Merge "Cert: Raise default timeout" am: a03f1c5c09

Original change: https://android-review.googlesource.com/c/platform/system/bt/+/1837937

Change-Id: I94c4e74a1392d8b49c939b184c62463ca229011f
diff --git a/system/binder/android/bluetooth/IBluetooth.aidl b/system/binder/android/bluetooth/IBluetooth.aidl
index 21955b2..2fa1ca0 100644
--- a/system/binder/android/bluetooth/IBluetooth.aidl
+++ b/system/binder/android/bluetooth/IBluetooth.aidl
@@ -26,6 +26,7 @@
 import android.bluetooth.BluetoothClass;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.OobData;
+import android.content.AttributionSource;
 import android.os.ParcelUuid;
 import android.os.ParcelFileDescriptor;
 import android.os.ResultReceiver;
@@ -37,99 +38,178 @@
  */
 interface IBluetooth
 {
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     int getState();
-    boolean enable(boolean quietMode);
-    boolean disable();
+
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean enable(boolean quietMode, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disable(in AttributionSource attributionSource);
 
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.LOCAL_MAC_ADDRESS})")
     String getAddress();
-    ParcelUuid[] getUuids();
-    boolean setName(in String name);
-    String getName();
-    BluetoothClass getBluetoothClass();
-    boolean setBluetoothClass(in BluetoothClass bluetoothClass);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.LOCAL_MAC_ADDRESS})")
+    String getAddressWithAttribution(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    ParcelUuid[] getUuids(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setName(in String name, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    String getName(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    int getNameLengthForAdvertise(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothClass getBluetoothClass(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setBluetoothClass(in BluetoothClass bluetoothClass, in AttributionSource attributionSource);
 
-    int getIoCapability();
-    boolean setIoCapability(int capability);
-    int getLeIoCapability();
-    boolean setLeIoCapability(int capability);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getIoCapability(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setIoCapability(int capability, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getLeIoCapability(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setLeIoCapability(int capability, in AttributionSource attributionSource);
 
-    int getScanMode();
-    boolean setScanMode(int mode, int duration);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    int getScanMode(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    boolean setScanMode(int mode, int duration, in AttributionSource attributionSource);
 
-    int getDiscoverableTimeout();
-    boolean setDiscoverableTimeout(int timeout);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    int getDiscoverableTimeout(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    boolean setDiscoverableTimeout(int timeout, in AttributionSource attributionSource);
 
-    boolean startDiscovery(String callingPackage, String callingFeatureId);
-    boolean cancelDiscovery();
-    boolean isDiscovering();
-    long getDiscoveryEndMillis();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    boolean startDiscovery(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    boolean cancelDiscovery(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    boolean isDiscovering(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    long getDiscoveryEndMillis(in AttributionSource attributionSource);
 
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     int getAdapterConnectionState();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     int getProfileConnectionState(int profile);
 
-    BluetoothDevice[] getBondedDevices();
-    boolean createBond(in BluetoothDevice device, in int transport, in OobData p192Data,
-    in OobData p256Data);
-    boolean cancelBondProcess(in BluetoothDevice device);
-    boolean removeBond(in BluetoothDevice device);
-    int getBondState(in BluetoothDevice device);
-    boolean isBondingInitiatedLocally(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothDevice[] getBondedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean createBond(in BluetoothDevice device, in int transport, in OobData p192Data, in OobData p256Data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean cancelBondProcess(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean removeBond(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getBondState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isBondingInitiatedLocally(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     long getSupportedProfiles();
+    @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     int getConnectionState(in BluetoothDevice device);
-
-    String getRemoteName(in BluetoothDevice device);
-    int getRemoteType(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionStateWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    String getRemoteName(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getRemoteType(in BluetoothDevice device, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     String getRemoteAlias(in BluetoothDevice device);
-    boolean setRemoteAlias(in BluetoothDevice device, in String name);
-    int getRemoteClass(in BluetoothDevice device);
-    ParcelUuid[] getRemoteUuids(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    String getRemoteAliasWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int setRemoteAlias(in BluetoothDevice device, in String name, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getRemoteClass(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    ParcelUuid[] getRemoteUuids(in BluetoothDevice device, in AttributionSource attributionSource);
     @UnsupportedAppUsage
-    boolean fetchRemoteUuids(in BluetoothDevice device, in int transport);
-    boolean sdpSearch(in BluetoothDevice device, in ParcelUuid uuid);
-    int getBatteryLevel(in BluetoothDevice device);
-    int getMaxConnectedAudioDevices();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean fetchRemoteUuids(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean fetchRemoteUuidsWithAttribution(in BluetoothDevice device, in int transport, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sdpSearch(in BluetoothDevice device, in ParcelUuid uuid, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getBatteryLevel(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getMaxConnectedAudioDevices(in AttributionSource attributionSource);
 
-    boolean setPin(in BluetoothDevice device, boolean accept, int len, in byte[] pinCode);
-    boolean setPasskey(in BluetoothDevice device, boolean accept, int len, in byte[]
-    passkey);
-    boolean setPairingConfirmation(in BluetoothDevice device, boolean accept);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setPin(in BluetoothDevice device, boolean accept, int len, in byte[] pinCode, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setPasskey(in BluetoothDevice device, boolean accept, int len, in byte[] passkey, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setPairingConfirmation(in BluetoothDevice device, boolean accept, in AttributionSource attributionSource);
 
-    int getPhonebookAccessPermission(in BluetoothDevice device);
-    boolean setSilenceMode(in BluetoothDevice device, boolean silence);
-    boolean getSilenceMode(in BluetoothDevice device);
-    boolean setPhonebookAccessPermission(in BluetoothDevice device, int value);
-    int getMessageAccessPermission(in BluetoothDevice device);
-    boolean setMessageAccessPermission(in BluetoothDevice device, int value);
-    int getSimAccessPermission(in BluetoothDevice device);
-    boolean setSimAccessPermission(in BluetoothDevice device, int value);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getPhonebookAccessPermission(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setSilenceMode(in BluetoothDevice device, boolean silence, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean getSilenceMode(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setPhonebookAccessPermission(in BluetoothDevice device, int value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getMessageAccessPermission(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setMessageAccessPermission(in BluetoothDevice device, int value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getSimAccessPermission(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setSimAccessPermission(in BluetoothDevice device, int value, in AttributionSource attributionSource);
 
-    void registerCallback(in IBluetoothCallback callback);
-    void unregisterCallback(in IBluetoothCallback callback);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void registerCallback(in IBluetoothCallback callback, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void unregisterCallback(in IBluetoothCallback callback, in AttributionSource attributionSource);
 
     // For Socket
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     IBluetoothSocketManager getSocketManager();
 
-    boolean factoryReset();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean factoryReset(in AttributionSource attributionSource);
 
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isMultiAdvertisementSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isOffloadedFilteringSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isOffloadedScanBatchingSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isActivityAndEnergyReportingSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isLe2MPhySupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isLeCodedPhySupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isLeExtendedAdvertisingSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isLePeriodicAdvertisingSupported();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     int getLeMaximumAdvertisingDataLength();
-    BluetoothActivityEnergyInfo reportActivityInfo();
+
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    BluetoothActivityEnergyInfo reportActivityInfo(in AttributionSource attributionSource);
 
     // For Metadata
-    boolean registerMetadataListener(in IBluetoothMetadataListener listener, in BluetoothDevice device);
-    boolean unregisterMetadataListener(in BluetoothDevice device);
-    boolean setMetadata(in BluetoothDevice device, in int key, in byte[] value);
-    byte[] getMetadata(in BluetoothDevice device, in int key);
-
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean registerMetadataListener(in IBluetoothMetadataListener listener, in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean unregisterMetadataListener(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setMetadata(in BluetoothDevice device, in int key, in byte[] value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    byte[] getMetadata(in BluetoothDevice device, in int key, in AttributionSource attributionSource);
 
     /**
      * Requests the controller activity info asynchronously.
@@ -138,20 +218,33 @@
      * key {@link android.os.BatteryStats#RESULT_RECEIVER_CONTROLLER_KEY}.
      * The result code is ignored.
      */
-    oneway void requestActivityInfo(in ResultReceiver result);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    oneway void requestActivityInfo(in ResultReceiver result, in AttributionSource attributionSource);
 
-    void onLeServiceUp();
-    void onBrEdrDown();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void onLeServiceUp(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void onBrEdrDown(in AttributionSource attributionSource);
 
-    boolean connectAllEnabledProfiles(in BluetoothDevice device);
-    boolean disconnectAllEnabledProfiles(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    int connectAllEnabledProfiles(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int disconnectAllEnabledProfiles(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    boolean setActiveDevice(in BluetoothDevice device, in int profiles);
-    List<BluetoothDevice> getMostRecentlyConnectedDevices();
-    boolean removeActiveDevice(in int profiles);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean setActiveDevice(in BluetoothDevice device, in int profiles, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getMostRecentlyConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean removeActiveDevice(in int profiles, in AttributionSource attributionSource);
 
-    boolean registerBluetoothConnectionCallback(in IBluetoothConnectionCallback callback);
-    boolean unregisterBluetoothConnectionCallback(in IBluetoothConnectionCallback callback);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean registerBluetoothConnectionCallback(in IBluetoothConnectionCallback callback, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean unregisterBluetoothConnectionCallback(in IBluetoothConnectionCallback callback, in AttributionSource attributionSource);
 
-    void generateLocalOobData(in int transport, IBluetoothOobDataCallback callback);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean canBondWithoutDialog(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void generateLocalOobData(in int transport, IBluetoothOobDataCallback callback, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothA2dp.aidl b/system/binder/android/bluetooth/IBluetoothA2dp.aidl
index c477310..94379af 100644
--- a/system/binder/android/bluetooth/IBluetoothA2dp.aidl
+++ b/system/binder/android/bluetooth/IBluetoothA2dp.aidl
@@ -20,6 +20,7 @@
 import android.bluetooth.BluetoothCodecStatus;
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BufferConstraints;
+import android.content.AttributionSource;
 
