, Serialize};
-use std::convert::TryInto;
 use std::panic;
 use std::sync::Arc;
 
@@ -76,7 +75,7 @@
     // Saying hi.
     log::info!("android.hardware.security.dice is starting.");
 
-    let (cdi_attest, cdi_seal, bcc) =
+    let dice_artifacts =
         make_sample_bcc_and_cdis().expect("Failed to construct sample dice chain.");
 
     let hal_impl = Arc::new(
@@ -85,13 +84,9 @@
             // This service does not start a thread pool. The main thread is the only thread
             // joining the thread pool, thereby keeping the process single threaded.
             ResidentHal::new(InsecureSerializableArtifacts {
-                cdi_attest: cdi_attest[..]
-                    .try_into()
-                    .expect("Failed to convert cdi_attest to array reference."),
-                cdi_seal: cdi_seal[..]
-                    .try_into()
-                    .expect("Failed to convert cdi_seal to array reference."),
-                bcc,
+                cdi_attest: dice_artifacts.cdi_values.cdi_attest,
+                cdi_seal: dice_artifacts.cdi_values.cdi_seal,
+                bcc: dice_artifacts.bcc[..].to_vec(),
             })
         }
         .expect("Failed to create ResidentHal implementation."),
diff --git a/security/dice/aidl/vts/functional/dice_demote_test.rs b/security/dice/aidl/vts/functional/dice_demote_test.rs
index 02ff2a4..1a17ec7 100644
--- a/security/dice/aidl/vts/functional/dice_demote_test.rs
+++ b/security/dice/aidl/vts/functional/dice_demote_test.rs
@@ -12,7 +12,6 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use diced_open_dice_cbor as dice;
 use diced_sample_inputs;
 use diced_utils;
 use std::convert::TryInto;
@@ -44,14 +43,7 @@
         )
         .unwrap();
 
-        let input_values: Vec<diced_utils::InputValues> = input_values
-            .iter()
-            .map(|v| v.into())
-            .collect();
-
-        let artifacts = artifacts
-            .execute_steps(input_values.iter().map(|v| v as &dyn dice::InputValues))
-            .unwrap();
+        let artifacts = artifacts.execute_steps(input_values.iter()).unwrap();
         let (cdi_attest, cdi_seal, bcc) = artifacts.into_tuple();
         let from_former = diced_utils::make_bcc_handover(
             cdi_attest[..].try_into().unwrap(),
diff --git a/security/dice/aidl/vts/functional/dice_test.rs b/security/dice/aidl/vts/functional/dice_test.rs
index 574b634..190f187 100644
--- a/security/dice/aidl/vts/functional/dice_test.rs
+++ b/security/dice/aidl/vts/functional/dice_test.rs
@@ -12,10 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use diced_open_dice_cbor as dice;
 use diced_sample_inputs;
 use diced_utils;
-use std::convert::{TryInto, Into};
+use std::convert::TryInto;
 
 mod utils;
 use utils::with_connection;
@@ -44,14 +43,7 @@
         )
         .unwrap();
 
-        let input_values: Vec<diced_utils::InputValues> = input_values
-            .iter()
-            .map(|v| v.into())
-            .collect();
-
-        let artifacts = artifacts
-            .execute_steps(input_values.iter().map(|v| v as &dyn dice::InputValues))
-            .unwrap();
+        let artifacts = artifacts.execute_steps(input_values.iter()).unwrap();
         let (cdi_attest, cdi_seal, bcc) = artifacts.into_tuple();
         let from_former = diced_utils::make_bcc_handover(
             cdi_attest[..].try_into().unwrap(),
diff --git a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
index 837fc81..d401247 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl
@@ -885,9 +885,9 @@
 
     /**
      * Tag::ATTESTATION_ID_SECOND_IMEI provides an additional IMEI of one of the radios on the
-     * device to attested key generation/import operations. This field MUST be accompanied by
-     * the Tag::ATTESTATION_ID_IMEI tag. It would only be used to convery a second IMEI the device
-     * has, after Tag::ATTESTATION_ID_SECOND_IMEI has been used to convery the first IMEI.
+     * device to attested key generation/import operations. It should be used to convey an
+     * IMEI different to the one conveyed by the Tag::ATTESTATION_ID_IMEI tag. Like all other
+     * ID attestation flags, it may be included independently of other tags.
      *
      * If the device does not support ID attestation (or destroyAttestationIds() was previously
      * called and the device can no longer attest its IDs), any key attestation request that
diff --git a/security/keymint/aidl/vts/functional/Android.bp b/security/keymint/aidl/vts/functional/Android.bp
index 88badc7..26e91bd 100644
--- a/security/keymint/aidl/vts/functional/Android.bp
+++ b/security/keymint/aidl/vts/functional/Android.bp
@@ -31,8 +31,11 @@
         "VtsHalTargetTestDefaults",
     ],
     shared_libs: [
+        "libbinder",
         "libbinder_ndk",
         "libcrypto",
+        "libbase",
+        "packagemanager_aidl-cpp",
     ],
     static_libs: [
         "android.hardware.security.rkp-V3-ndk",
diff --git a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
index ea4ba18..e46aeee 100644
--- a/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
+++ b/security/keymint/aidl/vts/functional/AttestKeyTest.cpp
@@ -15,6 +15,8 @@
  */
 
 #define LOG_TAG "keymint_1_attest_key_test"
+#include <android-base/logging.h>
+#include <android-base/strings.h>
 #include <cutils/log.h>
 #include <cutils/properties.h>
 
@@ -26,16 +28,75 @@
 namespace aidl::android::hardware::security::keymint::test {
 
 namespace {
+string TELEPHONY_CMD_GET_IMEI = "cmd phone get-imei ";
 
 bool IsSelfSigned(const vector<Certificate>& chain) {
     if (chain.size() != 1) return false;
     return ChainSignaturesAreValid(chain);
 }
 
+/*
+ * Run a shell command and collect the output of it. If any error, set an empty string as the
+ * output.
+ */
+string exec_command(string command) {
+    char buffer[128];
+    string result = "";
+
+    FILE* pipe = popen(command.c_str(), "r");
+    if (!pipe) {
+        LOG(ERROR) << "popen failed.";
+        return result;
+    }
+
+    // read till end of process:
+    while (!feof(pipe)) {
+        if (fgets(buffer, 128, pipe) != NULL) {
+            result += buffer;
+        }
+    }
+
+    pclose(pipe);
+    return result;
+}
+
+/*
+ * Get IMEI using Telephony service shell command. If any error while executing the command
+ * then empty string will be returned as output.
+ */
+string get_imei(int slot) {
+    string cmd = TELEPHONY_CMD_GET_IMEI + std::to_string(slot);
+    string output = exec_command(cmd);
+
+    if (output.empty()) {
+        LOG(ERROR) << "Command failed. Cmd: " << cmd;
+        return "";
+    }
+
+    vector<string> out = ::android::base::Tokenize(::android::base::Trim(output), "Device IMEI:");
+
+    if (out.size() != 1) {
+        LOG(ERROR) << "Error in parsing the command output. Cmd: " << cmd;
+        return "";
+    }
+
+    return ::android::base::Trim(out[0]);
+}
+
 }  // namespace
 
 class AttestKeyTest : public KeyMintAidlTestBase {
+  public:
+    void SetUp() override {
+        check_skip_test();
+        KeyMintAidlTestBase::SetUp();
+    }
+
   protected:
+    const string FEATURE_KEYSTORE_APP_ATTEST_KEY = "android.hardware.keystore.app_attest_key";
+
+    const string FEATURE_STRONGBOX_KEYSTORE = "android.hardware.strongbox_keystore";
+
     ErrorCode GenerateAttestKey(const AuthorizationSet& key_desc,
                                 const optional<AttestationKey>& attest_key,
                                 vector<uint8_t>* key_blob,
@@ -60,6 +121,59 @@
         }
         return GenerateKey(key_desc, attest_key, key_blob, key_characteristics, cert_chain);
     }
+
+    // Check if ATTEST_KEY feature is disabled
+    bool is_attest_key_feature_disabled(void) const {
+        if (!check_feature(FEATURE_KEYSTORE_APP_ATTEST_KEY)) {
+            GTEST_LOG_(INFO) << "Feature " + FEATURE_KEYSTORE_APP_ATTEST_KEY + " is disabled";
+            return true;
+        }
+
+        return false;
+    }
+
+    // Check if StrongBox KeyStore is enabled
+    bool is_strongbox_enabled(void) const {
+        if (check_feature(FEATURE_STRONGBOX_KEYSTORE)) {
+            GTEST_LOG_(INFO) << "Feature " + FEATURE_STRONGBOX_KEYSTORE + " is enabled";
+            return true;
+        }
+
+        return false;
+    }
+
+    // Check if chipset has received a waiver allowing it to be launched with
+    // Android S (or later) with Keymaster 4.0 in StrongBox
+    bool is_chipset_allowed_km4_strongbox(void) const {
+        std::array<char, PROPERTY_VALUE_MAX> buffer;
+
+        auto res = property_get("ro.vendor.qti.soc_model", buffer.data(), nullptr);
+        if (res <= 0) return false;
+
+        const string allowed_soc_models[] = {"SM8450", "SM8475", "SM8550", "SXR2230P"};
+
+        for (const string model : allowed_soc_models) {
+            if (model.compare(buffer.data()) == 0) {
+                GTEST_LOG_(INFO) << "QTI SOC Model " + model + " is allowed SB KM 4.0";
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    // Skip the test if all the following conditions hold:
+    // 1. ATTEST_KEY feature is disabled
+    // 2. STRONGBOX is enabled
+    // 3. The device is running one of the chipsets that have received a waiver
+    //     allowing it to be launched with Android S (or later) with Keymaster 4.0
+    //     in StrongBox
+    void check_skip_test(void) const {
+        if (is_attest_key_feature_disabled() && is_strongbox_enabled() &&
+            is_chipset_allowed_km4_strongbox()) {
+            GTEST_SKIP() << "Test is not applicable";
+        }
+    }
 };
 
 /*
@@ -795,13 +909,44 @@
 
     // Collection of valid attestation ID tags.
     auto attestation_id_tags = AuthorizationSetBuilder();
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    // Use ro.product.brand_for_attestation property for attestation if it is present else fallback
+    // to ro.product.brand
+    std::string prop_value =
+            ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND,
+                          "ro.product.brand_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    }
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device");
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    // Use ro.product.name_for_attestation property for attestation if it is present else fallback
+    // to ro.product.name
+    prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT,
+                          "ro.product.name_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    }
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno");
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MANUFACTURER,
                       "ro.product.manufacturer");
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    // Use ro.product.model_for_attestation property for attestation if it is present else fallback
+    // to ro.product.model
+    prop_value =
+            ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL,
+                          "ro.product.model_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    }
+
+    string imei = get_imei(0);
+    if (!imei.empty()) {
+        attestation_id_tags.Authorization(TAG_ATTESTATION_ID_IMEI, imei.data(), imei.size());
+    }
 
     for (const KeyParameter& tag : attestation_id_tags) {
         SCOPED_TRACE(testing::Message() << "+tag-" << tag);
diff --git a/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp b/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp
index 26dc3f5..55bb5b4 100644
--- a/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp
+++ b/security/keymint/aidl/vts/functional/DeviceUniqueAttestationTest.cpp
@@ -249,13 +249,39 @@
 
     // Collection of valid attestation ID tags.
     auto attestation_id_tags = AuthorizationSetBuilder();
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    // Use ro.product.brand_for_attestation property for attestation if it is present else fallback
+    // to ro.product.brand
+    std::string prop_value =
+            ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND,
+                          "ro.product.brand_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    }
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device");
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    // Use ro.product.name_for_attestation property for attestation if it is present else fallback
+    // to ro.product.name
+    prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT,
+                          "ro.product.name_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    }
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno");
     add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MANUFACTURER,
                       "ro.product.manufacturer");
-    add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    // Use ro.product.model_for_attestation property for attestation if it is present else fallback
+    // to ro.product.model
+    prop_value =
+            ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL,
+                          "ro.product.model_for_attestation");
+    } else {
+        add_tag_from_prop(&attestation_id_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    }
     vector<uint8_t> key_blob;
     vector<KeyCharacteristics> key_characteristics;
 
diff --git a/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp b/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
index c952012..6892442 100644
--- a/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyBlobUpgradeTest.cpp
@@ -76,18 +76,14 @@
         "rsa-key",        "p256-key",        "ed25519-key",       "x25519-key",
         "rsa-attest-key", "p256-attest-key", "ed25519-attest-key"};
 
+std::vector<std::string> keyblob_names_tee_no_25519 = {
+        "aes-key", "aes-key-rr", "des-key",        "hmac-key",
+        "rsa-key", "p256-key",   "rsa-attest-key", "p256-attest-key"};
+
 std::vector<std::string> keyblob_names_sb = {"aes-key",        "aes-key-rr",     "des-key",
                                              "hmac-key",       "rsa-key",        "p256-key",
                                              "rsa-attest-key", "p256-attest-key"};
 
-const std::vector<std::string>& keyblob_names(SecurityLevel sec_level) {
-    if (sec_level == SecurityLevel::STRONGBOX) {
-        return keyblob_names_sb;
-    } else {
-        return keyblob_names_tee;
-    }
-}
-
 bool requires_rr(const std::string& name) {
     return name.find("-rr") != std::string::npos;
 }
@@ -194,13 +190,23 @@
 
 class KeyBlobUpgradeTest : public KeyMintAidlTestBase {
   protected:
+    const std::vector<std::string>& keyblob_names() {
+        if (SecLevel() == SecurityLevel::STRONGBOX) {
+            return keyblob_names_sb;
+        } else if (!Curve25519Supported()) {
+            return keyblob_names_tee_no_25519;
+        } else {
+            return keyblob_names_tee;
+        }
+    }
+
     void UpgradeKeyBlobs(bool expectUpgrade) {
         std::string subdir = keyblob_subdir(keyblob_dir, GetParam(), /* create? */ false);
         if (subdir.empty()) {
             GTEST_SKIP() << "No keyblob directory provided";
         }
 
-        for (std::string name : keyblob_names(SecLevel())) {
+        for (std::string name : keyblob_names()) {
             for (bool with_hidden : {false, true}) {
                 std::string app_id;
                 std::string app_data;
@@ -291,14 +297,14 @@
                                 .Authorization(TAG_NO_AUTH_REQUIRED)},
             {"hmac-key", AuthorizationSetBuilder()
                                  .HmacKey(128)
-                                 .Digest(Digest::SHA1)
+                                 .Digest(Digest::SHA_2_256)
                                  .Authorization(TAG_MIN_MAC_LENGTH, 128)
                                  .Authorization(TAG_NO_AUTH_REQUIRED)},
             {"rsa-key", AuthorizationSetBuilder()
                                 .RsaEncryptionKey(2048, 65537)
                                 .Authorization(TAG_PURPOSE, KeyPurpose::SIGN)
                                 .Digest(Digest::NONE)
-                                .Digest(Digest::SHA1)
+                                .Digest(Digest::SHA_2_256)
                                 .Padding(PaddingMode::NONE)
                                 .Authorization(TAG_NO_AUTH_REQUIRED)
                                 .SetDefaultValidity()},
@@ -308,7 +314,7 @@
                             .EcdsaSigningKey(EcCurve::P_256)
                             .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
                             .Digest(Digest::NONE)
-                            .Digest(Digest::SHA1)
+                            .Digest(Digest::SHA_2_256)
                             .Authorization(TAG_NO_AUTH_REQUIRED)
                             .SetDefaultValidity(),
             },
@@ -348,7 +354,7 @@
                             .SetDefaultValidity(),
             }};
 
-    for (std::string name : keyblob_names(SecLevel())) {
+    for (std::string name : keyblob_names()) {
         auto entry = keys_info.find(name);
         ASSERT_NE(entry, keys_info.end()) << "no builder for " << name;
         auto builder = entry->second;
@@ -425,7 +431,7 @@
                         "/data/local/tmp/keymint-blobs";
     }
 
