diff --git a/audio/2.0/default/service.cpp b/audio/2.0/default/service.cpp
index 28ef660..646d898 100644
--- a/audio/2.0/default/service.cpp
+++ b/audio/2.0/default/service.cpp
@@ -16,14 +16,17 @@
 
 #define LOG_TAG "audiohalservice"
 
+#include <hidl/HidlTransportSupport.h>
 #include <hidl/LegacySupport.h>
 #include <android/hardware/audio/2.0/IDevicesFactory.h>
 #include <android/hardware/audio/effect/2.0/IEffectsFactory.h>
 #include <android/hardware/soundtrigger/2.0/ISoundTriggerHw.h>
 #include <android/hardware/broadcastradio/1.0/IBroadcastRadioFactory.h>
 
-using android::hardware::IPCThreadState;
-using android::hardware::ProcessState;
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+using android::hardware::registerPassthroughServiceImplementation;
+
 using android::hardware::audio::effect::V2_0::IEffectsFactory;
 using android::hardware::audio::V2_0::IDevicesFactory;
 using android::hardware::soundtrigger::V2_0::ISoundTriggerHw;
@@ -31,9 +34,10 @@
 using android::hardware::broadcastradio::V1_0::IBroadcastRadioFactory;
 
 int main(int /* argc */, char* /* argv */ []) {
+    configureRpcThreadpool(16, true /*callerWillJoin*/);
     registerPassthroughServiceImplementation<IDevicesFactory>("audio_devices_factory");
     registerPassthroughServiceImplementation<IEffectsFactory>("audio_effects_factory");
     registerPassthroughServiceImplementation<ISoundTriggerHw>("sound_trigger.primary");
     registerPassthroughServiceImplementation<IBroadcastRadioFactory>("broadcastradio");
-    return android::hardware::launchRpcServer(16);
+    joinRpcThreadpool();
 }
diff --git a/audio/common/2.0/types.hal b/audio/common/2.0/types.hal
index 13fd19b..eec4ac2 100644
--- a/audio/common/2.0/types.hal
+++ b/audio/common/2.0/types.hal
@@ -705,6 +705,7 @@
     ASSISTANCE_SONIFICATION            = 13,
     GAME                               = 14,
     VIRTUAL_SOURCE                     = 15,
+    ASSISTANT                          = 16,
 
     CNT,
     MAX                                = CNT - 1,
diff --git a/audio/common/2.0/vts/types.vts b/audio/common/2.0/vts/types.vts
index 9c79611..8d1a9db 100644
--- a/audio/common/2.0/vts/types.vts
+++ b/audio/common/2.0/vts/types.vts
@@ -132,7 +132,7 @@
         }
         enumerator: "PUBLIC_CNT"
         scalar_value: {
-            int32_t: 10
+            int32_t: 11
         }
         enumerator: "FOR_POLICY_CNT"
         scalar_value: {
@@ -309,6 +309,82 @@
         scalar_value: {
             uint32_t: 234881024
         }
+        enumerator: "EVRC"
+        scalar_value: {
+            uint32_t: 268435456
+        }
+        enumerator: "EVRCB"
+        scalar_value: {
+            uint32_t: 285212672
+        }
+        enumerator: "EVRCWB"
+        scalar_value: {
+            uint32_t: 301989888
+        }
+        enumerator: "EVRCNW"
+        scalar_value: {
+            uint32_t: 318767104
+        }
+        enumerator: "AAC_ADIF"
+        scalar_value: {
+            uint32_t: 335544320
+        }
+        enumerator: "WMA"
+        scalar_value: {
+            uint32_t: 352321536
+        }
+        enumerator: "WMA_PRO"
+        scalar_value: {
+            uint32_t: 369098752
+        }
+        enumerator: "AMR_WB_PLUS"
+        scalar_value: {
+            uint32_t: 385875968
+        }
+        enumerator: "MP2"
+        scalar_value: {
+            uint32_t: 402653184
+        }
+        enumerator: "QCELP"
+        scalar_value: {
+            uint32_t: 419430400
+        }
+        enumerator: "DSD"
+        scalar_value: {
+            uint32_t: 436207616
+        }
+        enumerator: "FLAC"
+        scalar_value: {
+            uint32_t: 452984832
+        }
+        enumerator: "ALAC"
+        scalar_value: {
+            uint32_t: 469762048
+        }
+        enumerator: "APE"
+        scalar_value: {
+            uint32_t: 486539264
+        }
+        enumerator: "AAC_ADTS"
+        scalar_value: {
+            uint32_t: 503316480
+        }
+        enumerator: "SBC"
+        scalar_value: {
+            uint32_t: 520093696
+        }
+        enumerator: "APTX"
+        scalar_value: {
+            uint32_t: 536870912
+        }
+        enumerator: "APTX_HD"
+        scalar_value: {
+            uint32_t: 553648128
+        }
+        enumerator: "LDAC"
+        scalar_value: {
+            uint32_t: 570425344
+        }
         enumerator: "MAIN_MASK"
         scalar_value: {
             uint32_t: 4278190080
@@ -457,6 +533,46 @@
         scalar_value: {
             uint32_t: 67109376
         }
+        enumerator: "AAC_ADTS_MAIN"
+        scalar_value: {
+            uint32_t: 503316481
+        }
+        enumerator: "AAC_ADTS_LC"
+        scalar_value: {
+            uint32_t: 503316482
+        }
+        enumerator: "AAC_ADTS_SSR"
+        scalar_value: {
+            uint32_t: 503316484
+        }
+        enumerator: "AAC_ADTS_LTP"
+        scalar_value: {
+            uint32_t: 503316488
+        }
+        enumerator: "AAC_ADTS_HE_V1"
+        scalar_value: {
+            uint32_t: 503316496
+        }
+        enumerator: "AAC_ADTS_SCALABLE"
+        scalar_value: {
+            uint32_t: 503316512
+        }
+        enumerator: "AAC_ADTS_ERLC"
+        scalar_value: {
+            uint32_t: 503316544
+        }
+        enumerator: "AAC_ADTS_LD"
+        scalar_value: {
+            uint32_t: 503316608
+        }
+        enumerator: "AAC_ADTS_HE_V2"
+        scalar_value: {
+            uint32_t: 503316736
+        }
+        enumerator: "AAC_ADTS_ELD"
+        scalar_value: {
+            uint32_t: 503316992
+        }
     }
 }
 
@@ -579,6 +695,10 @@
         scalar_value: {
             uint32_t: 3
         }
+        enumerator: "OUT_2POINT1"
+        scalar_value: {
+            uint32_t: 11
+        }
         enumerator: "OUT_QUAD"
         scalar_value: {
             uint32_t: 51
@@ -591,6 +711,14 @@
         scalar_value: {
             uint32_t: 1539
         }
+        enumerator: "OUT_SURROUND"
+        scalar_value: {
+            uint32_t: 263
+        }
+        enumerator: "OUT_PENTA"
+        scalar_value: {
+            uint32_t: 55
+        }
         enumerator: "OUT_5POINT1"
         scalar_value: {
             uint32_t: 63
@@ -603,6 +731,10 @@
         scalar_value: {
             uint32_t: 1551
         }
+        enumerator: "OUT_6POINT1"
+        scalar_value: {
+            uint32_t: 319
+        }
         enumerator: "OUT_7POINT1"
         scalar_value: {
             uint32_t: 1599
@@ -679,6 +811,18 @@
         scalar_value: {
             uint32_t: 48
         }
+        enumerator: "IN_VOICE_UPLINK_MONO"
+        scalar_value: {
+            uint32_t: 16400
+        }
+        enumerator: "IN_VOICE_DNLINK_MONO"
+        scalar_value: {
+            uint32_t: 32784
+        }
+        enumerator: "IN_VOICE_CALL_MONO"
+        scalar_value: {
+            uint32_t: 49168
+        }
         enumerator: "IN_ALL"
         scalar_value: {
             uint32_t: 65532
@@ -906,13 +1050,17 @@
         scalar_value: {
             uint32_t: 16777216
         }
+        enumerator: "OUT_PROXY"
+        scalar_value: {
+            uint32_t: 33554432
+        }
         enumerator: "OUT_DEFAULT"
         scalar_value: {
             uint32_t: 1073741824
         }
         enumerator: "OUT_ALL"
         scalar_value: {
-            uint32_t: 1107296255
+            uint32_t: 1140850687
         }
         enumerator: "OUT_ALL_A2DP"
         scalar_value: {
@@ -1018,13 +1166,17 @@
         scalar_value: {
             uint32_t: 2148532224
         }
+        enumerator: "IN_PROXY"
+        scalar_value: {
+            uint32_t: 2164260864
+        }
         enumerator: "IN_DEFAULT"
         scalar_value: {
             uint32_t: 3221225472
         }
         enumerator: "IN_ALL"
         scalar_value: {
-            uint32_t: 3223322623
+            uint32_t: 3240099839
         }
         enumerator: "IN_ALL_SCO"
         scalar_value: {
@@ -1091,6 +1243,14 @@
         scalar_value: {
             int32_t: 1024
         }
+        enumerator: "DIRECT_PCM"
+        scalar_value: {
+            int32_t: 8192
+        }
+        enumerator: "MMAP_NOIRQ"
+        scalar_value: {
+            int32_t: 16384
+        }
     }
 }
 
@@ -1120,6 +1280,91 @@
         scalar_value: {
             int32_t: 8
         }
+        enumerator: "MMAP_NOIRQ"
+        scalar_value: {
+            int32_t: 16
+        }
+    }
+}
+
+attribute: {
+    name: "::android::hardware::audio::common::V2_0::AudioUsage"
+    type: TYPE_ENUM
+    enum_value: {
+        scalar_type: "int32_t"
+
+        enumerator: "UNKNOWN"
+        scalar_value: {
+            int32_t: 0
+        }
+        enumerator: "MEDIA"
+        scalar_value: {
+            int32_t: 1
+        }
+        enumerator: "VOICE_COMMUNICATION"
+        scalar_value: {
+            int32_t: 2
+        }
+        enumerator: "VOICE_COMMUNICATION_SIGNALLING"
+        scalar_value: {
+            int32_t: 3
+        }
+        enumerator: "ALARM"
+        scalar_value: {
+            int32_t: 4
+        }
+        enumerator: "NOTIFICATION"
+        scalar_value: {
+            int32_t: 5
+        }
+        enumerator: "NOTIFICATION_TELEPHONY_RINGTONE"
+        scalar_value: {
+            int32_t: 6
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_REQUEST"
+        scalar_value: {
+            int32_t: 7
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_INSTANT"
+        scalar_value: {
+            int32_t: 8
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_DELAYED"
+        scalar_value: {
+            int32_t: 9
+        }
+        enumerator: "NOTIFICATION_EVENT"
+        scalar_value: {
+            int32_t: 10
+        }
+        enumerator: "ASSISTANCE_ACCESSIBILITY"
+        scalar_value: {
+            int32_t: 11
+        }
+        enumerator: "ASSISTANCE_NAVIGATION_GUIDANCE"
+        scalar_value: {
+            int32_t: 12
+        }
+        enumerator: "ASSISTANCE_SONIFICATION"
+        scalar_value: {
+            int32_t: 13
+        }
+        enumerator: "GAME"
+        scalar_value: {
+            int32_t: 14
+        }
+        enumerator: "VIRTUAL_SOURCE"
+        scalar_value: {
+            int32_t: 15
+        }
+        enumerator: "CNT"
+        scalar_value: {
+            int32_t: 16
+        }
+        enumerator: "MAX"
+        scalar_value: {
+            int32_t: 15
+        }
     }
 }
 
@@ -1166,6 +1411,21 @@
         type: TYPE_SCALAR
         scalar_type: "bool_t"
     }
+    struct_value: {
+        name: "bitWidth"
+        type: TYPE_SCALAR
+        scalar_type: "uint32_t"
+    }
+    struct_value: {
+        name: "bufferSize"
+        type: TYPE_SCALAR
+        scalar_type: "uint32_t"
+    }
+    struct_value: {
+        name: "usage"
+        type: TYPE_ENUM
+        predefined_type: "::android::hardware::audio::common::V2_0::AudioUsage"
+    }
 }
 
 attribute: {
@@ -1440,6 +1700,11 @@
                 type: TYPE_SCALAR
                 scalar_type: "int32_t"
             }
+            struct_value: {
+                name: "useCase"
+                type: TYPE_UNION
+                predefined_type: "::android::hardware::audio::common::V2_0::AudioPortConfig::Ext::AudioPortConfigMixExt::UseCase"
+            }
         }
         union_value: {
             name: "device"
@@ -1497,6 +1762,11 @@
         type: TYPE_ENUM
         predefined_type: "::android::hardware::audio::common::V2_0::AudioPortRole"
     }
+    struct_value: {
+        name: "ext"
+        type: TYPE_UNION
+        predefined_type: "::android::hardware::audio::common::V2_0::AudioPortConfig::Ext"
+    }
 }
 
 attribute: {
@@ -1648,31 +1918,10 @@
         type: TYPE_ENUM
         predefined_type: "::android::hardware::audio::common::V2_0::AudioPortType"
     }
-}
-
-attribute: {
-    name: "::android::hardware::audio::common::V2_0::AudioPatch"
-    type: TYPE_STRUCT
     struct_value: {
-        name: "id"
-        type: TYPE_SCALAR
-        scalar_type: "int32_t"
-    }
-    struct_value: {
-        name: "sources"
-        type: TYPE_VECTOR
-        vector_value: {
-            type: TYPE_STRUCT
-            predefined_type: "::android::hardware::audio::common::V2_0::AudioPortConfig"
-        }
-    }
-    struct_value: {
-        name: "sinks"
-        type: TYPE_VECTOR
-        vector_value: {
-            type: TYPE_STRUCT
-            predefined_type: "::android::hardware::audio::common::V2_0::AudioPortConfig"
-        }
+        name: "ext"
+        type: TYPE_UNION
+        predefined_type: "::android::hardware::audio::common::V2_0::AudioPort::Ext"
     }
 }
 
diff --git a/benchmarks/msgq/1.0/IBenchmarkMsgQ.hal b/benchmarks/msgq/1.0/IBenchmarkMsgQ.hal
index 3af0b71..c4b9d95 100644
--- a/benchmarks/msgq/1.0/IBenchmarkMsgQ.hal
+++ b/benchmarks/msgq/1.0/IBenchmarkMsgQ.hal
@@ -25,7 +25,7 @@
      * by the service. Client can use it to set up the FMQ at its end.
      */
     configureClientInboxSyncReadWrite()
-        generates(bool ret, MQDescriptorSync mqDescIn);
+        generates(bool ret, fmq_sync<uint8_t> mqDescIn);
 
     /*
      * This method requests the service to set up Synchronous read/write
@@ -35,7 +35,7 @@
      * by the service. Client can use it to set up the FMQ at its end.
      */
     configureClientOutboxSyncReadWrite()
-        generates(bool ret, MQDescriptorSync mqDescOut);
+        generates(bool ret, fmq_sync<uint8_t> mqDescOut);
 
