diff --git a/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml b/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
index f035baf..ae57125 100644
--- a/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
+++ b/audio/core/all-versions/vts/functional/VtsHalAudioV6_0TargetTest.xml
@@ -34,5 +34,6 @@
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
         <option name="module-name" value="VtsHalAudioV6_0TargetTest" />
+        <option name="native-test-timeout" value="5m" />
     </test>
 </configuration>
diff --git a/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml b/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
index 6635f31..55dbaf1 100644
--- a/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
+++ b/audio/core/all-versions/vts/functional/VtsHalAudioV7_0TargetTest.xml
@@ -34,5 +34,6 @@
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
         <option name="module-name" value="VtsHalAudioV7_0TargetTest" />
+        <option name="native-test-timeout" value="5m" />
     </test>
 </configuration>
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto b/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto
deleted file mode 100644
index 58daca6..0000000
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/VehicleHalProto.proto
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-syntax = "proto2";
-
-package vhal_proto;
-
-// CMD messages are from workstation --> VHAL
-// RESP messages are from VHAL --> workstation
-enum MsgType {
-    GET_CONFIG_CMD                      = 0;
-    GET_CONFIG_RESP                     = 1;
-    GET_CONFIG_ALL_CMD                  = 2;
-    GET_CONFIG_ALL_RESP                 = 3;
-    GET_PROPERTY_CMD                    = 4;
-    GET_PROPERTY_RESP                   = 5;
-    GET_PROPERTY_ALL_CMD                = 6;
-    GET_PROPERTY_ALL_RESP               = 7;
-    SET_PROPERTY_CMD                    = 8;
-    SET_PROPERTY_RESP                   = 9;
-    SET_PROPERTY_ASYNC                  = 10;
-    DEBUG_CMD                           = 11;
-    DEBUG_RESP                          = 12;
-}
-enum Status {
-    RESULT_OK                           = 0;
-    ERROR_UNKNOWN                       = 1;
-    ERROR_UNIMPLEMENTED_CMD             = 2;
-    ERROR_INVALID_PROPERTY              = 3;
-    ERROR_INVALID_AREA_ID               = 4;
-    ERROR_PROPERTY_UNINITIALIZED        = 5;
-    ERROR_WRITE_ONLY_PROPERTY           = 6;
-    ERROR_MEMORY_ALLOC_FAILED           = 7;
-    ERROR_INVALID_OPERATION             = 8;
-}
-
-enum VehiclePropStatus {
-    AVAILABLE                           = 0;
-    UNAVAILABLE                         = 1;
-    ERROR                               = 2;
-}
-
-message VehicleAreaConfig {
-    required int32  area_id             = 1;
-    optional sint32 min_int32_value     = 2;
-    optional sint32 max_int32_value     = 3;
-    optional sint64 min_int64_value     = 4;
-    optional sint64 max_int64_value     = 5;
-    optional float  min_float_value     = 6;
-    optional float  max_float_value     = 7;
-}
-
-message VehiclePropConfig {
-    required int32             prop                = 1;
-    optional int32             access              = 2;
-    optional int32             change_mode         = 3;
-    optional int32             value_type          = 4;
-    optional int32             supported_areas     = 5;     // Deprecated - DO NOT USE
-    repeated VehicleAreaConfig area_configs        = 6;
-    optional int32             config_flags        = 7;
-    repeated int32             config_array        = 8;
-    optional string            config_string       = 9;
-    optional float             min_sample_rate     = 10;
-    optional float             max_sample_rate     = 11;
-};
-
-message VehiclePropValue {
-    // common data
-    required int32  prop                = 1;
-    optional int32  value_type          = 2;
-    optional int64  timestamp           = 3;    // required for valid data from HAL, skipped for set
-    optional VehiclePropStatus  status  = 10;   // required for valid data from HAL, skipped for set
-
-    // values
-    optional int32  area_id             = 4;
-    repeated sint32 int32_values        = 5;    // this also covers boolean value.
-    repeated sint64 int64_values        = 6;
-    repeated float  float_values        = 7;
-    optional string string_value        = 8;
-    optional bytes  bytes_value         = 9;
-};
-
-// This structure is used to notify what values to get from the Vehicle HAL
-message VehiclePropGet {
-    required int32 prop                 = 1;
-    optional int32 area_id              = 2;
-};
-
-message EmulatorMessage {
-    required MsgType           msg_type       = 1;
-    optional Status            status         = 2; // Only for RESP messages
-    repeated VehiclePropGet    prop           = 3; // Provided for getConfig, getProperty commands
-    repeated VehiclePropConfig config         = 4;
-    repeated VehiclePropValue  value          = 5;
-    repeated string            debug_commands = 6; // Required for debug command
-    optional string            debug_result   = 7; // Required for debug RESP messages
-};
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
index cab184b..578d045 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/include/FakeVehicleHardware.h
@@ -23,7 +23,9 @@
 #include <IVehicleHardware.h>
 #include <VehicleHalTypes.h>
 #include <VehiclePropertyStore.h>
+#include <android-base/parseint.h>
 #include <android-base/result.h>
+#include <android-base/stringprintf.h>
 #include <android-base/thread_annotations.h>
 
 #include <map>
@@ -37,7 +39,7 @@
 namespace vehicle {
 namespace fake {
 
-class FakeVehicleHardware final : public IVehicleHardware {
+class FakeVehicleHardware : public IVehicleHardware {
   public:
     FakeVehicleHardware();
 
@@ -78,13 +80,21 @@
     void registerOnPropertySetErrorEvent(
             std::unique_ptr<const PropertySetErrorCallback> callback) override;
 
+  protected:
+    // mValuePool is also used in mServerSidePropStore.
+    const std::shared_ptr<VehiclePropValuePool> mValuePool;
+    const std::shared_ptr<VehiclePropertyStore> mServerSidePropStore;
+
+    ::android::base::Result<VehiclePropValuePool::RecyclableType> getValue(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
+
+    ::android::base::Result<void> setValue(
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value);
+
   private:
     // Expose private methods to unit test.
     friend class FakeVehicleHardwareTestHelper;
 
-    // mValuePool is also used in mServerSidePropStore.
-    const std::shared_ptr<VehiclePropValuePool> mValuePool;
-    const std::shared_ptr<VehiclePropertyStore> mServerSidePropStore;
     const std::unique_ptr<obd2frame::FakeObd2Frame> mFakeObd2Frame;
     const std::unique_ptr<FakeUserHal> mFakeUserHal;
     std::mutex mCallbackLock;
@@ -120,6 +130,35 @@
     ::android::base::Result<VehiclePropValuePool::RecyclableType> getUserHalProp(
             const ::aidl::android::hardware::automotive::vehicle::VehiclePropValue& value) const;
     bool isHvacPropAndHvacNotAvailable(int32_t propId);
+
+    std::string dumpAllProperties();
+    std::string dumpOnePropertyByConfig(
+            int rowNumber,
+            const ::aidl::android::hardware::automotive::vehicle::VehiclePropConfig& config);
+    std::string dumpOnePropertyById(int32_t propId, int32_t areaId);
+    std::string dumpHelp();
+    std::string dumpListProperties();
+    std::string dumpSpecificProperty(const std::vector<std::string>& options);
+    std::string dumpSetProperties(const std::vector<std::string>& options);
+
+    template <typename T>
+    ::android::base::Result<T> safelyParseInt(int index, const std::string& s) {
+        T out;
+        if (!::android::base::ParseInt(s, &out)) {
+            return ::android::base::Error() << ::android::base::StringPrintf(
+                           "non-integer argument at index %d: %s\n", index, s.c_str());
+        }
+        return out;
+    }
+    ::android::base::Result<float> safelyParseFloat(int index, const std::string& s);
+    std::vector<std::string> getOptionValues(const std::vector<std::string>& options,
+                                             size_t* index);
+    ::android::base::Result<::aidl::android::hardware::automotive::vehicle::VehiclePropValue>
+    parseSetPropOptions(const std::vector<std::string>& options);
+    ::android::base::Result<std::vector<uint8_t>> parseHexString(const std::string& s);
+
+    ::android::base::Result<void> checkArgumentsSize(const std::vector<std::string>& options,
+                                                     size_t minSize);
 };
 
 }  // namespace fake
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
index e75f0e7..097257e 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/src/FakeVehicleHardware.cpp
@@ -14,6 +14,9 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "FakeVehicleHardware"
+#define FAKE_VEHICLEHARDWARE_DEBUG false  // STOPSHIP if true.
+
 #include "FakeVehicleHardware.h"
 
 #include <DefaultConfig.h>
@@ -22,7 +25,9 @@
 #include <PropertyUtils.h>
 #include <VehicleHalTypes.h>
 #include <VehicleUtils.h>
+#include <android-base/parsedouble.h>
 #include <android-base/properties.h>
+#include <android-base/strings.h>
 #include <utils/Log.h>
 #include <utils/SystemClock.h>
 
@@ -56,12 +61,31 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyType;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 
+using ::android::base::EqualsIgnoreCase;
 using ::android::base::Error;
+using ::android::base::ParseFloat;
 using ::android::base::Result;
+using ::android::base::StartsWith;
+using ::android::base::StringPrintf;
 
 const char* VENDOR_OVERRIDE_DIR = "/vendor/etc/automotive/vhaloverride/";
 const char* OVERRIDE_PROPERTY = "persist.vendor.vhal_init_value_override";
 
+// A list of supported options for "--set" command.
+const std::unordered_set<std::string> SET_PROP_OPTIONS = {
+        // integer.
+        "-i",
+        // 64bit integer.
+        "-i64",
+        // float.
+        "-f",
+        // string.
+        "-s",
+        // bytes in hex format, e.g. 0xDEADBEEF.
+        "-b",
+        // Area id in integer.
+        "-a"};
+
 }  // namespace
 
 void FakeVehicleHardware::storePropInitialValue(const defaultconfig::ConfigDeclaration& config) {
@@ -381,44 +405,26 @@
 
 StatusCode FakeVehicleHardware::setValues(std::shared_ptr<const SetValuesCallback> callback,
                                           const std::vector<SetValueRequest>& requests) {
-    std::vector<VehiclePropValue> updatedValues;
     std::vector<SetValueResult> results;
     for (auto& request : requests) {
         const VehiclePropValue& value = request.value;
         int propId = value.prop;
 
-        ALOGD("Set value for property ID: %d", propId);
+        if (FAKE_VEHICLEHARDWARE_DEBUG) {
+            ALOGD("Set value for property ID: %d", propId);
+        }
 
         SetValueResult setValueResult;
         setValueResult.requestId = request.requestId;
-        setValueResult.status = StatusCode::OK;
 
-        bool isSpecialValue = false;
-        auto setSpecialValueResult = maybeSetSpecialValue(value, &isSpecialValue);
-
-        if (isSpecialValue) {
-            if (!setSpecialValueResult.ok()) {
-                ALOGE("failed to set special value for property ID: %d, error: %s, status: %d",
-                      propId, getErrorMsg(setSpecialValueResult).c_str(),
-                      getIntErrorCode(setSpecialValueResult));
-                setValueResult.status = getErrorCode(setSpecialValueResult);
-            }
-
-            // Special values are already handled.
-            results.push_back(std::move(setValueResult));
-            continue;
+        if (auto result = setValue(value); !result.ok()) {
+            ALOGE("failed to set value, error: %s, code: %d", getErrorMsg(result).c_str(),
+                  getIntErrorCode(result));
+            setValueResult.status = getErrorCode(result);
+        } else {
+            setValueResult.status = StatusCode::OK;
         }
 
-        auto updatedValue = mValuePool->obtain(value);
-        int64_t timestamp = elapsedRealtimeNano();
-        updatedValue->timestamp = timestamp;
-
-        auto writeResult = mServerSidePropStore->writeValue(std::move(updatedValue));
-        if (!writeResult.ok()) {
-            ALOGE("failed to write value into property store, error: %s, code: %d",
-                  getErrorMsg(writeResult).c_str(), getIntErrorCode(writeResult));
-            setValueResult.status = getErrorCode(writeResult);
-        }
         results.push_back(std::move(setValueResult));
     }
 
@@ -429,61 +435,378 @@
     return StatusCode::OK;
 }
 
+Result<void> FakeVehicleHardware::setValue(const VehiclePropValue& value) {
+    bool isSpecialValue = false;
+    auto setSpecialValueResult = maybeSetSpecialValue(value, &isSpecialValue);
+
+    if (isSpecialValue) {
+        if (!setSpecialValueResult.ok()) {
+            return Error(getIntErrorCode(setSpecialValueResult))
+                   << StringPrintf("failed to set special value for property ID: %d, error: %s",
+                                   value.prop, getErrorMsg(setSpecialValueResult).c_str());
+        }
+        return {};
+    }
+
+    auto updatedValue = mValuePool->obtain(value);
+    int64_t timestamp = elapsedRealtimeNano();
+    updatedValue->timestamp = timestamp;
+
+    auto writeResult = mServerSidePropStore->writeValue(std::move(updatedValue));
+    if (!writeResult.ok()) {
+        return Error(getIntErrorCode(writeResult))
+               << StringPrintf("failed to write value into property store, error: %s",
+                               getErrorMsg(writeResult).c_str());
+    }
+
+    return {};
+}
+
 StatusCode FakeVehicleHardware::getValues(std::shared_ptr<const GetValuesCallback> callback,
                                           const std::vector<GetValueRequest>& requests) const {
     std::vector<GetValueResult> results;
     for (auto& request : requests) {
         const VehiclePropValue& value = request.prop;
-        ALOGD("getValues(%d)", value.prop);
+
+        if (FAKE_VEHICLEHARDWARE_DEBUG) {
+            ALOGD("getValues(%d)", value.prop);
+        }
 
         GetValueResult getValueResult;
         getValueResult.requestId = request.requestId;
-        bool isSpecialValue = false;
 
-        auto result = maybeGetSpecialValue(value, &isSpecialValue);
-        if (isSpecialValue) {
-            if (!result.ok()) {
-                ALOGE("failed to get special value: %d, error: %s, code: %d", value.prop,
-                      getErrorMsg(result).c_str(), getIntErrorCode(result));
-                getValueResult.status = getErrorCode(result);
-            } else {
-                getValueResult.status = StatusCode::OK;
-                getValueResult.prop = *result.value();
-            }
-            results.push_back(std::move(getValueResult));
-            continue;
-        }
-
-        auto readResult = mServerSidePropStore->readValue(value);
-        if (!readResult.ok()) {
-            StatusCode errorCode = getErrorCode(readResult);
-            if (errorCode == StatusCode::NOT_AVAILABLE) {
-                ALOGW("%s", "value has not been set yet");
-            } else {
-                ALOGE("failed to get value, error: %s, code: %d", getErrorMsg(readResult).c_str(),
-                      toInt(errorCode));
-            }
-            getValueResult.status = errorCode;
+        auto result = getValue(value);
+        if (!result.ok()) {
+            ALOGE("failed to get value, error: %s, code: %d", getErrorMsg(result).c_str(),
+                  getIntErrorCode(result));
+            getValueResult.status = getErrorCode(result);
         } else {
             getValueResult.status = StatusCode::OK;
-            getValueResult.prop = *readResult.value();
+            getValueResult.prop = *result.value();
         }
         results.push_back(std::move(getValueResult));
     }
 
+    // In a real VHAL implementation, getValue would be async and we would call the callback after
+    // we actually received the values from vehicle bus. Here we are getting the result
+    // synchronously so we could call the callback here.
     (*callback)(std::move(results));
 
     return StatusCode::OK;
 }
 
-DumpResult FakeVehicleHardware::dump(const std::vector<std::string>&) {
+Result<VehiclePropValuePool::RecyclableType> FakeVehicleHardware::getValue(
+        const VehiclePropValue& value) const {
+    bool isSpecialValue = false;
+    auto result = maybeGetSpecialValue(value, &isSpecialValue);
+    if (isSpecialValue) {
+        if (!result.ok()) {
+            return Error(getIntErrorCode(result))
+                   << StringPrintf("failed to get special value: %d, error: %s", value.prop,
+                                   getErrorMsg(result).c_str());
+        } else {
+            return std::move(result);
+        }
+    }
+
+    auto readResult = mServerSidePropStore->readValue(value);
+    if (!readResult.ok()) {
+        StatusCode errorCode = getErrorCode(readResult);
+        if (errorCode == StatusCode::NOT_AVAILABLE) {
+            return Error(toInt(errorCode)) << "value has not been set yet";
+        } else {
+            return Error(toInt(errorCode))
+                   << "failed to get value, error: " << getErrorMsg(readResult);
+        }
+    }
+
+    return std::move(readResult);
+}
+
+DumpResult FakeVehicleHardware::dump(const std::vector<std::string>& options) {
     DumpResult result;
-    // TODO(b/201830716): Implement this.
+    result.callerShouldDumpState = false;
+    if (options.size() == 0) {
+        // We only want caller to dump default state when there is no options.
+        result.callerShouldDumpState = true;
+        result.buffer = dumpAllProperties();
+        return result;
+    }
+    std::string option = options[0];
+    if (EqualsIgnoreCase(option, "--help")) {
+        result.buffer = dumpHelp();
+        return result;
+    } else if (EqualsIgnoreCase(option, "--list")) {
+        result.buffer = dumpListProperties();
+    } else if (EqualsIgnoreCase(option, "--get")) {
+        result.buffer = dumpSpecificProperty(options);
+    } else if (EqualsIgnoreCase(option, "--set")) {
+        result.buffer = dumpSetProperties(options);
+    } else {
+        result.buffer = StringPrintf("Invalid option: %s\n", option.c_str());
+    }
     return result;
 }
 
+std::string FakeVehicleHardware::dumpHelp() {
+    return "Usage: \n\n"
+           "[no args]: dumps (id and value) all supported properties \n"
+           "--help: shows this help\n"
+           "--list: lists the ids of all supported properties\n"
+           "--get <PROP1> [PROP2] [PROPN]: dumps the value of specific properties \n"
+           "--set <PROP> [-i INT_VALUE [INT_VALUE ...]] [-i64 INT64_VALUE [INT64_VALUE ...]] "
+           "[-f FLOAT_VALUE [FLOAT_VALUE ...]] [-s STR_VALUE] "
+           "[-b BYTES_VALUE] [-a AREA_ID] : sets the value of property PROP. "
+           "Notice that the string, bytes and area value can be set just once, while the other can"
+           " have multiple values (so they're used in the respective array), "
+           "BYTES_VALUE is in the form of 0xXXXX, e.g. 0xdeadbeef.\n";
+}
+
+std::string FakeVehicleHardware::dumpAllProperties() {
+    auto configs = mServerSidePropStore->getAllConfigs();
+    if (configs.size() == 0) {
+        return "no properties to dump\n";
+    }
+    std::string msg = StringPrintf("dumping %zu properties\n", configs.size());
+    int rowNumber = 1;
+    for (const VehiclePropConfig& config : configs) {
+        msg += dumpOnePropertyByConfig(rowNumber++, config);
+    }
+    return msg;
+}
+
+std::string FakeVehicleHardware::dumpOnePropertyByConfig(int rowNumber,
+                                                         const VehiclePropConfig& config) {
+    size_t numberAreas = config.areaConfigs.size();
+    std::string msg = "";
+    if (numberAreas == 0) {
+        msg += StringPrintf("%d: ", rowNumber);
+        msg += dumpOnePropertyById(config.prop, /* areaId= */ 0);
+        return msg;
+    }
+    for (size_t j = 0; j < numberAreas; ++j) {
+        if (numberAreas > 1) {
+            msg += StringPrintf("%d-%zu: ", rowNumber, j);
+        } else {
+            msg += StringPrintf("%d: ", rowNumber);
+        }
+        msg += dumpOnePropertyById(config.prop, config.areaConfigs[j].areaId);
+    }
+    return msg;
+}
+
+std::string FakeVehicleHardware::dumpOnePropertyById(int32_t propId, int32_t areaId) {
+    VehiclePropValue value = {
+            .prop = propId,
+            .areaId = areaId,
+    };
+    bool isSpecialValue = false;
+    auto result = maybeGetSpecialValue(value, &isSpecialValue);
+    if (!isSpecialValue) {
+        result = mServerSidePropStore->readValue(value);
+    }
+    if (!result.ok()) {
+        return StringPrintf("failed to read property value: %d, error: %s, code: %d\n", propId,
+                            getErrorMsg(result).c_str(), getIntErrorCode(result));
+
+    } else {
+        return result.value()->toString() + "\n";
+    }
+}
+
+std::string FakeVehicleHardware::dumpListProperties() {
+    auto configs = mServerSidePropStore->getAllConfigs();
+    if (configs.size() == 0) {
+        return "no properties to list\n";
+    }
+    int rowNumber = 1;
+    std::string msg = StringPrintf("listing %zu properties\n", configs.size());
+    for (const auto& config : configs) {
+        msg += StringPrintf("%d: %d\n", rowNumber++, config.prop);
+    }
+    return msg;
+}
+
+Result<void> FakeVehicleHardware::checkArgumentsSize(const std::vector<std::string>& options,
+                                                     size_t minSize) {
+    size_t size = options.size();
+    if (size >= minSize) {
+        return {};
+    }
+    return Error() << StringPrintf("Invalid number of arguments: required at least %zu, got %zu\n",
+                                   minSize, size);
+}
+
+std::string FakeVehicleHardware::dumpSpecificProperty(const std::vector<std::string>& options) {
+    if (auto result = checkArgumentsSize(options, /*minSize=*/2); !result.ok()) {
+        return getErrorMsg(result);
+    }
+
+    // options[0] is the command itself...
+    int rowNumber = 1;
+    size_t size = options.size();
+    std::string msg = "";
+    for (size_t i = 1; i < size; ++i) {
+        auto propResult = safelyParseInt<int32_t>(i, options[i]);
+        if (!propResult.ok()) {
+            msg += getErrorMsg(propResult);
+            continue;
+        }
+        int32_t prop = propResult.value();
+        auto result = mServerSidePropStore->getConfig(prop);
+        if (!result.ok()) {
+            msg += StringPrintf("No property %d\n", prop);
+            continue;
+        }
+        msg += dumpOnePropertyByConfig(rowNumber++, *result.value());
+    }
+    return msg;
+}
+
+std::vector<std::string> FakeVehicleHardware::getOptionValues(
+        const std::vector<std::string>& options, size_t* index) {
+    std::vector<std::string> values;
+    while (*index < options.size()) {
+        std::string option = options[*index];
+        if (SET_PROP_OPTIONS.find(option) != SET_PROP_OPTIONS.end()) {
+            return std::move(values);
+        }
+        values.push_back(option);
+        (*index)++;
+    }
+    return std::move(values);
+}
+
+Result<VehiclePropValue> FakeVehicleHardware::parseSetPropOptions(
+        const std::vector<std::string>& options) {
+    // Options format:
+    // --set PROP [-f f1 f2...] [-i i1 i2...] [-i64 i1 i2...] [-s s1 s2...] [-b b1 b2...] [-a a]
+    size_t optionIndex = 1;
+    auto result = safelyParseInt<int32_t>(optionIndex, options[optionIndex]);
+    if (!result.ok()) {
+        return Error() << StringPrintf("Property value: \"%s\" is not a valid int: %s\n",
+                                       options[optionIndex].c_str(), getErrorMsg(result).c_str());
+    }
+    VehiclePropValue prop = {};
+    prop.prop = result.value();
+    prop.status = VehiclePropertyStatus::AVAILABLE;
+    optionIndex++;
+    std::unordered_set<std::string> parsedOptions;
+
+    while (optionIndex < options.size()) {
+        std::string type = options[optionIndex];
+        optionIndex++;
+        size_t currentIndex = optionIndex;
+        std::vector<std::string> values = getOptionValues(options, &optionIndex);
+        if (parsedOptions.find(type) != parsedOptions.end()) {
+            return Error() << StringPrintf("Duplicate \"%s\" options\n", type.c_str());
+        }
+        parsedOptions.insert(type);
+        if (EqualsIgnoreCase(type, "-i")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-i\"\n";
+            }
+            prop.value.int32Values.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto int32Result = safelyParseInt<int32_t>(currentIndex + i, values[i]);
+                if (!int32Result.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid int: %s\n",
+                                           values[i].c_str(), getErrorMsg(int32Result).c_str());
+                }
+                prop.value.int32Values[i] = int32Result.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-i64")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-i64\"\n";
+            }
+            prop.value.int64Values.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto int64Result = safelyParseInt<int64_t>(currentIndex + i, values[i]);
+                if (!int64Result.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid int64: %s\n",
+                                           values[i].c_str(), getErrorMsg(int64Result).c_str());
+                }
+                prop.value.int64Values[i] = int64Result.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-f")) {
+            if (values.size() == 0) {
+                return Error() << "No values specified when using \"-f\"\n";
+            }
+            prop.value.floatValues.resize(values.size());
+            for (size_t i = 0; i < values.size(); i++) {
+                auto floatResult = safelyParseFloat(currentIndex + i, values[i]);
+                if (!floatResult.ok()) {
+                    return Error()
+                           << StringPrintf("Value: \"%s\" is not a valid float: %s\n",
+                                           values[i].c_str(), getErrorMsg(floatResult).c_str());
+                }
+                prop.value.floatValues[i] = floatResult.value();
+            }
+        } else if (EqualsIgnoreCase(type, "-s")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-s\"\n";
+            }
+            prop.value.stringValue = values[0];
+        } else if (EqualsIgnoreCase(type, "-b")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-b\"\n";
+            }
+            auto bytesResult = parseHexString(values[0]);
+            if (!bytesResult.ok()) {
+                return Error() << StringPrintf("value: \"%s\" is not a valid hex string: %s\n",
+                                               values[0].c_str(), getErrorMsg(bytesResult).c_str());
+            }
+            prop.value.byteValues = std::move(bytesResult.value());
+        } else if (EqualsIgnoreCase(type, "-a")) {
+            if (values.size() != 1) {
+                return Error() << "Expect exact one value when using \"-a\"\n";
+            }
+            auto int32Result = safelyParseInt<int32_t>(currentIndex, values[0]);
+            if (!int32Result.ok()) {
+                return Error() << StringPrintf("Area ID: \"%s\" is not a valid int: %s\n",
+                                               values[0].c_str(), getErrorMsg(int32Result).c_str());
+            }
+            prop.areaId = int32Result.value();
+        } else {
+            return Error() << StringPrintf("Unknown option: %s\n", type.c_str());
+        }
+    }
+
+    return prop;
+}
+
+std::string FakeVehicleHardware::dumpSetProperties(const std::vector<std::string>& options) {
+    if (auto result = checkArgumentsSize(options, 3); !result.ok()) {
+        return getErrorMsg(result);
+    }
+
+    auto parseResult = parseSetPropOptions(options);
+    if (!parseResult.ok()) {
+        return getErrorMsg(parseResult);
+    }
+    VehiclePropValue prop = std::move(parseResult.value());
+    ALOGD("Dump: Setting property: %s", prop.toString().c_str());
+
+    bool isSpecialValue = false;
+    auto setResult = maybeSetSpecialValue(prop, &isSpecialValue);
+
+    if (!isSpecialValue) {
+        auto updatedValue = mValuePool->obtain(prop);
+        updatedValue->timestamp = elapsedRealtimeNano();
+        setResult = mServerSidePropStore->writeValue(std::move(updatedValue));
+    }
+
+    if (setResult.ok()) {
+        return StringPrintf("Set property: %s\n", prop.toString().c_str());
+    }
+    return StringPrintf("failed to set property: %s, error: %s\n", prop.toString().c_str(),
+                        getErrorMsg(setResult).c_str());
+}
+
 StatusCode FakeVehicleHardware::checkHealth() {
-    // TODO(b/201830716): Implement this.
+    // Always return OK for checkHealth.
     return StatusCode::OK;
 }
 
