Snap for 11819167 from fe2f7d631ae1cde296290c84b71d1d237cda6757 to busytown-mac-infra-releasebusytown-mac-infra-release

Change-Id: I136d882cda13d9f12b799ad48b2d36e490cf9dfa

33 files changed, 747 insertions, 133 deletions

diff --git a/Android.bp b/Android.bp
index 670ee39..06959a0 100644
--- a/Android.bp
+++ b/Android.bp
@@ -13,6 +13,7 @@
 // limitations under the License.
 
 package {
+    default_team: "trendy_team_android_kernel",
     default_applicable_licenses: ["system_libhidl_license"],
 }
 
@@ -101,20 +102,15 @@ cc_library {
         "com.android.btservices",
         "com.android.media",
         "com.android.media.swcodec",
+        "com.android.nfcservices",
         "com.android.tethering",
     ],
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
+    double_loadable: true,
     whole_static_libs: [
         "libhwbinder-impl-internal",
     ],
     min_sdk_version: "29",
     afdo: true,
-    header_abi_checker: {
-        diff_flags: ["-allow-adding-removing-weak-symbols"],
-    },
 }
 
 // WARNING: deprecated
@@ -129,6 +125,7 @@ cc_library {
         "//hardware:__subpackages__",
         "//test/sts:__subpackages__",
         "//vendor:__subpackages__",
+        "//visibility:any_system_partition",
     ],
 }
 
diff --git a/TEST_MAPPING b/TEST_MAPPING
index 22c9d36..7193d26 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -11,7 +11,26 @@
     },
     {
       "name": "hidl_lazy_test"
+    },
+    {
+      "name": "vts_ibase_test"
+    },
+    {
+      "name": "vts_treble_vintf_framework_test"
+    },
+    {
+      "name": "vts_treble_vintf_vendor_test"
+    },
+    {
+      "name": "hidl_test"
+    },
+    {
+       "name": "CtsOsTestCases",
+       "options": [
+           {
+              "include-filter": "android.os.cts.HwBinderTest"
+           }
+       ]
     }
   ]
 }
-
diff --git a/base/include/hidl/HidlSupport.h b/base/include/hidl/HidlSupport.h
index 1bb38e8..de01970 100644
--- a/base/include/hidl/HidlSupport.h
+++ b/base/include/hidl/HidlSupport.h
@@ -532,40 +532,35 @@ struct hidl_vec {
 private:
     // Define std interator interface for walking the array contents
     template<bool is_const>
-    class iter : public std::iterator<
-            std::random_access_iterator_tag, /* Category */
-            T,
-            ptrdiff_t, /* Distance */
-            typename std::conditional<is_const, const T *, T *>::type /* Pointer */,
-            typename std::conditional<is_const, const T &, T &>::type /* Reference */>
-    {
-        using traits = std::iterator_traits<iter>;
-        using ptr_type = typename traits::pointer;
-        using ref_type = typename traits::reference;
-        using diff_type = typename traits::difference_type;
+    class iter {
     public:
-        iter(ptr_type ptr) : mPtr(ptr) { }
+        using iterator_category = std::random_access_iterator_tag;
+        using value_type = T;
+        using difference_type = ptrdiff_t;
+        using pointer = std::conditional_t<is_const, const T *, T *>;
+        using reference = std::conditional_t<is_const, const T &, T &>;
+        iter(pointer ptr) : mPtr(ptr) { }
         inline iter &operator++()    { mPtr++; return *this; }
         inline iter  operator++(int) { iter i = *this; mPtr++; return i; }
         inline iter &operator--()    { mPtr--; return *this; }
         inline iter  operator--(int) { iter i = *this; mPtr--; return i; }
-        inline friend iter operator+(diff_type n, const iter &it) { return it.mPtr + n; }
-        inline iter  operator+(diff_type n) const { return mPtr + n; }
-        inline iter  operator-(diff_type n) const { return mPtr - n; }
-        inline diff_type operator-(const iter &other) const { return mPtr - other.mPtr; }
-        inline iter &operator+=(diff_type n) { mPtr += n; return *this; }
-        inline iter &operator-=(diff_type n) { mPtr -= n; return *this; }
-        inline ref_type operator*() const  { return *mPtr; }
-        inline ptr_type operator->() const { return mPtr; }
+        inline friend iter operator+(difference_type n, const iter &it) { return it.mPtr + n; }
+        inline iter  operator+(difference_type n) const { return mPtr + n; }
+        inline iter  operator-(difference_type n) const { return mPtr - n; }
+        inline difference_type operator-(const iter &other) const { return mPtr - other.mPtr; }
+        inline iter &operator+=(difference_type n) { mPtr += n; return *this; }
+        inline iter &operator-=(difference_type n) { mPtr -= n; return *this; }
+        inline reference operator*() const { return *mPtr; }
+        inline pointer operator->() const  { return mPtr; }
         inline bool operator==(const iter &rhs) const { return mPtr == rhs.mPtr; }
         inline bool operator!=(const iter &rhs) const { return mPtr != rhs.mPtr; }
         inline bool operator< (const iter &rhs) const { return mPtr <  rhs.mPtr; }
         inline bool operator> (const iter &rhs) const { return mPtr >  rhs.mPtr; }
         inline bool operator<=(const iter &rhs) const { return mPtr <= rhs.mPtr; }
         inline bool operator>=(const iter &rhs) const { return mPtr >= rhs.mPtr; }
-        inline ref_type operator[](size_t n) const { return mPtr[n]; }
+        inline reference operator[](size_t n) const { return mPtr[n]; }
     private:
-        ptr_type mPtr;
+        pointer mPtr;
     };
 public:
     using iterator       = iter<false /* is_const */>;
diff --git a/base/include/hidl/TaskRunner.h b/base/include/hidl/TaskRunner.h
index 6a79ebf..f3ea92f 100644
--- a/base/include/hidl/TaskRunner.h
+++ b/base/include/hidl/TaskRunner.h
@@ -16,6 +16,7 @@
 #ifndef ANDROID_HIDL_TASK_RUNNER_H
 #define ANDROID_HIDL_TASK_RUNNER_H
 