     /*
      * This method request the service to write into the FMQ.
diff --git a/bluetooth/1.0/default/Android.bp b/bluetooth/1.0/default/Android.bp
new file mode 100644
index 0000000..32e5328
--- /dev/null
+++ b/bluetooth/1.0/default/Android.bp
@@ -0,0 +1,52 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_library_shared {
+    name: "android.hardware.bluetooth@1.0-impl",
+    relative_install_path: "hw",
+    srcs: [
+        "async_fd_watcher.cc",
+        "bluetooth_hci.cc",
+        "bluetooth_address.cc",
+        "vendor_interface.cc",
+    ],
+    shared_libs: [
+        "android.hardware.bluetooth@1.0",
+        "libbase",
+        "libcutils",
+        "libhardware",
+        "libhwbinder",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libutils",
+    ],
+}
+
+cc_test_host {
+    name: "bluetooth-vendor-interface-unit-tests",
+    srcs: [
+        "bluetooth_address.cc",
+        "test/bluetooth_address_test.cc",
+        "test/properties.cc",
+    ],
+    local_include_dirs: [
+        "test",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+    ],
+}
diff --git a/bluetooth/1.0/default/Android.mk b/bluetooth/1.0/default/Android.mk
new file mode 100644
index 0000000..08bfb4e
--- /dev/null
+++ b/bluetooth/1.0/default/Android.mk
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_MODULE := android.hardware.bluetooth@1.0-service
+LOCAL_INIT_RC := android.hardware.bluetooth@1.0-service.rc
+LOCAL_SRC_FILES := \
+  service.cpp
+
+LOCAL_SHARED_LIBRARIES := \
+  liblog \
+  libcutils \
+  libdl \
+  libbase \
+  libutils \
+  libhardware_legacy \
+  libhardware \
+
+LOCAL_SHARED_LIBRARIES += \
+  libhwbinder \
+  libhidlbase \
+  libhidltransport \
+  android.hardware.bluetooth@1.0 \
+
+include $(BUILD_EXECUTABLE)
diff --git a/bluetooth/1.0/default/android.hardware.bluetooth@1.0-service.rc b/bluetooth/1.0/default/android.hardware.bluetooth@1.0-service.rc
new file mode 100644
index 0000000..8c5c02a
--- /dev/null
+++ b/bluetooth/1.0/default/android.hardware.bluetooth@1.0-service.rc
@@ -0,0 +1,4 @@
+service bluetooth-1-0 /system/bin/hw/android.hardware.bluetooth@1.0-service
+    class hal
+    user bluetooth
+    group bluetooth
diff --git a/bluetooth/1.0/default/async_fd_watcher.cc b/bluetooth/1.0/default/async_fd_watcher.cc
new file mode 100644
index 0000000..636b4b6
--- /dev/null
+++ b/bluetooth/1.0/default/async_fd_watcher.cc
@@ -0,0 +1,133 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "async_fd_watcher.h"
+
+#include <algorithm>
+#include <atomic>
+#include <condition_variable>
+#include <mutex>
+#include <thread>
+#include <vector>
+#include "fcntl.h"
+#include "sys/select.h"
+#include "unistd.h"
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+int AsyncFdWatcher::WatchFdForNonBlockingReads(
+    int file_descriptor, const ReadCallback& on_read_fd_ready_callback) {
+  // Add file descriptor and callback
+  {
+    std::unique_lock<std::mutex> guard(internal_mutex_);
+    read_fd_ = file_descriptor;
+    cb_ = on_read_fd_ready_callback;
+  }
+
+  // Start the thread if not started yet
+  int started = tryStartThread();
+  if (started != 0) {
+    return started;
+  }
+
+  return 0;
+}
+
+void AsyncFdWatcher::StopWatchingFileDescriptor() { stopThread(); }
+
+AsyncFdWatcher::~AsyncFdWatcher() {}
+
+// Make sure to call this with at least one file descriptor ready to be
+// watched upon or the thread routine will return immediately
+int AsyncFdWatcher::tryStartThread() {
+  if (std::atomic_exchange(&running_, true)) return 0;
+
+  // Set up the communication channel
+  int pipe_fds[2];
+  if (pipe2(pipe_fds, O_NONBLOCK)) return -1;
+
+  notification_listen_fd_ = pipe_fds[0];
+  notification_write_fd_ = pipe_fds[1];
+
+  thread_ = std::thread([this]() { ThreadRoutine(); });
+  if (!thread_.joinable()) return -1;
+
+  return 0;
+}
+
+int AsyncFdWatcher::stopThread() {
+  if (!std::atomic_exchange(&running_, false)) return 0;
+
+  notifyThread();
+  if (std::this_thread::get_id() != thread_.get_id()) {
+    thread_.join();
+  }
+
+  {
+    std::unique_lock<std::mutex> guard(internal_mutex_);
+    cb_ = nullptr;
+    read_fd_ = -1;
+  }
+
+  return 0;
+}
+
+int AsyncFdWatcher::notifyThread() {
+  uint8_t buffer[] = {0};
+  if (TEMP_FAILURE_RETRY(write(notification_write_fd_, &buffer, 1)) < 0) {
+    return -1;
+  }
+  return 0;
+}
+
+void AsyncFdWatcher::ThreadRoutine() {
+  while (running_) {
+    fd_set read_fds;
+    FD_ZERO(&read_fds);
+    FD_SET(notification_listen_fd_, &read_fds);
+    FD_SET(read_fd_, &read_fds);
+
+    // Wait until there is data available to read on some FD
+    int nfds = std::max(notification_listen_fd_, read_fd_);
+    int retval = select(nfds + 1, &read_fds, NULL, NULL, NULL);
+    if (retval <= 0) continue;  // there was some error or a timeout
+
+    // Read data from the notification FD
+    if (FD_ISSET(notification_listen_fd_, &read_fds)) {
+      char buffer[] = {0};
+      TEMP_FAILURE_RETRY(read(notification_listen_fd_, buffer, 1));
+    }
+
+    // Make sure we're still running
+    if (!running_) break;
+
+    // Invoke the data ready callback if appropriate
+    if (FD_ISSET(read_fd_, &read_fds)) {
+      std::unique_lock<std::mutex> guard(internal_mutex_);
+      if (cb_) cb_(read_fd_);
+    }
+  }
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace bluetooth
+} // namespace hardware
+} // namespace android
diff --git a/bluetooth/1.0/default/async_fd_watcher.h b/bluetooth/1.0/default/async_fd_watcher.h
new file mode 100644
index 0000000..1e4da8c
--- /dev/null
+++ b/bluetooth/1.0/default/async_fd_watcher.h
@@ -0,0 +1,63 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#pragma once
+
+#include <mutex>
+#include <thread>
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+using ReadCallback = std::function<void(int)>;
+
+class AsyncFdWatcher {
+ public:
+  AsyncFdWatcher() = default;
+  ~AsyncFdWatcher();
+
+  int WatchFdForNonBlockingReads(int file_descriptor,
+                                 const ReadCallback& on_read_fd_ready_callback);
+  void StopWatchingFileDescriptor();
+
+ private:
+  AsyncFdWatcher(const AsyncFdWatcher&) = delete;
+  AsyncFdWatcher& operator=(const AsyncFdWatcher&) = delete;
+
+  int tryStartThread();
+  int stopThread();
+  int notifyThread();
+  void ThreadRoutine();
+
+  std::atomic_bool running_{false};
+  std::thread thread_;
+  std::mutex internal_mutex_;
+
+  int read_fd_;
+  int notification_listen_fd_;
+  int notification_write_fd_;
+  ReadCallback cb_;
+};
+
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace bluetooth
+} // namespace hardware
+} // namespace android
diff --git a/bluetooth/1.0/default/bluetooth_address.cc b/bluetooth/1.0/default/bluetooth_address.cc
new file mode 100644
index 0000000..b917de9
--- /dev/null
+++ b/bluetooth/1.0/default/bluetooth_address.cc
@@ -0,0 +1,93 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "bluetooth_address.h"
+
+#include <android-base/logging.h>
+#include <cutils/properties.h>
+#include <fcntl.h>
+#include <utils/Log.h>
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+void BluetoothAddress::bytes_to_string(const uint8_t* addr, char* addr_str) {
+  sprintf(addr_str, "%02x:%02x:%02x:%02x:%02x:%02x", addr[0], addr[1], addr[2],
+          addr[3], addr[4], addr[5]);
+}
+
+bool BluetoothAddress::string_to_bytes(const char* addr_str, uint8_t* addr) {
+  if (addr_str == NULL) return false;
+  if (strnlen(addr_str, kStringLength) != kStringLength) return false;
+  unsigned char trailing_char = '\0';
+
+  return (sscanf(addr_str, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx%1c",
+                 &addr[0], &addr[1], &addr[2], &addr[3], &addr[4], &addr[5],
+                 &trailing_char) == kBytes);
+}
+
+bool BluetoothAddress::get_local_address(uint8_t* local_addr) {
+  char property[PROPERTY_VALUE_MAX] = {0};
+  bool valid_bda = false;
+
+  // Get local bdaddr storage path from a system property.
+  if (property_get(PROPERTY_BT_BDADDR_PATH, property, NULL)) {
+    int addr_fd;
+
+    ALOGD("%s: Trying %s", __func__, property);
+
+    addr_fd = open(property, O_RDONLY);
+    if (addr_fd != -1) {
+      int bytes_read = read(addr_fd, property, kStringLength);
+      CHECK(bytes_read == kStringLength);
+      close(addr_fd);
+
+      // Null terminate the string.
+      property[kStringLength] = '\0';
+
+      // If the address is not all zeros, then use it.
+      const uint8_t zero_bdaddr[kBytes] = {0, 0, 0, 0, 0, 0};
+      if ((string_to_bytes(property, local_addr)) &&
+          (memcmp(local_addr, zero_bdaddr, kBytes) != 0)) {
+        valid_bda = true;
+        ALOGD("%s: Got Factory BDA %s", __func__, property);
+      }
+    }
+  }
+
+  // No BDADDR found in the file. Look for BDA in a factory property.
+  if (!valid_bda && property_get(FACTORY_BDADDR_PROPERTY, property, NULL) &&
+      string_to_bytes(property, local_addr)) {
+    valid_bda = true;
+  }
+
+  // No factory BDADDR found. Look for a previously stored BDA.
+  if (!valid_bda && property_get(PERSIST_BDADDR_PROPERTY, property, NULL) &&
+      string_to_bytes(property, local_addr)) {
+    valid_bda = true;
+  }
+
+  return valid_bda;
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
diff --git a/bluetooth/1.0/default/bluetooth_address.h b/bluetooth/1.0/default/bluetooth_address.h
new file mode 100644
index 0000000..94bf616
--- /dev/null
+++ b/bluetooth/1.0/default/bluetooth_address.h
@@ -0,0 +1,61 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#pragma once
+
+#include <fcntl.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+// The property key stores the storage location of Bluetooth Device Address
+static constexpr char PROPERTY_BT_BDADDR_PATH[] = "ro.bt.bdaddr_path";
+
+// Check for a legacy address stored as a property.
+static constexpr char PERSIST_BDADDR_PROPERTY[] =
+    "persist.service.bdroid.bdaddr";
+
+// If there is no valid bdaddr available from PROPERTY_BT_BDADDR_PATH and there
+// is no available persistent bdaddr available from PERSIST_BDADDR_PROPERTY,
+// use a factory set address.
+static constexpr char FACTORY_BDADDR_PROPERTY[] = "ro.boot.btmacaddr";
+
+// Encapsulate handling for Bluetooth Addresses:
+class BluetoothAddress {
+ public:
+  // Conversion constants
+  static constexpr size_t kStringLength = sizeof("XX:XX:XX:XX:XX:XX") - 1;
+  static constexpr size_t kBytes = (kStringLength + 1) / 3;
+
+  static void bytes_to_string(const uint8_t* addr, char* addr_str);
+
+  static bool string_to_bytes(const char* addr_str, uint8_t* addr);
+
+  static bool get_local_address(uint8_t* addr);
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace bluetooth
+} // namespace hardware
+} // namespace android
diff --git a/bluetooth/1.0/default/bluetooth_hci.cc b/bluetooth/1.0/default/bluetooth_hci.cc
new file mode 100644
index 0000000..d12bfb9
--- /dev/null
+++ b/bluetooth/1.0/default/bluetooth_hci.cc
@@ -0,0 +1,95 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#define LOG_TAG "android.hardware.bluetooth@1.0-impl"
+#include <utils/Log.h>
+
+#include "bluetooth_hci.h"
+#include "vendor_interface.h"
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+static const uint8_t HCI_DATA_TYPE_COMMAND = 1;
+static const uint8_t HCI_DATA_TYPE_ACL = 2;
+static const uint8_t HCI_DATA_TYPE_SCO = 3;
+
+Return<Status> BluetoothHci::initialize(
+    const ::android::sp<IBluetoothHciCallbacks>& cb) {
+  ALOGW("BluetoothHci::initialize()");
+  event_cb_ = cb;
+
+  bool rc = VendorInterface::Initialize(
+      [this](HciPacketType type, const hidl_vec<uint8_t>& packet) {
+        switch (type) {
+          case HCI_PACKET_TYPE_EVENT:
+            event_cb_->hciEventReceived(packet);
+            break;
+          case HCI_PACKET_TYPE_ACL_DATA:
+            event_cb_->aclDataReceived(packet);
+            break;
+          case HCI_PACKET_TYPE_SCO_DATA:
+            event_cb_->scoDataReceived(packet);
+            break;
+          default:
+            ALOGE("%s Unexpected event type %d", __func__, type);
+            break;
+        }
+      });
+  if (!rc) return Status::INITIALIZATION_ERROR;
+
+  return Status::SUCCESS;
+}
+
+Return<void> BluetoothHci::close() {
+  ALOGW("BluetoothHci::close()");
+  VendorInterface::Shutdown();
+  return Void();
+}
+
+Return<void> BluetoothHci::sendHciCommand(const hidl_vec<uint8_t>& command) {
+  sendDataToController(HCI_DATA_TYPE_COMMAND, command);
+  return Void();
+}
+
+Return<void> BluetoothHci::sendAclData(const hidl_vec<uint8_t>& data) {
+  sendDataToController(HCI_DATA_TYPE_ACL, data);
+  return Void();
+}
+
+Return<void> BluetoothHci::sendScoData(const hidl_vec<uint8_t>& data) {
+  sendDataToController(HCI_DATA_TYPE_SCO, data);
+  return Void();
+}
+
+void BluetoothHci::sendDataToController(const uint8_t type,
+                                        const hidl_vec<uint8_t>& data) {
+  VendorInterface::get()->Send(&type, 1);
+  VendorInterface::get()->Send(data.data(), data.size());
+}
+
+IBluetoothHci* HIDL_FETCH_IBluetoothHci(const char* /* name */) {
+  return new BluetoothHci();
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
diff --git a/bluetooth/1.0/default/bluetooth_hci.h b/bluetooth/1.0/default/bluetooth_hci.h
new file mode 100644
index 0000000..d297570
--- /dev/null
+++ b/bluetooth/1.0/default/bluetooth_hci.h
@@ -0,0 +1,55 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef HIDL_GENERATED_android_hardware_bluetooth_V1_0_BluetoothHci_H_
+#define HIDL_GENERATED_android_hardware_bluetooth_V1_0_BluetoothHci_H_
+
+#include <android/hardware/bluetooth/1.0/IBluetoothHci.h>
+
+#include <hidl/MQDescriptor.h>
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::Return;
+using ::android::hardware::hidl_vec;
+
+class BluetoothHci : public IBluetoothHci {
+ public:
+  Return<Status> initialize(
+      const ::android::sp<IBluetoothHciCallbacks>& cb) override;
+  Return<void> sendHciCommand(const hidl_vec<uint8_t>& packet) override;
+  Return<void> sendAclData(const hidl_vec<uint8_t>& data) override;
+  Return<void> sendScoData(const hidl_vec<uint8_t>& data) override;
+  Return<void> close() override;
+
+ private:
+  void sendDataToController(const uint8_t type, const hidl_vec<uint8_t>& data);
+  ::android::sp<IBluetoothHciCallbacks> event_cb_;
+};
+
+extern "C" IBluetoothHci* HIDL_FETCH_IBluetoothHci(const char* name);
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
+
+#endif  // HIDL_GENERATED_android_hardware_bluetooth_V1_0_BluetoothHci_H_
diff --git a/bluetooth/1.0/default/bt_vendor_lib.h b/bluetooth/1.0/default/bt_vendor_lib.h
new file mode 100644
index 0000000..c140e52
--- /dev/null
+++ b/bluetooth/1.0/default/bt_vendor_lib.h
@@ -0,0 +1,435 @@
+/******************************************************************************
+ *
+ *  Copyright (C) 2009-2012 Broadcom Corporation
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#ifndef BT_VENDOR_LIB_H
+#define BT_VENDOR_LIB_H
+
+#include <stdint.h>
+#include <sys/cdefs.h>
+#include <sys/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Struct types */
+
+/** Typedefs and defines */
+
+/** Vendor specific operations OPCODE */
+typedef enum {
+  /*  [operation]
+   *      Power on or off the BT Controller.
+   *  [input param]
+   *      A pointer to int type with content of bt_vendor_power_state_t.
+   *      Typecasting conversion: (int *) param.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_POWER_CTRL,
+
+  /*  [operation]
+   *      Perform any vendor specific initialization or configuration
+   *      on the BT Controller. This is called before stack initialization.
+   *  [input param]
+   *      None.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      Must call fwcfg_cb to notify the stack of the completion of vendor
+   *      specific initialization once it has been done.
+   */
+  BT_VND_OP_FW_CFG,
+
+  /*  [operation]
+   *      Perform any vendor specific SCO/PCM configuration on the BT
+   * Controller.
+   *      This is called after stack initialization.
+   *  [input param]
+   *      None.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      Must call scocfg_cb to notify the stack of the completion of vendor
+   *      specific SCO configuration once it has been done.
+   */
+  BT_VND_OP_SCO_CFG,
+
+  /*  [operation]
+   *      Open UART port on where the BT Controller is attached.
+   *      This is called before stack initialization.
+   *  [input param]
+   *      A pointer to int array type for open file descriptors.
+   *      The mapping of HCI channel to fd slot in the int array is given in
+   *      bt_vendor_hci_channels_t.
+   *      And, it requires the vendor lib to fill up the content before
+   * returning
+   *      the call.
+   *      Typecasting conversion: (int (*)[]) param.
+   *  [return]
+   *      Numbers of opened file descriptors.
+   *      Valid number:
+   *          1 - CMD/EVT/ACL-In/ACL-Out via the same fd (e.g. UART)
+   *          2 - CMD/EVT on one fd, and ACL-In/ACL-Out on the other fd
+   *          4 - CMD, EVT, ACL-In, ACL-Out are on their individual fd
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_USERIAL_OPEN,
+
+  /*  [operation]
+   *      Close the previously opened UART port.
+   *  [input param]
+   *      None.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_USERIAL_CLOSE,
+
+  /*  [operation]
+   *      Get the LPM idle timeout in milliseconds.
+   *      The stack uses this information to launch a timer delay before it
+   *      attempts to de-assert LPM WAKE signal once downstream HCI packet
+   *      has been delivered.
+   *  [input param]
+   *      A pointer to uint32_t type which is passed in by the stack. And, it
+   *      requires the vendor lib to fill up the content before returning
+   *      the call.
+   *      Typecasting conversion: (uint32_t *) param.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_GET_LPM_IDLE_TIMEOUT,
+
+  /*  [operation]
+   *      Enable or disable LPM mode on BT Controller.
+   *  [input param]
+   *      A pointer to uint8_t type with content of bt_vendor_lpm_mode_t.
+   *      Typecasting conversion: (uint8_t *) param.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      Must call lpm_cb to notify the stack of the completion of LPM
+   *      disable/enable process once it has been done.
+   */
+  BT_VND_OP_LPM_SET_MODE,
+
+  /*  [operation]
+   *      Assert or Deassert LPM WAKE on BT Controller.
+   *  [input param]
+   *      A pointer to uint8_t type with content of bt_vendor_lpm_wake_state_t.
+   *      Typecasting conversion: (uint8_t *) param.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_LPM_WAKE_SET_STATE,
+
+  /*  [operation]
+   *      Perform any vendor specific commands related to audio state changes.
+   *  [input param]
+   *      a pointer to bt_vendor_op_audio_state_t indicating what audio state is
+   *      set.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      None.
+   */
+  BT_VND_OP_SET_AUDIO_STATE,
+
+  /*  [operation]
+   *      The epilog call to the vendor module so that it can perform any
+   *      vendor-specific processes (e.g. send a HCI_RESET to BT Controller)
+   *      before the caller calls for cleanup().
+   *  [input param]
+   *      None.
+   *  [return]
+   *      0 - default, don't care.
+   *  [callback]
+   *      Must call epilog_cb to notify the stack of the completion of vendor
+   *      specific epilog process once it has been done.
+   */
+  BT_VND_OP_EPILOG,
+
+  /*  [operation]
+   *      Call to the vendor module so that it can perform all vendor-specific
+   *      operations to start offloading a2dp media encode & tx.
+   *  [input param]
+   *      pointer to bt_vendor_op_a2dp_offload_start_t containing elements
+   *      required for VND FW to setup a2dp offload.
+   *  [return]
+   *      0  - default, dont care.
+   *  [callback]
+   *      Must call a2dp_offload_start_cb to notify the stack of the
+   *      completion of vendor specific setup process once it has been done.
+   */
+  BT_VND_OP_A2DP_OFFLOAD_START,
+
+  /*  [operation]
+   *      Call to the vendor module so that it can perform all vendor-specific
+   *      operations to suspend offloading a2dp media encode & tx.
+   *  [input param]
+   *      pointer to bt_vendor_op_a2dp_offload_t containing elements
+   *      required for VND FW to setup a2dp offload.
+   *  [return]
+   *      0  - default, dont care.
+   *  [callback]
+   *      Must call a2dp_offload_cb to notify the stack of the
+   *      completion of vendor specific setup process once it has been done.
+   */
+  BT_VND_OP_A2DP_OFFLOAD_STOP,
+
+} bt_vendor_opcode_t;
+
+/** Power on/off control states */
+typedef enum {
+  BT_VND_PWR_OFF,
+  BT_VND_PWR_ON,
+} bt_vendor_power_state_t;
+
+/** Define HCI channel identifier in the file descriptors array
+    used in BT_VND_OP_USERIAL_OPEN operation.
+ */
+typedef enum {
+  CH_CMD,      // HCI Command channel
+  CH_EVT,      // HCI Event channel
+  CH_ACL_OUT,  // HCI ACL downstream channel
+  CH_ACL_IN,   // HCI ACL upstream channel
+
+  CH_MAX  // Total channels
+} bt_vendor_hci_channels_t;
+
+/** LPM disable/enable request */
+typedef enum {
+  BT_VND_LPM_DISABLE,
+  BT_VND_LPM_ENABLE,
+} bt_vendor_lpm_mode_t;
+
+/** LPM WAKE set state request */
+typedef enum {
+  BT_VND_LPM_WAKE_ASSERT,
+  BT_VND_LPM_WAKE_DEASSERT,
+} bt_vendor_lpm_wake_state_t;
+
+/** Callback result values */
+typedef enum {
+  BT_VND_OP_RESULT_SUCCESS,
+  BT_VND_OP_RESULT_FAIL,
+} bt_vendor_op_result_t;
+
+/** audio (SCO) state changes triggering VS commands for configuration */
+typedef struct {
+  uint16_t handle;
+  uint16_t peer_codec;
+  uint16_t state;
+} bt_vendor_op_audio_state_t;
+
+/*
+ * Bluetooth Host/Controller Vendor callback structure.
+ */
+
+/* vendor initialization/configuration callback */
+typedef void (*cfg_result_cb)(bt_vendor_op_result_t result);
+
+/* datapath buffer allocation callback (callout)
+ *
+ *  Vendor lib needs to request a buffer through the alloc callout function
+ *  from HCI lib if the buffer is for constructing a HCI Command packet which
+ *  will be sent through xmit_cb to BT Controller.
+ *
+ *  For each buffer allocation, the requested size needs to be big enough to
+ *  accommodate the below header plus a complete HCI packet --
+ *      typedef struct
+ *      {
+ *          uint16_t          event;
+ *          uint16_t          len;
+ *          uint16_t          offset;
+ *          uint16_t          layer_specific;
+ *      } HC_BT_HDR;
+ *
+ *  HCI lib returns a pointer to the buffer where Vendor lib should use to
+ *  construct a HCI command packet as below format:
+ *
+ *  --------------------------------------------
+ *  |  HC_BT_HDR  |  HCI command               |
+ *  --------------------------------------------
+ *  where
+ *      HC_BT_HDR.event = 0x2000;
+ *      HC_BT_HDR.len = Length of HCI command;
+ *      HC_BT_HDR.offset = 0;
+ *      HC_BT_HDR.layer_specific = 0;
+ *
+ *  For example, a HCI_RESET Command will be formed as
+ *  ------------------------
+ *  |  HC_BT_HDR  |03|0c|00|
+ *  ------------------------
+ *  with
+ *      HC_BT_HDR.event = 0x2000;
+ *      HC_BT_HDR.len = 3;
+ *      HC_BT_HDR.offset = 0;
+ *      HC_BT_HDR.layer_specific = 0;
+ */
+typedef void* (*malloc_cb)(int size);
+
+/* datapath buffer deallocation callback (callout) */
+typedef void (*mdealloc_cb)(void* p_buf);
+
+/* define callback of the cmd_xmit_cb
+ *
+ *  The callback function which HCI lib will call with the return of command
+ *  complete packet. Vendor lib is responsible for releasing the buffer passed
+ *  in at the p_mem parameter by calling dealloc callout function.
+ */
+typedef void (*tINT_CMD_CBACK)(void* p_mem);
+
+/* hci command packet transmit callback (callout)
+ *
+ *  Vendor lib calls xmit_cb callout function in order to send a HCI Command
+ *  packet to BT Controller. The buffer carrying HCI Command packet content
+ *  needs to be first allocated through the alloc callout function.
+ *  HCI lib will release the buffer for Vendor lib once it has delivered the
+ *  packet content to BT Controller.
+ *
+ *  Vendor lib needs also provide a callback function (p_cback) which HCI lib
+ *  will call with the return of command complete packet.
+ *
+ *  The opcode parameter gives the HCI OpCode (combination of OGF and OCF) of
+ *  HCI Command packet. For example, opcode = 0x0c03 for the HCI_RESET command
+ *  packet.
+ */
+typedef uint8_t (*cmd_xmit_cb)(uint16_t opcode, void* p_buf,
+                               tINT_CMD_CBACK p_cback);
+
+typedef void (*cfg_a2dp_cb)(bt_vendor_op_result_t result, bt_vendor_opcode_t op,
+                            uint8_t bta_av_handle);
+
+typedef struct {
+  /** set to sizeof(bt_vendor_callbacks_t) */
+  size_t size;
+
+  /*
+   * Callback and callout functions have implemented in HCI libray
+   * (libbt-hci.so).
+   */
+
+  /* notifies caller result of firmware configuration request */
+  cfg_result_cb fwcfg_cb;
+
+  /* notifies caller result of sco configuration request */
+  cfg_result_cb scocfg_cb;
+
+  /* notifies caller result of lpm enable/disable */
+  cfg_result_cb lpm_cb;
+
+  /* notifies the result of codec setting */
+  cfg_result_cb audio_state_cb;
+
+  /* buffer allocation request */
+  malloc_cb alloc;
+
+  /* buffer deallocation request */
+  mdealloc_cb dealloc;
+
+  /* hci command packet transmit request */
+  cmd_xmit_cb xmit_cb;
+
+  /* notifies caller completion of epilog process */
+  cfg_result_cb epilog_cb;
+
+  /* notifies status of a2dp offload cmd's */
+  cfg_a2dp_cb a2dp_offload_cb;
+} bt_vendor_callbacks_t;
+
+/** A2DP offload request */
+typedef struct {
+  uint8_t bta_av_handle;  /* BTA_AV Handle for callbacks */
+  uint16_t xmit_quota;    /* Total ACL quota for light stack */
+  uint16_t acl_data_size; /* Max ACL data size across HCI transport */
+  uint16_t stream_mtu;
+  uint16_t local_cid;
+  uint16_t remote_cid;
+  uint16_t lm_handle;
+  uint8_t is_flushable; /* true if flushable channel */
+  uint32_t stream_source;
+  uint8_t codec_info[10]; /* Codec capabilities array */
+} bt_vendor_op_a2dp_offload_t;
+
+/*
+ * Bluetooth Host/Controller VENDOR Interface
+ */
+typedef struct {
+  /** Set to sizeof(bt_vndor_interface_t) */
+  size_t size;
+
+  /*
+   * Functions need to be implemented in Vendor libray (libbt-vendor.so).
+   */
+
+  /**
+   * Caller will open the interface and pass in the callback routines