-    for (std::string name : keyblob_names(SecLevel())) {
+    for (std::string name : keyblob_names()) {
         for (bool with_hidden : {false, true}) {
             auto builder = AuthorizationSetBuilder();
             if (with_hidden) {
@@ -465,7 +471,7 @@
                 string plaintext = DecryptMessage(keyblob, ciphertext, builder);
                 EXPECT_EQ(message, plaintext);
             } else if (name.find("hmac-key") != std::string::npos) {
-                builder.Digest(Digest::SHA1);
+                builder.Digest(Digest::SHA_2_256);
                 auto sign_builder = builder;
                 sign_builder.Authorization(TAG_MAC_LENGTH, 128);
                 string tag = SignMessage(keyblob, message, sign_builder);
@@ -475,7 +481,7 @@
                 string signature = SignMessage(keyblob, message, builder);
                 LocalVerifyMessage(cert, message, signature, builder);
             } else if (name.find("p256-key") != std::string::npos) {
-                builder.Digest(Digest::SHA1);
+                builder.Digest(Digest::SHA_2_256);
                 string signature = SignMessage(keyblob, message, builder);
                 LocalVerifyMessage(cert, message, signature, builder);
             } else if (name.find("ed25519-key") != std::string::npos) {
@@ -562,7 +568,7 @@
                         "/data/local/tmp/keymint-blobs";
     }
 
-    for (std::string name : keyblob_names(SecLevel())) {
+    for (std::string name : keyblob_names()) {
         for (bool with_hidden : {false, true}) {
             auto builder = AuthorizationSetBuilder();
             if (with_hidden) {
@@ -588,7 +594,7 @@
             ASSERT_EQ(ErrorCode::OK, DeleteKey(&keyblob));
 
             // Remove all files relating to the deleted key.
-            std::cerr << "Deleting files for deleted key '" << name << ";";
+            std::cerr << "Deleting files for deleted key '" << name << "';\n";
             delete_keyblob(subdir, name);
 
             // Attempting to use the keyblob after deletion should fail.
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 6c012fa..588a1d4 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -23,6 +23,7 @@
 
 #include <android-base/logging.h>
 #include <android/binder_manager.h>
+#include <android/content/pm/IPackageManagerNative.h>
 #include <cppbor_parse.h>
 #include <cutils/properties.h>
 #include <gmock/gmock.h>
@@ -2048,6 +2049,30 @@
     }
 }
 
+// Check whether the given named feature is available.
+bool check_feature(const std::string& name) {
+    ::android::sp<::android::IServiceManager> sm(::android::defaultServiceManager());
+    ::android::sp<::android::IBinder> binder(
+        sm->waitForService(::android::String16("package_native")));
+    if (binder == nullptr) {
+        GTEST_LOG_(ERROR) << "waitForService package_native failed";
+        return false;
+    }
+    ::android::sp<::android::content::pm::IPackageManagerNative> packageMgr =
+            ::android::interface_cast<::android::content::pm::IPackageManagerNative>(binder);
+    if (packageMgr == nullptr) {
+        GTEST_LOG_(ERROR) << "Cannot find package manager";
+        return false;
+    }
+    bool hasFeature = false;
+    auto status = packageMgr->hasSystemFeature(::android::String16(name.c_str()), 0, &hasFeature);
+    if (!status.isOk()) {
+        GTEST_LOG_(ERROR) << "hasSystemFeature('" << name << "') failed: " << status;
+        return false;
+    }
+    return hasFeature;
+}
+
 }  // namespace test
 
 }  // namespace aidl::android::hardware::security::keymint
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
index 908eeab..fae9459 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
@@ -402,6 +402,7 @@
                         vector<uint8_t>* payload_value);
 void p256_pub_key(const vector<uint8_t>& coseKeyData, EVP_PKEY_Ptr* signingKey);
 void device_id_attestation_vsr_check(const ErrorCode& result);
+bool check_feature(const std::string& name);
 
 AuthorizationSet HwEnforcedAuthorizations(const vector<KeyCharacteristics>& key_characteristics);
 AuthorizationSet SwEnforcedAuthorizations(const vector<KeyCharacteristics>& key_characteristics);
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 2440977..1b9e758 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -2080,12 +2080,38 @@
 
     // Various ATTESTATION_ID_* tags that map to fields in the attestation extension ASN.1 schema.
     auto extra_tags = AuthorizationSetBuilder();
-    add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    // Use ro.product.brand_for_attestation property for attestation if it is present else fallback
+    // to ro.product.brand
+    std::string prop_value =
+            ::android::base::GetProperty("ro.product.brand_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND,
+                          "ro.product.brand_for_attestation");
+    } else {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_BRAND, "ro.product.brand");
+    }
     add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_DEVICE, "ro.product.device");
-    add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    // Use ro.product.name_for_attestation property for attestation if it is present else fallback
+    // to ro.product.name
+    prop_value = ::android::base::GetProperty("ro.product.name_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT,
+                          "ro.product.name_for_attestation");
+    } else {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_PRODUCT, "ro.product.name");
+    }
     add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_SERIAL, "ro.serialno");
     add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MANUFACTURER, "ro.product.manufacturer");
-    add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    // Use ro.product.model_for_attestation property for attestation if it is present else fallback
+    // to ro.product.model
+    prop_value =
+            ::android::base::GetProperty("ro.product.model_for_attestation", /* default= */ "");
+    if (!prop_value.empty()) {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL,
+                          "ro.product.model_for_attestation");
+    } else {
+        add_tag_from_prop(&extra_tags, TAG_ATTESTATION_ID_MODEL, "ro.product.model");
+    }
 
     for (const KeyParameter& tag : extra_tags) {
         SCOPED_TRACE(testing::Message() << "tag-" << tag);
diff --git a/security/keymint/support/Android.bp b/security/keymint/support/Android.bp
index efd6fc7..1a8695b 100644
--- a/security/keymint/support/Android.bp
+++ b/security/keymint/support/Android.bp
@@ -66,6 +66,9 @@
     static_libs: [
         "android.hardware.security.rkp-V3-ndk",
     ],
+    whole_static_libs: [
+        "libhwtrust_cxx",
+    ],
     shared_libs: [
         "libbase",
         "libbinder_ndk",
@@ -84,6 +87,7 @@
         "android.hardware.security.rkp-V3-ndk",
         "libgmock",
         "libgtest_main",
+        "libkeymint_remote_prov_support",
     ],
     defaults: [
         "keymint_use_latest_hal_aidl_ndk_shared",
@@ -95,6 +99,5 @@
         "libcrypto",
         "libjsoncpp",
         "libkeymaster_portable",
-        "libkeymint_remote_prov_support",
     ],
 }
diff --git a/security/keymint/support/include/remote_prov/remote_prov_utils.h b/security/keymint/support/include/remote_prov/remote_prov_utils.h
index 1b94c62..79189a1 100644
--- a/security/keymint/support/include/remote_prov/remote_prov_utils.h
+++ b/security/keymint/support/include/remote_prov/remote_prov_utils.h
@@ -108,15 +108,6 @@
     bytevec pubKey;
 };
 
-/**
- * Validates the provided CBOR-encoded BCC, returning a vector of BccEntryData
- * structs containing the BCC entry contents.  If an entry contains no firmware
- * digest, the corresponding BccEntryData.firmwareDigest will have length zero
- * (there's no way to distinguish between an empty and missing firmware digest,
- * which seems fine).
- */
-ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc);
-
 struct JsonOutput {
     static JsonOutput Ok(std::string json) { return {std::move(json), ""}; }
     static JsonOutput Error(std::string error) { return {"", std::move(error)}; }
diff --git a/security/keymint/support/remote_prov_utils.cpp b/security/keymint/support/remote_prov_utils.cpp
index 7e164fd..9620b6a 100644
--- a/security/keymint/support/remote_prov_utils.cpp
+++ b/security/keymint/support/remote_prov_utils.cpp
@@ -24,6 +24,7 @@
 #include <aidl/android/hardware/security/keymint/RpcHardwareInfo.h>
 #include <android-base/properties.h>
 #include <cppbor.h>
+#include <hwtrust/hwtrust.h>
 #include <json/json.h>
 #include <keymaster/km_openssl/ec_key.h>
 #include <keymaster/km_openssl/ecdsa_operation.h>
@@ -289,134 +290,22 @@
     return chain.encode();
 }
 
-ErrMsgOr<bytevec> validatePayloadAndFetchPubKey(const cppbor::Map* payload) {
-    const auto& issuer = payload->get(kBccPayloadIssuer);
-    if (!issuer || !issuer->asTstr()) return "Issuer is not present or not a tstr.";
-    const auto& subject = payload->get(kBccPayloadSubject);
-    if (!subject || !subject->asTstr()) return "Subject is not present or not a tstr.";
-    const auto& keyUsage = payload->get(kBccPayloadKeyUsage);
-    if (!keyUsage || !keyUsage->asBstr()) return "Key usage is not present or not a bstr.";
-    const auto& serializedKey = payload->get(kBccPayloadSubjPubKey);
-    if (!serializedKey || !serializedKey->asBstr()) return "Key is not present or not a bstr.";
-    return serializedKey->asBstr()->value();
-}
-
-ErrMsgOr<bytevec> verifyAndParseCoseSign1Cwt(const cppbor::Array* coseSign1,
-                                             const bytevec& signingCoseKey, const bytevec& aad) {
-    if (!coseSign1 || coseSign1->size() != kCoseSign1EntryCount) {
-        return "Invalid COSE_Sign1";
-    }
-
-    const cppbor::Bstr* protectedParams = coseSign1->get(kCoseSign1ProtectedParams)->asBstr();
-    const cppbor::Map* unprotectedParams = coseSign1->get(kCoseSign1UnprotectedParams)->asMap();
-    const cppbor::Bstr* payload = coseSign1->get(kCoseSign1Payload)->asBstr();
-    const cppbor::Bstr* signature = coseSign1->get(kCoseSign1Signature)->asBstr();
-
-    if (!protectedParams || !unprotectedParams || !payload || !signature) {
-        return "Invalid COSE_Sign1";
-    }
-
-    auto [parsedProtParams, _, errMsg] = cppbor::parse(protectedParams);
-    if (!parsedProtParams) {
-        return errMsg + " when parsing protected params.";
-    }
-    if (!parsedProtParams->asMap()) {
-        return "Protected params must be a map";
-    }
-
-    auto& algorithm = parsedProtParams->asMap()->get(ALGORITHM);
-    if (!algorithm || !algorithm->asInt() ||
-        (algorithm->asInt()->value() != EDDSA && algorithm->asInt()->value() != ES256)) {
-        return "Unsupported signature algorithm";
-    }
-
-    auto [parsedPayload, __, payloadErrMsg] = cppbor::parse(payload);
-    if (!parsedPayload) return payloadErrMsg + " when parsing key";
-    if (!parsedPayload->asMap()) return "CWT must be a map";
-    auto serializedKey = validatePayloadAndFetchPubKey(parsedPayload->asMap());
-    if (!serializedKey) {
-        return "CWT validation failed: " + serializedKey.moveMessage();
-    }
-
-    bool selfSigned = signingCoseKey.empty();
-    bytevec signatureInput =
-        cppbor::Array().add("Signature1").add(*protectedParams).add(aad).add(*payload).encode();
-
-    if (algorithm->asInt()->value() == EDDSA) {
-        auto key = CoseKey::parseEd25519(selfSigned ? *serializedKey : signingCoseKey);
-
-        if (!key) return "Bad signing key: " + key.moveMessage();
-
-        if (!ED25519_verify(signatureInput.data(), signatureInput.size(), signature->value().data(),
-                            key->getBstrValue(CoseKey::PUBKEY_X)->data())) {
-            return "Signature verification failed";
-        }
-    } else {  // P256
-        auto key = CoseKey::parseP256(selfSigned ? *serializedKey : signingCoseKey);
-        if (!key || key->getBstrValue(CoseKey::PUBKEY_X)->empty() ||
-            key->getBstrValue(CoseKey::PUBKEY_Y)->empty()) {
-            return "Bad signing key: " + key.moveMessage();
-        }
-        auto publicKey = key->getEcPublicKey();
-        if (!publicKey) return publicKey.moveMessage();
-
-        auto ecdsaDerSignature = ecdsaCoseSignatureToDer(signature->value());
-        if (!ecdsaDerSignature) return ecdsaDerSignature.moveMessage();
-
-        // convert public key to uncompressed form.
-        publicKey->insert(publicKey->begin(), 0x04);
-
-        if (!verifyEcdsaDigest(publicKey.moveValue(), sha256(signatureInput), *ecdsaDerSignature)) {
-            return "Signature verification failed";
-        }
-    }
-
-    return serializedKey.moveValue();
-}
-
 ErrMsgOr<std::vector<BccEntryData>> validateBcc(const cppbor::Array* bcc) {
-    if (!bcc || bcc->size() == 0) return "Invalid BCC";
-
+    auto encodedBcc = bcc->encode();
+    auto chain = hwtrust::DiceChain::verify(encodedBcc);
+    if (!chain.ok()) return chain.error().message();
+    auto keys = chain->cose_public_keys();
+    if (!keys.ok()) return keys.error().message();
     std::vector<BccEntryData> result;
-
-    const auto& devicePubKey = bcc->get(0);
-    if (!devicePubKey->asMap()) return "Invalid device public key at the 1st entry in the BCC";
-
-    bytevec prevKey;
-
-    for (size_t i = 1; i < bcc->size(); ++i) {
-        const cppbor::Array* entry = bcc->get(i)->asArray();
-        if (!entry || entry->size() != kCoseSign1EntryCount) {
-            return "Invalid BCC entry " + std::to_string(i) + ": " + prettyPrint(entry);
-        }
-        auto payload = verifyAndParseCoseSign1Cwt(entry, std::move(prevKey), bytevec{} /* AAD */);
-        if (!payload) {
-            return "Failed to verify entry " + std::to_string(i) + ": " + payload.moveMessage();
-        }
-
-        auto& certProtParms = entry->get(kCoseSign1ProtectedParams);
-        if (!certProtParms || !certProtParms->asBstr()) return "Invalid prot params";
-        auto [parsedProtParms, _, errMsg] = cppbor::parse(certProtParms->asBstr()->value());
-        if (!parsedProtParms || !parsedProtParms->asMap()) return "Invalid prot params";
-
-        result.push_back(BccEntryData{*payload});
-
-        // This entry's public key is the signing key for the next entry.
-        prevKey = payload.moveValue();
-        if (i == 1) {
-            auto [parsedRootKey, _, errMsg] = cppbor::parse(prevKey);
-            if (!parsedRootKey || !parsedRootKey->asMap()) return "Invalid payload entry in BCC.";
-            if (*parsedRootKey != *devicePubKey) {
-                return "Device public key doesn't match BCC root.";
-            }
-        }
+    for (auto& key : *keys) {
+        result.push_back({std::move(key)});
     }
-
     return result;
 }
 
 JsonOutput jsonEncodeCsrWithBuild(const std::string instance_name, const cppbor::Array& csr) {
     const std::string kFingerprintProp = "ro.build.fingerprint";
+    const std::string kSerialNoProp = "ro.serialno";
 
     if (!::android::base::WaitForPropertyCreation(kFingerprintProp)) {
         return JsonOutput::Error("Unable to read build fingerprint");
@@ -441,6 +330,7 @@
     Json::Value json(Json::objectValue);
     json["name"] = instance_name;
     json["build_fingerprint"] = ::android::base::GetProperty(kFingerprintProp, /*default=*/"");
+    json["serialno"] = ::android::base::GetProperty(kSerialNoProp, /*default=*/"");
     json["csr"] = base64.data();  // Boring writes a NUL-terminated c-string
 
     Json::StreamWriterBuilder factory;
@@ -683,9 +573,6 @@
     if (!bccContents) {
         return bccContents.message() + "\n" + prettyPrint(bcc.get());
     }
-    if (bccContents->size() == 0U) {
-        return "The BCC is empty. It must contain at least one entry.";
-    }
 
     auto deviceInfoResult =
             parseAndValidateDeviceInfo(deviceInfo.deviceInfo, provisionable, isFactory);
@@ -977,9 +864,6 @@
     if (!diceContents) {
         return diceContents.message() + "\n" + prettyPrint(diceCertChain);
     }
-    if (diceContents->size() == 0U) {
-        return "The DICE chain is empty. It must contain at least one entry.";
-    }
 
     auto& udsPub = diceContents->back().pubKey;
 
diff --git a/security/keymint/support/remote_prov_utils_test.cpp b/security/keymint/support/remote_prov_utils_test.cpp
index 0250cd6..eaaba45 100644
--- a/security/keymint/support/remote_prov_utils_test.cpp
+++ b/security/keymint/support/remote_prov_utils_test.cpp
@@ -191,7 +191,8 @@
 
     std::string expected = R"({"build_fingerprint":")" +
                            ::android::base::GetProperty("ro.build.fingerprint", /*default=*/"") +
-                           R"(","csr":"gQE=","name":"test"})";
+                           R"(","csr":"gQE=","name":"test","serialno":")" +
+                           ::android::base::GetProperty("ro.serialno", /*default=*/"") + R"("})";
 
     ASSERT_EQ(json, expected);
 }
diff --git a/security/rkp/CHANGELOG.md b/security/rkp/CHANGELOG.md
index 715cf28..9409a6d 100644
--- a/security/rkp/CHANGELOG.md
+++ b/security/rkp/CHANGELOG.md
@@ -41,6 +41,7 @@
       payload and the implementation-defined payload itself. This is done by creating a typed
       `AuthenticatedRequest<T>` object representing the top level data required to authenticate
       the data provided in the payload, `T`.
+  * The new CSR format supports P-384 signing keys and SHA-384 hashes in the DICE chain.
 * RpcHardwareInfo
   * `supportedNumKeysInCsr` added to report the maximum number of keys supported in a CSR.
   * `supportedEekCurve` is no longer used, due to the removal of the EEK from the scheme.
diff --git a/security/rkp/README.md b/security/rkp/README.md
index 5fb4948..9090ac5 100644
--- a/security/rkp/README.md
+++ b/security/rkp/README.md
@@ -172,31 +172,28 @@
 
 *   ECDSA P-256 for attestation signing keys;
 *   Remote provisioning protocol signing keys:
-  *  Ed25519 / P-256
+  *  Ed25519 / P-256 / P-384
 *   ECDH keys:
   *  X25519 / P-256
 *   AES-GCM for all encryption;
-*   SHA-256 for all message digesting;
-*   HMAC-SHA-256 for all MACing; and
-*   HKDF-SHA-256 for all key derivation.
+*   SHA-256 / SHA-384 / SHA-512 for message digesting;
+*   HMAC with a supported message digest for all MACing; and
+*   HKDF with a supported message digest for all key derivation.
 