+#include <functional>
 #include <memory>
 #include <thread>
 
diff --git a/fuzzer/Android.bp b/fuzzer/Android.bp
new file mode 100644
index 0000000..3de7b74
--- /dev/null
+++ b/fuzzer/Android.bp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package {
+    default_team: "trendy_team_android_kernel",
+}
+
+cc_defaults {
+    name: "libHidlBase_fuzzer_defaults",
+    host_supported: true,
+    static_libs: [
+        "libhidlbase",
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libutils",
+        "libprocessgroup",
+        "libjsoncpp",
+        "libcgrouprc",
+        "libcgrouprc_format",
+        "libfmq",
+    ],
+    target: {
+        android: {
+            shared_libs: [
+                "libvndksupport",
+            ],
+        },
+    },
+    fuzz_config: {
+        cc: [
+            "smoreland@google.com",
+            "elsk@google.com",
+        ],
+        componentid: 155276,
+        hotlists: [
+            "4593311",
+        ],
+        description: "The fuzzers target the APIs of libhidlbase library",
+        vector: "local_no_privileges_required",
+        service_privilege: "privileged",
+        users: "multi_user",
+        fuzzed_code_usage: "shipped",
+    },
+}
+
+cc_fuzz {
+    name: "libHidlBase_parcel_fuzzer",
+    srcs: ["libHidlBase_parcel_fuzzer.cpp"],
+    defaults: ["libHidlBase_fuzzer_defaults"],
+}
diff --git a/fuzzer/README.md b/fuzzer/README.md
new file mode 100644
index 0000000..709cc19
--- /dev/null
+++ b/fuzzer/README.md
@@ -0,0 +1,29 @@
+# Fuzzer for libhidlbase
+
+## Table of contents
++ [libHidlBase_parcel_fuzzer](#libHidlBaseParcel)
+
+# <a name="libHidlBaseParcel"></a> Fuzzer for libHidlBaseParcel
+
+libHidlBaseParcel supports the following parameters:
+
+1. ParentHandle (parameter name: "parentHandle")
+2. ParentOffset (parameter name: "parentOffset")
+3. HidlString (parameter name: "hidlString")
+
+| Parameter| Valid Values| Configured Value|
+|------------- |-------------| ----- |
+|`parentHandle`| `Integer` |Value obtained from FuzzedDataProvider|
+|`parentOffset`| `Integer` |Value obtained from FuzzedDataProvider|
+|`hidlString`| `Structure` |Value obtained from FuzzedDataProvider|
+
+#### Steps to run
+1. Build the fuzzer
+```
+  $ make libHidlBase_parcel_fuzzer
+```
+2. To run on device
+```
+  $ adb sync data
+  $ adb shell /data/fuzz/arm64/libHidlBase_parcel_fuzzer/libHidlBase_parcel_fuzzer
+```
diff --git a/fuzzer/libHidlBase_fuzzer_helper.h b/fuzzer/libHidlBase_fuzzer_helper.h
new file mode 100644
index 0000000..53726dc
--- /dev/null
+++ b/fuzzer/libHidlBase_fuzzer_helper.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#ifndef _LIBHIDLBASE_FUZZER_HELPER_H
+#define _LIBHIDLBASE_FUZZER_HELPER_H
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <hidl/HidlBinderSupport.h>
+
+using namespace android;
+using namespace hardware;
+using namespace details;
+
+constexpr uint32_t kMaxBytes = 256;
+constexpr uint32_t kMin = 0;
+
+hidl_string createHidlString(FuzzedDataProvider& fdp) {
+    auto invokeHidlString = fdp.PickValueInArray<const std::function<hidl_string()>>({
+            [&]() { return hidl_string(fdp.ConsumeRandomLengthString(kMaxBytes)); },
+            [&]() { return hidl_string((fdp.ConsumeRandomLengthString(kMaxBytes)).c_str()); },
+            [&]() {
+                std::string testString = fdp.ConsumeRandomLengthString(kMaxBytes);
+                return hidl_string(testString.c_str(),
+                                   fdp.ConsumeIntegralInRange<uint32_t>(kMin, testString.length()));
+            },
+            [&]() { return fdp.ConsumeRandomLengthString(kMaxBytes); },
+    });
+    return invokeHidlString();
+}
+
+hidl_memory createHidlMemory(FuzzedDataProvider& fdp) {
+    if (fdp.ConsumeBool()) {
+        return hidl_memory();
+    }
+    return hidl_memory(createHidlString(fdp), hidl_handle(),
+                       fdp.ConsumeIntegral<uint64_t>() /* size */);
+}
+
+Status createStatus(FuzzedDataProvider& fdp) {
+    auto invokeStatus = fdp.PickValueInArray<const std::function<Status()>>({
+            [&]() { return Status::fromExceptionCode(fdp.ConsumeIntegral<uint32_t>()); },
+            [&]() {
+                return Status::fromExceptionCode(
+                        fdp.ConsumeIntegral<uint32_t>(),
+                        (fdp.ConsumeRandomLengthString(kMaxBytes)).c_str());
+            },
+            [&]() { return Status::fromStatusT(fdp.ConsumeIntegral<uint32_t>()); },
+            [&]() { return Status(); },
+    });
+    return invokeStatus();
+}
+
+#endif  // _LIBHIDLBASE_FUZZER_HELPER_H
diff --git a/fuzzer/libHidlBase_parcel_fuzzer.cpp b/fuzzer/libHidlBase_parcel_fuzzer.cpp
new file mode 100644
index 0000000..88c20c3
--- /dev/null
+++ b/fuzzer/libHidlBase_parcel_fuzzer.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <hidl/HidlBinderSupport.h>
+#include <libHidlBase_fuzzer_helper.h>
+
+constexpr size_t kMinByte = 0;
+constexpr size_t kMaxByte = 256;
+constexpr uint32_t kNumFds = 0;
+constexpr uint32_t kNumInts = 1;
+constexpr uint32_t kMinSize = 1;
+constexpr uint32_t kMaxSize = 1000;
+constexpr uint32_t kMax = 1024;
+
+class HidlBaseParcelFuzzer {
+  public:
+    HidlBaseParcelFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){};
+    void process();
+
+  private:
+    void createRandomParcel(Parcel& parcel);
+
+    FuzzedDataProvider mFdp;
+};
+
+void HidlBaseParcelFuzzer::createRandomParcel(Parcel& parcel) {
+    uint32_t iterCount = mFdp.ConsumeIntegralInRange<uint32_t>(kMin, kMax);
+    for (uint32_t idx = 0; idx < iterCount; ++idx) {
+        auto invokeHidlBaseParcelWriteAPI = mFdp.PickValueInArray<const std::function<void()>>({
+                [&]() {
+                    hidl_memory memory;
+                    native_handle_t* testNativeHandle = nullptr;
+                    if (mFdp.ConsumeBool()) {
+                        memory = createHidlMemory(mFdp);
+                    } else {
+                        hidl_string hidlString = createHidlString(mFdp);
+                        testNativeHandle = native_handle_create(
+                                mFdp.ConsumeIntegralInRange<uint32_t>(kMin, NATIVE_HANDLE_MAX_FDS),
+                                mFdp.ConsumeIntegralInRange<uint32_t>(kMin,
+                                                                      NATIVE_HANDLE_MAX_INTS));
+                        memory = hidl_memory(hidlString, testNativeHandle,
+                                             mFdp.ConsumeIntegral<uint64_t>());
+                    }
+                    writeEmbeddedToParcel(
+                            memory, &parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                    native_handle_close(testNativeHandle);
+                    native_handle_delete(testNativeHandle);
+                },
+                [&]() {
+                    MQDescriptorSync<uint8_t> descriptorSync;
+                    auto testHandle = native_handle_create(kNumFds, kNumInts);
+                    uint32_t size = sizeof(uint8_t);
+                    testHandle->data[0] = size;
+                    uint32_t bufferSize = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize);
+                    if (mFdp.ConsumeBool()) {
+                        std::vector<GrantorDescriptor> grantDescriptor(bufferSize);
+                        for (size_t idx = 0; idx < bufferSize; ++idx) {
+                            grantDescriptor[idx] = {mFdp.ConsumeIntegral<uint32_t>() /* flags */,
+                                                    mFdp.ConsumeIntegral<uint32_t>() /* fdIndex */,
+                                                    mFdp.ConsumeIntegral<uint32_t>() /* offset */,
+                                                    mFdp.ConsumeIntegral<uint64_t>() /* extent */};
+                        }
+                        descriptorSync =
+                                MQDescriptorSync<uint8_t>{grantDescriptor, testHandle, size};
+                    } else {
+                        descriptorSync = MQDescriptorSync<uint8_t>{bufferSize, testHandle, size,
+                                                                   mFdp.ConsumeBool()};
+                    }
+                    writeEmbeddedToParcel(
+                            descriptorSync, &parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                },
+                [&]() {
+                    native_handle_t* testNativeHandle = native_handle_create(
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMin, NATIVE_HANDLE_MAX_FDS),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMin, NATIVE_HANDLE_MAX_INTS));
+                    writeEmbeddedToParcel(
+                            testNativeHandle, &parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                    native_handle_close(testNativeHandle);
+                    native_handle_delete(testNativeHandle);
+                },
+                [&]() {
+                    Status status = createStatus(mFdp);
+                    writeToParcel(status, &parcel);
+                },
+                [&]() {
+                    auto parcelSize = mFdp.ConsumeIntegralInRange<size_t>(kMinByte, kMaxByte);
+                    std::vector<uint8_t> data = mFdp.ConsumeBytes<uint8_t>(parcelSize);
+                    parcel.write(data.data(), data.size());
+                },
+        });
+        invokeHidlBaseParcelWriteAPI();
+    }
+}
+
+void HidlBaseParcelFuzzer::process() {
+    Parcel parcel;
+    size_t originalPosition = parcel.dataPosition();
+    createRandomParcel(parcel);
+    parcel.setDataPosition(originalPosition);
+    while (mFdp.remaining_bytes()) {
+        auto invokeHidlBaseParcelAPI = mFdp.PickValueInArray<const std::function<void()>>({
+                [&]() {
+                    hidl_memory memory = createHidlMemory(mFdp);
+                    readEmbeddedFromParcel(
+                            memory, parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                },
+                [&]() {
+                    MQDescriptorSync<uint8_t> descriptorSync;
+                    readEmbeddedFromParcel(
+                            descriptorSync, parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                },
+                [&]() {
+                    hidl_handle handle;
+                    readEmbeddedFromParcel(
+                            handle, parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                },
+                [&]() {
+                    hidl_string hidlString = createHidlString(mFdp);
+                    readEmbeddedFromParcel(
+                            hidlString, parcel,
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize),
+                            mFdp.ConsumeIntegralInRange<uint32_t>(kMinSize, kMaxSize));
+                },
+                [&]() {
+                    Status status = createStatus(mFdp);
+                    readFromParcel(&status, parcel);
+                },
+        });
+        invokeHidlBaseParcelAPI();
+    }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    HidlBaseParcelFuzzer hidlBaseParcelFuzzer(data, size);
+    hidlBaseParcelFuzzer.process();
+    return 0;
+}
diff --git a/libhidlmemory/Android.bp b/libhidlmemory/Android.bp
index fc5770c..063cd8e 100644
--- a/libhidlmemory/Android.bp
+++ b/libhidlmemory/Android.bp
@@ -34,10 +34,7 @@ cc_library {
             enabled: false,
         },
     },
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
+    double_loadable: true,
     apex_available: [
         "//apex_available:platform",
         "com.android.neuralnetworks",
diff --git a/libhidlmemory/AshmemMemory.h b/libhidlmemory/AshmemMemory.h
new file mode 100644
index 0000000..ffb9c00
--- /dev/null
+++ b/libhidlmemory/AshmemMemory.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <android/hidl/memory/1.0/IMemory.h>
+#include <hidl/Status.h>
+#include <inttypes.h>
+#include <log/log.h>
+#include <sys/mman.h>
+
+namespace android {
+namespace hardware {
+namespace impl {
+
+using ::android::sp;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::hidl::memory::V1_0::IMemory;
+
+struct AshmemMemory : public IMemory {
+    AshmemMemory(const hidl_memory& memory, void* data) : mMemory(memory), mData(data) {}
+
+    ~AshmemMemory() { munmap(mData, mMemory.size()); }
+
+    // Methods from ::android::hidl::memory::V1_0::IMemory follow.
+    Return<void*> getPointer() override { return mData; }
+    Return<uint64_t> getSize() override { return mMemory.size(); }
+    // NOOPs (since non0remoted memory)
+    Return<void> update() override { return Void(); }
+    Return<void> updateRange(uint64_t /*start*/, uint64_t /*length*/) override { return Void(); }
+    Return<void> read() override { return Void(); }
+    Return<void> readRange(uint64_t /*start*/, uint64_t /*length*/) override { return Void(); }
+    Return<void> commit() override { return Void(); }
+
+  private:
+    // Holding onto hidl_memory reference because it contains
+    // handle and size, and handle will also be required for
+    // the remoted case.
+    hidl_memory mMemory;
+
+    // Mapped memory in process.
+    void* mData;
+};
+
+}  // namespace impl
+}  // namespace hardware
+}  // namespace android
diff --git a/libhidlmemory/mapping.cpp b/libhidlmemory/mapping.cpp
index 8f0bcf4..3fcc354 100644
--- a/libhidlmemory/mapping.cpp
+++ b/libhidlmemory/mapping.cpp
@@ -19,6 +19,7 @@
 #include <mutex>
 #include <string>
 