 /**
  * APIs for Bluetooth A2DP service
@@ -29,32 +30,64 @@
 interface IBluetoothA2dp {
     // Public API
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     boolean connect(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connectWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     boolean disconnect(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnectWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     List<BluetoothDevice> getConnectedDevices();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevicesWithAttribution(in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStatesWithAttribution(in int[] states, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     int getConnectionState(in BluetoothDevice device);
-    boolean setActiveDevice(in BluetoothDevice device);
-    BluetoothDevice getActiveDevice();
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionStateWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setActiveDevice(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothDevice getActiveDevice(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isAvrcpAbsoluteVolumeSupported();
-    oneway void setAvrcpAbsoluteVolume(int volume);
-    boolean isA2dpPlaying(in BluetoothDevice device);
-    BluetoothCodecStatus getCodecStatus(in BluetoothDevice device);
-    oneway void setCodecConfigPreference(in BluetoothDevice device,
-                in BluetoothCodecConfig codecConfig);
-    oneway void enableOptionalCodecs(in BluetoothDevice device);
-    oneway void disableOptionalCodecs(in BluetoothDevice device);
-    int supportsOptionalCodecs(in BluetoothDevice device);
-    int getOptionalCodecsEnabled(in BluetoothDevice device);
-    oneway void setOptionalCodecsEnabled(in BluetoothDevice device, int value);
-    int getDynamicBufferSupport();
-    BufferConstraints getBufferConstraints();
-    boolean setBufferLengthMillis(int codec, int size);
-    int getPriority(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    oneway void setAvrcpAbsoluteVolume(int volume, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isA2dpPlaying(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothCodecStatus getCodecStatus(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    oneway void setCodecConfigPreference(in BluetoothDevice device, in BluetoothCodecConfig codecConfig, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    oneway void enableOptionalCodecs(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    oneway void disableOptionalCodecs(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int supportsOptionalCodecs(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getOptionalCodecsEnabled(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    oneway void setOptionalCodecsEnabled(in BluetoothDevice device, int value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getDynamicBufferSupport(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    BufferConstraints getBufferConstraints(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setBufferLengthMillis(int codec, int size, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getPriority(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothA2dpSink.aidl b/system/binder/android/bluetooth/IBluetoothA2dpSink.aidl
index 946b8f4..53c1216 100644
--- a/system/binder/android/bluetooth/IBluetoothA2dpSink.aidl
+++ b/system/binder/android/bluetooth/IBluetoothA2dpSink.aidl
@@ -18,6 +18,7 @@
 
 import android.bluetooth.BluetoothAudioConfig;
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * APIs for Bluetooth A2DP sink service
@@ -25,13 +26,22 @@
  * @hide
  */
 interface IBluetoothA2dpSink {
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    BluetoothAudioConfig getAudioConfig(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
-    boolean isA2dpPlaying(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothAudioConfig getAudioConfig(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean isA2dpPlaying(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothAvrcpController.aidl b/system/binder/android/bluetooth/IBluetoothAvrcpController.aidl
index fc5ff2d..058ffcb 100644
--- a/system/binder/android/bluetooth/IBluetoothAvrcpController.aidl
+++ b/system/binder/android/bluetooth/IBluetoothAvrcpController.aidl
@@ -18,6 +18,7 @@
 
 import android.bluetooth.BluetoothAvrcpPlayerSettings;
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 import android.media.MediaMetadata;
 import android.media.session.PlaybackState;
 
@@ -27,10 +28,16 @@
  * @hide
  */
 interface IBluetoothAvrcpController {
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    BluetoothAvrcpPlayerSettings getPlayerSettings(in BluetoothDevice device);
-    boolean setPlayerApplicationSetting(in BluetoothAvrcpPlayerSettings plAppSetting);
-    void sendGroupNavigationCmd(in BluetoothDevice device, int keyCode, int keyState);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothAvrcpPlayerSettings getPlayerSettings(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setPlayerApplicationSetting(in BluetoothAvrcpPlayerSettings plAppSetting, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void sendGroupNavigationCmd(in BluetoothDevice device, int keyCode, int keyState, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothAvrcpTarget.aidl b/system/binder/android/bluetooth/IBluetoothAvrcpTarget.aidl
index 23f3608..64fbb7c 100644
--- a/system/binder/android/bluetooth/IBluetoothAvrcpTarget.aidl
+++ b/system/binder/android/bluetooth/IBluetoothAvrcpTarget.aidl
@@ -25,5 +25,6 @@
     /**
      * @hide
      */
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void sendVolumeChanged(in int volume);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothCsipSetCoordinator.aidl b/system/binder/android/bluetooth/IBluetoothCsipSetCoordinator.aidl
index f139ecb..4c451cd 100644
--- a/system/binder/android/bluetooth/IBluetoothCsipSetCoordinator.aidl
+++ b/system/binder/android/bluetooth/IBluetoothCsipSetCoordinator.aidl
@@ -18,6 +18,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 import android.os.ParcelUuid;
 import android.bluetooth.IBluetoothCsipSetCoordinatorLockCallback;
 import java.util.List;
@@ -29,44 +30,56 @@
  * @hide
  */
 interface IBluetoothCsipSetCoordinator {
-  boolean connect(in BluetoothDevice device);
-  boolean disconnect(in BluetoothDevice device);
-  List<BluetoothDevice> getConnectedDevices();
-  List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-  int getConnectionState(in BluetoothDevice device);
-  boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-  int getConnectionPolicy(in BluetoothDevice device);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)")
+  boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)")
+  boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)")
+  boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)")
+  int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 
   /**
     * Get the list of group identifiers for the given context {@var uuid}.
     * @return group identifiers as <code>List<Integer></code>
     */
-  List getAllGroupIds(in ParcelUuid uuid);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  List getAllGroupIds(in ParcelUuid uuid, in AttributionSource attributionSource);
 
   /**
     * Get all groups that {@var device} belongs to.
     * @return group identifiers and their context uuids as <code>Map<Integer, ParcelUuid></code>
     */
-  Map getGroupUuidMapByDevice(in BluetoothDevice device);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  Map getGroupUuidMapByDevice(in BluetoothDevice device, in AttributionSource attributionSource);
 
   /**
    * Get the number of known group members or
    * {@link android.bluetooth.IBluetoothCsipSetCoordinator.CSIS_GROUP_SIZE_UNKNOWN} if unknown.
    * @return group size
    */
-  int getDesiredGroupSize(in int groupId);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  int getDesiredGroupSize(in int group_id, in AttributionSource attributionSource);
 
   /**
    * Lock group identified with {@var groupId}.
    * @return unique lock identifier required for unlocking
    */
-  ParcelUuid groupLock(int groupId, in IBluetoothCsipSetCoordinatorLockCallback callback);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  ParcelUuid groupLock(int groupId, in IBluetoothCsipSetCoordinatorLockCallback callback, in AttributionSource attributionSource);
 
   /**
    * Unlock group using {@var lockUuid} acquired through
    * {@link android.bluetooth.IBluetoothCsipSetCoordinator.groupLock}.
    */
-  void groupUnlock(in ParcelUuid lockUuid);
+  @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+  void groupUnlock(in ParcelUuid lockUuid, in AttributionSource attributionSource);
 
   const int CSIS_GROUP_ID_INVALID = -1;
   const int CSIS_GROUP_SIZE_UNKNOWN = 1;
diff --git a/system/binder/android/bluetooth/IBluetoothGatt.aidl b/system/binder/android/bluetooth/IBluetoothGatt.aidl
index 201be2c..0c52180 100644
--- a/system/binder/android/bluetooth/IBluetoothGatt.aidl
+++ b/system/binder/android/bluetooth/IBluetoothGatt.aidl
@@ -27,6 +27,7 @@
 import android.bluetooth.le.ScanResult;
 import android.bluetooth.le.ScanSettings;
 import android.bluetooth.le.ResultStorageDescriptor;
+import android.content.AttributionSource;
 import android.os.ParcelUuid;
 import android.os.WorkSource;
 
@@ -41,80 +42,135 @@
  * @hide
  */
 interface IBluetoothGatt {
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
 
-    void registerScanner(in IScannerCallback callback, in WorkSource workSource);
-    void unregisterScanner(in int scannerId);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void registerScanner(in IScannerCallback callback, in WorkSource workSource, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void unregisterScanner(in int scannerId, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
     void startScan(in int scannerId, in ScanSettings settings, in List<ScanFilter> filters,
-                   in String callingPackage, String callingFeatureId);
+                   in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
     void startScanForIntent(in PendingIntent intent, in ScanSettings settings, in List<ScanFilter> filters,
-                            in String callingPackage, String callingFeatureId);
-    void stopScanForIntent(in PendingIntent intent, in String callingPackage);
-    void stopScan(in int scannerId);
-    void flushPendingBatchResults(in int scannerId);
+                            in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void stopScanForIntent(in PendingIntent intent, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void stopScan(in int scannerId, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void flushPendingBatchResults(in int scannerId, in AttributionSource attributionSource);
 
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
     void startAdvertisingSet(in AdvertisingSetParameters parameters, in AdvertiseData advertiseData,
                                 in AdvertiseData scanResponse, in PeriodicAdvertisingParameters periodicParameters,
                                 in AdvertiseData periodicData, in int duration, in int maxExtAdvEvents,
-                                in IAdvertisingSetCallback callback);
-    void stopAdvertisingSet(in IAdvertisingSetCallback callback);
+                                in IAdvertisingSetCallback callback, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void stopAdvertisingSet(in IAdvertisingSetCallback callback, in AttributionSource attributionSource);
 
-    void getOwnAddress(in int advertiserId);
-    void enableAdvertisingSet(in int advertiserId, in boolean enable, in int duration, in int maxExtAdvEvents);
-    void setAdvertisingData(in int advertiserId, in AdvertiseData data);
-    void setScanResponseData(in int advertiserId, in AdvertiseData data);
-    void setAdvertisingParameters(in int advertiserId, in AdvertisingSetParameters parameters);
-    void setPeriodicAdvertisingParameters(in int advertiserId, in PeriodicAdvertisingParameters parameters);
-    void setPeriodicAdvertisingData(in int advertiserId, in AdvertiseData data);
-    void setPeriodicAdvertisingEnable(in int advertiserId, in boolean enable);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_ADVERTISE,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    void getOwnAddress(in int advertiserId, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void enableAdvertisingSet(in int advertiserId, in boolean enable, in int duration, in int maxExtAdvEvents, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setAdvertisingData(in int advertiserId, in AdvertiseData data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setScanResponseData(in int advertiserId, in AdvertiseData data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setAdvertisingParameters(in int advertiserId, in AdvertisingSetParameters parameters, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setPeriodicAdvertisingParameters(in int advertiserId, in PeriodicAdvertisingParameters parameters, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setPeriodicAdvertisingData(in int advertiserId, in AdvertiseData data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_ADVERTISE)")
+    void setPeriodicAdvertisingEnable(in int advertiserId, in boolean enable, in AttributionSource attributionSource);
 
-    void registerSync(in ScanResult scanResult, in int skip, in int timeout, in IPeriodicAdvertisingCallback callback);
-    void unregisterSync(in IPeriodicAdvertisingCallback callback);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void registerSync(in ScanResult scanResult, in int skip, in int timeout, in IPeriodicAdvertisingCallback callback, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_SCAN)")
+    void unregisterSync(in IPeriodicAdvertisingCallback callback, in AttributionSource attributionSource);
 