@@ -544,6 +867,49 @@
     }
 }
 
+Result<float> FakeVehicleHardware::safelyParseFloat(int index, const std::string& s) {
+    float out;
+    if (!ParseFloat(s, &out)) {
+        return Error() << StringPrintf("non-float argument at index %d: %s\n", index, s.c_str());
+    }
+    return out;
+}
+
+Result<std::vector<uint8_t>> FakeVehicleHardware::parseHexString(const std::string& s) {
+    std::vector<uint8_t> bytes;
+    if (s.size() % 2 != 0) {
+        return Error() << StringPrintf("invalid hex string: %s, should have even size\n",
+                                       s.c_str());
+    }
+    if (!StartsWith(s, "0x")) {
+        return Error() << StringPrintf("hex string should start with \"0x\", got %s\n", s.c_str());
+    }
+    std::string subs = s.substr(2);
+    std::transform(subs.begin(), subs.end(), subs.begin(),
+                   [](unsigned char c) { return std::tolower(c); });
+
+    bool highDigit = true;
+    for (size_t i = 0; i < subs.size(); i++) {
+        char c = subs[i];
+        uint8_t v;
+        if (c >= '0' && c <= '9') {
+            v = c - '0';
+        } else if (c >= 'a' && c <= 'f') {
+            v = c - 'a' + 10;
+        } else {
+            return Error() << StringPrintf("invalid character %c in hex string %s\n", c,
+                                           subs.c_str());
+        }
+        if (highDigit) {
+            bytes.push_back(v * 16);
+        } else {
+            bytes[bytes.size() - 1] += v;
+        }
+        highDigit = !highDigit;
+    }
+    return bytes;
+}
+
 }  // namespace fake
 }  // namespace vehicle
 }  // namespace automotive
diff --git a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
index 970d044..0812c2a 100644
--- a/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
+++ b/automotive/vehicle/aidl/impl/fake_impl/hardware/test/FakeVehicleHardwareTest.cpp
@@ -24,6 +24,7 @@
 
 #include <android-base/expected.h>
 #include <android-base/file.h>
+#include <android-base/stringprintf.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
 #include <utils/Log.h>
@@ -52,13 +53,16 @@
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropertyStatus;
 using ::aidl::android::hardware::automotive::vehicle::VehiclePropValue;
 using ::android::base::expected;
+using ::android::base::StringPrintf;
 using ::android::base::unexpected;
 using ::testing::ContainerEq;
+using ::testing::ContainsRegex;
 using ::testing::Eq;
 using ::testing::IsSubsetOf;
 using ::testing::WhenSortedBy;
 
 constexpr int INVALID_PROP_ID = 0;
+constexpr char CAR_MAKE[] = "Default Car";
 
 }  // namespace
 
@@ -1203,6 +1207,261 @@
                          }));
 }
 
+TEST_F(FakeVehicleHardwareTest, testDumpAllProperties) {
+    std::vector<std::string> options;
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_TRUE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("dumping .+ properties"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpHelp) {
+    std::vector<std::string> options;
+    options.push_back("--help");
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Usage: "));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpListProperties) {
+    std::vector<std::string> options;
+    options.push_back("--list");
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("listing .+ properties"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificProperties) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+    std::string prop1 = std::to_string(toInt(VehicleProperty::INFO_FUEL_CAPACITY));
+    std::string prop2 = std::to_string(toInt(VehicleProperty::TIRE_PRESSURE));
+    options.push_back(prop1);
+    options.push_back(prop2);
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer,
+                ContainsRegex(StringPrintf("1:.*prop: %s.*\n2-0:.*prop: %s.*\n2-1:.*prop: %s.*\n",
+                                           prop1.c_str(), prop2.c_str(), prop2.c_str())));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificPropertiesInvalidProp) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+    std::string prop1 = std::to_string(toInt(VehicleProperty::INFO_FUEL_CAPACITY));
+    std::string prop2 = std::to_string(INVALID_PROP_ID);
+    options.push_back(prop1);
+    options.push_back(prop2);
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex(StringPrintf("1:.*prop: %s.*\nNo property %d\n",
+                                                          prop1.c_str(), INVALID_PROP_ID)));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpSpecificPropertiesNoArg) {
+    std::vector<std::string> options;
+    options.push_back("--get");
+
+    // No arguments.
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Invalid number of arguments"));
+}
+
+TEST_F(FakeVehicleHardwareTest, testDumpInvalidOptions) {
+    std::vector<std::string> options;
+    options.push_back("--invalid");
+
+    DumpResult result = getHardware()->dump(options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    ASSERT_THAT(result.buffer, ContainsRegex("Invalid option: --invalid"));
+}
+
+struct SetPropTestCase {
+    std::string test_name;
+    std::vector<std::string> options;
+    bool success;
+    std::string errorMsg = "";
+};
+
+class FakeVehicleHardwareSetPropTest : public FakeVehicleHardwareTest,
+                                       public testing::WithParamInterface<SetPropTestCase> {};
+
+TEST_P(FakeVehicleHardwareSetPropTest, cmdSetOneProperty) {
+    const SetPropTestCase& tc = GetParam();
+
+    DumpResult result = getHardware()->dump(tc.options);
+    ASSERT_FALSE(result.callerShouldDumpState);
+    ASSERT_NE(result.buffer, "");
+    if (tc.success) {
+        ASSERT_THAT(result.buffer, ContainsRegex("Set property:"));
+    } else {
+        ASSERT_THAT(result.buffer, ContainsRegex(tc.errorMsg));
+    }
+}
+
+std::vector<SetPropTestCase> GenSetPropParams() {
+    std::string infoMakeProperty = std::to_string(toInt(VehicleProperty::INFO_MAKE));
+    return {
+            {"success_set_string", {"--set", infoMakeProperty, "-s", CAR_MAKE}, true},
+            {"success_set_bytes", {"--set", infoMakeProperty, "-b", "0xdeadbeef"}, true},
+            {"success_set_bytes_caps", {"--set", infoMakeProperty, "-b", "0xDEADBEEF"}, true},
+            {"success_set_int", {"--set", infoMakeProperty, "-i", "2147483647"}, true},
+            {"success_set_ints",
+             {"--set", infoMakeProperty, "-i", "2147483647", "0", "-2147483648"},
+             true},
+            {"success_set_int64",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775808"},
+             true},
+            {"success_set_int64s",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775808", "0",
+              "9223372036854775807"},
+             true},
+            {"success_set_float", {"--set", infoMakeProperty, "-f", "1.175494351E-38"}, true},
+            {"success_set_floats",
+             {"--set", infoMakeProperty, "-f", "-3.402823466E+38", "0", "3.402823466E+38"},
+             true},
+            {"success_set_area", {"--set", infoMakeProperty, "-a", "2147483647"}, true},
+            {"fail_no_options", {"--set", infoMakeProperty}, false, "Invalid number of arguments"},
+            {"fail_less_than_4_options",
+             {"--set", infoMakeProperty, "-i"},
+             false,
+             "No values specified"},
+            {"fail_unknown_options", {"--set", infoMakeProperty, "-abcd"}, false, "Unknown option"},
+            {"fail_invalid_property",
+             {"--set", "not valid", "-s", CAR_MAKE},
+             false,
+             "not a valid int"},
+            {"fail_duplicate_string",
+             {"--set", infoMakeProperty, "-s", CAR_MAKE, "-s", CAR_MAKE},
+             false,
+             "Duplicate \"-s\" options"},
+            {"fail_multiple_strings",
+             {"--set", infoMakeProperty, "-s", CAR_MAKE, CAR_MAKE},
+             false,
+             "Expect exact one value"},
+            {"fail_no_string_value",
+             {"--set", infoMakeProperty, "-s", "-a", "1234"},
+             false,
+             "Expect exact one value"},
+            {"fail_duplicate_bytes",
+             {"--set", infoMakeProperty, "-b", "0xdeadbeef", "-b", "0xdeadbeef"},
+             false,
+             "Duplicate \"-b\" options"},
+            {"fail_multiple_bytes",
+             {"--set", infoMakeProperty, "-b", "0xdeadbeef", "0xdeadbeef"},
+             false,
+             "Expect exact one value"},
+            {"fail_invalid_bytes",
+             {"--set", infoMakeProperty, "-b", "0xgood"},
+             false,
+             "not a valid hex string"},
+            {"fail_invalid_bytes_no_prefix",
+             {"--set", infoMakeProperty, "-b", "deadbeef"},
+             false,
+             "not a valid hex string"},
+            {"fail_invalid_int",
+             {"--set", infoMakeProperty, "-i", "abc"},
+             false,
+             "not a valid int"},
+            {"fail_int_out_of_range",
+             {"--set", infoMakeProperty, "-i", "2147483648"},
+             false,
+             "not a valid int"},
+            {"fail_no_int_value",
+             {"--set", infoMakeProperty, "-i", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_invalid_int64",
+             {"--set", infoMakeProperty, "-i64", "abc"},
+             false,
+             "not a valid int64"},
+            {"fail_int64_out_of_range",
+             {"--set", infoMakeProperty, "-i64", "-9223372036854775809"},
+             false,
+             "not a valid int64"},
+            {"fail_no_int64_value",
+             {"--set", infoMakeProperty, "-i64", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_invalid_float",
+             {"--set", infoMakeProperty, "-f", "abc"},
+             false,
+             "not a valid float"},
+            {"fail_float_out_of_range",
+             {"--set", infoMakeProperty, "-f", "-3.402823466E+39"},
+             false,
+             "not a valid float"},
+            {"fail_no_float_value",
+             {"--set", infoMakeProperty, "-f", "-s", CAR_MAKE},
+             false,
+             "No values specified"},
+            {"fail_multiple_areas",
+             {"--set", infoMakeProperty, "-a", "2147483648", "0"},
+             false,
+             "Expect exact one value"},
+            {"fail_invalid_area",
+             {"--set", infoMakeProperty, "-a", "abc"},
+             false,
+             "not a valid int"},
+            {"fail_area_out_of_range",
+             {"--set", infoMakeProperty, "-a", "2147483648"},
+             false,
+             "not a valid int"},
+            {"fail_no_area_value",
+             {"--set", infoMakeProperty, "-a", "-s", CAR_MAKE},
+             false,
+             "Expect exact one value"},
+    };
+}
+
+INSTANTIATE_TEST_SUITE_P(
+        FakeVehicleHardwareSetPropTests, FakeVehicleHardwareSetPropTest,
+        testing::ValuesIn(GenSetPropParams()),
+        [](const testing::TestParamInfo<FakeVehicleHardwareSetPropTest::ParamType>& info) {
+            return info.param.test_name;
+        });
+
+TEST_F(FakeVehicleHardwareTest, SetComplexPropTest) {
+    std::string infoMakeProperty = std::to_string(toInt(VehicleProperty::INFO_MAKE));
+    getHardware()->dump({"--set", infoMakeProperty,      "-s",   CAR_MAKE,
+                         "-b",    "0xdeadbeef",          "-i",   "2147483647",
+                         "0",     "-2147483648",         "-i64", "-9223372036854775808",
+                         "0",     "9223372036854775807", "-f",   "-3.402823466E+38",
+                         "0",     "3.402823466E+38",     "-a",   "123"});
+    VehiclePropValue requestProp;
+    requestProp.prop = toInt(VehicleProperty::INFO_MAKE);
+    requestProp.areaId = 123;
+    auto result = getValue(requestProp);
+    ASSERT_TRUE(result.ok());
+    VehiclePropValue value = result.value();
+    ASSERT_EQ(value.prop, toInt(VehicleProperty::INFO_MAKE));
+    ASSERT_EQ(value.areaId, 123);
+    ASSERT_STREQ(CAR_MAKE, value.value.stringValue.c_str());
+    uint8_t bytes[] = {0xde, 0xad, 0xbe, 0xef};
+    ASSERT_FALSE(memcmp(bytes, value.value.byteValues.data(), sizeof(bytes)));
+    ASSERT_EQ(3u, value.value.int32Values.size());
+    ASSERT_EQ(2147483647, value.value.int32Values[0]);
+    ASSERT_EQ(0, value.value.int32Values[1]);
+    ASSERT_EQ(-2147483648, value.value.int32Values[2]);
+    ASSERT_EQ(3u, value.value.int64Values.size());
+    // -9223372036854775808 is not a valid literal since '-' and '9223372036854775808' would be two
+    // tokens and the later does not fit in unsigned long long.
+    ASSERT_EQ(-9223372036854775807 - 1, value.value.int64Values[0]);
+    ASSERT_EQ(0, value.value.int64Values[1]);
+    ASSERT_EQ(9223372036854775807, value.value.int64Values[2]);
+    ASSERT_EQ(3u, value.value.floatValues.size());
+    ASSERT_EQ(-3.402823466E+38f, value.value.floatValues[0]);
+    ASSERT_EQ(0.0f, value.value.floatValues[1]);
+    ASSERT_EQ(3.402823466E+38f, value.value.floatValues[2]);
+}
+
 }  // namespace fake
 }  // namespace vehicle
 }  // namespace automotive
diff --git a/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h b/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
index 833707a..15a6278 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/ConnectedClient.h
@@ -79,7 +79,7 @@
     GetSetValuesClient(std::shared_ptr<PendingRequestPool> requestPool, CallbackType callback);
 
     // Sends the results to this client.
-    void sendResults(const std::vector<ResultType>& results);
+    void sendResults(std::vector<ResultType>&& results);
 
     // Sends each result separately to this client. Each result would be sent through one callback
     // invocation.
diff --git a/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h b/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
index 62b2627..5e7adfc 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/DefaultVehicleHal.h
@@ -39,13 +39,6 @@
 namespace automotive {
 namespace vehicle {
 
-// private namespace
-namespace defaultvehiclehal_impl {
-
-constexpr int INVALID_MEMORY_FD = -1;
-
-}  // namespace defaultvehiclehal_impl
-
 class DefaultVehicleHal final : public ::aidl::android::hardware::automotive::vehicle::BnVehicle {
   public:
     using CallbackType =
@@ -79,6 +72,7 @@
                                      const std::vector<int32_t>& propIds) override;
     ::ndk::ScopedAStatus returnSharedMemory(const CallbackType& callback,
                                             int64_t sharedMemoryId) override;
+    binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
 
     IVehicleHardware* getHardware();
 
@@ -215,6 +209,8 @@
 
     void monitorBinderLifeCycle(const CallbackType& callback);
 
+    bool checkDumpPermission();
+
     template <class T>
     static std::shared_ptr<T> getOrCreateClient(
             std::unordered_map<const AIBinder*, std::shared_ptr<T>>* clients,
diff --git a/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h b/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h
index 4b7c2f3..7b2111b 100644
--- a/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h
+++ b/automotive/vehicle/aidl/impl/vhal/include/ParcelableUtils.h
@@ -29,6 +29,9 @@
 namespace automotive {
 namespace vehicle {
 
+// Turns the values into a stable large parcelable that could be sent via binder.
+// If values is small enough, it would be put into output.payloads, otherwise a shared memory file
+// would be created and output.sharedMemoryFd would be filled in.
 template <class T1, class T2>
 ::ndk::ScopedAStatus vectorToStableLargeParcelable(std::vector<T1>&& values, T2* output) {
     output->payloads = std::move(values);
@@ -44,6 +47,9 @@
         // 'sharedMemoryFd' field.
         output->payloads.clear();
         output->sharedMemoryFd = std::move(*fd);
+    } else {
+        output->sharedMemoryFd = ::ndk::ScopedFileDescriptor();
+        // Do not modify payloads.
     }
     return ::ndk::ScopedAStatus::ok();
 }
diff --git a/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp b/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
index 5ccef55..098bfee 100644
--- a/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/src/ConnectedClient.cpp
@@ -84,9 +84,9 @@
 // Send all the GetValue/SetValue results through callback in a single callback invocation.
 template <class ResultType, class ResultsType>
 void sendGetOrSetValueResults(std::shared_ptr<IVehicleCallback> callback,
-                              const std::vector<ResultType>& results) {
+                              std::vector<ResultType>&& results) {
     ResultsType parcelableResults;
-    ScopedAStatus status = vectorToStableLargeParcelable(results, &parcelableResults);
+    ScopedAStatus status = vectorToStableLargeParcelable(std::move(results), &parcelableResults);
     if (status.isOk()) {
         if (ScopedAStatus callbackStatus = callCallback(callback, parcelableResults);
             !callbackStatus.isOk()) {
@@ -99,7 +99,8 @@
     ALOGE("failed to marshal result into large parcelable, error: "
           "%s, code: %d",
           status.getMessage(), statusCode);
-    sendGetOrSetValueResultsSeparately<ResultType, ResultsType>(callback, results);
+    sendGetOrSetValueResultsSeparately<ResultType, ResultsType>(callback,
+                                                                parcelableResults.payloads);
 }
 
 // The timeout callback for GetValues/SetValues.
@@ -115,7 +116,7 @@
                 .status = StatusCode::TRY_AGAIN,
         });
     }
-    sendGetOrSetValueResults<ResultType, ResultsType>(callback, timeoutResults);
+    sendGetOrSetValueResults<ResultType, ResultsType>(callback, std::move(timeoutResults));
 }
 
 // The on-results callback for GetValues/SetValues.
@@ -123,7 +124,7 @@
 void getOrSetValuesCallback(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<ResultType> results, std::shared_ptr<PendingRequestPool> requestPool) {
+        std::vector<ResultType>&& results, std::shared_ptr<PendingRequestPool> requestPool) {
     std::unordered_set<int64_t> requestIds;
     for (const auto& result : results) {
         requestIds.insert(result.requestId);
@@ -145,7 +146,7 @@
     }
 
     if (!results.empty()) {
-        sendGetOrSetValueResults<ResultType, ResultsType>(callback, results);
+        sendGetOrSetValueResults<ResultType, ResultsType>(callback, std::move(results));
     }
 }
 
@@ -156,9 +157,9 @@
         std::shared_ptr<IVehicleCallback> callback, const SetValueResult& result);
 
 template void sendGetOrSetValueResults<GetValueResult, GetValueResults>(
-        std::shared_ptr<IVehicleCallback> callback, const std::vector<GetValueResult>& results);
+        std::shared_ptr<IVehicleCallback> callback, std::vector<GetValueResult>&& results);
 template void sendGetOrSetValueResults<SetValueResult, SetValueResults>(
-        std::shared_ptr<IVehicleCallback> callback, const std::vector<SetValueResult>& results);
+        std::shared_ptr<IVehicleCallback> callback, std::vector<SetValueResult>&& results);
 
 template void sendGetOrSetValueResultsSeparately<GetValueResult, GetValueResults>(
         std::shared_ptr<IVehicleCallback> callback, const std::vector<GetValueResult>& results);
@@ -175,11 +176,11 @@
 template void getOrSetValuesCallback<GetValueResult, GetValueResults>(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<GetValueResult> results, std::shared_ptr<PendingRequestPool> requestPool);
+        std::vector<GetValueResult>&& results, std::shared_ptr<PendingRequestPool> requestPool);
 template void getOrSetValuesCallback<SetValueResult, SetValueResults>(
         const void* clientId,
         std::shared_ptr<::aidl::android::hardware::automotive::vehicle::IVehicleCallback> callback,
-        std::vector<SetValueResult> results, std::shared_ptr<PendingRequestPool> requestPool);
+        std::vector<SetValueResult>&& results, std::shared_ptr<PendingRequestPool> requestPool);
 
 }  // namespace
 
@@ -230,9 +231,8 @@
 }
 
 template <class ResultType, class ResultsType>
-void GetSetValuesClient<ResultType, ResultsType>::sendResults(
-        const std::vector<ResultType>& results) {
-    return sendGetOrSetValueResults<ResultType, ResultsType>(mCallback, results);
+void GetSetValuesClient<ResultType, ResultsType>::sendResults(std::vector<ResultType>&& results) {
+    return sendGetOrSetValueResults<ResultType, ResultsType>(mCallback, std::move(results));
 }
 
 template <class ResultType, class ResultsType>
@@ -283,7 +283,8 @@
     // TODO(b/205189110): Use memory pool here and fill in sharedMemoryId.
     VehiclePropValues vehiclePropValues;
     int32_t sharedMemoryFileCount = 0;
-    ScopedAStatus status = vectorToStableLargeParcelable(updatedValues, &vehiclePropValues);
+    ScopedAStatus status =
+            vectorToStableLargeParcelable(std::move(updatedValues), &vehiclePropValues);
     if (!status.isOk()) {
         int statusCode = status.getServiceSpecificError();
         ALOGE("subscribe: failed to marshal result into large parcelable, error: "
diff --git a/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp b/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
index 3e088c5..c0a66da 100644
--- a/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/src/DefaultVehicleHal.cpp
@@ -24,6 +24,8 @@
 
 #include <android-base/result.h>
 #include <android-base/stringprintf.h>
+#include <android/binder_ibinder.h>
+#include <private/android_filesystem_config.h>
 #include <utils/Log.h>
 #include <utils/SystemClock.h>
 
@@ -387,7 +389,7 @@
 
     if (!failedResults.empty()) {
         // First send the failed results we already know back to the client.
-        client->sendResults(failedResults);
+        client->sendResults(std::move(failedResults));
     }
 
     if (hardwareRequests.empty()) {
@@ -476,7 +478,7 @@
 
     if (!failedResults.empty()) {
         // First send the failed results we already know back to the client.
-        client->sendResults(failedResults);
+        client->sendResults(std::move(failedResults));
     }
 
     if (hardwareRequests.empty()) {
@@ -718,6 +720,39 @@
     mLinkToDeathImpl = std::move(impl);
 }
 
+bool DefaultVehicleHal::checkDumpPermission() {
+    uid_t uid = AIBinder_getCallingUid();
+    return uid == AID_ROOT || uid == AID_SHELL || uid == AID_SYSTEM;
+}
+
+binder_status_t DefaultVehicleHal::dump(int fd, const char** args, uint32_t numArgs) {
+    if (!checkDumpPermission()) {
+        dprintf(fd, "Caller must be root, system or shell");
+        return STATUS_PERMISSION_DENIED;
+    }
+
+    std::vector<std::string> options;
+    for (uint32_t i = 0; i < numArgs; i++) {
+        options.push_back(args[i]);
+    }
+    DumpResult result = mVehicleHardware->dump(options);
+    dprintf(fd, "%s", (result.buffer + "\n").c_str());
+    if (!result.callerShouldDumpState) {
+        dprintf(fd, "Skip dumping Vehicle HAL State.\n");
+        return STATUS_OK;
+    }
+    dprintf(fd, "Vehicle HAL State: \n");
+    {
+        std::scoped_lock<std::mutex> lockGuard(mLock);
+        dprintf(fd, "Containing %zu property configs\n", mConfigsByPropId.size());
+        dprintf(fd, "Currently have %zu getValues clients\n", mGetValuesClients.size());
+        dprintf(fd, "Currently have %zu setValues clients\n", mSetValuesClients.size());
+        dprintf(fd, "Currently have %zu subscription clients\n",
+                mSubscriptionClients->countClients());
+    }
+    return STATUS_OK;
+}
+
 }  // namespace vehicle
 }  // namespace automotive
 }  // namespace hardware
diff --git a/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp b/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
index bd4a565..bdb0d31 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/ConnectedClientTest.cpp
@@ -80,7 +80,8 @@
 