+   * to the implemenation of this interface.
+   */
+  int (*init)(const bt_vendor_callbacks_t* p_cb, unsigned char* local_bdaddr);
+
+  /**  Vendor specific operations */
+  int (*op)(bt_vendor_opcode_t opcode, void* param);
+
+  /** Closes the interface */
+  void (*cleanup)(void);
+} bt_vendor_interface_t;
+
+/*
+ * External shared lib functions/data
+ */
+
+/* Entry point of DLib --
+ *      Vendor library needs to implement the body of bt_vendor_interface_t
+ *      structure and uses the below name as the variable name. HCI library
+ *      will use this symbol name to get address of the object through the
+ *      dlsym call.
+ */
+extern const bt_vendor_interface_t BLUETOOTH_VENDOR_LIB_INTERFACE;
+
+// MODIFICATION FOR NEW HAL/HIDL IMPLEMENTATION:
+// EXPOSE THE BT_HDR STRUCT HERE FOR THE VENDOR INTERFACE
+// ONLY, WITHOUT REQUIRING INCLUDES FROM system/bt OR OTHER
+// DIRECTORIES.
+// ONLY USED INSIDE transmit_cb.
+// DO NOT USE IN NEW HAL IMPLEMENTATIONS GOING FORWARD
+typedef struct
+{
+    uint16_t          event;
+    uint16_t          len;
+    uint16_t          offset;
+    uint16_t          layer_specific;
+    uint8_t           data[];
+} HC_BT_HDR;
+// /MODIFICATION
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* BT_VENDOR_LIB_H */
diff --git a/bluetooth/1.0/default/hci_internals.h b/bluetooth/1.0/default/hci_internals.h
new file mode 100644
index 0000000..d839590
--- /dev/null
+++ b/bluetooth/1.0/default/hci_internals.h
@@ -0,0 +1,44 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#pragma once
+
+// HCI UART transport packet types (Volume 4, Part A, 2)
+enum HciPacketType {
+  HCI_PACKET_TYPE_UNKNOWN = 0,
+  HCI_PACKET_TYPE_COMMAND = 1,
+  HCI_PACKET_TYPE_ACL_DATA = 2,
+  HCI_PACKET_TYPE_SCO_DATA = 3,
+  HCI_PACKET_TYPE_EVENT = 4
+};
+
+// 2 bytes for opcode, 1 byte for parameter length (Volume 2, Part E, 5.4.1)
+const size_t HCI_COMMAND_PREAMBLE_SIZE = 3;
+const size_t HCI_LENGTH_OFFSET_CMD = 2;
+
+// 2 bytes for handle, 2 bytes for data length (Volume 2, Part E, 5.4.2)
+const size_t HCI_ACL_PREAMBLE_SIZE = 4;
+const size_t HCI_LENGTH_OFFSET_ACL = 2;
+
+// 2 bytes for handle, 1 byte for data length (Volume 2, Part E, 5.4.3)
+const size_t HCI_SCO_PREAMBLE_SIZE = 3;
+const size_t HCI_LENGTH_OFFSET_SCO = 2;
+
+// 1 byte for event code, 1 byte for parameter length (Volume 2, Part E, 5.4.4)
+const size_t HCI_EVENT_PREAMBLE_SIZE = 2;
+const size_t HCI_LENGTH_OFFSET_EVT = 1;
+
+const size_t HCI_PREAMBLE_SIZE_MAX = HCI_ACL_PREAMBLE_SIZE;
diff --git a/bluetooth/1.0/default/service.cpp b/bluetooth/1.0/default/service.cpp
new file mode 100644
index 0000000..a3c3cad
--- /dev/null
+++ b/bluetooth/1.0/default/service.cpp
@@ -0,0 +1,29 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#define LOG_TAG "android.hardware.bluetooth@1.0-service"
+
+#include <android/hardware/bluetooth/1.0/IBluetoothHci.h>
+
+#include <hidl/LegacySupport.h>
+
+// Generated HIDL files
+using android::hardware::bluetooth::V1_0::IBluetoothHci;
+using android::hardware::defaultPassthroughServiceImplementation;
+
+int main() {
+  return defaultPassthroughServiceImplementation<IBluetoothHci>("bluetooth");
+}
diff --git a/bluetooth/1.0/default/test/bluetooth_address_test.cc b/bluetooth/1.0/default/test/bluetooth_address_test.cc
new file mode 100644
index 0000000..9f80ec2
--- /dev/null
+++ b/bluetooth/1.0/default/test/bluetooth_address_test.cc
@@ -0,0 +1,246 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include <cutils/properties.h>
+#include <fcntl.h>
+#include <gtest/gtest.h>
+
+#include <string>
+#include <vector>
+using std::vector;
+
+#include "bluetooth_address.h"
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+constexpr char kTestAddr1[BluetoothAddress::kStringLength + 1] =
+    "12:34:56:78:9a:bc";
+constexpr uint8_t kTestAddr1_bytes[BluetoothAddress::kBytes] = {
+    0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc};
+constexpr char kZeros[BluetoothAddress::kStringLength + 1] =
+    "00:00:00:00:00:00";
+constexpr uint8_t kZeros_bytes[BluetoothAddress::kBytes] = {0x00, 0x00, 0x00,
+                                                            0x00, 0x00, 0x00};
+constexpr char kTestAddrBad1[BluetoothAddress::kStringLength + 1] =
+    "bb:aa:dd:00:00:01";
+constexpr uint8_t kTestAddrBad1_bytes[BluetoothAddress::kBytes] = {
+    0xbb, 0xaa, 0xdd, 0x00, 0x00, 0x01};
+
+constexpr char kAddrPath[] = "/tmp/my_address_in_a_file.txt";
+
+class BluetoothAddressTest : public ::testing::Test {
+ public:
+  BluetoothAddressTest() {}
+  ~BluetoothAddressTest() {}
+
+  void FileWriteString(const char* path, const char* string);
+};
+
+void BluetoothAddressTest::FileWriteString(const char* path,
+                                           const char* string) {
+  int fd = open(path, O_CREAT | O_RDWR);
+  EXPECT_TRUE(fd > 0) << "err = " << strerror(errno);
+
+  size_t length = strlen(string);
+  size_t bytes_written = write(fd, string, length);
+
+  EXPECT_EQ(length, bytes_written) << strerror(errno);
+
+  close(fd);
+}
+
+TEST_F(BluetoothAddressTest, string_to_bytes) {
+  uint8_t addr[BluetoothAddress::kBytes];
+
+  // Malformed addresses
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("000000000000", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("00:00:00:00:0000", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("00:00:00:00:00:0", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("00:00:00:00:00:0;", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("aB:cD:eF:Gh:iJ:Kl", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("00:00:000:00:00:0;", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("12:34:56:78:90:12;", addr));
+  EXPECT_FALSE(BluetoothAddress::string_to_bytes("12:34:56:78:90:123", addr));
+
+  // Reasonable addresses
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes("00:00:00:00:00:00", addr));
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes("a5:a5:a5:a5:a5:a5", addr));
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes("5A:5A:5A:5A:5A:5A", addr));
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes("AA:BB:CC:DD:EE:FF", addr));
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes("aa:bb:cc:dd:ee:ff", addr));
+
+  // Compare the output to known bytes
+  uint8_t addrA[BluetoothAddress::kBytes];
+  uint8_t addrB[BluetoothAddress::kBytes];
+
+  // kTestAddr1
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes(kTestAddr1, addrA));
+  EXPECT_TRUE(memcmp(addrA, kTestAddr1_bytes, BluetoothAddress::kBytes) == 0);
+
+  // kZeros
+  EXPECT_TRUE(BluetoothAddress::string_to_bytes(kZeros, addrB));
+  EXPECT_TRUE(memcmp(addrB, kZeros_bytes, BluetoothAddress::kBytes) == 0);
+
+  // kTestAddr1 != kZeros
+  EXPECT_FALSE(memcmp(addrA, addrB, BluetoothAddress::kBytes) == 0);
+}
+
+TEST_F(BluetoothAddressTest, bytes_to_string) {
+  char addrA[BluetoothAddress::kStringLength + 1] = "";
+  char addrB[BluetoothAddress::kStringLength + 1] = "";
+
+  // kTestAddr1
+  BluetoothAddress::bytes_to_string(kTestAddr1_bytes, addrA);
+  EXPECT_TRUE(memcmp(addrA, kTestAddr1, BluetoothAddress::kStringLength) == 0);
+
+  // kZeros
+  BluetoothAddress::bytes_to_string(kZeros_bytes, addrB);
+  EXPECT_TRUE(memcmp(addrB, kZeros, BluetoothAddress::kStringLength) == 0);
+
+  // kTestAddr1 != kZeros
+  EXPECT_FALSE(memcmp(addrA, addrB, BluetoothAddress::kStringLength) == 0);
+}
+
+TEST_F(BluetoothAddressTest, property_set) {
+  // Set the properties to empty strings.
+  property_set(PERSIST_BDADDR_PROPERTY, "");
+  property_set(PROPERTY_BT_BDADDR_PATH, "");
+  property_set(FACTORY_BDADDR_PROPERTY, "");
+
+  // Get returns 0.
+  char prop[PROP_VALUE_MAX] = "";
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) == 0);
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) == 0);
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) == 0);
+
+  // Set the properties to known strings.
+  property_set(PERSIST_BDADDR_PROPERTY, "1");
+  property_set(PROPERTY_BT_BDADDR_PATH, "22");
+  property_set(FACTORY_BDADDR_PROPERTY, "333");
+
+  // Get returns the correct length.
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) == 1);
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) == 2);
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) == 3);
+
+  // Set the properties to empty strings again.
+  property_set(PERSIST_BDADDR_PROPERTY, "");
+  property_set(PROPERTY_BT_BDADDR_PATH, "");
+  property_set(FACTORY_BDADDR_PROPERTY, "");
+
+  // Get returns 0.
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) == 0);
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) == 0);
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) == 0);
+}
+
+TEST_F(BluetoothAddressTest, property_get) {
+  // Set the properties to known strings.
+  property_set(PERSIST_BDADDR_PROPERTY, PERSIST_BDADDR_PROPERTY);
+  property_set(PROPERTY_BT_BDADDR_PATH, PROPERTY_BT_BDADDR_PATH);
+  property_set(FACTORY_BDADDR_PROPERTY, FACTORY_BDADDR_PROPERTY);
+
+  // Get returns the same strings.
+  char prop[PROP_VALUE_MAX] = "";
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(PERSIST_BDADDR_PROPERTY, prop) == 0);
+
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(PROPERTY_BT_BDADDR_PATH, prop) == 0);
+
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(FACTORY_BDADDR_PROPERTY, prop) == 0);
+
+  // Set a property to a different known string.
+  char prop2[PROP_VALUE_MAX] = "Erased";
+  property_set(PERSIST_BDADDR_PROPERTY, prop2);
+
+  // Get returns the correct strings.
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(PROPERTY_BT_BDADDR_PATH, prop) == 0);
+
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(FACTORY_BDADDR_PROPERTY, prop) == 0);
+
+  // Set another property to prop2.
+  property_set(PROPERTY_BT_BDADDR_PATH, prop2);
+
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(FACTORY_BDADDR_PROPERTY, prop) == 0);
+
+  // Set the third property to prop2.
+  property_set(FACTORY_BDADDR_PROPERTY, prop2);
+
+  EXPECT_TRUE(property_get(PERSIST_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+
+  EXPECT_TRUE(property_get(PROPERTY_BT_BDADDR_PATH, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+
+  EXPECT_TRUE(property_get(FACTORY_BDADDR_PROPERTY, prop, NULL) > 0);
+  EXPECT_TRUE(strcmp(prop2, prop) == 0);
+}
+
+TEST_F(BluetoothAddressTest, get_local_address) {
+  EXPECT_TRUE(property_set(PERSIST_BDADDR_PROPERTY, "") == 0);
+  EXPECT_TRUE(property_set(FACTORY_BDADDR_PROPERTY, "") == 0);
+  uint8_t address[BluetoothAddress::kBytes];
+
+  // File contains a non-zero Address.
+  FileWriteString(kAddrPath, kTestAddr1);
+  EXPECT_TRUE(property_set(PROPERTY_BT_BDADDR_PATH, kAddrPath) == 0);
+  EXPECT_TRUE(BluetoothAddress::get_local_address(address));
+  EXPECT_TRUE(memcmp(address, kTestAddr1_bytes, BluetoothAddress::kBytes) == 0);
+
+  // File contains a zero address.
+  FileWriteString(kAddrPath, kZeros);
+  EXPECT_TRUE(property_set(PROPERTY_BT_BDADDR_PATH, kAddrPath) == 0);
+  EXPECT_FALSE(BluetoothAddress::get_local_address(address));
+
+  // Factory property contains an address.
+  EXPECT_TRUE(property_set(PERSIST_BDADDR_PROPERTY, kTestAddrBad1) == 0);
+  EXPECT_TRUE(property_set(FACTORY_BDADDR_PROPERTY, kTestAddr1) == 0);
+  EXPECT_TRUE(BluetoothAddress::get_local_address(address));
+  EXPECT_TRUE(memcmp(address, kTestAddr1_bytes, BluetoothAddress::kBytes) == 0);
+
+  // Persistent property contains an address.
+  memcpy(address, kTestAddrBad1_bytes, BluetoothAddress::kBytes);
+  EXPECT_TRUE(property_set(PERSIST_BDADDR_PROPERTY, kTestAddr1) == 0);
+  EXPECT_TRUE(property_set(FACTORY_BDADDR_PROPERTY, "") == 0);
+  EXPECT_TRUE(property_set(PROPERTY_BT_BDADDR_PATH, "") == 0);
+  EXPECT_TRUE(BluetoothAddress::get_local_address(address));
+  EXPECT_TRUE(memcmp(address, kTestAddr1_bytes, BluetoothAddress::kBytes) == 0);
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
diff --git a/bluetooth/1.0/default/test/properties.cc b/bluetooth/1.0/default/test/properties.cc
new file mode 100644
index 0000000..ad5c194
--- /dev/null
+++ b/bluetooth/1.0/default/test/properties.cc
@@ -0,0 +1,79 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#define LOG_TAG "properties"
+
+#include <ctype.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <cutils/properties.h>
+#include <utils/Log.h>
+
+static const int MAX_PROPERTIES = 5;
+
+struct property {
+  char key[PROP_KEY_MAX + 2];
+  char value[PROP_VALUE_MAX + 2];
+};
+
+int num_properties = 0;
+struct property properties[MAX_PROPERTIES];
+
+// Find the correct entry.
+static int property_find(const char *key) {
+  for (int i = 0; i < num_properties; i++) {
+    if (strncmp(properties[i].key, key, PROP_KEY_MAX) == 0) {
+      return i;
+    }
+  }
+  return MAX_PROPERTIES;
+}
+
+int property_set(const char *key, const char *value) {
+  if (strnlen(value, PROP_VALUE_MAX) > PROP_VALUE_MAX) return -1;
+
+  // Check to see if the property exists.
+  int prop_index = property_find(key);
+
+  if (prop_index == MAX_PROPERTIES) {
+    if (num_properties >= MAX_PROPERTIES) return -1;
+    prop_index = num_properties;
+    num_properties += 1;
+  }
+
+  // This is test code.  Be nice and don't push the boundary cases!
+  strncpy(properties[prop_index].key, key, PROP_KEY_MAX + 1);
+  strncpy(properties[prop_index].value, value, PROP_VALUE_MAX + 1);
+  return 0;
+}
+
+int property_get(const char *key, char *value, const char *default_value) {
+  // This doesn't mock the behavior of default value
+  if (default_value != NULL) ALOGE("%s: default_value is ignored!", __func__);
+
+  // Check to see if the property exists.
+  int prop_index = property_find(key);
+
+  if (prop_index == MAX_PROPERTIES) return 0;
+
+  int len = strlen(properties[prop_index].value);
+  memcpy(value, properties[prop_index].value, len);
+  value[len] = '\0';
+  return len;
+}
diff --git a/bluetooth/1.0/default/test/sys/system_properties.h b/bluetooth/1.0/default/test/sys/system_properties.h
new file mode 100644
index 0000000..b477a6b
--- /dev/null
+++ b/bluetooth/1.0/default/test/sys/system_properties.h
@@ -0,0 +1,20 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+// Mock sys/system_properties.h for testing
+
+#define PROP_VALUE_MAX 50
+#define PROP_KEY_MAX 50
diff --git a/bluetooth/1.0/default/vendor_interface.cc b/bluetooth/1.0/default/vendor_interface.cc
new file mode 100644
index 0000000..905e1a6
--- /dev/null
+++ b/bluetooth/1.0/default/vendor_interface.cc
@@ -0,0 +1,356 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "vendor_interface.h"
+
+#define LOG_TAG "android.hardware.bluetooth@1.0-impl"
+#include <android-base/logging.h>
+#include <cutils/properties.h>
+#include <utils/Log.h>
+
+#include <dlfcn.h>
+#include <fcntl.h>
+
+#include "bluetooth_address.h"
+
+static const char* VENDOR_LIBRARY_NAME = "libbt-vendor.so";
+static const char* VENDOR_LIBRARY_SYMBOL_NAME =
+    "BLUETOOTH_VENDOR_LIB_INTERFACE";
+
+static const int INVALID_FD = -1;
+
+namespace {
+
+using android::hardware::bluetooth::V1_0::implementation::VendorInterface;
+
+tINT_CMD_CBACK internal_command_cb;
+VendorInterface* g_vendor_interface = nullptr;
+
+const size_t preamble_size_for_type[] = {
+    0, HCI_COMMAND_PREAMBLE_SIZE, HCI_ACL_PREAMBLE_SIZE, HCI_SCO_PREAMBLE_SIZE,
+    HCI_EVENT_PREAMBLE_SIZE};
+const size_t packet_length_offset_for_type[] = {
+    0, HCI_LENGTH_OFFSET_CMD, HCI_LENGTH_OFFSET_ACL, HCI_LENGTH_OFFSET_SCO,
+    HCI_LENGTH_OFFSET_EVT};
+
+size_t HciGetPacketLengthForType(
+    HciPacketType type, const android::hardware::hidl_vec<uint8_t>& packet) {
+  size_t offset = packet_length_offset_for_type[type];
+  if (type == HCI_PACKET_TYPE_ACL_DATA) {
+    return (((packet[offset + 1]) << 8) | packet[offset]);
+  }
+  return packet[offset];
+}
+
+HC_BT_HDR* WrapPacketAndCopy(uint16_t event,
+                             const android::hardware::hidl_vec<uint8_t>& data) {
+  size_t packet_size = data.size() + sizeof(HC_BT_HDR);
+  HC_BT_HDR* packet = reinterpret_cast<HC_BT_HDR*>(new uint8_t[packet_size]);
+  packet->offset = 0;
+  packet->len = data.size();
+  packet->layer_specific = 0;
+  packet->event = event;
+  // TODO(eisenbach): Avoid copy here; if BT_HDR->data can be ensured to
+  // be the only way the data is accessed, a pointer could be passed here...
+  memcpy(packet->data, data.data(), data.size());
+  return packet;
+}
+
+uint8_t transmit_cb(uint16_t opcode, void* buffer, tINT_CMD_CBACK callback) {
+  ALOGV("%s opcode: 0x%04x, ptr: %p", __func__, opcode, buffer);
+  HC_BT_HDR* bt_hdr = reinterpret_cast<HC_BT_HDR*>(buffer);
+
+  internal_command_cb = callback;
+  uint8_t type = HCI_PACKET_TYPE_COMMAND;
+  VendorInterface::get()->SendPrivate(&type, 1);
+  VendorInterface::get()->SendPrivate(bt_hdr->data, bt_hdr->len);
+  return true;
+}
+
+void firmware_config_cb(bt_vendor_op_result_t result) {
+  ALOGD("%s result: %d", __func__, result);
+  VendorInterface::get()->OnFirmwareConfigured(result);
+}
+
+void sco_config_cb(bt_vendor_op_result_t result) {
+  ALOGD("%s result: %d", __func__, result);
+}
+
+void low_power_mode_cb(bt_vendor_op_result_t result) {
+  ALOGD("%s result: %d", __func__, result);
+}
+
+void sco_audiostate_cb(bt_vendor_op_result_t result) {
+  ALOGD("%s result: %d", __func__, result);
+}
+
+void* buffer_alloc_cb(int size) {
+  void* p = new uint8_t[size];
+  ALOGV("%s pts: %p, size: %d", __func__, p, size);
+  return p;
+}
+
+void buffer_free_cb(void* buffer) {
+  ALOGV("%s ptr: %p", __func__, buffer);
+  delete[] reinterpret_cast<uint8_t*>(buffer);
+}
+
+void epilog_cb(bt_vendor_op_result_t result) {
+  ALOGD("%s result: %d", __func__, result);
+}
+
+void a2dp_offload_cb(bt_vendor_op_result_t result, bt_vendor_opcode_t op,
+                     uint8_t av_handle) {
+  ALOGD("%s result: %d, op: %d, handle: %d", __func__, result, op, av_handle);
+}
+
+const bt_vendor_callbacks_t lib_callbacks = {
+    sizeof(lib_callbacks), firmware_config_cb, sco_config_cb,
+    low_power_mode_cb,     sco_audiostate_cb,  buffer_alloc_cb,
+    buffer_free_cb,        transmit_cb,        epilog_cb,
+    a2dp_offload_cb};
+
+}  // namespace
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+bool VendorInterface::Initialize(PacketReadCallback packet_read_cb) {
+  assert(!g_vendor_interface);
+  g_vendor_interface = new VendorInterface();
+  return g_vendor_interface->Open(packet_read_cb);
+}
+
+void VendorInterface::Shutdown() {
+  CHECK(g_vendor_interface);
+  g_vendor_interface->Close();
+  delete g_vendor_interface;
+  g_vendor_interface = nullptr;
+}
+
+VendorInterface* VendorInterface::get() { return g_vendor_interface; }
+
+bool VendorInterface::Open(PacketReadCallback packet_read_cb) {
+  firmware_configured_ = false;
+  packet_read_cb_ = packet_read_cb;
+
+  // Initialize vendor interface
+
+  lib_handle_ = dlopen(VENDOR_LIBRARY_NAME, RTLD_NOW);
+  if (!lib_handle_) {
+    ALOGE("%s unable to open %s (%s)", __func__, VENDOR_LIBRARY_NAME,
+          dlerror());
+    return false;
+  }
+
+  lib_interface_ = reinterpret_cast<bt_vendor_interface_t*>(
+      dlsym(lib_handle_, VENDOR_LIBRARY_SYMBOL_NAME));
+  if (!lib_interface_) {
+    ALOGE("%s unable to find symbol %s in %s (%s)", __func__,
+          VENDOR_LIBRARY_SYMBOL_NAME, VENDOR_LIBRARY_NAME, dlerror());
+    return false;
+  }
+
+  // Get the local BD address
+
+  uint8_t local_bda[BluetoothAddress::kBytes];
+  CHECK(BluetoothAddress::get_local_address(local_bda));
+  int status = lib_interface_->init(&lib_callbacks, (unsigned char*)local_bda);
+  if (status) {
+    ALOGE("%s unable to initialize vendor library: %d", __func__, status);
+    return false;
+  }
+
+  ALOGD("%s vendor library loaded", __func__);
+
+  // Power cycle chip
+
+  int power_state = BT_VND_PWR_OFF;
+  lib_interface_->op(BT_VND_OP_POWER_CTRL, &power_state);
+  power_state = BT_VND_PWR_ON;
+  lib_interface_->op(BT_VND_OP_POWER_CTRL, &power_state);
+
+  // Get the UART socket
+
+  int fd_list[CH_MAX] = {0};
+  int fd_count = lib_interface_->op(BT_VND_OP_USERIAL_OPEN, &fd_list);
+
+  if (fd_count != 1) {
+    ALOGE("%s fd count %d != 1; we can't handle this currently...", __func__,
+          fd_count);
+    return false;
+  }
+
+  uart_fd_ = fd_list[0];
+  if (uart_fd_ == INVALID_FD) {
+    ALOGE("%s unable to determine UART fd", __func__);
+    return false;
+  }
+
+  ALOGD("%s UART fd: %d", __func__, uart_fd_);
+
+  fd_watcher_.WatchFdForNonBlockingReads(uart_fd_,
+                                         [this](int fd) { OnDataReady(fd); });
+
+  // Start configuring the firmware
+  lib_interface_->op(BT_VND_OP_FW_CFG, nullptr);
+
+  return true;
+}
+
+void VendorInterface::Close() {
+  fd_watcher_.StopWatchingFileDescriptor();
+
+  if (lib_interface_ != nullptr) {
+    lib_interface_->op(BT_VND_OP_USERIAL_CLOSE, nullptr);
+    uart_fd_ = INVALID_FD;
+    int power_state = BT_VND_PWR_OFF;
+    lib_interface_->op(BT_VND_OP_POWER_CTRL, &power_state);
+  }
+
+  if (lib_handle_ != nullptr) {
+    dlclose(lib_handle_);
+    lib_handle_ = nullptr;
+  }
+
+  firmware_configured_ = false;
+}
+
+size_t VendorInterface::Send(const uint8_t* data, size_t length) {
+  if (firmware_configured_ && queued_data_.size() == 0)
+    return SendPrivate(data, length);
+
+  if (!firmware_configured_) {
+    ALOGI("%s queueing command", __func__);
+    queued_data_.resize(queued_data_.size() + length);
+    uint8_t* append_ptr = &queued_data_[queued_data_.size() - length];
+    memcpy(append_ptr, data, length);
+    return length;
+  }
+
+  ALOGI("%s sending queued command", __func__);
+  SendPrivate(queued_data_.data(), queued_data_.size());
+  queued_data_.resize(0);
+
+  ALOGI("%s done sending queued command", __func__);
+
+  return SendPrivate(data, length);
+}
+
+size_t VendorInterface::SendPrivate(const uint8_t* data, size_t length) {
+  if (uart_fd_ == INVALID_FD) return 0;
+
+  size_t transmitted_length = 0;
+  while (length > 0) {
+    ssize_t ret =
+        TEMP_FAILURE_RETRY(write(uart_fd_, data + transmitted_length, length));
+
+    if (ret == -1) {
+      if (errno == EAGAIN) continue;
+      ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
+      break;
+
+    } else if (ret == 0) {
+      // Nothing written :(
+      ALOGE("%s zero bytes written - something went wrong...", __func__);
+      break;
+    }
+
+    transmitted_length += ret;
+    length -= ret;
+  }
+
+  return transmitted_length;
+}
+
+void VendorInterface::OnFirmwareConfigured(uint8_t result) {
+  ALOGI("%s: result = %d", __func__, result);
+  firmware_configured_ = true;
+  VendorInterface::get()->Send(NULL, 0);
+}
+
+void VendorInterface::OnDataReady(int fd) {
+  switch (hci_parser_state_) {
+    case HCI_IDLE: {
+      uint8_t buffer[1] = {0};
+      size_t bytes_read = TEMP_FAILURE_RETRY(read(fd, buffer, 1));
+      CHECK(bytes_read == 1);
+      hci_packet_type_ = static_cast<HciPacketType>(buffer[0]);
+      // TODO(eisenbach): Check for workaround(s)
+      CHECK(hci_packet_type_ >= HCI_PACKET_TYPE_ACL_DATA &&
+            hci_packet_type_ <= HCI_PACKET_TYPE_EVENT)
+          << "buffer[0] = " << buffer[0];
+      hci_parser_state_ = HCI_TYPE_READY;
+      hci_packet_.resize(HCI_PREAMBLE_SIZE_MAX);
+      hci_packet_bytes_remaining_ = preamble_size_for_type[hci_packet_type_];
+      hci_packet_bytes_read_ = 0;
+      break;
+    }
+
+    case HCI_TYPE_READY: {
+      size_t bytes_read = TEMP_FAILURE_RETRY(
+          read(fd, hci_packet_.data() + hci_packet_bytes_read_,
+               hci_packet_bytes_remaining_));
+      CHECK(bytes_read > 0);
+      hci_packet_bytes_remaining_ -= bytes_read;
+      hci_packet_bytes_read_ += bytes_read;
+      if (hci_packet_bytes_remaining_ == 0) {
+        size_t packet_length =
+            HciGetPacketLengthForType(hci_packet_type_, hci_packet_);
+        hci_packet_.resize(preamble_size_for_type[hci_packet_type_] +
+                           packet_length);
+        hci_packet_bytes_remaining_ = packet_length;
+        hci_parser_state_ = HCI_PAYLOAD;
+        hci_packet_bytes_read_ = 0;
+      }
+      break;
+    }
+
+    case HCI_PAYLOAD: {
+      size_t bytes_read = TEMP_FAILURE_RETRY(
+          read(fd,
+               hci_packet_.data() + preamble_size_for_type[hci_packet_type_] +
+                   hci_packet_bytes_read_,
+               hci_packet_bytes_remaining_));
+      hci_packet_bytes_remaining_ -= bytes_read;
+      hci_packet_bytes_read_ += bytes_read;
+      if (hci_packet_bytes_remaining_ == 0) {
+        if (firmware_configured_) {
+          if (packet_read_cb_ != nullptr) {
+            packet_read_cb_(hci_packet_type_, hci_packet_);
+          }
+        } else {
+          if (internal_command_cb != nullptr) {
+            HC_BT_HDR* bt_hdr =
+                WrapPacketAndCopy(HCI_PACKET_TYPE_EVENT, hci_packet_);
+            internal_command_cb(bt_hdr);
+          }
+        }
+        hci_parser_state_ = HCI_IDLE;
+      }
+      break;
+    }
+  }
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace bluetooth
+}  // namespace hardware
+}  // namespace android
diff --git a/bluetooth/1.0/default/vendor_interface.h b/bluetooth/1.0/default/vendor_interface.h
new file mode 100644
index 0000000..73ff2eb
--- /dev/null
+++ b/bluetooth/1.0/default/vendor_interface.h
@@ -0,0 +1,83 @@
+//
+// Copyright 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#pragma once
+
+#include <hidl/HidlSupport.h>
+
+#include "async_fd_watcher.h"
+#include "bt_vendor_lib.h"
+#include "hci_internals.h"
+
+namespace android {
+namespace hardware {
+namespace bluetooth {
+namespace V1_0 {
+namespace implementation {
+
+using ::android::hardware::hidl_vec;
+using PacketReadCallback =
+    std::function<void(HciPacketType, const hidl_vec<uint8_t> &)>;
+
+class VendorInterface {
+ public:
+  static bool Initialize(PacketReadCallback packet_read_cb);
+  static void Shutdown();
+  static VendorInterface* get();
+
+  size_t Send(const uint8_t *data, size_t length);
+
+  void OnFirmwareConfigured(uint8_t result);
+
+  // Actually send the data.
+  size_t SendPrivate(const uint8_t *data, size_t length);
+
+ private:
+  VendorInterface() { queued_data_.resize(0); }
+  virtual ~VendorInterface() = default;
+
+  bool Open(PacketReadCallback packet_read_cb);
+  void Close();
+
+  void OnDataReady(int fd);
+
+  // Queue data from Send() until the interface is ready.
+  hidl_vec<uint8_t> queued_data_;
+
+  void *lib_handle_;
+  bt_vendor_interface_t *lib_interface_;
