Mark android12L-tests-dev@8941410 as merged.

Change-Id: Iceb951d6a9d9fb37fead3068948f280e58b8ff4b
diff --git a/keystore2/aidl/Android.bp b/keystore2/aidl/Android.bp
index f1d77b9..438fa60 100644
--- a/keystore2/aidl/Android.bp
+++ b/keystore2/aidl/Android.bp
@@ -25,7 +25,6 @@
     backend: {
         java: {
             platform_apis: true,
-            srcs_available: true,
         },
         ndk: {
             vndk: {
@@ -35,7 +34,22 @@
         },
         rust: {
             enabled: true,
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.compos",
+            ],
         },
     },
-    versions: ["1"],
+    versions_with_info: [
+        {
+            version: "1",
+            imports: ["android.hardware.security.keymint-V1"],
+        },
+        {
+            version: "2",
+            imports: ["android.hardware.security.keymint-V2"],
+        },
+
+    ],
+
 }
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/.hash b/keystore2/aidl/aidl_api/android.system.keystore2/2/.hash
new file mode 100644
index 0000000..a445b37
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/.hash
@@ -0,0 +1 @@
+7e8ea78246ea548d1258bf24990c4d67beca2873
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/AuthenticatorSpec.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/AuthenticatorSpec.aidl
new file mode 100644
index 0000000..49a3b2c
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/AuthenticatorSpec.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable AuthenticatorSpec {
+  android.hardware.security.keymint.HardwareAuthenticatorType authenticatorType = android.hardware.security.keymint.HardwareAuthenticatorType.NONE;
+  long authenticatorId;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Authorization.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Authorization.aidl
new file mode 100644
index 0000000..3efeb68
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Authorization.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable Authorization {
+  android.hardware.security.keymint.SecurityLevel securityLevel = android.hardware.security.keymint.SecurityLevel.SOFTWARE;
+  android.hardware.security.keymint.KeyParameter keyParameter;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/CreateOperationResponse.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/CreateOperationResponse.aidl
new file mode 100644
index 0000000..e37facb
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/CreateOperationResponse.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable CreateOperationResponse {
+  android.system.keystore2.IKeystoreOperation iOperation;
+  @nullable android.system.keystore2.OperationChallenge operationChallenge;
+  @nullable android.system.keystore2.KeyParameters parameters;
+  @nullable byte[] upgradedBlob;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Domain.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Domain.aidl
new file mode 100644
index 0000000..4fd54aa
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/Domain.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum Domain {
+  APP = 0,
+  GRANT = 1,
+  SELINUX = 2,
+  BLOB = 3,
+  KEY_ID = 4,
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/EphemeralStorageKeyResponse.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/EphemeralStorageKeyResponse.aidl
new file mode 100644
index 0000000..963af7b
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/EphemeralStorageKeyResponse.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2021, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable EphemeralStorageKeyResponse {
+  byte[] ephemeralKey;
+  @nullable byte[] upgradedBlob;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreOperation.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreOperation.aidl
new file mode 100644
index 0000000..df911cd
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreOperation.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@SensitiveData @VintfStability
+interface IKeystoreOperation {
+  void updateAad(in byte[] aadInput);
+  @nullable byte[] update(in byte[] input);
+  @nullable byte[] finish(in @nullable byte[] input, in @nullable byte[] signature);
+  void abort();
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreSecurityLevel.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreSecurityLevel.aidl
new file mode 100644
index 0000000..a14ee85
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreSecurityLevel.aidl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@SensitiveData @VintfStability
+interface IKeystoreSecurityLevel {
+  android.system.keystore2.CreateOperationResponse createOperation(in android.system.keystore2.KeyDescriptor key, in android.hardware.security.keymint.KeyParameter[] operationParameters, in boolean forced);
+  android.system.keystore2.KeyMetadata generateKey(in android.system.keystore2.KeyDescriptor key, in @nullable android.system.keystore2.KeyDescriptor attestationKey, in android.hardware.security.keymint.KeyParameter[] params, in int flags, in byte[] entropy);
+  android.system.keystore2.KeyMetadata importKey(in android.system.keystore2.KeyDescriptor key, in @nullable android.system.keystore2.KeyDescriptor attestationKey, in android.hardware.security.keymint.KeyParameter[] params, in int flags, in byte[] keyData);
+  android.system.keystore2.KeyMetadata importWrappedKey(in android.system.keystore2.KeyDescriptor key, in android.system.keystore2.KeyDescriptor wrappingKey, in @nullable byte[] maskingKey, in android.hardware.security.keymint.KeyParameter[] params, in android.system.keystore2.AuthenticatorSpec[] authenticators);
+  android.system.keystore2.EphemeralStorageKeyResponse convertStorageKeyToEphemeral(in android.system.keystore2.KeyDescriptor storageKey);
+  void deleteKey(in android.system.keystore2.KeyDescriptor key);
+  const int KEY_FLAG_AUTH_BOUND_WITHOUT_CRYPTOGRAPHIC_LSKF_BINDING = 1;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreService.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreService.aidl
new file mode 100644
index 0000000..5ed5d37
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/IKeystoreService.aidl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+interface IKeystoreService {
+  android.system.keystore2.IKeystoreSecurityLevel getSecurityLevel(in android.hardware.security.keymint.SecurityLevel securityLevel);
+  android.system.keystore2.KeyEntryResponse getKeyEntry(in android.system.keystore2.KeyDescriptor key);
+  void updateSubcomponent(in android.system.keystore2.KeyDescriptor key, in @nullable byte[] publicCert, in @nullable byte[] certificateChain);
+  android.system.keystore2.KeyDescriptor[] listEntries(in android.system.keystore2.Domain domain, in long nspace);
+  void deleteKey(in android.system.keystore2.KeyDescriptor key);
+  android.system.keystore2.KeyDescriptor grant(in android.system.keystore2.KeyDescriptor key, in int granteeUid, in int accessVector);
+  void ungrant(in android.system.keystore2.KeyDescriptor key, in int granteeUid);
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyDescriptor.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyDescriptor.aidl
new file mode 100644
index 0000000..79478aa
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyDescriptor.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@RustDerive(Clone=true, Eq=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
+parcelable KeyDescriptor {
+  android.system.keystore2.Domain domain = android.system.keystore2.Domain.APP;
+  long nspace;
+  @nullable String alias;
+  @nullable byte[] blob;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyEntryResponse.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyEntryResponse.aidl
new file mode 100644
index 0000000..ea313b3
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyEntryResponse.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable KeyEntryResponse {
+  @nullable android.system.keystore2.IKeystoreSecurityLevel iSecurityLevel;
+  android.system.keystore2.KeyMetadata metadata;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyMetadata.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyMetadata.aidl
new file mode 100644
index 0000000..fef4531
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyMetadata.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable KeyMetadata {
+  android.system.keystore2.KeyDescriptor key;
+  android.hardware.security.keymint.SecurityLevel keySecurityLevel = android.hardware.security.keymint.SecurityLevel.SOFTWARE;
+  android.system.keystore2.Authorization[] authorizations;
+  @nullable byte[] certificate;
+  @nullable byte[] certificateChain;
+  long modificationTimeMs;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyParameters.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyParameters.aidl
new file mode 100644
index 0000000..f9c836a
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyParameters.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable KeyParameters {
+  android.hardware.security.keymint.KeyParameter[] keyParameter;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyPermission.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyPermission.aidl
new file mode 100644
index 0000000..d023e24
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/KeyPermission.aidl
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum KeyPermission {
+  NONE = 0,
+  DELETE = 1,
+  GEN_UNIQUE_ID = 2,
+  GET_INFO = 4,
+  GRANT = 8,
+  MANAGE_BLOB = 16,
+  REBIND = 32,
+  REQ_FORCED_OP = 64,
+  UPDATE = 128,
+  USE = 256,
+  USE_DEV_ID = 512,
+  USE_NO_LSKF_BINDING = 1024,
+  CONVERT_STORAGE_KEY_TO_EPHEMERAL = 2048,
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/OperationChallenge.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/OperationChallenge.aidl
new file mode 100644
index 0000000..0a079fb
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/OperationChallenge.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@VintfStability
+parcelable OperationChallenge {
+  long challenge;
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/ResponseCode.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/ResponseCode.aidl
new file mode 100644
index 0000000..bbeb5d2
--- /dev/null
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/2/android/system/keystore2/ResponseCode.aidl
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.keystore2;
+/* @hide */
+@Backing(type="int") @VintfStability
+enum ResponseCode {
+  LOCKED = 2,
+  UNINITIALIZED = 3,
+  SYSTEM_ERROR = 4,
+  PERMISSION_DENIED = 6,
+  KEY_NOT_FOUND = 7,
+  VALUE_CORRUPTED = 8,
+  KEY_PERMANENTLY_INVALIDATED = 17,
+  BACKEND_BUSY = 18,
+  OPERATION_BUSY = 19,
+  INVALID_ARGUMENT = 20,
+  TOO_MUCH_DATA = 21,
+  OUT_OF_KEYS = 22,
+}
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/AuthenticatorSpec.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/AuthenticatorSpec.aidl
index 61b45d7..49a3b2c 100644
--- a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/AuthenticatorSpec.aidl
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/AuthenticatorSpec.aidl
@@ -35,6 +35,6 @@
 /* @hide */
 @VintfStability
 parcelable AuthenticatorSpec {
-  android.hardware.security.keymint.HardwareAuthenticatorType authenticatorType;
+  android.hardware.security.keymint.HardwareAuthenticatorType authenticatorType = android.hardware.security.keymint.HardwareAuthenticatorType.NONE;
   long authenticatorId;
 }
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/Authorization.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/Authorization.aidl
index 0b8c919..3efeb68 100644
--- a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/Authorization.aidl
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/Authorization.aidl
@@ -35,6 +35,6 @@
 /* @hide */
 @VintfStability
 parcelable Authorization {
-  android.hardware.security.keymint.SecurityLevel securityLevel;
+  android.hardware.security.keymint.SecurityLevel securityLevel = android.hardware.security.keymint.SecurityLevel.SOFTWARE;
   android.hardware.security.keymint.KeyParameter keyParameter;
 }
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyDescriptor.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyDescriptor.aidl
index 895a927..79478aa 100644
--- a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyDescriptor.aidl
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyDescriptor.aidl
@@ -35,7 +35,7 @@
 /* @hide */
 @RustDerive(Clone=true, Eq=true, Ord=true, PartialEq=true, PartialOrd=true) @VintfStability
 parcelable KeyDescriptor {
-  android.system.keystore2.Domain domain;
+  android.system.keystore2.Domain domain = android.system.keystore2.Domain.APP;
   long nspace;
   @nullable String alias;
   @nullable byte[] blob;
diff --git a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyMetadata.aidl b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyMetadata.aidl
index 5c8df71..fef4531 100644
--- a/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyMetadata.aidl
+++ b/keystore2/aidl/aidl_api/android.system.keystore2/current/android/system/keystore2/KeyMetadata.aidl
@@ -36,7 +36,7 @@
 @VintfStability
 parcelable KeyMetadata {
   android.system.keystore2.KeyDescriptor key;
-  android.hardware.security.keymint.SecurityLevel keySecurityLevel;
+  android.hardware.security.keymint.SecurityLevel keySecurityLevel = android.hardware.security.keymint.SecurityLevel.SOFTWARE;
   android.system.keystore2.Authorization[] authorizations;
   @nullable byte[] certificate;
   @nullable byte[] certificateChain;
diff --git a/keystore2/aidl/android/system/keystore2/AuthenticatorSpec.aidl b/keystore2/aidl/android/system/keystore2/AuthenticatorSpec.aidl
index 05503b4..44cb062 100644
--- a/keystore2/aidl/android/system/keystore2/AuthenticatorSpec.aidl
+++ b/keystore2/aidl/android/system/keystore2/AuthenticatorSpec.aidl
@@ -29,7 +29,7 @@
     /**
      * The type of the authenticator in question.
      */
-    HardwareAuthenticatorType authenticatorType;
+    HardwareAuthenticatorType authenticatorType = HardwareAuthenticatorType.NONE;
     /**
      * The secure user id by which the given authenticator knows the
      * user that a key should be bound to.
diff --git a/keystore2/aidl/android/system/keystore2/Authorization.aidl b/keystore2/aidl/android/system/keystore2/Authorization.aidl
index aa98892..eb0e1ae 100644
--- a/keystore2/aidl/android/system/keystore2/Authorization.aidl
+++ b/keystore2/aidl/android/system/keystore2/Authorization.aidl
@@ -22,6 +22,6 @@
 /** @hide */
 @VintfStability
 parcelable Authorization {
-    SecurityLevel securityLevel;
+    SecurityLevel securityLevel = SecurityLevel.SOFTWARE;
     KeyParameter keyParameter;
 }
\ No newline at end of file
diff --git a/keystore2/aidl/android/system/keystore2/IKeystoreSecurityLevel.aidl b/keystore2/aidl/android/system/keystore2/IKeystoreSecurityLevel.aidl
index 3ee0c0c..7aa422a 100644
--- a/keystore2/aidl/android/system/keystore2/IKeystoreSecurityLevel.aidl
+++ b/keystore2/aidl/android/system/keystore2/IKeystoreSecurityLevel.aidl
@@ -101,9 +101,13 @@
      *                   of the caller.
      *            * SeLinux: The key is stored by the alias string in the namespace given by the
      *                       `nspace` field provided the caller has the appropriate access rights.
-     *            * Blob: The key is returned as raw keymint blob in the resultKey.blob field.
-     *                    The `nspace` and `alias` fields are ignored. The caller must have the
-     *                    `MANAGE_BLOB` permission for the keystore:keystore_key context.
+     *            * Blob: The key is returned as an opaque KeyMint blob in the KeyMetadata.key.blob
+     *                    field of the return value.
+     *                    The `alias` field is ignored. The caller must have the `MANAGE_BLOB`
+     *                    permission for the targeted `keystore2_key` context given by
+     *                    `nspace`. `nspace` is translated into the corresponding target context
+     *                    `<target_context>` and `<target_context>:keystore2_key manage_blob` is
+     *                    checked against the caller's context.
      *
      * @param attestationKey Optional key to be used for signing the attestation certificate.
      *
diff --git a/keystore2/aidl/android/system/keystore2/KeyDescriptor.aidl b/keystore2/aidl/android/system/keystore2/KeyDescriptor.aidl
index f7c5561..1f8d986 100644
--- a/keystore2/aidl/android/system/keystore2/KeyDescriptor.aidl
+++ b/keystore2/aidl/android/system/keystore2/KeyDescriptor.aidl
@@ -52,7 +52,7 @@
 @VintfStability
 @RustDerive(Clone=true, Eq=true, PartialEq=true, Ord=true, PartialOrd=true)
 parcelable KeyDescriptor {
-    Domain domain;
+    Domain domain = Domain.APP;
     long nspace; /* namespace is a keyword in C++, so we had a to pick a different field name. */
     /**
      * A free form string denoting the key, chosen by the client.
diff --git a/keystore2/aidl/android/system/keystore2/KeyMetadata.aidl b/keystore2/aidl/android/system/keystore2/KeyMetadata.aidl
index 829676f..df0aa3b 100644
--- a/keystore2/aidl/android/system/keystore2/KeyMetadata.aidl
+++ b/keystore2/aidl/android/system/keystore2/KeyMetadata.aidl
@@ -40,7 +40,7 @@
      * The security level that the key resides in.
      * TODO, we could also take this from the origin tag in authorizations.
      */
-    SecurityLevel keySecurityLevel;
+    SecurityLevel keySecurityLevel = SecurityLevel.SOFTWARE;
     /**
      * The authorizations describing the key, e.g., the algorithm, key size,
      * permissible purposes, digests and paddings, as well as usage restrictions,
diff --git a/suspend/1.0/default/Android.bp b/suspend/1.0/default/Android.bp
index e5c3b38..9bcbc3c 100644
--- a/suspend/1.0/default/Android.bp
+++ b/suspend/1.0/default/Android.bp
@@ -21,6 +21,7 @@
     shared_libs: [
         "libbase",
         "libbinder",
+        "libbinder_ndk",
         "libcutils",
         "libhidlbase",
         "liblog",
@@ -51,6 +52,7 @@
     init_rc: ["android.system.suspend@1.0-service.rc"],
     vintf_fragments: ["android.system.suspend@1.0-service.xml"],
     shared_libs: [
+        "android.system.suspend-V1-ndk",
         "android.system.suspend.control-V1-cpp",
         "android.system.suspend.control.internal-cpp",
         "android.system.suspend@1.0",
@@ -60,6 +62,8 @@
         "main.cpp",
         "SuspendControlService.cpp",
         "SystemSuspend.cpp",
+        "SystemSuspendHidl.cpp",
+        "SystemSuspendAidl.cpp",
         "WakeLockEntryList.cpp",
         "WakeupList.cpp",
     ],
@@ -74,15 +78,19 @@
         "system_suspend_stats_defaults",
     ],
     static_libs: [
+        "android.system.suspend-V1-ndk",
         "android.system.suspend.control-V1-cpp",
         "android.system.suspend.control.internal-cpp",
-        "android.system.suspend@1.0",
         "libgmock",
         "SuspendProperties",
     ],
+    tidy_timeout_srcs: [
+        "SystemSuspendUnitTest.cpp",
+    ],
     srcs: [
         "SuspendControlService.cpp",
         "SystemSuspend.cpp",
+        "SystemSuspendAidl.cpp",
         "SystemSuspendUnitTest.cpp",
         "WakeLockEntryList.cpp",
         "WakeupList.cpp",
@@ -92,7 +100,7 @@
 }
 
