diff --git a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
index b5de262..393d3ec 100644
--- a/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
+++ b/automotive/vehicle/2.0/default/common/src/VehicleHalManager.cpp
@@ -218,7 +218,7 @@
     const auto& clients =
         mSubscriptionManager.getSubscribedClients(property, SubscribeFlags::EVENTS_FROM_CAR);
 
-    for (auto client : clients) {
+    for (const auto& client : clients) {
         client->getCallback()->onPropertySetError(errorCode, property, areaId);
     }
 }
@@ -312,7 +312,7 @@
 void VehicleHalManager::handlePropertySetEvent(const VehiclePropValue& value) {
     auto clients =
         mSubscriptionManager.getSubscribedClients(value.prop, SubscribeFlags::EVENTS_FROM_ANDROID);
-    for (auto client : clients) {
+    for (const auto& client : clients) {
         client->getCallback()->onPropertySet(value);
     }
 }
diff --git a/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp b/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
index ab2013d..23ab6bc 100644
--- a/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
+++ b/automotive/vehicle/2.0/default/tests/SubscriptionManager_test.cpp
@@ -66,7 +66,7 @@
     static std::list<sp<IVehicleCallback>> extractCallbacks(
             const std::list<sp<HalClient>>& clients) {
         std::list<sp<IVehicleCallback>> callbacks;
-        for (auto c : clients) {
+        for (const auto& c : clients) {
             callbacks.push_back(c->getCallback());
         }
         return callbacks;
diff --git a/camera/device/3.2/ICameraDeviceSession.hal b/camera/device/3.2/ICameraDeviceSession.hal
index 477a3cc..e62dc07 100644
--- a/camera/device/3.2/ICameraDeviceSession.hal
+++ b/camera/device/3.2/ICameraDeviceSession.hal
@@ -91,11 +91,11 @@
      * later configureStreams() call by the framework, and all the gralloc
      * buffers for it must be freed after the configureStreams() call returns.
      *
-     * If the stream is new, the maxBuffer field of the stream structure must be
-     * set to 0. The usage must be set to the consumer usage flags. The HAL
-     * device must set these fields in the configureStreams() return values.
-     * These fields are then used by the framework and the platform gralloc
-     * module to allocate the gralloc buffers for each stream.
+     * If the stream is new, the client must set the consumer usage flags in
+     * requestedConfiguration. Upon return, the HAL device must set producerUsage,
+     * maxBuffers, and other fields in the configureStreams() return values. These
+     * fields are then used by the framework and the platform gralloc module to
+     * allocate the gralloc buffers for each stream.
      *
      * Newly allocated buffers may be included in a capture request at any time
      * by the framework. Once a gralloc buffer is returned to the framework
diff --git a/camera/device/3.2/default/CameraDevice.cpp b/camera/device/3.2/default/CameraDevice.cpp
index dfbb976..297e778 100644
--- a/camera/device/3.2/default/CameraDevice.cpp
+++ b/camera/device/3.2/default/CameraDevice.cpp
@@ -262,7 +262,7 @@
             session->getInterface()->interfaceChain([](
                 ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
                     ALOGV("Session interface chain:");
-                    for (auto iface : interfaceChain) {
+                    for (const auto& iface : interfaceChain) {
                         ALOGV("  %s", iface.c_str());
                     }
                 });
diff --git a/camera/device/3.3/default/CameraDevice.cpp b/camera/device/3.3/default/CameraDevice.cpp
index ce5e1de..b4d279e 100644
--- a/camera/device/3.3/default/CameraDevice.cpp
+++ b/camera/device/3.3/default/CameraDevice.cpp
@@ -49,7 +49,7 @@
         session->getInterface()->interfaceChain([](
             ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
                 ALOGV("Session interface chain:");
-                for (auto iface : interfaceChain) {
+                for (const auto& iface : interfaceChain) {
                     ALOGV("  %s", iface.c_str());
                 }
             });
diff --git a/camera/device/3.4/default/CameraDevice.cpp b/camera/device/3.4/default/CameraDevice.cpp
index d73833a..bc443de 100644
--- a/camera/device/3.4/default/CameraDevice.cpp
+++ b/camera/device/3.4/default/CameraDevice.cpp
@@ -49,7 +49,7 @@
         session->getInterface()->interfaceChain([](
             ::android::hardware::hidl_vec<::android::hardware::hidl_string> interfaceChain) {
                 ALOGV("Session interface chain:");
-                for (auto iface : interfaceChain) {
+                for (const auto& iface : interfaceChain) {
                     ALOGV("  %s", iface.c_str());
                 }
             });
diff --git a/contexthub/1.0/vts/functional/VtsHalContexthubV1_0TargetTest.cpp b/contexthub/1.0/vts/functional/VtsHalContexthubV1_0TargetTest.cpp
index 7492152..629477a 100644
--- a/contexthub/1.0/vts/functional/VtsHalContexthubV1_0TargetTest.cpp
+++ b/contexthub/1.0/vts/functional/VtsHalContexthubV1_0TargetTest.cpp
@@ -83,7 +83,7 @@
     sp<IContexthub> hubApi = ::testing::VtsHalHidlTargetTestBase::getService<IContexthub>();
 