+  AsyncFdWatcher fd_watcher_;
+  int uart_fd_;
+  PacketReadCallback packet_read_cb_;
+  bool firmware_configured_;
+
+  enum HciParserState {
+    HCI_IDLE,
+    HCI_TYPE_READY,
+    HCI_PAYLOAD
+  };
+  HciParserState hci_parser_state_{HCI_IDLE};
+  HciPacketType hci_packet_type_{HCI_PACKET_TYPE_UNKNOWN};
+  hidl_vec<uint8_t> hci_packet_;
+  size_t hci_packet_bytes_remaining_;
+  size_t hci_packet_bytes_read_;
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace bluetooth
+} // namespace hardware
+} // namespace android
diff --git a/bluetooth/1.0/vts/functional/Android.bp b/bluetooth/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..7d04736
--- /dev/null
+++ b/bluetooth/1.0/vts/functional/Android.bp
@@ -0,0 +1,41 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "bluetooth_hidl_hal_test",
+    gtest: true,
+    srcs: ["bluetooth_hidl_hal_test.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.bluetooth@1.0",
+    ],
+    static_libs: ["libgtest"],
+    cflags: [
+        "--coverage",
+        "-O0",
+        "-g",
+    ],
+    ldflags: [
+        "--coverage",
+    ],
+}
diff --git a/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp b/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp
new file mode 100644
index 0000000..2a4bbdd
--- /dev/null
+++ b/bluetooth/1.0/vts/functional/bluetooth_hidl_hal_test.cpp
@@ -0,0 +1,683 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bluetooth_hidl_hal_test"
+#include <android-base/logging.h>
+
+#include <android/hardware/bluetooth/1.0/IBluetoothHci.h>
+#include <android/hardware/bluetooth/1.0/IBluetoothHciCallbacks.h>
+#include <android/hardware/bluetooth/1.0/types.h>
+#include <hardware/bluetooth.h>
+#include <utils/Log.h>
+
+#include <gtest/gtest.h>
+#include <condition_variable>
+#include <mutex>
+#include <queue>
+
+using ::android::hardware::bluetooth::V1_0::IBluetoothHci;
+using ::android::hardware::bluetooth::V1_0::IBluetoothHciCallbacks;
+using ::android::hardware::bluetooth::V1_0::Status;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+using ::android::sp;
+
+#define Bluetooth_HCI_SERVICE_NAME "bluetooth"
+
+#define HCI_MINIMUM_HCI_VERSION 5  // Bluetooth Core Specification 3.0 + HS
+#define HCI_MINIMUM_LMP_VERSION 5  // Bluetooth Core Specification 3.0 + HS
+#define NUM_HCI_COMMANDS_BANDWIDTH 1000
+#define NUM_SCO_PACKETS_BANDWIDTH 1000
+#define NUM_ACL_PACKETS_BANDWIDTH 1000
+#define WAIT_FOR_HCI_EVENT_TIMEOUT std::chrono::milliseconds(2000)
+#define WAIT_FOR_SCO_DATA_TIMEOUT std::chrono::milliseconds(1000)
+#define WAIT_FOR_ACL_DATA_TIMEOUT std::chrono::milliseconds(1000)
+
+#define COMMAND_HCI_SHOULD_BE_UNKNOWN \
+  { 0xff, 0x3B, 0x08, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07 }
+#define COMMAND_HCI_READ_LOCAL_VERSION_INFORMATION \
+  { 0x01, 0x10, 0x00 }
+#define COMMAND_HCI_READ_BUFFER_SIZE \
+  { 0x05, 0x10, 0x00 }
+#define COMMAND_HCI_WRITE_LOOPBACK_MODE_LOCAL \
+  { 0x02, 0x18, 0x01, 0x01 }
+#define COMMAND_HCI_RESET \
+  { 0x03, 0x0c, 0x00 }
+#define COMMAND_HCI_WRITE_LOCAL_NAME \
+  { 0x13, 0x0c, 0xf8 }
+#define HCI_STATUS_SUCCESS 0x00
+#define HCI_STATUS_UNKNOWN_HCI_COMMAND 0x01
+
+#define EVENT_CONNECTION_COMPLETE 0x03
+#define EVENT_COMMAND_COMPLETE 0x0e
+#define EVENT_COMMAND_STATUS 0x0f
+#define EVENT_NUMBER_OF_COMPLETED_PACKETS 0x13
+#define EVENT_LOOPBACK_COMMAND 0x19
+
+#define EVENT_CODE_BYTE 0
+#define EVENT_LENGTH_BYTE 1
+#define EVENT_FIRST_PAYLOAD_BYTE 2
+#define EVENT_COMMAND_STATUS_STATUS_BYTE 2
+#define EVENT_COMMAND_STATUS_ALLOWED_PACKETS_BYTE 3
+#define EVENT_COMMAND_STATUS_OPCODE_LSBYTE 4  // Bytes 4 and 5
+#define EVENT_COMMAND_COMPLETE_ALLOWED_PACKETS_BYTE 2
+#define EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE 3  // Bytes 3 and 4
+#define EVENT_COMMAND_COMPLETE_STATUS_BYTE 5
+#define EVENT_COMMAND_COMPLETE_FIRST_PARAM_BYTE 6
+#define EVENT_LOCAL_HCI_VERSION_BYTE EVENT_COMMAND_COMPLETE_FIRST_PARAM_BYTE
+#define EVENT_LOCAL_LMP_VERSION_BYTE EVENT_LOCAL_HCI_VERSION_BYTE + 3
+
+#define EVENT_CONNECTION_COMPLETE_PARAM_LENGTH 11
+#define EVENT_CONNECTION_COMPLETE_TYPE 11
+#define EVENT_CONNECTION_COMPLETE_TYPE_SCO 0
+#define EVENT_CONNECTION_COMPLETE_TYPE_ACL 1
+#define EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE 3
+#define EVENT_COMMAND_STATUS_LENGTH 4
+
+#define EVENT_NUMBER_OF_COMPLETED_PACKETS_NUM_HANDLES 2
+
+#define ACL_BROADCAST_ACTIVE_SLAVE (0x1 << 4)
+#define ACL_PACKET_BOUNDARY_COMPLETE (0x3 << 6)
+
+class ThroughputLogger {
+ public:
+  ThroughputLogger(std::string task)
+      : task_(task), start_time_(std::chrono::steady_clock::now()) {}
+
+  ~ThroughputLogger() {
+    if (total_bytes_ == 0) return;
+    std::chrono::duration<double> duration =
+        std::chrono::steady_clock::now() - start_time_;
+    double s = duration.count();
+    if (s == 0) return;
+    double rate_kb = (static_cast<double>(total_bytes_) / s) / 1024;
+    ALOGD("%s %.1f KB/s (%zu bytes in %.3fs)", task_.c_str(), rate_kb,
+          total_bytes_, s);
+  }
+
+  void setTotalBytes(size_t total_bytes) { total_bytes_ = total_bytes; }
+
+ private:
+  size_t total_bytes_;
+  std::string task_;
+  std::chrono::steady_clock::time_point start_time_;
+};
+
+// The main test class for Bluetooth HIDL HAL.
+class BluetoothHidlTest : public ::testing::Test {
+ public:
+  virtual void SetUp() override {
+    // currently test passthrough mode only
+    bluetooth = IBluetoothHci::getService(Bluetooth_HCI_SERVICE_NAME);
+    ALOGW("%s: getService(%s) is %s", __func__, Bluetooth_HCI_SERVICE_NAME,
+          bluetooth->isRemote() ? "remote" : "local");
+    ASSERT_NE(bluetooth, nullptr);
+
+    bluetooth_cb = new BluetoothHciCallbacks(*this);
+    ASSERT_NE(bluetooth_cb, nullptr);
+
+    max_acl_data_packet_length = 0;
+    max_sco_data_packet_length = 0;
+    max_acl_data_packets = 0;
+    max_sco_data_packets = 0;
+
+    event_count = 0;
+    acl_count = 0;
+    sco_count = 0;
+    event_cb_count = 0;
+    acl_cb_count = 0;
+    sco_cb_count = 0;
+
+    // Collision with android::hardware::Status
+    EXPECT_EQ(android::hardware::bluetooth::V1_0::Status::SUCCESS,
+              bluetooth->initialize(bluetooth_cb));
+  }
+
+  virtual void TearDown() override {
+    bluetooth->close();
+    EXPECT_EQ(static_cast<size_t>(0), event_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), sco_queue.size());
+    EXPECT_EQ(static_cast<size_t>(0), acl_queue.size());
+  }
+
+  void setBufferSizes();
+
+  // Functions called from within tests in loopback mode
+  void sendAndCheckHCI(int num_packets);
+  void sendAndCheckSCO(int num_packets, size_t size, uint16_t handle);
+  void sendAndCheckACL(int num_packets, size_t size, uint16_t handle);
+
+  // Helper functions to try to get a handle on verbosity
+  void enterLoopbackMode(std::vector<uint16_t>& sco_handles,
+                         std::vector<uint16_t>& acl_handles);
+  void wait_for_command_complete_event(hidl_vec<uint8_t> cmd);
+  int wait_for_completed_packets_event(uint16_t handle);
+
+  // Inform the test about an event callback
+  inline void notify_event_received() {
+    std::unique_lock<std::mutex> lock(event_mutex);
+    event_count++;
+    event_condition.notify_one();
+  }
+
+  // Test code calls this function to wait for an event callback
+  inline void wait_for_event() {
+    std::unique_lock<std::mutex> lock(event_mutex);
+
+    auto start_time = std::chrono::steady_clock::now();
+    while (event_count == 0)
+      if (event_condition.wait_until(lock,
+                                     start_time + WAIT_FOR_HCI_EVENT_TIMEOUT) ==
+          std::cv_status::timeout)
+        return;
+    event_count--;
+  }
+
+  // Inform the test about an acl data callback
+  inline void notify_acl_data_received() {
+    std::unique_lock<std::mutex> lock(acl_mutex);
+    acl_count++;
+    acl_condition.notify_one();
+  }
+
+  // Test code calls this function to wait for an acl data callback
+  inline void wait_for_acl() {
+    std::unique_lock<std::mutex> lock(acl_mutex);
+
+    while (acl_count == 0)
+      acl_condition.wait_until(
+          lock, std::chrono::steady_clock::now() + WAIT_FOR_ACL_DATA_TIMEOUT);
+    acl_count--;
+  }
+
+  // Inform the test about a sco data callback
+  inline void notify_sco_data_received() {
+    std::unique_lock<std::mutex> lock(sco_mutex);
+    sco_count++;
+    sco_condition.notify_one();
+  }
+
+  // Test code calls this function to wait for a sco data callback
+  inline void wait_for_sco() {
+    std::unique_lock<std::mutex> lock(sco_mutex);
+
+    while (sco_count == 0)
+      sco_condition.wait_until(
+          lock, std::chrono::steady_clock::now() + WAIT_FOR_SCO_DATA_TIMEOUT);
+    sco_count--;
+  }
+
+  // A simple test implementation of BluetoothHciCallbacks.
+  class BluetoothHciCallbacks : public IBluetoothHciCallbacks {
+    BluetoothHidlTest& parent_;
+
+   public:
+    BluetoothHciCallbacks(BluetoothHidlTest& parent) : parent_(parent){};
+
+    virtual ~BluetoothHciCallbacks() = default;
+
+    Return<void> hciEventReceived(
+        const ::android::hardware::hidl_vec<uint8_t>& event) override {
+      parent_.event_cb_count++;
+      parent_.event_queue.push(event);
+      parent_.notify_event_received();
+      ALOGV("Event received (length = %d)", static_cast<int>(event.size()));
+      return Void();
+    };
+
+    Return<void> aclDataReceived(
+        const ::android::hardware::hidl_vec<uint8_t>& data) override {
+      parent_.acl_cb_count++;
+      parent_.acl_queue.push(data);
+      parent_.notify_acl_data_received();
+      return Void();
+    };
+
+    Return<void> scoDataReceived(
+        const ::android::hardware::hidl_vec<uint8_t>& data) override {
+      parent_.sco_cb_count++;
+      parent_.sco_queue.push(data);
+      parent_.notify_sco_data_received();
+      return Void();
+    };
+  };
+
+  sp<IBluetoothHci> bluetooth;
+  sp<IBluetoothHciCallbacks> bluetooth_cb;
+  std::queue<hidl_vec<uint8_t>> event_queue;
+  std::queue<hidl_vec<uint8_t>> acl_queue;
+  std::queue<hidl_vec<uint8_t>> sco_queue;
+
+  int event_cb_count;
+  int sco_cb_count;
+  int acl_cb_count;
+
+  int max_acl_data_packet_length;
+  int max_sco_data_packet_length;
+  int max_acl_data_packets;
+  int max_sco_data_packets;
+
+ private:
+  std::mutex event_mutex;
+  std::mutex sco_mutex;
+  std::mutex acl_mutex;
+  std::condition_variable event_condition;
+  std::condition_variable sco_condition;
+  std::condition_variable acl_condition;
+  int event_count;
+  int sco_count;
+  int acl_count;
+};
+
+// A class for test environment setup (kept since this file is a template).
+class BluetoothHidlEnvironment : public ::testing::Environment {
+ public:
+  virtual void SetUp() {}
+  virtual void TearDown() {}
+
+ private:
+};
+
+// Receive and check status events until a COMMAND_COMPLETE is received.
+void BluetoothHidlTest::wait_for_command_complete_event(hidl_vec<uint8_t> cmd) {
+  // Allow intermediate COMMAND_STATUS events
+  int status_event_count = 0;
+  hidl_vec<uint8_t> event;
+  do {
+    wait_for_event();
+    EXPECT_LT(static_cast<size_t>(0), event_queue.size());
+    if (event_queue.size() == 0) {
+      event.resize(0);
+      break;
+    }
+    event = event_queue.front();
+    event_queue.pop();
+    EXPECT_GT(event.size(),
+              static_cast<size_t>(EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1));
+    if (event[EVENT_CODE_BYTE] == EVENT_COMMAND_STATUS) {
+      EXPECT_EQ(EVENT_COMMAND_STATUS_LENGTH, event[EVENT_LENGTH_BYTE]);
+      EXPECT_EQ(cmd[0], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE]);
+      EXPECT_EQ(cmd[1], event[EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1]);
+      EXPECT_EQ(event[EVENT_COMMAND_STATUS_STATUS_BYTE], HCI_STATUS_SUCCESS);
+      status_event_count++;
+    }
+  } while (event.size() > 0 && event[EVENT_CODE_BYTE] == EVENT_COMMAND_STATUS);
+
+  EXPECT_GT(event.size(),
+            static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
+  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+  EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+}
+
+// Send the command to read the controller's buffer sizes.
+void BluetoothHidlTest::setBufferSizes() {
+  hidl_vec<uint8_t> cmd = COMMAND_HCI_READ_BUFFER_SIZE;
+  bluetooth->sendHciCommand(cmd);
+
+  wait_for_event();
+
+  EXPECT_LT(static_cast<size_t>(0), event_queue.size());
+  if (event_queue.size() == 0) return;
+
+  hidl_vec<uint8_t> event = event_queue.front();
+  event_queue.pop();
+
+  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+  EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+
+  max_acl_data_packet_length =
+      event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 1] +
+      (event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 2] << 8);
+  max_sco_data_packet_length = event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 3];
+  max_acl_data_packets = event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 4] +
+                         (event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 5] << 8);
+  max_sco_data_packets = event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 6] +
+                         (event[EVENT_COMMAND_COMPLETE_STATUS_BYTE + 7] << 8);
+
+  ALOGD("%s: ACL max %d num %d SCO max %d num %d", __func__,
+        static_cast<int>(max_acl_data_packet_length),
+        static_cast<int>(max_acl_data_packets),
+        static_cast<int>(max_sco_data_packet_length),
+        static_cast<int>(max_sco_data_packets));
+}
+
+// Send an HCI command (in Loopback mode) and check the response.
+void BluetoothHidlTest::sendAndCheckHCI(int num_packets) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send an HCI packet
+    std::vector<uint8_t> write_name = COMMAND_HCI_WRITE_LOCAL_NAME;
+    // With a name
+    char new_name[] = "John Jacob Jingleheimer Schmidt ___________________0";
+    size_t new_name_length = strlen(new_name);
+    for (size_t i = 0; i < new_name_length; i++)
+      write_name.push_back(static_cast<uint8_t>(new_name[i]));
+    // And the packet number
+    {
+      size_t i = new_name_length - 1;
+      for (int digits = n; digits > 0; digits = digits / 10, i--)
+        write_name[i] = static_cast<uint8_t>('0' + digits % 10);
+    }
+    // And padding
+    for (size_t i = 0; i < 248 - new_name_length; i++)
+      write_name.push_back(static_cast<uint8_t>(0));
+
+    hidl_vec<uint8_t> cmd = write_name;
+    bluetooth->sendHciCommand(cmd);
+
+    // Check the loopback of the HCI packet
+    wait_for_event();
+    hidl_vec<uint8_t> event = event_queue.front();
+    event_queue.pop();
+    size_t compare_length =
+        (cmd.size() > static_cast<size_t>(0xff) ? static_cast<size_t>(0xff)
+                                                : cmd.size());
+    EXPECT_GT(event.size(), compare_length + EVENT_FIRST_PAYLOAD_BYTE - 1);
+
+    EXPECT_EQ(EVENT_LOOPBACK_COMMAND, event[EVENT_CODE_BYTE]);
+    EXPECT_EQ(compare_length, event[EVENT_LENGTH_BYTE]);
+    if (n == 0) logger.setTotalBytes(cmd.size() * num_packets * 2);
+
+    for (size_t i = 0; i < compare_length; i++)
+      EXPECT_EQ(cmd[i], event[EVENT_FIRST_PAYLOAD_BYTE + i]);
+  }
+}
+
+// Send a SCO data packet (in Loopback mode) and check the response.
+void BluetoothHidlTest::sendAndCheckSCO(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send a SCO packet
+    hidl_vec<uint8_t> sco_packet;
+    std::vector<uint8_t> sco_vector;
+    sco_vector.push_back(static_cast<uint8_t>(handle & 0xff));
+    sco_vector.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8));
+    sco_vector.push_back(static_cast<uint8_t>(size & 0xff));
+    sco_vector.push_back(static_cast<uint8_t>((size & 0xff00) >> 8));
+    for (size_t i = 0; i < size; i++) {
+      sco_vector.push_back(static_cast<uint8_t>(i + n));
+    }
+    sco_packet = sco_vector;
+    bluetooth->sendScoData(sco_vector);
+
+    // Check the loopback of the SCO packet
+    wait_for_sco();
+    hidl_vec<uint8_t> sco_loopback = sco_queue.front();
+    sco_queue.pop();
+
+    EXPECT_EQ(sco_packet.size(), sco_loopback.size());
+    size_t successful_bytes = 0;
+
+    if (n == 0) logger.setTotalBytes(num_packets * size * 2);
+
+    for (size_t i = 0; i < sco_packet.size(); i++) {
+      if (sco_packet[i] == sco_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              sco_packet[i], sco_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              sco_packet[i + 1], sco_loopback[i + 1]);
+        break;
+      }
+    }
+    EXPECT_EQ(sco_packet.size(), successful_bytes + 1);
+  }
+}
+
+// Send an ACL data packet (in Loopback mode) and check the response.
+void BluetoothHidlTest::sendAndCheckACL(int num_packets, size_t size,
+                                        uint16_t handle) {
+  ThroughputLogger logger = {__func__};
+  for (int n = 0; n < num_packets; n++) {
+    // Send an ACL packet
+    hidl_vec<uint8_t> acl_packet;
+    std::vector<uint8_t> acl_vector;
+    acl_vector.push_back(static_cast<uint8_t>(handle & 0xff));
+    acl_vector.push_back(static_cast<uint8_t>((handle & 0x0f00) >> 8) |
+                         ACL_BROADCAST_ACTIVE_SLAVE |
+                         ACL_PACKET_BOUNDARY_COMPLETE);
+    acl_vector.push_back(static_cast<uint8_t>(size & 0xff));
+    acl_vector.push_back(static_cast<uint8_t>((size & 0xff00) >> 8));
+    for (size_t i = 0; i < size; i++) {
+      acl_vector.push_back(static_cast<uint8_t>(i + n));
+    }
+    acl_packet = acl_vector;
+    bluetooth->sendAclData(acl_vector);
+
+    // Check the loopback of the ACL packet
+    wait_for_acl();
+    hidl_vec<uint8_t> acl_loopback = acl_queue.front();
+    acl_queue.pop();
+
+    EXPECT_EQ(acl_packet.size(), acl_loopback.size());
+    size_t successful_bytes = 0;
+
+    if (n == 0) logger.setTotalBytes(num_packets * size * 2);
+
+    for (size_t i = 0; i < acl_packet.size(); i++) {
+      if (acl_packet[i] == acl_loopback[i]) {
+        successful_bytes = i;
+      } else {
+        ALOGE("Miscompare at %d (expected %x, got %x)", static_cast<int>(i),
+              acl_packet[i], acl_loopback[i]);
+        ALOGE("At %d (expected %x, got %x)", static_cast<int>(i + 1),
+              acl_packet[i + 1], acl_loopback[i + 1]);
+        break;
+      }
+    }
+    EXPECT_EQ(acl_packet.size(), successful_bytes + 1);
+  }
+}
+
+// Return the number of completed packets reported by the controller.
+int BluetoothHidlTest::wait_for_completed_packets_event(uint16_t handle) {
+  wait_for_event();
+  int packets_processed = 0;
+  while (event_queue.size() > 0) {
+    hidl_vec<uint8_t> event = event_queue.front();
+    event_queue.pop();
+
+    EXPECT_EQ(EVENT_NUMBER_OF_COMPLETED_PACKETS, event[EVENT_CODE_BYTE]);
+    EXPECT_EQ(1, event[EVENT_NUMBER_OF_COMPLETED_PACKETS_NUM_HANDLES]);
+
+    uint16_t event_handle = event[3] + (event[4] << 8);
+    EXPECT_EQ(handle, event_handle);
+
+    packets_processed += event[5] + (event[6] << 8);
+  }
+  return packets_processed;
+}
+
+// Send local loopback command and initialize SCO and ACL handles.
+void BluetoothHidlTest::enterLoopbackMode(std::vector<uint16_t>& sco_handles,
+                                          std::vector<uint16_t>& acl_handles) {
+  hidl_vec<uint8_t> cmd = COMMAND_HCI_WRITE_LOOPBACK_MODE_LOCAL;
+  bluetooth->sendHciCommand(cmd);
+
+  // Receive connection complete events with data channels
+  int connection_event_count = 0;
+  hidl_vec<uint8_t> event;
+  do {
+    wait_for_event();
+    event = event_queue.front();
+    event_queue.pop();
+    EXPECT_GT(event.size(),
+              static_cast<size_t>(EVENT_COMMAND_COMPLETE_STATUS_BYTE));
+    if (event[EVENT_CODE_BYTE] == EVENT_CONNECTION_COMPLETE) {
+      EXPECT_GT(event.size(),
+                static_cast<size_t>(EVENT_CONNECTION_COMPLETE_TYPE));
+      EXPECT_EQ(event[EVENT_LENGTH_BYTE],
+                EVENT_CONNECTION_COMPLETE_PARAM_LENGTH);
+      uint8_t connection_type = event[EVENT_CONNECTION_COMPLETE_TYPE];
+
+      EXPECT_TRUE(connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO ||
+                  connection_type == EVENT_CONNECTION_COMPLETE_TYPE_ACL);
+
+      // Save handles
+      uint16_t handle = event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE] |
+                        event[EVENT_CONNECTION_COMPLETE_HANDLE_LSBYTE + 1] << 8;
+      if (connection_type == EVENT_CONNECTION_COMPLETE_TYPE_SCO)
+        sco_handles.push_back(handle);
+      else
+        acl_handles.push_back(handle);
+
+      ALOGD("Connect complete type = %d handle = %d",
+            event[EVENT_CONNECTION_COMPLETE_TYPE], handle);
+      connection_event_count++;
+    }
+  } while (event[EVENT_CODE_BYTE] == EVENT_CONNECTION_COMPLETE);
+
+  EXPECT_GT(connection_event_count, 0);
+
+  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+  EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+}
+
+// Empty test: Initialize()/Close() are called in SetUp()/TearDown().
+TEST_F(BluetoothHidlTest, InitializeAndClose) { }
+
+// Send an HCI Reset with sendHciCommand and wait for a command complete event.
+TEST_F(BluetoothHidlTest, HciReset) {
+  hidl_vec<uint8_t> cmd = COMMAND_HCI_RESET;
+  bluetooth->sendHciCommand(cmd);
+
+  wait_for_command_complete_event(cmd);
+}
+
+// Read and check the HCI version of the controller.
+TEST_F(BluetoothHidlTest, HciVersionTest) {
+  hidl_vec<uint8_t> cmd = COMMAND_HCI_READ_LOCAL_VERSION_INFORMATION;
+  bluetooth->sendHciCommand(cmd);
+
+  wait_for_event();
+
+  hidl_vec<uint8_t> event = event_queue.front();
+  event_queue.pop();
+  EXPECT_GT(event.size(), static_cast<size_t>(EVENT_LOCAL_LMP_VERSION_BYTE));
+
+  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+  EXPECT_EQ(HCI_STATUS_SUCCESS, event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+
+  EXPECT_LE(HCI_MINIMUM_HCI_VERSION, event[EVENT_LOCAL_HCI_VERSION_BYTE]);
+  EXPECT_LE(HCI_MINIMUM_LMP_VERSION, event[EVENT_LOCAL_LMP_VERSION_BYTE]);
+}
+
+// Send an unknown HCI command and wait for the error message.
+TEST_F(BluetoothHidlTest, HciUnknownCommand) {
+  hidl_vec<uint8_t> cmd = COMMAND_HCI_SHOULD_BE_UNKNOWN;
+  bluetooth->sendHciCommand(cmd);
+
+  wait_for_event();
+
+  hidl_vec<uint8_t> event = event_queue.front();
+  event_queue.pop();
+  EXPECT_GT(event.size(),
+            static_cast<size_t>(EVENT_COMMAND_STATUS_OPCODE_LSBYTE + 1));
+
+  EXPECT_EQ(EVENT_COMMAND_COMPLETE, event[EVENT_CODE_BYTE]);
+  EXPECT_EQ(cmd[0], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE]);
+  EXPECT_EQ(cmd[1], event[EVENT_COMMAND_COMPLETE_OPCODE_LSBYTE + 1]);
+  EXPECT_EQ(HCI_STATUS_UNKNOWN_HCI_COMMAND,
+            event[EVENT_COMMAND_COMPLETE_STATUS_BYTE]);
+}
+
+// Enter loopback mode, but don't send any packets.
+TEST_F(BluetoothHidlTest, WriteLoopbackMode) {
+  std::vector<uint16_t> sco_connection_handles;
+  std::vector<uint16_t> acl_connection_handles;
+  enterLoopbackMode(sco_connection_handles, acl_connection_handles);
+}
+
+// Enter loopback mode and send single packets.
+TEST_F(BluetoothHidlTest, LoopbackModeSinglePackets) {
+  setBufferSizes();
+  EXPECT_LT(0, max_sco_data_packet_length);
+  EXPECT_LT(0, max_acl_data_packet_length);
+
+  std::vector<uint16_t> sco_connection_handles;
+  std::vector<uint16_t> acl_connection_handles;
+  enterLoopbackMode(sco_connection_handles, acl_connection_handles);
+
+  sendAndCheckHCI(1);
+
+  // This should work, but breaks on some current platforms.  Figure out how to
+  // grandfather older devices but test new ones.
+  int sco_packets_sent = 0;
+  if (0 && sco_connection_handles.size() > 0) {
+    sendAndCheckSCO(1, max_sco_data_packet_length, sco_connection_handles[0]);
+    sco_packets_sent = 1;
+    EXPECT_EQ(sco_packets_sent,
+              wait_for_completed_packets_event(sco_connection_handles[0]));
+  }
+
+  int acl_packets_sent = 0;
+  if (acl_connection_handles.size() > 0) {
+    sendAndCheckACL(1, max_acl_data_packet_length, acl_connection_handles[0]);
+    acl_packets_sent = 1;
+    EXPECT_EQ(acl_packets_sent,
+              wait_for_completed_packets_event(acl_connection_handles[0]));
+  }
+}
+
+// Enter loopback mode and send packets for bandwidth measurements.
+TEST_F(BluetoothHidlTest, LoopbackModeBandwidth) {
+  setBufferSizes();
+
+  std::vector<uint16_t> sco_connection_handles;
+  std::vector<uint16_t> acl_connection_handles;
+  enterLoopbackMode(sco_connection_handles, acl_connection_handles);
+
+  sendAndCheckHCI(NUM_HCI_COMMANDS_BANDWIDTH);
+
+  // This should work, but breaks on some current platforms.  Figure out how to
+  // grandfather older devices but test new ones.
+  int sco_packets_sent = 0;
+  if (0 && sco_connection_handles.size() > 0) {
+    sendAndCheckSCO(NUM_SCO_PACKETS_BANDWIDTH, max_sco_data_packet_length,
+                    sco_connection_handles[0]);
+    sco_packets_sent = NUM_SCO_PACKETS_BANDWIDTH;
+    EXPECT_EQ(sco_packets_sent,
+              wait_for_completed_packets_event(sco_connection_handles[0]));
+  }
+
+  int acl_packets_sent = 0;
+  if (acl_connection_handles.size() > 0) {
+    sendAndCheckACL(NUM_ACL_PACKETS_BANDWIDTH, max_acl_data_packet_length,
+                    acl_connection_handles[0]);
+    acl_packets_sent = NUM_ACL_PACKETS_BANDWIDTH;
+    EXPECT_EQ(acl_packets_sent,
+              wait_for_completed_packets_event(acl_connection_handles[0]));
+  }
+}
+
+int main(int argc, char** argv) {
+  ::testing::AddGlobalTestEnvironment(new BluetoothHidlEnvironment);
+  ::testing::InitGoogleTest(&argc, argv);
+  int status = RUN_ALL_TESTS();
+  ALOGI("Test result = %d", status);
+  return status;
+}
diff --git a/bluetooth/Android.bp b/bluetooth/Android.bp
index bbb3e4b..ed19a37 100644
--- a/bluetooth/Android.bp
+++ b/bluetooth/Android.bp
@@ -1,4 +1,6 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "1.0",
+    "1.0/default",
+    "1.0/vts/functional",
 ]
diff --git a/broadcastradio/1.0/vts/functional/broadcastradio_hidl_hal_test.cpp b/broadcastradio/1.0/vts/functional/broadcastradio_hidl_hal_test.cpp
index 26666d6..6802c3c 100644
--- a/broadcastradio/1.0/vts/functional/broadcastradio_hidl_hal_test.cpp
+++ b/broadcastradio/1.0/vts/functional/broadcastradio_hidl_hal_test.cpp
@@ -19,9 +19,8 @@
 #include <android-base/logging.h>
 #include <cutils/native_handle.h>
 #include <cutils/properties.h>
+#include <hidl/HidlTransportSupport.h>
 #include <utils/threads.h>
-#include <hwbinder/IPCThreadState.h>
-#include <hwbinder/ProcessState.h>
 