 cc_test {
-    name:"SystemSuspendV1_0AidlTest",
+    name: "SystemSuspendV1_0AidlTest",
     srcs: [
         "SystemSuspendAidlTest.cpp",
     ],
@@ -103,10 +111,23 @@
     static_libs: [
         "android.system.suspend.control-V1-cpp",
     ],
-    test_suites: ["device-tests", "vts"],
+    test_suites: [
+        "device-tests",
+        "vts",
+    ],
     require_root: true,
 }
 
+sh_test {
+    name: "SuspendSepolicyTests",
+    src: "SuspendSepolicyTests.sh",
+    test_suites: [
+        "device-tests",
+        "vts",
+    ],
+    test_config: "suspend-sepolicy-tests.xml",
+}
+
 cc_benchmark {
     name: "SystemSuspendBenchmark",
     defaults: [
@@ -115,7 +136,7 @@
     shared_libs: [
         "android.system.suspend.control-V1-cpp",
         "android.system.suspend.control.internal-cpp",
-        "android.system.suspend@1.0",
+        "android.system.suspend-V1-ndk",
     ],
     srcs: [
         "SystemSuspendBenchmark.cpp",
diff --git a/suspend/1.0/default/SuspendControlService.cpp b/suspend/1.0/default/SuspendControlService.cpp
index a993985..faadecb 100644
--- a/suspend/1.0/default/SuspendControlService.cpp
+++ b/suspend/1.0/default/SuspendControlService.cpp
@@ -151,9 +151,11 @@
     mSuspend = suspend;
 }
 
-binder::Status SuspendControlServiceInternal::enableAutosuspend(bool* _aidl_return) {
+binder::Status SuspendControlServiceInternal::enableAutosuspend(const sp<IBinder>& token,
+                                                                bool* _aidl_return) {
     const auto suspendService = mSuspend.promote();
-    return retOk(suspendService != nullptr && suspendService->enableAutosuspend(), _aidl_return);
+    return retOk(suspendService != nullptr && suspendService->enableAutosuspend(token),
+                 _aidl_return);
 }
 
 binder::Status SuspendControlServiceInternal::forceSuspend(bool* _aidl_return) {
diff --git a/suspend/1.0/default/SuspendControlService.h b/suspend/1.0/default/SuspendControlService.h
index 072b2e6..7d7e0ae 100644
--- a/suspend/1.0/default/SuspendControlService.h
+++ b/suspend/1.0/default/SuspendControlService.h
@@ -66,20 +66,17 @@
     }
 };
 
-class SuspendControlServiceInternal : public BnSuspendControlServiceInternal,
-                                      public virtual IBinder::DeathRecipient {
+class SuspendControlServiceInternal : public BnSuspendControlServiceInternal {
    public:
     SuspendControlServiceInternal() = default;
     ~SuspendControlServiceInternal() override = default;
 
-    binder::Status enableAutosuspend(bool* _aidl_return) override;
+    binder::Status enableAutosuspend(const sp<IBinder>& token, bool* _aidl_return) override;
     binder::Status forceSuspend(bool* _aidl_return) override;
     binder::Status getSuspendStats(SuspendInfo* _aidl_return) override;
     binder::Status getWakeLockStats(std::vector<WakeLockInfo>* _aidl_return) override;
     binder::Status getWakeupStats(std::vector<WakeupInfo>* _aidl_return) override;
 
-    void binderDied([[maybe_unused]] const wp<IBinder>& who) override {}
-
     void setSuspendService(const wp<SystemSuspend>& suspend);
     status_t dump(int fd, const Vector<String16>& args) override;
 
diff --git a/suspend/1.0/default/SuspendSepolicyTests.sh b/suspend/1.0/default/SuspendSepolicyTests.sh
new file mode 100755
index 0000000..b40f798
--- /dev/null
+++ b/suspend/1.0/default/SuspendSepolicyTests.sh
@@ -0,0 +1,104 @@
+#!/bin/bash
+
+# Copyright (C) 2021 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Check that sysfs wakeup nodes are correctly labeled by the
+# device's sepolicy.
+
+wakeup_attr="u:object_r:sysfs_wakeup:s0"
+wakeup_paths=()
+unlabeled_paths=()
+
+get_wakeup_paths() {
+    adb shell 'paths=()
+        wakeup_dir=/sys/class/wakeup
+        cd $wakeup_dir
+        for file in $wakeup_dir/*; do
+            paths+=( $(realpath $file) )
+        done
+        echo "${paths[@]}"'
+}
+
+has_wakeup_attr() { #path
+    adb shell ls -dZ "$1" | grep -q "$wakeup_attr"
+    return $?
+}
+
+check_wakeup_dup() { # wakeup_path
+    ret=1
+    for path in "${unlabeled_paths[@]}"; do
+        if [ "$path" == "$1" ]; then
+            ret=0
+            break
+        fi
+    done
+    return $ret
+}
+
+get_unlabeled_wakeup_paths() {
+    for path in ${wakeup_paths[@]}; do
+        # If there exists a common wakeup parent directory, label that instead
+        # of each wakeupN directory
+        wakeup_path="$path"
+        dir_path="$(dirname $path)"
+        [ "$(basename $dir_path)" == "wakeup" ] && wakeup_path="$dir_path"
+        has_wakeup_attr "$wakeup_path" || check_wakeup_dup $wakeup_path \
+            || unlabeled_paths+=( $wakeup_path )
+    done
+}
+
+print_missing_labels() {
+    nr_unlabeled="${#unlabeled_paths[@]}"
+
+    [ "$nr_unlabeled" == "0" ] && return 1
+
+    echo ""
+    echo "Unlabeled wakeup nodes found, your device is likely missing"
+    echo "device/oem specific selinux genfscon rules for suspend."
+    echo ""
+    echo "Please review and add the following generated rules to the"
+    echo "device specific genfs_contexts:"
+    echo ""
+
+    for path in ${unlabeled_paths[@]}; do
+        echo "genfscon sysfs ${path#/sys/} $wakeup_attr"
+    done
+
+    echo ""
+
+    return 0
+}
+
+fail() { #msg
+    echo $1
+    exit 1
+}
+
+pass() { #msg
+    echo $1
+    exit 0
+}
+
+# requirement added in T (33)
+vendor_api_level="$(adb shell getprop ro.vendor.api_level 33)"
+if [ "$vendor_api_level" -lt 33 ]; then
+    pass "Test skipped: vendor_api_level ($vendor_api_level) < min_api_level (33)"
+fi
+
+# Test unlabeled sysfs_wakeup nodes
+wakeup_paths+=( $(get_wakeup_paths) )
+get_unlabeled_wakeup_paths
+print_missing_labels && fail "Missing sysfs_wakeup labels" \
+    || pass "No missing sysfs_wakeup labels"
diff --git a/suspend/1.0/default/SystemSuspend.cpp b/suspend/1.0/default/SystemSuspend.cpp
index e9bb646..a0e08b4 100644
--- a/suspend/1.0/default/SystemSuspend.cpp
+++ b/suspend/1.0/default/SystemSuspend.cpp
@@ -16,23 +16,28 @@
 