+#include <AshmemMemory.h>
 #include <hidlmemory/mapping.h>
 
 #include <android-base/logging.h>
@@ -35,6 +36,33 @@ namespace hardware {
 
 static std::map<std::string, sp<IMapper>> gMappersByName;
 static std::mutex gMutex;
+static std::once_flag gOnceFlagLog;
+
+static sp<IMemory> createAshmemMemory(const hidl_memory& mem) {
+    if (mem.handle()->numFds == 0) {
+        return nullptr;
+    }
+
+    // If ashmem service runs in 32-bit (size_t is uint32_t) and a 64-bit
+    // client process requests a memory > 2^32 bytes, the size would be
+    // converted to a 32-bit number in mmap. mmap could succeed but the
+    // mapped memory's actual size would be smaller than the reported size.
+    if (mem.size() > SIZE_MAX) {
+        ALOGE("Cannot map %" PRIu64 " bytes of memory because it is too large.", mem.size());
+        android_errorWriteLog(0x534e4554, "79376389");
+        return nullptr;
+    }
+
+    int fd = mem.handle()->data[0];
+    void* data = mmap(0, mem.size(), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+    if (data == MAP_FAILED) {
+        // mmap never maps at address zero without MAP_FIXED, so we can avoid
+        // exposing clients to MAP_FAILED.
+        return nullptr;
+    }
+
+    return new impl::AshmemMemory(mem, data);
+}
 