 #include <android/hardware/broadcastradio/1.0/IBroadcastRadioFactory.h>
 #include <android/hardware/broadcastradio/1.0/IBroadcastRadio.h>
@@ -33,7 +32,6 @@
 using ::android::sp;
 using ::android::Mutex;
 using ::android::Condition;
-using ::android::hardware::ProcessState;
 using ::android::hardware::Return;
 using ::android::hardware::Status;
 using ::android::hardware::Void;
@@ -461,8 +459,6 @@
 
 
 int main(int argc, char** argv) {
-  sp<ProcessState> proc(ProcessState::self());
-  ProcessState::self()->startThreadPool();
   ::testing::AddGlobalTestEnvironment(new BroadcastRadioHidlEnvironment);
   ::testing::InitGoogleTest(&argc, argv);
   int status = RUN_ALL_TESTS();
diff --git a/evs/1.0/default/service.cpp b/evs/1.0/default/service.cpp
index 6ab2975..112c879 100644
--- a/evs/1.0/default/service.cpp
+++ b/evs/1.0/default/service.cpp
@@ -18,8 +18,7 @@
 
 #include <unistd.h>
 
-#include <hwbinder/IPCThreadState.h>
-#include <hwbinder/ProcessState.h>
+#include <hidl/HidlTransportSupport.h>
 #include <utils/Errors.h>
 #include <utils/StrongPointer.h>
 #include <utils/Log.h>
@@ -29,9 +28,9 @@
 #include "EvsDisplay.h"
 
 
-// libhwbinder:
-using android::hardware::IPCThreadState;
-using android::hardware::ProcessState;
+// libhidl:
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
 
 // Generated HIDL files
 using android::hardware::evs::V1_0::IEvsEnumerator;
@@ -46,25 +45,14 @@
     ALOGI("EVS Hardware Enumerator service is starting");
     android::sp<IEvsEnumerator> service = new EvsEnumerator();
 