 We believe that Curve25519 offers the best tradeoff in terms of security,
 efficiency and global trustworthiness, and that it is now sufficiently
 widely-used and widely-implemented to make it a practical choice.
 
-However, since Secure Elements (SE) do not currently offer support for curve
-25519, we are allowing implementations to instead make use of EC P-256 for
-signing and ECDH. To put it simply, the device unique key pair will be a P-256
-key pair for ECDSA instead of Ed25519, and the ProtectedData COSE\_Encrypt
-message will have its payload encrypted with P-256 ECDH key exchange instead of
-X25519.
+However, since hardware such as Secure Elements (SE) do not currently offer
+support for curve 25519, we are allowing implementations to instead make use of
+ECDSA and ECDH.
 
 The CDDL in the rest of the document will use the '/' operator to show areas
-where either curve 25519 or P-256 may be used. Since there is no easy way to
-bind choices across different CDDL groups, it is important that the implementor
-stays consistent in which type is chosen. E.g. taking ES256 as the choice for
-algorithm implies the implementor should also choose the P256 public key group
-further down in the COSE structure.
+where either curve 25519, P-256 or P-384 may be used. Since there is no easy way
+to bind choices across different CDDL groups, it is important that the
+implementor stays consistent in which type is chosen. E.g. taking ES256 as the
+choice for algorithm implies the implementor should also choose the P256 public
+key group further down in the COSE structure.
 
 ### Testability
 
diff --git a/security/rkp/aidl/aidl_api/android.hardware.security.rkp/1/.hash b/security/rkp/aidl/aidl_api/android.hardware.security.rkp/1/.hash
index 404553b..1397c05 100644
--- a/security/rkp/aidl/aidl_api/android.hardware.security.rkp/1/.hash
+++ b/security/rkp/aidl/aidl_api/android.hardware.security.rkp/1/.hash
@@ -1 +1,2 @@
+976674616001f714f4a4df49ee45f548de828524
 d285480d2e0002adc0ace80edf34aa725679512e
diff --git a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
index ff710f1..5bd2145 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/IRemotelyProvisionedComponent.aidl
@@ -159,18 +159,27 @@
      *        IRemotelyProvisionedComponent must validate the MACs on each key.  If any entry in the
      *        array lacks a valid MAC, the method must return STATUS_INVALID_MAC.
      *
-     *        If testMode is true, the keysToCertify array must contain only keys flagged as test
+     *        If testMode is true, the keysToSign array must contain only keys flagged as test
      *        keys. Otherwise, the method must return STATUS_PRODUCTION_KEY_IN_TEST_REQUEST.
      *
-     *        If testMode is false, the keysToCertify array must not contain any keys flagged as
+     *        If testMode is false, the keysToSign array must not contain any keys flagged as
      *        test keys. Otherwise, the method must return STATUS_TEST_KEY_IN_PRODUCTION_REQUEST.
      *
-     * @param in endpointEncryptionKey contains an X25519 public key which will be used to encrypt
-     *        the BCC. For flexibility, this is represented as a certificate chain, represented as a
-     *        CBOR array of COSE_Sign1 objects, ordered from root to leaf. The leaf contains the
-     *        X25519 encryption key, each other element is an Ed25519 key signing the next in the
-     *        chain. The root is self-signed. An implementor may also choose to use P256 as an
-     *        alternative curve for signing and encryption instead of Curve 25519.
+     * @param in endpointEncryptionKey contains an X25519 or P-256 public key which will be used to
+     *        encrypt the BCC. For flexibility, this is represented as a certificate chain
+     *        in the form of a CBOR array of COSE_Sign1 objects, ordered from root to leaf.  An
+     *        implementor may also choose to use P256 as an alternative curve for signing and
+     *        encryption instead of Curve 25519, as indicated by the supportedEekCurve field in
+     *        RpcHardwareInfo; the contents of the EEK chain will match the specified
+     *        supportedEekCurve.
+     *
+     *        - For CURVE_25519 the leaf contains the X25519 agreement key, each other element is an
+     *          Ed25519 key signing the next in the chain.
+     *
+     *        - For CURVE_P256 the leaf contains the P-256 agreement key, each other element is a
+     *          P-256 key signing the next in the chain.
+     *
+     *        In either case, the root is self-signed.
      *
      *            EekChain = [ + SignedSignatureKey, SignedEek ]
      *
@@ -335,14 +344,14 @@
      *     UdsCerts,
      *     DiceCertChain,
      *     SignedData<[
-     *         challenge: bstr .size (32..64), ; Provided by the method parameters
+     *         challenge: bstr .size (16..64), ; Provided by the method parameters
      *         bstr .cbor T,
      *     ]>,
      * ]
      *
      * ; COSE_Sign1 (untagged)
      * SignedData<Data> = [
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     unprotected: {},
      *     payload: bstr .cbor Data / nil,
      *     signature: bstr      ; PureEd25519(CDI_Leaf_Priv, SignedDataSigStruct<Data>) /
@@ -352,7 +361,7 @@
      * ; Sig_structure for SignedData
      * SignedDataSigStruct<Data> = [
      *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     external_aad: bstr .size 0,
      *     payload: bstr .cbor Data / nil,
      * ]
@@ -384,7 +393,7 @@
      * ; after the first describe a link in the boot chain (e.g. bootloaders: BL1, BL2, ... BLN)
      * ; Note that there is no DiceChainEntry for UDS_pub, only a "bare" COSE_key.
      * DiceCertChain = [
-     *     PubKeyEd25519 / PubKeyECDSA256,  ; UDS_Pub
+     *     PubKeyEd25519 / PubKeyECDSA256 / PubKeyECDSA384,  ; UDS_Pub
      *     + DiceChainEntry,                ; First CDI_Certificate -> Last CDI_Certificate
      *                                      ; Last certificate corresponds to KeyMint's DICE key.
      * ]
@@ -392,16 +401,17 @@
      * ; This is the signed payload for each entry in the DICE chain. Note that the "Configuration
      * ; Input Values" described by the Open Profile are not used here. Instead, the DICE chain
      * ; defines its own configuration values for the Configuration Descriptor field. See
-     * ; the Open Profile for DICE for more details on the fields. SHA256 and SHA512 are acceptable
-     * ; hash algorithms. The digest bstr values in the payload are the digest values without any
-     * ; padding. Note that for SHA256, this implies the digest bstr is 32 bytes. This is an
-     * ; intentional, minor deviation from Open Profile for DICE, which specifies all digests are
-     * ; 64 bytes.
+     * ; the Open Profile for DICE for more details on the fields. SHA256, SHA384 and SHA512 are
+     * ; acceptable hash algorithms. The digest bstr values in the payload are the digest values
+     * ; without any padding. Note that this implies that the digest is a 32-byte bstr for SHA256
+     * ; and a 48-byte bstr for SHA384. This is an intentional, minor deviation from Open Profile
+     * ; for DICE, which specifies all digests are 64 bytes.
      * DiceChainEntryPayload = {                    ; CWT [RFC8392]
      *     1 : tstr,                                ; Issuer
      *     2 : tstr,                                ; Subject
      *     -4670552 : bstr .cbor PubKeyEd25519 /
-     *                bstr .cbor PubKeyECDSA256,    ; Subject Public Key
+     *                bstr .cbor PubKeyECDSA256,
+     *                bstr .cbor PubKeyECDSA384,    ; Subject Public Key
      *     -4670553 : bstr                          ; Key Usage
      *
      *     ; NOTE: All of the following fields may be omitted for a "Degenerate DICE Chain", as
@@ -422,7 +432,7 @@
      * ; Each entry in the DICE chain is a DiceChainEntryPayload signed by the key from the previous
      * ; entry in the DICE chain array.
      * DiceChainEntry = [                            ; COSE_Sign1 (untagged)
-     *     protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected : bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     unprotected: {},
      *     payload: bstr .cbor DiceChainEntryPayload,
      *     signature: bstr ; PureEd25519(SigningKey, DiceChainEntryInput) /
@@ -433,7 +443,7 @@
      *
      * DiceChainEntryInput = [
      *     context: "Signature1",
-     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 },
+     *     protected: bstr .cbor { 1 : AlgorithmEdDSA / AlgorithmES256 / AlgorithmES384 },
      *     external_aad: bstr .size 0,
      *     payload: bstr .cbor DiceChainEntryPayload
      * ]
@@ -458,7 +468,16 @@
      *     -3 : bstr                    ; Y coordinate, big-endian
      * }
      *
+     * PubKeyECDSA384 = {               ; COSE_Key
+     *     1 : 2,                       ; Key type : EC2
+     *     3 : AlgorithmES384,          ; Algorithm : ECDSA w/ SHA-384
+     *     -1 : 2,                      ; Curve: P384
+     *     -2 : bstr,                   ; X coordinate
+     *     -3 : bstr                    ; Y coordinate
+     * }
+     *
      * AlgorithmES256 = -7
+     * AlgorithmES384 = -35
      * AlgorithmEdDSA = -8
      */
     byte[] generateCertificateRequestV2(in MacedPublicKey[] keysToSign, in byte[] challenge);
diff --git a/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl b/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
index 3f699bc..de94264 100644
--- a/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
+++ b/security/rkp/aidl/android/hardware/security/keymint/ProtectedData.aidl
@@ -50,6 +50,8 @@
      *                                     ; salt = null
      *                                     ; info = .cbor Context (see below)
      *                                     ; K = HKDF-SHA-256(ikm, salt, info)
+     *                                     ; AAD for the encryption is a CBOR-serialized
+     *                                     ; Enc_structure (RFC 8152 s5.3) with empty external_aad.
      *         recipients : [
      *             [                       ; COSE_Recipient
      *                 protected : bstr .cbor {
@@ -65,7 +67,10 @@
      *     ]
      *
      *     ; The COSE_KDF_Context that is used to derive the ProtectedData encryption key with
-     *     ; HKDF. See details on use in ProtectedData comments above.
+     *     ; HKDF. See details on use in ProtectedData comments above. The public key data
+     *     ; included in the other field of PartyUInfo / PartyVInfo is encoded as:
+     *     ;  - a raw 32-byte public key for X25519
+     *     ;  - raw coordinate data (x || y) for P-256
      *     Context = [
      *         AlgorithmID : 3             ; AES-GCM 256
      *         PartyUInfo : [
@@ -134,11 +139,11 @@
      *     ]
      *
      *     SignedMacAad = [
-     *         challenge : bstr .size (32..64),   ; Size between 32 - 64
+     *         challenge : bstr .size (16..64),   ; Size between 16 - 64
      *                                            ; bytes inclusive
      *         VerifiedDeviceInfo,
      *         tag: bstr                 ; This is the tag from COSE_Mac0 of
-     *                                   ; KeysToCertify, to tie the key set to
+     *                                   ; KeysToSign, to tie the key set to
      *                                   ; the signature.
      *     ]
      *
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index bbda56d..573f10b 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -404,6 +404,7 @@
   protected:
     void SetUp() override {
         CertificateRequestTestBase::SetUp();
+        ASSERT_FALSE(HasFatalFailure());
 
         if (rpcHardwareInfo.versionNumber >= VERSION_WITHOUT_TEST_MODE) {
             bytevec keysToSignMac;
@@ -689,6 +690,7 @@
 class CertificateRequestV2Test : public CertificateRequestTestBase {
     void SetUp() override {
         CertificateRequestTestBase::SetUp();
+        ASSERT_FALSE(HasFatalFailure());
 
         if (rpcHardwareInfo.versionNumber < VERSION_WITHOUT_TEST_MODE) {
             GTEST_SKIP() << "This test case only applies to RKP v3 and above. "
diff --git a/staging/threadnetwork/OWNERS b/staging/threadnetwork/OWNERS
new file mode 100644
index 0000000..037215d
--- /dev/null
+++ b/staging/threadnetwork/OWNERS
@@ -0,0 +1,5 @@
+# Bug component: 1203089
+
+wgtdkp@google.com
+xyk@google.com
+zhanglongxia@google.com
diff --git a/staging/threadnetwork/README.md b/staging/threadnetwork/README.md
new file mode 100644
index 0000000..12104e5
--- /dev/null
+++ b/staging/threadnetwork/README.md
@@ -0,0 +1,12 @@
+# Staging threadnetwork HAL interface
+
+The directory includes the unstable/unreleased version of `hardware/interfaces/threadnetwork`
+code which should **NOT** be used in production. But vendors may start verifying their hardware
+with the HAL interface.
+
+This directory will be cleaned up when the stable Thread HAL interface is added in
+`hardware/interfaces/threadnetwork` by version `V` or later.
+
+More information about _Thread_:
+- https://www.threadgroup.org
+- https://openthread.io
diff --git a/tetheroffload/aidl/Android.bp b/tetheroffload/aidl/Android.bp
new file mode 100644
index 0000000..1d80586
--- /dev/null
+++ b/tetheroffload/aidl/Android.bp
@@ -0,0 +1,27 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+aidl_interface {
+    name: "android.hardware.tetheroffload",
+    vendor_available: true,
+    srcs: ["android/hardware/tetheroffload/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+            apex_available: [
+                "com.android.tethering",
+            ],
+            min_sdk_version: "30",
+            enabled: true,
+        },
+        ndk: {
+            apps_enabled: false,
+        },
+    },
+    frozen: false,
+}
diff --git a/tetheroffload/aidl/TEST_MAPPING b/tetheroffload/aidl/TEST_MAPPING
new file mode 100644
index 0000000..c6d4c07
--- /dev/null
+++ b/tetheroffload/aidl/TEST_MAPPING
@@ -0,0 +1,7 @@
+{
+  "presubmit" : [
+    {
+      "name": "VtsHalTetheroffloadTargetTest"
+    }
+  ]
+}
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
similarity index 89%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
index 336f9b5..493a698 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ForwardedStats.aidl
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable ForwardedStats {
+  long rxBytes;
+  long txBytes;
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
similarity index 69%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
index 336f9b5..9a58b1f 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IOffload.aidl
@@ -31,12 +31,16 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.tetheroffload;
+@VintfStability
+interface IOffload {
+  void initOffload(in ParcelFileDescriptor fd1, in ParcelFileDescriptor fd2, in android.hardware.tetheroffload.ITetheringOffloadCallback cb);
+  void stopOffload();
+  void setLocalPrefixes(in String[] prefixes);
+  android.hardware.tetheroffload.ForwardedStats getForwardedStats(in String upstream);
+  void setDataWarningAndLimit(in String upstream, in long warningBytes, in long limitBytes);
+  void setUpstreamParameters(in String iface, in String v4Addr, in String v4Gw, in String[] v6Gws);
+  void addDownstream(in String iface, in String prefix);
+  void removeDownstream(in String iface, in String prefix);
+  const int ERROR_CODE_UNUSED = 0;
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
similarity index 89%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
index 336f9b5..2b42f0c 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable IPv4AddrPortPair {
+  String addr;
+  int port;
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
similarity index 85%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
index 336f9b5..4eb7d04 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.tetheroffload;
+@VintfStability
+interface ITetheringOffloadCallback {
+  oneway void onEvent(in android.hardware.tetheroffload.OffloadCallbackEvent event);
+  oneway void updateTimeout(in android.hardware.tetheroffload.NatTimeoutUpdate params);
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
similarity index 86%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
index 336f9b5..9eddaa2 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
@@ -31,12 +31,10 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
-@Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+package android.hardware.tetheroffload;
+@VintfStability
+parcelable NatTimeoutUpdate {
+  android.hardware.tetheroffload.IPv4AddrPortPair src;
+  android.hardware.tetheroffload.IPv4AddrPortPair dst;
+  android.hardware.tetheroffload.NetworkProtocol proto;
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
similarity index 91%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
index 336f9b5..52bd2a6 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/NetworkProtocol.aidl
@@ -31,12 +31,9 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
+package android.hardware.tetheroffload;
 @Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+enum NetworkProtocol {
+  TCP = 6,
+  UDP = 17,
 }
diff --git a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
similarity index 86%
copy from audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
copy to tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
index 336f9b5..026e18e 100644
--- a/audio/aidl/aidl_api/android.hardware.audio.core/current/android/hardware/audio/core/AudioMode.aidl
+++ b/tetheroffload/aidl/aidl_api/android.hardware.tetheroffload/current/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
@@ -31,12 +31,13 @@
 // with such a backward incompatible change, it has a high risk of breaking
 // later when a module using the interface is updated, e.g., Mainline modules.
 