     GetValuesClient client(getPool(), getCallbackClient());
 
-    client.sendResults(results);
+    auto resultsCopy = results;
+    client.sendResults(std::move(resultsCopy));
 
     auto maybeGetValueResults = getCallback()->nextGetValueResults();
     ASSERT_TRUE(maybeGetValueResults.has_value());
@@ -160,7 +161,8 @@
 
     SetValuesClient client(getPool(), getCallbackClient());
 
-    client.sendResults(results);
+    auto resultsCopy = results;
+    client.sendResults(std::move(resultsCopy));
 
     auto maybeSetValueResults = getCallback()->nextSetValueResults();
     ASSERT_TRUE(maybeSetValueResults.has_value());
diff --git a/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp b/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
index ff355c3..7443d5b 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/DefaultVehicleHalTest.cpp
@@ -27,6 +27,7 @@
 #include <android-base/thread_annotations.h>
 #include <gmock/gmock.h>
 #include <gtest/gtest.h>
+#include <sys/mman.h>
 #include <utils/Log.h>
 #include <utils/SystemClock.h>
 
@@ -75,6 +76,7 @@
 using ::ndk::ScopedFileDescriptor;
 using ::ndk::SpAIBinder;
 
+using ::testing::ContainsRegex;
 using ::testing::Eq;
 using ::testing::UnorderedElementsAre;
 using ::testing::UnorderedElementsAreArray;
@@ -371,7 +373,7 @@
         return mVhal->mOnBinderDiedContexts[clientId].get();
     }
 
-    bool countOnBinderDiedContexts() {
+    size_t countOnBinderDiedContexts() {
         std::scoped_lock<std::mutex> lockGuard(mVhal->mLock);
         return mVhal->mOnBinderDiedContexts.size();
     }
@@ -444,6 +446,7 @@
         if (result.value() != nullptr) {
             requests.payloads.clear();
             requests.sharedMemoryFd = std::move(*result.value());
+            requests.payloads.clear();
         }
         return {};
     }
@@ -1544,6 +1547,45 @@
             << "expect OnBinderDied context to be deleted when binder is unlinked";
 }
 
+TEST_F(DefaultVehicleHalTest, testDumpCallerShouldDump) {
+    std::string buffer = "Dump from hardware";
+    getHardware()->setDumpResult({
+            .callerShouldDumpState = true,
+            .buffer = buffer,
+    });
+    int fd = memfd_create("memfile", 0);
+    getClient()->dump(fd, nullptr, 0);
+
+    lseek(fd, 0, SEEK_SET);
+    char buf[10240] = {};
+    read(fd, buf, sizeof(buf));
+    close(fd);
+
+    std::string msg(buf);
+
+    ASSERT_THAT(msg, ContainsRegex(buffer + "\nVehicle HAL State: \n"));
+}
+
+TEST_F(DefaultVehicleHalTest, testDumpCallerShouldNotDump) {
+    std::string buffer = "Dump from hardware";
+    getHardware()->setDumpResult({
+            .callerShouldDumpState = false,
+            .buffer = buffer,
+    });
+    int fd = memfd_create("memfile", 0);
+    getClient()->dump(fd, nullptr, 0);
+
+    lseek(fd, 0, SEEK_SET);
+    char buf[10240] = {};
+    read(fd, buf, sizeof(buf));
+    close(fd);
+
+    std::string msg(buf);
+
+    ASSERT_THAT(msg, ContainsRegex(buffer));
+    ASSERT_EQ(msg.find("Vehicle HAL State: "), std::string::npos);
+}
+
 }  // namespace vehicle
 }  // namespace automotive
 }  // namespace hardware
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp
index eec32dd..66aef7c 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.cpp
@@ -71,13 +71,15 @@
                                 &mGetValueResponses);
 }
 
+void MockVehicleHardware::setDumpResult(DumpResult result) {
+    mDumpResult = result;
+}
+
 DumpResult MockVehicleHardware::dump(const std::vector<std::string>&) {
-    // TODO(b/200737967): mock this.
-    return DumpResult{};
+    return mDumpResult;
 }
 
 StatusCode MockVehicleHardware::checkHealth() {
-    // TODO(b/200737967): mock this.
     return StatusCode::OK;
 }
 
diff --git a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h
index 0844de1..74d4fae 100644
--- a/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h
+++ b/automotive/vehicle/aidl/impl/vhal/test/MockVehicleHardware.h
@@ -79,6 +79,7 @@
     void setStatus(const char* functionName,
                    ::aidl::android::hardware::automotive::vehicle::StatusCode status);
     void setSleepTime(int64_t timeInNano);
+    void setDumpResult(DumpResult result);
 
   private:
     mutable std::mutex mLock;
@@ -114,6 +115,8 @@
             const std::vector<RequestType>& requests,
             std::list<std::vector<RequestType>>* storedRequests,
             std::list<std::vector<ResultType>>* storedResponses) const REQUIRES(mLock);
+
+    DumpResult mDumpResult;
 };
 
 }  // namespace vehicle
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp b/automotive/vehicle/proto/Android.bp
similarity index 94%
rename from automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp
rename to automotive/vehicle/proto/Android.bp
index 3307bd6..683f128 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/proto/Android.bp
+++ b/automotive/vehicle/proto/Android.bp
@@ -25,8 +25,8 @@
 cc_library_static {
     name: "android.hardware.automotive.vehicle@2.0-libproto-native",
     visibility: [
-        "//hardware/interfaces/automotive/vehicle/2.0/default:__subpackages__",
-        "//device/generic/car/emulator/vhal_v2_0:__subpackages__",
+        "//hardware/interfaces/automotive/vehicle:__subpackages__",
+        "//device/generic/car/emulator:__subpackages__",
     ],
     vendor: true,
     host_supported: true,
diff --git a/automotive/vehicle/proto/VehicleHalProto.proto b/automotive/vehicle/proto/VehicleHalProto.proto
new file mode 100644
index 0000000..0dafe8c
--- /dev/null
+++ b/automotive/vehicle/proto/VehicleHalProto.proto
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto2";
+
+package vhal_proto;
+
+// CMD messages are from workstation --> VHAL
+// RESP messages are from VHAL --> workstation
+enum MsgType {
+    GET_CONFIG_CMD = 0;
+    GET_CONFIG_RESP = 1;
+    GET_CONFIG_ALL_CMD = 2;
+    GET_CONFIG_ALL_RESP = 3;
+    GET_PROPERTY_CMD = 4;
+    GET_PROPERTY_RESP = 5;
+    GET_PROPERTY_ALL_CMD = 6;
+    GET_PROPERTY_ALL_RESP = 7;
+    SET_PROPERTY_CMD = 8;
+    SET_PROPERTY_RESP = 9;
+    SET_PROPERTY_ASYNC = 10;
+    DEBUG_CMD = 11;
+    DEBUG_RESP = 12;
+}
+enum Status {
+    RESULT_OK = 0;
+    ERROR_UNKNOWN = 1;
+    ERROR_UNIMPLEMENTED_CMD = 2;
+    ERROR_INVALID_PROPERTY = 3;
+    ERROR_INVALID_AREA_ID = 4;
+    ERROR_PROPERTY_UNINITIALIZED = 5;
+    ERROR_WRITE_ONLY_PROPERTY = 6;
+    ERROR_MEMORY_ALLOC_FAILED = 7;
+    ERROR_INVALID_OPERATION = 8;
+}
+
+enum VehiclePropStatus {
+    AVAILABLE = 0;
+    UNAVAILABLE = 1;
+    ERROR = 2;
+}
+
+message VehicleAreaConfig {
+    required int32 area_id = 1;
+    optional sint32 min_int32_value = 2;
+    optional sint32 max_int32_value = 3;
+    optional sint64 min_int64_value = 4;
+    optional sint64 max_int64_value = 5;
+    optional float min_float_value = 6;
+    optional float max_float_value = 7;
+}
+
+message VehiclePropConfig {
+    required int32 prop = 1;
+    optional int32 access = 2;
+    optional int32 change_mode = 3;
+    optional int32 value_type = 4;
+    optional int32 supported_areas = 5;  // Deprecated - DO NOT USE
+    repeated VehicleAreaConfig area_configs = 6;
+    optional int32 config_flags = 7;
+    repeated int32 config_array = 8;
+    optional string config_string = 9;
+    optional float min_sample_rate = 10;
+    optional float max_sample_rate = 11;
+};
+
+message VehiclePropValue {
+    // common data
+    required int32 prop = 1;
+    optional int32 value_type = 2;
+    optional int64 timestamp = 3;            // required for valid data from HAL, skipped for set
+    optional VehiclePropStatus status = 10;  // required for valid data from HAL, skipped for set
+
+    // values
+    optional int32 area_id = 4;
+    repeated sint32 int32_values = 5;  // this also covers boolean value.
+    repeated sint64 int64_values = 6;
+    repeated float float_values = 7;
+    optional string string_value = 8;
+    optional bytes bytes_value = 9;
+};
+
+// This structure is used to notify what values to get from the Vehicle HAL
+message VehiclePropGet {
+    required int32 prop = 1;
+    optional int32 area_id = 2;
+};
+
+message EmulatorMessage {
+    required MsgType msg_type = 1;
+    optional Status status = 2;        // Only for RESP messages
+    repeated VehiclePropGet prop = 3;  // Provided for getConfig, getProperty commands
+    repeated VehiclePropConfig config = 4;
+    repeated VehiclePropValue value = 5;
+    repeated string debug_commands = 6;  // Required for debug command
+    optional string debug_result = 7;    // Required for debug RESP messages
+};
diff --git a/bluetooth/audio/2.2/default/OWNERS b/bluetooth/audio/2.2/default/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/2.2/default/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
index e2a08a0..948c04a 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecCapabilities.aidl
@@ -37,11 +37,16 @@
   android.hardware.bluetooth.audio.CodecType codecType;
   android.hardware.bluetooth.audio.CodecCapabilities.Capabilities capabilities;
   @VintfStability
+  parcelable VendorCapabilities {
+    ParcelableHolder extension;
+  }
+  @VintfStability
   union Capabilities {
     android.hardware.bluetooth.audio.SbcCapabilities sbcCapabilities;
     android.hardware.bluetooth.audio.AacCapabilities aacCapabilities;
     android.hardware.bluetooth.audio.LdacCapabilities ldacCapabilities;
     android.hardware.bluetooth.audio.AptxCapabilities aptxCapabilities;
     android.hardware.bluetooth.audio.Lc3Capabilities lc3Capabilities;
+    android.hardware.bluetooth.audio.CodecCapabilities.VendorCapabilities vendorCapabilities;
   }
 }
diff --git a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
index 34ebd60..32bccd8 100644
--- a/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/aidl_api/android.hardware.bluetooth.audio/current/android/hardware/bluetooth/audio/CodecConfiguration.aidl
@@ -40,11 +40,18 @@
   boolean isScmstEnabled;
   android.hardware.bluetooth.audio.CodecConfiguration.CodecSpecific config;
   @VintfStability
+  parcelable VendorConfiguration {
+    int vendorId;
+    char codecId;
+    ParcelableHolder codecConfig;
+  }
+  @VintfStability
   union CodecSpecific {
     android.hardware.bluetooth.audio.SbcConfiguration sbcConfig;
     android.hardware.bluetooth.audio.AacConfiguration aacConfig;
     android.hardware.bluetooth.audio.LdacConfiguration ldacConfig;
     android.hardware.bluetooth.audio.AptxConfiguration aptxConfig;
     android.hardware.bluetooth.audio.Lc3Configuration lc3Config;
+    android.hardware.bluetooth.audio.CodecConfiguration.VendorConfiguration vendorConfig;
   }
 }
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
index 5bf0252..41e2431 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecCapabilities.aidl
@@ -30,12 +30,17 @@
 @VintfStability
 parcelable CodecCapabilities {
     @VintfStability
+    parcelable VendorCapabilities {
+        ParcelableHolder extension;
+    }
+    @VintfStability
     union Capabilities {
         SbcCapabilities sbcCapabilities;
         AacCapabilities aacCapabilities;
         LdacCapabilities ldacCapabilities;
         AptxCapabilities aptxCapabilities;
         Lc3Capabilities lc3Capabilities;
+        VendorCapabilities vendorCapabilities;
     }
     CodecType codecType;
     Capabilities capabilities;
diff --git a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
index 9e43f22..3679537 100644
--- a/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
+++ b/bluetooth/audio/aidl/android/hardware/bluetooth/audio/CodecConfiguration.aidl
@@ -30,12 +30,19 @@
 @VintfStability
 parcelable CodecConfiguration {
     @VintfStability
+    parcelable VendorConfiguration {
+        int vendorId;
+        char codecId;
+        ParcelableHolder codecConfig;
+    }
+    @VintfStability
     union CodecSpecific {
         SbcConfiguration sbcConfig;
         AacConfiguration aacConfig;
         LdacConfiguration ldacConfig;
         AptxConfiguration aptxConfig;
         Lc3Configuration lc3Config;
+        VendorConfiguration vendorConfig;
     }
     CodecType codecType;
     /**
diff --git a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
index 7e49074..5a413e0 100644
--- a/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/A2dpSoftwareAudioProvider.cpp
@@ -88,8 +88,9 @@
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
   *_aidl_return = data_mq_->dupeDesc();
+  auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
-                                                _aidl_return, *audio_config_);
+                                                &desc, *audio_config_);
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
index 8e6cee7..1e55a0b 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProvidersFactory"
+#define LOG_TAG "BTAudioProviderFactoryAIDL"
 
 #include "BluetoothAudioProviderFactory.h"
 
diff --git a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
index 96d888c..b38cfd2 100644
--- a/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
+++ b/bluetooth/audio/aidl/default/BluetoothAudioProviderFactory.h
@@ -18,13 +18,6 @@
 
 #include <aidl/android/hardware/bluetooth/audio/BnBluetoothAudioProviderFactory.h>
 
-#include "A2dpOffloadAudioProvider.h"
-#include "A2dpSoftwareAudioProvider.h"
-#include "BluetoothAudioProvider.h"
-#include "HearingAidAudioProvider.h"
-#include "LeAudioOffloadAudioProvider.h"
-#include "LeAudioSoftwareAudioProvider.h"
-
 namespace aidl {
 namespace android {
 namespace hardware {
diff --git a/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp b/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
index a993059..66ce93b 100644
--- a/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/HearingAidAudioProvider.cpp
@@ -81,10 +81,10 @@
     *_aidl_return = DataMQDesc();
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
+  *_aidl_return = data_mq_->dupeDesc();
   auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
                                                 &desc, *audio_config_);
-  *_aidl_return = data_mq_->dupeDesc();
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
index 4078783..72ac9bd 100644
--- a/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/LeAudioOffloadAudioProvider.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProviderLeAudioSW"
+#define LOG_TAG "BTAudioProviderLeAudioHW"
 
 #include "LeAudioOffloadAudioProvider.h"
 
diff --git a/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp b/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
index f9962fd..67b7d60 100644
--- a/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
+++ b/bluetooth/audio/aidl/default/LeAudioSoftwareAudioProvider.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "BTAudioProviderLeAudioHW"
+#define LOG_TAG "BTAudioProviderLeAudioSW"
 
 #include "LeAudioSoftwareAudioProvider.h"
 
@@ -88,6 +88,16 @@
       channel_mode_to_channel_count(pcm_config.channelMode) *
       (pcm_config.bitsPerSample / 8) * (pcm_config.dataIntervalUs / 1000) *
       buffer_modifier;
+  if (data_mq_size <= 0) {
+    LOG(ERROR) << __func__ << "Unexpected audio buffer size: " << data_mq_size
+               << ", SampleRateHz: " << pcm_config.sampleRateHz
+               << ", ChannelMode: " << toString(pcm_config.channelMode)
+               << ", BitsPerSample: "
+               << static_cast<int>(pcm_config.bitsPerSample)
+               << ", DataIntervalUs: " << pcm_config.dataIntervalUs
+               << ", SessionType: " << toString(session_type_);
+    return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
+  }
 
   LOG(INFO) << __func__ << " - size of audio buffer " << data_mq_size
             << " byte(s)";
@@ -113,8 +123,9 @@
     return ndk::ScopedAStatus::fromExceptionCode(EX_ILLEGAL_ARGUMENT);
   }
   *_aidl_return = data_mq_->dupeDesc();
+  auto desc = data_mq_->dupeDesc();
   BluetoothAudioSessionReport::OnSessionStarted(session_type_, stack_iface_,
-                                                _aidl_return, *audio_config_);
+                                                &desc, *audio_config_);
   return ndk::ScopedAStatus::ok();
 }
 
diff --git a/bluetooth/audio/aidl/default/OWNERS b/bluetooth/audio/aidl/default/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/aidl/default/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/aidl/vts/OWNERS b/bluetooth/audio/aidl/vts/OWNERS
new file mode 100644
index 0000000..17ea464
--- /dev/null
+++ b/bluetooth/audio/aidl/vts/OWNERS
@@ -0,0 +1,4 @@
+include platform/packages/modules/Bluetooth:/OWNERS
+
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/utils/OWNERS b/bluetooth/audio/utils/OWNERS
index ed92847..17ea464 100644
--- a/bluetooth/audio/utils/OWNERS
+++ b/bluetooth/audio/utils/OWNERS
@@ -1,3 +1,4 @@
 include platform/packages/modules/Bluetooth:/OWNERS
 
-cheneyni@google.com
\ No newline at end of file
+cheneyni@google.com
+aliceypkuo@google.com
\ No newline at end of file
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
index 380732f..516ebe8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.cpp
@@ -78,7 +78,7 @@
     .bitsPerSample = {24},
 };
 
-static const Lc3Capabilities kDefaultOffloadLc3Capability = {
+static const Lc3Capabilities kDefaultA2dpOffloadLc3Capability = {
     .samplingFrequencyHz = {44100, 48000},
     .frameDurationUs = {7500, 10000},
     .channelMode = {ChannelMode::MONO, ChannelMode::STEREO},
@@ -285,11 +285,11 @@
   const Lc3Configuration lc3_data =
       codec_specific.get<CodecConfiguration::CodecSpecific::lc3Config>();
 
-  if (ContainedInVector(kDefaultOffloadLc3Capability.samplingFrequencyHz,
+  if (ContainedInVector(kDefaultA2dpOffloadLc3Capability.samplingFrequencyHz,
                         lc3_data.samplingFrequencyHz) &&
-      ContainedInVector(kDefaultOffloadLc3Capability.frameDurationUs,
+      ContainedInVector(kDefaultA2dpOffloadLc3Capability.frameDurationUs,
                         lc3_data.frameDurationUs) &&
-      ContainedInVector(kDefaultOffloadLc3Capability.channelMode,
+      ContainedInVector(kDefaultA2dpOffloadLc3Capability.channelMode,
                         lc3_data.channelMode)) {
     return true;
   }
@@ -352,11 +352,10 @@
       case CodecType::LC3:
         codec_capability.capabilities
             .set<CodecCapabilities::Capabilities::lc3Capabilities>(
-                kDefaultOffloadLc3Capability);
+                kDefaultA2dpOffloadLc3Capability);
         break;
       case CodecType::UNKNOWN:
       case CodecType::VENDOR:
-        codec_capability = {};
         break;
     }
   }
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
index c542ce5..0259a7e 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioCodecs.h
@@ -45,11 +45,7 @@
       const SessionType& session_type, const CodecConfiguration& codec_config);
 
   static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type, const Lc3Configuration& codec_config);
-
-  static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type,
-      const LeAudioConfiguration& codec_config);
+      const SessionType& session_type, const LeAudioConfiguration&);
 
   static std::vector<LeAudioCodecCapabilitiesSetting>
   GetLeAudioOffloadCodecCapabilities(const SessionType& session_type);
@@ -77,8 +73,6 @@
       const CodecConfiguration::CodecSpecific& codec_specific);
   static bool IsOffloadLc3ConfigurationValid(
       const CodecConfiguration::CodecSpecific& codec_specific);
-  static bool IsOffloadLeAudioConfigurationValid(
-      const SessionType& session_type, const LeAudioCodecConfiguration&);
 };
 
 }  // namespace audio
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
index 95e473e..f626db8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.cpp
@@ -35,22 +35,8 @@
 static constexpr int kWritePollMs = 1;  // polled non-blocking interval
 static constexpr int kReadPollMs = 1;   // polled non-blocking interval
 
-const CodecConfiguration BluetoothAudioSession::kInvalidCodecConfiguration = {};
-const LeAudioConfiguration kInvalidLeAudioConfiguration = {};
-AudioConfiguration BluetoothAudioSession::invalidSoftwareAudioConfiguration =
-    {};
-AudioConfiguration BluetoothAudioSession::invalidOffloadAudioConfiguration = {};
-AudioConfiguration BluetoothAudioSession::invalidLeOffloadAudioConfig = {};
-
 BluetoothAudioSession::BluetoothAudioSession(const SessionType& session_type)
-    : session_type_(session_type), stack_iface_(nullptr), data_mq_(nullptr) {
-  invalidSoftwareAudioConfiguration.set<AudioConfiguration::pcmConfig>(
-      kInvalidPcmConfiguration);
-  invalidOffloadAudioConfiguration.set<AudioConfiguration::a2dpConfig>(
-      kInvalidCodecConfiguration);
-  invalidLeOffloadAudioConfig.set<AudioConfiguration::leAudioConfig>(
-      kInvalidLeAudioConfiguration);
-}
+    : session_type_(session_type), stack_iface_(nullptr), data_mq_(nullptr) {}
 
 /***
  *
@@ -72,13 +58,7 @@
   } else if (!UpdateDataPath(mq_desc)) {
     LOG(ERROR) << __func__ << " - SessionType=" << toString(session_type_)
                << " MqDescriptor Invalid";
-    if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      audio_config_ = std::make_unique<AudioConfiguration>(
-          invalidOffloadAudioConfiguration);
-    } else {
-      audio_config_ = std::make_unique<AudioConfiguration>(
-          invalidSoftwareAudioConfiguration);
-    }
+    audio_config_ = nullptr;
   } else {
     stack_iface_ = stack_iface;
     LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_)
@@ -91,13 +71,7 @@
   std::lock_guard<std::recursive_mutex> guard(mutex_);
   bool toggled = IsSessionReady();
   LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_);
-  if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-    audio_config_ =
-        std::make_unique<AudioConfiguration>(invalidOffloadAudioConfiguration);
-  } else {
-    audio_config_ =
-        std::make_unique<AudioConfiguration>(invalidSoftwareAudioConfiguration);
-  }
+  audio_config_ = nullptr;
   stack_iface_ = nullptr;
   UpdateDataPath(nullptr);
   if (toggled) {
@@ -111,22 +85,17 @@
  *
  ***/
 
-const AudioConfiguration& BluetoothAudioSession::GetAudioConfig() {
+const AudioConfiguration BluetoothAudioSession::GetAudioConfig() {
   std::lock_guard<std::recursive_mutex> guard(mutex_);
   if (!IsSessionReady()) {
-    if (session_type_ == SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      return invalidOffloadAudioConfiguration;
-    } else {
-      return invalidSoftwareAudioConfiguration;
-    }
     switch (session_type_) {
       case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
-        return invalidOffloadAudioConfiguration;
+        return AudioConfiguration(CodecConfiguration{});
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
       case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
-        return invalidLeOffloadAudioConfig;
+        return AudioConfiguration(LeAudioConfiguration{});
       default:
-        return invalidSoftwareAudioConfiguration;
+        return AudioConfiguration(PcmConfiguration{});
     }
   }
   return *audio_config_;
@@ -169,7 +138,7 @@
        session_type_ ==
            SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH ||
        (data_mq_ != nullptr && data_mq_->isValid()));
-  return stack_iface_ != nullptr && is_mq_valid;
+  return stack_iface_ != nullptr && is_mq_valid && audio_config_ != nullptr;
 }
 
 /***
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
index 85fd571..73bc0f8 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSession.h
@@ -144,7 +144,7 @@
    * The control function is for the bluetooth_audio module to get the current
    * AudioConfiguration
    ***/
-  const AudioConfiguration& GetAudioConfig();
+  const AudioConfiguration GetAudioConfig();
 
   /***
    * The report function is used to report that the Bluetooth stack has notified
@@ -173,14 +173,6 @@
   // Return if IBluetoothAudioProviderFactory implementation existed
   static bool IsAidlAvailable();
 