+    configureRpcThreadpool(1, true /* callerWillJoin */);
+
     // Register our service -- if somebody is already registered by our name,
     // they will be killed (their thread pool will throw an exception).
     status_t status = service->registerAsService(kEnumeratorServiceName);
     if (status == OK) {
         ALOGD("%s is ready.", kEnumeratorServiceName);
-
-        // Set thread pool size to ensure the API is not called in parallel.
-        // By setting the size to zero, the main thread will be the only one
-        // serving requests once we "joinThreadPool".
-        ProcessState::self()->setThreadPoolMaxThreadCount(0);
-
-        // Note:  We don't start the thread pool because it'll add at least one (default)
-        //        thread to it, which we don't want.  See b/31226656
-        // ProcessState::self()->startThreadPool();
-
-        // Send this main thread to become a permanent part of the thread pool.
-        // This bumps up the thread count by 1 (from zero in this case).
-        // This is not expected to return.
-        IPCThreadState::self()->joinThreadPool();
+        joinRpcThreadpool();
     } else {
         ALOGE("Could not register service %s (%d).", kEnumeratorServiceName, status);
     }
diff --git a/example/extension/light/2.0/default/service.cpp b/example/extension/light/2.0/default/service.cpp
index 3eb7bdf..d3fb4de 100644
--- a/example/extension/light/2.0/default/service.cpp
+++ b/example/extension/light/2.0/default/service.cpp
@@ -16,15 +16,14 @@
 #define LOG_TAG "android.hardware.light@2.0-service"
 
 #include <android/log.h>
+#include <hidl/HidlTransportSupport.h>
 
 #include "Light.h"
 
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
 using android::sp;
 
-// libhwbinder:
-using android::hardware::IPCThreadState;
-using android::hardware::ProcessState;
-
 // Generated HIDL files
 using android::hardware::light::V2_0::ILight;
 
@@ -32,10 +31,7 @@
     const char instance[] = "light";
 
     android::sp<ILight> service = new Light();
-
+    configureRpcThreadpool(1, true /*callerWillJoin*/);
     service->registerAsService(instance);
-
-    ProcessState::self()->setThreadPoolMaxThreadCount(0);
-    ProcessState::self()->startThreadPool();
-    IPCThreadState::self()->joinThreadPool();
+    joinRpcThreadpool();
 }
diff --git a/graphics/composer/2.1/IComposerClient.hal b/graphics/composer/2.1/IComposerClient.hal
index 1a82215..b0bd837 100644
--- a/graphics/composer/2.1/IComposerClient.hal
+++ b/graphics/composer/2.1/IComposerClient.hal
@@ -554,7 +554,7 @@
      * @return error is NONE upon success. Otherwise,
      *         NO_RESOURCES when failed to set the queue temporarily.
      */
-    setInputCommandQueue(MQDescriptorSync descriptor)
+    setInputCommandQueue(fmq_sync<uint32_t> descriptor)
               generates (Error error);
 
     /*
@@ -568,7 +568,7 @@
      */
     getOutputCommandQueue()
               generates (Error error,
-                         MQDescriptorSync descriptor);
+                         fmq_sync<uint32_t> descriptor);
 
     /*
      * Executes commands from the input command message queue. Return values
diff --git a/graphics/composer/2.1/default/HwcClient.cpp b/graphics/composer/2.1/default/HwcClient.cpp
index ce6c480..8c2dd6d 100644
--- a/graphics/composer/2.1/default/HwcClient.cpp
+++ b/graphics/composer/2.1/default/HwcClient.cpp
@@ -497,7 +497,7 @@
 }
 
 Return<Error> HwcClient::setInputCommandQueue(
-        const MQDescriptorSync& descriptor)
+        const MQDescriptorSync<uint32_t>& descriptor)
 {
     std::lock_guard<std::mutex> lock(mCommandMutex);
     return mReader.setMQDescriptor(descriptor) ?
@@ -514,7 +514,7 @@
     if (outDescriptor) {
         hidl_cb(Error::NONE, *outDescriptor);
     } else {
-        hidl_cb(Error::NO_RESOURCES, MQDescriptorSync(0, nullptr, 0));
+        hidl_cb(Error::NO_RESOURCES, MQDescriptorSync<uint32_t>());
     }
 
     return Void();
diff --git a/graphics/composer/2.1/default/HwcClient.h b/graphics/composer/2.1/default/HwcClient.h
index a9bc4cd..c719774 100644
--- a/graphics/composer/2.1/default/HwcClient.h
+++ b/graphics/composer/2.1/default/HwcClient.h
@@ -97,7 +97,7 @@
     Return<Error> setClientTargetSlotCount(Display display,
             uint32_t clientTargetSlotCount) override;
     Return<Error> setInputCommandQueue(
-            const MQDescriptorSync& descriptor) override;
+            const MQDescriptorSync<uint32_t>& descriptor) override;
     Return<void> getOutputCommandQueue(
             getOutputCommandQueue_cb hidl_cb) override;
     Return<void> executeCommands(uint32_t inLength,
diff --git a/graphics/composer/2.1/default/IComposerCommandBuffer.h b/graphics/composer/2.1/default/IComposerCommandBuffer.h
index 8f133fe..7e14f19 100644
--- a/graphics/composer/2.1/default/IComposerCommandBuffer.h
+++ b/graphics/composer/2.1/default/IComposerCommandBuffer.h
@@ -120,7 +120,7 @@
         return true;
     }
 
-    const MQDescriptorSync* getMQDescriptor() const
+    const MQDescriptorSync<uint32_t>* getMQDescriptor() const
     {
         return (mQueue) ? mQueue->getDesc() : nullptr;
     }
@@ -626,7 +626,7 @@
         reset();
     }
 
-    bool setMQDescriptor(const MQDescriptorSync& descriptor)
+    bool setMQDescriptor(const MQDescriptorSync<uint32_t>& descriptor)
     {
         mQueue = std::make_unique<CommandQueueType>(descriptor, false);
         if (mQueue->isValid()) {
diff --git a/graphics/composer/2.1/default/service.cpp b/graphics/composer/2.1/default/service.cpp
index 0384a53..c2a2b19 100644
--- a/graphics/composer/2.1/default/service.cpp
+++ b/graphics/composer/2.1/default/service.cpp
@@ -17,14 +17,13 @@
 #define LOG_TAG "HWComposerService"
 
 #include <binder/ProcessState.h>
-#include <hwbinder/IPCThreadState.h>
-#include <hwbinder/ProcessState.h>
+#include <hidl/HidlTransportSupport.h>
 #include <utils/StrongPointer.h>
 #include "Hwc.h"
 
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
 using android::sp;
-using android::hardware::IPCThreadState;
-using android::hardware::ProcessState;
 using android::hardware::graphics::composer::V2_1::IComposer;
 using android::hardware::graphics::composer::V2_1::implementation::HIDL_FETCH_IComposer;
 
@@ -34,6 +33,7 @@
 
     ALOGI("Service is starting.");
 
+    configureRpcThreadpool(1, true /* callerWillJoin */);
     sp<IComposer> service = HIDL_FETCH_IComposer(instance);
     if (service == nullptr) {
         ALOGI("getService returned NULL");
@@ -48,9 +48,7 @@
     android::ProcessState::self()->setThreadPoolMaxThreadCount(4);
     android::ProcessState::self()->startThreadPool();
 
-    ProcessState::self()->setThreadPoolMaxThreadCount(0);
-    ProcessState::self()->startThreadPool();
-    IPCThreadState::self()->joinThreadPool();
+    joinRpcThreadpool();
 
     return 0;
 }
diff --git a/keymaster/3.0/default/service.cpp b/keymaster/3.0/default/service.cpp
index 038bf31..dd8c0b2 100644
--- a/keymaster/3.0/default/service.cpp
+++ b/keymaster/3.0/default/service.cpp
@@ -19,15 +19,17 @@
 
 #include <android/hardware/keymaster/3.0/IKeymasterDevice.h>
 
+#include <hidl/HidlTransportSupport.h>
 #include <hidl/LegacySupport.h>
 
-using android::sp;
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
 
 using android::hardware::keymaster::V3_0::IKeymasterDevice;
 using android::hardware::registerPassthroughServiceImplementation;
-using android::hardware::launchRpcServer;
 
 int main() {
+    configureRpcThreadpool(1, true /*callerWillJoin*/);
     registerPassthroughServiceImplementation<IKeymasterDevice>("keymaster");
-    return launchRpcServer(1);
+    joinRpcThreadpool();
 }
diff --git a/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp b/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
index 3e40a9c..f5ed4d7 100644
--- a/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
+++ b/nfc/1.0/vts/functional/nfc_hidl_hal_test.cpp
@@ -21,14 +21,12 @@
 #include <android/hardware/nfc/1.0/INfcClientCallback.h>
 #include <android/hardware/nfc/1.0/types.h>
 #include <hardware/nfc.h>
-#include <hwbinder/ProcessState.h>
 
 #include <gtest/gtest.h>
 #include <chrono>
 #include <condition_variable>
 #include <mutex>
 
-using ::android::hardware::ProcessState;
 using ::android::hardware::nfc::V1_0::INfc;
 using ::android::hardware::nfc::V1_0::INfcClientCallback;
 using ::android::hardware::nfc::V1_0::NfcEvent;
@@ -66,12 +64,6 @@
     nfc_ = INfc::getService(NFC_NCI_SERVICE_NAME, passthrough);
     ASSERT_NE(nfc_, nullptr);
 
-    // TODO:b/31748996
-    if (nfc_->isRemote()) {
-      ProcessState::self()->setThreadPoolMaxThreadCount(1);
-      ProcessState::self()->startThreadPool();
-    }
-
     nfc_cb_ = new NfcClientCallback(*this);
     ASSERT_NE(nfc_cb_, nullptr);
 
diff --git a/radio/1.0/Android.mk b/radio/1.0/Android.mk
index c645657..059ebcb 100644
--- a/radio/1.0/Android.mk
+++ b/radio/1.0/Android.mk
@@ -1556,6 +1556,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (LastCallFailCauseInfo)
+#
+GEN := $(intermediates)/android/hardware/radio/V1_0/LastCallFailCauseInfo.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.radio@1.0::types.LastCallFailCauseInfo
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (LceDataInfo)
 #
 GEN := $(intermediates)/android/hardware/radio/V1_0/LceDataInfo.java
@@ -4476,6 +4495,25 @@
 LOCAL_GENERATED_SOURCES += $(GEN)
 
 #
+# Build types.hal (LastCallFailCauseInfo)
+#
+GEN := $(intermediates)/android/hardware/radio/V1_0/LastCallFailCauseInfo.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(LOCAL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.radio@1.0::types.LastCallFailCauseInfo
+
+$(GEN): $(LOCAL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
 # Build types.hal (LceDataInfo)
 #
 GEN := $(intermediates)/android/hardware/radio/V1_0/LceDataInfo.java
diff --git a/radio/1.0/IRadio.hal b/radio/1.0/IRadio.hal
index 62bc840..1cb7040 100644
--- a/radio/1.0/IRadio.hal
+++ b/radio/1.0/IRadio.hal
@@ -1037,7 +1037,7 @@
      *
      * Response callback is IRadioCallback.setGsmBroadcastConfigResponse()
      */
-    oneway setGsmBroadcastConfig(int32_t serial, GsmBroadcastSmsConfigInfo configInfo);
+    oneway setGsmBroadcastConfig(int32_t serial, vec<GsmBroadcastSmsConfigInfo> configInfo);
 
     /*
      * Enable or disable the reception of GSM/WCDMA Cell Broadcast SMS
@@ -1067,7 +1067,7 @@
      *
      * Response callback is IRadioCallback.setCdmaBroadcastConfigResponse()
      */
-    oneway setCdmaBroadcastConfig(int32_t serial, CdmaBroadcastSmsConfigInfo configInfo);
+    oneway setCdmaBroadcastConfig(int32_t serial, vec<CdmaBroadcastSmsConfigInfo> configInfo);
 
     /*
      * Enable or disable the reception of CDMA Cell Broadcast SMS
@@ -1564,4 +1564,4 @@
      *
      */
     oneway responseAcknowledgement();
-};
\ No newline at end of file
+};
diff --git a/radio/1.0/IRadioIndication.hal b/radio/1.0/IRadioIndication.hal
index 4dbae17..79ebf30 100644
--- a/radio/1.0/IRadioIndication.hal
+++ b/radio/1.0/IRadioIndication.hal
@@ -81,8 +81,9 @@
      * Indicates when new SMS has been stored on SIM card
      *
      * @param type Type of radio indication
+     * @param recordNumber Record number on the sim
      */
-    oneway newSmsOnSim(RadioIndicationType type);
+    oneway newSmsOnSim(RadioIndicationType type, int32_t recordNumber);
 
     /*
      * Indicates when a new USSD message is received.
@@ -91,8 +92,9 @@
      *
      * @param type Type of radio indication
      * @param modeType USSD type code
+     * @param msg Message string in UTF-8, if applicable
      */
-    oneway onUssd(RadioIndicationType type, UssdModeType modeType);
+    oneway onUssd(RadioIndicationType type, UssdModeType modeType, string msg);
 
     /*
      * Indicates when radio has received a NITZ time message.
@@ -146,7 +148,7 @@
      * @param cmd SAT/USAT proactive represented as byte array starting with command tag.
      *        Refer ETSI TS 102.223 section 9.4 for command types
      */
-    oneway stkProactiveCommand(RadioIndicationType type, vec<uint8_t> cmd);
+    oneway stkProactiveCommand(RadioIndicationType type, string cmd);
 
     /*
      * Indicates when SIM notifies applcations some event happens.
@@ -157,7 +159,7 @@
      *        starting with first byte of response data for command tag. Refer
      *        ETSI TS 102.223 section 9.4 for command types
      */
-    oneway stkEventNotify(RadioIndicationType type, vec<uint8_t> cmd);
+    oneway stkEventNotify(RadioIndicationType type, string cmd);
 