     @UnsupportedAppUsage
-    void registerClient(in ParcelUuid appId, in IBluetoothGattCallback callback, boolean eatt_support);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void registerClient(in ParcelUuid appId, in IBluetoothGattCallback callback, boolean eatt_support, in AttributionSource attributionSource);
 
     @UnsupportedAppUsage
-    void unregisterClient(in int clientIf);
-    void clientConnect(in int clientIf, in String address, in boolean isDirect, in int transport, in boolean opportunistic, in int phy);
-    void clientDisconnect(in int clientIf, in String address);
-    void clientSetPreferredPhy(in int clientIf, in String address, in int txPhy, in int rxPhy, in int phyOptions);
-    void clientReadPhy(in int clientIf, in String address);
-    void refreshDevice(in int clientIf, in String address);
-    void discoverServices(in int clientIf, in String address);
-    void discoverServiceByUuid(in int clientIf, in String address, in ParcelUuid uuid);
-    void readCharacteristic(in int clientIf, in String address, in int handle, in int authReq);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void unregisterClient(in int clientIf, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void clientConnect(in int clientIf, in String address, in boolean isDirect, in int transport, in boolean opportunistic, in int phy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void clientDisconnect(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void clientSetPreferredPhy(in int clientIf, in String address, in int txPhy, in int rxPhy, in int phyOptions, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void clientReadPhy(in int clientIf, in String addres, in AttributionSource attributionSources);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void refreshDevice(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void discoverServices(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void discoverServiceByUuid(in int clientIf, in String address, in ParcelUuid uuid, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void readCharacteristic(in int clientIf, in String address, in int handle, in int authReq, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void readUsingCharacteristicUuid(in int clientIf, in String address, in ParcelUuid uuid,
-                           in int startHandle, in int endHandle, in int authReq);
+                           in int startHandle, in int endHandle, in int authReq, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     int writeCharacteristic(in int clientIf, in String address, in int handle,
-                            in int writeType, in int authReq, in byte[] value);
-    void readDescriptor(in int clientIf, in String address, in int handle, in int authReq);
+                            in int writeType, in int authReq, in byte[] value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void readDescriptor(in int clientIf, in String address, in int handle, in int authReq, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void writeDescriptor(in int clientIf, in String address, in int handle,
-                            in int authReq, in byte[] value);
-    void registerForNotification(in int clientIf, in String address, in int handle, in boolean enable);
-    void beginReliableWrite(in int clientIf, in String address);
-    void endReliableWrite(in int clientIf, in String address, in boolean execute);
-    void readRemoteRssi(in int clientIf, in String address);
-    void configureMTU(in int clientIf, in String address, in int mtu);
-    void connectionParameterUpdate(in int clientIf, in String address, in int connectionPriority);
+                            in int authReq, in byte[] value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void registerForNotification(in int clientIf, in String address, in int handle, in boolean enable, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void beginReliableWrite(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void endReliableWrite(in int clientIf, in String address, in boolean execute, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void readRemoteRssi(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void configureMTU(in int clientIf, in String address, in int mtu, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void connectionParameterUpdate(in int clientIf, in String address, in int connectionPriority, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void leConnectionUpdate(int clientIf, String address, int minInterval,
                             int maxInterval, int peripheralLatency, int supervisionTimeout,
-                            int minConnectionEventLen, int maxConnectionEventLen);
+                            int minConnectionEventLen, int maxConnectionEventLen, in AttributionSource attributionSource);
 
-    void registerServer(in ParcelUuid appId, in IBluetoothGattServerCallback callback, boolean eatt_support);
-    void unregisterServer(in int serverIf);
-    void serverConnect(in int serverIf, in String address, in boolean isDirect, in int transport);
-    void serverDisconnect(in int serverIf, in String address);
-    void serverSetPreferredPhy(in int clientIf, in String address, in int txPhy, in int rxPhy, in int phyOptions);
-    void serverReadPhy(in int clientIf, in String address);
-    void addService(in int serverIf, in BluetoothGattService service);
-    void removeService(in int serverIf, in int handle);
-    void clearServices(in int serverIf);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void registerServer(in ParcelUuid appId, in IBluetoothGattServerCallback callback, boolean eatt_support, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void unregisterServer(in int serverIf, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void serverConnect(in int serverIf, in String address, in boolean isDirect, in int transport, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void serverDisconnect(in int serverIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void serverSetPreferredPhy(in int clientIf, in String address, in int txPhy, in int rxPhy, in int phyOptions, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void serverReadPhy(in int clientIf, in String address, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void addService(in int serverIf, in BluetoothGattService service, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void removeService(in int serverIf, in int handle, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void clearServices(in int serverIf, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void sendResponse(in int serverIf, in String address, in int requestId,
-                            in int status, in int offset, in byte[] value);
+                            in int status, in int offset, in byte[] value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void sendNotification(in int serverIf, in String address, in int handle,
-                            in boolean confirm, in byte[] value);
-    void disconnectAll();
-    void unregAll();
-    int numHwTrackFiltersAvailable();
+                            in boolean confirm, in byte[] value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void disconnectAll(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void unregAll(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int numHwTrackFiltersAvailable(in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothHeadset.aidl b/system/binder/android/bluetooth/IBluetoothHeadset.aidl
index b9497d6..e94ce5a 100644
--- a/system/binder/android/bluetooth/IBluetoothHeadset.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHeadset.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * API for Bluetooth Headset service
@@ -30,42 +31,76 @@
 interface IBluetoothHeadset {
     // Public API
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevicesWithAttribution(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     int getConnectionState(in BluetoothDevice device);
-    boolean startVoiceRecognition(in BluetoothDevice device);
-    boolean stopVoiceRecognition(in BluetoothDevice device);
-    boolean isAudioConnected(in BluetoothDevice device);
-    boolean sendVendorSpecificResultCode(in BluetoothDevice device,
-                                         in String command,
-                                         in String arg);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionStateWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean startVoiceRecognition(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean stopVoiceRecognition(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isAudioConnected(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sendVendorSpecificResultCode(in BluetoothDevice device, in String command, in String arg, in AttributionSource attributionSource);
 
     // Hidden API
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
     boolean connect(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean connectWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     boolean disconnect(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
-    int getAudioState(in BluetoothDevice device);
-    boolean isAudioOn();
-    boolean connectAudio();
-    boolean disconnectAudio();
-    void setAudioRouteAllowed(boolean allowed);
-    boolean getAudioRouteAllowed();
-    void setForceScoAudio(boolean forced);
-    boolean startScoUsingVirtualVoiceCall();
-    boolean stopScoUsingVirtualVoiceCall();
-    oneway void phoneStateChanged(int numActive, int numHeld, int callState, String number, int type, String name);
-    void clccResponse(int index, int direction, int status, int mode, boolean mpty,
-                      String number, int type);
-    boolean setActiveDevice(in BluetoothDevice device);
-    BluetoothDevice getActiveDevice();
-    boolean isInbandRingingEnabled();
-    boolean setPriority(in BluetoothDevice device, int connectionPolicy);
-    int getPriority(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnectWithAttribution(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getAudioState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isAudioOn(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connectAudio(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnectAudio(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setAudioRouteAllowed(boolean allowed, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getAudioRouteAllowed(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setForceScoAudio(boolean forced, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean startScoUsingVirtualVoiceCall(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean stopScoUsingVirtualVoiceCall(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    oneway void phoneStateChanged(int numActive, int numHeld, int callState, String number, int type, String name, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    void clccResponse(int index, int direction, int status, int mode, boolean mpty, String number, int type, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean setActiveDevice(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothDevice getActiveDevice(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isInbandRingingEnabled(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.MODIFY_PHONE_STATE})")
+    boolean setPriority(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getPriority(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    boolean isNoiseReductionSupported(in BluetoothDevice device);
-    boolean isVoiceRecognitionSupported(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isNoiseReductionSupported(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isVoiceRecognitionSupported(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl b/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
index f767b27..b223590 100644
--- a/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
@@ -18,6 +18,7 @@
 
 import android.bluetooth.BluetoothDevice;
 import android.bluetooth.BluetoothHeadsetClientCall;
+import android.content.AttributionSource;
 import android.os.Bundle;
 
 /**
@@ -26,40 +27,67 @@
  * {@hide}
  */
 interface IBluetoothHeadsetClient {
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    boolean startVoiceRecognition(in BluetoothDevice device);
-    boolean stopVoiceRecognition(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean startVoiceRecognition(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean stopVoiceRecognition(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    List<BluetoothHeadsetClientCall> getCurrentCalls(in BluetoothDevice device);
-    Bundle getCurrentAgEvents(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothHeadsetClientCall> getCurrentCalls(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    Bundle getCurrentAgEvents(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    boolean acceptCall(in BluetoothDevice device, int flag);
-    boolean holdCall(in BluetoothDevice device);
-    boolean rejectCall(in BluetoothDevice device);
-    boolean terminateCall(in BluetoothDevice device, in BluetoothHeadsetClientCall call);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean acceptCall(in BluetoothDevice device, int flag, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean holdCall(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean rejectCall(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean terminateCall(in BluetoothDevice device, in BluetoothHeadsetClientCall call, in AttributionSource attributionSource);
 
-    boolean enterPrivateMode(in BluetoothDevice device, int index);
-    boolean explicitCallTransfer(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean enterPrivateMode(in BluetoothDevice device, int index, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean explicitCallTransfer(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    BluetoothHeadsetClientCall dial(in BluetoothDevice device, String number);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothHeadsetClientCall dial(in BluetoothDevice device, String number, in AttributionSource attributionSource);
 
-    boolean sendDTMF(in BluetoothDevice device, byte code);
-    boolean getLastVoiceTagNumber(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sendDTMF(in BluetoothDevice device, byte code, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getLastVoiceTagNumber(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    int getAudioState(in BluetoothDevice device);
-    boolean connectAudio(in BluetoothDevice device);
-    boolean disconnectAudio(in BluetoothDevice device);
-    void setAudioRouteAllowed(in BluetoothDevice device, boolean allowed);
-    boolean getAudioRouteAllowed(in BluetoothDevice device);
-    boolean sendVendorAtCommand(in BluetoothDevice device, int vendorId, String atCommand);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getAudioState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connectAudio(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnectAudio(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setAudioRouteAllowed(in BluetoothDevice device, boolean allowed, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getAudioRouteAllowed(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sendVendorAtCommand(in BluetoothDevice device, int vendorId, String atCommand, in AttributionSource attributionSource);
 