-package android.hardware.audio.core;
+package android.hardware.tetheroffload;
 @Backing(type="int") @VintfStability
-enum AudioMode {
-  NORMAL = 0,
-  RINGTONE = 1,
-  IN_CALL = 2,
-  IN_COMMUNICATION = 3,
-  CALL_SCREEN = 4,
+enum OffloadCallbackEvent {
+  OFFLOAD_STARTED = 1,
+  OFFLOAD_STOPPED_ERROR = 2,
+  OFFLOAD_STOPPED_UNSUPPORTED = 3,
+  OFFLOAD_SUPPORT_AVAILABLE = 4,
+  OFFLOAD_STOPPED_LIMIT_REACHED = 5,
+  OFFLOAD_WARNING_REACHED = 6,
 }
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl
new file mode 100644
index 0000000..d2fe49b
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/ForwardedStats.aidl
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+@VintfStability
+parcelable ForwardedStats {
+    /**
+     * Tx/Rx forwarded bytes
+     */
+    long rxBytes;
+    long txBytes;
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl
new file mode 100644
index 0000000..984f2a5
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/IOffload.aidl
@@ -0,0 +1,282 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.ForwardedStats;
+import android.hardware.tetheroffload.ITetheringOffloadCallback;
+
+/**
+ * Interface used to control tethering offload.
+ */
+@VintfStability
+interface IOffload {
+    /**
+     * Error code for all {@code ServiceSpecificException}s thrown by this interface.
+     */
+    const int ERROR_CODE_UNUSED = 0;
+
+    /**
+     * Indicates intent to start offload for tethering in immediate future.
+     *
+     * This API must be called exactly once when Tethering is requested by the user.
+     *
+     * If this API is called multiple times without first calling stopOffload, then the subsequent
+     * calls must fail without changing the state of the server.
+     *
+     * If for some reason, the hardware is currently unable to support offload, this call must fail.
+     *
+     * @param fd1 A file descriptor bound to the following netlink groups
+     *            (NF_NETLINK_CONNTRACK_NEW | NF_NETLINK_CONNTRACK_DESTROY).
+     * @param fd2 A file descriptor bound to the following netlink groups
+     *            (NF_NETLINK_CONNTRACK_UPDATE | NF_NETLINK_CONNTRACK_DESTROY).
+     * @param cb Assuming success, this callback must provide unsolicited updates of offload status.
+     *           It is assumed to be valid until stopOffload is called.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any file descriptors are invalid.
+     *         - EX_ILLEGAL_STATE if this method previously succeeded and stopOffload() was not
+     *           later called.
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: Initializing offload does not imply that any upstreams or downstreams have yet been,
+     * or even will be, chosen.  This API is symmetrical with stopOffload.
+     */
+    void initOffload(in ParcelFileDescriptor fd1, in ParcelFileDescriptor fd2,
+            in ITetheringOffloadCallback cb);
+
+    /**
+     * Indicate desire to tear down all tethering offload.
+     *
+     * Called after tethering is no longer requested by the user. Any remaining offload must
+     * be subsequently torn down by the management process.  Upon success, the callback registered
+     * in initOffload must be released, and offload must be stopped.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_STATE if initOffload() was not called, or if stopOffload() was already
+     *           called.
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: Statistics must be reset by this API.
+     */
+    void stopOffload();
+
+    /**
+     * Instruct management process not to forward traffic destined to or from the specified
+     * prefixes.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param prefixes List containing fully specified prefixes. For e.g. 192.168.1.0/24
+     * or 2001:4860:684::/64
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if the IP prefixes are invalid.
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: This list overrides any previously specified list
+     */
+    void setLocalPrefixes(in String[] prefixes);
+
+    /**
+     * Query offloaded traffic statistics forwarded to an upstream address.
+     *
+     * Return statistics that have transpired since the last query.  This would include
+     * statistics from all offloaded downstream tether interfaces that have been forwarded to this
+     * upstream interface.  After returning the statistics, the counters are reset to zero.
+     *
+     * Only offloaded statistics must be returned by this API, software stats must not be
+     * returned.
+     *
+     * @param upstream Upstream interface on which traffic exited/entered
+     *
+     * @return ForwardedStats depicting the received and transmitted bytes
+     *
+     * @throws:
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    ForwardedStats getForwardedStats(in String upstream);
+
+    /**
+     * Instruct hardware to send callbacks, and possibly stop offload, after certain number of bytes
+     * have been transferred in either direction on this upstream interface.
+     *
+     * The specified quota bytes must be applied to all traffic on the given upstream interface.
+     * This includes hardware forwarded traffic, software forwarded traffic, and AP-originated
+     * traffic. IPv4 and IPv6 traffic both count towards the same quota. IP headers are included
+     * in the byte count quota, but, link-layer headers are not.
+     *
+     * This API may only be called while offload is occurring on this upstream. The hardware
+     * management process MUST NOT store the values when offload is not started and apply them
+     * once offload is started. This is because the quota values would likely become stale over
+     * time and would not reflect any new traffic that has occurred.
+     *
+     * The specified quota bytes MUST replace any previous quotas set by
+     * {@code setDataWarningAndLimit} specified on the same interface. It may be interpreted as
+     * "tell me when either <warningBytes> or <limitBytes> bytes have been transferred
+     * (in either direction), and stop offload when <limitBytes> bytes have been transferred,
+     * starting now and counting from zero on <upstream>."
+     *
+     * Once the {@code warningBytes} is reached, the callback registered in initOffload must be
+     * called with {@code OFFLOAD_WARNING_REACHED} to indicate this event. Once the event fires
+     * for this upstream, no further {@code OFFLOAD_WARNING_REACHED} event will be fired for this
+     * upstream unless this method is called again with the same interface. Note that there is
+     * no need to call initOffload again to resume offload if stopOffload was not called by the
+     * client.
+     *
+     * Similarly, Once the {@code limitBytes} is reached, the callback registered in initOffload
+     * must be called with {@code OFFLOAD_STOPPED_LIMIT_REACHED} to indicate this event. Once
+     * the event fires for this upstream, no further {@code OFFLOAD_STOPPED_LIMIT_REACHED}
+     * event will be fired for this upstream unless this method is called again with the same
+     * interface. However, unlike {@code warningBytes}, when {@code limitBytes} is reached,
+     * all offload must be stopped. If offload is desired again, the hardware management
+     * process must be completely reprogrammed by calling setUpstreamParameters and
+     * addDownstream again.
+     *
+     * Note that {@code warningBytes} must always be less than or equal to {@code limitBytes},
+     * when {@code warningBytes} is reached, {@code limitBytes} may still valid unless this method
+     * is called again with the same interface.
+     *
+     * @param upstream Upstream interface name that quota must apply to.
+     * @param warningBytes The quota of warning, defined as the number of bytes, starting from
+     *                     zero and counting from now.
+     * @param limitBytes The quota of limit, defined as the number of bytes, starting from zero
+     *                   and counting from now.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid upstream
+     *           or negative number of bytes).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    void setDataWarningAndLimit(in String upstream, in long warningBytes, in long limitBytes);
+
+    /**
+     * Instruct hardware to start forwarding traffic to the specified upstream.
+     *
+     * When iface, v4Addr, and v4Gw are all non-null, the management process may begin forwarding
+     * any currently configured or future configured IPv4 downstreams to this upstream interface.
+     *
+     * If any of the previously three mentioned parameters are null, then any current IPv4 offload
+     * must be stopped.
+     *
+     * When iface and v6Gws are both non-null, and in the case of v6Gws, are not empty, the
+     * management process may begin forwarding any currently configured or future configured IPv6
+     * downstreams to this upstream interface.
+     *
+     * If either of the two above parameters are null, or no V6 Gateways are provided, then IPv6
+     * offload must be stopped.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Upstream interface name.  Note that only one is needed because IPv4 and IPv6
+     *               interfaces cannot be different (only known that this can occur during software
+     *               xlat, which cannot be offloaded through hardware anyways).  If the iface is
+     *               null, offload must be stopped.
+     * @param v4Addr The local IPv4 address assigned to the provided upstream interface, i.e. the
+     *               IPv4 address the packets are NATed to. For e.g. 192.168.0.12.
+     * @param v4Gw   The IPv4 address of the IPv4 gateway on the upstream interface.
+     *               For e.g. 192.168.1.1
+     * @param v6Gws  A list of IPv6 addresses (for e.g. fe80::97be:9de7:b24b:9194) for possible IPv6
+     *               gateways on the upstream interface.
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid upstream
+     *           or IP addresses).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: This overrides any previously configured parameters.
+     */
+    void setUpstreamParameters(
+            in String iface, in String v4Addr, in String v4Gw, in String[] v6Gws);
+
+    /**
+     * Configure a downstream interface and prefix in the hardware management process that may be
+     * forwarded.
+     *
+     * The prefix may be an IPv4 or an IPv6 prefix to signify which family can be offloaded from
+     * the specified tether interface.  The list of IPv4 and IPv6 downstreams that are configured
+     * may differ.
+     *
+     * If the given protocol, as determined by the prefix, has an upstream set,
+     * the hardware may begin forwarding traffic between the upstream and any devices on the
+     * downstream interface that have IP addresses within the specified prefix. Other traffic from
+     * the same downstream interfaces is unaffected and must be forwarded if and only if it was
+     * already being forwarded.
+     *
+     * If no upstream is currently configured, then these downstream interface and prefixes must be
+     * preserved so that offload may begin in the future when an upstream is set.
+     *
+     * This API does not replace any previously configured downstreams and any such downstreams must
+     * be explicitly removed by calling removeDownstream.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Downstream interface
+     * @param prefix Downstream prefix depicting addresses that may be offloaded.
+     *               For e.g. 192.168.1.0/24 or 2001:4860:684::/64)
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid downstream
+     *           or IP prefix).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     *
+     * Remarks: The hardware management process may fail this call in a normal situation.  This can
+     *          happen because the hardware cannot support the current number of prefixes, the
+     *          hardware cannot support concurrent offload on multiple interfaces, the hardware
+     *          cannot currently support offload on the tether interface for some reason, or any
+     *          other dynamic configuration issues which may occur.  In this case,
+     *          traffic must remain unaffected and must be forwarded if and only if it was already
+     *          being forwarded.
+     */
+    void addDownstream(in String iface, in String prefix);
+
+    /**
+     * Remove a downstream prefix that may be forwarded from the hardware management process.
+     *
+     * The prefix may be an IPv4 or an IPv6 prefix. If it was not previously configured using
+     * addDownstream, then this must be a no-op.
+     *
+     * This API may only be called after initOffload and before stopOffload.
+     *
+     * @param iface  Downstream interface
+     * @param prefix Downstream prefix depicting prefix that must no longer be offloaded
+     *               For e.g. 192.168.1.0/24 or 2001:4860:684::/64)
+     *
+     * @throws:
+     *         - EX_ILLEGAL_ARGUMENT if any parameters are invalid (such as invalid downstream
+     *           or IP prefix).
+     *         - EX_ILLEGAL_STATE if this method is called before initOffload(), or if this method
+     *           is called after stopOffload().
+     *         - EX_SERVICE_SPECIFIC with the error message set to a human-readable reason for the
+     *           error.
+     */
+    void removeDownstream(in String iface, in String prefix);
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
new file mode 100644
index 0000000..16d7d85
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/IPv4AddrPortPair.aidl
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+@VintfStability
+parcelable IPv4AddrPortPair {
+    /**
+     * IPv4 Address and Port
+     */
+    String addr;
+    int port;
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
new file mode 100644
index 0000000..5ee819b
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/ITetheringOffloadCallback.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.NatTimeoutUpdate;
+import android.hardware.tetheroffload.OffloadCallbackEvent;
+
+/**
+ * Callback providing information about status of hardware management process
+ * as well as providing a way to keep offloaded connections from timing out.
+ */
+@VintfStability
+oneway interface ITetheringOffloadCallback {
+    /**
+     * Called when an asynchronous event is generated by the hardware
+     * management process.
+     */
+    void onEvent(in OffloadCallbackEvent event);
+
+    /**
+     *  Provide a way for the management process to request that a connections
+     *  timeout be updated in kernel.
+     *
+     *  This is necessary to ensure that offloaded traffic is not cleaned up
+     *  by the kernel connection tracking module for IPv4.
+     */
+    void updateTimeout(in NatTimeoutUpdate params);
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
new file mode 100644
index 0000000..50805ef
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/NatTimeoutUpdate.aidl
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+import android.hardware.tetheroffload.IPv4AddrPortPair;
+import android.hardware.tetheroffload.NetworkProtocol;
+
+@VintfStability
+parcelable NatTimeoutUpdate {
+    IPv4AddrPortPair src;
+    IPv4AddrPortPair dst;
+    NetworkProtocol proto;
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl
new file mode 100644
index 0000000..cc4f7ac
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/NetworkProtocol.aidl
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+@VintfStability
+@Backing(type="int")
+enum NetworkProtocol {
+    TCP = 6,
+    UDP = 17,
+}
diff --git a/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl b/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
new file mode 100644
index 0000000..15a1f93
--- /dev/null
+++ b/tetheroffload/aidl/android/hardware/tetheroffload/OffloadCallbackEvent.aidl
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.tetheroffload;
+
+@VintfStability
+@Backing(type="int")
+enum OffloadCallbackEvent {
+    /**
+     * Indicate that a working configuration has been programmed and the
+     * hardware management process has begun forwarding traffic.
+     */
+    OFFLOAD_STARTED = 1,
+    /**
+     * Indicate that an error has occurred which has disrupted hardware
+     * acceleration.  Software routing may still be attempted; however,
+     * statistics may be temporarily unavailable.  Statistics may be recovered
+     * after OFFLOAD_SUPPORT_AVAILABLE event is fired.
+     */
+    OFFLOAD_STOPPED_ERROR = 2,
+    /**
+     * Indicate that the device has moved to a RAT on which hardware
+     * acceleration is not supported.  Subsequent calls to setUpstreamParameters
+     * and add/removeDownstream will likely fail and cannot be presumed to be
+     * saved inside of the hardware management process.  Upon receiving
+     * OFFLOAD_SUPPORT_AVAILABLE, the client may reprogram the hardware
+     * management process to begin offload again.
+     */
+    OFFLOAD_STOPPED_UNSUPPORTED = 3,
+    /**
+     * Indicate that the hardware management process is willing and able to
+     * provide support for hardware acceleration at this time.  If applicable,
+     * the client may query for statistics.  If offload is desired, the client
+     * must reprogram the hardware management process.
+     */
+    OFFLOAD_SUPPORT_AVAILABLE = 4,
+    /**
+     * Hardware acceleration is no longer in effect and must be reprogrammed
+     * in order to resume.  This event is fired when the limit, applied in
+     * setDataLimit, has expired.  It is recommended that the client query for
+     * statistics immediately after receiving this event.
+     */
+    OFFLOAD_STOPPED_LIMIT_REACHED = 5,
+    /**
+     * This event is fired when the quota, applied in setDataWarningAndLimit, has expired. It is
+     * recommended that the client query for statistics immediately after receiving this event.
+     * Any offloaded traffic will continue to be offloaded until offload is stopped or
+     * OFFLOAD_STOPPED_LIMIT_REACHED is sent.
+     */
+    OFFLOAD_WARNING_REACHED = 6,
+}
diff --git a/tetheroffload/aidl/default/Android.bp b/tetheroffload/aidl/default/Android.bp
new file mode 100644
index 0000000..8f0739c
--- /dev/null
+++ b/tetheroffload/aidl/default/Android.bp
@@ -0,0 +1,36 @@
+// Copyright (C) 2022 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "android.hardware.tetheroffload-service.example",
+    relative_install_path: "hw",
+    init_rc: ["tetheroffload-example.rc"],
+    vintf_fragments: ["tetheroffload-example.xml"],
+    vendor: true,
+    shared_libs: [
+        "android.hardware.tetheroffload-V1-ndk",
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libutils",
+    ],
+    srcs: [
+        "main.cpp",
+        "Offload.cpp",
+    ],
+}
diff --git a/tetheroffload/aidl/default/Offload.cpp b/tetheroffload/aidl/default/Offload.cpp
new file mode 100644
index 0000000..8aa6916
--- /dev/null
+++ b/tetheroffload/aidl/default/Offload.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <numeric>
+#include <string>
+
+#include <android-base/logging.h>
+#include <android-base/strings.h>
+#include <netdb.h>
+
+#include "Offload.h"
+
+namespace aidl::android::hardware::tetheroffload::impl::example {
+
+using ::android::base::Join;
+
+ndk::ScopedAStatus Offload::addDownstream(const std::string& in_iface,
+                                          const std::string& in_prefix) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", Prefix: " << in_prefix;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (!isValidIpPrefix(in_prefix)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid IP prefix");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::getForwardedStats(const std::string& in_upstream,
+                                              ForwardedStats* _aidl_return) {
+    LOG(VERBOSE) << __func__ << " Upstream: " << in_upstream;
+    ForwardedStats stats;
+    stats.rxBytes = 0;
+    stats.txBytes = 0;
+    *_aidl_return = std::move(stats);
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::initOffload(const ndk::ScopedFileDescriptor& in_fd1,
+                                        const ndk::ScopedFileDescriptor& in_fd2,
+                                        const std::shared_ptr<ITetheringOffloadCallback>& in_cb) {
+    LOG(VERBOSE) << __func__ << " FileDescriptor1: " << std::to_string(in_fd1.get())
+                 << ", FileDescriptor2: " << std::to_string(in_fd2.get())
+                 << ", ITetheringOffloadCallback: " << in_cb;
+    if (isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL already initialized");
+    }
+    int fd1 = in_fd1.get();
+    int fd2 = in_fd2.get();
+    if (fd1 < 0 || fd2 < 0) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid file descriptors");
+    }
+    mFd1 = ndk::ScopedFileDescriptor(dup(fd1));
+    mFd2 = ndk::ScopedFileDescriptor(dup(fd2));
+    mInitialized = true;
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::removeDownstream(const std::string& in_iface,
+                                             const std::string& in_prefix) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", Prefix: " << in_prefix;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidIpPrefix(in_prefix)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid IP prefix");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setDataWarningAndLimit(const std::string& in_upstream,
+                                                   int64_t in_warningBytes, int64_t in_limitBytes) {
+    LOG(VERBOSE) << __func__ << " Upstream: " << in_upstream
+                 << ", WarningBytes: " << in_warningBytes << ", LimitBytes: " << in_limitBytes;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_upstream)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (in_warningBytes < 0 || in_limitBytes < 0) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Threshold must be non-negative");
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setLocalPrefixes(const std::vector<std::string>& in_prefixes) {
+    LOG(VERBOSE) << __func__ << " Prefixes: " << Join(in_prefixes, ',');
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (in_prefixes.empty()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "No IP prefix");
+    }
+    for (std::string prefix : in_prefixes) {
+        if (!isValidIpPrefix(prefix)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP prefix");
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::setUpstreamParameters(const std::string& in_iface,
+                                                  const std::string& in_v4Addr,
+                                                  const std::string& in_v4Gw,
+                                                  const std::vector<std::string>& in_v6Gws) {
+    LOG(VERBOSE) << __func__ << " Interface: " << in_iface << ", IPv4Address: " << in_v4Addr
+                 << ", IPv4Gateway: " << in_v4Gw << ", IPv6Gateways: " << Join(in_v6Gws, ',');
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    if (!isValidInterface(in_iface)) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid interface name");
+    }
+    if (in_v4Addr.empty() && in_v4Gw.empty() && in_v6Gws.empty()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "No upstream IP address");
+    }
+    if (!in_v4Addr.empty() && !in_v4Gw.empty()) {
+        if (!isValidIpv4Address(in_v4Addr) || !isValidIpv4Address(in_v4Gw)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP address");
+        }
+    }
+    for (std::string ip : in_v6Gws) {
+        if (!isValidIpv6Address(ip)) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Invalid IP address");
+        }
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Offload::stopOffload() {
+    LOG(VERBOSE) << __func__;
+    if (!isInitialized()) {
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(
+                EX_ILLEGAL_STATE, "Tetheroffload HAL not initialized");
+    }
+    mInitialized = false;
+    return ndk::ScopedAStatus::ok();
+};
+
+bool Offload::isInitialized() {
+    return (mInitialized == true);
+}
+
+bool Offload::isValidInterface(const std::string& iface) {
+    return !iface.empty() && iface != "invalid";
+}
+
+bool Offload::isValidIpv4Address(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET, false);
+}
+
+bool Offload::isValidIpv4Prefix(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET, true);
+}
+
+bool Offload::isValidIpv6Address(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET6, false);
+}
+
+bool Offload::isValidIpv6Prefix(const std::string& repr) {
+    return validateIpAddressOrPrefix(repr, AF_INET6, true);
+}
+
+bool Offload::isValidIpAddress(const std::string& repr) {
+    return isValidIpv4Address(repr) || isValidIpv6Address(repr);
+}
+
+bool Offload::isValidIpPrefix(const std::string& repr) {
+    return isValidIpv4Prefix(repr) || isValidIpv6Prefix(repr);
+}
+
+// Refer to libnetdutils's IPAddress and IPPrefix classes.
+// Can't use them directly because libnetdutils is not "vendor_available".
+bool Offload::validateIpAddressOrPrefix(const std::string& repr, const int expectedFamily,
+                                        const bool isPrefix) {
+    const addrinfo hints = {
+            .ai_flags = AI_NUMERICHOST | AI_NUMERICSERV,
+    };
+    addrinfo* res;
+    size_t index = repr.find('/');
+    if (isPrefix && index == std::string::npos) return false;
+
+    // Parse the IP address.
+    const std::string ipAddress = isPrefix ? repr.substr(0, index) : repr;
+    const int ret = getaddrinfo(ipAddress.c_str(), nullptr, &hints, &res);
+    if (ret != 0) return false;
+
+    // Check the address family.
+    int family = res[0].ai_family;
+    freeaddrinfo(res);
+    if (family != expectedFamily) return false;
+    if (!isPrefix) return true;
+
+    // Parse the prefix length.
+    const char* prefixString = repr.c_str() + index + 1;
+    if (!isdigit(*prefixString)) return false;
+    char* endptr;
+    unsigned long prefixlen = strtoul(prefixString, &endptr, 10);
+    if (*endptr != '\0') return false;
+
+    uint8_t maxlen = (family == AF_INET) ? 32 : 128;
+    if (prefixlen > maxlen) return false;
+
+    return true;
+}
+
+}  // namespace aidl::android::hardware::tetheroffload::impl::example
diff --git a/tetheroffload/aidl/default/Offload.h b/tetheroffload/aidl/default/Offload.h
new file mode 100644
index 0000000..a1f6bce
--- /dev/null
+++ b/tetheroffload/aidl/default/Offload.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/tetheroffload/BnOffload.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace tetheroffload {
+namespace impl {
+namespace example {
+
+using aidl::android::hardware::tetheroffload::ForwardedStats;
+using aidl::android::hardware::tetheroffload::ITetheringOffloadCallback;
+
+class Offload : public BnOffload {
+  public:
+    ndk::ScopedAStatus addDownstream(const std::string& in_iface,
+                                     const std::string& in_prefix) override;
+    ndk::ScopedAStatus getForwardedStats(const std::string& in_upstream,
+                                         ForwardedStats* _aidl_return) override;
+    ndk::ScopedAStatus initOffload(
+            const ndk::ScopedFileDescriptor& in_fd1, const ndk::ScopedFileDescriptor& in_fd2,
+            const std::shared_ptr<ITetheringOffloadCallback>& in_cb) override;
+    ndk::ScopedAStatus removeDownstream(const std::string& in_iface,
+                                        const std::string& in_prefix) override;
+    ndk::ScopedAStatus setDataWarningAndLimit(const std::string& in_upstream,
+                                              int64_t in_warningBytes,
+                                              int64_t in_limitBytes) override;
+    ndk::ScopedAStatus setLocalPrefixes(const std::vector<std::string>& in_prefixes) override;
+    ndk::ScopedAStatus setUpstreamParameters(const std::string& in_iface,
+                                             const std::string& in_v4Addr,
+                                             const std::string& in_v4Gw,
+                                             const std::vector<std::string>& in_v6Gws) override;
+    ndk::ScopedAStatus stopOffload() override;
+
+  private:
+    bool isInitialized();
+    bool isValidInterface(const std::string& iface);
+    bool isValidIpv4Address(const std::string& repr);
+    bool isValidIpv4Prefix(const std::string& repr);
+    bool isValidIpv6Address(const std::string& repr);
+    bool isValidIpv6Prefix(const std::string& repr);