 #include "SystemSuspend.h"
 
+#include <aidl/android/system/suspend/ISystemSuspend.h>
+#include <aidl/android/system/suspend/IWakeLock.h>
 #include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <android/binder_manager.h>
 #include <fcntl.h>
-#include <hidl/Status.h>
-#include <hwbinder/IPCThreadState.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
+#include <chrono>
 #include <string>
 #include <thread>
+using namespace std::chrono_literals;
 
+using ::aidl::android::system::suspend::ISystemSuspend;
+using ::aidl::android::system::suspend::IWakeLock;
+using ::aidl::android::system::suspend::WakeLockType;
 using ::android::base::Error;
 using ::android::base::ReadFdToString;
 using ::android::base::WriteStringToFd;
-using ::android::hardware::Void;
 using ::std::string;
 
 namespace android {
@@ -62,10 +67,6 @@
     return string{buf, static_cast<size_t>(n)};
 }
 
-static inline int getCallingPid() {
-    return ::android::hardware::IPCThreadState::self()->getCallingPid();
-}
-
 static std::vector<std::string> readWakeupReasons(int fd) {
     std::vector<std::string> wakeupReasons;
     std::string reasonlines;
@@ -119,27 +120,6 @@
                 std::chrono::duration<double>(suspendTime))};
 }
 
-WakeLock::WakeLock(SystemSuspend* systemSuspend, const string& name, int pid)
-    : mReleased(), mSystemSuspend(systemSuspend), mName(name), mPid(pid) {
-    mSystemSuspend->incSuspendCounter(mName);
-}
-
-WakeLock::~WakeLock() {
-    releaseOnce();
-}
-
-Return<void> WakeLock::release() {
-    releaseOnce();
-    return Void();
-}
-
-void WakeLock::releaseOnce() {
-    std::call_once(mReleased, [this]() {
-        mSystemSuspend->decSuspendCounter(mName);
-        mSystemSuspend->updateWakeLockStatOnRelease(mName, mPid, getTimeNow());
-    });
-}
-
 SystemSuspend::SystemSuspend(unique_fd wakeupCountFd, unique_fd stateFd, unique_fd suspendStatsFd,
                              size_t maxStatsEntries, unique_fd kernelWakelockStatsFd,
                              unique_fd wakeupReasonsFd, unique_fd suspendTimeFd,
@@ -177,25 +157,69 @@
     }
 }
 
-bool SystemSuspend::enableAutosuspend() {
-    if (mAutosuspendEnabled.test_and_set()) {
+bool SystemSuspend::enableAutosuspend(const sp<IBinder>& token) {
+    auto autosuspendLock = std::lock_guard(mAutosuspendLock);
+
+    bool hasToken = std::find(mDisableAutosuspendTokens.begin(), mDisableAutosuspendTokens.end(),
+                              token) != mDisableAutosuspendTokens.end();
+
+    if (!hasToken) {
+        mDisableAutosuspendTokens.push_back(token);
+    }
+
+    if (mAutosuspendEnabled) {
         LOG(ERROR) << "Autosuspend already started.";
         return false;
     }
 
-    initAutosuspend();
+    mAutosuspendEnabled = true;
+    initAutosuspendLocked();
     return true;
 }
 
+void SystemSuspend::disableAutosuspendLocked() {
+    mDisableAutosuspendTokens.clear();
+    if (mAutosuspendEnabled) {
+        mAutosuspendEnabled = false;
+        mAutosuspendCondVar.notify_all();
+        LOG(INFO) << "automatic system suspend disabled";
+    }
+}
+
+void SystemSuspend::disableAutosuspend() {
+    auto autosuspendLock = std::lock_guard(mAutosuspendLock);
+    disableAutosuspendLocked();
+}
+
+bool SystemSuspend::hasAliveAutosuspendTokenLocked() {
+    mDisableAutosuspendTokens.erase(
+        std::remove_if(mDisableAutosuspendTokens.begin(), mDisableAutosuspendTokens.end(),
+                       [](const sp<IBinder>& token) { return token->pingBinder() != OK; }),
+        mDisableAutosuspendTokens.end());
+
+    return !mDisableAutosuspendTokens.empty();
+}
+
+SystemSuspend::~SystemSuspend(void) {
+    auto autosuspendLock = std::unique_lock(mAutosuspendLock);
+
+    // signal autosuspend thread to shut down
+    disableAutosuspendLocked();
+
+    // wait for autosuspend thread to exit
+    mAutosuspendCondVar.wait_for(autosuspendLock, 100ms,
+                                 [this] { return !mAutosuspendThreadCreated; });
+}
+
 bool SystemSuspend::forceSuspend() {
     //  We are forcing the system to suspend. This particular call ignores all
     //  existing wakelocks (full or partial). It does not cancel the wakelocks
     //  or reset mSuspendCounter, it just ignores them.  When the system
     //  returns from suspend, the wakelocks and SuspendCounter will not have
     //  changed.
-    auto counterLock = std::unique_lock(mCounterLock);
+    auto autosuspendLock = std::unique_lock(mAutosuspendLock);
     bool success = WriteStringToFd(kSleepState, mStateFd);
-    counterLock.unlock();
+    autosuspendLock.unlock();
 
     if (!success) {
         PLOG(VERBOSE) << "error writing to /sys/power/state for forceSuspend";
@@ -203,18 +227,8 @@
     return success;
 }
 
-Return<sp<IWakeLock>> SystemSuspend::acquireWakeLock(WakeLockType /* type */,
-                                                     const hidl_string& name) {
-    auto pid = getCallingPid();
-    auto timeNow = getTimeNow();
-    IWakeLock* wl = new WakeLock{this, name, pid};
-    mControlService->notifyWakelock(name, true);
-    mStatsList.updateOnAcquire(name, pid, timeNow);
-    return wl;
-}
-
 void SystemSuspend::incSuspendCounter(const string& name) {
-    auto l = std::lock_guard(mCounterLock);
+    auto l = std::lock_guard(mAutosuspendLock);
     if (mUseSuspendCounter) {
         mSuspendCounter++;
     } else {
@@ -225,10 +239,10 @@
 }
 
 void SystemSuspend::decSuspendCounter(const string& name) {
-    auto l = std::lock_guard(mCounterLock);
+    auto l = std::lock_guard(mAutosuspendLock);
     if (mUseSuspendCounter) {
         if (--mSuspendCounter == 0) {
-            mCounterCondVar.notify_one();
+            mAutosuspendCondVar.notify_one();
         }
     } else {
         if (!WriteStringToFd(name, mWakeUnlockFd)) {
@@ -248,50 +262,95 @@
     return tempFd;
 }
 
-void SystemSuspend::initAutosuspend() {
+void SystemSuspend::initAutosuspendLocked() {
+    if (mAutosuspendThreadCreated) {
+        LOG(INFO) << "Autosuspend thread already started.";
+        return;
+    }
+
     std::thread autosuspendThread([this] {
+        auto autosuspendLock = std::unique_lock(mAutosuspendLock);
+        bool shouldSleep = true;
+
         while (true) {
-            std::this_thread::sleep_for(mSleepTime);
-            lseek(mWakeupCountFd, 0, SEEK_SET);
-            const string wakeupCount = readFd(mWakeupCountFd);
+            if (!mAutosuspendEnabled) {
+                mAutosuspendThreadCreated = false;
+                return;
+            }
+            // If we got here by a failed write to /sys/power/wakeup_count; don't sleep
+            // since we didn't attempt to suspend on the last cycle of this loop.
+            if (shouldSleep) {
+                mAutosuspendCondVar.wait_for(autosuspendLock, mSleepTime,
+                                             [this] { return !mAutosuspendEnabled; });
+            }
+
+            if (!mAutosuspendEnabled) continue;
+
+            string wakeupCount;
+            {
+                autosuspendLock.unlock();
+
+                lseek(mWakeupCountFd, 0, SEEK_SET);
+                wakeupCount = readFd(mWakeupCountFd);
+
+                autosuspendLock.lock();
+            }
+
             if (wakeupCount.empty()) {
                 PLOG(ERROR) << "error reading from /sys/power/wakeup_count";
                 continue;
             }
 
-            auto counterLock = std::unique_lock(mCounterLock);
-            mCounterCondVar.wait(counterLock, [this] { return mSuspendCounter == 0; });
+            shouldSleep = false;
+
+            mAutosuspendCondVar.wait(
+                autosuspendLock, [this] { return mSuspendCounter == 0 || !mAutosuspendEnabled; });
             // The mutex is locked and *MUST* remain locked until we write to /sys/power/state.
             // Otherwise, a WakeLock might be acquired after we check mSuspendCounter and before we
             // write to /sys/power/state.
 