 static inline sp<IMapper> getMapperService(const std::string& name) {
     std::unique_lock<std::mutex> _lock(gMutex);
@@ -55,8 +83,14 @@ sp<IMemory> mapMemory(const hidl_memory& memory) {
     sp<IMapper> mapper = getMapperService(memory.name());
 
     if (mapper == nullptr) {
-        LOG(ERROR) << "Could not fetch mapper for " << memory.name() << " shared memory";
-        return nullptr;
+        if (memory.name() == "ashmem") {
+            std::call_once(gOnceFlagLog,
+                           [&]() { LOG(INFO) << "Using libhidlmemory mapper for ashmem."; });
+            return createAshmemMemory(memory);
+        } else {
+            LOG(ERROR) << "Could not fetch mapper for " << memory.name() << " shared memory";
+            return nullptr;
+        }
     }
 
     if (mapper->isRemote()) {
diff --git a/test_main.cpp b/test_main.cpp
index 8681375..f4f7fe1 100644
--- a/test_main.cpp
+++ b/test_main.cpp
@@ -23,6 +23,10 @@
 #pragma clang diagnostic pop
 
 #include <android-base/logging.h>
+#include <android-base/properties.h>
+#ifdef __ANDROID__
+#include <android/api-level.h>
+#endif
 #include <android/hidl/memory/1.0/IMemory.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
@@ -33,12 +37,6 @@
 #include <fstream>
 #include <vector>
 
-#ifdef __ANDROID__
-static bool kAndroid = true;
-#else
-static bool kAndroid = false;
-#endif
-
 #define EXPECT_ARRAYEQ(__a1__, __a2__, __size__) EXPECT_TRUE(isArrayEqual(__a1__, __a2__, __size__))
 #define EXPECT_2DARRAYEQ(__a1__, __a2__, __size1__, __size2__) \
         EXPECT_TRUE(is2dArrayEqual(__a1__, __a2__, __size1__, __size2__))
@@ -633,18 +631,26 @@ TEST_F(LibHidlTest, StatusStringTest) {
 TEST_F(LibHidlTest, PreloadTest) {
     // HIDL doesn't have support to load passthrough implementations on host, but we
     // could do this by loading implementations from the output directory
-    if (!kAndroid) GTEST_SKIP();
-
+#ifndef __ANDROID__
+    GTEST_SKIP();
+#else
     using ::android::hardware::preloadPassthroughService;
     using ::android::hidl::memory::V1_0::IMemory;
 
-    // installed on all devices by default in both bitnesses and not otherwise a dependency of this
+    // android.hidl.memory@1.0-impl.so is installed on all devices by default up
+    // to Android U in both bitnesses and not otherwise a dependency of this
+    // test.
+    // Android V+ devices do not have this installed by default, so skip the
     // test.
+    if (android::base::GetIntProperty("ro.vendor.api_level", 0) >= __ANDROID_API_V__) {
+        GTEST_SKIP();
+    }
     static const std::string kLib = "android.hidl.memory@1.0-impl.so";
 
     EXPECT_FALSE(isLibraryOpen(kLib));
     preloadPassthroughService<IMemory>();
     EXPECT_TRUE(isLibraryOpen(kLib));
+#endif
 }
 
 template <typename T, size_t start, size_t end>
diff --git a/transport/Android.bp b/transport/Android.bp
index 10f31a7..e06a29f 100644
--- a/transport/Android.bp
+++ b/transport/Android.bp
@@ -24,3 +24,8 @@ package {
 hidl_package_root {
     name: "android.hidl",
 }
+
+filegroup {
+    name: "checked_in_hidl_current",
+    srcs: ["current.txt"],
+}
diff --git a/transport/ServiceManagement.cpp b/transport/ServiceManagement.cpp
index f3ee611..b5e02df 100644
--- a/transport/ServiceManagement.cpp
+++ b/transport/ServiceManagement.cpp
@@ -17,6 +17,7 @@
 #define LOG_TAG "HidlServiceManagement"
 
 #ifdef __ANDROID__
+#include <android/api-level.h>
 #include <android/dlext.h>
 #endif  // __ANDROID__
 
@@ -44,6 +45,7 @@
 #include <android-base/properties.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <hwbinder/HidlSupport.h>
 #include <hwbinder/IPCThreadState.h>
 #include <hwbinder/Parcel.h>
 #if !defined(__ANDROID_RECOVERY__) && defined(__ANDROID__)
@@ -70,19 +72,8 @@ static constexpr bool kIsRecovery = true;
 static constexpr bool kIsRecovery = false;
 #endif
 
-static void waitForHwServiceManager() {
-    // TODO(b/31559095): need bionic host so that we can use 'prop_info' returned
-    // from WaitForProperty
-#ifdef __ANDROID__
-    static const char* kHwServicemanagerReadyProperty = "hwservicemanager.ready";
-
-    using std::literals::chrono_literals::operator""s;
-
-    using android::base::WaitForProperty;
-    while (!WaitForProperty(kHwServicemanagerReadyProperty, "true", 1s)) {
-        LOG(WARNING) << "Waited for hwservicemanager.ready for a second, waiting another...";
-    }
-#endif  // __ANDROID__
+bool isHidlSupported() {
+    return isHwbinderSupportedBlocking();
 }
 
 static std::string binaryName() {
@@ -209,9 +200,6 @@ static bool isServiceManager(const hidl_string& fqName) {
     return fqName == IServiceManager1_0::descriptor || fqName == IServiceManager1_1::descriptor ||
            fqName == IServiceManager1_2::descriptor;
 }
-static bool isHwServiceManagerInstalled() {
-    return access("/system/bin/hwservicemanager", F_OK) == 0;
-}
 