-  static constexpr PcmConfiguration kInvalidPcmConfiguration = {};
-  // can't be constexpr because of non-literal type
-  static const CodecConfiguration kInvalidCodecConfiguration;
-
-  static AudioConfiguration invalidSoftwareAudioConfiguration;
-  static AudioConfiguration invalidOffloadAudioConfiguration;
-  static AudioConfiguration invalidLeOffloadAudioConfig;
-
  private:
   // using recursive_mutex to allow hwbinder to re-enter again.
   std::recursive_mutex mutex_;
diff --git a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
index a3ed428..aff01e5 100644
--- a/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
+++ b/bluetooth/audio/utils/aidl_session/BluetoothAudioSessionControl.h
@@ -79,11 +79,15 @@
         BluetoothAudioSessionInstance::GetSessionInstance(session_type);
     if (session_ptr != nullptr) {
       return session_ptr->GetAudioConfig();
-    } else if (session_type ==
-               SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH) {
-      return BluetoothAudioSession::invalidOffloadAudioConfiguration;
-    } else {
-      return BluetoothAudioSession::invalidSoftwareAudioConfiguration;
+    }
+    switch (session_type) {
+      case SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+        return AudioConfiguration(CodecConfiguration{});
+      case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_ENCODING_DATAPATH:
+      case SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH:
+        return AudioConfiguration(LeAudioConfiguration{});
+      default:
+        return AudioConfiguration(PcmConfiguration{});
     }
   }
 
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
index 91e0238..632a389 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware.cpp
@@ -93,16 +93,6 @@
     std::unordered_map<uint16_t, std::shared_ptr<PortStatusCallbacks_2_2>>>
     legacy_callback_table;
 
-const static std::unordered_map<SessionType_2_0, SessionType>
-    session_type_2_0_to_aidl_map{
-        {SessionType_2_0::A2DP_SOFTWARE_ENCODING_DATAPATH,
-         SessionType::A2DP_SOFTWARE_ENCODING_DATAPATH},
-        {SessionType_2_0::A2DP_HARDWARE_OFFLOAD_DATAPATH,
-         SessionType::A2DP_HARDWARE_OFFLOAD_ENCODING_DATAPATH},
-        {SessionType_2_0::HEARING_AID_SOFTWARE_ENCODING_DATAPATH,
-         SessionType::HEARING_AID_SOFTWARE_ENCODING_DATAPATH},
-    };
-
 const static std::unordered_map<SessionType_2_1, SessionType>
     session_type_2_1_to_aidl_map{
         {SessionType_2_1::A2DP_SOFTWARE_ENCODING_DATAPATH,
@@ -121,18 +111,6 @@
          SessionType::LE_AUDIO_HARDWARE_OFFLOAD_DECODING_DATAPATH},
     };
 
-const static std::unordered_map<int32_t, SampleRate_2_0>
-    sample_rate_to_hidl_2_0_map{
-        {44100, SampleRate_2_0::RATE_44100},
-        {48000, SampleRate_2_0::RATE_48000},
-        {88200, SampleRate_2_0::RATE_88200},
-        {96000, SampleRate_2_0::RATE_96000},
-        {176400, SampleRate_2_0::RATE_176400},
-        {192000, SampleRate_2_0::RATE_192000},
-        {16000, SampleRate_2_0::RATE_16000},
-        {24000, SampleRate_2_0::RATE_24000},
-    };
-
 const static std::unordered_map<int32_t, SampleRate_2_1>
     sample_rate_to_hidl_2_1_map{
         {44100, SampleRate_2_1::RATE_44100},
@@ -211,20 +189,6 @@
         {LdacQualityIndex::ABR, LdacQualityIndex_2_0::QUALITY_ABR},
     };
 
-const static std::unordered_map<LeAudioMode, LeAudioMode_2_2>
-    leaudio_mode_to_hidl_map{
-        {LeAudioMode::UNKNOWN, LeAudioMode_2_2::UNKNOWN},
-        {LeAudioMode::UNICAST, LeAudioMode_2_2::UNICAST},
-        {LeAudioMode::BROADCAST, LeAudioMode_2_2::BROADCAST},
-    };
-
-inline SessionType from_session_type_2_0(
-    const SessionType_2_0& session_type_hidl) {
-  auto it = session_type_2_0_to_aidl_map.find(session_type_hidl);
-  if (it != session_type_2_0_to_aidl_map.end()) return it->second;
-  return SessionType::UNKNOWN;
-}
-
 inline SessionType from_session_type_2_1(
     const SessionType_2_1& session_type_hidl) {
   auto it = session_type_2_1_to_aidl_map.find(session_type_hidl);
@@ -232,6 +196,11 @@
   return SessionType::UNKNOWN;
 }
 
+inline SessionType from_session_type_2_0(
+    const SessionType_2_0& session_type_hidl) {
+  return from_session_type_2_1(static_cast<SessionType_2_1>(session_type_hidl));
+}
+
 inline HidlStatus to_hidl_status(const BluetoothAudioStatus& status) {
   switch (status) {
     case BluetoothAudioStatus::SUCCESS:
@@ -243,18 +212,19 @@
   }
 }
 
-inline SampleRate_2_0 to_hidl_sample_rate_2_0(const int32_t sample_rate_hz) {
-  auto it = sample_rate_to_hidl_2_0_map.find(sample_rate_hz);
-  if (it != sample_rate_to_hidl_2_0_map.end()) return it->second;
-  return SampleRate_2_0::RATE_UNKNOWN;
-}
-
 inline SampleRate_2_1 to_hidl_sample_rate_2_1(const int32_t sample_rate_hz) {
   auto it = sample_rate_to_hidl_2_1_map.find(sample_rate_hz);
   if (it != sample_rate_to_hidl_2_1_map.end()) return it->second;
   return SampleRate_2_1::RATE_UNKNOWN;
 }
 
+inline SampleRate_2_0 to_hidl_sample_rate_2_0(const int32_t sample_rate_hz) {
+  auto it = sample_rate_to_hidl_2_1_map.find(sample_rate_hz);
+  if (it != sample_rate_to_hidl_2_1_map.end())
+    return static_cast<SampleRate_2_0>(it->second);
+  return SampleRate_2_0::RATE_UNKNOWN;
+}
+
 inline BitsPerSample_2_0 to_hidl_bits_per_sample(const int8_t bit_per_sample) {
   switch (bit_per_sample) {
     case 16:
@@ -449,18 +419,49 @@
 
 inline Lc3CodecConfig_2_1 to_hidl_leaudio_config_2_1(
     const LeAudioConfiguration& leaudio_config) {
-  auto& unicast_config =
-      leaudio_config.modeConfig
-          .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
+  Lc3CodecConfig_2_1 hidl_lc3_codec_config = {
+      .audioChannelAllocation = 0,
+  };
+  if (leaudio_config.modeConfig.getTag() ==
+      LeAudioConfiguration::LeAudioModeConfig::unicastConfig) {
+    auto& unicast_config =
+        leaudio_config.modeConfig
+            .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
+    if (unicast_config.leAudioCodecConfig.getTag() ==
+        LeAudioCodecConfiguration::lc3Config) {
+      LOG(FATAL) << __func__ << ": unexpected codec type(vendor?)";
+    }
+    auto& le_codec_config = unicast_config.leAudioCodecConfig
+                                .get<LeAudioCodecConfiguration::lc3Config>();
 
-  auto& le_codec_config = unicast_config.leAudioCodecConfig
-                              .get<LeAudioCodecConfiguration::lc3Config>();
+    hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
 
-  Lc3CodecConfig_2_1 hidl_lc3_codec_config;
-  hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
+    for (const auto& map : unicast_config.streamMap) {
+      hidl_lc3_codec_config.audioChannelAllocation |=
+          map.audioChannelAllocation;
+    }
+  } else {
+    // NOTE: Broadcast is not officially supported in HIDL
+    auto& bcast_config =
+        leaudio_config.modeConfig
+            .get<LeAudioConfiguration::LeAudioModeConfig::broadcastConfig>();
+    if (bcast_config.streamMap.empty()) {
+      return hidl_lc3_codec_config;
+    }
+    if (bcast_config.streamMap[0].leAudioCodecConfig.getTag() !=
+        LeAudioCodecConfiguration::lc3Config) {
+      LOG(FATAL) << __func__ << ": unexpected codec type(vendor?)";
+    }
+    auto& le_codec_config =
+        bcast_config.streamMap[0]
+            .leAudioCodecConfig.get<LeAudioCodecConfiguration::lc3Config>();
+    hidl_lc3_codec_config.lc3Config = to_hidl_lc3_config_2_1(le_codec_config);
 
-  hidl_lc3_codec_config.audioChannelAllocation =
-      unicast_config.streamMap.size();
+    for (const auto& map : bcast_config.streamMap) {
+      hidl_lc3_codec_config.audioChannelAllocation |=
+          map.audioChannelAllocation;
+    }
+  }
 
   return hidl_lc3_codec_config;
 }
@@ -468,13 +469,10 @@
 inline LeAudioConfig_2_2 to_hidl_leaudio_config_2_2(
     const LeAudioConfiguration& leaudio_config) {
   LeAudioConfig_2_2 hidl_leaudio_config;
-  if (leaudio_mode_to_hidl_map.find(leaudio_config.mode) !=
-      leaudio_mode_to_hidl_map.end()) {
-    hidl_leaudio_config.mode = leaudio_mode_to_hidl_map.at(leaudio_config.mode);
-  }
 
   if (leaudio_config.modeConfig.getTag() ==
       LeAudioConfiguration::LeAudioModeConfig::unicastConfig) {
+    hidl_leaudio_config.mode = LeAudioMode_2_2::UNICAST;
     auto& unicast_config =
         leaudio_config.modeConfig
             .get<LeAudioConfiguration::LeAudioModeConfig::unicastConfig>();
@@ -497,6 +495,7 @@
     }
   } else if (leaudio_config.modeConfig.getTag() ==
              LeAudioConfiguration::LeAudioModeConfig::broadcastConfig) {
+    hidl_leaudio_config.mode = LeAudioMode_2_2::BROADCAST;
     auto bcast_config =
         leaudio_config.modeConfig
             .get<LeAudioConfiguration::LeAudioModeConfig::broadcastConfig>();
@@ -641,6 +640,12 @@
       from_session_type_2_0(session_type), buffer, bytes);
 }
 
+size_t HidlToAidlMiddleware_2_0::InReadPcmData(
+    const SessionType_2_0& session_type, void* buffer, size_t bytes) {
+  return BluetoothAudioSessionControl::InReadPcmData(
+      from_session_type_2_0(session_type), buffer, bytes);
+}
+
 bool HidlToAidlMiddleware_2_0::IsAidlAvailable() {
   return BluetoothAudioSession::IsAidlAvailable();
 }
@@ -761,6 +766,13 @@
       from_session_type_2_1(session_type));
 }
 
+void HidlToAidlMiddleware_2_2::UpdateTracksMetadata(
+    const SessionType_2_1& session_type,
+    const struct source_metadata* source_metadata) {
+  return BluetoothAudioSessionControl::UpdateSourceMetadata(
+      from_session_type_2_1(session_type), *source_metadata);
+}
+
 void HidlToAidlMiddleware_2_2::UpdateSinkMetadata(
     const SessionType_2_1& session_type,
     const struct sink_metadata* sink_metadata) {
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
index d10ee37..b124d8f 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_0.h
@@ -64,6 +64,9 @@
 
   static size_t OutWritePcmData(const SessionType_2_0& session_type,
                                 const void* buffer, size_t bytes);
+
+  static size_t InReadPcmData(const SessionType_2_0& session_type, void* buffer,
+                              size_t bytes);
 };
 
 }  // namespace audio
diff --git a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
index 149e404..f6c3e5c 100644
--- a/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
+++ b/bluetooth/audio/utils/aidl_session/HidlToAidlMiddleware_2_2.h
@@ -54,6 +54,10 @@
 
   static void StopStream(const SessionType_2_1& session_type);
 
+  static void UpdateTracksMetadata(
+      const SessionType_2_1& session_type,
+      const struct source_metadata* source_metadata);
+
   static void UpdateSinkMetadata(const SessionType_2_1& session_type,
                                  const struct sink_metadata* sink_metadata);
 };
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession.cpp b/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
index 6d5608b..283952e 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession.cpp
@@ -437,6 +437,9 @@
 
 // The control function reads stream from FMQ
 size_t BluetoothAudioSession::InReadPcmData(void* buffer, size_t bytes) {
+  if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
+    return HidlToAidlMiddleware_2_0::InReadPcmData(session_type_, buffer,
+                                                   bytes);
   if (buffer == nullptr || !bytes) return 0;
   size_t totalRead = 0;
   int ms_timeout = kFmqReceiveTimeoutMs;
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h b/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
index 368939e..c270ef0 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
+++ b/bluetooth/audio/utils/session/BluetoothAudioSessionControl_2_2.h
@@ -152,7 +152,7 @@
     std::shared_ptr<BluetoothAudioSession_2_2> session_ptr =
         BluetoothAudioSessionInstance_2_2::GetSessionInstance(session_type);
     if (session_ptr != nullptr) {
-      session_ptr->GetAudioSession()->UpdateTracksMetadata(source_metadata);
+      session_ptr->UpdateTracksMetadata(source_metadata);
     }
   }
 
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
index 4613ddc..ceb0662 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.cpp
@@ -31,9 +31,13 @@
 
 using ::aidl::android::hardware::bluetooth::audio::HidlToAidlMiddleware_2_0;
 using ::aidl::android::hardware::bluetooth::audio::HidlToAidlMiddleware_2_2;
+using ::android::hardware::audio::common::V5_0::AudioContentType;
 using ::android::hardware::audio::common::V5_0::AudioSource;
+using ::android::hardware::audio::common::V5_0::AudioUsage;
+using ::android::hardware::audio::common::V5_0::PlaybackTrackMetadata;
 using ::android::hardware::audio::common::V5_0::RecordTrackMetadata;
 using ::android::hardware::audio::common::V5_0::SinkMetadata;
+using ::android::hardware::audio::common::V5_0::SourceMetadata;
 using ::android::hardware::bluetooth::audio::V2_0::BitsPerSample;
 using ::android::hardware::bluetooth::audio::V2_0::ChannelMode;
 using ::android::hardware::bluetooth::audio::V2_2::LeAudioConfiguration;
@@ -128,6 +132,53 @@
   return audio_session_2_1;
 }
 
+void BluetoothAudioSession_2_2::UpdateTracksMetadata(
+    const struct source_metadata* source_metadata) {
+  if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
+    return HidlToAidlMiddleware_2_2::UpdateTracksMetadata(raw_session_type_,
+                                                          source_metadata);
+  std::lock_guard<std::recursive_mutex> guard(audio_session->mutex_);
+  if (!IsSessionReady()) {
+    LOG(DEBUG) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+               << " has NO session";
+    return;
+  }
+
+  ssize_t track_count = source_metadata->track_count;
+  LOG(INFO) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+            << ", " << track_count << " track(s)";
+
+  if (session_type_2_1_ == SessionType_2_1::UNKNOWN) {
+    audio_session->UpdateTracksMetadata(source_metadata);
+    return;
+  }
+
+  struct playback_track_metadata* track = source_metadata->tracks;
+  SourceMetadata sourceMetadata;
+  PlaybackTrackMetadata* halMetadata;
+
+  sourceMetadata.tracks.resize(track_count);
+  halMetadata = sourceMetadata.tracks.data();
+  while (track_count && track) {
+    halMetadata->usage = static_cast<AudioUsage>(track->usage);
+    halMetadata->contentType =
+        static_cast<AudioContentType>(track->content_type);
+    halMetadata->gain = track->gain;
+    LOG(VERBOSE) << __func__ << " - SessionType=" << toString(session_type_2_1_)
+                 << ", usage=" << toString(halMetadata->usage)
+                 << ", content=" << toString(halMetadata->contentType)
+                 << ", gain=" << halMetadata->gain;
+    --track_count;
+    ++track;
+    ++halMetadata;
+  }
+  auto hal_retval = audio_session->stack_iface_->updateMetadata(sourceMetadata);
+  if (!hal_retval.isOk()) {
+    LOG(WARNING) << __func__ << " - IBluetoothAudioPort SessionType="
+                 << toString(session_type_2_1_) << " failed";
+  }
+}
+
 void BluetoothAudioSession_2_2::UpdateSinkMetadata(
     const struct sink_metadata* sink_metadata) {
   if (HidlToAidlMiddleware_2_0::IsAidlAvailable())
diff --git a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
index b6f96ab..e04ad80 100644
--- a/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
+++ b/bluetooth/audio/utils/session/BluetoothAudioSession_2_2.h
@@ -152,6 +152,7 @@
   const ::android::hardware::bluetooth::audio::V2_2::AudioConfiguration
   GetAudioConfig();
 
+  void UpdateTracksMetadata(const struct source_metadata* source_metadata);
   void UpdateSinkMetadata(const struct sink_metadata* sink_metadata);
 
   static constexpr ::android::hardware::bluetooth::audio::V2_2::
diff --git a/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp b/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
index c812d54..b63e3bb 100644
--- a/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
+++ b/camera/provider/2.7/default/ExternalCameraProviderImpl_2_7.cpp
@@ -292,8 +292,7 @@
     } else {
         deviceName = std::string("device@3.4/external/") + cameraId;
     }
-    if (mCameraStatusMap.find(deviceName) != mCameraStatusMap.end()) {
-        mCameraStatusMap.erase(deviceName);
+    if (mCameraStatusMap.erase(deviceName) != 0) {
         if (mCallbacks != nullptr) {
             mCallbacks->cameraDeviceStatusChange(deviceName, CameraDeviceStatus::NOT_PRESENT);
         }
@@ -391,4 +390,4 @@
 }  // namespace provider
 }  // namespace camera
 }  // namespace hardware
-}  // namespace android
\ No newline at end of file
+}  // namespace android
diff --git a/compatibility_matrices/compatibility_matrix.current.xml b/compatibility_matrices/compatibility_matrix.current.xml
index 1731c9c..e6dd1bf 100644
--- a/compatibility_matrices/compatibility_matrix.current.xml
+++ b/compatibility_matrices/compatibility_matrix.current.xml
@@ -486,6 +486,13 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.nfc</name>
+        <interface>
+            <name>INfc</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.oemlock</name>
         <version>1.0</version>
@@ -752,6 +759,13 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>android.hardware.usb</name>
+        <interface>
+            <name>IUsb</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <hal format="hidl" optional="true">
         <name>android.hardware.usb.gadget</name>
         <version>1.0-2</version>
diff --git a/graphics/common/OWNERS b/graphics/common/OWNERS
new file mode 100644
index 0000000..94999ea
--- /dev/null
+++ b/graphics/common/OWNERS
@@ -0,0 +1,5 @@
+# Bug component: 1075130
+adyabr@google.com
+alecmouri@google.com
+jreck@google.com
+scroggo@google.com
diff --git a/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl b/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
index 7719d6e..74a9ce3 100644
--- a/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
+++ b/graphics/common/aidl/android/hardware/graphics/common/StandardMetadataType.aidl
@@ -22,8 +22,9 @@
  * This is an enum that defines the common types of gralloc 4 buffer metadata. The comments for
  * each enum include a description of the metadata that is associated with the type.
  *
- * IMapper@4.x must support getting the following standard buffer metadata types. IMapper@4.x may
- * support setting these standard buffer metadata types as well.
+ * IMapper@4.x must support getting the following standard buffer metadata types, with the exception
+ * of SMPTE 2094-10 metadata. IMapper@4.x may support setting these standard buffer metadata types
+ * as well.
  *
  * When encoding these StandardMetadataTypes into a byte stream, the associated MetadataType is
  * is first encoded followed by the StandardMetadataType value. The MetadataType is encoded by
diff --git a/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp b/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
index b071f71..fa294ff 100644
--- a/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
+++ b/graphics/composer/2.4/vts/functional/VtsHalGraphicsComposerV2_4TargetTest.cpp
@@ -161,7 +161,8 @@
         return mGralloc->allocate(
                 width, height, /*layerCount*/ 1,
                 static_cast<common::V1_1::PixelFormat>(PixelFormat::RGBA_8888),
-                static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN));
+                static_cast<uint64_t>(BufferUsage::CPU_WRITE_OFTEN | BufferUsage::CPU_READ_OFTEN |
+                                      BufferUsage::COMPOSER_OVERLAY));
     }
 
     struct TestParameters {
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
index 741572d..bd2c3b1 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/Android.bp
@@ -50,6 +50,7 @@
         "libgui",
         "libhidlbase",
         "libprocessgroup",
+        "libtinyxml2",
         "android.hardware.graphics.mapper@2.0",
         "android.hardware.graphics.mapper@2.1",
         "android.hardware.graphics.mapper@3.0",
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
index e519221..3f1e703 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_ReadbackTest.cpp
@@ -24,10 +24,18 @@
 #include <composer-vts/include/ReadbackVts.h>
 #include <composer-vts/include/RenderEngineVts.h>
 #include <gtest/gtest.h>
+#include <ui/DisplayId.h>
+#include <ui/DisplayIdentification.h>
 #include <ui/GraphicBuffer.h>
 #include <ui/GraphicBufferAllocator.h>
 #include <ui/PixelFormat.h>
 #include <ui/Rect.h>
+
+// tinyxml2 does implicit conversions >:(
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wconversion"
+#include <tinyxml2.h>
+#pragma clang diagnostic pop
 #include "composer-vts/include/GraphicsComposerCallback.h"
 
 namespace aidl::android::hardware::graphics::composer3::vts {
@@ -124,6 +132,76 @@
                 /*layerCount*/ 1u, usage, "VtsHalGraphicsComposer3_ReadbackTest");
     }
 
+    uint64_t getStableDisplayId(int64_t display) {
+        DisplayIdentification identification;
+        const auto error = mComposerClient->getDisplayIdentificationData(display, &identification);
+        EXPECT_TRUE(error.isOk());
+
+        if (const auto info = ::android::parseDisplayIdentificationData(
+                    static_cast<uint8_t>(identification.port), identification.data)) {
+            return info->id.value;
+        }
+
+        return ::android::PhysicalDisplayId::fromPort(static_cast<uint8_t>(identification.port))
+                .value;
+    }
+
+    // Gets the per-display XML config
+    std::unique_ptr<tinyxml2::XMLDocument> getDisplayConfigXml(int64_t display) {
+        std::stringstream pathBuilder;
+        pathBuilder << "/vendor/etc/displayconfig/display_id_" << getStableDisplayId(display)
+                    << ".xml";
+        const std::string path = pathBuilder.str();
+        auto document = std::make_unique<tinyxml2::XMLDocument>();
+        const tinyxml2::XMLError error = document->LoadFile(path.c_str());
+        if (error == tinyxml2::XML_SUCCESS) {
+            return document;
+        } else {
+            return nullptr;
+        }
+    }
+
+    // Gets the max display brightness for this display.
+    // If the display config xml does not exist, then assume that the display is not well-configured
+    // enough to provide a display brightness, so return nullopt.
+    std::optional<float> getMaxDisplayBrightnessNits(int64_t display) {
+        const auto document = getDisplayConfigXml(display);
+        if (!document) {
+            // Assume the device doesn't support display brightness
+            return std::nullopt;
+        }
+
+        const auto root = document->RootElement();
+        if (!root) {
+            // If there's somehow no root element, then this isn't a valid config
+            return std::nullopt;
+        }
+
+        const auto screenBrightnessMap = root->FirstChildElement("screenBrightnessMap");
+        if (!screenBrightnessMap) {
+            // A valid display config must have a screen brightness map
+            return std::nullopt;
+        }
+
+        auto point = screenBrightnessMap->FirstChildElement("point");
+        float maxNits = -1.f;
+        while (point != nullptr) {
+            const auto nits = point->FirstChildElement("nits");
+            if (nits) {
+                maxNits = std::max(maxNits, nits->FloatText(-1.f));
+            }
+            point = point->NextSiblingElement("point");
+        }
+
+        if (maxNits < 0.f) {
+            // If we got here, then there were no point elements containing a nit value, so this
+            // config isn't valid
+            return std::nullopt;
+        }
+
+        return maxNits;
+    }
+
     void writeLayers(const std::vector<std::shared_ptr<TestLayer>>& layers) {
         for (auto layer : layers) {
             layer->write(mWriter);
@@ -250,8 +328,8 @@
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -286,8 +364,8 @@
             return;
         }
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
@@ -363,8 +441,8 @@
         std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, coloredSquare, BLUE);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mWriter.validateDisplay(mPrimaryDisplay, ComposerClientWriter::kNoTimestamp);
@@ -389,8 +467,8 @@
         return;
     }
 
-    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer, mDisplayWidth,
-                                  mDisplayHeight, mPixelFormat, mDataspace);
+    ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth, mDisplayHeight,
+                                  mPixelFormat, mDataspace);
 
     ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 }
@@ -419,8 +497,13 @@
         return;
     }
 
-    aidl::android::hardware::common::NativeHandle bufferHandle =
-            ::android::dupToAidl(mGraphicBuffer->handle);
+    aidl::android::hardware::common::NativeHandle bufferHandle;
+    {
+        ::android::sp<::android::GraphicBuffer> buffer = allocate();
+        ASSERT_EQ(::android::OK, mGraphicBuffer->initCheck());
+        ::android::makeToAidl(mGraphicBuffer->handle);
+    }
+
     ndk::ScopedFileDescriptor releaseFence = ndk::ScopedFileDescriptor(-1);
     const auto error =
             mComposerClient->setReadbackBuffer(mPrimaryDisplay, bufferHandle, releaseFence);
@@ -438,8 +521,9 @@
     ndk::ScopedFileDescriptor releaseFence;
     const auto error = mComposerClient->getReadbackBufferFence(mPrimaryDisplay, &releaseFence);
 