-    Bundle getCurrentAgFeatures(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    Bundle getCurrentAgFeatures(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothHearingAid.aidl b/system/binder/android/bluetooth/IBluetoothHearingAid.aidl
index b6e02c1..211e3ee 100644
--- a/system/binder/android/bluetooth/IBluetoothHearingAid.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHearingAid.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * APIs for Bluetooth Hearing Aid service
@@ -25,25 +26,38 @@
  */
 interface IBluetoothHearingAid {
     // Public API
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setActiveDevice(in BluetoothDevice device);
-    List<BluetoothDevice> getActiveDevices();
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
-    void setVolume(int volume);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setActiveDevice(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getActiveDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setVolume(int volume, in AttributionSource attributionSource);
 
     const int HI_SYNC_ID_INVALID = 0;
-    long getHiSyncId(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    long getHiSyncId(in BluetoothDevice device, in AttributionSource attributionSource);
 
     const int SIDE_LEFT = 0;
     const int SIDE_RIGHT = 1;
-    int getDeviceSide(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getDeviceSide(in BluetoothDevice device, in AttributionSource attributionSource);
 
     const int MODE_MONAURAL = 0;
     const int MODE_BINAURAL = 1;
-    int getDeviceMode(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getDeviceMode(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothHidDevice.aidl b/system/binder/android/bluetooth/IBluetoothHidDevice.aidl
index cefb324..c53d1e6 100644
--- a/system/binder/android/bluetooth/IBluetoothHidDevice.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHidDevice.aidl
@@ -20,22 +20,34 @@
 import android.bluetooth.IBluetoothHidDeviceCallback;
 import android.bluetooth.BluetoothHidDeviceAppSdpSettings;
 import android.bluetooth.BluetoothHidDeviceAppQosSettings;
+import android.content.AttributionSource;
 
 /** @hide */
 interface IBluetoothHidDevice {
-    boolean registerApp(in BluetoothHidDeviceAppSdpSettings sdp,
-            in BluetoothHidDeviceAppQosSettings inQos, in BluetoothHidDeviceAppQosSettings outQos,
-            in IBluetoothHidDeviceCallback callback);
-    boolean unregisterApp();
-    boolean sendReport(in BluetoothDevice device, in int id, in byte[] data);
-    boolean replyReport(in BluetoothDevice device, in byte type, in byte id, in byte[] data);
-    boolean reportError(in BluetoothDevice device, byte error);
-    boolean unplug(in BluetoothDevice device);
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    String getUserAppName();
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean registerApp(in BluetoothHidDeviceAppSdpSettings sdp, in BluetoothHidDeviceAppQosSettings inQos, in BluetoothHidDeviceAppQosSettings outQos, in IBluetoothHidDeviceCallback callback, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean unregisterApp(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sendReport(in BluetoothDevice device, in int id, in byte[] data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean replyReport(in BluetoothDevice device, in byte type, in byte id, in byte[] data, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean reportError(in BluetoothDevice device, byte error, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean unplug(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    String getUserAppName(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothHidHost.aidl b/system/binder/android/bluetooth/IBluetoothHidHost.aidl
index ca3e33c..23fbd60 100644
--- a/system/binder/android/bluetooth/IBluetoothHidHost.aidl
+++ b/system/binder/android/bluetooth/IBluetoothHidHost.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * API for Bluetooth HID service
@@ -25,43 +26,34 @@
  */
 interface IBluetoothHidHost {
     // Public API
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
-    /**
-    * @hide
-    */
-    boolean getProtocolMode(in BluetoothDevice device);
-    /**
-    * @hide
-    */
-    boolean virtualUnplug(in BluetoothDevice device);
-    /**
-    * @hide
-    */
-    boolean setProtocolMode(in BluetoothDevice device, int protocolMode);
-    /**
-    * @hide
-    */
-    boolean getReport(in BluetoothDevice device, byte reportType, byte reportId, int bufferSize);
-    /**
-    * @hide
-    */
-    boolean setReport(in BluetoothDevice device, byte reportType, String report);
-    /**
-    * @hide
-    */
-    boolean sendData(in BluetoothDevice device, String report);
-    /**
-    * @hide
-    */
-    boolean getIdleTime(in BluetoothDevice device);
-    /**
-    * @hide
-    */
-    boolean setIdleTime(in BluetoothDevice device, byte idleTime);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getProtocolMode(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean virtualUnplug(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setProtocolMode(in BluetoothDevice device, int protocolMode, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getReport(in BluetoothDevice device, byte reportType, byte reportId, int bufferSize, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setReport(in BluetoothDevice device, byte reportType, String report, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean sendData(in BluetoothDevice device, String report, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean getIdleTime(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setIdleTime(in BluetoothDevice device, byte idleTime, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothLeAudio.aidl b/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
index 4f2ee75..34240d1 100644
--- a/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
+++ b/system/binder/android/bluetooth/IBluetoothLeAudio.aidl
@@ -18,6 +18,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * APIs for Bluetooth LE Audio service
@@ -26,15 +27,24 @@
  */
 interface IBluetoothLeAudio {
     // Public API
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setActiveDevice(in BluetoothDevice device);
-    List<BluetoothDevice> getActiveDevices();
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean setActiveDevice(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getActiveDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 
     const int LE_AUDIO_GROUP_ID_INVALID = -1;
 
@@ -42,6 +52,6 @@
      * Get device group id. Devices with same group id belong to same group (i.e left and right
      * earbud)
      */
-    int getGroupId(in BluetoothDevice device);
-
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getGroupId(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothManager.aidl b/system/binder/android/bluetooth/IBluetoothManager.aidl
index 5f0b314..c0cc204 100644
--- a/system/binder/android/bluetooth/IBluetoothManager.aidl
+++ b/system/binder/android/bluetooth/IBluetoothManager.aidl
@@ -21,6 +21,7 @@
 import android.bluetooth.IBluetoothManagerCallback;
 import android.bluetooth.IBluetoothProfileServiceConnection;
 import android.bluetooth.IBluetoothStateChangeCallback;
+import android.content.AttributionSource;
 
 /**
  * System private API for talking with the Bluetooth service.
@@ -29,31 +30,47 @@
  */
 interface IBluetoothManager
 {
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     IBluetooth registerAdapter(in IBluetoothManagerCallback callback);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void unregisterAdapter(in IBluetoothManagerCallback callback);
     @UnsupportedAppUsage
     void registerStateChangeCallback(in IBluetoothStateChangeCallback callback);
     @UnsupportedAppUsage
     void unregisterStateChangeCallback(in IBluetoothStateChangeCallback callback);
-    boolean enable(String packageName);
-    boolean enableNoAutoConnect(String packageName);
-    boolean disable(String packageName, boolean persist);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean enable(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean enableNoAutoConnect(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disable(in AttributionSource attributionSource, boolean persist);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     int getState();
     @UnsupportedAppUsage
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     IBluetoothGatt getBluetoothGatt();
 
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean bindBluetoothProfileService(int profile, IBluetoothProfileServiceConnection proxy);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void unbindBluetoothProfileService(int profile, IBluetoothProfileServiceConnection proxy);
 
-    String getAddress();
-    String getName();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.LOCAL_MAC_ADDRESS})")
+    String getAddress(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    String getName(in AttributionSource attributionSource);
 
-    boolean onFactoryReset();
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean onFactoryReset(in AttributionSource attributionSource);
 
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isBleScanAlwaysAvailable();
-    boolean enableBle(String packageName, IBinder b);
-    boolean disableBle(String packageName, IBinder b);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean enableBle(in AttributionSource attributionSource, IBinder b);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disableBle(in AttributionSource attributionSource, IBinder b);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isBleAppPresent();
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     boolean isHearingAidProfileSupported();
 }
-
diff --git a/system/binder/android/bluetooth/IBluetoothMap.aidl b/system/binder/android/bluetooth/IBluetoothMap.aidl
index 4f221e4..2862005 100644
--- a/system/binder/android/bluetooth/IBluetoothMap.aidl
+++ b/system/binder/android/bluetooth/IBluetoothMap.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * System private API for Bluetooth MAP service
@@ -24,13 +25,22 @@
  * {@hide}
  */
 interface IBluetoothMap {
-    int getState();
-    BluetoothDevice getClient();
-    boolean disconnect(in BluetoothDevice device);
-    boolean isConnected(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getState(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothDevice getClient(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isConnected(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothMapClient.aidl b/system/binder/android/bluetooth/IBluetoothMapClient.aidl
index dec2d42..38aa2c4 100644
--- a/system/binder/android/bluetooth/IBluetoothMapClient.aidl
+++ b/system/binder/android/bluetooth/IBluetoothMapClient.aidl
@@ -18,6 +18,7 @@
 
 import android.app.PendingIntent;
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 import android.net.Uri;
 