+            if (!mAutosuspendEnabled) continue;
+
+            if (!hasAliveAutosuspendTokenLocked()) {
+                disableAutosuspendLocked();
+                continue;
+            }
+
             if (!WriteStringToFd(wakeupCount, mWakeupCountFd)) {
                 PLOG(VERBOSE) << "error writing from /sys/power/wakeup_count";
                 continue;
             }
             bool success = WriteStringToFd(kSleepState, mStateFd);
-            counterLock.unlock();
+            shouldSleep = true;
 
-            if (!success) {
-                PLOG(VERBOSE) << "error writing to /sys/power/state";
+            {
+                autosuspendLock.unlock();
+
+                if (!success) {
+                    PLOG(VERBOSE) << "error writing to /sys/power/state";
+                }
+
+                struct SuspendTime suspendTime = readSuspendTime(mSuspendTimeFd);
+                updateSleepTime(success, suspendTime);
+
+                std::vector<std::string> wakeupReasons = readWakeupReasons(mWakeupReasonsFd);
+                if (wakeupReasons == std::vector<std::string>({kUnknownWakeup})) {
+                    LOG(INFO) << "Unknown/empty wakeup reason. Re-opening wakeup_reason file.";
+
+                    mWakeupReasonsFd =
+                        std::move(reopenFileUsingFd(mWakeupReasonsFd.get(), O_CLOEXEC | O_RDONLY));
+                }
+                mWakeupList.update(wakeupReasons);
+
+                mControlService->notifyWakeup(success, wakeupReasons);
+
+                // Take the lock before returning to the start of the loop
+                autosuspendLock.lock();
             }
-
-            struct SuspendTime suspendTime = readSuspendTime(mSuspendTimeFd);
-            updateSleepTime(success, suspendTime);
-
-            std::vector<std::string> wakeupReasons = readWakeupReasons(mWakeupReasonsFd);
-            if (wakeupReasons == std::vector<std::string>({kUnknownWakeup})) {
-                LOG(INFO) << "Unknown/empty wakeup reason. Re-opening wakeup_reason file.";
-
-                mWakeupReasonsFd =
-                    std::move(reopenFileUsingFd(mWakeupReasonsFd.get(), O_CLOEXEC | O_RDONLY));
-            }
-            mWakeupList.update(wakeupReasons);
-
-            mControlService->notifyWakeup(success, wakeupReasons);
         }
     });
     autosuspendThread.detach();
+    mAutosuspendThreadCreated = true;
     LOG(INFO) << "automatic system suspend enabled";
 }
 
@@ -364,10 +423,18 @@
     mNumConsecutiveBadSuspends++;
 }
 
-void SystemSuspend::updateWakeLockStatOnRelease(const std::string& name, int pid,
-                                                TimestampType timeNow) {
+void SystemSuspend::updateWakeLockStatOnAcquire(const std::string& name, int pid) {
+    // Update the stats first so that the stat time is right after
+    // suspend counter being incremented.
+    mStatsList.updateOnAcquire(name, pid);
+    mControlService->notifyWakelock(name, true);
+}
+
+void SystemSuspend::updateWakeLockStatOnRelease(const std::string& name, int pid) {
+    // Update the stats first so that the stat time is right after
+    // suspend counter being decremented.
+    mStatsList.updateOnRelease(name, pid);
     mControlService->notifyWakelock(name, false);
-    mStatsList.updateOnRelease(name, pid, timeNow);
 }
 
 const WakeLockEntryList& SystemSuspend::getStatsList() const {
@@ -403,9 +470,16 @@
 
     struct dirent* de;
 
-    // Grab a wakelock before reading suspend stats,
-    // to ensure a consistent snapshot.
-    sp<IWakeLock> suspendStatsLock = acquireWakeLock(WakeLockType::PARTIAL, "suspend_stats_lock");
+    // Grab a wakelock before reading suspend stats, to ensure a consistent snapshot.
+    const std::string suspendInstance = std::string() + ISystemSuspend::descriptor + "/default";
+    auto suspendService = ISystemSuspend::fromBinder(
+        ndk::SpAIBinder(AServiceManager_checkService(suspendInstance.c_str())));
+
+    std::shared_ptr<IWakeLock> wl = nullptr;
+    if (suspendService) {
+        auto status =
+            suspendService->acquireWakeLock(WakeLockType::PARTIAL, "suspend_stats_lock", &wl);
+    }
 
     while ((de = readdir(dp.get()))) {
         std::string statName(de->d_name);
diff --git a/suspend/1.0/default/SystemSuspend.h b/suspend/1.0/default/SystemSuspend.h
index b84b1c9..ddcee24 100644
--- a/suspend/1.0/default/SystemSuspend.h
+++ b/suspend/1.0/default/SystemSuspend.h
@@ -19,9 +19,8 @@
 
 #include <android-base/result.h>
 #include <android-base/unique_fd.h>
-#include <android/system/suspend/1.0/ISystemSuspend.h>
 #include <android/system/suspend/internal/SuspendInfo.h>
-#include <hidl/HidlTransportSupport.h>
+#include <utils/RefBase.h>
 
 #include <atomic>
 #include <condition_variable>
@@ -39,9 +38,6 @@
 
 using ::android::base::Result;
 using ::android::base::unique_fd;
-using ::android::hardware::hidl_string;
-using ::android::hardware::interfacesEqual;
-using ::android::hardware::Return;
 using ::android::system::suspend::internal::SuspendInfo;
 
 using namespace std::chrono_literals;
@@ -76,23 +72,7 @@
 
 std::string readFd(int fd);
 
-class WakeLock : public IWakeLock {
-   public:
-    WakeLock(SystemSuspend* systemSuspend, const std::string& name, int pid);
-    ~WakeLock();
-
-    Return<void> release();
-
-   private:
-    inline void releaseOnce();
-    std::once_flag mReleased;
-
-    SystemSuspend* mSystemSuspend;
-    std::string mName;
-    int mPid;
-};
-
-class SystemSuspend : public ISystemSuspend {
+class SystemSuspend : public RefBase {
    public:
     SystemSuspend(unique_fd wakeupCountFd, unique_fd stateFd, unique_fd suspendStatsFd,
                   size_t maxStatsEntries, unique_fd kernelWakelockStatsFd,
@@ -101,15 +81,16 @@
                   const sp<SuspendControlService>& controlService,
                   const sp<SuspendControlServiceInternal>& controlServiceInternal,
                   bool useSuspendCounter = true);
-    Return<sp<IWakeLock>> acquireWakeLock(WakeLockType type, const hidl_string& name) override;
     void incSuspendCounter(const std::string& name);
     void decSuspendCounter(const std::string& name);
-    bool enableAutosuspend();
+    bool enableAutosuspend(const sp<IBinder>& token);
+    void disableAutosuspend();
     bool forceSuspend();
 
     const WakeupList& getWakeupList() const;
     const WakeLockEntryList& getStatsList() const;
-    void updateWakeLockStatOnRelease(const std::string& name, int pid, TimestampType timeNow);
+    void updateWakeLockStatOnAcquire(const std::string& name, int pid);
+    void updateWakeLockStatOnRelease(const std::string& name, int pid);
     void updateStatsNow();
     Result<SuspendStats> getSuspendStats();
     void getSuspendInfo(SuspendInfo* info);
@@ -117,10 +98,13 @@
     unique_fd reopenFileUsingFd(const int fd, int permission);
 
    private:
-    void initAutosuspend();
+    ~SystemSuspend(void) override;
+    void initAutosuspendLocked();
+    void disableAutosuspendLocked();
+    bool hasAliveAutosuspendTokenLocked();
 
-    std::mutex mCounterLock;
-    std::condition_variable mCounterCondVar;
+    std::mutex mAutosuspendLock;
+    std::condition_variable mAutosuspendCondVar;
     uint32_t mSuspendCounter;
     unique_fd mWakeupCountFd;
     unique_fd mStateFd;
@@ -154,7 +138,9 @@
     unique_fd mWakeUnlockFd;
     unique_fd mWakeupReasonsFd;
 
-    std::atomic_flag mAutosuspendEnabled = ATOMIC_FLAG_INIT;
+    std::atomic<bool> mAutosuspendEnabled{false};
+    std::atomic<bool> mAutosuspendThreadCreated{false};
+    std::vector<sp<IBinder>> mDisableAutosuspendTokens;
 };
 
 }  // namespace V1_0
diff --git a/suspend/1.0/default/SystemSuspendAidl.cpp b/suspend/1.0/default/SystemSuspendAidl.cpp
new file mode 100644
index 0000000..f11932d
--- /dev/null
+++ b/suspend/1.0/default/SystemSuspendAidl.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SystemSuspendAidl.h"
+
+#include <binder/IPCThreadState.h>
+
+namespace aidl {
+namespace android {
+namespace system {
+namespace suspend {
+
+static inline int getCallingPid() {
+    return ::android::IPCThreadState::self()->getCallingPid();
+}
+
+WakeLock::WakeLock(SystemSuspend* systemSuspend, const std::string& name, int pid)
+    : mReleased(), mSystemSuspend(systemSuspend), mName(name), mPid(pid) {
+    mSystemSuspend->incSuspendCounter(mName);
+}
+
+WakeLock::~WakeLock() {
+    releaseOnce();
+}
+
+ndk::ScopedAStatus WakeLock::release() {
+    releaseOnce();
+    return ndk::ScopedAStatus::ok();
+}
+
+void WakeLock::releaseOnce() {
+    std::call_once(mReleased, [this]() {
+        mSystemSuspend->decSuspendCounter(mName);
+        mSystemSuspend->updateWakeLockStatOnRelease(mName, mPid);
+    });
+}
+
+SystemSuspendAidl::SystemSuspendAidl(SystemSuspend* systemSuspend)
+    : mSystemSuspend(systemSuspend) {}
+
+ndk::ScopedAStatus SystemSuspendAidl::acquireWakeLock(WakeLockType /* type */,
+                                                      const std::string& name,
+                                                      std::shared_ptr<IWakeLock>* _aidl_return) {
+    auto pid = getCallingPid();
+    if (_aidl_return == nullptr) {
+        return ndk::ScopedAStatus(AStatus_fromExceptionCode(EX_ILLEGAL_ARGUMENT));
+    }
+    *_aidl_return = ndk::SharedRefBase::make<WakeLock>(mSystemSuspend, name, pid);
+    mSystemSuspend->updateWakeLockStatOnAcquire(name, pid);
+    return ndk::ScopedAStatus::ok();
+}
+
+}  // namespace suspend
+}  // namespace system
+}  // namespace android
+}  // namespace aidl
diff --git a/suspend/1.0/default/SystemSuspendAidl.h b/suspend/1.0/default/SystemSuspendAidl.h
new file mode 100644
index 0000000..5a81a6e
--- /dev/null
+++ b/suspend/1.0/default/SystemSuspendAidl.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/system/suspend/BnSystemSuspend.h>
+#include <aidl/android/system/suspend/BnWakeLock.h>
+
+#include <string>
+
+#include "SystemSuspend.h"
+
+namespace aidl {
+namespace android {
+namespace system {
+namespace suspend {
+
+using ::android::system::suspend::V1_0::SystemSuspend;
+
+class WakeLock : public BnWakeLock {
+   public:
+    WakeLock(SystemSuspend* systemSuspend, const std::string& name, int pid);
+    ~WakeLock();
+
+    ndk::ScopedAStatus release() override;
+
+   private:
+    inline void releaseOnce();
+    std::once_flag mReleased;
+
+    SystemSuspend* mSystemSuspend;
+    std::string mName;
+    int mPid;
+};
+
+class SystemSuspendAidl : public BnSystemSuspend {
+   public:
+    SystemSuspendAidl(SystemSuspend* systemSuspend);
+    ndk::ScopedAStatus acquireWakeLock(WakeLockType type, const std::string& name,
+                                       std::shared_ptr<IWakeLock>* _aidl_return) override;
+
+   private:
+    SystemSuspend* mSystemSuspend;
+};
+
+}  // namespace suspend
+}  // namespace system
+}  // namespace android
+}  // namespace aidl
diff --git a/suspend/1.0/default/SystemSuspendBenchmark.cpp b/suspend/1.0/default/SystemSuspendBenchmark.cpp
index ab6162d..fca12a4 100644
--- a/suspend/1.0/default/SystemSuspendBenchmark.cpp
+++ b/suspend/1.0/default/SystemSuspendBenchmark.cpp
@@ -14,24 +14,30 @@
  * limitations under the License.
  */
 
-#include <android/system/suspend/1.0/ISystemSuspend.h>
+#include <aidl/android/system/suspend/ISystemSuspend.h>
+#include <aidl/android/system/suspend/IWakeLock.h>
+#include <android/binder_manager.h>
 #include <android/system/suspend/internal/ISuspendControlServiceInternal.h>
 #include <benchmark/benchmark.h>
 #include <binder/IServiceManager.h>
 