     /*
      * Indicates when SIM wants application to setup a voice call.
diff --git a/radio/1.0/IRadioResponse.hal b/radio/1.0/IRadioResponse.hal
index e25a30c..8ff2e24 100644
--- a/radio/1.0/IRadioResponse.hal
+++ b/radio/1.0/IRadioResponse.hal
@@ -23,17 +23,17 @@
  */
 interface IRadioResponse {
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param cardStatus ICC card status as defined by CardStatus in types.hal
      *
      * Valid errors returned:
      *   RadioError:NONE
      *   RadioError:INVALID_ARGUMENTS
      */
-    oneway iccCardStatusResponse(RadioResponseInfo info, CardStatus cardStatus);
+    oneway getIccCardStatusResponse(RadioResponseInfo info, CardStatus cardStatus);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -46,7 +46,7 @@
     oneway supplyIccPinForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -59,7 +59,7 @@
     oneway supplyIccPukForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -72,7 +72,7 @@
     oneway supplyIccPin2ForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      * Valid errors returned:
      *   RadioError:NONE
@@ -84,7 +84,7 @@
     oneway supplyIccPuk2ForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -97,7 +97,7 @@
     oneway changeIccPinForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -110,7 +110,7 @@
     oneway changeIccPin2ForAppResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param remainingRetries Number of retries remaining, must be equal to -1 if unknown.
      *
      * Valid errors returned:
@@ -123,7 +123,7 @@
     oneway supplyNetworkDepersonalizationResponse(RadioResponseInfo info, int32_t remainingRetries);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param calls Current call list
      *
      * Valid errors returned:
@@ -136,7 +136,7 @@
     oneway getCurrentCallsResponse(RadioResponseInfo info, vec<Call> calls);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -162,7 +162,7 @@
     oneway dialResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param imsi String containing the IMSI
      *
      * Valid errors returned:
@@ -174,7 +174,7 @@
     oneway getIMSIForAppResponse(RadioResponseInfo info, string imsi);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -190,7 +190,7 @@
     oneway hangupConnectionResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -208,7 +208,7 @@
     oneway hangupWaitingOrBackgroundResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -226,7 +226,7 @@
     oneway hangupForegroundResumeBackgroundResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -244,7 +244,7 @@
     oneway switchWaitingOrHoldingAndActiveResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -261,7 +261,7 @@
     oneway conferenceResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -279,9 +279,9 @@
     oneway rejectCallResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
-     * @param failCause failCause is LastCallFailCause. GSM failure reasons are
-     *        mapped to cause codes defined in TS 24.008 Annex H where possible. CDMA
+     * @param info Response info struct containing response type, serial no. and error
+     * @param failCauseInfo Contains LastCallFailCause and vendor cause code. GSM failure reasons
+     *        are mapped to cause codes defined in TS 24.008 Annex H where possible. CDMA
      *        failure reasons are derived from the possible call failure scenarios
      *        described in the "CDMA IS-2000 Release A (C.S0005-A v6.0)" standard.
      *
@@ -300,10 +300,11 @@
      *   RadioError:NO_MEMORY
      *   RadioError:GENERIC_FAILURE
      */
-    oneway getLastCallFailCauseResponse(RadioResponseInfo info, LastCallFailCause failCause);
+    oneway getLastCallFailCauseResponse(RadioResponseInfo info,
+            LastCallFailCauseInfo failCauseinfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param sigStrength Current signal strength
      *
      * Valid errors returned:
@@ -314,7 +315,7 @@
     oneway getSignalStrengthResponse(RadioResponseInfo info, SignalStrength sigStrength);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param voiceRegResponse Current Voice registration response as defined by VoiceRegStateResult
      *        in types.hal
      *
@@ -328,7 +329,7 @@
             VoiceRegStateResult voiceRegResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param dataRegResponse Current Data registration response as defined by DataRegStateResult in
      *        types.hal
      *
@@ -342,7 +343,7 @@
             DataRegStateResult dataRegResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param longName is long alpha ONS or EONS or empty string if unregistered
      * @param shortName is short alpha ONS or EONS or empty string if unregistered
      * @param numeric is 5 or 6 digit numeric code (MCC + MNC) or empty string if unregistered
@@ -357,7 +358,7 @@
             string numeric);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -369,7 +370,7 @@
     oneway setRadioPowerResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -384,7 +385,7 @@
     oneway sendDtmfResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param sms Response to sms sent as defined by SendSmsResult in types.hal
      *
      * Valid errors returned:
@@ -408,7 +409,7 @@
     oneway sendSmsResponse(RadioResponseInfo info, SendSmsResult sms);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param sms Response to sms sent as defined by SendSmsResult in types.hal
      *
      * Valid errors returned:
@@ -433,7 +434,7 @@
     oneway sendSMSExpectMoreResponse(RadioResponseInfo info, SendSmsResult sms);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param dcResponse SetupDataCallResult defined in types.hal
      *
      * Valid errors returned:
@@ -450,7 +451,7 @@
     oneway setupDataCallResponse(RadioResponseInfo info, SetupDataCallResult dcResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param iccIo ICC io operation response as defined by IccIoResult in types.hal
      *
      * Valid errors returned:
@@ -461,10 +462,10 @@
      *   RadioError:SIM_PUK2
      *   RadioError:GENERIC_FAILURE
      */
-    oneway iccIOForApp(RadioResponseInfo info, IccIoResult iccIo);
+    oneway iccIOForAppResponse(RadioResponseInfo info, IccIoResult iccIo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -487,7 +488,7 @@
     oneway sendUssdResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -504,7 +505,7 @@
     oneway cancelPendingUssdResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param n is "n" parameter from TS 27.007 7.7
      * @param m is "m" parameter from TS 27.007 7.7
      *
@@ -525,7 +526,7 @@
     oneway getClirResponse(RadioResponseInfo info, int32_t n, int32_t m);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -541,7 +542,7 @@
     oneway setClirResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param callForwardInfos points to a vector of CallForwardInfo, one for
      *        each distinct registered phone number.
      *
@@ -570,7 +571,7 @@
             vec<CallForwardInfo> callForwardInfos);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -590,7 +591,7 @@
     oneway setCallForwardResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param enable If current call waiting state is disabled, enable = false else true
      * @param serviceClass If enable, then callWaitingResp[1]
      *        must follow, with the TS 27.007 service class bit vector of services
@@ -615,7 +616,7 @@
     oneway getCallWaitingResponse(RadioResponseInfo info, bool enable, int32_t serviceClass);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -634,7 +635,7 @@
     oneway setCallWaitingResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -645,7 +646,7 @@
     oneway acknowledgeLastIncomingGsmSmsResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -662,7 +663,7 @@
     oneway acceptCallResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -673,7 +674,7 @@
     oneway deactivateDataCallResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param response 0 is the TS 27.007 service class bit vector of
      *        services for which the specified barring facility
      *        is active. "0" means "disabled for all"
@@ -695,7 +696,7 @@
     oneway getFacilityLockForAppResponse(RadioResponseInfo info, int32_t response);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param retry 0 is the number of retries remaining, or -1 if unknown
      *
      * Valid errors returned:
@@ -715,7 +716,7 @@
     oneway setFacilityLockForAppResponse(RadioResponseInfo info, int32_t retry);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -734,7 +735,7 @@
     oneway setBarringPasswordResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param selection false for automatic selection, true for manual selection
      *
      * Valid errors returned:
@@ -746,7 +747,7 @@
     oneway getNetworkSelectionModeResponse(RadioResponseInfo info, bool manual);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -763,7 +764,7 @@
     oneway setNetworkSelectionModeAutomaticResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -780,7 +781,7 @@
     oneway setNetworkSelectionModeManualResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param networkInfos List of network operator information as OperatorInfos defined in
      *         types.hal
      *
@@ -795,7 +796,7 @@
             vec<OperatorInfo> networkInfos);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -812,7 +813,7 @@
     oneway startDtmfResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -830,7 +831,7 @@
     oneway stopDtmfResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param version string containing version string for log reporting
      *
      * Valid errors returned:
@@ -843,7 +844,7 @@
     oneway getBasebandVersionResponse(RadioResponseInfo info, string version);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -862,7 +863,7 @@
     oneway separateConnectionResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -875,8 +876,8 @@
     oneway setMuteResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
-     * @param enable true for "mute enabled" & false for "mute disabled"
+     * @param info Response info struct containing response type, serial no. and error
+     * @param enable true for "mute enabled" and false for "mute disabled"
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -892,7 +893,7 @@
     oneway getMuteResponse(RadioResponseInfo info, bool enable);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param status indicates CLIP status
      *
      * Valid errors returned:
@@ -909,7 +910,7 @@
     oneway getClipResponse(RadioResponseInfo info, ClipStatus status);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param dcResponse List of DataCallResult as defined in types.hal
      *
      * Valid errors returned:
@@ -921,7 +922,7 @@
     oneway getDataCallListResponse(RadioResponseInfo info, vec<SetupDataCallResult> dcResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param data data returned by oem
      *
      * Valid errors returned:
@@ -933,7 +934,7 @@
     oneway sendOemRilRequestRawResponse(RadioResponseInfo info, vec<uint8_t> data);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param data data returned by oem
      *
      * Valid errors returned:
@@ -945,7 +946,7 @@
     oneway sendOemRilRequestStringsResponse(RadioResponseInfo info, vec<string> data);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -956,7 +957,7 @@
     oneway sendScreenStateResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -972,7 +973,7 @@
     oneway setSuppServiceNotificationsResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param index record index where the message is stored
      *
      * Valid errors returned:
@@ -993,7 +994,7 @@
     oneway writeSmsToSimResponse(RadioResponseInfo info, int32_t index);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1009,7 +1010,7 @@
     oneway deleteSmsOnSimResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1021,7 +1022,7 @@
     oneway setBandModeResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param bandModes List of RadioBandMode listing supported modes
      *
      * Valid errors returned:
@@ -1033,7 +1034,7 @@
     oneway getAvailableBandModesResponse(RadioResponseInfo info, vec<RadioBandMode> bandModes);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param commandResponse SAT/USAT response in hexadecimal format
      *        string starting with first byte of response
      *
@@ -1048,7 +1049,7 @@
     oneway sendEnvelopeResponse(RadioResponseInfo info, string commandResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1060,7 +1061,7 @@
     oneway sendTerminalResponseToSimResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1072,7 +1073,7 @@
     oneway handleStkCallSetupRequestFromSimResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1091,7 +1092,7 @@
     oneway explicitCallTransferResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1104,7 +1105,7 @@
     oneway setPreferredNetworkTypeResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param nwType RadioPreferredNetworkType defined in types.hal
      *
      * Valid errors returned:
@@ -1117,8 +1118,8 @@
             PreferredNetworkType nwType);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
-     * @param cell RadioNeighboringCell defined in types.hal
+     * @param info Response info struct containing response type, serial no. and error
+     * @param cells Vector of neighboring radio cell
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1126,10 +1127,10 @@
      *   RadioError:INVALID_ARGUMENTS
      *   RadioError:GENERIC_FAILURE
      */
-    oneway getNeighboringCidsResponse(RadioResponseInfo info, NeighboringCell cell);
+    oneway getNeighboringCidsResponse(RadioResponseInfo info, vec<NeighboringCell> cells);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1140,7 +1141,7 @@
     oneway setLocationUpdatesResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1153,7 +1154,7 @@
     oneway setCdmaSubscriptionSourceResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1164,7 +1165,7 @@
     oneway setCdmaRoamingPreferenceResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param type CdmaRoamingType defined in types.hal
      *
      * Valid errors returned:
@@ -1176,7 +1177,7 @@
     oneway getCdmaRoamingPreferenceResponse(RadioResponseInfo info, CdmaRoamingType type);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1190,7 +1191,7 @@
     oneway setTTYModeResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param mode TtyMode
      *
      * Valid errors returned:
@@ -1205,7 +1206,7 @@
     oneway getTTYModeResponse(RadioResponseInfo info, TtyMode mode);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1219,7 +1220,7 @@
     oneway setPreferredVoicePrivacyResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param enable false for Standard Privacy Mode (Public Long Code Mask)
      *        true for Enhanced Privacy Mode (Private Long Code Mask)
      *
@@ -1237,7 +1238,7 @@
     /*
      * Response callback for IRadio.sendCDMAFeatureCode()
      *
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1254,7 +1255,7 @@
     oneway sendCDMAFeatureCodeResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1271,7 +1272,7 @@
     oneway sendBurstDtmfResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param sms Sms result struct as defined by SendSmsResult in types.hal
      *
      * Valid errors returned:
@@ -1296,7 +1297,7 @@
     oneway sendCdmaSmsResponse(RadioResponseInfo info, SendSmsResult sms);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1316,8 +1317,8 @@
     oneway acknowledgeLastIncomingCdmaSmsResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
-     * @param configInfo Setting of GSM/WCDMA Cell broadcast config
+     * @param info Response info struct containing response type, serial no. and error
+     * @param configs Vector of GSM/WCDMA Cell broadcast configs
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1331,10 +1332,11 @@
      *   RadioError:NO_RESOURCES
      *   RadioError:GENERIC_FAILURE
      */
-    oneway getGsmBroadcastConfigResponse(RadioResponseInfo info, GsmBroadcastSmsConfigInfo configInfo);
+    oneway getGsmBroadcastConfigResponse(RadioResponseInfo info,
+            vec<GsmBroadcastSmsConfigInfo> configs);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1350,7 +1352,7 @@
     oneway setGsmBroadcastConfigResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1366,8 +1368,8 @@
     oneway setGsmBroadcastActivationResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
-     * @param configInfo CDMA Broadcast SMS config.
+     * @param info Response info struct containing response type, serial no. and error
+     * @param configs Vector of CDMA Broadcast SMS configs.
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1381,10 +1383,11 @@
      *   RadioError:NO_RESOURCES
      *   RadioError:GENERIC_FAILURE
      */
-    oneway getCdmaBroadcastConfigResponse(RadioResponseInfo info, CdmaBroadcastSmsConfigInfo configInfo);
+    oneway getCdmaBroadcastConfigResponse(RadioResponseInfo info,
+            vec<CdmaBroadcastSmsConfigInfo> configs);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1400,7 +1403,7 @@
     oneway setCdmaBroadcastConfigResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1416,7 +1419,7 @@
     oneway setCdmaBroadcastActivationResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param mdn MDN if CDMA subscription is available
      * @param hSid is a comma separated list of H_SID (Home SID) if
      *        CDMA subscription is available, in decimal format
@@ -1436,7 +1439,7 @@
             string hNid, string min, string prl);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param index record index where the cmda sms message is stored
      *
      * Valid errors returned:
@@ -1458,7 +1461,7 @@
     oneway writeSmsToRuimResponse(RadioResponseInfo info, uint32_t index);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1474,7 +1477,7 @@
     oneway deleteSmsOnRuimResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param imei IMEI if GSM subscription is available
      * @param imeisv IMEISV if GSM subscription is available
      * @param esn ESN if CDMA subscription is available
@@ -1494,7 +1497,7 @@
             string esn, string meid);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1506,7 +1509,7 @@
     oneway exitEmergencyCallbackModeResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param smsc Short Message Service Center address on the device
      *
      * Valid errors returned:
@@ -1525,7 +1528,7 @@
     oneway getSmscAddressResponse(RadioResponseInfo info, string smsc);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1542,7 +1545,7 @@
     oneway setSmscAddressResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1558,7 +1561,7 @@
     oneway reportSmsMemoryStatusResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param source CDMA subscription source
      *
      * Valid errors returned:
@@ -1570,7 +1573,7 @@
     oneway getCdmaSubscriptionSourceResponse(RadioResponseInfo info, CdmaSubscriptionSource source);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param response response string of the challenge/response algo for ISIM auth in base64 format
      *
      * Valid errors returned:
@@ -1581,7 +1584,7 @@
     oneway requestIsimAuthenticationResponse(RadioResponseInfo info, string response);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1591,7 +1594,7 @@
     oneway acknowledgeIncomingGsmSmsWithPduResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param iccIo IccIoResult as defined in types.hal corresponding to ICC IO response
      *
      * Valid errors returned:
@@ -1604,7 +1607,7 @@
     oneway sendEnvelopeWithStatusResponse(RadioResponseInfo info, IccIoResult iccIo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param rat Current voice RAT
      *
      * Valid errors returned:
@@ -1615,7 +1618,7 @@
     oneway getVoiceRadioTechnologyResponse(RadioResponseInfo info, RadioTechnology rat);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param cellInfo List of current cell information known to radio
      *
      * Valid errors returned:
@@ -1626,7 +1629,7 @@
     oneway getCellInfoListResponse(RadioResponseInfo info, vec<CellInfo> cellInfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1636,7 +1639,7 @@
     oneway setCellInfoListRateResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1647,7 +1650,7 @@
     oneway setInitialAttachApnResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param isRegistered false = not registered, true = registered
      * @param ratFamily RadioTechnologyFamily as defined in types.hal. This value is valid only if
      *        isRegistered is true.
@@ -1661,7 +1664,7 @@
             RadioTechnologyFamily ratFamily);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param sms Response to sms sent as defined by SendSmsResult in types.hal
      *
      * Valid errors returned:
@@ -1685,7 +1688,7 @@
     oneway sendImsSmsResponse(RadioResponseInfo info, SendSmsResult sms);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param result IccIoResult as defined in types.hal
      *
      * Valid errors returned:
@@ -1696,7 +1699,7 @@
     oneway iccTransmitApduBasicChannelResponse(RadioResponseInfo info, IccIoResult result);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param channelId session id of the logical channel.
      * @param selectResponse Contains the select response for the open channel command with one
      *        byte per integer
@@ -1712,7 +1715,7 @@
             vec<int8_t> selectResponse);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1722,7 +1725,7 @@
     oneway iccCloseLogicalChannelResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param result IccIoResult as defined in types.hal
      *
      * Valid errors returned:
@@ -1733,7 +1736,7 @@
     oneway iccTransmitApduLogicalChannelResponse(RadioResponseInfo info, IccIoResult result);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param result string containing the contents of the NV item
      *
      * Valid errors returned:
@@ -1744,7 +1747,7 @@
     oneway nvReadItemResponse(RadioResponseInfo info, string result);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1754,7 +1757,7 @@
     oneway nvWriteItemResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1764,7 +1767,7 @@
     oneway nvWriteCdmaPrlResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1774,7 +1777,7 @@
     oneway nvResetConfigResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1785,7 +1788,7 @@
     oneway setUiccSubscriptionResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1795,7 +1798,7 @@
     oneway setDataAllowedResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param config Array of HardwareConfig of the radio.
      *
      * Valid errors returned:
@@ -1805,7 +1808,7 @@
     oneway getHardwareConfigResponse(RadioResponseInfo info, vec<HardwareConfig> config);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param result IccIoResult as defined in types.hal
      *
      * Valid errors returned:
@@ -1815,7 +1818,7 @@
     oneway requestIccSimAuthenticationResponse(RadioResponseInfo info, IccIoResult result);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1825,7 +1828,7 @@
     oneway setDataProfileResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      *
      * Valid errors returned:
      *   RadioError:NONE
@@ -1836,7 +1839,7 @@
     oneway requestShutdownResponse(RadioResponseInfo info);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param rc Radio capability as defined by RadioCapability in types.hal
      *
      * Valid errors returned:
@@ -1848,7 +1851,7 @@
     oneway getRadioCapabilityResponse(RadioResponseInfo info, RadioCapability rc);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param rc Radio capability as defined by RadioCapability in types.hal used to
      *        feedback return status
      *
@@ -1861,7 +1864,7 @@
     oneway setRadioCapabilityResponse(RadioResponseInfo info, RadioCapability rc);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param statusInfo LceStatusInfo indicating LCE status
      *
      * Valid errors returned:
@@ -1872,7 +1875,7 @@
     oneway startLceServiceResponse(RadioResponseInfo info, LceStatusInfo statusInfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param statusInfo LceStatusInfo indicating LCE status
      *
      * Valid errors returned:
@@ -1883,7 +1886,7 @@
     oneway stopLceServiceResponse(RadioResponseInfo info, LceStatusInfo statusInfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param lceInfo LceDataInfo indicating LCE data as defined in types.hal
      *
      * Valid errors returned:
@@ -1894,7 +1897,7 @@
     oneway pullLceDataResponse(RadioResponseInfo info, LceDataInfo lceInfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param activityInfo modem activity information
      *
      * Valid errors returned:
@@ -1905,7 +1908,7 @@
     oneway getModemActivityInfoResponse(RadioResponseInfo info, ActivityStatsInfo activityInfo);
 
     /*
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param numAllowed number of allowed carriers which have been set correctly.
      *        On success, it must match the length of list Carriers->allowedCarriers.
      *        if Length of allowed carriers list is 0, numAllowed = 0.
@@ -1922,7 +1925,7 @@
      * Expected modem behavior:
      *  Return list of allowed carriers, and if all carriers are allowed.
      *
-     * @param info Response info struct containing response type, serial no. & error
+     * @param info Response info struct containing response type, serial no. and error
      * @param allAllowed true only when all carriers are allowed. Ignore "carriers" struct.
      *        If false, consider "carriers" struct
      * @param carriers Carrier restriction information.
@@ -1942,5 +1945,5 @@
      *
      * @param serial Serial no. of the request whose acknowledgement is sent.
      */
-    oneway requestAcknowledgement(int32_t serial);
+    oneway acknowledgeRequest(int32_t serial);
 };
diff --git a/radio/1.0/types.hal b/radio/1.0/types.hal
index 5b853b4..8c7f538 100644
--- a/radio/1.0/types.hal
+++ b/radio/1.0/types.hal
@@ -562,8 +562,6 @@
 };
 
 enum CallForwardInfoStatus : int32_t {
-    ACTIVE,
-    INACTIVE,
     DISABLE,
     ENABLE,
     INTERROGATE,
@@ -1080,7 +1078,7 @@
     string aidPtr;                        // e.g., from 0xA0, 0x00 -> 0x41,
                                           // 0x30, 0x30, 0x30
     string appLabelPtr;
-    int32_t pin1Replaced;                 // applicable to USIM, CSIM & ISIM
+    int32_t pin1Replaced;                 // applicable to USIM, CSIM and ISIM
     PinState pin1;
     PinState pin2;
 };
@@ -1126,6 +1124,11 @@
     vec<UusInfo> uusInfo;                 // Vector of User-User Signaling Information
 };
 
+struct LastCallFailCauseInfo {
+    LastCallFailCause causeCode;
+    string vendorCause;
+};
+
 struct GsmSignalStrength {
     uint32_t signalStrength;              // Valid values are (0-61, 99) as defined in
                                           // TS 27.007 8.69
@@ -1262,16 +1265,16 @@
 
 struct IccIo {
     int32_t command;                      // one of the commands listed for TS 27.007 +CRSM
-    int32_t fileid;                       // EF id
+    int32_t fileId;                       // EF id
     string path;                          // "pathid" from TS 27.007 +CRSM command.
                                           // Path is in hex asciii format eg "7f205f70"
                                           // Path must always be provided.
-    int32_t p1;                           // Values of p1, p2 & p3 defined as per 3GPP TS 51.011
+    int32_t p1;                           // Values of p1, p2 and p3 defined as per 3GPP TS 51.011
     int32_t p2;
     int32_t p3;
     string data;                          // information to be written to the SIM
     string pin2;
-    string aidPtr;                        // AID value, See ETSI 102.221 8.1 and 101.220 4, empty
+    string aid;                           // AID value, See ETSI 102.221 8.1 and 101.220 4, empty
                                           // string if no value.
 };
 
@@ -1405,7 +1408,7 @@
 // See also com.android.internal.telephony.gsm.CallForwardInfo
 struct CallForwardInfo {
     CallForwardInfoStatus status;         // For queryCallForwardStatus()
-                                          // status must be ACTIVE, INACTIVE
+                                          // status is DISABLE (Not used by vendor code currently)
                                           // For setCallForward():
                                           // status must be
                                           // DISABLE, ENABLE, INTERROGATE, REGISTRATION, ERASURE
@@ -1437,7 +1440,7 @@
 };
 
 struct CdmaSmsAddress {
-    CdmaSmsDigitMode digitMode;          // CdmaSmsDigitMode is of two types : 4 bit & 8 bit.
+    CdmaSmsDigitMode digitMode;          // CdmaSmsDigitMode is of two types : 4 bit and 8 bit.
                                          // For 4-bit type, only "digits" field defined below in
                                          // this struct is used.
     CdmaSmsNumberMode numberMode;        // Used only when digitMode is 8-bit
@@ -1613,7 +1616,7 @@
     bool registered;                     // true if this cell is registered false if not registered
     TimeStampType timeStampType;         // type of time stamp represented by timeStamp
     uint64_t timeStamp;                  // Time in nanos as returned by ril_nano_time
-    // Only one of the below vectors must be of size 1 based on the CellInfoType & others must be
+    // Only one of the below vectors must be of size 1 based on the CellInfoType and others must be
     // of size 0
     vec<CellInfoGsm> gsm;                // Valid only if type = gsm and size = 1 else must be empty
     vec<CellInfoCdma> cdma;              // Valid only if type = cdma and size = 1 else must be
@@ -1640,7 +1643,7 @@
     int32_t messageRef;                  // Valid field if retry is set to true.
                                          // Contains messageRef from SendSmsResult stuct
                                          // corresponding to failed MO SMS.
-    // Only one of the below vectors must be of size 1 based on the RadioTechnologyFamily & others
+    // Only one of the below vectors must be of size 1 based on the RadioTechnologyFamily and others
     // must be of size 0
     vec<CdmaSmsMessage> cdmaMessage;     // Valid field if tech is 3GPP2 and size = 1 else must be
                                          // empty
@@ -1649,7 +1652,7 @@
 };
 
 struct SimApdu {
-    int32_t sessionid;                   // "sessionid" from TS 27.007 +CGLA command. Must be
+    int32_t sessionId;                   // "sessionid" from TS 27.007 +CGLA command. Must be
                                          // ignored for +CSIM command.
     // Following fields are used to derive the APDU ("command" and "length"
     // values in TS 27.007 +CSIM and +CGLA commands).
@@ -1662,7 +1665,7 @@
 };
 
 struct NvWriteItem {
-    NvItem itemID;
+    NvItem itemId;
     string value;
 };
 
@@ -1786,9 +1789,7 @@
     bool isMT;                             // notification type
                                            // false = MO intermediate result code
                                            // true = MT unsolicited result code
-    bool isCode1;                          // See 27.007 7.17
-                                           // true = "code1" for MO
-                                           // false = "code2" for MT
+    int32_t code;                          // result code. See 27.007 7.17.
     int32_t index;                         // CUG index. See 27.007 7.17.
     int32_t type;                          // "type" from 27.007 7.17 (MT only).
     string number;                         // "number" from 27.007 7.17
@@ -1933,4 +1934,4 @@
                                          // to send all of them.
     vec<uint8_t> contents;               // Carrier-defined content. It is binary, opaque and
                                          // loosely defined in LTE Layer 3 spec 24.008
-};
\ No newline at end of file
+};
diff --git a/sensors/1.0/vts/functional/vts/testcases/hal/sensors/hidl/target/AndroidTest.xml b/sensors/1.0/vts/functional/vts/testcases/hal/sensors/hidl/target/AndroidTest.xml
index 66317f0..6329d5d 100644
--- a/sensors/1.0/vts/functional/vts/testcases/hal/sensors/hidl/target/AndroidTest.xml
+++ b/sensors/1.0/vts/functional/vts/testcases/hal/sensors/hidl/target/AndroidTest.xml
@@ -25,6 +25,7 @@
             _64bit::DATA/nativetest64/sensors_hidl_hal_test/sensors_hidl_hal_test,
             "/>
         <option name="binary-test-type" value="gtest" />
+        <option name="binary-test-disable-framework" value="true" />
         <option name="test-timeout" value="10m" />
     </test>
 </configuration>
diff --git a/tests/baz/1.0/IBaz.hal b/tests/baz/1.0/IBaz.hal
index 7c5d63a..a2d961a 100644
--- a/tests/baz/1.0/IBaz.hal
+++ b/tests/baz/1.0/IBaz.hal
@@ -52,6 +52,7 @@
 
     callMeLater(IBazCallback cb);
     iAmFreeNow();
+    dieNow();
 
     useAnEnum(SomeEnum zzz) generates (SomeEnum kkk);
 
diff --git a/tests/msgq/1.0/ITestMsgQ.hal b/tests/msgq/1.0/ITestMsgQ.hal
index b23f48f..933e39b 100644
--- a/tests/msgq/1.0/ITestMsgQ.hal
+++ b/tests/msgq/1.0/ITestMsgQ.hal
@@ -31,7 +31,7 @@
      * set up by the service. Client can use it to set up the FMQ at its end.
      */
     configureFmqSyncReadWrite()
-        generates(bool ret, MQDescriptorSync mqDesc);
+        generates(bool ret, fmq_sync<uint16_t> mqDesc);
 
     /*
      * This method requests the service to set up an unsynchronized write
@@ -42,7 +42,7 @@
      * set up by the service. Client can use it to set up the FMQ at its end.
      */
     configureFmqUnsyncWrite()
-        generates(bool ret, MQDescriptorUnsync mqDesc);
+        generates(bool ret, fmq_unsync<uint16_t> mqDesc);
 