 /**
@@ -26,18 +27,28 @@
  * {@hide}
  */
 interface IBluetoothMapClient {
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    boolean isConnected(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device,in int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
-    boolean sendMessage(in BluetoothDevice device, in Uri[] contacts, in  String message,
-        in PendingIntent sentIntent, in PendingIntent deliveryIntent);
-    boolean getUnreadMessages(in BluetoothDevice device);
-    int getSupportedFeatures(in BluetoothDevice device);
-    boolean setMessageStatus(in BluetoothDevice device, in String handle,
-        in int status);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.BLUETOOTH_PRIVILEGED })")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.BLUETOOTH_PRIVILEGED })")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isConnected(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.BLUETOOTH_PRIVILEGED })")
+    boolean setConnectionPolicy(in BluetoothDevice device,in int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.BLUETOOTH_PRIVILEGED })")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.SEND_SMS })")
+    boolean sendMessage(in BluetoothDevice device, in Uri[] contacts, in  String message, in PendingIntent sentIntent, in PendingIntent deliveryIntent, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.READ_SMS })")
+    boolean getUnreadMessages(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getSupportedFeatures(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf = { android.Manifest.permission.BLUETOOTH_CONNECT, android.Manifest.permission.READ_SMS })")
+    boolean setMessageStatus(in BluetoothDevice device, in String handle, in int status, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothMcpServiceManager.aidl b/system/binder/android/bluetooth/IBluetoothMcpServiceManager.aidl
index 3d74f18..823edf0 100644
--- a/system/binder/android/bluetooth/IBluetoothMcpServiceManager.aidl
+++ b/system/binder/android/bluetooth/IBluetoothMcpServiceManager.aidl
@@ -18,6 +18,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * Media Control Profile service manager
@@ -25,5 +26,6 @@
  */
 interface IBluetoothMcpServiceManager
 {
-    void setDeviceAuthorized(in BluetoothDevice device, boolean isAuthorized);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_PRIVILEGED)")
+    void setDeviceAuthorized(in BluetoothDevice device, boolean isAuthorized, in AttributionSource source);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothMetadataListener.aidl b/system/binder/android/bluetooth/IBluetoothMetadataListener.aidl
index 765b128..e08919f 100644
--- a/system/binder/android/bluetooth/IBluetoothMetadataListener.aidl
+++ b/system/binder/android/bluetooth/IBluetoothMetadataListener.aidl
@@ -24,5 +24,6 @@
  * @hide
  */
 oneway interface IBluetoothMetadataListener {
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void onMetadataChanged(in BluetoothDevice devices, in int key, in byte[] value);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothPan.aidl b/system/binder/android/bluetooth/IBluetoothPan.aidl
index ba27acf..4ee664e 100644
--- a/system/binder/android/bluetooth/IBluetoothPan.aidl
+++ b/system/binder/android/bluetooth/IBluetoothPan.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * API for Bluetooth Pan service
@@ -25,12 +26,20 @@
  */
 interface IBluetoothPan {
     // Public API
-    boolean isTetheringOn();
-    void setBluetoothTethering(boolean value, String pkgName, @nullable String attributionTag);
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isTetheringOn(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED,android.Manifest.permission.TETHER_PRIVILEGED})")
+    void setBluetoothTethering(boolean value, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothPbap.aidl b/system/binder/android/bluetooth/IBluetoothPbap.aidl
index 3cb6a6f..5d4f334 100644
--- a/system/binder/android/bluetooth/IBluetoothPbap.aidl
+++ b/system/binder/android/bluetooth/IBluetoothPbap.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * System private API for Bluetooth pbap service
@@ -24,9 +25,14 @@
  * {@hide}
  */
 interface IBluetoothPbap {
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    void disconnect(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothPbapClient.aidl b/system/binder/android/bluetooth/IBluetoothPbapClient.aidl
index e4bfc4e..1512e44 100644
--- a/system/binder/android/bluetooth/IBluetoothPbapClient.aidl
+++ b/system/binder/android/bluetooth/IBluetoothPbapClient.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * API for Bluetooth Phone Book Access Provile Client Side
@@ -24,11 +25,18 @@
  * {@hide}
  */
 interface IBluetoothPbapClient {
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothProfileServiceConnection.aidl b/system/binder/android/bluetooth/IBluetoothProfileServiceConnection.aidl
index e5c3de9..5a048cf 100644
--- a/system/binder/android/bluetooth/IBluetoothProfileServiceConnection.aidl
+++ b/system/binder/android/bluetooth/IBluetoothProfileServiceConnection.aidl
@@ -25,6 +25,8 @@
  * {@hide}
  */
 oneway interface IBluetoothProfileServiceConnection {
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void onServiceConnected(in ComponentName comp, in IBinder service);
+    @JavaPassthrough(annotation="@android.annotation.RequiresNoPermission")
     void onServiceDisconnected(in ComponentName comp);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothSap.aidl b/system/binder/android/bluetooth/IBluetoothSap.aidl
index 00f1f1a..c97403e 100644
--- a/system/binder/android/bluetooth/IBluetoothSap.aidl
+++ b/system/binder/android/bluetooth/IBluetoothSap.aidl
@@ -17,6 +17,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * System private API for Bluetooth SAP service
@@ -24,14 +25,24 @@
  * {@hide}
  */
 interface IBluetoothSap {
-    int getState();
-    BluetoothDevice getClient();
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    boolean isConnected(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getState(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    BluetoothDevice getClient(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean isConnected(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothSocketManager.aidl b/system/binder/android/bluetooth/IBluetoothSocketManager.aidl
index 119988e..e895b42 100644
--- a/system/binder/android/bluetooth/IBluetoothSocketManager.aidl
+++ b/system/binder/android/bluetooth/IBluetoothSocketManager.aidl
@@ -27,7 +27,10 @@
  */
 interface IBluetoothSocketManager
 {
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     @nullable ParcelFileDescriptor connectSocket(in BluetoothDevice device, int type, in @nullable ParcelUuid uuid, int port, int flag);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     @nullable ParcelFileDescriptor createSocketChannel(int type, in @nullable String serviceName, in @nullable ParcelUuid uuid, int port, int flag);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
     void requestMaximumTxDataLength(in BluetoothDevice device);
 }
diff --git a/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl b/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
index 66d3396..d390bf0 100644
--- a/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
+++ b/system/binder/android/bluetooth/IBluetoothVolumeControl.aidl
@@ -18,6 +18,7 @@
 package android.bluetooth;
 
 import android.bluetooth.BluetoothDevice;
+import android.content.AttributionSource;
 
 /**
  * APIs for Bluetooth Volume Control service
@@ -26,14 +27,23 @@
  */
 interface IBluetoothVolumeControl {
     /* Public API */
-    boolean connect(in BluetoothDevice device);
-    boolean disconnect(in BluetoothDevice device);
-    List<BluetoothDevice> getConnectedDevices();
-    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
-    int getConnectionState(in BluetoothDevice device);
-    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy);
-    int getConnectionPolicy(in BluetoothDevice device);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean connect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    boolean disconnect(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getConnectedDevices(in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    int getConnectionState(in BluetoothDevice device, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    boolean setConnectionPolicy(in BluetoothDevice device, int connectionPolicy, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(allOf={android.Manifest.permission.BLUETOOTH_CONNECT,android.Manifest.permission.BLUETOOTH_PRIVILEGED})")
+    int getConnectionPolicy(in BluetoothDevice device, in AttributionSource attributionSource);
 
-    void setVolume(in BluetoothDevice device, int volume);
-    void setVolumeGroup(int group_id, int volume);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setVolume(in BluetoothDevice device, int volume, in AttributionSource attributionSource);
+    @JavaPassthrough(annotation="@android.annotation.RequiresPermission(android.Manifest.permission.BLUETOOTH_CONNECT)")
+    void setVolumeGroup(int group_id, int volume, in AttributionSource attributionSource);
 }
diff --git a/system/bta/ag/bta_ag_sdp.cc b/system/bta/ag/bta_ag_sdp.cc
index d291ed9..f9eb028 100644
--- a/system/bta/ag/bta_ag_sdp.cc
+++ b/system/bta/ag/bta_ag_sdp.cc
@@ -477,7 +477,7 @@
 
   if (p_scb->p_disc_db != nullptr) {
     android_errorWriteLog(0x534e4554, "174052148");
-    APPL_TRACE_ERROR("Discovery already in progress... returning.");
+    LOG_ERROR("Discovery already in progress... returning.");
     return;
   }
 
diff --git a/system/bta/hh/bta_hh_le.cc b/system/bta/hh/bta_hh_le.cc
index 8a575ad..b20986f 100644
--- a/system/bta/hh/bta_hh_le.cc
+++ b/system/bta/hh/bta_hh_le.cc
@@ -1831,6 +1831,9 @@
 
   const gatt::Characteristic* p_char =
       BTA_GATTC_GetCharacteristic(conn_id, handle);
+
+  if (p_char == nullptr) return;
+
   uint16_t uuid = p_char->uuid.As16Bit();
   if (uuid != GATT_UUID_HID_REPORT && uuid != GATT_UUID_HID_BT_KB_INPUT &&
       uuid != GATT_UUID_HID_BT_MOUSE_INPUT &&
diff --git a/system/btif/src/btif_av.cc b/system/btif/src/btif_av.cc
index e67f5a0..267966c 100644
--- a/system/btif/src/btif_av.cc
+++ b/system/btif/src/btif_av.cc
@@ -541,7 +541,6 @@
   std::set<RawAddress> silenced_peers_;
   RawAddress active_peer_;
   std::map<uint8_t, tBTA_AV_HNDL> peer_id2bta_handle_;
-  std::mutex mutex_;
 };
 
 class BtifAvSink {
@@ -660,7 +659,6 @@
   std::map<RawAddress, BtifAvPeer*> peers_;
   RawAddress active_peer_;
   std::map<uint8_t, tBTA_AV_HNDL> peer_id2bta_handle_;
-  std::mutex mutex_;
 };
 
 /*****************************************************************************
@@ -1048,7 +1046,6 @@
 
 BtifAvPeer* BtifAvSource::FindOrCreatePeer(const RawAddress& peer_address,
                                            tBTA_AV_HNDL bta_handle) {
-  std::unique_lock<std::mutex> lock(mutex_);
   BTIF_TRACE_DEBUG("%s: peer_address=%s bta_handle=0x%x", __PRETTY_FUNCTION__,
                    peer_address.ToString().c_str(), bta_handle);
 
@@ -1153,7 +1150,6 @@
 }
 
 void BtifAvSource::DeregisterAllBtaHandles() {
-  std::unique_lock<std::mutex> lock(mutex_);
   for (auto it : peer_id2bta_handle_) {
     tBTA_AV_HNDL bta_handle = it.second;
     BTA_AvDeregister(bta_handle);
@@ -1163,7 +1159,6 @@
 
 void BtifAvSource::BtaHandleRegistered(uint8_t peer_id,
                                        tBTA_AV_HNDL bta_handle) {
-  std::unique_lock<std::mutex> lock(mutex_);
   peer_id2bta_handle_.insert(std::make_pair(peer_id, bta_handle));
 
   // Set the BTA Handle for the Peer (if exists)
@@ -1256,7 +1251,6 @@
 
 BtifAvPeer* BtifAvSink::FindOrCreatePeer(const RawAddress& peer_address,
                                          tBTA_AV_HNDL bta_handle) {
-  std::unique_lock<std::mutex> lock(mutex_);
   BTIF_TRACE_DEBUG("%s: peer_address=%s bta_handle=0x%x", __PRETTY_FUNCTION__,
                    peer_address.ToString().c_str(), bta_handle);
 
@@ -1364,7 +1358,6 @@
 }
 
 void BtifAvSink::DeregisterAllBtaHandles() {
-  std::unique_lock<std::mutex> lock(mutex_);
   for (auto it : peer_id2bta_handle_) {
     tBTA_AV_HNDL bta_handle = it.second;
     BTA_AvDeregister(bta_handle);
@@ -1373,7 +1366,6 @@
 }
 
 void BtifAvSink::BtaHandleRegistered(uint8_t peer_id, tBTA_AV_HNDL bta_handle) {
-  std::unique_lock<std::mutex> lock(mutex_);
   peer_id2bta_handle_.insert(std::make_pair(peer_id, bta_handle));
 
   // Set the BTA Handle for the Peer (if exists)
diff --git a/system/btif/src/btif_rc.cc b/system/btif/src/btif_rc.cc
index dedbde4..3576d6a 100644
--- a/system/btif/src/btif_rc.cc
+++ b/system/btif/src/btif_rc.cc
@@ -4260,6 +4260,11 @@
   btif_rc_device_cb_t* p_dev =
       btif_rc_get_device_by_handle(pmeta_msg->rc_handle);
 
+  if (p_dev == NULL) {
+    BTIF_TRACE_ERROR("%s: Invalid rc handle", __func__);
+    return;
+  }
+
   if (p_rsp->status == AVRC_STS_NO_ERROR) {
     do_in_jni_thread(FROM_HERE,
                      base::Bind(bt_rc_ctrl_callbacks->change_folder_path_cb,
@@ -4284,6 +4289,11 @@
   btif_rc_device_cb_t* p_dev =
       btif_rc_get_device_by_handle(pmeta_msg->rc_handle);
 