 /*
  * A replacement for hwservicemanager when it is not installed on a device.
@@ -222,7 +210,7 @@ static bool isHwServiceManagerInstalled() {
  * to be able service the requests and tell clients there are no services
  * registered.
  */
-struct NoHwServiceManager : public IServiceManager1_2 {
+struct NoHwServiceManager : public IServiceManager1_2, hidl_death_recipient {
     Return<sp<IBase>> get(const hidl_string& fqName, const hidl_string&) override {
         sp<IBase> ret = nullptr;
 
@@ -238,9 +226,15 @@ struct NoHwServiceManager : public IServiceManager1_2 {
     }
 
     Return<Transport> getTransport(const hidl_string& fqName, const hidl_string& name) {
+        // We pretend like IServiceManager is declared for
+        // IServiceManager::getService to return this NoHwServiceManager
+        // instance
+        if (isServiceManager(fqName)) {
+            return Transport::HWBINDER;
+        }
         LOG(INFO) << "Trying to get transport of " << fqName << "/" << name
                   << " without hwservicemanager";
-        return Transport::PASSTHROUGH;
+        return Transport::EMPTY;
     }
 
     Return<void> list(list_cb _hidl_cb) override {
@@ -254,11 +248,49 @@ struct NoHwServiceManager : public IServiceManager1_2 {
         return Void();
     }
 
+    void serviceDied(uint64_t /* cookie */, const wp<IBase>& who) override {
+        sp<IBase> promoted = who.promote();
+        if (promoted) {
+            bool removed = false;
+            for (auto [name, callbacks] : mServiceNotifications) {
+                for (auto it = callbacks.begin(); it != callbacks.end();) {
+                    if (interfacesEqual(*it, promoted)) {
+                        callbacks.erase(it);
+                        removed = true;
+                    }
+                    it++;
+                }
+                if (removed) return;
+            }
+        }
+        LOG(ERROR) << "Could not find a registered callback for a service who died. "
+                   << "Service pointer: " << who.promote().get();
+    }
+
     Return<bool> registerForNotifications(const hidl_string& fqName, const hidl_string& name,
-                                          const sp<IServiceNotification>& /* callback */) override {
-        LOG(INFO) << "Cannot register for notifications for " << fqName << "/" << name
-                  << " without hwservicemanager";
-        return false;
+                                          const sp<IServiceNotification>& callback) override {
+        LOG(INFO) << "Will not get any notifications for " << fqName << "/" << name
+                  << " without hwservicemanager but keeping the callback.";
+        if (callback == nullptr) {
+            LOG(ERROR) << "Cannot register a null callback for " << fqName << "/" << name;
+            return false;
+        }
+        bool ret = callback->linkToDeath(this, 0);
+        if (!ret) {
+            LOG(ERROR) << "Failed to register death recipient for " << fqName << "/" << name;
+            return false;
+        }
+
+        auto [it, inserted] = mServiceNotifications[static_cast<std::string>(fqName) + "/" +
+                                                    static_cast<std::string>(name)]
+                                      .insert(callback);
+        if (!inserted) {
+            LOG(WARNING) << "This callback for " << fqName << "/" << name
+                         << " was already registered so "
+                         << "we are not keeping a reference to this one.";
+            return false;
+        }
+        return true;
     }
 
     Return<void> debugDump(debugDump_cb _hidl_cb) override {
@@ -274,13 +306,19 @@ struct NoHwServiceManager : public IServiceManager1_2 {
         return Void();
     }
 
-    Return<bool> unregisterForNotifications(
-            const hidl_string& fqName, const hidl_string& name,
-            const sp<IServiceNotification>& /* callback */) override {
-        LOG(INFO) << "Cannot unregister for notifications for " << fqName << "/" << name
-                  << " without hwservicemanager";
-        return false;
+    Return<bool> unregisterForNotifications(const hidl_string& fqName, const hidl_string& name,
+                                            const sp<IServiceNotification>& callback) override {
+        auto ret = mServiceNotifications[static_cast<std::string>(fqName) + "/" +
+                                         static_cast<std::string>(name)]
+                           .erase(callback);
+        if (!ret) {
+            LOG(WARNING) << "This callback for " << fqName << "/" << name << " was not previously "
+                         << "registered so there is nothing to do.";
+            return false;
+        }
+        return true;
     }
+
     Return<bool> registerClientCallback(const hidl_string& fqName, const hidl_string& name,
                                         const sp<IBase>&, const sp<IClientCallback>&) {
         LOG(INFO) << "Cannot add client callback for " << fqName << "/" << name
@@ -306,6 +344,9 @@ struct NoHwServiceManager : public IServiceManager1_2 {
                   << " without hwservicemanager";
         return false;
     }
+
+  private:
+    std::map<std::string, std::set<sp<IServiceNotification>>> mServiceNotifications;
 };
 
 sp<IServiceManager1_2> defaultServiceManager1_2() {
@@ -321,19 +362,18 @@ sp<IServiceManager1_2> defaultServiceManager1_2() {
             return gDefaultServiceManager;
         }
 
-        if (!isHwServiceManagerInstalled()) {
-            // hwservicemanager is not available on this device.
-            gDefaultServiceManager = sp<NoHwServiceManager>::make();
-            return gDefaultServiceManager;
-        }
-
         if (access("/dev/hwbinder", F_OK|R_OK|W_OK) != 0) {
             // HwBinder not available on this device or not accessible to
             // this process.
             return nullptr;
         }
 
-        waitForHwServiceManager();
+        if (!isHidlSupported()) {
+            // hwservicemanager is not available on this device.
+            LOG(WARNING) << "hwservicemanager is not supported on the device.";
+            gDefaultServiceManager = sp<NoHwServiceManager>::make();
+            return gDefaultServiceManager;
+        }
 
         while (gDefaultServiceManager == nullptr) {
             gDefaultServiceManager =
@@ -526,7 +566,7 @@ struct PassthroughServiceManager : IServiceManager1_1 {
         // This is required to run without hwservicemanager while we have
         // passthrough HIDL services. Once the passthrough HIDL services have
         // been removed, the PassthroughServiceManager will no longer be needed.
-        if (!isHwServiceManagerInstalled() && isServiceManager(fqName)) {
+        if (!isHidlSupported() && isServiceManager(fqName)) {
             return defaultServiceManager1_2();
         }
 
diff --git a/transport/allocator/1.0/default/Android.bp b/transport/allocator/1.0/default/Android.bp
index 42abe9c..d739cd8 100644
--- a/transport/allocator/1.0/default/Android.bp
+++ b/transport/allocator/1.0/default/Android.bp
@@ -31,6 +31,7 @@ cc_binary {
     ],
     init_rc: ["android.hidl.allocator@1.0-service.rc"],
     vintf_fragments: ["android.hidl.allocator@1.0-service.xml"],
+    system_ext_specific: true,
 
     shared_libs: [
         "android.hidl.allocator@1.0",
diff --git a/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.rc b/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.rc
index 4f05523..a0ffbad 100644
--- a/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.rc
+++ b/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.rc
@@ -1,4 +1,7 @@
-service hidl_memory /system/bin/hw/android.hidl.allocator@1.0-service
+service hidl_memory /system/system_ext/bin/hw/android.hidl.allocator@1.0-service
     class hal
     user system
     group system
+
+on property:hidl_memory.disabled=true
+   stop hidl_memory
diff --git a/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.xml b/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.xml
index 5218241..6fa909b 100644
--- a/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.xml
+++ b/transport/allocator/1.0/default/android.hidl.allocator@1.0-service.xml
@@ -1,5 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal>
+    <hal max-level="8">
         <name>android.hidl.allocator</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
diff --git a/transport/allocator/1.0/default/service.cpp b/transport/allocator/1.0/default/service.cpp
index 63babd3..d918aae 100644
--- a/transport/allocator/1.0/default/service.cpp
+++ b/transport/allocator/1.0/default/service.cpp
@@ -4,24 +4,43 @@
 