+    bool isValidIpAddress(const std::string& repr);
+    bool isValidIpPrefix(const std::string& repr);
+    bool validateIpAddressOrPrefix(const std::string& repr, const int expectedFamily,
+                                   const bool isPrefix);
+
+    bool mInitialized = false;
+    ndk::ScopedFileDescriptor mFd1;
+    ndk::ScopedFileDescriptor mFd2;
+};
+
+}  // namespace example
+}  // namespace impl
+}  // namespace tetheroffload
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/tetheroffload/aidl/default/main.cpp b/tetheroffload/aidl/default/main.cpp
new file mode 100644
index 0000000..6633630
--- /dev/null
+++ b/tetheroffload/aidl/default/main.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Offload.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+using aidl::android::hardware::tetheroffload::impl::example::Offload;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<Offload> offload = ndk::SharedRefBase::make<Offload>();
+
+    binder_status_t status = AServiceManager_addService(
+            offload->asBinder().get(), Offload::makeServiceName("default").c_str());
+    CHECK_EQ(status, STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/tetheroffload/aidl/default/tetheroffload-example.rc b/tetheroffload/aidl/default/tetheroffload-example.rc
new file mode 100644
index 0000000..46cda61
--- /dev/null
+++ b/tetheroffload/aidl/default/tetheroffload-example.rc
@@ -0,0 +1,4 @@
+service vendor.tetheroffload-example /vendor/bin/hw/android.hardware.tetheroffload-service.example
+    class hal
+    user nobody
+    group nobody
diff --git a/tetheroffload/aidl/default/tetheroffload-example.xml b/tetheroffload/aidl/default/tetheroffload-example.xml
new file mode 100644
index 0000000..9fe83f6
--- /dev/null
+++ b/tetheroffload/aidl/default/tetheroffload-example.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.tetheroffload</name>
+        <version>1</version>
+        <fqname>IOffload/default</fqname>
+    </hal>
+</manifest>
diff --git a/tetheroffload/aidl/vts/functional/Android.bp b/tetheroffload/aidl/vts/functional/Android.bp
new file mode 100644
index 0000000..74edab0
--- /dev/null
+++ b/tetheroffload/aidl/vts/functional/Android.bp
@@ -0,0 +1,25 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "VtsHalTetheroffloadTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: [
+        "VtsHalTetheroffloadTargetTest.cpp",
+    ],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.tetheroffload-V1-ndk",
+        "libgmock_ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp b/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp
new file mode 100644
index 0000000..f46c9ab
--- /dev/null
+++ b/tetheroffload/aidl/vts/functional/VtsHalTetheroffloadTargetTest.cpp
@@ -0,0 +1,701 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "tetheroffload_aidl_hal_test"
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/tetheroffload/BnOffload.h>
+#include <aidl/android/hardware/tetheroffload/BnTetheringOffloadCallback.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#include <log/log.h>
+#include <net/if.h>
+#include <sys/socket.h>
+
+namespace aidl::android::hardware::tetheroffload {
+
+namespace {
+
+using ::android::base::unique_fd;
+using android::hardware::tetheroffload::ForwardedStats;
+using android::hardware::tetheroffload::IOffload;
+using android::hardware::tetheroffload::NatTimeoutUpdate;
+using android::hardware::tetheroffload::OffloadCallbackEvent;
+using ::testing::AnyOf;
+using ::testing::Eq;
+
+const std::string TEST_IFACE = "rmnet_data0";
+const unsigned kFd1Groups = NF_NETLINK_CONNTRACK_NEW | NF_NETLINK_CONNTRACK_DESTROY;
+const unsigned kFd2Groups = NF_NETLINK_CONNTRACK_UPDATE | NF_NETLINK_CONNTRACK_DESTROY;
+
+enum class ExpectBoolean {
+    Ignored = -1,
+    False = 0,
+    True = 1,
+};
+
+inline const sockaddr* asSockaddr(const sockaddr_nl* nladdr) {
+    return reinterpret_cast<const sockaddr*>(nladdr);
+}
+
+int netlinkSocket(int protocol, unsigned groups) {
+    unique_fd s(socket(AF_NETLINK, SOCK_DGRAM, protocol));
+    if (s.get() < 0) {
+        return -errno;
+    }
+
+    const struct sockaddr_nl bind_addr = {
+            .nl_family = AF_NETLINK,
+            .nl_pad = 0,
+            .nl_pid = 0,
+            .nl_groups = groups,
+    };
+    if (bind(s.get(), asSockaddr(&bind_addr), sizeof(bind_addr)) != 0) {
+        return -errno;
+    }
+
+    const struct sockaddr_nl kernel_addr = {
+            .nl_family = AF_NETLINK,
+            .nl_pad = 0,
+            .nl_pid = 0,
+            .nl_groups = groups,
+    };
+    if (connect(s.get(), asSockaddr(&kernel_addr), sizeof(kernel_addr)) != 0) {
+        return -errno;
+    }
+
+    return s.release();
+}
+
+int netlinkSocket(unsigned groups) {
+    return netlinkSocket(NETLINK_NETFILTER, groups);
+}
+
+// Check whether the specified interface is up.
+bool interfaceIsUp(const std::string name) {
+    struct ifreq ifr = {};
+    strlcpy(ifr.ifr_name, name.c_str(), sizeof(ifr.ifr_name));
+    int sock = socket(AF_INET6, SOCK_DGRAM, 0);
+    if (sock == -1) return false;
+    int ret = ioctl(sock, SIOCGIFFLAGS, &ifr, sizeof(ifr));
+    close(sock);
+    return (ret == 0) && (ifr.ifr_flags & IFF_UP);
+}
+
+// Callback class for both events and NAT timeout updates.
+class TetheringOffloadCallback : public BnTetheringOffloadCallback {
+  public:
+    ndk::ScopedAStatus onEvent(OffloadCallbackEvent in_event) override {
+        auto lock = std::lock_guard{mMutex};
+        mOnEventInvoked = true;
+        mLastEvent = in_event;
+        mNotifyCv.notify_all();
+        return ndk::ScopedAStatus::ok();
+    }
+
+    ndk::ScopedAStatus updateTimeout(const NatTimeoutUpdate& in_params) override {
+        auto lock = std::lock_guard{mMutex};
+        mOnUpdateTimeoutInvoked = true;
+        mNatTimeout = in_params;
+        mNotifyCv.notify_all();
+        return ndk::ScopedAStatus::ok();
+    }
+
+  private:
+    std::mutex mMutex;
+    std::condition_variable mNotifyCv;
+    OffloadCallbackEvent mLastEvent;
+    NatTimeoutUpdate mNatTimeout;
+    bool mOnEventInvoked = false;
+    bool mOnUpdateTimeoutInvoked = false;
+};
+
+// The common base class for tetheroffload AIDL HAL tests.
+class TetheroffloadAidlTestBase : public testing::TestWithParam<std::string> {
+  public:
+    virtual void SetUp() override { getService(); }
+    virtual void TearDown() override {
+        // For good measure, the teardown should try stopOffload() once more, since
+        // different HAL call test cycles might enter this function. Also the
+        // return code cannot be actually expected for all cases, hence ignore it.
+        stopOffload(ExpectBoolean::Ignored);
+    };
+
+  protected:
+    void getService() {
+        AIBinder* binder = AServiceManager_waitForService(GetParam().c_str());
+        ASSERT_NE(binder, nullptr);
+        mOffload = IOffload::fromBinder(ndk::SpAIBinder(binder));
+    }
+
+    void initOffload(const bool expectedResult) {
+        unique_fd ufd1(netlinkSocket(kFd1Groups));
+        if (ufd1.get() < 0) {
+            FAIL() << "Unable to create conntrack sockets: " << strerror(errno);
+        }
+        ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(ufd1.release());
+
+        unique_fd ufd2(netlinkSocket(kFd2Groups));
+        if (ufd2.get() < 0) {
+            FAIL() << "Unable to create conntrack sockets: " << strerror(errno);
+        }
+        ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(ufd2.release());
+
+        mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+        ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+
+        ASSERT_EQ(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                  expectedResult ? EX_NONE : EX_ILLEGAL_STATE);
+    }
+
+    void stopOffload(const ExpectBoolean expectedResult) {
+        ndk::ScopedAStatus status = mOffload->stopOffload();
+        if (expectedResult == ExpectBoolean::Ignored) return;
+        ASSERT_EQ(status.getExceptionCode(),
+                  expectedResult == ExpectBoolean::True ? EX_NONE : EX_ILLEGAL_STATE);
+    }
+
+    std::shared_ptr<IOffload> mOffload;
+    std::shared_ptr<TetheringOffloadCallback> mTetheringOffloadCallback;
+};
+
+// The test class for tetheroffload before initialization.
+class TetheroffloadAidlPreInitTest : public TetheroffloadAidlTestBase {
+  public:
+    virtual void SetUp() override { getService(); }
+};
+
+// The main test class for tetheroffload AIDL HAL.
+class TetheroffloadAidlGeneralTest : public TetheroffloadAidlTestBase {
+  public:
+    virtual void SetUp() override {
+        getService();
+        initOffload(true);
+    }
+};
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when both FDs are empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFdsReturnsError) {
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(-1);
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(-1);
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when FD1 is empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFd1ReturnsError) {
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(-1);
+    unique_fd ufd2(netlinkSocket(kFd2Groups));
+    if (ufd2.get() < 0) {
+        FAIL() << "Unable to create conntrack sockets: " << strerror(errno);
+    }
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(ufd2.release());
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Passing invalid file descriptor to initOffload() should return an error.
+// Check that this occurs when FD2 is empty.
+TEST_P(TetheroffloadAidlPreInitTest, TestInitOffloadInvalidFd2ReturnsError) {
+    unique_fd ufd1(netlinkSocket(kFd1Groups));
+    if (ufd1.get() < 0) {
+        FAIL() << "Unable to create conntrack sockets: " << strerror(errno);
+    }
+    ndk::ScopedFileDescriptor fd1 = ndk::ScopedFileDescriptor(ufd1.release());
+    ndk::ScopedFileDescriptor fd2 = ndk::ScopedFileDescriptor(-1);
+    mTetheringOffloadCallback = ndk::SharedRefBase::make<TetheringOffloadCallback>();
+    ASSERT_NE(mTetheringOffloadCallback, nullptr) << "Could not get offload callback";
+    EXPECT_THAT(mOffload->initOffload(fd1, fd2, mTetheringOffloadCallback).getExceptionCode(),
+                AnyOf(Eq(EX_ILLEGAL_ARGUMENT), Eq(EX_TRANSACTION_FAILED)));
+}
+
+// Call initOffload() multiple times. Check that non-first initOffload() calls return error.
+TEST_P(TetheroffloadAidlPreInitTest, AdditionalInitsWithoutStopReturnError) {
+    initOffload(true);
+    initOffload(false);
+    initOffload(false);
+    initOffload(false);
+}
+
+// Check that calling stopOffload() without first having called initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, MultipleStopsWithoutInitReturnError) {
+    stopOffload(ExpectBoolean::False);
+    stopOffload(ExpectBoolean::False);
+    stopOffload(ExpectBoolean::False);
+}
+
+// Check that calling stopOffload() after a complete init/stop cycle returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AdditionalStopsWithInitReturnError) {
+    initOffload(true);
+    // Call setUpstreamParameters() so that "offload" can be reasonably said
+    // to be both requested and operational.
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.0.2");
+    const std::string v4Gw("192.0.0.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    auto ret = mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    if (!interfaceIsUp(TEST_IFACE)) {
+        return;
+    }
+    SCOPED_TRACE("Expecting stopOffload to succeed");
+    stopOffload(ExpectBoolean::True);  // balance out initOffload(true)
+    SCOPED_TRACE("Expecting stopOffload to fail the first time");
+    stopOffload(ExpectBoolean::False);
+    SCOPED_TRACE("Expecting stopOffload to fail the second time");
+    stopOffload(ExpectBoolean::False);
+}
+
+// Check that calling setLocalPrefixes() without first having called initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, SetLocalPrefixesWithoutInitReturnsError) {
+    const std::vector<std::string> prefixes{std::string("2001:db8::/64")};
+    EXPECT_EQ(EX_ILLEGAL_STATE, mOffload->setLocalPrefixes(prefixes).getExceptionCode());
+}
+
+// Check that calling getForwardedStats() without first having called initOffload()
+// returns zero bytes statistics.
+TEST_P(TetheroffloadAidlPreInitTest, GetForwardedStatsWithoutInitReturnsZeroValues) {
+    const std::string upstream(TEST_IFACE);
+    ForwardedStats stats;
+    auto ret = mOffload->getForwardedStats(upstream, &stats);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    EXPECT_EQ(0ULL, stats.rxBytes);
+    EXPECT_EQ(0ULL, stats.txBytes);
+}
+
+// Check that calling setDataWarningAndLimit() without first having called initOffload() returns
+// error.
+TEST_P(TetheroffloadAidlPreInitTest, SetDataWarningAndLimitWithoutInitReturnsError) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 5000LL;
+    const int64_t limit = 5000LL;
+    EXPECT_EQ(EX_ILLEGAL_STATE,
+              mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode());
+}
+
+// Check that calling setUpstreamParameters() without first having called initOffload()
+// returns error.
+TEST_P(TetheroffloadAidlPreInitTest, SetUpstreamParametersWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.0/24");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    EXPECT_EQ(EX_ILLEGAL_STATE,
+              mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+}
+
+// Check that calling addDownstream() with an IPv4 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AddIPv4DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("192.0.2.0/24");
+    EXPECT_EQ(EX_ILLEGAL_STATE, mOffload->addDownstream(iface, prefix).getExceptionCode());
+}
+
+// Check that calling addDownstream() with an IPv6 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, AddIPv6DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("2001:db8::/64");
+    EXPECT_EQ(EX_ILLEGAL_STATE, mOffload->addDownstream(iface, prefix).getExceptionCode());
+}
+
+// Check that calling removeDownstream() with an IPv4 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, RemoveIPv4DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("192.0.2.0/24");
+    EXPECT_EQ(EX_ILLEGAL_STATE, mOffload->removeDownstream(iface, prefix).getExceptionCode());
+}
+
+// Check that calling removeDownstream() with an IPv6 prefix without first having called
+// initOffload() returns error.
+TEST_P(TetheroffloadAidlPreInitTest, RemoveIPv6DownstreamWithoutInitReturnsError) {
+    const std::string iface(TEST_IFACE);
+    const std::string prefix("2001:db8::/64");
+    EXPECT_EQ(EX_ILLEGAL_STATE, mOffload->removeDownstream(iface, prefix).getExceptionCode());
+}
+
+/*
+ * Tests for IOffload::setLocalPrefixes().
+ */
+
+// Test setLocalPrefixes() rejects an IPv4 address.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv4AddressFails) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.1")};
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->setLocalPrefixes(prefixes).getExceptionCode());
+}
+
+// Test setLocalPrefixes() rejects an IPv6 address.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv6AddressFails) {
+    const std::vector<std::string> prefixes{std::string("fe80::1")};
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->setLocalPrefixes(prefixes).getExceptionCode());
+}
+
+// Test setLocalPrefixes() accepts both IPv4 and IPv6 prefixes.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesIPv4v6PrefixesOk) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.0/24"), std::string("fe80::/64")};
+    auto ret = mOffload->setLocalPrefixes(prefixes);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test that setLocalPrefixes() fails given empty input. There is always
+// a non-empty set of local prefixes; when all networking interfaces are down
+// we still apply {127.0.0.0/8, ::1/128, fe80::/64} here.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesEmptyFails) {
+    const std::vector<std::string> prefixes{};
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->setLocalPrefixes(prefixes).getExceptionCode());
+}
+
+// Test setLocalPrefixes() fails on incorrectly formed input strings.
+TEST_P(TetheroffloadAidlGeneralTest, SetLocalPrefixesInvalidFails) {
+    const std::vector<std::string> prefixes{std::string("192.0.2.0/24"), std::string("invalid")};
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->setLocalPrefixes(prefixes).getExceptionCode());
+}
+
+/*
+ * Tests for IOffload::getForwardedStats().
+ */
+
+// Test that getForwardedStats() for a non-existent upstream yields zero bytes statistics.
+TEST_P(TetheroffloadAidlGeneralTest, GetForwardedStatsInvalidUpstreamIface) {
+    const std::string upstream("invalid");
+    ForwardedStats stats;
+    auto ret = mOffload->getForwardedStats(upstream, &stats);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    EXPECT_EQ(0ULL, stats.rxBytes);
+    EXPECT_EQ(0ULL, stats.txBytes);
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, GetForwardedStatsDummyIface) {
+    const std::string upstream(TEST_IFACE);
+    ForwardedStats stats;
+    auto ret = mOffload->getForwardedStats(upstream, &stats);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    EXPECT_EQ(0ULL, stats.rxBytes);
+    EXPECT_EQ(0ULL, stats.txBytes);
+}
+
+/*
+ * Tests for IOffload::setDataWarningAndLimit().
+ */
+
+// Test that setDataWarningAndLimit() for an empty interface name fails.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitEmptyUpstreamIfaceFails) {
+    const std::string upstream("");
+    const int64_t warning = 12345LL;
+    const int64_t limit = 67890LL;
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+              mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode());
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitNonZeroOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 4000LL;
+    const int64_t limit = 5000LL;
+    auto ret = mOffload->setDataWarningAndLimit(upstream, warning, limit);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitZeroOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = 0LL;
+    const int64_t limit = 0LL;
+    auto ret = mOffload->setDataWarningAndLimit(upstream, warning, limit);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitUnlimitedWarningOk) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = LLONG_MAX;
+    const int64_t limit = 5000LL;
+    auto ret = mOffload->setDataWarningAndLimit(upstream, warning, limit);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test that setDataWarningAndLimit() with negative thresholds fails.
+TEST_P(TetheroffloadAidlGeneralTest, SetDataWarningAndLimitNegativeFails) {
+    const std::string upstream(TEST_IFACE);
+    const int64_t warning = -1LL;
+    const int64_t limit = -1LL;
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+              mOffload->setDataWarningAndLimit(upstream, warning, limit).getExceptionCode());
+}
+
+/*
+ * Tests for IOffload::setUpstreamParameters().
+ */
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv6OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    auto ret = mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersAlternateIPv6OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:3")};
+    auto ret = mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv4OnlyOk) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{};
+    auto ret = mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// TEST_IFACE is presumed to exist on the device and be up. No packets
+// are ever actually caused to be forwarded.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersIPv4v6Ok) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1"), std::string("fe80::db8:2")};
+    auto ret = mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test that setUpstreamParameters() fails when all parameters are empty.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersEmptyFails) {
+    const std::string iface("");
+    const std::string v4Addr("");
+    const std::string v4Gw("");
+    const std::vector<std::string> v6Gws{};
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+              mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+}
+
+// Test that setUpstreamParameters() fails when given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersBogusIfaceFails) {
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "upstream: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv4 addresses.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersInvalidIPv4AddrFails) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Gw("192.0.2.1");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"invalid", "192.0.2"}) {
+        SCOPED_TRACE(testing::Message() << "v4addr: " << bogus);
+        const std::string v4Addr(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv4 gateways.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersInvalidIPv4GatewayFails) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::vector<std::string> v6Gws{std::string("fe80::db8:1")};
+    for (const auto& bogus : {"invalid", "192.0.2"}) {
+        SCOPED_TRACE(testing::Message() << "v4gateway: " << bogus);
+        const std::string v4Gw(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+    }
+}
+
+// Test that setUpstreamParameters() fails when given unparseable IPv6 gateways.
+TEST_P(TetheroffloadAidlGeneralTest, SetUpstreamParametersBadIPv6GatewaysFail) {
+    const std::string iface(TEST_IFACE);
+    const std::string v4Addr("192.0.2.2");
+    const std::string v4Gw("192.0.2.1");
+    for (const auto& bogus : {"", "invalid", "fe80::bogus", "192.0.2.66"}) {
+        SCOPED_TRACE(testing::Message() << "v6gateway: " << bogus);
+        const std::vector<std::string> v6Gws{std::string("fe80::1"), std::string(bogus)};
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->setUpstreamParameters(iface, v4Addr, v4Gw, v6Gws).getExceptionCode());
+    }
+}
+
+/*
+ * Tests for IOffload::addDownstream().
+ */
+
+// Test addDownstream() works given an IPv4 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamIPv4) {
+    const std::string iface("dummy0");
+    const std::string prefix("192.0.2.0/24");
+    auto ret = mOffload->addDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test addDownstream() works given an IPv6 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamIPv6) {
+    const std::string iface("dummy0");
+    const std::string prefix("2001:db8::/64");
+    auto ret = mOffload->addDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test addDownstream() fails given all empty parameters.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamEmptyFails) {
+    const std::string iface("");
+    const std::string prefix("");
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->addDownstream(iface, prefix).getExceptionCode());
+}
+
+// Test addDownstream() fails given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamInvalidIfaceFails) {
+    const std::string prefix("192.0.2.0/24");
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "iface: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->addDownstream(iface, prefix).getExceptionCode());
+    }
+}
+
+// Test addDownstream() fails given unparseable prefix arguments.
+TEST_P(TetheroffloadAidlGeneralTest, AddDownstreamBogusPrefixFails) {
+    const std::string iface("dummy0");
+    for (const auto& bogus : {"", "192.0.2/24", "2001:db8/64"}) {
+        SCOPED_TRACE(testing::Message() << "prefix: " << bogus);
+        const std::string prefix(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->addDownstream(iface, prefix).getExceptionCode());
+    }
+}
+
+/*
+ * Tests for IOffload::removeDownstream().
+ */
+
+// Test removeDownstream() works given an IPv4 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamIPv4) {
+    const std::string iface("dummy0");
+    const std::string prefix("192.0.2.0/24");
+    // First add the downstream, otherwise removeDownstream logic can reasonably
+    // return error for downstreams not previously added.
+    auto ret = mOffload->addDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    ret = mOffload->removeDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test removeDownstream() works given an IPv6 prefix.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamIPv6) {
+    const std::string iface("dummy0");
+    const std::string prefix("2001:db8::/64");
+    // First add the downstream, otherwise removeDownstream logic can reasonably
+    // return error for downstreams not previously added.
+    auto ret = mOffload->addDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+    ret = mOffload->removeDownstream(iface, prefix);
+    EXPECT_TRUE(ret.isOk()) << ret;
+}
+
+// Test removeDownstream() fails given all empty parameters.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamEmptyFails) {
+    const std::string iface("");
+    const std::string prefix("");
+    EXPECT_EQ(EX_ILLEGAL_ARGUMENT, mOffload->removeDownstream(iface, prefix).getExceptionCode());
+}
+
+// Test removeDownstream() fails given empty or non-existent interface names.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamBogusIfaceFails) {
+    const std::string prefix("192.0.2.0/24");
+    for (const auto& bogus : {"", "invalid"}) {
+        SCOPED_TRACE(testing::Message() << "iface: " << bogus);
+        const std::string iface(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->removeDownstream(iface, prefix).getExceptionCode());
+    }
+}
+
+// Test removeDownstream() fails given unparseable prefix arguments.
+TEST_P(TetheroffloadAidlGeneralTest, RemoveDownstreamBogusPrefixFails) {
+    const std::string iface("dummy0");
+    for (const auto& bogus : {"", "192.0.2/24", "2001:db8/64"}) {
+        SCOPED_TRACE(testing::Message() << "prefix: " << bogus);
+        const std::string prefix(bogus);
+        EXPECT_EQ(EX_ILLEGAL_ARGUMENT,
+                  mOffload->removeDownstream(iface, prefix).getExceptionCode());
+    }
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlTestBase);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlTestBase,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlPreInitTest);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlPreInitTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(TetheroffloadAidlGeneralTest);
+INSTANTIATE_TEST_SUITE_P(
+        IOffload, TetheroffloadAidlGeneralTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IOffload::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+}  // namespace
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    return RUN_ALL_TESTS();
+}
+
+}  // namespace aidl::android::hardware::tetheroffload
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingDevice.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingDevice.aidl
index dfd8686..dff3c4c 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingDevice.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingDevice.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.thermal;
 /* @hide */
-@VintfStability
+@JavaDerive(toString=true) @VintfStability
 parcelable CoolingDevice {
   android.hardware.thermal.CoolingType type;
   String name;
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingType.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingType.aidl
index d2eb389..1f87cf2 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingType.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/CoolingType.aidl
@@ -35,15 +35,15 @@
 /* @hide */
 @Backing(type="int") @VintfStability
 enum CoolingType {
-  FAN = 0,
-  BATTERY = 1,
-  CPU = 2,
-  GPU = 3,
-  MODEM = 4,
-  NPU = 5,
-  COMPONENT = 6,
-  TPU = 7,
-  POWER_AMPLIFIER = 8,
-  DISPLAY = 9,
-  SPEAKER = 10,
+  FAN,
+  BATTERY,
+  CPU,
+  GPU,
+  MODEM,
+  NPU,
+  COMPONENT,
+  TPU,
+  POWER_AMPLIFIER,
+  DISPLAY,
+  SPEAKER,
 }
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/Temperature.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/Temperature.aidl
index 3bf08bf..ce70ab8 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/Temperature.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/Temperature.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.thermal;
 /* @hide */
-@VintfStability
+@JavaDerive(toString=true) @VintfStability
 parcelable Temperature {
   android.hardware.thermal.TemperatureType type;
   String name;
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureThreshold.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureThreshold.aidl
index c5ca4b9..a384d19 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureThreshold.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureThreshold.aidl
@@ -33,7 +33,7 @@
 