+  if (p_dev == NULL) {
+    BTIF_TRACE_ERROR("%s: Invalid rc handle", __func__);
+    return;
+  }
+
   if (p_rsp->status == AVRC_STS_NO_ERROR) {
     do_in_jni_thread(
         FROM_HERE,
diff --git a/system/gd/hci/acl_manager/assembler.h b/system/gd/hci/acl_manager/assembler.h
index 903efae..307b5bb 100644
--- a/system/gd/hci/acl_manager/assembler.h
+++ b/system/gd/hci/acl_manager/assembler.h
@@ -75,6 +75,11 @@
   void on_incoming_packet(AclView packet) {
     PacketView<kLittleEndian> payload = packet.GetPayload();
     auto payload_size = payload.size();
+    auto broadcast_flag = packet.GetBroadcastFlag();
+    if (broadcast_flag == BroadcastFlag::ACTIVE_PERIPHERAL_BROADCAST) {
+      LOG_WARN("Dropping broadcast from remote");
+      return;
+    }
     auto packet_boundary_flag = packet.GetPacketBoundaryFlag();
     if (packet_boundary_flag == PacketBoundaryFlag::FIRST_NON_AUTOMATICALLY_FLUSHABLE) {
       LOG_ERROR("Controller is not allowed to send FIRST_NON_AUTOMATICALLY_FLUSHABLE to host except loopback mode");
diff --git a/system/gd/hci/acl_manager_test.cc b/system/gd/hci/acl_manager_test.cc
index 8056dd1..3975e27 100644
--- a/system/gd/hci/acl_manager_test.cc
+++ b/system/gd/hci/acl_manager_test.cc
@@ -70,7 +70,7 @@
 
 std::unique_ptr<AclBuilder> NextAclPacket(uint16_t handle) {
   PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
-  BroadcastFlag broadcast_flag = BroadcastFlag::ACTIVE_PERIPHERAL_BROADCAST;
+  BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
   return AclBuilder::Create(handle, packet_boundary_flag, broadcast_flag, NextPayload(handle));
 }
 
diff --git a/system/gd/hci/cert/acl_manager_test.py b/system/gd/hci/cert/acl_manager_test.py
index b87aa33..27d7c09 100644
--- a/system/gd/hci/cert/acl_manager_test.py
+++ b/system/gd/hci/cert/acl_manager_test.py
@@ -38,6 +38,25 @@
     def test_cert_connects(self):
         AclManagerTestBase.test_cert_connects(self)
 
+    def test_reject_broadcast(self):
+        dut_address = self.dut.hci_controller.GetMacAddressSimple()
+        self.dut.neighbor.EnablePageScan(neighbor_facade.EnableMsg(enabled=True))
+
+        self.dut_acl_manager.listen_for_an_incoming_connection()
+        self.cert_hci.initiate_connection(dut_address)
+        with self.dut_acl_manager.complete_incoming_connection() as dut_acl:
+            cert_acl = self.cert_hci.complete_connection()
+
+            cert_acl.send(hci_packets.PacketBoundaryFlag.FIRST_AUTOMATICALLY_FLUSHABLE,
+                          hci_packets.BroadcastFlag.ACTIVE_PERIPHERAL_BROADCAST,
+                          b'\x26\x00\x07\x00This is a Broadcast from the Cert')
+            assertThat(dut_acl).emitsNone()
+
+            cert_acl.send(hci_packets.PacketBoundaryFlag.FIRST_AUTOMATICALLY_FLUSHABLE,
+                          hci_packets.BroadcastFlag.POINT_TO_POINT,
+                          b'\x26\x00\x07\x00This is just SomeAclData from the Cert')
+            assertThat(dut_acl).emits(lambda packet: b'SomeAclData' in packet.payload)
+
     def test_cert_connects_disconnects(self):
         AclManagerTestBase.test_cert_connects_disconnects(self)
 
diff --git a/system/gd/packet/parser/packet_def.cc b/system/gd/packet/parser/packet_def.cc
index 084d8dd..82ebda6 100644
--- a/system/gd/packet/parser/packet_def.cc
+++ b/system/gd/packet/parser/packet_def.cc
@@ -185,6 +185,10 @@
   s << "protected:";
   s << "virtual bool IsValid_() const {";
 
+  if (parent_ != nullptr) {
+    s << "if (!" << parent_->name_ << "View::IsValid_()) { return false; } ";
+  }
+
   // Offset by the parents known size. We know that any dynamic fields can
   // already be called since the parent must have already been validated by
   // this point.
diff --git a/system/gd/security/pairing_handler_le_secure_connections.cc b/system/gd/security/pairing_handler_le_secure_connections.cc
index 1109a1f..778c643 100644
--- a/system/gd/security/pairing_handler_le_secure_connections.cc
+++ b/system/gd/security/pairing_handler_le_secure_connections.cc
@@ -59,6 +59,11 @@
   remote_public_key.y = ppkv.GetPublicKeyY();
   LOG_INFO("Received Public key from remote");
 
+  if (public_key.x == remote_public_key.x) {
+    LOG_INFO("Remote and local public keys can't match");
+    return PairingFailure("Remote and local public keys match");
+  }
+
   // validate received public key
   if (!ValidateECDHPoint(remote_public_key)) {
     // TODO: Spec is unclear what should happend when the point is not on
diff --git a/system/hci/Android.bp b/system/hci/Android.bp
index d6efd24..8716f56 100644
--- a/system/hci/Android.bp
+++ b/system/hci/Android.bp
@@ -106,8 +106,11 @@
 cc_test {
     name: "net_test_hci_native",
     test_suites: ["device-tests"],
-    defaults: ["libbt-hci_defaults"],
+    defaults: ["fluoride_defaults"],
     host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
     local_include_dirs: [
         "include",
     ],
@@ -143,6 +146,9 @@
     test_suites: ["device-tests"],
     defaults: ["fluoride_defaults"],
     host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
     local_include_dirs: [
         "include",
     ],
diff --git a/system/hci/src/hci_layer.cc b/system/hci/src/hci_layer.cc
index 3bfc0e4..b61de5f 100644
--- a/system/hci/src/hci_layer.cc
+++ b/system/hci/src/hci_layer.cc
@@ -576,6 +576,8 @@
     goto intercepted;
   } else if (event_code == HCI_COMMAND_STATUS_EVT) {
     if (length < (sizeof(uint8_t) + sizeof(uint8_t) + sizeof(uint16_t))) {
+      LOG_WARN("%s Unexpected hci command status event length:%hhd", __func__,
+               length);
       goto intercepted;
     }
     uint8_t status;
diff --git a/system/hci/src/hci_packet_parser.cc b/system/hci/src/hci_packet_parser.cc
index 2ee75fc..fbbbd32 100644
--- a/system/hci/src/hci_packet_parser.cc
+++ b/system/hci/src/hci_packet_parser.cc
@@ -193,8 +193,9 @@
     BT_HDR* response, uint8_t* resolving_list_size_ptr) {
   uint8_t* stream = read_command_complete_header(
       response, HCI_BLE_READ_RESOLVING_LIST_SIZE, 1 /* bytes after */);
-  STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
-
+  if (stream) {
+    STREAM_TO_UINT8(*resolving_list_size_ptr, stream);
+  }
   buffer_allocator->free(response);
 }
 
@@ -202,8 +203,9 @@
     BT_HDR* response, uint16_t* ble_default_packet_length_ptr) {
   uint8_t* stream = read_command_complete_header(
       response, HCI_BLE_READ_DEFAULT_DATA_LENGTH, 2 /* bytes after */);
-  STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
-
+  if (stream) {
+    STREAM_TO_UINT16(*ble_default_packet_length_ptr, stream);
+  }
   buffer_allocator->free(response);
 }
 
@@ -213,11 +215,12 @@
     uint16_t* ble_supported_max_rx_time) {
   uint8_t* stream = read_command_complete_header(
       response, HCI_BLE_READ_MAXIMUM_DATA_LENGTH, 8 /* bytes after */);
-  STREAM_TO_UINT16(*ble_supported_max_tx_octets, stream);
-  STREAM_TO_UINT16(*ble_supported_max_tx_time, stream);
-  STREAM_TO_UINT16(*ble_supported_max_rx_octets, stream);
-  STREAM_TO_UINT16(*ble_supported_max_rx_time, stream);
-
+  if (stream) {
+    STREAM_TO_UINT16(*ble_supported_max_tx_octets, stream);
+    STREAM_TO_UINT16(*ble_supported_max_tx_time, stream);
+    STREAM_TO_UINT16(*ble_supported_max_rx_octets, stream);
+    STREAM_TO_UINT16(*ble_supported_max_rx_time, stream);
+  }
   buffer_allocator->free(response);
 }
 
@@ -226,8 +229,9 @@
   uint8_t* stream = read_command_complete_header(
       response, HCI_LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH,
       2 /* bytes after */);
-  STREAM_TO_UINT16(*ble_maximum_advertising_data_length_ptr, stream);
-
+  if (stream) {
+    STREAM_TO_UINT16(*ble_maximum_advertising_data_length_ptr, stream);
+  }
   buffer_allocator->free(response);
 }
 
@@ -236,8 +240,9 @@
   uint8_t* stream = read_command_complete_header(
       response, HCI_LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS,
       1 /* bytes after */);
-  STREAM_TO_UINT8(*ble_number_of_supported_advertising_sets_ptr, stream);
-
+  if (stream) {
+    STREAM_TO_UINT8(*ble_number_of_supported_advertising_sets_ptr, stream);
+  }
   buffer_allocator->free(response);
 }
 
@@ -246,8 +251,9 @@
   uint8_t* stream = read_command_complete_header(
       response, HCI_BLE_READ_PERIODIC_ADVERTISER_LIST_SIZE,
       1 /* bytes after */);
-  STREAM_TO_UINT8(*ble_size_of_advertiser_list_ptr, stream);
-
+  if (stream) {
+    STREAM_TO_UINT8(*ble_size_of_advertiser_list_ptr, stream);
+  }
   buffer_allocator->free(response);
 }
 
diff --git a/system/hci/src/packet_fragmenter.cc b/system/hci/src/packet_fragmenter.cc
index 8bfeb5b..09f4327 100644
--- a/system/hci/src/packet_fragmenter.cc
+++ b/system/hci/src/packet_fragmenter.cc
@@ -290,8 +290,10 @@
         return;
       }
 