+using aidl::android::system::suspend::ISystemSuspend;
+using aidl::android::system::suspend::IWakeLock;
+using aidl::android::system::suspend::WakeLockType;
 using android::IBinder;
 using android::sp;
 using android::system::suspend::internal::ISuspendControlServiceInternal;
 using android::system::suspend::internal::WakeLockInfo;
-using android::system::suspend::V1_0::ISystemSuspend;
-using android::system::suspend::V1_0::IWakeLock;
-using android::system::suspend::V1_0::WakeLockType;
 
 static void BM_acquireWakeLock(benchmark::State& state) {
-    static sp<ISystemSuspend> suspendService = ISystemSuspend::getService();
+    static const std::string suspendInstance =
+        std::string() + ISystemSuspend::descriptor + "/default";
+    static std::shared_ptr<ISystemSuspend> suspendService = ISystemSuspend::fromBinder(
+        ndk::SpAIBinder(AServiceManager_waitForService(suspendInstance.c_str())));
 
     while (state.KeepRunning()) {
-        suspendService->acquireWakeLock(WakeLockType::PARTIAL, "BenchmarkWakeLock");
+        std::shared_ptr<IWakeLock> wl = nullptr;
+        suspendService->acquireWakeLock(WakeLockType::PARTIAL, "BenchmarkWakeLock", &wl);
     }
 }
 BENCHMARK(BM_acquireWakeLock);
diff --git a/suspend/1.0/default/SystemSuspendHidl.cpp b/suspend/1.0/default/SystemSuspendHidl.cpp
new file mode 100644
index 0000000..55a939a
--- /dev/null
+++ b/suspend/1.0/default/SystemSuspendHidl.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SystemSuspendHidl.h"
+
+#include <hwbinder/IPCThreadState.h>
+
+using ::android::hardware::Void;
+
+namespace android {
+namespace system {
+namespace suspend {
+namespace V1_0 {
+
+static inline int getCallingPid() {
+    return ::android::hardware::IPCThreadState::self()->getCallingPid();
+}
+
+WakeLock::WakeLock(SystemSuspend* systemSuspend, const std::string& name, int pid)
+    : mReleased(), mSystemSuspend(systemSuspend), mName(name), mPid(pid) {
+    mSystemSuspend->incSuspendCounter(mName);
+    mSystemSuspend->updateWakeLockStatOnAcquire(mName, mPid);
+}
+
+WakeLock::~WakeLock() {
+    releaseOnce();
+}
+
+Return<void> WakeLock::release() {
+    releaseOnce();
+    return Void();
+}
+
+void WakeLock::releaseOnce() {
+    std::call_once(mReleased, [this]() {
+        mSystemSuspend->decSuspendCounter(mName);
+        mSystemSuspend->updateWakeLockStatOnRelease(mName, mPid);
+    });
+}
+
+SystemSuspendHidl::SystemSuspendHidl(SystemSuspend* systemSuspend)
+    : mSystemSuspend(systemSuspend) {}
+
+Return<sp<IWakeLock>> SystemSuspendHidl::acquireWakeLock(WakeLockType /* type */,
+                                                         const hidl_string& name) {
+    auto pid = getCallingPid();
+    IWakeLock* wl = new WakeLock{mSystemSuspend, name, pid};
+    return wl;
+}
+
+}  // namespace V1_0
+}  // namespace suspend
+}  // namespace system
+}  // namespace android
diff --git a/suspend/1.0/default/SystemSuspendHidl.h b/suspend/1.0/default/SystemSuspendHidl.h
new file mode 100644
index 0000000..79c41e2
--- /dev/null
+++ b/suspend/1.0/default/SystemSuspendHidl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/system/suspend/1.0/ISystemSuspend.h>
+
+#include <string>
+
+#include "SystemSuspend.h"
+
+namespace android {
+namespace system {
+namespace suspend {
+namespace V1_0 {
+
+using ::android::hardware::hidl_string;
+using ::android::hardware::Return;
+
+class WakeLock : public IWakeLock {
+   public:
+    WakeLock(SystemSuspend* systemSuspend, const std::string& name, int pid);
+    ~WakeLock();
+
+    Return<void> release();
+
+   private:
+    inline void releaseOnce();
+    std::once_flag mReleased;
+
+    SystemSuspend* mSystemSuspend;
+    std::string mName;
+    int mPid;
+};
+
+class SystemSuspendHidl : public ISystemSuspend {
+   public:
+    SystemSuspendHidl(SystemSuspend* systemSuspend);
+    Return<sp<IWakeLock>> acquireWakeLock(WakeLockType type, const hidl_string& name) override;
+
+   private:
+    SystemSuspend* mSystemSuspend;
+};
+
+}  // namespace V1_0
+}  // namespace suspend
+}  // namespace system
+}  // namespace android
diff --git a/suspend/1.0/default/SystemSuspendUnitTest.cpp b/suspend/1.0/default/SystemSuspendUnitTest.cpp
index d7b136a..c779623 100644
--- a/suspend/1.0/default/SystemSuspendUnitTest.cpp
+++ b/suspend/1.0/default/SystemSuspendUnitTest.cpp
@@ -18,6 +18,8 @@
 #include <android-base/logging.h>
 #include <android-base/result.h>
 #include <android-base/unique_fd.h>
+#include <android/binder_manager.h>
+#include <android/binder_stability.h>
 #include <android/system/suspend/BnSuspendCallback.h>
 #include <android/system/suspend/BnWakelockCallback.h>
 #include <binder/IPCThreadState.h>
@@ -42,8 +44,13 @@
 
 #include "SuspendControlService.h"
 #include "SystemSuspend.h"
+#include "SystemSuspendAidl.h"
 #include "WakeupList.h"
 
+using aidl::android::system::suspend::ISystemSuspend;
+using aidl::android::system::suspend::IWakeLock;
+using aidl::android::system::suspend::SystemSuspendAidl;
+using aidl::android::system::suspend::WakeLockType;
 using android::sp;
 using android::base::Result;
 using android::base::Socketpair;
@@ -60,9 +67,6 @@
 using android::system::suspend::internal::ISuspendControlServiceInternal;
 using android::system::suspend::internal::WakeLockInfo;
 using android::system::suspend::internal::WakeupInfo;
-using android::system::suspend::V1_0::getTimeNow;
-using android::system::suspend::V1_0::ISystemSuspend;
-using android::system::suspend::V1_0::IWakeLock;
 using android::system::suspend::V1_0::readFd;
 using android::system::suspend::V1_0::SleepTimeConfig;
 using android::system::suspend::V1_0::SuspendControlService;
@@ -70,7 +74,6 @@
 using android::system::suspend::V1_0::SuspendStats;
 using android::system::suspend::V1_0::SystemSuspend;
 using android::system::suspend::V1_0::TimestampType;
-using android::system::suspend::V1_0::WakeLockType;
 using android::system::suspend::V1_0::WakeupList;
 using namespace std::chrono_literals;
 
@@ -119,15 +122,18 @@
             suspendTimeFd =
                 unique_fd(TEMP_FAILURE_RETRY(open(suspendTimeFile.path, O_CLOEXEC | O_RDONLY)));
 
-            sp<ISystemSuspend> suspend = new SystemSuspend(
+            systemSuspend = new SystemSuspend(
                 std::move(wakeupCountFds[1]), std::move(stateFds[1]),
                 unique_fd(-1) /*suspendStatsFd*/, 1 /* maxNativeStatsEntries */,
                 unique_fd(-1) /* kernelWakelockStatsFd */, std::move(wakeupReasonsFd),
                 std::move(suspendTimeFd), kSleepTimeConfig, suspendControl, suspendControlInternal);
-            status_t status = suspend->registerAsService(kServiceName);
-            if (android::OK != status) {
-                LOG(FATAL) << "Unable to register service: " << status;
-            }
+
+            std::shared_ptr<SystemSuspendAidl> suspendAidl =
+                ndk::SharedRefBase::make<SystemSuspendAidl>(systemSuspend.get());
+            auto aidlBinder = suspendAidl->asBinder();
+            AIBinder_forceDowngradeToLocalStability(aidlBinder.get());
+            auto aidlStatus = AServiceManager_addService(aidlBinder.get(), kServiceName);
+            CHECK(aidlStatus == STATUS_OK);
 
             joinRpcThreadpool();
         });
@@ -138,9 +144,12 @@
         Socketpair(SOCK_STREAM, &wakeupCountFds[0], &wakeupCountFds[1]);
         Socketpair(SOCK_STREAM, &stateFds[0], &stateFds[1]);
 
+        wakeupCountFd = wakeupCountFds[0];
+        stateFd = stateFds[0];
+
         registerTestService();
-        ::android::hardware::details::waitForHwService(ISystemSuspend::descriptor, kServiceName);
-        sp<ISystemSuspend> suspendService = ISystemSuspend::getService(kServiceName);
+        std::shared_ptr<ISystemSuspend> suspendService = ISystemSuspend::fromBinder(
+            ndk::SpAIBinder(AServiceManager_waitForService(kServiceName)));
         ASSERT_NE(suspendService, nullptr) << "failed to get suspend service";
 
         sp<IBinder> control =
@@ -156,14 +165,19 @@
 
         // Start auto-suspend.
         bool enabled = false;
-        controlServiceInternal->enableAutosuspend(&enabled);
+        controlServiceInternal->enableAutosuspend(new BBinder(), &enabled);
         ASSERT_EQ(enabled, true) << "failed to start autosuspend";
     }
 
+    static void TearDownTestSuite() {
+        unblockSystemSuspendFromWakeupCount();
+        systemSuspend->disableAutosuspend();
+    }
+
    public:
     virtual void SetUp() override {
-        ::android::hardware::details::waitForHwService(ISystemSuspend::descriptor, kServiceName);
-        suspendService = ISystemSuspend::getService(kServiceName);
+        suspendService = ISystemSuspend::fromBinder(
+            ndk::SpAIBinder(AServiceManager_waitForService(kServiceName)));
         ASSERT_NE(suspendService, nullptr) << "failed to get suspend service";
 
         sp<IBinder> control =
@@ -176,8 +190,7 @@
         ASSERT_NE(controlInternal, nullptr) << "failed to get the suspend control internal service";
         controlServiceInternal = interface_cast<ISuspendControlServiceInternal>(controlInternal);
 
-        wakeupCountFd = wakeupCountFds[0];
-        stateFd = stateFds[0];
+        systemSuspend->enableAutosuspend(new BBinder());
 
         // SystemSuspend HAL should not have written back to wakeupCountFd or stateFd yet.
         ASSERT_TRUE(isReadBlocked(wakeupCountFd));
@@ -191,15 +204,17 @@
         ASSERT_TRUE(isReadBlocked(stateFd));
     }
 
-    void unblockSystemSuspendFromWakeupCount() {
+    static void unblockSystemSuspendFromWakeupCount() {
         std::string wakeupCount = std::to_string(rand());
         ASSERT_TRUE(WriteStringToFd(wakeupCount, wakeupCountFd));
     }
 
     bool isSystemSuspendBlocked(int timeout_ms = 20) { return isReadBlocked(stateFd, timeout_ms); }
 