 package android.hardware.thermal;
 /* @hide */
-@VintfStability
+@JavaDerive(toString=true) @VintfStability
 parcelable TemperatureThreshold {
   android.hardware.thermal.TemperatureType type;
   String name;
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureType.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureType.aidl
index 0a9efdd..e9710a7 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureType.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/TemperatureType.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @Backing(type="int") @VintfStability
 enum TemperatureType {
-  UNKNOWN = -1,
+  UNKNOWN = (-1),
   CPU = 0,
   GPU = 1,
   BATTERY = 2,
diff --git a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/ThrottlingSeverity.aidl b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/ThrottlingSeverity.aidl
index 8fe3df6..183344d 100644
--- a/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/ThrottlingSeverity.aidl
+++ b/thermal/aidl/aidl_api/android.hardware.thermal/current/android/hardware/thermal/ThrottlingSeverity.aidl
@@ -36,10 +36,10 @@
 @Backing(type="int") @VintfStability
 enum ThrottlingSeverity {
   NONE = 0,
-  LIGHT = 1,
-  MODERATE = 2,
-  SEVERE = 3,
-  CRITICAL = 4,
-  EMERGENCY = 5,
-  SHUTDOWN = 6,
+  LIGHT,
+  MODERATE,
+  SEVERE,
+  CRITICAL,
+  EMERGENCY,
+  SHUTDOWN,
 }
diff --git a/thermal/aidl/android/hardware/thermal/CoolingDevice.aidl b/thermal/aidl/android/hardware/thermal/CoolingDevice.aidl
index 1f2360d..0c5c17d 100644
--- a/thermal/aidl/android/hardware/thermal/CoolingDevice.aidl
+++ b/thermal/aidl/android/hardware/thermal/CoolingDevice.aidl
@@ -20,6 +20,7 @@
 