-      if ((boundary_flag == HCI_ISO_BF_COMPLETE_PACKET) &&
-          (iso_full_len != packet->len)) {
+      if (((boundary_flag == HCI_ISO_BF_COMPLETE_PACKET) &&
+           (iso_full_len != packet->len)) ||
+          ((boundary_flag == HCI_ISO_BF_FIRST_FRAGMENTED_PACKET) &&
+           (iso_full_len <= packet->len))) {
         LOG_ERROR("%s corrupted ISO frame", __func__);
         return;
       }
@@ -360,6 +362,18 @@
         return;
       }
 
+      if (partial_packet->len !=
+          partial_packet->offset + packet->len - HCI_ISO_PREAMBLE_SIZE) {
+        LOG_ERROR(
+            "%s got last fragment, but it doesn't fill up the whole packet of "
+            "size %d",
+            __func__, partial_packet->len);
+        buffer_allocator->free(packet);
+        partial_iso_packets.erase(map_iter);
+        buffer_allocator->free(partial_packet);
+        return;
+      }
+
       partial_packet->layer_specific |= BT_ISO_HDR_OFFSET_POINTS_DATA;
       partial_packet->offset = HCI_ISO_PREAMBLE_SIZE;
       if (partial_packet->layer_specific & BT_ISO_HDR_CONTAINS_TS)
diff --git a/system/profile/avrcp/avrcp_message_converter.h b/system/profile/avrcp/avrcp_message_converter.h
index 476c559..0b47f96 100644
--- a/system/profile/avrcp/avrcp_message_converter.h
+++ b/system/profile/avrcp/avrcp_message_converter.h
@@ -77,7 +77,7 @@
         for (int i = 2; i >= 0; i--) {
           data.push_back((uint8_t)((msg->company_id >> i * 8) & 0xff));
         }
-        for (uint8_t i = 0; i < msg->vendor_len; i++) {
+        for (int i = 0; i < msg->vendor_len; i++) {
           data.push_back(msg->p_vendor_data[i]);
         }
       } break;
diff --git a/system/profile/avrcp/device.cc b/system/profile/avrcp/device.cc
index 75a8c2b..43856828 100644
--- a/system/profile/avrcp/device.cc
+++ b/system/profile/avrcp/device.cc
@@ -170,6 +170,7 @@
         DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
         auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
         send_message(label, false, std::move(response));
+        return;
       }
       media_interface_->GetSongInfo(base::Bind(&Device::GetElementAttributesResponse, weak_ptr_factory_.GetWeakPtr(),
                                                label, get_element_attributes_request_pkt));
diff --git a/system/stack/Android.bp b/system/stack/Android.bp
index eba08cf..ac9d9e7 100644
--- a/system/stack/Android.bp
+++ b/system/stack/Android.bp
@@ -759,6 +759,9 @@
     name: "net_test_stack_btm",
     test_suites: ["device-tests"],
     host_supported: true,
+    test_options: {
+        unit_test: true,
+    },
     defaults: ["fluoride_defaults"],
     local_include_dirs: [
         "include",
diff --git a/system/stack/a2dp/a2dp_sbc.cc b/system/stack/a2dp/a2dp_sbc.cc
index 3fe54ee..c5d5a15 100644
--- a/system/stack/a2dp/a2dp_sbc.cc
+++ b/system/stack/a2dp/a2dp_sbc.cc
@@ -691,10 +691,13 @@
 
 bool A2DP_BuildCodecHeaderSbc(UNUSED_ATTR const uint8_t* p_codec_info,
                               BT_HDR* p_buf, uint16_t frames_per_packet) {
-  uint8_t* p;
+  // this doesn't happen in real life, but keeps fuzzer happy
+  if (p_buf->len - p_buf->offset < A2DP_SBC_MPL_HDR_LEN) {
+    return false;
+  }
 
   p_buf->offset -= A2DP_SBC_MPL_HDR_LEN;
-  p = (uint8_t*)(p_buf + 1) + p_buf->offset;
+  uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
   p_buf->len += A2DP_SBC_MPL_HDR_LEN;
   A2DP_BuildMediaPayloadHeaderSbc(p, false, false, false,
                                   (uint8_t)frames_per_packet);
diff --git a/system/stack/a2dp/a2dp_vendor_ldac_decoder.cc b/system/stack/a2dp/a2dp_vendor_ldac_decoder.cc
index 9023fe8..294d3f0 100644
--- a/system/stack/a2dp/a2dp_vendor_ldac_decoder.cc
+++ b/system/stack/a2dp/a2dp_vendor_ldac_decoder.cc
@@ -202,22 +202,20 @@
 
 bool a2dp_vendor_ldac_decoder_decode_packet(BT_HDR* p_buf) {
   if (p_buf == nullptr) {
-    LOG(ERROR) << __func__ << "Dropping packet with nullptr";
+    LOG_ERROR("%s Dropping packet with nullptr", __func__);
     return false;
   }
-
+  pthread_mutex_lock(&(a2dp_ldac_decoder_cb.mutex));
   unsigned char* pBuffer =
       reinterpret_cast<unsigned char*>(p_buf->data + p_buf->offset);
   //  unsigned int bufferSize = p_buf->len;
   unsigned int bytesValid = p_buf->len;
-
   if (bytesValid == 0) {
-    LOG(WARNING) << __func__ << "Dropping packet with zero length";
+    pthread_mutex_unlock(&(a2dp_ldac_decoder_cb.mutex));
+    LOG_WARN("%s Dropping packet with zero length", __func__);
     return false;
   }
 
-  pthread_mutex_lock(&(a2dp_ldac_decoder_cb.mutex));
-
   LDACBT_SMPL_FMT_T fmt;
   int bs_bytes, frame_number;
 
diff --git a/system/stack/avdt/avdt_ccb_act.cc b/system/stack/avdt/avdt_ccb_act.cc
index a52d704..d8f8817 100644
--- a/system/stack/avdt/avdt_ccb_act.cc
+++ b/system/stack/avdt/avdt_ccb_act.cc
@@ -206,10 +206,16 @@
  *
  ******************************************************************************/
 void avdt_ccb_hdl_getcap_cmd(AvdtpCcb* p_ccb, tAVDT_CCB_EVT* p_data) {
-  AvdtpScb* p_scb;
-
   /* look up scb for seid sent to us */
-  p_scb = avdt_scb_by_hdl(p_data->msg.single.seid);
+  AvdtpScb* p_scb = avdt_scb_by_hdl(p_data->msg.single.seid);
+
+  if (p_scb == nullptr) {
+    /* not ok, send reject */
+    p_data->msg.hdr.err_code = AVDT_ERR_BAD_STATE;
+    p_data->msg.hdr.err_param = p_data->msg.single.seid;
+    avdt_msg_send_rej(p_ccb, AVDT_SIG_START, &p_data->msg);
+    return;
+  }
 
   p_data->msg.svccap.p_cfg = &p_scb->stream_config.cfg;
 
diff --git a/system/stack/avdt/avdt_scb.cc b/system/stack/avdt/avdt_scb.cc
index 3b7c027..bcb8a1a 100644
--- a/system/stack/avdt/avdt_scb.cc
+++ b/system/stack/avdt/avdt_scb.cc
@@ -948,51 +948,54 @@
  ******************************************************************************/
 uint8_t avdt_scb_verify(AvdtpCcb* p_ccb, uint8_t state, uint8_t* p_seid,
                         uint16_t num_seid, uint8_t* p_err_code) {
-  int i;
-  AvdtpScb* p_scb;
-  uint8_t nsc_mask;
-  uint8_t ret = 0;
-
   AVDT_TRACE_DEBUG("avdt_scb_verify state %d", state);
   /* set nonsupported command mask */
   /* translate public state into private state */
-  nsc_mask = 0;
+  uint8_t nsc_mask = 0;
   if (state == AVDT_VERIFY_SUSPEND) {
     nsc_mask = AvdtpStreamConfig::AVDT_NSC_SUSPEND;
   }
 
   /* verify every scb */
-  for (i = 0, *p_err_code = 0;
-       (i < num_seid) && (*p_err_code == 0) && (i < AVDT_NUM_SEPS); i++) {
-    p_scb = avdt_scb_by_hdl(p_seid[i]);
-    if (p_scb == NULL)
+  *p_err_code = 0;
+  for (int i = 0; (i < num_seid) && (i < AVDT_NUM_SEPS); i++) {
+    AvdtpScb* p_scb = avdt_scb_by_hdl(p_seid[i]);
+    if (p_scb == NULL) {
       *p_err_code = AVDT_ERR_BAD_STATE;
-    else if (p_scb->p_ccb != p_ccb)
+      return p_seid[i];
+    }
+
+    if (p_scb->p_ccb != p_ccb) {
       *p_err_code = AVDT_ERR_BAD_STATE;
-    else if (p_scb->stream_config.nsc_mask & nsc_mask)
+      return p_seid[i];
+    }
+
+    if (p_scb->stream_config.nsc_mask & nsc_mask) {
       *p_err_code = AVDT_ERR_NSC;
+      return p_seid[i];
+    }
 
     switch (state) {
       case AVDT_VERIFY_OPEN:
       case AVDT_VERIFY_START:
         if (p_scb->state != AVDT_SCB_OPEN_ST &&
-            p_scb->state != AVDT_SCB_STREAM_ST)
+            p_scb->state != AVDT_SCB_STREAM_ST) {
           *p_err_code = AVDT_ERR_BAD_STATE;
+          return p_seid[i];
+        }
         break;
 
       case AVDT_VERIFY_SUSPEND:
       case AVDT_VERIFY_STREAMING:
-        if (p_scb->state != AVDT_SCB_STREAM_ST)
+        if (p_scb->state != AVDT_SCB_STREAM_ST) {
           *p_err_code = AVDT_ERR_BAD_STATE;
+          return p_seid[i];
+        }
         break;
     }
   }
 
-  if ((i != num_seid) && (i < AVDT_NUM_SEPS)) {
-    ret = p_seid[i];
-  }
-
-  return ret;
+  return 0;
 }
 
 /*******************************************************************************
diff --git a/system/stack/avrc/avrc_pars_tg.cc b/system/stack/avrc/avrc_pars_tg.cc
index 6aa4a31..71cebef 100644
--- a/system/stack/avrc/avrc_pars_tg.cc
+++ b/system/stack/avrc/avrc_pars_tg.cc
@@ -118,6 +118,13 @@
   if (p_msg->vendor_len == 0) return AVRC_STS_NO_ERROR;
   if (p_msg->p_vendor_data == NULL) return AVRC_STS_INTERNAL_ERR;
 