-    sp<IWakeLock> acquireWakeLock(const std::string& name = "TestLock") {
-        return suspendService->acquireWakeLock(WakeLockType::PARTIAL, name);
+    std::shared_ptr<IWakeLock> acquireWakeLock(const std::string& name = "TestLock") {
+        std::shared_ptr<IWakeLock> wl = nullptr;
+        auto status = suspendService->acquireWakeLock(WakeLockType::PARTIAL, name, &wl);
+        return wl;
     }
 
     size_t getActiveWakeLockCount() {
@@ -222,7 +237,7 @@
 
     void checkWakelockLoop(int numIter, const std::string name) {
         for (int i = 0; i < numIter; i++) {
-            sp<IWakeLock> testLock = acquireWakeLock(name);
+            std::shared_ptr<IWakeLock> testLock = acquireWakeLock(name);
             testLock->release();
         }
     }
@@ -237,18 +252,18 @@
     }
 
     void checkSleepTime(std::chrono::milliseconds expected) {
-        SystemSuspend* s = static_cast<SystemSuspend*>(suspendService.get());
         // There is a race window where sleepTime can be checked in the tests,
         // before it is updated in autoSuspend
         while (!isReadBlocked(wakeupCountFd)) {
         }
-        std::chrono::milliseconds actual = s->getSleepTime();
+        std::chrono::milliseconds actual = systemSuspend->getSleepTime();
         ASSERT_EQ(actual.count(), expected.count()) << "incorrect sleep time";
     }
 
-    sp<ISystemSuspend> suspendService;
+    std::shared_ptr<ISystemSuspend> suspendService;
     sp<ISuspendControlService> controlService;
     sp<ISuspendControlServiceInternal> controlServiceInternal;
+    static sp<SystemSuspend> systemSuspend;
     static unique_fd wakeupCountFds[2];
     static unique_fd stateFds[2];
     static unique_fd wakeupReasonsFd;
@@ -270,6 +285,7 @@
 };
 
 // SystemSuspendTest test suite resources
+sp<SystemSuspend> SystemSuspendTest::systemSuspend;
 unique_fd SystemSuspendTest::wakeupCountFds[2];
 unique_fd SystemSuspendTest::stateFds[2];
 unique_fd SystemSuspendTest::wakeupReasonsFd;
@@ -282,10 +298,43 @@
 // Tests that autosuspend thread can only be enabled once.
 TEST_F(SystemSuspendTest, OnlyOneEnableAutosuspend) {
     bool enabled = false;
-    controlServiceInternal->enableAutosuspend(&enabled);
+    controlServiceInternal->enableAutosuspend(new BBinder(), &enabled);
     ASSERT_EQ(enabled, false);
 }
 
+// Tests that autosuspend thread can only enabled again after its been disabled.
+TEST_F(SystemSuspendTest, EnableAutosuspendAfterDisableAutosuspend) {
+    bool enabled = false;
+    unblockSystemSuspendFromWakeupCount();
+    systemSuspend->disableAutosuspend();
+    controlServiceInternal->enableAutosuspend(new BBinder(), &enabled);
+    ASSERT_EQ(enabled, true);
+}
+
+TEST_F(SystemSuspendTest, DisableAutosuspendBlocksSuspend) {
+    checkLoop(1);
+    systemSuspend->disableAutosuspend();
+    ASSERT_TRUE(isSystemSuspendBlocked());
+}
+
+TEST_F(SystemSuspendTest, BlockAutosuspendIfBinderIsDead) {
+    class DeadBinder : public BBinder {
+        android::status_t pingBinder() override { return android::UNKNOWN_ERROR; }
+    };
+
+    auto token = sp<DeadBinder>::make();
+
+    systemSuspend->disableAutosuspend();
+    unblockSystemSuspendFromWakeupCount();
+    ASSERT_TRUE(isSystemSuspendBlocked());
+
+    bool enabled = false;
+    controlServiceInternal->enableAutosuspend(token, &enabled);
+    unblockSystemSuspendFromWakeupCount();
+
+    ASSERT_TRUE(isSystemSuspendBlocked(150));
+}
+
 TEST_F(SystemSuspendTest, AutosuspendLoop) {
     checkLoop(5);
 }
@@ -293,7 +342,7 @@
 // Tests that upon WakeLock destruction SystemSuspend HAL is unblocked.
 TEST_F(SystemSuspendTest, WakeLockDestructor) {
     {
-        sp<IWakeLock> wl = acquireWakeLock();
+        std::shared_ptr<IWakeLock> wl = acquireWakeLock();
         ASSERT_NE(wl, nullptr);
         unblockSystemSuspendFromWakeupCount();
         ASSERT_TRUE(isSystemSuspendBlocked());
@@ -303,7 +352,7 @@
 
 // Tests that upon WakeLock::release() SystemSuspend HAL is unblocked.
 TEST_F(SystemSuspendTest, WakeLockRelease) {
-    sp<IWakeLock> wl = acquireWakeLock();
+    std::shared_ptr<IWakeLock> wl = acquireWakeLock();
     ASSERT_NE(wl, nullptr);
     unblockSystemSuspendFromWakeupCount();
     ASSERT_TRUE(isSystemSuspendBlocked());
@@ -314,12 +363,12 @@
 // Tests that multiple WakeLocks correctly block SystemSuspend HAL.
 TEST_F(SystemSuspendTest, MultipleWakeLocks) {
     {
-        sp<IWakeLock> wl1 = acquireWakeLock();
+        std::shared_ptr<IWakeLock> wl1 = acquireWakeLock();
         ASSERT_NE(wl1, nullptr);
         ASSERT_TRUE(isSystemSuspendBlocked());
         unblockSystemSuspendFromWakeupCount();
         {
-            sp<IWakeLock> wl2 = acquireWakeLock();
+            std::shared_ptr<IWakeLock> wl2 = acquireWakeLock();
             ASSERT_NE(wl2, nullptr);
             ASSERT_TRUE(isSystemSuspendBlocked());
         }
@@ -331,7 +380,7 @@
 // Tests that upon thread deallocation WakeLock is destructed and SystemSuspend HAL is unblocked.
 TEST_F(SystemSuspendTest, ThreadCleanup) {
     std::thread clientThread([this] {
-        sp<IWakeLock> wl = acquireWakeLock();
+        std::shared_ptr<IWakeLock> wl = acquireWakeLock();
         ASSERT_NE(wl, nullptr);
         unblockSystemSuspendFromWakeupCount();
         ASSERT_TRUE(isSystemSuspendBlocked());
@@ -345,7 +394,7 @@
 TEST_F(SystemSuspendTest, CleanupOnAbort) {
     ASSERT_EXIT(
         {
-            sp<IWakeLock> wl = acquireWakeLock();
+            std::shared_ptr<IWakeLock> wl = acquireWakeLock();
             ASSERT_NE(wl, nullptr);
             std::abort();
         },
@@ -367,8 +416,8 @@
     for (int i = 0; i < numThreads; i++) {
         tds[i] = std::thread([this] {
             for (int j = 0; j < numLocks; j++) {
-                sp<IWakeLock> wl1 = acquireWakeLock();
-                sp<IWakeLock> wl2 = acquireWakeLock();
+                std::shared_ptr<IWakeLock> wl1 = acquireWakeLock();
+                std::shared_ptr<IWakeLock> wl2 = acquireWakeLock();
                 wl2->release();
             }
         });
@@ -674,7 +723,7 @@
 
     // Dead process callback must still be dealt with either by unregistering it
     // or checking isOk() on every call.
-    sp<IWakeLock> testLock = acquireWakeLock("testLock");
+    std::shared_ptr<IWakeLock> testLock = acquireWakeLock("testLock");
     ASSERT_TRUE(testLock->release().isOk());
 }
 
@@ -738,8 +787,10 @@
 
 class SystemSuspendSameThreadTest : public ::testing::Test {
    public:
-    sp<IWakeLock> acquireWakeLock(const std::string& name = "TestLock") {
-        return suspendService->acquireWakeLock(WakeLockType::PARTIAL, name);
+    std::shared_ptr<IWakeLock> acquireWakeLock(const std::string& name = "TestLock") {
+        std::shared_ptr<IWakeLock> wl = nullptr;
+        auto status = suspendService->acquireWakeLock(WakeLockType::PARTIAL, name, &wl);
+        return wl;
     }
 
     /**
@@ -908,9 +959,7 @@
     /**
      * Returns suspend stats.
      */
-    Result<SuspendStats> getSuspendStats() {
-        return reinterpret_cast<SystemSuspend*>(suspendService.get())->getSuspendStats();
-    }
+    Result<SuspendStats> getSuspendStats() { return systemSuspend->getSuspendStats(); }
 
     virtual void SetUp() override {
         kernelWakelockStatsFd = unique_fd(TEMP_FAILURE_RETRY(
@@ -931,20 +980,24 @@
             new SuspendControlServiceInternal();
         controlService = suspendControl;
         controlServiceInternal = suspendControlInternal;
-        suspendService =
-            new SystemSuspend(unique_fd(-1) /* wakeupCountFd */, unique_fd(-1) /* stateFd */,
-                              unique_fd(dup(suspendStatsFd)), 1 /* maxNativeStatsEntries */,
-                              unique_fd(dup(kernelWakelockStatsFd.get())),
-                              unique_fd(-1) /* wakeupReasonsFd */, unique_fd(-1) /*suspendTimeFd*/,
-                              kSleepTimeConfig, suspendControl, suspendControlInternal);
+        systemSuspend = new SystemSuspend(
+            unique_fd(-1) /* wakeupCountFd */, unique_fd(-1) /* stateFd */,
+            unique_fd(dup(suspendStatsFd)), 1 /* maxNativeStatsEntries */,
+            unique_fd(dup(kernelWakelockStatsFd.get())), unique_fd(-1) /* wakeupReasonsFd */,
+            unique_fd(-1) /* suspendTimeFd */, kSleepTimeConfig, suspendControl,
+            suspendControlInternal);
+
+        suspendService = ndk::SharedRefBase::make<SystemSuspendAidl>(systemSuspend.get());
     }
 
     virtual void TearDown() override {
+        systemSuspend->disableAutosuspend();
         ASSERT_TRUE(clearDirectory(kernelWakelockStatsDir.path));
         ASSERT_TRUE(clearDirectory(suspendStatsDir.path));
     }
 
-    sp<ISystemSuspend> suspendService;
+    sp<SystemSuspend> systemSuspend;
+    std::shared_ptr<ISystemSuspend> suspendService;
     sp<ISuspendControlService> controlService;
     sp<ISuspendControlServiceInternal> controlServiceInternal;
     unique_fd kernelWakelockStatsFd;
@@ -967,7 +1020,7 @@
 TEST_F(SystemSuspendSameThreadTest, GetNativeWakeLockStats) {
     std::string fakeWlName = "FakeLock";
     {
-        sp<IWakeLock> fakeLock = acquireWakeLock(fakeWlName);
+        std::shared_ptr<IWakeLock> fakeLock = acquireWakeLock(fakeWlName);
         std::vector<WakeLockInfo> wlStats = getWakelockStats();
         ASSERT_EQ(wlStats.size(), 1);
 
@@ -1065,7 +1118,7 @@
     addKernelWakelock(fakeKwlName);
 
     {
-        sp<IWakeLock> fakeLock = acquireWakeLock(fakeNwlName);
+        std::shared_ptr<IWakeLock> fakeLock = acquireWakeLock(fakeNwlName);
         std::vector<WakeLockInfo> wlStats = getWakelockStats();
         ASSERT_EQ(wlStats.size(), 2);
 
@@ -1207,19 +1260,26 @@
         wakeupReasonsFd =
             unique_fd(TEMP_FAILURE_RETRY(open(wakeupReasonsFile.path, O_CLOEXEC | O_RDONLY)));
 