     /*
      * This method request the service to write into the synchronized read/write
diff --git a/tv/input/1.0/Android.bp b/tv/input/1.0/Android.bp
index 21d8893..94dcdc9 100644
--- a/tv/input/1.0/Android.bp
+++ b/tv/input/1.0/Android.bp
@@ -64,3 +64,67 @@
         "android.hidl.base@1.0",
     ],
 }
+
+genrule {
+    name: "android.hardware.tv.input.vts.driver@1.0_genc++",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tv.input@1.0 && $(location vtsc) -mDRIVER -tSOURCE -b$(genDir) android/hardware/tv/input/1.0/ $(genDir)/android/hardware/tv/input/1.0/",
+    srcs: [
+        "types.hal",
+        "ITvInput.hal",
+        "ITvInputCallback.hal",
+    ],
+    out: [
+        "android/hardware/tv/input/1.0/types.vts.cpp",
+        "android/hardware/tv/input/1.0/TvInput.vts.cpp",
+        "android/hardware/tv/input/1.0/TvInputCallback.vts.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.tv.input.vts.driver@1.0_genc++_headers",
+    tools: ["hidl-gen", "vtsc"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lvts -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.tv.input@1.0 && $(location vtsc) -mDRIVER -tHEADER -b$(genDir) android/hardware/tv/input/1.0/ $(genDir)/android/hardware/tv/input/1.0/",
+    srcs: [
+        "types.hal",
+        "ITvInput.hal",
+        "ITvInputCallback.hal",
+    ],
+    out: [
+        "android/hardware/tv/input/1.0/types.vts.h",
+        "android/hardware/tv/input/1.0/TvInput.vts.h",
+        "android/hardware/tv/input/1.0/TvInputCallback.vts.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.tv.input.vts.driver@1.0",
+    generated_sources: ["android.hardware.tv.input.vts.driver@1.0_genc++"],
+    generated_headers: ["android.hardware.tv.input.vts.driver@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.tv.input.vts.driver@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "libvts_common",
+        "libvts_datatype",
+        "libvts_measurement",
+        "libvts_multidevice_proto",
+        "libcamera_metadata",
+        "libprotobuf-cpp-full",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+        "android.hardware.tv.input@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hardware.audio.common@2.0",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/tv/input/1.0/Android.mk b/tv/input/1.0/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/input/1.0/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/input/1.0/vts/Android.mk b/tv/input/1.0/vts/Android.mk
index 5a60edc..040cfce 100644
--- a/tv/input/1.0/vts/Android.mk
+++ b/tv/input/1.0/vts/Android.mk
@@ -16,74 +16,4 @@
 
 LOCAL_PATH := $(call my-dir)
 
-# build VTS profiler for TvInput
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_profiler_hidl_tv_input@1.0
-
-LOCAL_SRC_FILES := \
-  TvInput.vts \
-  types.vts \
-  ../../../../audio/common/2.0/vts/types.vts \
-
-LOCAL_C_INCLUDES += \
-  test/vts/drivers/libprofiling \
-
-LOCAL_VTS_MODE := PROFILER
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.tv.input@1.0 \
-  libbase \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_multidevice_proto \
-  libvts_profiling \
-  libutils \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
-
-# build VTS profiler for TvInputCallback
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := libvts_profiler_hidl_tv_input_callback_@1.0
-
-LOCAL_SRC_FILES := \
-  TvInputCallback.vts \
-  types.vts \
-  ../../../../audio/common/2.0/vts/types.vts \
-
-LOCAL_C_INCLUDES += \
-  test/vts/drivers/libprofiling \
-
-LOCAL_VTS_MODE := PROFILER
-
-LOCAL_SHARED_LIBRARIES += \
-  android.hardware.tv.input@1.0 \
-  libbase \
-  libcutils \
-  liblog \
-  libhidlbase \
-  libhidltransport \
-  libhwbinder \
-  libprotobuf-cpp-full \
-  libvts_common \
-  libvts_multidevice_proto \
-  libvts_profiling \
-  libutils \
-
-LOCAL_PROTOC_OPTIMIZE_TYPE := full
-
-LOCAL_MULTILIB := both
-
-include $(BUILD_SHARED_LIBRARY)
-
+include $(LOCAL_PATH)/functional/vts/testcases/hal/tv_input/hidl/host/Android.mk
diff --git a/tv/input/1.0/vts/TvInput.vts b/tv/input/1.0/vts/TvInput.vts
index 638fd08..73b322a 100644
--- a/tv/input/1.0/vts/TvInput.vts
+++ b/tv/input/1.0/vts/TvInput.vts
@@ -57,6 +57,7 @@
             predefined_type: "::android::hardware::tv::input::V1_0::Result"
         }
         return_type_hidl: {
+            type: TYPE_HANDLE
         }
         arg: {
             type: TYPE_SCALAR
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/__init__.py b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/__init__.py
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/Android.mk b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/Android.mk
new file mode 100644
index 0000000..f9e3276
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/Android.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/__init__.py b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/__init__.py
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/Android.mk b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/Android.mk
new file mode 100644
index 0000000..2703d8c
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/Android.mk
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include $(call all-subdir-makefiles)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := TvInputHidlTest
+VTS_CONFIG_SRC_DIR := testcases/hal/tv_input/hidl/host
+include test/vts/tools/build/Android.host_config.mk
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/AndroidTest.xml b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/AndroidTest.xml
new file mode 100644
index 0000000..8fdd72d
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/AndroidTest.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2016 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config for VTS Tv Input HIDL HAL's host-side test cases">
+    <target_preparer class="com.android.compatibility.common.tradefed.targetprep.VtsFilePusher">
+        <option name="push-group" value="HidlHalTest.push" />
+        <option name="push" value="spec/hardware/interfaces/tv/input/1.0/vts/TvInput.vts->/data/local/tmp/spec/TvInput.vts" />
+        <option name="push" value="spec/hardware/interfaces/tv/input/1.0/vts/TvInputCallback.vts->/data/local/tmp/spec/TvInputCallback.vts" />
+        <option name="push" value="spec/hardware/interfaces/tv/input/1.0/vts/types.vts->/data/local/tmp/spec/types.vts" />
+        <option name="cleanup" value="true" />
+    </target_preparer>
+    <target_preparer class="com.android.tradefed.targetprep.VtsPythonVirtualenvPreparer">
+    </target_preparer>
+    <test class="com.android.tradefed.testtype.VtsMultiDeviceTest">
+        <option name="test-module-name" value="TvInputHidlTest" />
+        <option name="test-case-path" value="vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest" />
+    </test>
+</configuration>
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py
new file mode 100644
index 0000000..c99c82c
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/TvInputHidlTest.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import logging
+
+from vts.runners.host import asserts
+from vts.runners.host import base_test_with_webdb
+from vts.runners.host import const
+from vts.runners.host import test_runner
+from vts.utils.python.controllers import android_device
+
+
+class TvInputHidlTest(base_test_with_webdb.BaseTestWithWebDbClass):
+    """Two hello world test cases which use the shell driver."""
+
+    def setUpClass(self):
+        """Creates a mirror and init tv input hal."""
+        self.dut = self.registerController(android_device)[0]
+
+        self.dut.shell.InvokeTerminal("one")
+        self.dut.shell.one.Execute("setenforce 0")  # SELinux permissive mode
+
+        self.dut.hal.InitHidlHal(target_type="tv_input",
+                                 target_basepaths=["/system/lib64"],
+                                 target_version=1.0,
+                                 target_package="android.hardware.tv.input",
+                                 target_component_name="ITvInput",
+                                 bits=64)
+
+        self.dut.shell.InvokeTerminal("one")
+
+    def testGetStreamConfigurations(self):
+        configs = self.dut.hal.tv_input.getStreamConfigurations(0)
+        logging.info('tv input configs: %s', configs)
+
+
+if __name__ == "__main__":
+    test_runner.main()
diff --git a/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/__init__.py b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tv/input/1.0/vts/functional/vts/testcases/hal/tv_input/hidl/host/__init__.py
diff --git a/tv/input/1.0/vts/types.vts b/tv/input/1.0/vts/types.vts
index 67d84db..d03e065 100644
--- a/tv/input/1.0/vts/types.vts
+++ b/tv/input/1.0/vts/types.vts
@@ -133,7 +133,7 @@
         }
         enumerator: "PUBLIC_CNT"
         scalar_value: {
-            int32_t: 10
+            int32_t: 11
         }
         enumerator: "FOR_POLICY_CNT"
         scalar_value: {
@@ -310,6 +310,82 @@
         scalar_value: {
             uint32_t: 234881024
         }
+        enumerator: "EVRC"
+        scalar_value: {
+            uint32_t: 268435456
+        }
+        enumerator: "EVRCB"
+        scalar_value: {
+            uint32_t: 285212672
+        }
+        enumerator: "EVRCWB"
+        scalar_value: {
+            uint32_t: 301989888
+        }
+        enumerator: "EVRCNW"
+        scalar_value: {
+            uint32_t: 318767104
+        }
+        enumerator: "AAC_ADIF"
+        scalar_value: {
+            uint32_t: 335544320
+        }
+        enumerator: "WMA"
+        scalar_value: {
+            uint32_t: 352321536
+        }
+        enumerator: "WMA_PRO"
+        scalar_value: {
+            uint32_t: 369098752
+        }
+        enumerator: "AMR_WB_PLUS"
+        scalar_value: {
+            uint32_t: 385875968
+        }
+        enumerator: "MP2"
+        scalar_value: {
+            uint32_t: 402653184
+        }
+        enumerator: "QCELP"
+        scalar_value: {
+            uint32_t: 419430400
+        }
+        enumerator: "DSD"
+        scalar_value: {
+            uint32_t: 436207616
+        }
+        enumerator: "FLAC"
+        scalar_value: {
+            uint32_t: 452984832
+        }
+        enumerator: "ALAC"
+        scalar_value: {
+            uint32_t: 469762048
+        }
+        enumerator: "APE"
+        scalar_value: {
+            uint32_t: 486539264
+        }
+        enumerator: "AAC_ADTS"
+        scalar_value: {
+            uint32_t: 503316480
+        }
+        enumerator: "SBC"
+        scalar_value: {
+            uint32_t: 520093696
+        }
+        enumerator: "APTX"
+        scalar_value: {
+            uint32_t: 536870912
+        }
+        enumerator: "APTX_HD"
+        scalar_value: {
+            uint32_t: 553648128
+        }
+        enumerator: "LDAC"
+        scalar_value: {
+            uint32_t: 570425344
+        }
         enumerator: "MAIN_MASK"
         scalar_value: {
             uint32_t: 4278190080
@@ -458,6 +534,46 @@
         scalar_value: {
             uint32_t: 67109376
         }
+        enumerator: "AAC_ADTS_MAIN"
+        scalar_value: {
+            uint32_t: 503316481
+        }
+        enumerator: "AAC_ADTS_LC"
+        scalar_value: {
+            uint32_t: 503316482
+        }
+        enumerator: "AAC_ADTS_SSR"
+        scalar_value: {
+            uint32_t: 503316484
+        }
+        enumerator: "AAC_ADTS_LTP"
+        scalar_value: {
+            uint32_t: 503316488
+        }
+        enumerator: "AAC_ADTS_HE_V1"
+        scalar_value: {
+            uint32_t: 503316496
+        }
+        enumerator: "AAC_ADTS_SCALABLE"
+        scalar_value: {
+            uint32_t: 503316512
+        }
+        enumerator: "AAC_ADTS_ERLC"
+        scalar_value: {
+            uint32_t: 503316544
+        }
+        enumerator: "AAC_ADTS_LD"
+        scalar_value: {
+            uint32_t: 503316608
+        }
+        enumerator: "AAC_ADTS_HE_V2"
+        scalar_value: {
+            uint32_t: 503316736
+        }
+        enumerator: "AAC_ADTS_ELD"
+        scalar_value: {
+            uint32_t: 503316992
+        }
     }
 }
 
@@ -580,6 +696,10 @@
         scalar_value: {
             uint32_t: 3
         }
+        enumerator: "OUT_2POINT1"
+        scalar_value: {
+            uint32_t: 11
+        }
         enumerator: "OUT_QUAD"
         scalar_value: {
             uint32_t: 51
@@ -592,6 +712,14 @@
         scalar_value: {
             uint32_t: 1539
         }
+        enumerator: "OUT_SURROUND"
+        scalar_value: {
+            uint32_t: 263
+        }
+        enumerator: "OUT_PENTA"
+        scalar_value: {
+            uint32_t: 55
+        }
         enumerator: "OUT_5POINT1"
         scalar_value: {
             uint32_t: 63
@@ -604,6 +732,10 @@
         scalar_value: {
             uint32_t: 1551
         }
+        enumerator: "OUT_6POINT1"
+        scalar_value: {
+            uint32_t: 319
+        }
         enumerator: "OUT_7POINT1"
         scalar_value: {
             uint32_t: 1599
@@ -680,6 +812,18 @@
         scalar_value: {
             uint32_t: 48
         }
+        enumerator: "IN_VOICE_UPLINK_MONO"
+        scalar_value: {
+            uint32_t: 16400
+        }
+        enumerator: "IN_VOICE_DNLINK_MONO"
+        scalar_value: {
+            uint32_t: 32784
+        }
+        enumerator: "IN_VOICE_CALL_MONO"
+        scalar_value: {
+            uint32_t: 49168
+        }
         enumerator: "IN_ALL"
         scalar_value: {
             uint32_t: 65532
@@ -907,13 +1051,17 @@
         scalar_value: {
             uint32_t: 16777216
         }
+        enumerator: "OUT_PROXY"
+        scalar_value: {
+            uint32_t: 33554432
+        }
         enumerator: "OUT_DEFAULT"
         scalar_value: {
             uint32_t: 1073741824
         }
         enumerator: "OUT_ALL"
         scalar_value: {
-            uint32_t: 1107296255
+            uint32_t: 1140850687
         }
         enumerator: "OUT_ALL_A2DP"
         scalar_value: {
@@ -1019,13 +1167,17 @@
         scalar_value: {
             uint32_t: 2148532224
         }
+        enumerator: "IN_PROXY"
+        scalar_value: {
+            uint32_t: 2164260864
+        }
         enumerator: "IN_DEFAULT"
         scalar_value: {
             uint32_t: 3221225472
         }
         enumerator: "IN_ALL"
         scalar_value: {
-            uint32_t: 3223322623
+            uint32_t: 3240099839
         }
         enumerator: "IN_ALL_SCO"
         scalar_value: {
@@ -1092,6 +1244,14 @@
         scalar_value: {
             int32_t: 1024
         }
+        enumerator: "DIRECT_PCM"
+        scalar_value: {
+            int32_t: 8192
+        }
+        enumerator: "MMAP_NOIRQ"
+        scalar_value: {
+            int32_t: 16384
+        }
     }
 }
 
@@ -1121,6 +1281,91 @@
         scalar_value: {
             int32_t: 8
         }
+        enumerator: "MMAP_NOIRQ"
+        scalar_value: {
+            int32_t: 16
+        }
+    }
+}
+
+attribute: {
+    name: "::android::hardware::audio::common::V2_0::AudioUsage"
+    type: TYPE_ENUM
+    enum_value: {
+        scalar_type: "int32_t"
+
+        enumerator: "UNKNOWN"
+        scalar_value: {
+            int32_t: 0
+        }
+        enumerator: "MEDIA"
+        scalar_value: {
+            int32_t: 1
+        }
+        enumerator: "VOICE_COMMUNICATION"
+        scalar_value: {
+            int32_t: 2
+        }
+        enumerator: "VOICE_COMMUNICATION_SIGNALLING"
+        scalar_value: {
+            int32_t: 3
+        }
+        enumerator: "ALARM"
+        scalar_value: {
+            int32_t: 4
+        }
+        enumerator: "NOTIFICATION"
+        scalar_value: {
+            int32_t: 5
+        }
+        enumerator: "NOTIFICATION_TELEPHONY_RINGTONE"
+        scalar_value: {
+            int32_t: 6
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_REQUEST"
+        scalar_value: {
+            int32_t: 7
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_INSTANT"
+        scalar_value: {
+            int32_t: 8
+        }
+        enumerator: "NOTIFICATION_COMMUNICATION_DELAYED"
+        scalar_value: {
+            int32_t: 9
+        }
+        enumerator: "NOTIFICATION_EVENT"
+        scalar_value: {
+            int32_t: 10
+        }
+        enumerator: "ASSISTANCE_ACCESSIBILITY"
+        scalar_value: {
+            int32_t: 11
+        }
+        enumerator: "ASSISTANCE_NAVIGATION_GUIDANCE"
+        scalar_value: {
+            int32_t: 12
+        }
+        enumerator: "ASSISTANCE_SONIFICATION"
+        scalar_value: {
+            int32_t: 13
+        }
+        enumerator: "GAME"
+        scalar_value: {
+            int32_t: 14
+        }
+        enumerator: "VIRTUAL_SOURCE"
+        scalar_value: {
+            int32_t: 15
+        }
+        enumerator: "CNT"
+        scalar_value: {
+            int32_t: 16
+        }
+        enumerator: "MAX"
+        scalar_value: {
+            int32_t: 15
+        }
     }
 }
 
@@ -1167,6 +1412,21 @@
         type: TYPE_SCALAR
         scalar_type: "bool_t"
     }
+    struct_value: {
+        name: "bitWidth"
+        type: TYPE_SCALAR
+        scalar_type: "uint32_t"
+    }
+    struct_value: {
+        name: "bufferSize"
+        type: TYPE_SCALAR
+        scalar_type: "uint32_t"
+    }
+    struct_value: {
+        name: "usage"
+        type: TYPE_ENUM
+        predefined_type: "::android::hardware::audio::common::V2_0::AudioUsage"
+    }
 }
 
 attribute: {
diff --git a/update-makefiles.sh b/update-makefiles.sh
index f153a84..d0cb91c 100755
--- a/update-makefiles.sh
+++ b/update-makefiles.sh
@@ -20,7 +20,9 @@
 for p in $packages; do
   echo "Updating $p";
   hidl-gen -Lmakefile -r android.hardware:hardware/interfaces -r android.hidl:system/libhidl/transport $p;
+  rc=$?; if [[ $rc != 0 ]]; then exit $rc; fi
   hidl-gen -Landroidbp -r android.hardware:hardware/interfaces -r android.hidl:system/libhidl/transport $p;
+  rc=$?; if [[ $rc != 0 ]]; then exit $rc; fi
 done
 
 # subdirectories of hardware/interfaces which contain an Android.bp file
diff --git a/vehicle/2.0/default/VehicleService.cpp b/vehicle/2.0/default/VehicleService.cpp
index 651a2ad..493df74 100644
--- a/vehicle/2.0/default/VehicleService.cpp
+++ b/vehicle/2.0/default/VehicleService.cpp
@@ -16,10 +16,10 @@
 
 #define LOG_TAG "android.hardware.vehicle@2.0-service"
 #include <android/log.h>
+#include <hidl/HidlTransportSupport.h>
 
 #include <iostream>
 
-#include <hwbinder/IPCThreadState.h>
 
 #include <vehicle_hal_manager/VehicleHalManager.h>
 #include <impl/DefaultVehicleHal.h>
@@ -32,11 +32,11 @@
     auto hal = std::make_unique<impl::DefaultVehicleHal>();
     auto service = std::make_unique<VehicleHalManager>(hal.get());
 
+    configureRpcThreadpool(1, true /* callerWillJoin */);
+
     ALOGI("Registering as service...");
     service->registerAsService("Vehicle");
 
     ALOGI("Ready");
-    ProcessState::self()->setThreadPoolMaxThreadCount(0);
-    ProcessState::self()->startThreadPool();
-    IPCThreadState::self()->joinThreadPool();
+    joinRpcThreadpool();
 }
diff --git a/wifi/1.0/default/service.cpp b/wifi/1.0/default/service.cpp
index 751e8f6..40e8b12 100644
--- a/wifi/1.0/default/service.cpp
+++ b/wifi/1.0/default/service.cpp
@@ -15,42 +15,21 @@
  */
 
 #include <android-base/logging.h>
-#include <hwbinder/IPCThreadState.h>
-#include <hwbinder/ProcessState.h>
+#include <hidl/HidlTransportSupport.h>
 #include <utils/Looper.h>
 #include <utils/StrongPointer.h>
 
 #include "wifi.h"
 
-using android::hardware::hidl_version;
-using android::hardware::IPCThreadState;
-using android::hardware::ProcessState;
-using android::Looper;
-
-namespace {
-int OnBinderReadReady(int /*fd*/, int /*events*/, void* /*data*/) {
-  IPCThreadState::self()->handlePolledCommands();
-  return 1;  // continue receiving events
-}
-}
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
 
 int main(int /*argc*/, char** argv) {
   android::base::InitLogging(argv,
                              android::base::LogdLogger(android::base::SYSTEM));
   LOG(INFO) << "wifi_hal_legacy is starting up...";
 
-  // Setup binder
-  int binder_fd = -1;
-  ProcessState::self()->setThreadPoolMaxThreadCount(0);
-  CHECK_EQ(IPCThreadState::self()->setupPolling(&binder_fd), android::NO_ERROR)
-      << "Failed to initialize binder polling";
-  CHECK_GE(binder_fd, 0) << "Invalid binder FD: " << binder_fd;
-
-  // Setup looper
-  android::sp<Looper> looper = Looper::prepare(0 /* no options */);
-  CHECK(looper->addFd(
-      binder_fd, 0, Looper::EVENT_INPUT, OnBinderReadReady, nullptr))
-      << "Failed to watch binder FD";
+  configureRpcThreadpool(1, true /* callerWillJoin */);
 
   // Setup hwbinder service
   android::sp<android::hardware::wifi::V1_0::IWifi> service =
@@ -58,10 +37,7 @@
   CHECK_EQ(service->registerAsService("wifi"), android::NO_ERROR)
       << "Failed to register wifi HAL";
 
-  // Loop
-  while (looper->pollAll(-1) != Looper::POLL_ERROR) {
-    // Keep polling until failure.
-  }
+  joinRpcThreadpool();
 
   LOG(INFO) << "wifi_hal_legacy is terminating...";
   return 0;