     if (hubApi != nullptr) {
-      for (ContextHub hub : getHubsSync(hubApi)) {
+      for (const ContextHub& hub : getHubsSync(hubApi)) {
         hubIds.push_back(hub.hubId);
       }
     }
@@ -206,7 +206,7 @@
   hidl_vec<ContextHub> hubs = getHubsSync(hubApi);
   ALOGD("System reports %zu hubs", hubs.size());
 
-  for (ContextHub hub : hubs) {
+  for (const ContextHub& hub : hubs) {
     ALOGD("Checking hub ID %" PRIu32, hub.hubId);
 
     EXPECT_FALSE(hub.name.empty());
diff --git a/current.txt b/current.txt
index f0082a3..2e57feb 100644
--- a/current.txt
+++ b/current.txt
@@ -385,6 +385,7 @@
 10ff2fae516346b86121368ce5790d5accdfcb73983246b813f3d488b66db45a android.hardware.wifi.supplicant@1.1::ISupplicantStaNetwork
 
 # ABI preserving changes to HALs during Android Q
+f72d23278af99a2f6a9c1d40352b67dbf1f582282f799f88f7235dc7c13892b5 android.hardware.camera.device@3.2::ICameraDeviceSession
 da33234403ff5d60f3473711917b9948e6484a4260b5247acdafb111193a9de2 android.hardware.configstore@1.0::ISurfaceFlingerConfigs
 21165b8e30c4b2d52980e4728f661420adc16e38bbe73476c06b2085be908f4c android.hardware.gnss@1.0::IGnssCallback
 d702fb01dc2a0733aa820b7eb65435ee3334f75632ef880bafd2fb8803a20a58 android.hardware.gnss@1.0::IGnssMeasurementCallback
diff --git a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
index d03b2af..20a2ca4 100644
--- a/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
+++ b/drm/1.0/vts/functional/drm_hal_vendor_test.cpp
@@ -177,7 +177,7 @@
 TEST_P(DrmHalVendorFactoryTest, ValidateConfigurations) {
     const char* kVendorStr = "Vendor module ";
     size_t count = 0;
-    for (auto config : contentConfigurations) {
+    for (const auto& config : contentConfigurations) {
         ASSERT_TRUE(config.name.size() > 0) << kVendorStr << "has no name";
         ASSERT_TRUE(config.serverUrl.size() > 0) << kVendorStr
                                                  << "has no serverUrl";
@@ -186,7 +186,7 @@
         ASSERT_TRUE(config.mimeType.size() > 0) << kVendorStr
                                                 << "has no mime type";
         ASSERT_TRUE(config.keys.size() >= 1) << kVendorStr << "has no keys";
-        for (auto key : config.keys) {
+        for (const auto& key : config.keys) {
             ASSERT_TRUE(key.keyId.size() > 0) << kVendorStr
                                               << " has zero length keyId";
             ASSERT_TRUE(key.keyId.size() > 0) << kVendorStr
@@ -245,7 +245,7 @@
  */
 TEST_P(DrmHalVendorFactoryTest, ValidContentTypeSupported) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
+    for (const auto& config : contentConfigurations) {
         EXPECT_TRUE(drmFactory->isContentTypeSupported(config.mimeType));
     }
 }
@@ -610,7 +610,7 @@
  */
 TEST_P(DrmHalVendorPluginTest, RestoreKeys) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
+    for (const auto& config : contentConfigurations) {
         if (config.policy.allowOffline) {
             auto sessionId = openSession();
             hidl_vec<uint8_t> keySetId =
@@ -645,7 +645,7 @@
  */
 TEST_P(DrmHalVendorPluginTest, RestoreKeysClosedSession) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
+    for (const auto& config : contentConfigurations) {
         if (config.policy.allowOffline) {
             auto sessionId = openSession();
             hidl_vec<uint8_t> keySetId =
@@ -1022,8 +1022,8 @@
  */
 TEST_P(DrmHalVendorPluginTest, RequiresSecureDecoderConfig) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
-        for (auto key : config.keys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
             if (key.isSecure) {
                 EXPECT_TRUE(cryptoPlugin->requiresSecureDecoderComponent(config.mimeType));
                 break;
@@ -1471,7 +1471,7 @@
  */
 TEST_P(DrmHalVendorDecryptTest, QueryKeyStatus) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
+    for (const auto& config : contentConfigurations) {
         auto sessionId = openSession();
         loadKeys(sessionId, config);
         auto keyStatus = queryKeyStatus(sessionId);
@@ -1485,8 +1485,8 @@
  */
 TEST_P(DrmHalVendorDecryptTest, ClearSegmentTest) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