-        suspend = new SystemSuspend(std::move(wakeupCountServiceFd), std::move(stateServiceFd),
-                                    unique_fd(-1) /*suspendStatsFd*/, 100 /* maxStatsEntries */,
-                                    unique_fd(-1) /* kernelWakelockStatsFd */,
-                                    std::move(wakeupReasonsFd), std::move(suspendTimeFd),
-                                    kSleepTimeConfig, suspendControl, suspendControlInternal);
+        systemSuspend = new SystemSuspend(
+            std::move(wakeupCountServiceFd), std::move(stateServiceFd),
+            unique_fd(-1) /* suspendStatsFd */, 100 /* maxStatsEntries */,
+            unique_fd(-1) /* kernelWakelockStatsFd */, std::move(wakeupReasonsFd),
+            std::move(suspendTimeFd), kSleepTimeConfig, suspendControl, suspendControlInternal);
 
         // Start auto-suspend.
         bool enabled = false;
-        suspendControlInternal->enableAutosuspend(&enabled);
+        suspendControlInternal->enableAutosuspend(new BBinder(), &enabled);
         ASSERT_EQ(enabled, true) << "failed to start autosuspend";
     }
 
-    virtual void TearDown() override {}
+    virtual void TearDown() override { systemSuspend->disableAutosuspend(); }
+
+    std::shared_ptr<IWakeLock> acquireWakeLock(const std::string& name = "TestLock") {
+        auto suspendService = ndk::SharedRefBase::make<SystemSuspendAidl>(systemSuspend.get());
+        std::shared_ptr<IWakeLock> wl = nullptr;
+        auto status = suspendService->acquireWakeLock(WakeLockType::PARTIAL, name, &wl);
+        return wl;
+    }
 
     void wakeup(std::string wakeupReason) {
         ASSERT_TRUE(WriteStringToFile(wakeupReason, wakeupReasonsFile.path));
@@ -1256,10 +1316,8 @@
     }
 
     void checkSuspendInfo(const SuspendInfo& expected) {
-        SystemSuspend* s = static_cast<SystemSuspend*>(suspend.get());
-
         SuspendInfo actual;
-        s->getSuspendInfo(&actual);
+        systemSuspend->getSuspendInfo(&actual);
 
         ASSERT_EQ(actual.suspendAttemptCount, expected.suspendAttemptCount);
         ASSERT_EQ(actual.failedSuspendCount, expected.failedSuspendCount);
@@ -1285,7 +1343,7 @@
     TemporaryFile wakeupCountFile;
     sp<SuspendControlService> suspendControl;
     sp<SuspendControlServiceInternal> suspendControlInternal;
-    sp<ISystemSuspend> suspend;
+    sp<SystemSuspend> systemSuspend;
 
     const SleepTimeConfig kSleepTimeConfig = {
         .baseSleepTime = 100ms,
diff --git a/suspend/1.0/default/WakeLockEntryList.cpp b/suspend/1.0/default/WakeLockEntryList.cpp
index 8a05a30..a5b1de5 100644
--- a/suspend/1.0/default/WakeLockEntryList.cpp
+++ b/suspend/1.0/default/WakeLockEntryList.cpp
@@ -18,10 +18,15 @@
 
 #include <android-base/file.h>
 #include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/stringprintf.h>
 
 #include <iomanip>
 
+using android::base::ParseInt;
 using android::base::ReadFdToString;
+using android::base::Readlink;
+using android::base::StringPrintf;
 
 namespace android {
 namespace system {
@@ -219,7 +224,13 @@
     unique_fd wakelockFd{TEMP_FAILURE_RETRY(
         openat(mKernelWakelockStatsFd, kwlId.c_str(), O_DIRECTORY | O_CLOEXEC | O_RDONLY))};
     if (wakelockFd < 0) {
-        PLOG(ERROR) << "Error opening kernel wakelock stats for: " << kwlId;
+        char buf[PATH_MAX];
+        ssize_t data_length =
+            readlinkat(mKernelWakelockStatsFd, kwlId.c_str(), buf, sizeof(buf) - 1);
+        if (data_length <= 0 || strncmp(kwlId.c_str(), buf, kwlId.length()) == 0) {
+            buf[0] = '\0';
+        }
+        PLOG(ERROR) << "Error opening kernel wakelock stats for: " << kwlId << " (" << buf << ")";
     }
 
     std::unique_ptr<DIR, decltype(&closedir)> wakelockDp(fdopendir(dup(wakelockFd.get())),
@@ -252,7 +263,17 @@
                 continue;
             }
 
-            int64_t statVal = std::stoll(valStr);
+            int64_t statVal;
+            if (!ParseInt(valStr, &statVal)) {
+                std::string path;
+                if (Readlink(StringPrintf("/proc/self/fd/%d", statFd.get()), &path)) {
+                    LOG(ERROR) << "Unexpected format for wakelock stat value (" << valStr
+                               << ") from file: " << path;
+                } else {
+                    LOG(ERROR) << "Unexpected format for wakelock stat value (" << valStr << ")";
+                }
+                continue;
+            }
 
             if (statName == "active_count") {
                 info.activeCount = statVal;
@@ -301,7 +322,9 @@
     }
 }
 
-void WakeLockEntryList::updateOnAcquire(const std::string& name, int pid, TimestampType timeNow) {
+void WakeLockEntryList::updateOnAcquire(const std::string& name, int pid) {
+    TimestampType timeNow = getTimeNow();
+
     std::lock_guard<std::mutex> lock(mStatsLock);
 
     auto key = std::make_pair(name, pid);
@@ -325,7 +348,9 @@
     }
 }
 
-void WakeLockEntryList::updateOnRelease(const std::string& name, int pid, TimestampType timeNow) {
+void WakeLockEntryList::updateOnRelease(const std::string& name, int pid) {
+    TimestampType timeNow = getTimeNow();
+
     std::lock_guard<std::mutex> lock(mStatsLock);
 
     auto key = std::make_pair(name, pid);
diff --git a/suspend/1.0/default/WakeLockEntryList.h b/suspend/1.0/default/WakeLockEntryList.h
index 4a792cb..1ebc411 100644
--- a/suspend/1.0/default/WakeLockEntryList.h
+++ b/suspend/1.0/default/WakeLockEntryList.h
@@ -37,8 +37,6 @@
 using android::base::unique_fd;
 using TimestampType = int64_t;
 
-TimestampType getTimeNow();
-
 /*
  * WakeLockEntryList to collect wake lock stats.
  * This class is thread safe.
@@ -46,8 +44,8 @@
 class WakeLockEntryList {
    public:
     WakeLockEntryList(size_t capacity, unique_fd kernelWakelockStatsFd);
-    void updateOnAcquire(const std::string& name, int pid, TimestampType timeNow);
-    void updateOnRelease(const std::string& name, int pid, TimestampType timeNow);
+    void updateOnAcquire(const std::string& name, int pid);
+    void updateOnRelease(const std::string& name, int pid);
     // updateNow() should be called before getWakeLockStats() to ensure stats are
     // updated wrt the current time.
     void updateNow();
diff --git a/suspend/1.0/default/android.system.suspend@1.0-service.xml b/suspend/1.0/default/android.system.suspend@1.0-service.xml
index 9f06ae3..5337891 100644
--- a/suspend/1.0/default/android.system.suspend@1.0-service.xml
+++ b/suspend/1.0/default/android.system.suspend@1.0-service.xml
@@ -1,5 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal>
+    <hal max-level="6">
         <name>android.system.suspend</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -8,4 +8,9 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl">
+        <name>android.system.suspend</name>
+        <version>1</version>
+        <fqname>ISystemSuspend/default</fqname>
+    </hal>
 </manifest>
diff --git a/suspend/1.0/default/main.cpp b/suspend/1.0/default/main.cpp
index d17cdb5..6843dea 100644
--- a/suspend/1.0/default/main.cpp
+++ b/suspend/1.0/default/main.cpp
@@ -15,13 +15,15 @@
  */
 
 #include <android-base/logging.h>
+#include <android/binder_manager.h>
 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
 #include <binder/ProcessState.h>
 #include <cutils/native_handle.h>
-#include <fcntl.h>
 #include <hidl/HidlTransportSupport.h>
 #include <hwbinder/ProcessState.h>
+
+#include <fcntl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -31,9 +33,13 @@
 
 #include "SuspendControlService.h"
 #include "SystemSuspend.h"
+#include "SystemSuspendAidl.h"
+#include "SystemSuspendHidl.h"
 
+using aidl::android::system::suspend::SystemSuspendAidl;
 using android::sp;
 using android::status_t;
+using android::String16;
 using android::base::Socketpair;
 using android::base::unique_fd;
 using android::hardware::configureRpcThreadpool;
@@ -43,6 +49,7 @@
 using android::system::suspend::V1_0::SuspendControlService;
 using android::system::suspend::V1_0::SuspendControlServiceInternal;
 using android::system::suspend::V1_0::SystemSuspend;
+using android::system::suspend::V1_0::SystemSuspendHidl;
 using namespace std::chrono_literals;
 using namespace ::android::sysprop;
 
@@ -88,7 +95,7 @@
         PLOG(ERROR) << "SystemSuspend: Error opening " << kSysKernelWakeupReasons;
     }
     unique_fd suspendTimeFd{TEMP_FAILURE_RETRY(open(kSysKernelSuspendTime, O_CLOEXEC | O_RDONLY))};
-    if (wakeupReasonsFd < 0) {
+    if (suspendTimeFd < 0) {
         PLOG(ERROR) << "SystemSuspend: Error opening " << kSysKernelSuspendTime;
     }
 
@@ -123,15 +130,15 @@
     configureRpcThreadpool(1, true /* callerWillJoin */);
 
     sp<SuspendControlService> suspendControl = new SuspendControlService();
-    auto controlStatus = android::defaultServiceManager()->addService(
-        android::String16("suspend_control"), suspendControl);
+    auto controlStatus =
+        android::defaultServiceManager()->addService(String16("suspend_control"), suspendControl);
     if (controlStatus != android::OK) {
         LOG(FATAL) << "Unable to register suspend_control service: " << controlStatus;
     }
 
     sp<SuspendControlServiceInternal> suspendControlInternal = new SuspendControlServiceInternal();
     controlStatus = android::defaultServiceManager()->addService(
-        android::String16("suspend_control_internal"), suspendControlInternal);
+        String16("suspend_control_internal"), suspendControlInternal);
     if (controlStatus != android::OK) {
         LOG(FATAL) << "Unable to register suspend_control_internal service: " << controlStatus;
     }
@@ -145,9 +152,20 @@
         std::move(kernelWakelockStatsFd), std::move(wakeupReasonsFd), std::move(suspendTimeFd),
         sleepTimeConfig, suspendControl, suspendControlInternal, true /* mUseSuspendCounter*/);
 