 #include <android-base/logging.h>
 #include <android/hidl/allocator/1.0/IAllocator.h>
+#include <android/hidl/manager/1.2/IServiceManager.h>
+#include <cutils/properties.h>
 #include <hidl/HidlTransportSupport.h>
 
+using android::sp;
+using android::status_t;
 using android::hardware::configureRpcThreadpool;
 using android::hardware::joinRpcThreadpool;
 using android::hidl::allocator::V1_0::IAllocator;
 using android::hidl::allocator::V1_0::implementation::AshmemAllocator;
-using android::sp;
-using android::status_t;
+using android::hidl::manager::V1_2::IServiceManager;
+
+static constexpr char kInstanceName[] = "ashmem";
 
 int main() {
     configureRpcThreadpool(1, true /* callerWillJoin */);
 
     sp<IAllocator> allocator = new AshmemAllocator();
 
-    status_t status = allocator->registerAsService("ashmem");
-
-    if (android::OK != status) {
-        LOG(FATAL) << "Unable to register allocator service: " << status;
+    IServiceManager::Transport transport =
+            android::hardware::defaultServiceManager1_2()->getTransport(IAllocator::descriptor,
+                                                                        kInstanceName);
+    if (transport == IServiceManager::Transport::HWBINDER) {
+        status_t status = allocator->registerAsService(kInstanceName);
+        if (android::OK != status) {
+            LOG(FATAL) << "Unable to register allocator service: " << status;
+            return -1;
+        }
+    } else {
+        LOG(INFO) << IAllocator::descriptor << "/" << kInstanceName
+                  << " is not registered in the VINTF manifest as it is deprecated.";
+        // The transport won't change at run time, so make sure we don't restart
+        int rc = property_set("hidl_memory.disabled", "true");
+        if (rc) {
+            LOG_ALWAYS_FATAL("Failed to set \"hidl_memory.disabled\" (error %d).\"", rc);
+        }
+        return 0;
     }
 
     joinRpcThreadpool();
diff --git a/transport/allocator/1.0/utils/Android.bp b/transport/allocator/1.0/utils/Android.bp
index f21047d..7ac7c01 100644
--- a/transport/allocator/1.0/utils/Android.bp
+++ b/transport/allocator/1.0/utils/Android.bp
@@ -24,9 +24,6 @@ package {
 cc_library {
     name: "libhidlallocatorutils",
     vendor_available: true,
-    vndk: {
-        enabled: true,
-    },
     double_loadable: true,
     defaults: ["libhidl-defaults"],
     shared_libs: [
diff --git a/transport/allocator/1.0/vts/functional/Android.bp b/transport/allocator/1.0/vts/functional/Android.bp
index f53fc4f..58047cb 100644
--- a/transport/allocator/1.0/vts/functional/Android.bp
+++ b/transport/allocator/1.0/vts/functional/Android.bp
@@ -15,6 +15,7 @@
 //
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "system_libhidl_license"
@@ -33,5 +34,8 @@ cc_test {
     static_libs: [
         "android.hidl.allocator@1.0",
     ],
-    test_suites: ["general-tests", "vts"],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
 }
diff --git a/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp b/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
index 340ec0c..b824a3e 100644
--- a/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
+++ b/transport/allocator/1.0/vts/functional/VtsHidlAllocatorV1_0TargetTest.cpp
@@ -122,6 +122,7 @@ TEST_P(AllocatorHidlTest, TestCommit) {
     }
 }
 
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(AllocatorHidlTest);
 INSTANTIATE_TEST_SUITE_P(
         PerInstance, AllocatorHidlTest,
         testing::ValuesIn(android::hardware::getAllHalInstanceNames(IAllocator::descriptor)),
diff --git a/transport/base/1.0/vts/functional/Android.bp b/transport/base/1.0/vts/functional/Android.bp
index a2a3484..a5a7c33 100644
--- a/transport/base/1.0/vts/functional/Android.bp
+++ b/transport/base/1.0/vts/functional/Android.bp
@@ -13,6 +13,7 @@
 // limitations under the License.
 
 package {
+    default_team: "trendy_team_android_kernel",
     // See: http://go/android-license-faq
     // A large-scale-change added 'default_applicable_licenses' to import
     // all of the 'license_kinds' from "system_libhidl_license"
diff --git a/transport/base/1.0/vts/functional/vts_ibase_test.cpp b/transport/base/1.0/vts/functional/vts_ibase_test.cpp
index 6372631..f8f8b33 100644
--- a/transport/base/1.0/vts/functional/vts_ibase_test.cpp
+++ b/transport/base/1.0/vts/functional/vts_ibase_test.cpp
@@ -81,7 +81,7 @@ pid_t GetServiceDebugPid(const std::string& service) {
 std::map<std::string, std::vector<Hal>> gDeclaredServiceHalMap;
 std::mutex gDeclaredServiceHalMapMutex;
 
-void GetHal(const std::string& service, const FqInstance& instance) {
+void GetHal(const sp<IServiceManager> &manager, const std::string& service, const FqInstance& instance) {
     if (instance.getFqName().string() == IBase::descriptor) {
         return;
     }
@@ -89,6 +89,23 @@ void GetHal(const std::string& service, const FqInstance& instance) {
     sp<IBase> hal = android::hardware::details::getRawServiceInternal(
             instance.getFqName().string(), instance.getInstance(), true /*retry*/,
             false /*getStub*/);
+
+    // Check transport of manifest to support hardware SKU:
+    // Don't add service to gDeclaredServiceHalMap if hal instance is null and
+    // the transport of the declared interface is not present in manifest. Because
+    // manufacturer may disable this hal service in the current hardware SKU,
+    // but enable it in the other hardware SKU.
+    if (hal == nullptr && manager != nullptr) {
+        auto transport = manager->getTransport(instance.getFqName().string(),
+            instance.getInstance());
+        if(transport == IServiceManager::Transport::EMPTY){
+            LOG(WARNING)
+                << "Ignore, because Service '" << service << "' is not running,"
+                << " its interface '" << instance.string() << "' is not present in manifest.";
+            return;
+        }
+    }
+
     // Add to gDeclaredServiceHalMap if getRawServiceInternal() returns (even if
     // the returned HAL is null). getRawServiceInternal() won't return if the
     // HAL is in the VINTF but unable to start.
@@ -138,7 +155,9 @@ class VtsHalBaseV1_0TargetTest : public ::testing::Test {
             }
         }));
 