-    EXPECT_TRUE(error.isOk());
+    ASSERT_FALSE(error.isOk());
     EXPECT_EQ(IComposerClient::EX_UNSUPPORTED, error.getServiceSpecificError());
+    EXPECT_EQ(-1, releaseFence.get());
 }
 
 TEST_P(GraphicsCompositionTest, ClientComposition) {
@@ -474,8 +558,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -553,8 +637,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight}, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         auto deviceLayer = std::make_shared<TestBufferLayer>(
@@ -657,8 +741,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -720,8 +804,8 @@
 
         std::vector<std::shared_ptr<TestLayer>> layers = {layer};
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
 
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
@@ -781,8 +865,8 @@
         // update expected colors to match crop
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth,
                                        {0, 0, mDisplayWidth, mDisplayHeight}, BLUE);
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(layers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -834,8 +918,8 @@
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, blueRect, BLUE);
         ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         writeLayers(layers);
@@ -876,6 +960,90 @@
     }
 }
 
+TEST_P(GraphicsCompositionTest, SetLayerWhitePointDims) {
+    std::vector<DisplayCapability> capabilities;
+    const auto error = mComposerClient->getDisplayCapabilities(mPrimaryDisplay, &capabilities);
+    ASSERT_TRUE(error.isOk());
+
+    const bool brightnessSupport = std::find(capabilities.begin(), capabilities.end(),
+                                             DisplayCapability::BRIGHTNESS) != capabilities.end();
+
+    if (!brightnessSupport) {
+        GTEST_SUCCEED() << "Cannot verify dimming behavior without brightness support";
+        return;
+    }
+
+    const std::optional<float> maxBrightnessNitsOptional =
+            getMaxDisplayBrightnessNits(mPrimaryDisplay);
+
+    ASSERT_TRUE(maxBrightnessNitsOptional.has_value());
+
+    const float maxBrightnessNits = *maxBrightnessNitsOptional;
+
+    // Preconditions to successfully run are knowing the max brightness and successfully applying
+    // the max brightness
+    ASSERT_GT(maxBrightnessNits, 0.f);
+    mWriter.setDisplayBrightness(mPrimaryDisplay, 1.f);
+    execute();
+    ASSERT_TRUE(mReader.takeErrors().empty());
+
+    for (ColorMode mode : mTestColorModes) {
+        ASSERT_NO_FATAL_FAILURE(
+                mComposerClient->setColorMode(mPrimaryDisplay, mode, RenderIntent::COLORIMETRIC));
+
+        if (!getHasReadbackBuffer()) {
+            GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace for "
+                               "color mode: "
+                            << toString(mode);
+            continue;
+        }
+        const common::Rect redRect = {0, 0, mDisplayWidth, mDisplayHeight / 2};
+        const common::Rect dimmerRedRect = {0, mDisplayHeight / 2, mDisplayWidth, mDisplayHeight};
+        const auto redLayer = std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        redLayer->setColor(RED);
+        redLayer->setDisplayFrame(redRect);
+        redLayer->setWhitePointNits(maxBrightnessNits);
+
+        const auto dimmerRedLayer =
+                std::make_shared<TestColorLayer>(mComposerClient, mPrimaryDisplay);
+        dimmerRedLayer->setColor(RED);
+        dimmerRedLayer->setDisplayFrame(dimmerRedRect);
+        // Intentionally use a small dimming ratio as some implementations may be more likely to
+        // kick into GPU composition to apply dithering when the dimming ratio is high.
+        static constexpr float kDimmingRatio = 0.9f;
+        dimmerRedLayer->setWhitePointNits(maxBrightnessNits * kDimmingRatio);
+
+        const std::vector<std::shared_ptr<TestLayer>> layers = {redLayer, dimmerRedLayer};
+        std::vector<Color> expectedColors(static_cast<size_t>(mDisplayWidth * mDisplayHeight));
+
+        ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, redRect, RED);
+        ReadbackHelper::fillColorsArea(expectedColors, mDisplayWidth, dimmerRedRect, DIM_RED);
+
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
+        ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
+
+        writeLayers(layers);
+        ASSERT_TRUE(mReader.takeErrors().empty());
+        mWriter.validateDisplay(mPrimaryDisplay, ComposerClientWriter::kNoTimestamp);
+        execute();
+        if (!mReader.takeChangedCompositionTypes(mPrimaryDisplay).empty()) {
+            GTEST_SUCCEED()
+                    << "Readback verification not supported for GPU composition for color mode: "
+                    << toString(mode);
+            continue;
+        }
+        mWriter.presentDisplay(mPrimaryDisplay);
+        execute();
+        ASSERT_TRUE(mReader.takeErrors().empty());
+
+        ASSERT_NO_FATAL_FAILURE(readbackBuffer.checkReadbackBuffer(expectedColors));
+        mTestRenderEngine->setRenderLayers(layers);
+        ASSERT_NO_FATAL_FAILURE(mTestRenderEngine->drawLayers());
+        ASSERT_NO_FATAL_FAILURE(mTestRenderEngine->checkColorBuffer(expectedColors));
+    }
+}
+
 class GraphicsBlendModeCompositionTest
     : public GraphicsCompositionTestBase,
       public testing::WithParamInterface<std::tuple<std::string, std::string>> {
@@ -973,8 +1141,8 @@
         setUpLayers(BlendMode::NONE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1014,8 +1182,8 @@
         setUpLayers(BlendMode::COVERAGE);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1050,8 +1218,8 @@
         setUpLayers(BlendMode::PREMULTIPLIED);
         setExpectedColors(expectedColors);
 
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         writeLayers(mLayers);
         ASSERT_TRUE(mReader.takeErrors().empty());
@@ -1120,8 +1288,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
         mLayer->setTransform(Transform::FLIP_H);
         mLayer->setDataspace(ReadbackHelper::getDataspaceForColorMode(mode), mWriter);
@@ -1161,8 +1329,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::FLIP_V);
@@ -1202,8 +1370,8 @@
             GTEST_SUCCEED() << "Readback not supported or unsupported pixelFormat/dataspace";
             return;
         }
-        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mGraphicBuffer,
-                                      mDisplayWidth, mDisplayHeight, mPixelFormat, mDataspace);
+        ReadbackBuffer readbackBuffer(mPrimaryDisplay, mComposerClient, mDisplayWidth,
+                                      mDisplayHeight, mPixelFormat, mDataspace);
         ASSERT_NO_FATAL_FAILURE(readbackBuffer.setReadbackBuffer());
 
         mLayer->setTransform(Transform::ROT_180);
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
index 1c75749..0a12f1a 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/VtsHalGraphicsComposer3_TargetTest.cpp
@@ -191,6 +191,14 @@
         resourceIt->second.layers.erase(layer);
     }
 
+    bool hasCapability(Capability capability) {
+        std::vector<Capability> capabilities;
+        EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
+        return std::any_of(
+                capabilities.begin(), capabilities.end(),
+                [&](const Capability& activeCapability) { return activeCapability == capability; });
+    }
+
     // returns an invalid display id (one that has not been registered to a
     // display.  Currently assuming that a device will never have close to
     // std::numeric_limit<uint64_t>::max() displays registered while running tests
@@ -1477,6 +1485,11 @@
     }
 
     void Test_expectedPresentTime(std::optional<int> framesDelay) {
+        if (hasCapability(Capability::PRESENT_FENCE_IS_NOT_RELIABLE)) {
+            GTEST_SUCCEED() << "Device has unreliable present fences capability, skipping";
+            return;
+        }
+
         ASSERT_TRUE(mComposerClient->setPowerMode(mPrimaryDisplay, PowerMode::ON).isOk());
 
         const auto vsyncPeriod = getVsyncPeriod();
@@ -1653,10 +1666,7 @@
  */
 // TODO(b/208441745) fix the test failure
 TEST_P(GraphicsComposerAidlCommandTest, PRESENT_DISPLAY_NO_LAYER_STATE_CHANGES) {
-    std::vector<Capability> capabilities;
-    EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
-    if (none_of(capabilities.begin(), capabilities.end(),
-                [&](auto item) { return item == Capability::SKIP_VALIDATE; })) {
+    if (!hasCapability(Capability::SKIP_VALIDATE)) {
         GTEST_SUCCEED() << "Device does not have skip validate capability, skipping";
         return;
     }
@@ -1884,10 +1894,7 @@
 }
 
 TEST_P(GraphicsComposerAidlCommandTest, SET_LAYER_SIDEBAND_STREAM) {
-    std::vector<Capability> capabilities;
-    EXPECT_TRUE(mComposer->getCapabilities(&capabilities).isOk());
-    if (none_of(capabilities.begin(), capabilities.end(),
-                [&](auto& item) { return item == Capability::SIDEBAND_STREAM; })) {
+    if (!hasCapability(Capability::SIDEBAND_STREAM)) {
         GTEST_SUCCEED() << "no sideband stream support";
         return;
     }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
index ee597a1..587c523 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/ReadbackVts.cpp
@@ -41,6 +41,7 @@
     writer.setLayerTransform(mDisplay, mLayer, mTransform);
     writer.setLayerPlaneAlpha(mDisplay, mLayer, mAlpha);
     writer.setLayerBlendMode(mDisplay, mLayer, mBlendMode);
+    writer.setLayerWhitePointNits(mDisplay, mLayer, mWhitePointNits);
 }
 
 std::string ReadbackHelper::getColorModeString(ColorMode mode) {
@@ -103,6 +104,7 @@
             1.0f, 1.0f));
 
     layerSettings.geometry.positionTransform = scale * translation;
+    layerSettings.whitePointNits = mWhitePointNits;
 
     return layerSettings;
 }
@@ -175,18 +177,17 @@
     return true;
 }
 
-void ReadbackHelper::compareColorBuffers(std::vector<Color>& expectedColors, void* bufferData,
-                                         const int32_t stride, const uint32_t width,
+void ReadbackHelper::compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                         const uint32_t stride, const uint32_t width,
                                          const uint32_t height, common::PixelFormat pixelFormat) {
     const int32_t bytesPerPixel = ReadbackHelper::GetBytesPerPixel(pixelFormat);
     ASSERT_NE(-1, bytesPerPixel);
     for (int row = 0; row < height; row++) {
         for (int col = 0; col < width; col++) {
             auto pixel = row * static_cast<int32_t>(width) + col;
-            int offset = (row * stride + col) * bytesPerPixel;
+            int offset = (row * static_cast<int32_t>(stride) + col) * bytesPerPixel;
             uint8_t* pixelColor = (uint8_t*)bufferData + offset;
             const Color expectedColor = expectedColors[static_cast<size_t>(pixel)];
-
             ASSERT_EQ(std::round(255.0f * expectedColor.r), pixelColor[0]);
             ASSERT_EQ(std::round(255.0f * expectedColor.g), pixelColor[1]);
             ASSERT_EQ(std::round(255.0f * expectedColor.b), pixelColor[2]);
@@ -195,13 +196,11 @@
 }
 
 ReadbackBuffer::ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client,
-                               const ::android::sp<::android::GraphicBuffer>& graphicBuffer,
                                int32_t width, int32_t height, common::PixelFormat pixelFormat,
                                common::Dataspace dataspace) {
     mDisplay = display;
 
     mComposerClient = client;
-    mGraphicBuffer = graphicBuffer;
 
     mPixelFormat = pixelFormat;
     mDataspace = dataspace;
@@ -235,19 +234,24 @@
 }
 
 void ReadbackBuffer::checkReadbackBuffer(std::vector<Color> expectedColors) {
+    ASSERT_NE(nullptr, mGraphicBuffer);
     // lock buffer for reading
     ndk::ScopedFileDescriptor fenceHandle;
     EXPECT_TRUE(mComposerClient->getReadbackBufferFence(mDisplay, &fenceHandle).isOk());
 
-    int outBytesPerPixel;
-    int outBytesPerStride;
+    int bytesPerPixel = -1;
+    int bytesPerStride = -1;
     void* bufData = nullptr;
-    auto status = mGraphicBuffer->lockAsync(mUsage, mAccessRegion, &bufData, fenceHandle.get(),
-                                            &outBytesPerPixel, &outBytesPerStride);
+
+    auto status = mGraphicBuffer->lockAsync(mUsage, mAccessRegion, &bufData, dup(fenceHandle.get()),
+                                            &bytesPerPixel, &bytesPerStride);
     EXPECT_EQ(::android::OK, status);
     ASSERT_TRUE(mPixelFormat == PixelFormat::RGB_888 || mPixelFormat == PixelFormat::RGBA_8888);
-    ReadbackHelper::compareColorBuffers(expectedColors, bufData, static_cast<int32_t>(mStride),
-                                        mWidth, mHeight, mPixelFormat);
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufData, stride, mWidth, mHeight,
+                                        mPixelFormat);
     status = mGraphicBuffer->unlock();
     EXPECT_EQ(::android::OK, status);
 }
@@ -303,10 +307,7 @@
     LayerSettings layerSettings = TestLayer::toRenderEngineLayerSettings();
     layerSettings.source.buffer.buffer =
             std::make_shared<::android::renderengine::impl::ExternalTexture>(
-                    ::android::sp<::android::GraphicBuffer>::make(
-                            mGraphicBuffer->handle, ::android::GraphicBuffer::CLONE_HANDLE, mWidth,
-                            mHeight, static_cast<int32_t>(mPixelFormat), 1, mUsage, mStride),
-                    mRenderEngine.getInternalRenderEngine(),
+                    mGraphicBuffer, mRenderEngine.getInternalRenderEngine(),
                     ::android::renderengine::impl::ExternalTexture::Usage::READABLE);
 
     layerSettings.source.buffer.usePremultipliedAlpha = mBlendMode == BlendMode::PREMULTIPLIED;
@@ -317,7 +318,7 @@
     const float translateY = mSourceCrop.top / (static_cast<float>(mHeight));
 
     layerSettings.source.buffer.textureTransform =
-            ::android::mat4::translate(::android::vec4(translateX, translateY, 0, 1)) *
+            ::android::mat4::translate(::android::vec4(translateX, translateY, 0, 1.0)) *
             ::android::mat4::scale(::android::vec4(scaleX, scaleY, 1.0, 1.0));
 
     return layerSettings;
@@ -325,9 +326,14 @@
 
 void TestBufferLayer::fillBuffer(std::vector<Color>& expectedColors) {
     void* bufData;
-    auto status = mGraphicBuffer->lock(mUsage, &bufData);
+    int32_t bytesPerPixel = -1;
+    int32_t bytesPerStride = -1;
+    auto status = mGraphicBuffer->lock(mUsage, &bufData, &bytesPerPixel, &bytesPerStride);
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
     EXPECT_EQ(::android::OK, status);
-    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBuffer(mWidth, mHeight, mStride, bufData,
+    ASSERT_NO_FATAL_FAILURE(ReadbackHelper::fillBuffer(mWidth, mHeight, stride, bufData,
                                                        mPixelFormat, expectedColors));
     EXPECT_EQ(::android::OK, mGraphicBuffer->unlock());
 }
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
index 6ff064f..0a55484 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/RenderEngineVts.cpp
@@ -77,13 +77,18 @@
     }
 }
 
-void TestRenderEngine::checkColorBuffer(std::vector<Color>& expectedColors) {
+void TestRenderEngine::checkColorBuffer(const std::vector<Color>& expectedColors) {
     void* bufferData;
-    ASSERT_EQ(0,
-              mGraphicBuffer->lock(static_cast<uint32_t>(mGraphicBuffer->getUsage()), &bufferData));
-    ReadbackHelper::compareColorBuffers(
-            expectedColors, bufferData, static_cast<int32_t>(mGraphicBuffer->getStride()),
-            mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(), mFormat);
+    int32_t bytesPerPixel = -1;
+    int32_t bytesPerStride = -1;
+    ASSERT_EQ(0, mGraphicBuffer->lock(static_cast<uint32_t>(mGraphicBuffer->getUsage()),
+                                      &bufferData, &bytesPerPixel, &bytesPerStride));
+    const uint32_t stride = (bytesPerPixel > 0 && bytesPerStride > 0)
+                                    ? static_cast<uint32_t>(bytesPerStride / bytesPerPixel)
+                                    : mGraphicBuffer->getStride();
+    ReadbackHelper::compareColorBuffers(expectedColors, bufferData, stride,
+                                        mGraphicBuffer->getWidth(), mGraphicBuffer->getHeight(),
+                                        mFormat);
     ASSERT_EQ(::android::OK, mGraphicBuffer->unlock());
 }
 
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
index 0fac2b3..a3ce795 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/ReadbackVts.h
@@ -43,6 +43,10 @@
 
 static const Color BLACK = {0.0f, 0.0f, 0.0f, 1.0f};
 static const Color RED = {1.0f, 0.0f, 0.0f, 1.0f};
+// DIM_RED is 90% dimmed from RED in linear space
+// hard-code as value 243 in 8-bit space here, as calculating it requires
+// oetf(eotf(value) * .9), which is a complex non-linear transformation
+static const Color DIM_RED = {243.f / 255.f, 0.0f, 0.0f, 1.0f};
 static const Color TRANSLUCENT_RED = {1.0f, 0.0f, 0.0f, 0.3f};
 static const Color GREEN = {0.0f, 1.0f, 0.0f, 1.0f};
 static const Color BLUE = {0.0f, 0.0f, 1.0f, 1.0f};
@@ -67,6 +71,7 @@
     void setDisplayFrame(Rect frame) { mDisplayFrame = frame; }
     void setSourceCrop(FRect crop) { mSourceCrop = crop; }
     void setZOrder(uint32_t z) { mZOrder = z; }
+    void setWhitePointNits(float whitePointNits) { mWhitePointNits = whitePointNits; }
 
     void setSurfaceDamage(std::vector<Rect> surfaceDamage) {
         mSurfaceDamage = std::move(surfaceDamage);
@@ -84,10 +89,13 @@
 
     int64_t getLayer() const { return mLayer; }
 
+    float getWhitePointNits() const { return mWhitePointNits; }
+
   protected:
     int64_t mDisplay;
     int64_t mLayer;
     Rect mDisplayFrame = {0, 0, 0, 0};
+    float mWhitePointNits = -1.f;
     std::vector<Rect> mSurfaceDamage;
     Transform mTransform = static_cast<Transform>(0);
     FRect mSourceCrop = {0, 0, 0, 0};
@@ -153,7 +161,6 @@
     uint32_t mLayerCount;
     PixelFormat mPixelFormat;
     uint32_t mUsage;
-    uint32_t mStride;
     ::android::Rect mAccessRegion;
 };
 
@@ -181,15 +188,14 @@
     static const std::vector<ColorMode> colorModes;
     static const std::vector<Dataspace> dataspaces;
 
-    static void compareColorBuffers(std::vector<Color>& expectedColors, void* bufferData,
-                                    const int32_t stride, const uint32_t width,
+    static void compareColorBuffers(const std::vector<Color>& expectedColors, void* bufferData,
+                                    const uint32_t stride, const uint32_t width,
                                     const uint32_t height, PixelFormat pixelFormat);
 };
 
 class ReadbackBuffer {
   public:
-    ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client,
-                   const ::android::sp<::android::GraphicBuffer>& graphicBuffer, int32_t width,
+    ReadbackBuffer(int64_t display, const std::shared_ptr<IComposerClient>& client, int32_t width,
                    int32_t height, common::PixelFormat pixelFormat, common::Dataspace dataspace);
 
     void setReadbackBuffer();
@@ -203,7 +209,6 @@
     uint32_t mHeight;
     uint32_t mLayerCount;
     uint32_t mUsage;
-    uint32_t mStride;
     PixelFormat mPixelFormat;
     Dataspace mDataspace;
     int64_t mDisplay;
diff --git a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
index 2798e09..a776a27 100644
--- a/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
+++ b/graphics/composer/aidl/android/hardware/graphics/composer3/vts/functional/composer-vts/include/RenderEngineVts.h
@@ -54,7 +54,7 @@
         mDisplaySettings = displaySettings;
     };
     void drawLayers();
-    void checkColorBuffer(std::vector<Color>& expectedColors);
+    void checkColorBuffer(const std::vector<Color>& expectedColors);
 
     ::android::renderengine::RenderEngine& getInternalRenderEngine() { return *mRenderEngine; }
 
diff --git a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
index 9371154..5e012f6 100644
--- a/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
+++ b/graphics/mapper/4.0/vts/functional/VtsHalGraphicsMapperV4_0TargetTest.cpp
@@ -93,7 +93,13 @@
         ASSERT_NO_FATAL_FAILURE(bufferHandle = mGralloc->allocate(descriptorInfo, true));
 
         hidl_vec<uint8_t> vec;
-        ASSERT_EQ(Error::NONE, mGralloc->get(bufferHandle, metadataType, &vec));
+        const auto result = mGralloc->get(bufferHandle, metadataType, &vec);
+
+        if (metadataType == gralloc4::MetadataType_Smpte2094_10 && result == Error::UNSUPPORTED) {
+            GTEST_SKIP() << "getting metadata for Smpte2094-10 is unsupported";
+        }
+
+        ASSERT_EQ(Error::NONE, result);
 
         ASSERT_NO_FATAL_FAILURE(decode(descriptorInfo, vec));
     }
diff --git a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
index 34a87a6..97d9e84 100644
--- a/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/aidl_api/android.hardware.health/current/android/hardware/health/HealthInfo.aidl
@@ -37,6 +37,7 @@
   boolean chargerAcOnline;
   boolean chargerUsbOnline;
   boolean chargerWirelessOnline;
+  boolean chargerDockOnline;
   int maxChargingCurrentMicroamps;
   int maxChargingVoltageMicrovolts;
   android.hardware.health.BatteryStatus batteryStatus;
diff --git a/health/aidl/android/hardware/health/HealthInfo.aidl b/health/aidl/android/hardware/health/HealthInfo.aidl
index 504e218..5b98baf 100644
--- a/health/aidl/android/hardware/health/HealthInfo.aidl
+++ b/health/aidl/android/hardware/health/HealthInfo.aidl
@@ -40,6 +40,10 @@
      */
     boolean chargerWirelessOnline;
     /**
+     * Dock charger state - 'true' if online
+     */
+    boolean chargerDockOnline;
+    /**
      * Maximum charging current supported by charger in µA
      */
     int maxChargingCurrentMicroamps;
diff --git a/health/aidl/default/HalHealthLoop.cpp b/health/aidl/default/HalHealthLoop.cpp
index c9a081e..ec23c10 100644
--- a/health/aidl/default/HalHealthLoop.cpp
+++ b/health/aidl/default/HalHealthLoop.cpp
@@ -61,7 +61,7 @@
 
 void HalHealthLoop::set_charger_online(const HealthInfo& health_info) {
     charger_online_ = health_info.chargerAcOnline || health_info.chargerUsbOnline ||
-                      health_info.chargerWirelessOnline;
+                      health_info.chargerWirelessOnline || health_info.chargerDockOnline;
 }
 
 }  // namespace aidl::android::hardware::health
diff --git a/health/aidl/default/health-convert.cpp b/health/aidl/default/health-convert.cpp
index b5251f4..6118865 100644
--- a/health/aidl/default/health-convert.cpp
+++ b/health/aidl/default/health-convert.cpp
@@ -22,6 +22,7 @@
     p->chargerAcOnline = info.chargerAcOnline;
     p->chargerUsbOnline = info.chargerUsbOnline;
     p->chargerWirelessOnline = info.chargerWirelessOnline;
+    p->chargerDockOnline = info.chargerDockOnline;
     p->maxChargingCurrent = info.maxChargingCurrentMicroamps;
     p->maxChargingVoltage = info.maxChargingVoltageMicrovolts;
     p->batteryStatus = static_cast<int>(info.batteryStatus);
diff --git a/neuralnetworks/aidl/vts/functional/Android.bp b/neuralnetworks/aidl/vts/functional/Android.bp
index 1ed15b8..356cdb0 100644
--- a/neuralnetworks/aidl/vts/functional/Android.bp
+++ b/neuralnetworks/aidl/vts/functional/Android.bp
@@ -30,6 +30,7 @@
         "neuralnetworks_vts_functional_defaults",
         "use_libaidlvintf_gtest_helper_static",
     ],
+    host_supported: true,
     srcs: [
         "BasicTests.cpp",
         "Callbacks.cpp",
@@ -46,18 +47,11 @@
     ],
     shared_libs: [
         "libbinder_ndk",
-        "libnativewindow",
-        "libvndksupport",
     ],
     static_libs: [
-        "android.hidl.allocator@1.0",
-        "android.hidl.memory@1.0",
         "libaidlcommonsupport",
-        "libgmock",
-        "libhidlmemory",
         "libneuralnetworks_common",
         "libneuralnetworks_generated_test_harness",
-        "libsync",
     ],
     whole_static_libs: [
         "neuralnetworks_generated_AIDL_V3_example",
@@ -73,6 +67,34 @@
     ],
     test_suites: [
         "general-tests",
-        "vts",
     ],
+    target: {
+        android: {
+            shared_libs: [
+                "libnativewindow",
+                "libvndksupport",
+            ],
+            static_libs: [
+                "libsync",
+            ],
+            test_suites: [
+                "vts",
+            ],
+            test_config: "AndroidTestDevice.xml",
+        },
+        host: {
+            shared_libs: [
+                "libtextclassifier_hash",
+            ],
+            static_libs: [
+                "neuralnetworks_canonical_sample_driver",
+                "neuralnetworks_utils_hal_adapter_aidl",
+            ],
+            exclude_static_libs: [
+                "VtsHalHidlTestUtils",
+                "libaidlvintf_gtest_helper",
+            ],
+            test_config: "AndroidTestHost.xml",
+        },
+    },
 }
diff --git a/neuralnetworks/aidl/vts/functional/AndroidTest.xml b/neuralnetworks/aidl/vts/functional/AndroidTestDevice.xml
similarity index 100%
rename from neuralnetworks/aidl/vts/functional/AndroidTest.xml
rename to neuralnetworks/aidl/vts/functional/AndroidTestDevice.xml
diff --git a/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml b/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml
new file mode 100644
index 0000000..7372a31
--- /dev/null
+++ b/neuralnetworks/aidl/vts/functional/AndroidTestHost.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2022 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Runs VtsHalNeuralnetworksTargetTest.">
+    <test class="com.android.tradefed.testtype.HostGTest" >
+        <option name="module-name" value="VtsHalNeuralnetworksTargetTest" />
+        <option name="native-test-timeout" value="15m" />
+    </test>
+</configuration>
+
diff --git a/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp b/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
index 77208aa..7451f7e 100644
--- a/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
+++ b/neuralnetworks/aidl/vts/functional/CompilationCachingTests.cpp
@@ -23,7 +23,6 @@
 #include <fcntl.h>
 #include <ftw.h>
 #include <gtest/gtest.h>
-#include <hidlmemory/mapping.h>
 #include <unistd.h>
 