 /* @hide */
 @VintfStability
+@JavaDerive(toString=true)
 parcelable CoolingDevice {
     /**
      * This cooling device type, CPU, GPU, BATTERY, and etc.
diff --git a/thermal/aidl/android/hardware/thermal/IThermal.aidl b/thermal/aidl/android/hardware/thermal/IThermal.aidl
index dd87b3a..c94edcd 100644
--- a/thermal/aidl/android/hardware/thermal/IThermal.aidl
+++ b/thermal/aidl/android/hardware/thermal/IThermal.aidl
@@ -36,9 +36,8 @@
      *    exist on boot. The method always returns and never removes from
      *    the list such cooling devices.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     CoolingDevice[] getCoolingDevices();
 
@@ -54,9 +53,8 @@
      *    exist on boot. The method always returns and never removes from
      *    the list such cooling devices.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     CoolingDevice[] getCoolingDevicesWithType(in CoolingType type);
 
@@ -70,9 +68,8 @@
      *    they go offline, if these devices exist on boot. The method
      *    always returns and never removes such temperatures.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     Temperature[] getTemperatures();
 
@@ -88,9 +85,8 @@
      *    they go offline, if these devices exist on boot. The method
      *    always returns and never removes such temperatures.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     Temperature[] getTemperaturesWithType(in TemperatureType type);
 
@@ -104,15 +100,14 @@
      *    they go offline, if these devices exist on boot. The method
      *    always returns and never removes such temperatures. The thresholds
      *    are returned as static values and must not change across calls. The actual
-     *    throttling state is determined in device thermal mitigation policy/agorithm
+     *    throttling state is determined in device thermal mitigation policy/algorithm
      *    which might not be simple thresholds so these values Thermal HAL provided
-     *    may not be accurate to detemin the throttling status. To get accurate
+     *    may not be accurate to determine the throttling status. To get accurate
      *    throttling status, use getTemperatures or registerThermalChangedCallback
      *    and listen to the callback.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     TemperatureThreshold[] getTemperatureThresholds();
 
@@ -129,15 +124,14 @@
      *    they go offline, if these devices exist on boot. The method
      *    always returns and never removes such temperatures. The thresholds
      *    are returned as static values and must not change across calls. The actual
-     *    throttling state is determined in device thermal mitigation policy/agorithm
+     *    throttling state is determined in device thermal mitigation policy/algorithm
      *    which might not be simple thresholds so these values Thermal HAL provided
-     *    may not be accurate to detemin the throttling status. To get accurate
+     *    may not be accurate to determine the throttling status. To get accurate
      *    throttling status, use getTemperatures or registerThermalChangedCallback
      *    and listen to the callback.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     TemperatureThreshold[] getTemperatureThresholdsWithType(in TemperatureType type);
 
@@ -152,12 +146,10 @@
      *    thermal events. if nullptr callback is given, the status code will be
      *    STATUS_BAD_VALUE and the operation will fail.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message. If callback is given nullptr, the returned status code
-     *    will be STATUS_BAD_VALUE and the exception will be EX_ILLEGAL_ARGUMENT.
-     *    if callback is already registered, the returned status code will be
-     *    STATUS_INVALID_OPERATION, the exception will be EX_ILLEGAL_ARGUMENT.
+     * @throws EX_ILLEGAL_ARGUMENT If the callback is given nullptr or already registered. And the
+     *         getMessage() must be populated with human-readable error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     void registerThermalChangedCallback(in IThermalChangedCallback callback);
 
@@ -174,12 +166,10 @@
      *    STATUS_BAD_VALUE and the operation will fail.
      * @param type the type to be filtered.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message. If callback is given nullptr, the returned status code
-     *    will be STATUS_BAD_VALUE and the exception will be EX_ILLEGAL_ARGUMENT.
-     *    if callback is already registered, the returned status code will be
-     *    STATUS_INVALID_OPERATION, the exception will be EX_ILLEGAL_ARGUMENT.
+     * @throws EX_ILLEGAL_ARGUMENT If the callback is given nullptr or already registered. And the
+     *         getMessage() must be populated with human-readable error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     void registerThermalChangedCallbackWithType(
             in IThermalChangedCallback callback, in TemperatureType type);
@@ -192,12 +182,10 @@
      *    thermal events. if nullptr callback is given, the status code will be
      *    STATUS_BAD_VALUE and the operation will fail.
      *
-     * @throws ScopedAStatus Status of the operation. If status code is not
-     *    STATUS_OK, the getMessage() must be populated with the human-readable
-     *    error message. If callback is given nullptr, the returned status code
-     *    will be STATUS_BAD_VALUE and the exception will be EX_ILLEGAL_ARGUMENT.
-     *    if callback is not registered, the returned status code will be
-     *    STATUS_INVALID_OPERATION, the exception will be EX_ILLEGAL_ARGUMENT.
+     * @throws EX_ILLEGAL_ARGUMENT If the callback is given nullptr or not previously registered.
+     *         And the getMessage() must be populated with human-readable error message.
+     * @throws EX_ILLEGAL_STATE If the Thermal HAL is not initialized successfully. And the
+     *         getMessage() must be populated with human-readable error message.
      */
     void unregisterThermalChangedCallback(in IThermalChangedCallback callback);
 }
diff --git a/thermal/aidl/android/hardware/thermal/Temperature.aidl b/thermal/aidl/android/hardware/thermal/Temperature.aidl
index 281d68d..b3f6700 100644
--- a/thermal/aidl/android/hardware/thermal/Temperature.aidl
+++ b/thermal/aidl/android/hardware/thermal/Temperature.aidl
@@ -21,6 +21,7 @@
 
 /* @hide */
 @VintfStability
+@JavaDerive(toString=true)
 parcelable Temperature {
     /**
      * This temperature's type.
diff --git a/thermal/aidl/android/hardware/thermal/TemperatureThreshold.aidl b/thermal/aidl/android/hardware/thermal/TemperatureThreshold.aidl
index 8065f76..94991ae 100644
--- a/thermal/aidl/android/hardware/thermal/TemperatureThreshold.aidl
+++ b/thermal/aidl/android/hardware/thermal/TemperatureThreshold.aidl
@@ -20,6 +20,7 @@
 
 /* @hide */
 @VintfStability
+@JavaDerive(toString=true)
 parcelable TemperatureThreshold {
     /**
      * This temperature's type.
@@ -36,7 +37,7 @@
      * level defined in ThrottlingSeverity including shutdown. Throttling
      * happens when temperature >= threshold. If not available, set to NAN.
      * Unit is same as Temperature's value.
-     * The number of thresholds must be the same as ThrottlingSeverity#len.
+     * The array size must be the same as ThrottlingSeverity's enum cardinality.
      */
     float[] hotThrottlingThresholds;
     /**
@@ -44,7 +45,7 @@
      * level defined in ThrottlingSeverity including shutdown. Throttling
      * happens when temperature <= threshold. If not available, set to NAN.
      * Unit is same as Temperature's value.
-     * The number of theresholds must be the same as ThrottlingSeverity#len.
+     * The array size must be the same as ThrottlingSeverity's enum cardinality.
      */
     float[] coldThrottlingThresholds;
 }
diff --git a/thermal/aidl/default/Thermal.cpp b/thermal/aidl/default/Thermal.cpp
index 5771e0e..f643d22 100644
--- a/thermal/aidl/default/Thermal.cpp
+++ b/thermal/aidl/default/Thermal.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "thermal_service_example"
+
 #include "Thermal.h"
 
 #include <android-base/logging.h>
@@ -22,6 +24,18 @@
 
 using ndk::ScopedAStatus;
 
+namespace {
+
+bool interfacesEqual(const std::shared_ptr<::ndk::ICInterface>& left,
+                     const std::shared_ptr<::ndk::ICInterface>& right) {
+    if (left == nullptr || right == nullptr || !left->isRemote() || !right->isRemote()) {
+        return left == right;
+    }
+    return left->asBinder() == right->asBinder();
+}
+
+}  // namespace
+
 ScopedAStatus Thermal::getCoolingDevices(std::vector<CoolingDevice>* /* out_devices */) {
     LOG(VERBOSE) << __func__;
     return ScopedAStatus::ok();
@@ -61,12 +75,20 @@
         const std::shared_ptr<IThermalChangedCallback>& in_callback) {
     LOG(VERBOSE) << __func__ << " IThermalChangedCallback: " << in_callback;
     if (in_callback == nullptr) {
-        return ScopedAStatus::fromStatus(STATUS_BAD_VALUE);
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid nullptr callback");
     }
-    if (mCallbacks.find(in_callback) != mCallbacks.end()) {
-        return ScopedAStatus::fromStatus(STATUS_INVALID_OPERATION);
+    {
+        std::lock_guard<std::mutex> _lock(thermal_callback_mutex_);
+        if (std::any_of(thermal_callbacks_.begin(), thermal_callbacks_.end(),
+                        [&](const std::shared_ptr<IThermalChangedCallback>& c) {
+                            return interfacesEqual(c, in_callback);
+                        })) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Callback already registered");
+        }
+        thermal_callbacks_.push_back(in_callback);
     }
-    mCallbacks.insert(in_callback);
     return ScopedAStatus::ok();
 }
 
@@ -75,26 +97,48 @@
     LOG(VERBOSE) << __func__ << " IThermalChangedCallback: " << in_callback
                  << ", TemperatureType: " << static_cast<int32_t>(in_type);
     if (in_callback == nullptr) {
-        return ScopedAStatus::fromStatus(STATUS_BAD_VALUE);
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid nullptr callback");
     }
-    if (mCallbacks.find(in_callback) != mCallbacks.end()) {
-        return ScopedAStatus::fromStatus(STATUS_INVALID_OPERATION);
+    {
+        std::lock_guard<std::mutex> _lock(thermal_callback_mutex_);
+        if (std::any_of(thermal_callbacks_.begin(), thermal_callbacks_.end(),
+                        [&](const std::shared_ptr<IThermalChangedCallback>& c) {
+                            return interfacesEqual(c, in_callback);
+                        })) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Callback already registered");
+        }
+        thermal_callbacks_.push_back(in_callback);
     }
-    mCallbacks.insert(in_callback);
     return ScopedAStatus::ok();
 }
 
 ScopedAStatus Thermal::unregisterThermalChangedCallback(
         const std::shared_ptr<IThermalChangedCallback>& in_callback) {
     LOG(VERBOSE) << __func__ << " IThermalChangedCallback: " << in_callback;
-    bool found = false;
     if (in_callback == nullptr) {
-        return ScopedAStatus::fromStatus(STATUS_BAD_VALUE);
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid nullptr callback");
     }
-    if (mCallbacks.find(in_callback) == mCallbacks.end()) {
-        return ScopedAStatus::fromStatus(STATUS_INVALID_OPERATION);
+    {
+        std::lock_guard<std::mutex> _lock(thermal_callback_mutex_);
+        bool removed = false;
+        thermal_callbacks_.erase(
+                std::remove_if(thermal_callbacks_.begin(), thermal_callbacks_.end(),
+                               [&](const std::shared_ptr<IThermalChangedCallback>& c) {
+                                   if (interfacesEqual(c, in_callback)) {
+                                       removed = true;
+                                       return true;
+                                   }
+                                   return false;
+                               }),
+                thermal_callbacks_.end());
+        if (!removed) {
+            return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                    "Callback wasn't registered");
+        }
     }
-    mCallbacks.erase(in_callback);
     return ScopedAStatus::ok();
 }
 
diff --git a/thermal/aidl/default/Thermal.h b/thermal/aidl/default/Thermal.h
index 788af4a..8885e63 100644
--- a/thermal/aidl/default/Thermal.h
+++ b/thermal/aidl/default/Thermal.h
@@ -54,7 +54,8 @@
             const std::shared_ptr<IThermalChangedCallback>& in_callback) override;
 
   private:
-    std::set<std::shared_ptr<IThermalChangedCallback>> mCallbacks;
+    std::mutex thermal_callback_mutex_;
+    std::vector<std::shared_ptr<IThermalChangedCallback>> thermal_callbacks_;
 };
 