-        ASSERT_FALSE(all_hals_.empty());  // sanity
+        if (all_hals_.empty()) {
+            GTEST_SKIP() << "No HIDL HAls on this device.";
+        }
     }
 
     void EachHal(const std::function<void(const Hal&)>& check) {
@@ -235,6 +254,7 @@ TEST_F(VtsHalBaseV1_0TargetTest, ServiceProvidesAndDeclaresTheSameInterfaces) {
     const Result<ServiceInterfacesMap> service_interfaces_map =
             android::init::GetOnDeviceServiceInterfacesMap();
     ASSERT_RESULT_OK(service_interfaces_map);
+    auto service_manager = ::android::hardware::defaultServiceManager();
 
     std::map<std::string, std::set<FqInstance>> hidl_interfaces_map;
 
@@ -253,7 +273,7 @@ TEST_F(VtsHalBaseV1_0TargetTest, ServiceProvidesAndDeclaresTheSameInterfaces) {
                 ASSERT_TRUE(fqInstance.setTo(interface))
                         << "Unable to parse interface: '" << interface << "'";
 
-                std::thread(GetHal, service, fqInstance).detach();
+                std::thread(GetHal, service_manager, service, fqInstance).detach();
                 hidl_interfaces_map[service].insert(fqInstance);
             }
         }
diff --git a/transport/include/hidl/ServiceManagement.h b/transport/include/hidl/ServiceManagement.h
index 886e816..715f27e 100644
--- a/transport/include/hidl/ServiceManagement.h
+++ b/transport/include/hidl/ServiceManagement.h
@@ -70,6 +70,9 @@ status_t registerAsServiceInternal(const sp<::android::hidl::base::V1_0::IBase>&
                                    const std::string& name);
 }  // namespace details
 
+// Returns whether or not HIDL is supported on this device
+bool isHidlSupported();
+
 // These functions are for internal use by hidl. If you want to get ahold
 // of an interface, the best way to do this is by calling IFoo::getService()
 sp<::android::hidl::manager::V1_0::IServiceManager> defaultServiceManager();
diff --git a/transport/memory/1.0/Android.bp b/transport/memory/1.0/Android.bp
index 8e066a9..e1b03b2 100644
--- a/transport/memory/1.0/Android.bp
+++ b/transport/memory/1.0/Android.bp
@@ -14,10 +14,6 @@ hidl_interface {
     root: "android.hidl",
     // TODO(b/153609531): remove when no longer needed.
     native_bridge_supported: true,
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
     srcs: [
         "IMapper.hal",
         "IMemory.hal",
diff --git a/transport/memory/1.0/default/Android.bp b/transport/memory/1.0/default/Android.bp
index a44a0db..c0dd3b7 100644
--- a/transport/memory/1.0/default/Android.bp
+++ b/transport/memory/1.0/default/Android.bp
@@ -24,10 +24,6 @@ package {
 cc_library_shared {
     name: "android.hidl.memory@1.0-impl",
     vendor_available: true,
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
     compile_multilib: "both",
     relative_install_path: "hw",
     defaults: ["libhidl-defaults"],
diff --git a/transport/memory/token/1.0/Android.bp b/transport/memory/token/1.0/Android.bp
index c304284..c7a099e 100644
--- a/transport/memory/token/1.0/Android.bp
+++ b/transport/memory/token/1.0/Android.bp
@@ -14,10 +14,6 @@ hidl_interface {
     root: "android.hidl",
     // TODO(b/153609531): remove when no longer needed.
     native_bridge_supported: true,
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
     srcs: [
         "IMemoryToken.hal",
     ],
diff --git a/transport/safe_union/1.0/Android.bp b/transport/safe_union/1.0/Android.bp
index cae92dd..45c010f 100644
--- a/transport/safe_union/1.0/Android.bp
+++ b/transport/safe_union/1.0/Android.bp
@@ -12,10 +12,6 @@ package {
 hidl_interface {
     name: "android.hidl.safe_union@1.0",
     root: "android.hidl",
-    vndk: {
-        enabled: true,
-        support_system_process: true,
-    },
     srcs: [
         "types.hal",
     ],
diff --git a/transport/token/1.0/Android.bp b/transport/token/1.0/Android.bp
index 8bda482..88fd909 100644
--- a/transport/token/1.0/Android.bp
+++ b/transport/token/1.0/Android.bp
@@ -12,9 +12,6 @@ package {
 hidl_interface {
     name: "android.hidl.token@1.0",
     root: "android.hidl",
-    vndk: {
-        enabled: true,
-    },
     srcs: [
         "ITokenManager.hal",
     ],
diff --git a/transport/token/1.0/utils/Android.bp b/transport/token/1.0/utils/Android.bp
index 84f6f0f..a58d730 100644
--- a/transport/token/1.0/utils/Android.bp
+++ b/transport/token/1.0/utils/Android.bp
@@ -32,9 +32,6 @@ cc_library {
             enabled: false,
         },
     },
-    vndk: {
-        enabled: true,
-    },
     double_loadable: true,
 
     srcs: [
diff --git a/vintfdata/Android.mk b/vintfdata/Android.mk
index 4c5cca5..ed8f506 100644
--- a/vintfdata/Android.mk
+++ b/vintfdata/Android.mk
@@ -28,15 +28,23 @@ ifdef DEVICE_FRAMEWORK_MANIFEST_FILE
 endif
 
 SYSTEM_EXT_MANIFEST_INPUT_FILES := $(LOCAL_PATH)/system_ext_manifest.default.xml
-ifdef SYSTEM_EXT_MANIFEST_FILES
-  SYSTEM_EXT_MANIFEST_INPUT_FILES += $(SYSTEM_EXT_MANIFEST_FILES)
-endif
 