 #include <cstdio>
@@ -34,7 +33,6 @@
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
-#include "MemoryUtils.h"
 #include "TestHarness.h"
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
@@ -229,7 +227,11 @@
 
         // Create cache directory. The cache directory and a temporary cache file is always created
         // to test the behavior of prepareModelFromCache, even when caching is not supported.
+#ifdef __ANDROID__
         char cacheDirTemp[] = "/data/local/tmp/TestCompilationCachingXXXXXX";
+#else   // __ANDROID__
+        char cacheDirTemp[] = "/tmp/TestCompilationCachingXXXXXX";
+#endif  // __ANDROID__
         char* cacheDir = mkdtemp(cacheDirTemp);
         ASSERT_NE(cacheDir, nullptr);
         mCacheDir = cacheDir;
diff --git a/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp b/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
index 8c8a87a..40f6cd1 100644
--- a/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
+++ b/neuralnetworks/aidl/vts/functional/GeneratedTestHarness.cpp
@@ -20,7 +20,6 @@
 #include <aidl/android/hardware/neuralnetworks/RequestMemoryPool.h>
 #include <android-base/logging.h>
 #include <android/binder_auto_utils.h>
-#include <android/sync.h>
 #include <gtest/gtest.h>
 
 #include <algorithm>
@@ -30,7 +29,6 @@
 #include <numeric>
 #include <vector>
 
-#include <MemoryUtils.h>
 #include <android/binder_status.h>
 #include <nnapi/Result.h>
 #include <nnapi/SharedMemory.h>
@@ -43,6 +41,10 @@
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
 
+#ifdef __ANDROID__
+#include <android/sync.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks::vts::functional {
 
 namespace nn = ::android::nn;
@@ -281,10 +283,14 @@
 }  // namespace
 
 void waitForSyncFence(int syncFd) {
-    constexpr int kInfiniteTimeout = -1;
     ASSERT_GT(syncFd, 0);
+#ifdef __ANDROID__
+    constexpr int kInfiniteTimeout = -1;
     int r = sync_wait(syncFd, kInfiniteTimeout);
     ASSERT_GE(r, 0);
+#else   // __ANDROID__
+    LOG(FATAL) << "waitForSyncFence not supported on host";
+#endif  // __ANDROID__
 }
 
 Model createModel(const TestModel& testModel) {
@@ -895,7 +901,11 @@
             outputTypesList = {OutputType::FULLY_SPECIFIED};
             measureTimingList = {false};
             executorList = {Executor::SYNC, Executor::BURST, Executor::FENCED};
+#ifdef __ANDROID__
             memoryTypeList = {MemoryType::BLOB_AHWB, MemoryType::DEVICE};
+#else   // __ANDROID__
+            memoryTypeList = {MemoryType::DEVICE};  // BLOB_AHWB is not supported on the host.
+#endif  // __ANDROID__
         } break;
         case TestKind::FENCED_COMPUTE: {
             outputTypesList = {OutputType::FULLY_SPECIFIED};
diff --git a/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp b/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
index 97760ae..f8341b1 100644
--- a/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
+++ b/neuralnetworks/aidl/vts/functional/MemoryDomainTests.cpp
@@ -17,6 +17,7 @@
 #define LOG_TAG "neuralnetworks_aidl_hal_test"
 
 #include <aidl/android/hardware/graphics/common/PixelFormat.h>
+#include <aidl/android/hardware/neuralnetworks/IPreparedModel.h>
 #include <android-base/logging.h>
 #include <android/binder_auto_utils.h>
 #include <android/binder_interface_utils.h>
@@ -33,7 +34,6 @@
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
-#include "MemoryUtils.h"
 #include "Utils.h"
 #include "VtsHalNeuralnetworks.h"
 
@@ -191,7 +191,7 @@
 }
 
 // A placeholder invalid IPreparedModel class for MemoryDomainAllocateTest.InvalidPreparedModel
-class InvalidPreparedModel : public BnPreparedModel {
+class InvalidPreparedModel final : public IPreparedModel {
   public:
     ndk::ScopedAStatus executeSynchronously(const Request&, bool, int64_t, int64_t,
                                             ExecutionResult*) override {
@@ -225,6 +225,16 @@
         return ndk::ScopedAStatus::fromServiceSpecificError(
                 static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
     }
+    ndk::ScopedAStatus getInterfaceVersion(int32_t* /*interfaceVersion*/) {
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
+    }
+    ndk::ScopedAStatus getInterfaceHash(std::string* /*interfaceHash*/) {
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(ErrorStatus::GENERAL_FAILURE));
+    }
+    ndk::SpAIBinder asBinder() override { return ::ndk::SpAIBinder{}; }
+    bool isRemote() override { return true; }
 };
 
 template <typename... Args>
diff --git a/neuralnetworks/aidl/vts/functional/Utils.cpp b/neuralnetworks/aidl/vts/functional/Utils.cpp
index efd5bca..1bc76f2 100644
--- a/neuralnetworks/aidl/vts/functional/Utils.cpp
+++ b/neuralnetworks/aidl/vts/functional/Utils.cpp
@@ -21,18 +21,20 @@
 #include <aidl/android/hardware/neuralnetworks/OperandType.h>
 #include <android-base/logging.h>
 #include <android/binder_status.h>
-#include <android/hardware_buffer.h>
 
 #include <sys/mman.h>
 #include <iostream>
 #include <limits>
 #include <numeric>
 
-#include <MemoryUtils.h>
 #include <nnapi/SharedMemory.h>
 #include <nnapi/hal/aidl/Conversions.h>
 #include <nnapi/hal/aidl/Utils.h>
 
+#ifdef __ANDROID__
+#include <android/hardware_buffer.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks {
 
 using test_helper::TestBuffer;
@@ -140,7 +142,8 @@
     return ahwb->mIsValid ? std::move(ahwb) : nullptr;
 }
 
-void TestBlobAHWB::initialize(uint32_t size) {
+void TestBlobAHWB::initialize([[maybe_unused]] uint32_t size) {
+#ifdef __ANDROID__
     mIsValid = false;
     ASSERT_GT(size, 0);
     const auto usage = AHARDWAREBUFFER_USAGE_CPU_READ_OFTEN | AHARDWAREBUFFER_USAGE_CPU_WRITE_OFTEN;
@@ -164,6 +167,9 @@
     mAidlMemory = utils::convert(mMemory).value();
 
     mIsValid = true;
+#else   // __ANDROID__
+    LOG(FATAL) << "TestBlobAHWB::initialize not supported on host";
+#endif  // __ANDROID__
 }
 
 std::string gtestCompliantName(std::string name) {
diff --git a/neuralnetworks/aidl/vts/functional/Utils.h b/neuralnetworks/aidl/vts/functional/Utils.h
index 0db3f8c..4e0a4aa 100644
--- a/neuralnetworks/aidl/vts/functional/Utils.h
+++ b/neuralnetworks/aidl/vts/functional/Utils.h
@@ -18,7 +18,6 @@
 #define ANDROID_HARDWARE_NEURALNETWORKS_AIDL_UTILS_H
 
 #include <android-base/logging.h>
-#include <android/hardware_buffer.h>
 #include <gtest/gtest.h>
 
 #include <algorithm>
diff --git a/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp b/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
index ad93e6d..51b4805 100644
--- a/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
+++ b/neuralnetworks/aidl/vts/functional/VtsHalNeuralnetworks.cpp
@@ -15,6 +15,7 @@
  */
 
 #define LOG_TAG "neuralnetworks_aidl_hal_test"
+
 #include "VtsHalNeuralnetworks.h"
 
 #include <android-base/logging.h>
@@ -28,13 +29,19 @@
 #include <utility>
 
 #include <TestHarness.h>
-#include <aidl/Vintf.h>
 #include <nnapi/hal/aidl/Conversions.h>
 
 #include "Callbacks.h"
 #include "GeneratedTestHarness.h"
 #include "Utils.h"
 
+#ifdef __ANDROID__
+#include <aidl/Vintf.h>
+#else  // __ANDROID__
+#include <CanonicalDevice.h>
+#include <nnapi/hal/aidl/Adapter.h>
+#endif  // __ANDROID__
+
 namespace aidl::android::hardware::neuralnetworks::vts::functional {
 
 using implementation::PreparedModelCallback;
@@ -111,6 +118,7 @@
     ASSERT_TRUE(deviceIsResponsive);
 }
 
+#ifdef __ANDROID__
 static NamedDevice makeNamedDevice(const std::string& name) {
     ndk::SpAIBinder binder(AServiceManager_waitForService(name.c_str()));
     return {name, IDevice::fromBinder(binder)};
@@ -127,6 +135,14 @@
     std::transform(names.begin(), names.end(), std::back_inserter(namedDevices), makeNamedDevice);
     return namedDevices;
 }
+#else   // __ANDROID__
+static std::vector<NamedDevice> getNamedDevicesImpl() {
+    const std::string name = "nnapi-sample";
+    auto device = std::make_shared<const ::android::nn::sample::Device>(name);
+    auto aidlDevice = adapter::adapt(device);
+    return {{name, aidlDevice}};
+}
+#endif  // __ANDROID__
 