-    status_t status = suspend->registerAsService();
-    if (android::OK != status) {
-        LOG(FATAL) << "Unable to register system-suspend service: " << status;
+    std::shared_ptr<SystemSuspendAidl> suspendAidl =
+        ndk::SharedRefBase::make<SystemSuspendAidl>(suspend.get());
+    const std::string suspendAidlInstance =
+        std::string() + SystemSuspendAidl::descriptor + "/default";
+    auto aidlStatus =
+        AServiceManager_addService(suspendAidl->asBinder().get(), suspendAidlInstance.c_str());
+    CHECK_EQ(aidlStatus, STATUS_OK)
+        << "Unable to register system-suspend AIDL service: " << aidlStatus;
+
+    sp<SystemSuspendHidl> suspendHidl = new SystemSuspendHidl(suspend.get());
+    status_t hidlStatus = suspendHidl->registerAsService();
+    if (android::OK != hidlStatus) {
+        LOG(INFO) << "system-suspend HIDL hal not supported, use the AIDL suspend hal for "
+                     "requesting wakelocks";
     }
 
     joinRpcThreadpool();
diff --git a/suspend/1.0/default/suspend-sepolicy-tests.xml b/suspend/1.0/default/suspend-sepolicy-tests.xml
new file mode 100644
index 0000000..b97ca0d
--- /dev/null
+++ b/suspend/1.0/default/suspend-sepolicy-tests.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2021 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<configuration description="Runs SuspendSepolicyTests">
+    <!-- This test requires root for reading sysfs files  -->
+    <target_preparer class="com.android.tradefed.targetprep.RootTargetPreparer" />
+    <test class="com.android.tradefed.testtype.binary.ExecutableHostTest" >
+        <option name="binary" value="SuspendSepolicyTests" />
+        <!-- This test requires a device, so it's not annotated with a null-device -->
+        <option name="per-binary-timeout" value="2m" />
+    </test>
+</configuration>
diff --git a/suspend/TEST_MAPPING b/suspend/TEST_MAPPING
index a059d3b..a937485 100644
--- a/suspend/TEST_MAPPING
+++ b/suspend/TEST_MAPPING
@@ -5,6 +5,20 @@
     },
     {
       "name": "SystemSuspendV1_0AidlTest"
+    },
+    {
+      "name": "SuspendSepolicyTests"
+    }
+  ],
+  "hwasan-postsubmit": [
+    {
+      "name": "SystemSuspendV1_0UnitTest"
+    },
+    {
+      "name": "SystemSuspendV1_0AidlTest"
+    },
+    {
+      "name": "SuspendSepolicyTests"
     }
   ]
 }
diff --git a/suspend/aidl/Android.bp b/suspend/aidl/Android.bp
index d0bebf1..0efa00a 100644
--- a/suspend/aidl/Android.bp
+++ b/suspend/aidl/Android.bp
@@ -20,14 +20,17 @@
     name: "android.system.suspend.control",
     local_include_dir: ".",
     srcs: [
-        "android/system/suspend/*.aidl",
+        "android/system/suspend/ISuspendControlService.aidl",
+        "android/system/suspend/ISuspendCallback.aidl",
+        "android/system/suspend/IWakelockCallback.aidl",
     ],
     backend: {
         ndk: {
             apex_available: [
                 "//apex_available:platform",
-                "com.android.bluetooth.updatable",
+                "com.android.bluetooth",
             ],
+            min_sdk_version: "30",
         },
         java: {
             sdk_version: "28",
@@ -35,3 +38,40 @@
     },
     versions: ["1"],
 }
+
+aidl_interface {
+    name: "android.system.suspend",
+    vendor_available: true,
+    stability: "vintf",
+    srcs: [
+        "android/system/suspend/ISystemSuspend.aidl",
+        "android/system/suspend/IWakeLock.aidl",
+        "android/system/suspend/WakeLockType.aidl",
+    ],
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            enabled: false,
+        },
+        ndk: {
+            apex_available: [
+                "//apex_available:platform",
+                "com.android.uwb",
+                "com.android.bluetooth",
+            ],
+            min_sdk_version: "30",
+            vndk: {
+                enabled: true,
+            },
+        },
+    },
+    versions_with_info: [
+        {
+            version: "1",
+            imports: [],
+        },
+    ],
+
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/1/.hash b/suspend/aidl/aidl_api/android.system.suspend/1/.hash
new file mode 100644
index 0000000..c794a4a
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/1/.hash
@@ -0,0 +1 @@
+082a58c2505b703702f34ab8abcb1d1b5e890be4
diff --git a/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/ISystemSuspend.aidl b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/ISystemSuspend.aidl
new file mode 100644
index 0000000..2273511
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/ISystemSuspend.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+interface ISystemSuspend {
+  android.system.suspend.IWakeLock acquireWakeLock(android.system.suspend.WakeLockType type, @utf8InCpp String name);
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/IWakeLock.aidl b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/IWakeLock.aidl
new file mode 100644
index 0000000..27d427b
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/IWakeLock.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+interface IWakeLock {
+  oneway void release();
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/WakeLockType.aidl b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/WakeLockType.aidl
new file mode 100644
index 0000000..b103832
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/1/android/system/suspend/WakeLockType.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+enum WakeLockType {
+  PARTIAL = 0,
+  FULL = 1,
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/ISystemSuspend.aidl b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/ISystemSuspend.aidl
new file mode 100644
index 0000000..2273511
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/ISystemSuspend.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+interface ISystemSuspend {
+  android.system.suspend.IWakeLock acquireWakeLock(android.system.suspend.WakeLockType type, @utf8InCpp String name);
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/IWakeLock.aidl b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/IWakeLock.aidl
new file mode 100644
index 0000000..27d427b
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/IWakeLock.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+interface IWakeLock {
+  oneway void release();
+}
diff --git a/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/WakeLockType.aidl b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/WakeLockType.aidl
new file mode 100644
index 0000000..b103832
--- /dev/null
+++ b/suspend/aidl/aidl_api/android.system.suspend/current/android/system/suspend/WakeLockType.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.system.suspend;
+@VintfStability
+enum WakeLockType {
+  PARTIAL = 0,
+  FULL = 1,
+}
diff --git a/suspend/aidl/android/system/suspend/ISystemSuspend.aidl b/suspend/aidl/android/system/suspend/ISystemSuspend.aidl
new file mode 100644
index 0000000..defb8cf
--- /dev/null
+++ b/suspend/aidl/android/system/suspend/ISystemSuspend.aidl
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.system.suspend;
+
+import android.system.suspend.IWakeLock;
+import android.system.suspend.WakeLockType;
+
+@VintfStability
+interface ISystemSuspend {
+    IWakeLock acquireWakeLock(WakeLockType type, @utf8InCpp String name);
+}
diff --git a/suspend/aidl/android/system/suspend/IWakeLock.aidl b/suspend/aidl/android/system/suspend/IWakeLock.aidl
new file mode 100644
index 0000000..d305b85
--- /dev/null
+++ b/suspend/aidl/android/system/suspend/IWakeLock.aidl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.system.suspend;
+
+/**
+ * Allocating an IWakeLock instance must block system suspend. Deallocating an
+ * IWakeLock must unblock system suspend in a manner equivalent to calling
+ * IWakeLock::release().
+ */
+@VintfStability
+interface IWakeLock {
+    /**
+     *  Releases IWakeLock instance. This method only has effect first time its
+     *  called. Subsequent calls must result in no-ops. If no unreleased wake
+     *  lock is present, system is allowed to suspend.
+     */
+    oneway void release();
+}
diff --git a/suspend/aidl/android/system/suspend/WakeLockType.aidl b/suspend/aidl/android/system/suspend/WakeLockType.aidl
new file mode 100644
index 0000000..f78198c
--- /dev/null
+++ b/suspend/aidl/android/system/suspend/WakeLockType.aidl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.system.suspend;
+
+/**
+ * Blocking CPU suspend is the only constraint that must be respected by all
+ * wake lock types. E.g. a request for a full wake lock must block CPU suspend,
+ * but not necessarily keep the screen alive.
+ */
+@VintfStability
+enum WakeLockType {
+    /* CPU stays on. */
+    PARTIAL = 0,
+    /* CPU and the screen stay on. */
+    FULL = 1,
+}
diff --git a/suspend/aidl/android/system/suspend/internal/ISuspendControlServiceInternal.aidl b/suspend/aidl/android/system/suspend/internal/ISuspendControlServiceInternal.aidl
index 99ac525..8e0a9a2 100644
--- a/suspend/aidl/android/system/suspend/internal/ISuspendControlServiceInternal.aidl
+++ b/suspend/aidl/android/system/suspend/internal/ISuspendControlServiceInternal.aidl
@@ -29,9 +29,11 @@
     /**
      * Starts automatic system suspension.
      *
+     * @param token token registering automatic system suspension.
+     * When all registered tokens die automatic system suspension is disabled.
      * @return true on success, false otherwise.
      */
-    boolean enableAutosuspend();
+    boolean enableAutosuspend(IBinder token);
 
     /**
      * Suspends the system even if there are wakelocks being held.
diff --git a/wifi/keystore/1.0/default/Android.bp b/wifi/keystore/1.0/default/Android.bp
index c1efded..109ae89 100644
--- a/wifi/keystore/1.0/default/Android.bp
+++ b/wifi/keystore/1.0/default/Android.bp
@@ -10,9 +10,11 @@
         "-Wextra",
     ],
     srcs: ["keystore.cpp"],
+    defaults: [
+        "keystore2_use_latest_aidl_ndk_shared",
+    ],
     shared_libs: [
-        "android.system.keystore2-V1-ndk_platform",
-        "android.security.legacykeystore-ndk_platform",
+        "android.security.legacykeystore-ndk",
         "android.system.wifi.keystore@1.0",
         "libbase",
         "libbinder",
diff --git a/wifi/keystore/1.0/default/test/Android.bp b/wifi/keystore/1.0/default/test/Android.bp
index a732b5e..3d874ea 100644
--- a/wifi/keystore/1.0/default/test/Android.bp
+++ b/wifi/keystore/1.0/default/test/Android.bp
@@ -23,7 +23,11 @@
     srcs: [
         "WifiLegacyKeystoreIntegrationTest.cpp",
     ],
-    defaults: ["VtsHalTargetTestDefaults"],
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "keymint_use_latest_hal_aidl_ndk_static",
+        "keystore2_use_latest_aidl_ndk_static",
+    ],
     shared_libs: [
         "libbase",
         "liblog",
@@ -36,9 +40,8 @@
     ],
     static_libs: [
         "VtsHalHidlTargetTestBase",
-        "android.hardware.security.keymint-V1-ndk_platform",
-        "android.security.legacykeystore-ndk_platform",
-        "android.system.keystore2-V1-ndk_platform",
+        "android.hardware.security.secureclock-V1-ndk",
+        "android.security.legacykeystore-ndk",
         "android.system.wifi.keystore@1.0",
         "libkeymint_support",
     ],
diff --git a/wifi/keystore/1.0/vts/functional/Android.bp b/wifi/keystore/1.0/vts/functional/Android.bp
index d6e4241..7f13903 100644
--- a/wifi/keystore/1.0/vts/functional/Android.bp
+++ b/wifi/keystore/1.0/vts/functional/Android.bp
@@ -20,7 +20,11 @@
 
 cc_test {
     name: "VtsHalWifiKeystoreV1_0TargetTest",
-    defaults: ["VtsHalTargetTestDefaults"],
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "keymint_use_latest_hal_aidl_ndk_static",
+        "keystore2_use_latest_aidl_ndk_static",
+    ],
     srcs: [
         "VtsHalWifiKeystoreV1_0TargetTest.cpp",
     ],
@@ -35,8 +39,6 @@
     ],
     static_libs: [
         "VtsHalHidlTargetTestBase",
-        "android.hardware.security.keymint-V1-ndk_platform",
-        "android.system.keystore2-V1-ndk_platform",
         "android.system.wifi.keystore@1.0",
         "libkeymint_support",
     ],
diff --git a/wifi/keystore/1.0/vts/functional/OWNERS b/wifi/keystore/1.0/vts/functional/OWNERS
new file mode 100644
index 0000000..3f5fd4a
--- /dev/null
+++ b/wifi/keystore/1.0/vts/functional/OWNERS
@@ -0,0 +1,3 @@
+# Bug component: 189335
+haishalom@google.com
+etancohen@google.com