-# VNDK Version in device compatibility matrix and framework manifest
-ifeq ($(BOARD_VNDK_VERSION),current)
-VINTF_VNDK_VERSION := $(PLATFORM_VNDK_VERSION)
+ifeq ($(PRODUCT_HIDL_ENABLED),true)
+ifneq ($(filter hwservicemanager,$(PRODUCT_PACKAGES)),)
+SYSTEM_EXT_MANIFEST_INPUT_FILES += $(TOPDIR)system/hwservicemanager/hwservicemanager_no_max.xml
 else
-VINTF_VNDK_VERSION := $(BOARD_VNDK_VERSION)
+$(error If PRODUCT_HIDL_ENABLED is set, hwservicemanager must be added to PRODUCT_PACKAGES explicitly)
+endif
+else
+ifneq ($(filter hwservicemanager,$(PRODUCT_PACKAGES)),)
+SYSTEM_EXT_MANIFEST_INPUT_FILES += $(TOPDIR)system/hwservicemanager/hwservicemanager.xml
+else ifneq ($(filter hwservicemanager,$(PRODUCT_PACKAGES_SHIPPING_API_LEVEL_34)),)
+SYSTEM_EXT_MANIFEST_INPUT_FILES += $(TOPDIR)system/hwservicemanager/hwservicemanager.xml
+endif
+endif
+
+ifdef SYSTEM_EXT_MANIFEST_FILES
+  SYSTEM_EXT_MANIFEST_INPUT_FILES += $(SYSTEM_EXT_MANIFEST_FILES)
 endif
 
 # Device Compatibility Matrix
@@ -57,10 +65,9 @@ LOCAL_MODULE_PATH   := $(TARGET_OUT_VENDOR)/etc/vintf
 
 GEN := $(local-generated-sources-dir)/compatibility_matrix.xml
 
-$(GEN): PRIVATE_VINTF_VNDK_VERSION := $(VINTF_VNDK_VERSION)
 $(GEN): PRIVATE_DEVICE_MATRIX_INPUT_FILE := $(DEVICE_MATRIX_INPUT_FILE)
+
 $(GEN): $(DEVICE_MATRIX_INPUT_FILE) $(HOST_OUT_EXECUTABLES)/assemble_vintf
-	REQUIRED_VNDK_VERSION=$(PRIVATE_VINTF_VNDK_VERSION) \
 	BOARD_SYSTEMSDK_VERSIONS="$(BOARD_SYSTEMSDK_VERSIONS)" \
 		$(HOST_OUT_EXECUTABLES)/assemble_vintf \
 		-i $(call normalize-path-list,$(PRIVATE_DEVICE_MATRIX_INPUT_FILE)) \
@@ -125,9 +132,11 @@ LOCAL_SYSTEM_EXT_MODULE := true
 LOCAL_MODULE_RELATIVE_PATH := vintf
 GEN := $(local-generated-sources-dir)/manifest.xml
 $(GEN): PRIVATE_SYSTEM_EXT_MANIFEST_FILES := $(SYSTEM_EXT_MANIFEST_INPUT_FILES)
-$(GEN): PRIVATE_VINTF_VNDK_VERSION := $(VINTF_VNDK_VERSION)
+$(GEN): PRIVATE_PROVIDED_VNDK_VERSIONS := \
+  $(sort $(PRODUCT_EXTRA_VNDK_VERSIONS))
+
 $(GEN): $(SYSTEM_EXT_MANIFEST_INPUT_FILES) $(HOST_OUT_EXECUTABLES)/assemble_vintf
-	PROVIDED_VNDK_VERSIONS="$(PRIVATE_VINTF_VNDK_VERSION) $(PRODUCT_EXTRA_VNDK_VERSIONS)" \
+	PROVIDED_VNDK_VERSIONS="$(PRIVATE_PROVIDED_VNDK_VERSIONS)" \
 	$(HOST_OUT_EXECUTABLES)/assemble_vintf \
 		-i $(call normalize-path-list,$(PRIVATE_SYSTEM_EXT_MANIFEST_FILES)) \
 		-o $@
@@ -135,7 +144,6 @@ $(GEN): $(SYSTEM_EXT_MANIFEST_INPUT_FILES) $(HOST_OUT_EXECUTABLES)/assemble_vint
 LOCAL_PREBUILT_MODULE_FILE := $(GEN)
 include $(BUILD_PREBUILT)
 
-VINTF_VNDK_VERSION :=
 SYSTEM_MANIFEST_INPUT_FILES :=
 SYSTEM_EXT_MANIFEST_INPUT_FILES :=
 DEVICE_MATRIX_INPUT_FILE :=
diff --git a/vintfdata/frozen/8.xml b/vintfdata/frozen/8.xml
new file mode 100644
index 0000000..db34f63
--- /dev/null
+++ b/vintfdata/frozen/8.xml
@@ -0,0 +1,101 @@
+<compatibility-matrix version="7.0" type="device">
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.cameraservice.service</name>
+        <interface>
+            <name>ICameraService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.location.altitude</name>
+        <interface>
+            <name>IAltitudeService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.sensorservice</name>
+        <interface>
+            <name>ISensorManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.frameworks.sensorservice</name>
+        <version>1.0</version>
+        <interface>
+            <name>ISensorManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.frameworks.stats</name>
+        <version>2</version>
+        <interface>
+            <name>IStats</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hardware.media.c2</name>
+        <version>1.2</version>
+        <interface>
+            <name>IComponentStore</name>
+            <instance>software</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.allocator</name>
+        <version>1.0</version>
+        <interface>
+            <name>IAllocator</name>
+            <instance>ashmem</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.manager</name>
+        <version>1.2</version>
+        <interface>
+            <name>IServiceManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.memory</name>
+        <version>1.0</version>
+        <interface>
+            <name>IMapper</name>
+            <instance>ashmem</instance>
+        </interface>
+    </hal>
+    <hal format="hidl" optional="false">
+        <name>android.hidl.token</name>
+        <version>1.0</version>
+        <interface>
+            <name>ITokenManager</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.keystore2</name>
+        <version>3</version>
+        <interface>
+            <name>IKeystoreService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.net.netd</name>
+        <interface>
+            <name>INetd</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="false">
+        <name>android.system.suspend</name>
+        <interface>
+            <name>ISystemSuspend</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/vintfdata/manifest.xml b/vintfdata/manifest.xml
index b3d84aa..61a42a0 100644
--- a/vintfdata/manifest.xml
+++ b/vintfdata/manifest.xml
@@ -1,5 +1,5 @@
 <manifest version="1.0" type="framework">
-    <hal format="hidl">
+    <hal format="hidl" max-level="8">
         <name>android.hidl.memory</name>
         <transport arch="32+64">passthrough</transport>
         <version>1.0</version>
@@ -36,7 +36,7 @@
         <version>1</version>
         <fqname>ISensorManager/default</fqname>
     </hal>
-    <hal format="hidl">
+    <hal format="hidl" max-level="8">
         <name>android.frameworks.sensorservice</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -54,7 +54,7 @@
             <instance>default</instance>
         </interface>
     </hal>
-    <hal format="hidl">
+    <hal format="hidl" max-level="7">
         <name>android.system.wifi.keystore</name>
         <transport>hwbinder</transport>
         <version>1.0</version>