 const std::vector<NamedDevice>& getNamedDevices() {
     const static std::vector<NamedDevice> devices = getNamedDevicesImpl();
diff --git a/nfc/OWNERS b/nfc/OWNERS
new file mode 100644
index 0000000..7867204
--- /dev/null
+++ b/nfc/OWNERS
@@ -0,0 +1,6 @@
+# Bug component: 48448
+alisher@google.com
+georgekgchang@google.com
+jackcwyu@google.com
+
+
diff --git a/nfc/aidl/Android.bp b/nfc/aidl/Android.bp
new file mode 100644
index 0000000..d390c7e
--- /dev/null
+++ b/nfc/aidl/Android.bp
@@ -0,0 +1,34 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+aidl_interface {
+    name: "android.hardware.nfc",
+    vendor_available: true,
+    srcs: ["android/hardware/nfc/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+            enabled: false,
+        },
+        ndk: {
+            vndk: {
+                enabled: true,
+            },
+        },
+    },
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl
new file mode 100644
index 0000000..7a0ae54
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfc.aidl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@VintfStability
+interface INfc {
+  void open(in android.hardware.nfc.INfcClientCallback clientCallback);
+  void close(in android.hardware.nfc.NfcCloseType type);
+  void coreInitialized();
+  void factoryReset();
+  android.hardware.nfc.NfcConfig getConfig();
+  void powerCycle();
+  void preDiscover();
+  int write(in byte[] data);
+  void setEnableVerboseLogging(in boolean enable);
+  boolean isVerboseLoggingEnabled();
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl
new file mode 100644
index 0000000..8150e81
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/INfcClientCallback.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@VintfStability
+interface INfcClientCallback {
+  void sendData(in byte[] data);
+  void sendEvent(in android.hardware.nfc.NfcEvent event, in android.hardware.nfc.NfcStatus status);
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl
new file mode 100644
index 0000000..7d44d48
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcCloseType.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@Backing(type="int") @VintfStability
+enum NfcCloseType {
+  DISABLE = 0,
+  HOST_SWITCHED_OFF = 1,
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
new file mode 100644
index 0000000..92e0a9a
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcConfig.aidl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@VintfStability
+parcelable NfcConfig {
+  boolean nfaPollBailOutMode;
+  android.hardware.nfc.PresenceCheckAlgorithm presenceCheckAlgorithm;
+  android.hardware.nfc.ProtocolDiscoveryConfig nfaProprietaryCfg;
+  byte defaultOffHostRoute;
+  byte defaultOffHostRouteFelica;
+  byte defaultSystemCodeRoute;
+  byte defaultSystemCodePowerState;
+  byte defaultRoute;
+  byte offHostESEPipeId;
+  byte offHostSIMPipeId;
+  int maxIsoDepTransceiveLength;
+  byte[] hostAllowlist;
+  byte[] offHostRouteUicc;
+  byte[] offHostRouteEse;
+  byte defaultIsoDepRoute;
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl
new file mode 100644
index 0000000..dda258e
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcEvent.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@Backing(type="int") @VintfStability
+enum NfcEvent {
+  OPEN_CPLT = 0,
+  CLOSE_CPLT = 1,
+  POST_INIT_CPLT = 2,
+  PRE_DISCOVER_CPLT = 3,
+  HCI_NETWORK_RESET = 4,
+  ERROR = 5,
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl
new file mode 100644
index 0000000..2632480
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/NfcStatus.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@Backing(type="int") @VintfStability
+enum NfcStatus {
+  OK = 0,
+  FAILED = 1,
+  ERR_TRANSPORT = 2,
+  ERR_CMD_TIMEOUT = 3,
+  REFUSED = 4,
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl
new file mode 100644
index 0000000..9a9be21
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/PresenceCheckAlgorithm.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@Backing(type="byte") @VintfStability
+enum PresenceCheckAlgorithm {
+  DEFAULT = 0,
+  I_BLOCK = 1,
+  ISO_DEP_NAK = 2,
+}
diff --git a/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
new file mode 100644
index 0000000..021dfe2
--- /dev/null
+++ b/nfc/aidl/aidl_api/android.hardware.nfc/current/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.nfc;
+@VintfStability
+parcelable ProtocolDiscoveryConfig {
+  byte protocol18092Active;
+  byte protocolBPrime;
+  byte protocolDual;
+  byte protocol15693;
+  byte protocolKovio;
+  byte protocolMifare;
+  byte discoveryPollKovio;
+  byte discoveryPollBPrime;
+  byte discoveryListenBPrime;
+}
diff --git a/nfc/aidl/android/hardware/nfc/INfc.aidl b/nfc/aidl/android/hardware/nfc/INfc.aidl
new file mode 100644
index 0000000..662f8d4
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/INfc.aidl
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.INfcClientCallback;
+import android.hardware.nfc.NfcCloseType;
+import android.hardware.nfc.NfcConfig;
+import android.hardware.nfc.NfcStatus;
+
+@VintfStability
+interface INfc {
+    /**
+     * Opens the NFC controller device and performs initialization.
+     * This may include patch download and other vendor-specific initialization.
+     *
+     * If open completes successfully, the controller must be ready to perform NCI
+     * initialization - ie accept CORE_RESET and subsequent commands through the write()
+     * call.
+     *
+     * Returns ok() if initialization starts successfully.
+     * If open() returns ok(), the NCI stack must wait for a NfcEvent.OPEN_CPLT
+     * callback before continuing.
+     * If a NfcEvent.OPEN_CPLT callback received with status NfcStatus::OK, the controller
+     * must be ready to perform  NCI initialization - ie accept CORE_RESET and subsequent
+     * commands through the write() call.
+     */
+    void open(in INfcClientCallback clientCallback);
+
+    /**
+     * Close the NFC HAL and setup NFC controller close type.
+     * Associated resources such as clientCallback must be released.
+     * The clientCallback reference from open() must be invalid after close().
+     * If close() returns ok(), the NCI stack must wait for a NfcEvent.CLOSE_CPLT
+     * callback before continuing.
+     * Returns an error if close may be called more than once.
+     * Calls to any other method which expect a callback after this must return
+     * a service-specific error NfcStatus::FAILED.
+     * HAL close automatically if the client drops the reference to the HAL or
+     * crashes.
+     */
+    void close(in NfcCloseType type);
+
+    /**
+     * coreInitialized() is called after the CORE_INIT_RSP is received from the
+     * NFCC. At this time, the HAL can do any chip-specific configuration.
+     *
+     * If coreInitialized() returns ok(), the NCI stack must wait for a
+     * NfcEvent.POST_INIT_CPLT before continuing.
+     * If coreInitialized() returns an error, the NCI stack must continue immediately.
+     *
+     * coreInitialized() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     *
+     */
+    void coreInitialized();
+
+    /**
+     * Clears the NFC chip.
+     *
+     * Must be called during factory reset and/or before the first time the HAL is
+     * initialized after a factory reset.
+     */
+    void factoryReset();
+
+    /**
+     * Fetches vendor specific configurations.
+     * @return NfcConfig indicates support for certain features and
+     * populates the vendor specific configs.
+     */
+    NfcConfig getConfig();
+
+    /**
+     * Restart controller by power cyle;
+     * It's similar to open but just reset the controller without initialize all the
+     * resources.
+     *
+     * If powerCycle() returns ok(), the NCI stack must wait for a NfcEvent.OPEN_CPLT
+     * before continuing.
+     *
+     * powerCycle() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     */
+    void powerCycle();
+
+    /**
+     * preDiscover is called every time before starting RF discovery.
+     * It is a good place to do vendor-specific configuration that must be
+     * performed every time RF discovery is about to be started.
+     *
+     * If preDiscover() returns ok(), the NCI stack must wait for a
+     * NfcEvent.PREDISCOVER_CPLT before continuing.
+     *
+     * preDiscover() must be called after open() registers the clientCallback
+     * or return a service-specific error NfcStatus::FAILED directly.
+     *
+     * If preDiscover() reports an error, the NCI stack must start RF discovery immediately.
+     */
+    void preDiscover();
+
+    /**
+     * Performs an NCI write.
+     *
+     * This method may queue writes and return immediately. The only
+     * requirement is that the writes are executed in order.
+     *
+     * @param data
+     * Data packet to transmit NCI Commands and Data Messages over write.
+     * Detailed format is defined in NFC Controller Interface (NCI) Technical Specification.
+     * https://nfc-forum.org/our-work/specification-releases/
+     *
+     * @return number of bytes written to the NFCC.
+     */
+    int write(in byte[] data);
+
+    /**
+     * Set the logging flag for NFC HAL to enable it's verbose logging.
+     * If verbose logging is not supported, the call must not have any effect on logging verbosity.
+     * However, isVerboseLoggingEnabled() must still return the value set by the last call to
+     * setEnableVerboseLogging().
+     * @param enable for setting the verbose logging flag to HAL
+     */
+    void setEnableVerboseLogging(in boolean enable);
+
+    /**
+     * Get the verbose logging flag value from NFC HAL.
+     * @return true if verbose logging flag value is enabled, false if disabled.
+     */
+    boolean isVerboseLoggingEnabled();
+}
diff --git a/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl b/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl
new file mode 100644
index 0000000..43d4f5c
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/INfcClientCallback.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.NfcEvent;
+import android.hardware.nfc.NfcStatus;
+
+@VintfStability
+interface INfcClientCallback {
+    /**
+     * The callback passed in from the NFC stack that the HAL
+     * can use to pass incomming response data to the stack.
+     *
+     * @param data
+     * Data packet to transmit NCI Responses, Notifications, and Data
+     * Messages over sendData.
+     * Detailed format is defined in NFC Controller Interface (NCI) Technical Specification.
+     * https://nfc-forum.org/our-work/specification-releases/
+     */
+    void sendData(in byte[] data);
+
+    /**
+     * The callback passed in from the NFC stack that the HAL
+     * can use to pass events back to the stack.
+     */
+    void sendEvent(in NfcEvent event, in NfcStatus status);
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl b/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl
new file mode 100644
index 0000000..5160532
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcCloseType.aidl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Different closing types for NFC HAL.
+ */
+@VintfStability
+@Backing(type="int")
+enum NfcCloseType {
+    /**
+     * Close the NFC controller and free NFC HAL resources.
+     */
+    DISABLE = 0,
+
+    /**
+     * Switch the NFC controller operation mode and free NFC HAL resources.
+     * Enable NFC functionality for off host card emulation usecases in
+     * device(host) power off(switched off) state, if the device
+     * supports power off use cases. If the device doesn't support power
+     * off use cases, this call should be same as DISABLE.
+     */
+    HOST_SWITCHED_OFF = 1,
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcConfig.aidl b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
new file mode 100644
index 0000000..1b4fcfb
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcConfig.aidl
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+import android.hardware.nfc.PresenceCheckAlgorithm;
+import android.hardware.nfc.ProtocolDiscoveryConfig;
+
+/**
+ * Define Nfc related configurations based on:
+ * NFC Controller Interface (NCI) Technical Specification
+ * https://nfc-forum.org/our-work/specification-releases/
+ */
+@VintfStability
+parcelable NfcConfig {
+    /**
+     * If true, NFCC is using bail out mode for either Type A or Type B poll
+     * based on: Nfc-Forum Activity Technical Specification
+     * https://nfc-forum.org/our-work/specification-releases/
+     */
+    boolean nfaPollBailOutMode;
+    PresenceCheckAlgorithm presenceCheckAlgorithm;
+    ProtocolDiscoveryConfig nfaProprietaryCfg;
+    /**
+     * Default off-host route. 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte defaultOffHostRoute;
+    /**
+     * Default off-host route for Felica. 0x00 if there aren't any. Refer to
+     * NCI spec.
+     */
+    byte defaultOffHostRouteFelica;
+    /**
+     * Default system code route. 0x00 if there aren't any. Refer NCI spec.
+     */
+    byte defaultSystemCodeRoute;
+    /**
+     * Default power state for system code route. 0x00 if there aren't any.
+     * Refer to NCI spec.
+     */
+    byte defaultSystemCodePowerState;
+    /**
+     * Default route for all remaining protocols and technology which haven't
+     * been configured.
+     * Device Host(0x00) is the default. Refer to NCI spec.
+     *
+     */
+    byte defaultRoute;
+    /**
+     * Pipe ID for eSE. 0x00 if there aren't any.
+     */
+    byte offHostESEPipeId;
+    /**
+     * Pipe ID for UICC. 0x00 if there aren't any.
+     */
+    byte offHostSIMPipeId;
+    /**
+     * Extended APDU length for ISO_DEP. If not supported default length is 261
+     */
+    int maxIsoDepTransceiveLength;
+    /**
+     * list of allowed host ids, as per ETSI TS 102 622
+     * https://www.etsi.org/
+     */
+    byte[] hostAllowlist;
+    /**
+     * NFCEE ID for offhost UICC & eSE secure element.
+     * 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte[] offHostRouteUicc;
+    byte[] offHostRouteEse;
+    /**
+     * Default IsoDep route. 0x00 if there aren't any. Refer to NCI spec.
+     */
+    byte defaultIsoDepRoute;
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcEvent.aidl b/nfc/aidl/android/hardware/nfc/NfcEvent.aidl
new file mode 100644
index 0000000..a78b1cd
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcEvent.aidl
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Nfc event to notify nfc status change.
+ */
+@VintfStability
+@Backing(type="int")
+enum NfcEvent {
+    /**
+     * Open complete event to notify upper layer when NFC HAL and NFCC
+     * initialization complete.
+     */
+    OPEN_CPLT = 0,
+    /**
+     * Close complete event to notify upper layer when HAL close is done.
+     */
+    CLOSE_CPLT = 1,
+    /**
+     * Post init complete event to notify upper layer when post init operations
+     * are done.
+     */
+    POST_INIT_CPLT = 2,
+    /**
+     * Pre-discover complete event to notify upper layer when pre-discover
+     * operations are done.
+     */
+    PRE_DISCOVER_CPLT = 3,
+    /**
+     * HCI network reset event to notify upplayer when HCI network needs to
+     * be re-initialized in case of an error.
+     */
+    HCI_NETWORK_RESET = 4,
+    /**
+     * Error event to notify upper layer when there's an unknown error.
+     */
+    ERROR = 5,
+}
diff --git a/nfc/aidl/android/hardware/nfc/NfcStatus.aidl b/nfc/aidl/android/hardware/nfc/NfcStatus.aidl
new file mode 100644
index 0000000..a38d370
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/NfcStatus.aidl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Used to specify the status of the NfcEvent
+ */
+@VintfStability
+@Backing(type="int")
+enum NfcStatus {
+    /**
+     * Default status when NfcEvent with status OK.
+     */
+    OK = 0,
+    /**
+     * Generic error.
+     */
+    FAILED = 1,
+    /**
+     * Transport error.
+     */
+    ERR_TRANSPORT = 2,
+    /**
+     * Command timeout error.
+     */
+    ERR_CMD_TIMEOUT = 3,
+    /**
+     * Refused error when command is rejected.
+     */
+    REFUSED = 4,
+}
diff --git a/nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl b/nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl
new file mode 100644
index 0000000..20e7bff
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/PresenceCheckAlgorithm.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/*
+ * Presence Check Algorithm as defined in ISO/IEC 14443-4:
+ * https://www.iso.org/standard/73599.html
+ */
+@VintfStability
+@Backing(type="byte")
+enum PresenceCheckAlgorithm {
+    /**
+     * Let the stack select an algorithm
+     */
+    DEFAULT = 0,
+    /**
+     * ISO-DEP protocol's empty I-block
+     */
+    I_BLOCK = 1,
+    /**
+     * Type - 4 tag protocol iso-dep nak presence check command is sent waiting for
+     * response and notification.
+     */
+    ISO_DEP_NAK = 2,
+}
diff --git a/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
new file mode 100644
index 0000000..f8e3228
--- /dev/null
+++ b/nfc/aidl/android/hardware/nfc/ProtocolDiscoveryConfig.aidl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.nfc;
+
+/**
+ * Vendor Specific Proprietary Protocol & Discovery Configuration.
+ * Set to 0xFF if not supported.
+ * discovery* fields map to "RF Technology and Mode" in NCI Spec
+ * protocol* fields map to "RF protocols" in NCI Spec
+ */
+@VintfStability
+parcelable ProtocolDiscoveryConfig {
+    byte protocol18092Active;
+    byte protocolBPrime;
+    byte protocolDual;
+    byte protocol15693;
+    byte protocolKovio;
+    byte protocolMifare;
+    byte discoveryPollKovio;
+    byte discoveryPollBPrime;
+    byte discoveryListenBPrime;
+}
diff --git a/nfc/aidl/default/Android.bp b/nfc/aidl/default/Android.bp
new file mode 100644
index 0000000..907d23d
--- /dev/null
+++ b/nfc/aidl/default/Android.bp
@@ -0,0 +1,23 @@
+cc_binary {
+    name: "android.hardware.nfc-service.example",
+    relative_install_path: "hw",
+    init_rc: ["nfc-service-example.rc"],
+    vintf_fragments: ["nfc-service-example.xml"],
+    vendor: true,
+    cflags: [
+        "-Wall",
+        "-Wextra",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libutils",
+        "libbinder_ndk",
+        "android.hardware.nfc-V1-ndk",
+    ],
+    srcs: [
+        "main.cpp",
+        "Nfc.cpp",
+        "Vendor_hal_api.cpp",
+    ],
+}
diff --git a/nfc/aidl/default/Nfc.cpp b/nfc/aidl/default/Nfc.cpp
new file mode 100644
index 0000000..a31ac5e
--- /dev/null
+++ b/nfc/aidl/default/Nfc.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Nfc.h"
+
+#include <android-base/logging.h>
+
+#include "Vendor_hal_api.h"
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace nfc {
+
+std::shared_ptr<INfcClientCallback> Nfc::mCallback = nullptr;
+AIBinder_DeathRecipient* clientDeathRecipient = nullptr;
+
+void OnDeath(void* cookie) {
+    if (Nfc::mCallback != nullptr && !AIBinder_isAlive(Nfc::mCallback->asBinder().get())) {
+        LOG(INFO) << __func__ << " Nfc service has died";
+        Nfc* nfc = static_cast<Nfc*>(cookie);
+        nfc->close(NfcCloseType::DISABLE);
+    }
+}
+
+::ndk::ScopedAStatus Nfc::open(const std::shared_ptr<INfcClientCallback>& clientCallback) {
+    LOG(INFO) << "open";
+    if (clientCallback == nullptr) {
+        LOG(INFO) << "Nfc::open null callback";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    } else {
+        Nfc::mCallback = clientCallback;
+
+        clientDeathRecipient = AIBinder_DeathRecipient_new(OnDeath);
+        auto linkRet = AIBinder_linkToDeath(clientCallback->asBinder().get(), clientDeathRecipient,
+                                            this /* cookie */);
+        if (linkRet != STATUS_OK) {
+            LOG(ERROR) << __func__ << ": linkToDeath failed: " << linkRet;
+            // Just ignore the error.
+        }
+
+        int ret = Vendor_hal_open(eventCallback, dataCallback);
+        return ret == 0 ? ndk::ScopedAStatus::ok()
+                        : ndk::ScopedAStatus::fromServiceSpecificError(
+                                  static_cast<int32_t>(NfcStatus::FAILED));
+        return ndk::ScopedAStatus::ok();
+    }
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::close(NfcCloseType type) {
+    LOG(INFO) << "close";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    int ret = 0;
+    if (type == NfcCloseType::HOST_SWITCHED_OFF) {
+        ret = Vendor_hal_close_off();
+    } else {
+        ret = Vendor_hal_close();
+    }
+    Nfc::mCallback = nullptr;
+    AIBinder_DeathRecipient_delete(clientDeathRecipient);
+    clientDeathRecipient = nullptr;
+    return ret == 0 ? ndk::ScopedAStatus::ok()
+                    : ndk::ScopedAStatus::fromServiceSpecificError(
+                              static_cast<int32_t>(NfcStatus::FAILED));
+}
+
+::ndk::ScopedAStatus Nfc::coreInitialized() {
+    LOG(INFO) << "coreInitialized";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    int ret = Vendor_hal_core_initialized();
+
+    return ret == 0 ? ndk::ScopedAStatus::ok()
+                    : ndk::ScopedAStatus::fromServiceSpecificError(
+                              static_cast<int32_t>(NfcStatus::FAILED));
+}
+
+::ndk::ScopedAStatus Nfc::factoryReset() {
+    LOG(INFO) << "factoryReset";
+    Vendor_hal_factoryReset();
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::getConfig(NfcConfig* _aidl_return) {
+    LOG(INFO) << "getConfig";
+    NfcConfig nfcVendorConfig;
+    Vendor_hal_getConfig(nfcVendorConfig);
+
+    *_aidl_return = nfcVendorConfig;
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::powerCycle() {
+    LOG(INFO) << "powerCycle";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    return Vendor_hal_power_cycle() ? ndk::ScopedAStatus::fromServiceSpecificError(
+                                              static_cast<int32_t>(NfcStatus::FAILED))
+                                    : ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::preDiscover() {
+    LOG(INFO) << "preDiscover";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    return Vendor_hal_pre_discover() ? ndk::ScopedAStatus::fromServiceSpecificError(
+                                               static_cast<int32_t>(NfcStatus::FAILED))
+                                     : ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::write(const std::vector<uint8_t>& data, int32_t* _aidl_return) {
+    LOG(INFO) << "write";
+    if (Nfc::mCallback == nullptr) {
+        LOG(ERROR) << __func__ << "mCallback null";
+        return ndk::ScopedAStatus::fromServiceSpecificError(
+                static_cast<int32_t>(NfcStatus::FAILED));
+    }
+    *_aidl_return = Vendor_hal_write(data.size(), &data[0]);
+    return ndk::ScopedAStatus::ok();
+}
+::ndk::ScopedAStatus Nfc::setEnableVerboseLogging(bool enable) {
+    LOG(INFO) << "setVerboseLogging";
+    Vendor_hal_setVerboseLogging(enable);
+    return ndk::ScopedAStatus::ok();
+}
+
+::ndk::ScopedAStatus Nfc::isVerboseLoggingEnabled(bool* _aidl_return) {
+    *_aidl_return = Vendor_hal_getVerboseLogging();
+    return ndk::ScopedAStatus::ok();
+}
+
+}  // namespace nfc
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/nfc/aidl/default/Nfc.h b/nfc/aidl/default/Nfc.h
new file mode 100644
index 0000000..1b14534
--- /dev/null
+++ b/nfc/aidl/default/Nfc.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/nfc/BnNfc.h>
+#include <aidl/android/hardware/nfc/INfcClientCallback.h>
+#include <android-base/logging.h>
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace nfc {
+
+using ::aidl::android::hardware::nfc::NfcCloseType;
+using ::aidl::android::hardware::nfc::NfcConfig;
+using ::aidl::android::hardware::nfc::NfcStatus;
+
+// Default implementation that reports no support NFC.
+struct Nfc : public BnNfc {
+  public:
+    Nfc() = default;
+
+    ::ndk::ScopedAStatus open(const std::shared_ptr<INfcClientCallback>& clientCallback) override;
+    ::ndk::ScopedAStatus close(NfcCloseType type) override;
+    ::ndk::ScopedAStatus coreInitialized() override;
+    ::ndk::ScopedAStatus factoryReset() override;
+    ::ndk::ScopedAStatus getConfig(NfcConfig* _aidl_return) override;
+    ::ndk::ScopedAStatus powerCycle() override;
+    ::ndk::ScopedAStatus preDiscover() override;
+    ::ndk::ScopedAStatus write(const std::vector<uint8_t>& data, int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus setEnableVerboseLogging(bool enable) override;
+    ::ndk::ScopedAStatus isVerboseLoggingEnabled(bool* _aidl_return) override;
+
+    static void eventCallback(uint8_t event, uint8_t status) {
+        if (mCallback != nullptr) {
+            auto ret = mCallback->sendEvent((NfcEvent)event, (NfcStatus)status);
+            if (!ret.isOk()) {
+                LOG(ERROR) << "Failed to send event!";
+            }
+        }
+    }
+
+    static void dataCallback(uint16_t data_len, uint8_t* p_data) {
+        std::vector<uint8_t> data(p_data, p_data + data_len);
+        if (mCallback != nullptr) {
+            auto ret = mCallback->sendData(data);
+            if (!ret.isOk()) {
+                LOG(ERROR) << "Failed to send data!";
+            }
+        }
+    }
+
+    static std::shared_ptr<INfcClientCallback> mCallback;
+};
+
+}  // namespace nfc
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/nfc/aidl/default/Vendor_hal_api.cpp b/nfc/aidl/default/Vendor_hal_api.cpp
new file mode 100644
index 0000000..66a2ebc
--- /dev/null
+++ b/nfc/aidl/default/Vendor_hal_api.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/properties.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <string.h>
+
+#include "Vendor_hal_api.h"
+
+bool logging = false;
+
+int Vendor_hal_open(nfc_stack_callback_t* p_cback, nfc_stack_data_callback_t* p_data_cback) {
+    (void)p_cback;
+    (void)p_data_cback;
+    // nothing to open in this example
+    return -1;
+}
+
+int Vendor_hal_write(uint16_t data_len, const uint8_t* p_data) {
+    (void)data_len;
+    (void)p_data;
+    return -1;
+}
+
+int Vendor_hal_core_initialized() {
+    return -1;
+}
+
+int Vendor_hal_pre_discover() {
+    return -1;
+}
+
+int Vendor_hal_close() {
+    return -1;
+}
+
+int Vendor_hal_close_off() {
+    return -1;
+}
+
+int Vendor_hal_power_cycle() {
+    return -1;
+}
+
+void Vendor_hal_factoryReset() {}
+
+void Vendor_hal_getConfig(NfcConfig& config) {
+    (void)config;
+}
+
+void Vendor_hal_setVerboseLogging(bool enable) {
+    logging = enable;
+}
+
+bool Vendor_hal_getVerboseLogging() {
+    return logging;
+}
diff --git a/nfc/aidl/default/Vendor_hal_api.h b/nfc/aidl/default/Vendor_hal_api.h
new file mode 100644
index 0000000..595c2dd
--- /dev/null
+++ b/nfc/aidl/default/Vendor_hal_api.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <aidl/android/hardware/nfc/INfc.h>
+#include <aidl/android/hardware/nfc/NfcConfig.h>
+#include <aidl/android/hardware/nfc/NfcEvent.h>
+#include <aidl/android/hardware/nfc/NfcStatus.h>
+#include <aidl/android/hardware/nfc/PresenceCheckAlgorithm.h>
+#include <aidl/android/hardware/nfc/ProtocolDiscoveryConfig.h>
+#include "hardware_nfc.h"
+
+using aidl::android::hardware::nfc::NfcConfig;
+using aidl::android::hardware::nfc::NfcEvent;
+using aidl::android::hardware::nfc::NfcStatus;
+using aidl::android::hardware::nfc::PresenceCheckAlgorithm;
+using aidl::android::hardware::nfc::ProtocolDiscoveryConfig;
+
+int Vendor_hal_open(nfc_stack_callback_t* p_cback, nfc_stack_data_callback_t* p_data_cback);
+int Vendor_hal_write(uint16_t data_len, const uint8_t* p_data);
+
+int Vendor_hal_core_initialized();
+
+int Vendor_hal_pre_discover();
+
+int Vendor_hal_close();
+
+int Vendor_hal_close_off();
+
+int Vendor_hal_power_cycle();
+
+void Vendor_hal_factoryReset();
+
+void Vendor_hal_getConfig(NfcConfig& config);
+
+void Vendor_hal_setVerboseLogging(bool enable);
+
+bool Vendor_hal_getVerboseLogging();
diff --git a/nfc/aidl/default/hardware_nfc.h b/nfc/aidl/default/hardware_nfc.h
new file mode 100644
index 0000000..0f856c5
--- /dev/null
+++ b/nfc/aidl/default/hardware_nfc.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+typedef uint8_t nfc_event_t;
+typedef uint8_t nfc_status_t;
+
+/*
+ * The callback passed in from the NFC stack that the HAL
+ * can use to pass events back to the stack.
+ */
+typedef void(nfc_stack_callback_t)(nfc_event_t event, nfc_status_t event_status);
+
+/*
+ * The callback passed in from the NFC stack that the HAL
+ * can use to pass incomming data to the stack.
+ */
+typedef void(nfc_stack_data_callback_t)(uint16_t data_len, uint8_t* p_data);
diff --git a/nfc/aidl/default/main.cpp b/nfc/aidl/default/main.cpp
new file mode 100644
index 0000000..0cc51e7
--- /dev/null
+++ b/nfc/aidl/default/main.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include "Nfc.h"
+using ::aidl::android::hardware::nfc::Nfc;
+
+int main() {
+    LOG(INFO) << "NFC HAL starting up";
+    if (!ABinderProcess_setThreadPoolMaxThreadCount(1)) {
+        LOG(INFO) << "failed to set thread pool max thread count";
+        return 1;
+    }
+    std::shared_ptr<Nfc> nfc_service = ndk::SharedRefBase::make<Nfc>();
+
+    const std::string instance = std::string() + Nfc::descriptor + "/default";
+    binder_status_t status =
+            AServiceManager_addService(nfc_service->asBinder().get(), instance.c_str());
+    CHECK(status == STATUS_OK);
+    ABinderProcess_joinThreadPool();
+    return 0;
+}
diff --git a/nfc/aidl/default/nfc-service-example.rc b/nfc/aidl/default/nfc-service-example.rc
new file mode 100644
index 0000000..7d7052e
--- /dev/null
+++ b/nfc/aidl/default/nfc-service-example.rc
@@ -0,0 +1,4 @@
+service nfc_hal_service /vendor/bin/hw/android.hardware.nfc-service.st
+    class hal
+    user nfc
+    group nfc
diff --git a/nfc/aidl/default/nfc-service-example.xml b/nfc/aidl/default/nfc-service-example.xml
new file mode 100644
index 0000000..70fed20
--- /dev/null
+++ b/nfc/aidl/default/nfc-service-example.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.nfc</name>
+        <fqname>INfc/default</fqname>
+    </hal>
+</manifest>
diff --git a/nfc/aidl/vts/functional/Android.bp b/nfc/aidl/vts/functional/Android.bp
new file mode 100644
index 0000000..99eecd0
--- /dev/null
+++ b/nfc/aidl/vts/functional/Android.bp
@@ -0,0 +1,46 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsAidlHalNfcTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: [
+        "VtsAidlHalNfcTargetTest.cpp",
+    ],
+    shared_libs: [
+        "libbinder",
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.nfc-V1-ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp b/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp
new file mode 100644
index 0000000..977b25c
--- /dev/null
+++ b/nfc/aidl/vts/functional/VtsAidlHalNfcTargetTest.cpp
@@ -0,0 +1,458 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "nfc_aidl_hal_test"
+
+#include <aidl/Gtest.h>
+#include <aidl/Vintf.h>
+#include <aidl/android/hardware/nfc/BnNfc.h>
+#include <aidl/android/hardware/nfc/BnNfcClientCallback.h>
+#include <aidl/android/hardware/nfc/INfc.h>
+#include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+#include <android/binder_auto_utils.h>
+#include <android/binder_enums.h>
+#include <android/binder_interface_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include <chrono>
+#include <future>
+
+using aidl::android::hardware::nfc::INfc;
+using aidl::android::hardware::nfc::INfcClientCallback;
+using aidl::android::hardware::nfc::NfcCloseType;
+using aidl::android::hardware::nfc::NfcConfig;
+using aidl::android::hardware::nfc::NfcEvent;
+using aidl::android::hardware::nfc::NfcStatus;
+using aidl::android::hardware::nfc::PresenceCheckAlgorithm;
+
+using android::getAidlHalInstanceNames;
+using android::PrintInstanceNameToString;
+using android::base::StringPrintf;
+using ndk::enum_range;
+using ndk::ScopedAStatus;
+using ndk::SharedRefBase;
+using ndk::SpAIBinder;
+
+constexpr static int kCallbackTimeoutMs = 10000;
+
+// 261 bytes is the default and minimum transceive length
+constexpr unsigned int MIN_ISO_DEP_TRANSCEIVE_LENGTH = 261;
+
+// Range of valid off host route ids
+constexpr uint8_t MIN_OFFHOST_ROUTE_ID = 0x01;
+constexpr uint8_t MAX_OFFHOST_ROUTE_ID = 0xFE;
+
+class NfcClientCallback : public aidl::android::hardware::nfc::BnNfcClientCallback {
+  public:
+    NfcClientCallback(const std::function<void(NfcEvent, NfcStatus)>& on_hal_event_cb,
+                      const std::function<void(const std::vector<uint8_t>&)>& on_nci_data_cb)
+        : on_nci_data_cb_(on_nci_data_cb), on_hal_event_cb_(on_hal_event_cb) {}
+    virtual ~NfcClientCallback() = default;
+
+    ::ndk::ScopedAStatus sendEvent(NfcEvent event, NfcStatus event_status) override {
+        on_hal_event_cb_(event, event_status);
+        return ::ndk::ScopedAStatus::ok();
+    };
+    ::ndk::ScopedAStatus sendData(const std::vector<uint8_t>& data) override {
+        on_nci_data_cb_(data);
+        return ::ndk::ScopedAStatus::ok();
+    };
+
+  private:
+    std::function<void(const std::vector<uint8_t>&)> on_nci_data_cb_;
+    std::function<void(NfcEvent, NfcStatus)> on_hal_event_cb_;
+};
+
+class NfcAidl : public testing::TestWithParam<std::string> {
+  public:
+    void SetUp() override {
+        SpAIBinder binder(AServiceManager_waitForService(GetParam().c_str()));
+        infc_ = INfc::fromBinder(binder);
+        ASSERT_NE(infc_, nullptr);
+    }
+    std::shared_ptr<INfc> infc_;
+};
+
+/*
+ * OpenAndCloseForDisable:
+ * Makes an open call, waits for NfcEvent::OPEN_CPLT
+ * Immediately calls close(NfcCloseType::DISABLE) and
+ * waits for NfcEvent::CLOSE_CPLT
+ *
+ */
+TEST_P(NfcAidl, OpenAndCloseForDisable) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                LOG(INFO) << StringPrintf("%s,%d ", __func__, event);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close DISABLE";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    LOG(INFO) << "wait for close";
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * OpenAndCloseForHostSwitchedOff:
+ * Makes an open call, waits for NfcEvent::OPEN_CPLT
+ * Immediately calls close(NfcCloseType::HOST_SWITCHED_OFF) and
+ * waits for NfcEvent::CLOSE_CPLT
+ *
+ */
+TEST_P(NfcAidl, OpenAndCloseForHostSwitchedOff) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close HOST_SWITCHED_OFF";
+    EXPECT_TRUE(infc_->close(NfcCloseType::HOST_SWITCHED_OFF).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * OpenAfterOpen:
+ * Calls open() multiple times
+ * Checks status
+ */
+TEST_P(NfcAidl, OpenAfterOpen) {
+    int open_count = 0;
+    std::promise<void> open_cb_promise;
+    std::promise<void> open2_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto open2_cb_future = open2_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &open2_cb_promise, &open_count](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) {
+                    open_count == 0 ? open_cb_promise.set_value() : open2_cb_promise.set_value();
+                    open_count++;
+                }
+            },
+            [](auto) {});
+
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Open again and wait for OPEN_CPLT
+    LOG(INFO) << "open again";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open2_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * CloseAfterClose:
+ * Calls close() multiple times
+ * Checks status
+ */
+TEST_P(NfcAidl, CloseAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+    // Close again should fail.
+    LOG(INFO) << "close again";
+    EXPECT_TRUE(!(infc_->close(NfcCloseType::DISABLE).isOk()));
+}
+
+/*
+ * PowerCycleAfterOpen:
+ * Calls powerCycle() after open
+ * Waits for NfcEvent.OPEN_CPLT
+ * Checks status
+ */
+TEST_P(NfcAidl, PowerCycleAfterOpen) {
+    int open_cplt_count = 0;
+    std::promise<void> open_cb_promise;
+    std::promise<void> power_cycle_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto power_cycle_cb_future = power_cycle_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise, &power_cycle_cb_promise, &open_cplt_count](
+                    auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) {
+                    if (open_cplt_count == 0) {
+                        open_cplt_count++;
+                        open_cb_promise.set_value();
+                    } else {
+                        power_cycle_cb_promise.set_value();
+                    }
+                }
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // PowerCycle and wait for OPEN_CPLT
+    LOG(INFO) << "PowerCycle";
+    EXPECT_TRUE(infc_->powerCycle().isOk());
+    EXPECT_EQ(power_cycle_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * PowerCycleAfterClose:
+ * Calls powerCycle() after close
+ * PowerCycle should fail immediately
+ */
+TEST_P(NfcAidl, PowerCycleAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // PowerCycle should fail
+    LOG(INFO) << "PowerCycle";
+    EXPECT_TRUE(!(infc_->powerCycle().isOk()));
+}
+
+/*
+ * CoreInitializedAfterOpen:
+ * Calls coreInitialized() after open
+ * Waits for NfcEvent.POST_INIT_CPLT
+ */
+TEST_P(NfcAidl, CoreInitializedAfterOpen) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> core_init_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto core_init_cb_future = core_init_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise, &core_init_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::POST_INIT_CPLT) core_init_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // CoreInitialized and wait for POST_INIT_CPLT
+    LOG(INFO) << "coreInitialized";
+    EXPECT_TRUE(infc_->coreInitialized().isOk());
+    EXPECT_EQ(core_init_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+}
+
+/*
+ * CoreInitializedAfterClose:
+ * Calls coreInitialized() after close
+ * coreInitialized() should fail immediately
+ */
+TEST_P(NfcAidl, CoreInitializedAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // coreInitialized should fail
+    LOG(INFO) << "CoreInitialized";
+    EXPECT_TRUE(!(infc_->coreInitialized().isOk()));
+}
+
+/*
+ * PreDiscoverAfterClose:
+ * Call preDiscover() after close
+ * preDiscover() should fail immediately
+ */
+TEST_P(NfcAidl, PreDiscoverAfterClose) {
+    std::promise<void> open_cb_promise;
+    std::promise<void> close_cb_promise;
+    auto open_cb_future = open_cb_promise.get_future();
+    auto close_cb_future = close_cb_promise.get_future();
+    std::shared_ptr<INfcClientCallback> mCallback = ::ndk::SharedRefBase::make<NfcClientCallback>(
+            [&open_cb_promise, &close_cb_promise](auto event, auto status) {
+                EXPECT_EQ(status, NfcStatus::OK);
+                if (event == NfcEvent::OPEN_CPLT) open_cb_promise.set_value();
+                if (event == NfcEvent::CLOSE_CPLT) close_cb_promise.set_value();
+            },
+            [](auto) {});
+    std::chrono::milliseconds timeout{kCallbackTimeoutMs};
+    // Open and wait for OPEN_CPLT
+    LOG(INFO) << "open";
+    EXPECT_TRUE(infc_->open(mCallback).isOk());
+    EXPECT_EQ(open_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // Close and wait for CLOSE_CPLT
+    LOG(INFO) << "close";
+    EXPECT_TRUE(infc_->close(NfcCloseType::DISABLE).isOk());
+    EXPECT_EQ(close_cb_future.wait_for(timeout), std::future_status::ready);
+
+    // preDiscover should fail
+    LOG(INFO) << "preDiscover";
+    EXPECT_TRUE(!(infc_->preDiscover().isOk()));
+}
+
+/*
+ * checkGetConfigValues:
+ * Calls getConfig()
+ * checks if fields in NfcConfig are populated correctly
+ */
+TEST_P(NfcAidl, CheckGetConfigValues) {
+    NfcConfig configValue;
+    EXPECT_TRUE(infc_->getConfig(&configValue).isOk());
+    EXPECT_GE(configValue.maxIsoDepTransceiveLength, MIN_ISO_DEP_TRANSCEIVE_LENGTH);
+    LOG(INFO) << StringPrintf("configValue.maxIsoDepTransceiveLength = %x",
+                              configValue.maxIsoDepTransceiveLength);
+    for (auto uicc : configValue.offHostRouteUicc) {
+        LOG(INFO) << StringPrintf("offHostRouteUicc = %x", uicc);
+        EXPECT_GE(uicc, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE(uicc, MAX_OFFHOST_ROUTE_ID);
+    }
+    for (auto ese : configValue.offHostRouteEse) {
+        LOG(INFO) << StringPrintf("offHostRouteEse = %x", ese);
+        EXPECT_GE(ese, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE(ese, MAX_OFFHOST_ROUTE_ID);
+    }
+    if (configValue.defaultIsoDepRoute != 0) {
+        EXPECT_GE((uint8_t)configValue.defaultIsoDepRoute, MIN_OFFHOST_ROUTE_ID);
+        EXPECT_LE((uint8_t)configValue.defaultIsoDepRoute, MAX_OFFHOST_ROUTE_ID);
+    }
+}
+
+/*
+ * CheckisVerboseLoggingEnabledAfterSetEnableVerboseLogging:
+ * Calls setEnableVerboseLogging()
+ * checks the return value of isVerboseLoggingEnabled
+ */
+TEST_P(NfcAidl, CheckisVerboseLoggingEnabledAfterSetEnableVerboseLogging) {
+    bool enabled = false;
+    EXPECT_TRUE(infc_->setEnableVerboseLogging(true).isOk());
+    EXPECT_TRUE(infc_->isVerboseLoggingEnabled(&enabled).isOk());
+    EXPECT_TRUE(enabled);
+    EXPECT_TRUE(infc_->setEnableVerboseLogging(false).isOk());
+    EXPECT_TRUE(infc_->isVerboseLoggingEnabled(&enabled).isOk());
+    EXPECT_TRUE(!enabled);
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(NfcAidl);
+INSTANTIATE_TEST_SUITE_P(Nfc, NfcAidl,
+                         testing::ValuesIn(::android::getAidlHalInstanceNames(INfc::descriptor)),
+                         ::android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_startThreadPool();
+    std::system("/system/bin/svc nfc disable"); /* Turn off NFC */
+    sleep(5);
+    int status = RUN_ALL_TESTS();
+    LOG(INFO) << "Test result = " << status;
+    std::system("/system/bin/svc nfc enable"); /* Turn on NFC */
+    sleep(5);
+    return status;
+}
diff --git a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
index 9846ee9..4b63799 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
@@ -96,7 +96,9 @@
  *      - TRUSTED_ENVRIONMENT IKeyMintDevices must support curve 25519 for Purpose::SIGN (Ed25519,
  *        as specified in RFC 8032), Purpose::ATTEST_KEY (Ed25519) or for KeyPurpose::AGREE_KEY
  *        (X25519, as specified in RFC 7748).  However, a key must have exactly one of these
- *        purpose values; the same key cannot be used for multiple purposes.
+ *        purpose values; the same key cannot be used for multiple purposes. Signing operations
+ *        (Purpose::SIGN) have a message size limit of 16 KiB; operations on messages longer than
+ *        this limit must fail with ErrorCode::INVALID_INPUT_LENGTH.
  *        STRONGBOX IKeyMintDevices do not support curve 25519.
  *
  * o   AES
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
index 374f2da..146a527 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp
@@ -25,6 +25,7 @@
 #include <cppbor_parse.h>
 #include <cutils/properties.h>
 #include <gmock/gmock.h>
+#include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <remote_prov/remote_prov_utils.h>
 