 }  // namespace example
diff --git a/thermal/aidl/default/main.cpp b/thermal/aidl/default/main.cpp
index 61d8ad0..9f4ddb8 100644
--- a/thermal/aidl/default/main.cpp
+++ b/thermal/aidl/default/main.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "thermal_service_example"
+
 #include "Thermal.h"
 
 #include <android-base/logging.h>
diff --git a/thermal/aidl/vts/VtsHalThermalTargetTest.cpp b/thermal/aidl/vts/VtsHalThermalTargetTest.cpp
index b93250e..73c5dd2 100644
--- a/thermal/aidl/vts/VtsHalThermalTargetTest.cpp
+++ b/thermal/aidl/vts/VtsHalThermalTargetTest.cpp
@@ -95,21 +95,21 @@
 
         mThermalCallback = ndk::SharedRefBase::make<ThermalCallback>();
         ASSERT_NE(mThermalCallback, nullptr);
-        auto ret = mThermal->registerThermalChangedCallback(mThermalCallback);
-        ASSERT_TRUE(ret.isOk());
+        auto status = mThermal->registerThermalChangedCallback(mThermalCallback);
+        ASSERT_TRUE(status.isOk());
         // Expect to fail if register again
-        ret = mThermal->registerThermalChangedCallback(mThermalCallback);
-        ASSERT_FALSE(ret.isOk());
-        ASSERT_TRUE(ret.getStatus() == STATUS_INVALID_OPERATION);
+        status = mThermal->registerThermalChangedCallback(mThermalCallback);
+        ASSERT_FALSE(status.isOk());
+        ASSERT_EQ(EX_ILLEGAL_ARGUMENT, status.getExceptionCode());
     }
 
     void TearDown() override {
-        auto ret = mThermal->unregisterThermalChangedCallback(mThermalCallback);
-        ASSERT_TRUE(ret.isOk());
+        auto status = mThermal->unregisterThermalChangedCallback(mThermalCallback);
+        ASSERT_TRUE(status.isOk());
         // Expect to fail if unregister again
-        ret = mThermal->unregisterThermalChangedCallback(mThermalCallback);
-        ASSERT_FALSE(ret.isOk());
-        ASSERT_TRUE(ret.getStatus() == STATUS_INVALID_OPERATION);
+        status = mThermal->unregisterThermalChangedCallback(mThermalCallback);
+        ASSERT_FALSE(status.isOk());
+        ASSERT_EQ(EX_ILLEGAL_ARGUMENT, status.getExceptionCode());
     }
 
   protected:
diff --git a/tv/hdmi/aidl/vts/functional/VtsHalTvHdmiAidlTargetTest.cpp b/tv/hdmi/aidl/vts/functional/VtsHalTvHdmiAidlTargetTest.cpp
deleted file mode 100644
index fd4d94f..0000000
--- a/tv/hdmi/aidl/vts/functional/VtsHalTvHdmiAidlTargetTest.cpp
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "Hdmi_hal_test"
-
-#include <aidl/Gtest.h>
-#include <aidl/Vintf.h>
-#include <aidl/android/hardware/tv/hdmi/BnHdmi.h>
-#include <aidl/android/hardware/tv/hdmi/BnHdmiCallback.h>
-#include <android-base/logging.h>
-#include <android/binder_manager.h>
-#include <android/binder_process.h>
-#include <gtest/gtest.h>
-#include <log/log.h>
-#include <sstream>
-#include <vector>
-
-using ::aidl::android::hardware::tv::hdmi::BnHdmiCallback;
-using ::aidl::android::hardware::tv::hdmi::HdmiPortInfo;
-using ::aidl::android::hardware::tv::hdmi::HdmiPortType;
-using ::aidl::android::hardware::tv::hdmi::HpdSignal;
-using ::aidl::android::hardware::tv::hdmi::IHdmi;
-using ::aidl::android::hardware::tv::hdmi::IHdmiCallback;
-using ::ndk::SpAIBinder;
-
-#define INCORRECT_VENDOR_ID 0x00
-#define TV_PHYSICAL_ADDRESS 0x0000
-
-// The main test class for TV HDMI HAL.
-class HdmiTest : public ::testing::TestWithParam<std::string> {
-    static void serviceDied(void* /* cookie */) { ALOGE("VtsHalTvCecAidlTargetTest died"); }
-
-  public:
-    void SetUp() override {
-        hdmi = IHdmi::fromBinder(SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
-        ASSERT_NE(hdmi, nullptr);
-        ALOGI("%s: getService() for hdmi is %s", __func__, hdmi->isRemote() ? "remote" : "local");
-
-        hdmiCallback = ::ndk::SharedRefBase::make<HdmiCallback>();
-        ASSERT_NE(hdmiCallback, nullptr);
-        hdmiDeathRecipient =
-                ndk::ScopedAIBinder_DeathRecipient(AIBinder_DeathRecipient_new(&serviceDied));
-        ASSERT_EQ(AIBinder_linkToDeath(hdmi->asBinder().get(), hdmiDeathRecipient.get(), 0),
-                  STATUS_OK);
-    }
-
-    class HdmiCallback : public BnHdmiCallback {
-      public:
-        ::ndk::ScopedAStatus onHotplugEvent(bool connected __unused, int32_t portId __unused) {
-            return ::ndk::ScopedAStatus::ok();
-        };
-    };
-
-    std::shared_ptr<IHdmi> hdmi;
-    std::shared_ptr<IHdmiCallback> hdmiCallback;
-    ::ndk::ScopedAIBinder_DeathRecipient hdmiDeathRecipient;
-};
-
-GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(HdmiTest);
-INSTANTIATE_TEST_SUITE_P(PerInstance, HdmiTest,
-                         testing::ValuesIn(android::getAidlHalInstanceNames(IHdmi::descriptor)),
-                         android::PrintInstanceNameToString);
-
-TEST_P(HdmiTest, SetCallback) {
-    ASSERT_TRUE(hdmi->setCallback(::ndk::SharedRefBase::make<HdmiCallback>()).isOk());
-}
-
-TEST_P(HdmiTest, GetPortInfo) {
-    std::vector<HdmiPortInfo> ports;
-    ASSERT_TRUE(hdmi->getPortInfo(&ports).isOk());
-
-    bool cecSupportedOnDevice = false;
-    for (size_t i = 0; i < ports.size(); ++i) {
-        EXPECT_TRUE((ports[i].type == HdmiPortType::OUTPUT) ||
-                    (ports[i].type == HdmiPortType::INPUT));
-        if (ports[i].portId == 0) {
-            ALOGW("%s: Port id should start from 1", __func__);
-        }
-        cecSupportedOnDevice = cecSupportedOnDevice | ports[i].cecSupported;
-    }
-    EXPECT_NE(cecSupportedOnDevice, false) << "At least one port should support CEC";
-}
-
-TEST_P(HdmiTest, IsConnected) {
-    std::vector<HdmiPortInfo> ports;
-    ASSERT_TRUE(hdmi->getPortInfo(&ports).isOk());
-    for (size_t i = 0; i < ports.size(); ++i) {
-        bool connected;
-        ASSERT_TRUE(hdmi->isConnected(ports[i].portId, &connected).isOk());
-    }
-}
-
-TEST_P(HdmiTest, HdpSignal) {
-    HpdSignal originalSignal;
-    HpdSignal signal = HpdSignal::HDMI_HPD_STATUS_BIT;
-    HpdSignal readSignal;
-    ASSERT_TRUE(hdmi->getHpdSignal(&originalSignal).isOk());
-    ASSERT_TRUE(hdmi->setHpdSignal(signal).isOk());
-    ASSERT_TRUE(hdmi->getHpdSignal(&readSignal).isOk());
-    EXPECT_EQ(readSignal, signal);
-    signal = HpdSignal::HDMI_HPD_PHYSICAL;
-    ASSERT_TRUE(hdmi->setHpdSignal(signal).isOk());
-    ASSERT_TRUE(hdmi->getHpdSignal(&readSignal).isOk());
-    EXPECT_EQ(readSignal, signal);
-    ASSERT_TRUE(hdmi->setHpdSignal(originalSignal).isOk());
-}
diff --git a/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl b/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
index c8a10d1..1d2ef4a 100644
--- a/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
+++ b/tv/hdmi/connection/aidl/android/hardware/tv/hdmi/connection/HdmiPortInfo.aidl
@@ -24,7 +24,7 @@
 @VintfStability
 parcelable HdmiPortInfo {
     HdmiPortType type;
-    int portId; // Should start from 1 which corresponds to HDMI "port 1".
+    int portId; // Output ports should start from 1 which corresponds to HDMI "port 1".
     boolean cecSupported;
     boolean arcSupported;
     boolean eArcSupported;
diff --git a/tv/hdmi/earc/aidl/default/EArcMock.cpp b/tv/hdmi/earc/aidl/default/EArcMock.cpp
index 3578999..99a845e 100644
--- a/tv/hdmi/earc/aidl/default/EArcMock.cpp
+++ b/tv/hdmi/earc/aidl/default/EArcMock.cpp
@@ -85,7 +85,7 @@
     return ScopedAStatus::ok();
 }
 
-ScopedAStatus EArcMock::reportCapabilities(const std::vector<uint8_t> capabilities,
+ScopedAStatus EArcMock::reportCapabilities(const std::vector<uint8_t>& capabilities,
                                            int32_t portId) {
     if (mCallback != nullptr) {
         mCallback->onCapabilitiesReported(capabilities, portId);
diff --git a/tv/hdmi/earc/aidl/default/EArcMock.h b/tv/hdmi/earc/aidl/default/EArcMock.h
index fc4c828..8af9706 100644
--- a/tv/hdmi/earc/aidl/default/EArcMock.h
+++ b/tv/hdmi/earc/aidl/default/EArcMock.h
@@ -43,7 +43,7 @@
     ::ndk::ScopedAStatus getState(int32_t in_portId, IEArcStatus* _aidl_return) override;
     ::ndk::ScopedAStatus getLastReportedAudioCapabilities(
             int32_t in_portId, std::vector<uint8_t>* _aidl_return) override;
-    ::ndk::ScopedAStatus reportCapabilities(const std::vector<uint8_t> capabilities,
+    ::ndk::ScopedAStatus reportCapabilities(const std::vector<uint8_t>& capabilities,
                                             int32_t portId);
     ::ndk::ScopedAStatus changeState(const IEArcStatus status, int32_t portId);
 
diff --git a/usb/gadget/aidl/default/UsbGadget.cpp b/usb/gadget/aidl/default/UsbGadget.cpp
index 17e1da7..51f7f5b 100644
--- a/usb/gadget/aidl/default/UsbGadget.cpp
+++ b/usb/gadget/aidl/default/UsbGadget.cpp
@@ -91,6 +91,9 @@
 
 ScopedAStatus UsbGadget::getCurrentUsbFunctions(const shared_ptr<IUsbGadgetCallback>& callback,
                                                 int64_t in_transactionId) {
+    if (callback == nullptr) {
+        return ScopedAStatus::fromExceptionCode(EX_NULL_POINTER);
+    }
     ScopedAStatus ret = callback->getCurrentUsbFunctionsCb(
             mCurrentUsbFunctions,
             mCurrentUsbFunctionsApplied ? Status::FUNCTIONS_APPLIED : Status::FUNCTIONS_NOT_APPLIED,
@@ -146,7 +149,9 @@
 Status UsbGadget::setupFunctions(long functions, const shared_ptr<IUsbGadgetCallback>& callback,
                                  uint64_t timeout, int64_t in_transactionId) {
     bool ffsEnabled = false;
-    ALOGI("functions: %ld, timeout: %ld", functions, timeout);
+    if (timeout == 0) {
+        ALOGI("timeout not setup");
+    }
 
     if ((functions & GadgetFunction::ADB) != 0) {
         ffsEnabled = true;
@@ -190,16 +195,15 @@
     return Status::ERROR;
 }
 
-ScopedAStatus UsbGadget::setCurrentUsbFunctions(long functions,
+ScopedAStatus UsbGadget::setCurrentUsbFunctions(int64_t functions,
                                                 const shared_ptr<IUsbGadgetCallback>& callback,
-                                                int64_t timeout, int64_t in_transactionId) {
+                                                int64_t timeoutMs, int64_t in_transactionId) {
     std::unique_lock<std::mutex> lk(mLockSetCurrentFunction);
     std::string current_usb_power_operation_mode, current_usb_type;
     std::string usb_limit_sink_enable;
 
     string accessoryCurrentLimitEnablePath, accessoryCurrentLimitPath, path;
 
-    ALOGI("enter setCurrentUsbFunctions, in_transactionId=%ld , %ld", in_transactionId, timeout);
     mCurrentUsbFunctions = functions;
     mCurrentUsbFunctionsApplied = false;
 
@@ -232,7 +236,7 @@
                 -1, "Error while calling setCurrentUsbFunctionsCb");
     }
 
-    status = setupFunctions(functions, callback, timeout, in_transactionId);
+    status = setupFunctions(functions, callback, timeoutMs, in_transactionId);
     if (status != Status::SUCCESS) {
         goto error;
     }
diff --git a/usb/gadget/aidl/default/UsbGadget.h b/usb/gadget/aidl/default/UsbGadget.h
index 4060021..5060194 100644
--- a/usb/gadget/aidl/default/UsbGadget.h
+++ b/usb/gadget/aidl/default/UsbGadget.h
@@ -89,9 +89,9 @@
     bool mCurrentUsbFunctionsApplied;
     UsbSpeed mUsbSpeed;
 
-    ScopedAStatus setCurrentUsbFunctions(long functions,
+    ScopedAStatus setCurrentUsbFunctions(int64_t functions,
                                          const shared_ptr<IUsbGadgetCallback>& callback,
-                                         int64_t timeout, int64_t in_transactionId) override;
+                                         int64_t timeoutMs, int64_t in_transactionId) override;
 
     ScopedAStatus getCurrentUsbFunctions(const shared_ptr<IUsbGadgetCallback>& callback,
                                          int64_t in_transactionId) override;
diff --git a/usb/gadget/aidl/default/service_gadget.cpp b/usb/gadget/aidl/default/service_gadget.cpp
index 18d268d..88678ab 100644
--- a/usb/gadget/aidl/default/service_gadget.cpp
+++ b/usb/gadget/aidl/default/service_gadget.cpp
@@ -17,11 +17,6 @@
 #include <android/binder_manager.h>
 #include <android/binder_process.h>
 #include "UsbGadget.h"
-/*using android::OK;
-using android::hardware::configureRpcThreadpool;
-using android::hardware::joinRpcThreadpool;
-using android::sp;
-using android::status_t;*/
 using ::aidl::android::hardware::usb::gadget::UsbGadget;
 int main() {
     ABinderProcess_setThreadPoolMaxThreadCount(0);
diff --git a/uwb/aidl/Android.bp b/uwb/aidl/Android.bp
index 7dc2b7f..c537322 100755
--- a/uwb/aidl/Android.bp
+++ b/uwb/aidl/Android.bp
@@ -18,7 +18,11 @@
     backend: {
         java: {
             sdk_version: "module_Tiramisu",
-            enabled: false,
+            enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.uwb",
+            ],
         },
         ndk: {
             apex_available: [
diff --git a/wifi/apex/Android.bp b/wifi/apex/Android.bp
index 0afb96b..45f17a6 100644
--- a/wifi/apex/Android.bp
+++ b/wifi/apex/Android.bp
@@ -30,6 +30,7 @@
     name: "com.android.hardware.wifi.xml",
     src: ":default-android.hardware.wifi@1.0-service.xml",
     installable: false,
+    sub_dir: "vintf",
 }
 
 apex {
@@ -38,7 +39,6 @@
     key: "com.android.hardware.wifi.key",
     certificate: ":com.android.hardware.wifi.certificate",
     file_contexts: "file_contexts",
-    vintf_fragments: [":com.android.hardware.wifi.xml"],
     use_vndk_as_stable: true,
     updatable: false,
     soc_specific: true,
diff --git a/wifi/apex/file_contexts b/wifi/apex/file_contexts
index 812d51d..04e8a62 100644
--- a/wifi/apex/file_contexts
+++ b/wifi/apex/file_contexts
@@ -1,3 +1,3 @@
-(/.*)? 								u:object_r:vendor_file:s0
-/bin/hw/android\.hardware\.wifi@1.0-service			u:object_r:hal_wifi_default_exec:s0
-
+(/.*)?                                          u:object_r:vendor_file:s0
+/etc(/.*)?                                      u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.wifi@1.0-service     u:object_r:hal_wifi_default_exec:s0