+  if (p_msg->vendor_len < 4) {
+    android_errorWriteLog(0x534e4554, "168712382");
+    AVRC_TRACE_WARNING("%s: message length %d too short: must be at least 4",
+                       __func__, p_msg->vendor_len);
+    return AVRC_STS_INTERNAL_ERR;
+  }
+
   p = p_msg->p_vendor_data;
   p_result->pdu = *p++;
   AVRC_TRACE_DEBUG("%s pdu:0x%x", __func__, p_result->pdu);
diff --git a/system/stack/btm/btm_ble_batchscan.cc b/system/stack/btm/btm_ble_batchscan.cc
index 65732a5..8daace5 100644
--- a/system/stack/btm/btm_ble_batchscan.cc
+++ b/system/stack/btm/btm_ble_batchscan.cc
@@ -267,6 +267,11 @@
     return;
   }
 
+  if (len < 4) {
+    BTM_TRACE_ERROR("%s: wrong length", __func__);
+    return;
+  }
+
   uint8_t report_format, num_records;
   STREAM_TO_UINT8(report_format, p);
   STREAM_TO_UINT8(num_records, p);
diff --git a/system/stack/btm/btm_ble_bgconn.cc b/system/stack/btm/btm_ble_bgconn.cc
index fa9b10b..fd64abc 100644
--- a/system/stack/btm/btm_ble_bgconn.cc
+++ b/system/stack/btm/btm_ble_bgconn.cc
@@ -368,18 +368,18 @@
   }
 
   btm_send_hci_create_connection(
-      scan_int,                            /* uint16_t scan_int      */
-      scan_win,                            /* uint16_t scan_win      */
-      0x01,                                /* uint8_t acceptlist     */
-      peer_addr_type,                      /* uint8_t addr_type_peer */
-      RawAddress::kEmpty,                  /* BD_ADDR bda_peer     */
-      own_addr_type,                       /* uint8_t addr_type_own */
-      BTM_BLE_CONN_INT_MIN_DEF,            /* uint16_t conn_int_min  */
-      BTM_BLE_CONN_INT_MAX_DEF,            /* uint16_t conn_int_max  */
+      scan_int,                       /* uint16_t scan_int      */
+      scan_win,                       /* uint16_t scan_win      */
+      0x01,                           /* uint8_t acceptlist     */
+      peer_addr_type,                 /* uint8_t addr_type_peer */
+      RawAddress::kEmpty,             /* BD_ADDR bda_peer     */
+      own_addr_type,                  /* uint8_t addr_type_own */
+      BTM_BLE_CONN_INT_MIN_DEF,       /* uint16_t conn_int_min  */
+      BTM_BLE_CONN_INT_MAX_DEF,       /* uint16_t conn_int_max  */
       BTM_BLE_CONN_PERIPHERAL_LATENCY_DEF, /* uint16_t conn_latency  */
-      BTM_BLE_CONN_TIMEOUT_DEF,            /* uint16_t conn_timeout  */
-      0,                                   /* uint16_t min_len       */
-      0,                                   /* uint16_t max_len       */
+      BTM_BLE_CONN_TIMEOUT_DEF,       /* uint16_t conn_timeout  */
+      0,                              /* uint16_t min_len       */
+      0,                              /* uint16_t max_len       */
       phy);
   return true;
 }
diff --git a/system/stack/btm/btm_ble_gap.cc b/system/stack/btm/btm_ble_gap.cc
index 9aa417b..72b786d 100644
--- a/system/stack/btm/btm_ble_gap.cc
+++ b/system/stack/btm/btm_ble_gap.cc
@@ -1774,8 +1774,9 @@
   /* Extract the number of reports in this event. */
   STREAM_TO_UINT8(num_reports, p);
 
+  constexpr int extended_report_header_size = 24;
   while (num_reports--) {
-    if (p > data + data_len) {
+    if (p + extended_report_header_size > data + data_len) {
       // TODO(jpawlowski): we should crash the stack here
       BTM_TRACE_ERROR(
           "Malformed LE Extended Advertising Report Event from controller - "
@@ -1836,8 +1837,9 @@
   /* Extract the number of reports in this event. */
   STREAM_TO_UINT8(num_reports, p);
 
+  constexpr int report_header_size = 10;
   while (num_reports--) {
-    if (p > data + data_len) {
+    if (p + report_header_size > data + data_len) {
       // TODO(jpawlowski): we should crash the stack here
       BTM_TRACE_ERROR("Malformed LE Advertising Report Event from controller");
       return;
diff --git a/system/stack/gatt/gatt_api.cc b/system/stack/gatt/gatt_api.cc
index 063c821..0c3669e 100644
--- a/system/stack/gatt/gatt_api.cc
+++ b/system/stack/gatt/gatt_api.cc
@@ -519,6 +519,7 @@
     return GATT_ILLEGAL_PARAMETER;
   }
 
+  memset(&notif, 0, sizeof(notif));
   notif.handle = attr_handle;
   notif.len = val_len;
   memcpy(notif.value, p_val, val_len);
diff --git a/system/stack/include/ldacBT_bco_for_fluoride.h b/system/stack/include/ldacBT_bco_for_fluoride.h
index d97a5dc..3d9e548 100644
--- a/system/stack/include/ldacBT_bco_for_fluoride.h
+++ b/system/stack/include/ldacBT_bco_for_fluoride.h
@@ -28,7 +28,7 @@
 #endif /* LDAC_BCO_API */
 
 /* This file contains the definitions, declarations and macros for an
- * implementation of LDAC buffer control operation.
+ * implimentation of LDAC buffer control operation.
  */
 
 #define LDAC_BCO_ERR_NONE 0
diff --git a/system/stack/sdp/sdp_db.cc b/system/stack/sdp/sdp_db.cc
index 0ec0a85..879bf63 100644
--- a/system/stack/sdp/sdp_db.cc
+++ b/system/stack/sdp/sdp_db.cc
@@ -374,11 +374,22 @@
           "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p, "
           "*p_val:%d",
           handle, attr_id, attr_type, attr_len, p_val, *p_val);
+    } else if ((attr_type == TEXT_STR_DESC_TYPE) ||
+               (attr_type == URL_DESC_TYPE)) {
+      if (p_val[attr_len - 1] == '\0') {
+        SDP_TRACE_DEBUG(
+            "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p, "
+            "*p_val:%s",
+            handle, attr_id, attr_type, attr_len, p_val, (char*)p_val);
+      } else {
+        SDP_TRACE_DEBUG(
+            "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p",
+            handle, attr_id, attr_type, attr_len, p_val);
+      }
     } else {
       SDP_TRACE_DEBUG(
-          "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p, "
-          "*p_val:%s",
-          handle, attr_id, attr_type, attr_len, p_val, p_val);
+          "SDP_AddAttribute: handle:%X, id:%04X, type:%d, len:%d, p_val:%p",
+          handle, attr_id, attr_type, attr_len, p_val);
     }
   }
 
@@ -758,13 +769,13 @@
   uint32_t len; /* Number of bytes in the entry */
 
   /* Find the record in the database */
-  for (uint16_t xx = 0; xx < sdp_cb.server_db.num_records; xx++, p_rec++) {
+  for (uint16_t record_index = 0; record_index < sdp_cb.server_db.num_records; record_index++, p_rec++) {
     if (p_rec->record_handle == handle) {
       tSDP_ATTRIBUTE* p_attr = &p_rec->attribute[0];
 
       SDP_TRACE_API("Deleting attr_id 0x%04x for handle 0x%x", attr_id, handle);
       /* Found it. Now, find the attribute */
-      for (uint16_t yy = 0; yy < p_rec->num_attributes; yy++, p_attr++) {
+      for (uint16_t attribute_index = 0; attribute_index < p_rec->num_attributes; attribute_index++, p_attr++) {
         if (p_attr->id == attr_id) {
           pad_ptr = p_attr->value_ptr;
           len = p_attr->len;
@@ -779,15 +790,15 @@
           /* Found it. Shift everything up one */
           p_rec->num_attributes--;
 
-          for (uint16_t zz = xx; zz < p_rec->num_attributes; zz++, p_attr++) {
+          for (uint16_t zz = attribute_index; zz < p_rec->num_attributes; zz++, p_attr++) {
             *p_attr = *(p_attr + 1);
           }
 
           /* adjust attribute values if needed */
           if (len) {
-            xx =
+            uint16_t last_attribute_to_adjust =
                 (p_rec->free_pad_ptr - ((pad_ptr + len) - &p_rec->attr_pad[0]));
-            for (uint16_t zz = 0; zz < xx; zz++, pad_ptr++) {
+            for (uint16_t zz = 0; zz < last_attribute_to_adjust; zz++, pad_ptr++) {
               *pad_ptr = *(pad_ptr + len);
             }
             p_rec->free_pad_ptr -= len;
diff --git a/system/stack/smp/smp_br_main.cc b/system/stack/smp/smp_br_main.cc
index d67eb5b..b311d9d 100644
--- a/system/stack/smp/smp_br_main.cc
+++ b/system/stack/smp/smp_br_main.cc
@@ -306,7 +306,6 @@
   tSMP_BR_STATE curr_state = p_cb->br_state;
   tSMP_BR_SM_TBL state_table;
   uint8_t action, entry;
-  tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role];
 
   SMP_TRACE_EVENT("main %s", __func__);
   if (curr_state >= SMP_BR_STATE_MAX) {
@@ -320,6 +319,8 @@
     return;
   }
 
+  tSMP_BR_ENTRY_TBL entry_table = smp_br_entry_table[p_cb->role];
+
   SMP_TRACE_DEBUG(
       "SMP Role: %s State: [%s (%d)], Event: [%s (%d)]",
       (p_cb->role == HCI_ROLE_PERIPHERAL) ? "Peripheral" : "Central",
diff --git a/system/stack/test/gatt/gatt_sr_test.cc b/system/stack/test/gatt/gatt_sr_test.cc
index 551f543..a17f4fd 100644
--- a/system/stack/test/gatt/gatt_sr_test.cc
+++ b/system/stack/test/gatt/gatt_sr_test.cc
@@ -125,6 +125,9 @@
 void l2cble_set_fixed_channel_tx_data_length(const RawAddress& remote_bda,
                                              uint16_t fix_cid,
                                              uint16_t tx_mtu) {}
+void L2CA_SetLeFixedChannelTxDataLength(const RawAddress& remote_bda,
+                                        uint16_t fix_cid,
+                                        uint16_t tx_mtu) {}
 bool SDP_AddAttribute(uint32_t handle, uint16_t attr_id, uint8_t attr_type,
                       uint32_t attr_len, uint8_t* p_val) {
   return false;
diff --git a/system/types/Android.bp b/system/types/Android.bp
index 2a6e0dd..ac2f0f0 100644
--- a/system/types/Android.bp
+++ b/system/types/Android.bp
@@ -48,9 +48,6 @@
     test_suites: ["device-tests"],
     defaults: ["fluoride_defaults"],
     host_supported: true,
-    test_options: {
-        unit_test: true,
-    },
     srcs: [
         "test/class_of_device_unittest.cc",
         "test/raw_address_unittest.cc",