-        for (auto key : config.keys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
             const size_t kSegmentSize = 1024;
             vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
             const Pattern noPattern = {0, 0};
@@ -1513,8 +1513,8 @@
  */
 TEST_P(DrmHalVendorDecryptTest, EncryptedAesCtrSegmentTest) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
-        for (auto key : config.keys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
             const size_t kSegmentSize = 1024;
             vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
             const Pattern noPattern = {0, 0};
@@ -1540,8 +1540,8 @@
  */
 TEST_P(DrmHalVendorDecryptTest, EncryptedAesCtrSegmentTestNoKeys) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
-        for (auto key : config.keys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
             vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
             const Pattern noPattern = {0, 0};
             const vector<SubSample> subSamples = {{.numBytesOfClearData = 256,
@@ -1567,8 +1567,8 @@
  */
 TEST_P(DrmHalVendorDecryptTest, AttemptDecryptWithKeysRemoved) {
     RETURN_IF_SKIPPED;
-    for (auto config : contentConfigurations) {
-        for (auto key : config.keys) {
+    for (const auto& config : contentConfigurations) {
+        for (const auto& key : config.keys) {
             vector<uint8_t> iv(AES_BLOCK_SIZE, 0);
             const Pattern noPattern = {0, 0};
             const vector<SubSample> subSamples = {{.numBytesOfClearData = 256,
diff --git a/drm/1.1/vts/functional/drm_hal_clearkey_test.cpp b/drm/1.1/vts/functional/drm_hal_clearkey_test.cpp
index 1246616..7dedd7f 100644
--- a/drm/1.1/vts/functional/drm_hal_clearkey_test.cpp
+++ b/drm/1.1/vts/functional/drm_hal_clearkey_test.cpp
@@ -228,13 +228,13 @@
                                       const std::string& componentName, const VT& componentValue) {
      bool validAttribute = false;
      bool validComponent = false;
-     for (DrmMetricGroup::Attribute attribute : metric.attributes) {
+     for (const DrmMetricGroup::Attribute& attribute : metric.attributes) {
          if (attribute.name == attributeName &&
              ValueEquals(attribute.type, attributeValue, attribute)) {
              validAttribute = true;
          }
      }
-     for (DrmMetricGroup::Value value : metric.values) {
+     for (const DrmMetricGroup::Value& value : metric.values) {
          if (value.componentName == componentName &&
              ValueEquals(value.type, componentValue, value)) {
              validComponent = true;
diff --git a/graphics/composer/2.1/utils/vts/ComposerVts.cpp b/graphics/composer/2.1/utils/vts/ComposerVts.cpp
index 2f531b4..6e668af 100644
--- a/graphics/composer/2.1/utils/vts/ComposerVts.cpp
+++ b/graphics/composer/2.1/utils/vts/ComposerVts.cpp
@@ -78,9 +78,9 @@
 ComposerClient::ComposerClient(const sp<IComposerClient>& client) : mClient(client) {}
 
 ComposerClient::~ComposerClient() {
-    for (auto it : mDisplayResources) {
+    for (const auto& it : mDisplayResources) {
         Display display = it.first;
-        DisplayResource& resource = it.second;
+        const DisplayResource& resource = it.second;
 
         for (auto layer : resource.layers) {
             EXPECT_EQ(Error::NONE, mClient->destroyLayer(display, layer))
diff --git a/health/2.0/default/healthd_common.cpp b/health/2.0/default/healthd_common.cpp
index 8ff409d..b5fdc8e 100644
--- a/health/2.0/default/healthd_common.cpp
+++ b/health/2.0/default/healthd_common.cpp
@@ -67,8 +67,6 @@
 
 #define POWER_SUPPLY_SUBSYSTEM "power_supply"
 
-// epoll_create() parameter is actually unused
-#define MAX_EPOLL_EVENTS 40
 static int uevent_fd;
 static int wakealarm_fd;
 
@@ -240,9 +238,9 @@
 }
 
 static int healthd_init() {
-    epollfd = epoll_create(MAX_EPOLL_EVENTS);
+    epollfd = epoll_create1(EPOLL_CLOEXEC);
     if (epollfd == -1) {
-        KLOG_ERROR(LOG_TAG, "epoll_create failed; errno=%d\n", errno);
+        KLOG_ERROR(LOG_TAG, "epoll_create1 failed; errno=%d\n", errno);
         return -1;
     }