@@ -206,6 +207,21 @@
     return boot_patch_level(key_characteristics_);
 }
 
+bool KeyMintAidlTestBase::Curve25519Supported() {
+    // Strongbox never supports curve 25519.
+    if (SecLevel() == SecurityLevel::STRONGBOX) {
+        return false;
+    }
+
+    // Curve 25519 was included in version 2 of the KeyMint interface.
+    int32_t version = 0;
+    auto status = keymint_->getInterfaceVersion(&version);
+    if (!status.isOk()) {
+        ADD_FAILURE() << "Failed to determine interface version";
+    }
+    return version >= 2;
+}
+
 ErrorCode KeyMintAidlTestBase::GetReturnErrorCode(const Status& result) {
     if (result.isOk()) return ErrorCode::OK;
 
@@ -543,7 +559,12 @@
     std::vector<uint8_t> o_put;
     result = op_->update(vector<uint8_t>(input.begin(), input.end()), {}, {}, &o_put);
 
-    if (result.isOk()) output->append(o_put.begin(), o_put.end());
+    if (result.isOk()) {
+        output->append(o_put.begin(), o_put.end());
+    } else {
+        // Failure always terminates the operation.
+        op_ = {};
+    }
 
     return GetReturnErrorCode(result);
 }
@@ -740,6 +761,19 @@
 
     if (digest == Digest::NONE) {
         switch (EVP_PKEY_id(pub_key.get())) {
+            case EVP_PKEY_ED25519: {
+                ASSERT_EQ(64, signature.size());
+                uint8_t pub_keydata[32];
+                size_t pub_len = sizeof(pub_keydata);
+                ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(pub_key.get(), pub_keydata, &pub_len));
+                ASSERT_EQ(sizeof(pub_keydata), pub_len);
+                ASSERT_EQ(1, ED25519_verify(reinterpret_cast<const uint8_t*>(message.data()),
+                                            message.size(),
+                                            reinterpret_cast<const uint8_t*>(signature.data()),
+                                            pub_keydata));
+                break;
+            }
+
             case EVP_PKEY_EC: {
                 vector<uint8_t> data((EVP_PKEY_bits(pub_key.get()) + 7) / 8);
                 size_t data_size = std::min(data.size(), message.size());
@@ -1166,16 +1200,31 @@
 vector<EcCurve> KeyMintAidlTestBase::ValidCurves() {
     if (securityLevel_ == SecurityLevel::STRONGBOX) {
         return {EcCurve::P_256};
+    } else if (Curve25519Supported()) {
+        return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521,
+                EcCurve::CURVE_25519};
     } else {
-        return {EcCurve::P_224, EcCurve::P_256, EcCurve::P_384, EcCurve::P_521};
+        return {
+                EcCurve::P_224,
+                EcCurve::P_256,
+                EcCurve::P_384,
+                EcCurve::P_521,
+        };
     }
 }
 
 vector<EcCurve> KeyMintAidlTestBase::InvalidCurves() {
     if (SecLevel() == SecurityLevel::STRONGBOX) {
-        return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521};
+        // Curve 25519 is not supported, either because:
+        // - KeyMint v1: it's an unknown enum value
+        // - KeyMint v2+: it's not supported by StrongBox.
+        return {EcCurve::P_224, EcCurve::P_384, EcCurve::P_521, EcCurve::CURVE_25519};
     } else {
-        return {};
+        if (Curve25519Supported()) {
+            return {};
+        } else {
+            return {EcCurve::CURVE_25519};
+        }
     }
 }
 
diff --git a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
index 61f9d4d..27cb99c 100644
--- a/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
+++ b/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.h
@@ -80,6 +80,8 @@
     uint32_t boot_patch_level(const vector<KeyCharacteristics>& key_characteristics);
     uint32_t boot_patch_level();
 
+    bool Curve25519Supported();
+
     ErrorCode GetReturnErrorCode(const Status& result);
 
     ErrorCode GenerateKey(const AuthorizationSet& key_desc, vector<uint8_t>* key_blob,
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 340010f..7357ac7 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -22,6 +22,7 @@
 #include <algorithm>
 #include <iostream>
 
+#include <openssl/curve25519.h>
 #include <openssl/ec.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
@@ -69,6 +70,9 @@
 
 namespace {
 
+// Maximum supported Ed25519 message size.
+const size_t MAX_ED25519_MSG_SIZE = 16 * 1024;
+
 // Whether to check that BOOT_PATCHLEVEL is populated.
 bool check_boot_pl = true;
 
@@ -415,6 +419,126 @@
         // } end SEQUENCE (PrivateKeyInfo)
 );
 
+/**
+ * Ed25519 key pair generated as follows:
+ * ```
+ * % openssl req -x509 -newkey ED25519 -days 700 -nodes \
+ *  -keyout ed25519_priv.key -out ed25519.pem * -subj "/CN=fake.ed25519.com"
+ * Generating a ED25519 private key writing new private key to
+ * 'ed25519_priv.key'
+ * -----
+ * % cat ed25519_priv.key
+ * -----BEGIN PRIVATE KEY-----
+ * MC4CAQAwBQYDK2VwBCIEIKl3A5quNywcj1P+0XI9SBalFPIvO52NxceMLRH6dVmR
+ * -----END PRIVATE KEY-----
+ * % der2ascii -pem -i ed25519_priv.key
+ * SEQUENCE {
+ *   INTEGER { 0 }
+ *   SEQUENCE {
+ *     # ed25519
+ *     OBJECT_IDENTIFIER { 1.3.101.112 }
+ *   }
+ *   OCTET_STRING {
+ *     OCTET_STRING { `a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991` }
+ *   }
+ * }
+ * % cat ed25519.pem
+ * -----BEGIN CERTIFICATE-----
+ * MIIBSjCB/aADAgECAhR0Jron3eKcdgqyecv/eEfGWAzn8DAFBgMrZXAwGzEZMBcG
+ * A1UEAwwQZmFrZS5lZDI1NTE5LmNvbTAeFw0yMTEwMjAwODI3NDJaFw0yMzA5MjAw
+ * ODI3NDJaMBsxGTAXBgNVBAMMEGZha2UuZWQyNTUxOS5jb20wKjAFBgMrZXADIQDv
+ * uwHz+3TaQ69D2digxlz0fFfsZg0rPqgQae3jBPRWkaNTMFEwHQYDVR0OBBYEFN9O
+ * od30SY4JTs66ZR403UPya+iXMB8GA1UdIwQYMBaAFN9Ood30SY4JTs66ZR403UPy
+ * a+iXMA8GA1UdEwEB/wQFMAMBAf8wBQYDK2VwA0EAKjVrYQjuE/gEL2j/ABpDbFjV
+ * Ilg5tJ6MN/P3psAv3Cs7f0X1lFqdlt15nJ/6aj2cmGCwNRXt5wcyYDKNu+v2Dw==
+ * -----END CERTIFICATE-----
+ * % openssl x509 -in ed25519.pem -text -noout
+ * Certificate:
+ *     Data:
+ *         Version: 3 (0x2)
+ *         Serial Number:
+ *             74:26:ba:27:dd:e2:9c:76:0a:b2:79:cb:ff:78:47:c6:58:0c:e7:f0
+ *         Signature Algorithm: ED25519
+ *         Issuer: CN = fake.ed25519.com
+ *         Validity
+ *             Not Before: Oct 20 08:27:42 2021 GMT
+ *             Not After : Sep 20 08:27:42 2023 GMT
+ *         Subject: CN = fake.ed25519.com
+ *         Subject Public Key Info:
+ *             Public Key Algorithm: ED25519
+ *                 ED25519 Public-Key:
+ *                 pub:
+ *                     ef:bb:01:f3:fb:74:da:43:af:43:d9:d8:a0:c6:5c:
+ *                     f4:7c:57:ec:66:0d:2b:3e:a8:10:69:ed:e3:04:f4:
+ *                     56:91
+ *         X509v3 extensions:
+ *             X509v3 Subject Key Identifier:
+ *                 DF:4E:A1:DD:F4:49:8E:09:4E:CE:BA:65:1E:34:DD:43:F2:6B:E8:97
+ *             X509v3 Authority Key Identifier:
+ *                 keyid:DF:4E:A1:DD:F4:49:8E:09:4E:CE:BA:65:1E:34:DD:43:F2:6B:E8:97
+ *
+ *             X509v3 Basic Constraints: critical
+ *                 CA:TRUE
+ *     Signature Algorithm: ED25519
+ *          2a:35:6b:61:08:ee:13:f8:04:2f:68:ff:00:1a:43:6c:58:d5:
+ *          22:58:39:b4:9e:8c:37:f3:f7:a6:c0:2f:dc:2b:3b:7f:45:f5:
+ *          94:5a:9d:96:dd:79:9c:9f:fa:6a:3d:9c:98:60:b0:35:15:ed:
+ *          e7:07:32:60:32:8d:bb:eb:f6:0f
+ * ```
+ */
+string ed25519_key = hex2str("a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991");
+string ed25519_pkcs8_key = hex2str(
+        // RFC 5208 s5
+        "302e"    // SEQUENCE length 0x2e (PrivateKeyInfo) {
+        "0201"    // INTEGER length 1 (Version)
+        "00"      // version 0
+        "3005"    // SEQUENCE length 05 (AlgorithmIdentifier) {
+        "0603"    // OBJECT IDENTIFIER length 3 (algorithm)
+        "2b6570"  // 1.3.101.112 (id-Ed125519 RFC 8410 s3)
+        // } end SEQUENCE (AlgorithmIdentifier)
+        "0422"  // OCTET STRING length 0x22 (PrivateKey)
+        "0420"  // OCTET STRING length 0x20 (RFC 8410 s7)
+        "a977039aae372c1c8f53fed1723d4816a514f22f3b9d8dc5c78c2d11fa755991"
+        // } end SEQUENCE (PrivateKeyInfo)
+);
+string ed25519_pubkey = hex2str("efbb01f3fb74da43af43d9d8a0c65cf47c57ec660d2b3ea81069ede304f45691");
+
+/**
+ * X25519 key pair generated as follows:
+ * ```
+ * % openssl genpkey -algorithm X25519 > x25519_priv.key
+ * % cat x25519_priv.key
+ * -----BEGIN PRIVATE KEY-----
+ * MC4CAQAwBQYDK2VuBCIEIGgPwF3NLwQx/Sfwr2nfJvXitwlDNh3Skzh+TISN/y1C
+ * -----END PRIVATE KEY-----
+ * % der2ascii -pem -i x25519_priv.key
+ * SEQUENCE {
+ *   INTEGER { 0 }
+ *   SEQUENCE {
+ *     # x25519
+ *     OBJECT_IDENTIFIER { 1.3.101.110 }
+ *   }
+ *   OCTET_STRING {
+ *     OCTET_STRING { `680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42` }
+ *   }
+ * }
+ * ```
+ */
+
+string x25519_key = hex2str("680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42");
+string x25519_pkcs8_key = hex2str(
+        // RFC 5208 s5
+        "302e"    // SEQUENCE length 0x2e (PrivateKeyInfo) {
+        "0201"    // INTEGER length 1 (Version)
+        "00"      // version 0
+        "3005"    // SEQUENCE length 05 (AlgorithmIdentifier) {
+        "0603"    // OBJECT IDENTIFIER length 3 (algorithm)
+        "2b656e"  // 1.3.101.110 (id-X125519 RFC 8410 s3)
+        "0422"    // OCTET STRING length 0x22 (PrivateKey)
+        "0420"    // OCTET STRING length 0x20 (RFC 8410 s7)
+        "680fc05dcd2f0431fd27f0af69df26f5e2b70943361dd293387e4c848dff2d42");
+string x25519_pubkey = hex2str("be46925a857f17831d6d454b9d3d36a4a30166edf80eb82b684661c3e258f768");
+
 struct RSA_Delete {
     void operator()(RSA* p) { RSA_free(p); }
 };
@@ -1374,7 +1498,7 @@
 /*
  * NewKeyGenerationTest.Ecdsa
  *
- * Verifies that keymint can generate all required EC key sizes, and that the resulting keys
+ * Verifies that keymint can generate all required EC curves, and that the resulting keys
  * have correct characteristics.
  */
 TEST_P(NewKeyGenerationTest, Ecdsa) {
@@ -1400,6 +1524,65 @@
 }
 
 /*
+ * NewKeyGenerationTest.EcdsaCurve25519
+ *
+ * Verifies that keymint can generate a curve25519 key, and that the resulting key
+ * has correct characteristics.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(result, ErrorCode::OK);
+    ASSERT_GT(key_blob.size(), 0U);
+
+    EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
+    ASSERT_GT(cert_chain_.size(), 0);
+
+    CheckBaseParams(key_characteristics);
+    CheckCharacteristics(key_blob, key_characteristics);
+
+    AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);
+
+    EXPECT_TRUE(crypto_params.Contains(TAG_ALGORITHM, Algorithm::EC));
+    EXPECT_TRUE(crypto_params.Contains(TAG_EC_CURVE, curve)) << "Curve " << curve << "missing";
+
+    CheckedDeleteKey(&key_blob);
+}
+
+/*
+ * NewKeyGenerationTest.EcCurve25519MultiPurposeFail
+ *
+ * Verifies that KeyMint rejects an attempt to generate a curve 25519 key for both
+ * SIGN and AGREE_KEY.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaCurve25519MultiPurposeFail) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(result, ErrorCode::INCOMPATIBLE_PURPOSE);
+}
+
+/*
  * NewKeyGenerationTest.EcdsaAttestation
  *
  * Verifies that for all Ecdsa key sizes, if challenge and app id is provided,
@@ -1453,6 +1636,62 @@
 }
 
 /*
+ * NewKeyGenerationTest.EcdsaAttestationCurve25519
+ *
+ * Verifies that for a curve 25519 key, if challenge and app id is provided,
+ * an attestation will be generated.
+ */
+TEST_P(NewKeyGenerationTest, EcdsaAttestationCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    auto challenge = "hello";
+    auto app_id = "foo";
+
+    auto subject = "cert subj 2";
+    vector<uint8_t> subject_der(make_name_from_str(subject));
+
+    uint64_t serial_int = 0xFFFFFFFFFFFFFFFF;
+    vector<uint8_t> serial_blob(build_serial_blob(serial_int));
+
+    vector<uint8_t> key_blob;
+    vector<KeyCharacteristics> key_characteristics;
+    ErrorCode result = GenerateKey(AuthorizationSetBuilder()
+                                           .Authorization(TAG_NO_AUTH_REQUIRED)
+                                           .EcdsaSigningKey(curve)
+                                           .Digest(Digest::NONE)
+                                           .AttestationChallenge(challenge)
+                                           .AttestationApplicationId(app_id)
+                                           .Authorization(TAG_CERTIFICATE_SERIAL, serial_blob)
+                                           .Authorization(TAG_CERTIFICATE_SUBJECT, subject_der)
+                                           .SetDefaultValidity(),
+                                   &key_blob, &key_characteristics);
+    ASSERT_EQ(ErrorCode::OK, result);
+    ASSERT_GT(key_blob.size(), 0U);
+    CheckBaseParams(key_characteristics);
+    CheckCharacteristics(key_blob, key_characteristics);
+
+    AuthorizationSet crypto_params = SecLevelAuthorizations(key_characteristics);
+
+    EXPECT_TRUE(crypto_params.Contains(TAG_ALGORITHM, Algorithm::EC));
+    EXPECT_TRUE(crypto_params.Contains(TAG_EC_CURVE, curve)) << "Curve " << curve << "missing";
+
+    EXPECT_TRUE(ChainSignaturesAreValid(cert_chain_));
+    ASSERT_GT(cert_chain_.size(), 0);
+    verify_subject_and_serial(cert_chain_[0], serial_int, subject, false);
+
+    AuthorizationSet hw_enforced = HwEnforcedAuthorizations(key_characteristics);
+    AuthorizationSet sw_enforced = SwEnforcedAuthorizations(key_characteristics);
+    EXPECT_TRUE(verify_attestation_record(AidlVersion(), challenge, app_id,  //
+                                          sw_enforced, hw_enforced, SecLevel(),
+                                          cert_chain_[0].encodedCertificate));
+
+    CheckedDeleteKey(&key_blob);
+}
+
+/*
  * NewKeyGenerationTest.EcdsaAttestationTags
  *
  * Verifies that creation of an attested ECDSA key includes various tags in the
@@ -1984,20 +2223,22 @@
 }
 
 /*
- * NewKeyGenerationTest.EcdsaInvalidSize
+ * NewKeyGenerationTest.EcdsaInvalidCurve
  *
- * Verifies that specifying an invalid key size for EC key generation returns
+ * Verifies that specifying an invalid curve for EC key generation returns
  * UNSUPPORTED_KEY_SIZE.
  */
-TEST_P(NewKeyGenerationTest, EcdsaInvalidSize) {
+TEST_P(NewKeyGenerationTest, EcdsaInvalidCurve) {
     for (auto curve : InvalidCurves()) {
         vector<uint8_t> key_blob;
         vector<KeyCharacteristics> key_characteristics;
-        ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE, GenerateKey(AuthorizationSetBuilder()
-                                                                       .EcdsaSigningKey(curve)
-                                                                       .Digest(Digest::NONE)
-                                                                       .SetDefaultValidity(),
-                                                               &key_blob, &key_characteristics));
+        auto result = GenerateKey(AuthorizationSetBuilder()
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity(),
+                                  &key_blob, &key_characteristics);
+        ASSERT_TRUE(result == ErrorCode::UNSUPPORTED_KEY_SIZE ||
+                    result == ErrorCode::UNSUPPORTED_EC_CURVE);
     }
 
     ASSERT_EQ(ErrorCode::UNSUPPORTED_KEY_SIZE,
@@ -2808,15 +3049,19 @@
 /*
  * SigningOperationsTest.EcdsaAllDigestsAndCurves
  *
- * Verifies ECDSA signature/verification for all digests and curves.
+ * Verifies ECDSA signature/verification for all digests and required curves.
  */
 TEST_P(SigningOperationsTest, EcdsaAllDigestsAndCurves) {
-    auto digests = ValidDigests(true /* withNone */, false /* withMD5 */);
 
     string message = "1234567890";
     string corrupt_message = "2234567890";
     for (auto curve : ValidCurves()) {
         SCOPED_TRACE(testing::Message() << "Curve::" << curve);
+        // Ed25519 only allows Digest::NONE.
+        auto digests = (curve == EcCurve::CURVE_25519)
+                               ? std::vector<Digest>(1, Digest::NONE)
+                               : ValidDigests(true /* withNone */, false /* withMD5 */);
+
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                               .Authorization(TAG_NO_AUTH_REQUIRED)
                                               .EcdsaSigningKey(curve)
@@ -2841,25 +3086,141 @@
 /*
  * SigningOperationsTest.EcdsaAllCurves
  *
- * Verifies that ECDSA operations succeed with all possible curves.
+ * Verifies that ECDSA operations succeed with all required curves.
  */
 TEST_P(SigningOperationsTest, EcdsaAllCurves) {
     for (auto curve : ValidCurves()) {
+        Digest digest = (curve == EcCurve::CURVE_25519 ? Digest::NONE : Digest::SHA_2_256);
+        SCOPED_TRACE(testing::Message() << "Curve::" << curve);
         ErrorCode error = GenerateKey(AuthorizationSetBuilder()
                                               .Authorization(TAG_NO_AUTH_REQUIRED)
                                               .EcdsaSigningKey(curve)
-                                              .Digest(Digest::SHA_2_256)
+                                              .Digest(digest)
                                               .SetDefaultValidity());
         EXPECT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
         if (error != ErrorCode::OK) continue;
 
         string message(1024, 'a');
-        SignMessage(message, AuthorizationSetBuilder().Digest(Digest::SHA_2_256));
+        SignMessage(message, AuthorizationSetBuilder().Digest(digest));
         CheckedDeleteKey();
     }
 }
 
 /*
+ * SigningOperationsTest.EcdsaCurve25519
+ *
+ * Verifies that ECDSA operations succeed with curve25519.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    string message(1024, 'a');
+    SignMessage(message, AuthorizationSetBuilder().Digest(Digest::NONE));
+    CheckedDeleteKey();
+}
+
+/*
+ * SigningOperationsTest.EcdsaCurve25519MaxSize
+ *
+ * Verifies that EDDSA operations with curve25519 under the maximum message size succeed.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519MaxSize) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+
+    for (size_t msg_size : {MAX_ED25519_MSG_SIZE - 1, MAX_ED25519_MSG_SIZE}) {
+        SCOPED_TRACE(testing::Message() << "-msg-size=" << msg_size);
+        string message(msg_size, 'a');
+
+        // Attempt to sign via Begin+Finish.
+        AuthorizationSet out_params;
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string signature;
+        auto result = Finish(message, &signature);
+        EXPECT_EQ(result, ErrorCode::OK);
+        LocalVerifyMessage(message, signature, params);
+
+        // Attempt to sign via Begin+Update+Finish
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string output;
+        result = Update(message, &output);
+        EXPECT_EQ(result, ErrorCode::OK);
+        EXPECT_EQ(output.size(), 0);
+        string signature2;
+        EXPECT_EQ(ErrorCode::OK, Finish({}, &signature2));
+        LocalVerifyMessage(message, signature2, params);
+    }
+
+    CheckedDeleteKey();
+}
+
+/*
+ * SigningOperationsTest.EcdsaCurve25519MaxSizeFail
+ *
+ * Verifies that EDDSA operations with curve25519 fail when message size is too large.
+ */
+TEST_P(SigningOperationsTest, EcdsaCurve25519MaxSizeFail) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    EcCurve curve = EcCurve::CURVE_25519;
+    ErrorCode error = GenerateKey(AuthorizationSetBuilder()
+                                          .Authorization(TAG_NO_AUTH_REQUIRED)
+                                          .EcdsaSigningKey(curve)
+                                          .Digest(Digest::NONE)
+                                          .SetDefaultValidity());
+    ASSERT_EQ(ErrorCode::OK, error) << "Failed to generate ECDSA key with curve " << curve;
+
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+
+    for (size_t msg_size : {MAX_ED25519_MSG_SIZE + 1, MAX_ED25519_MSG_SIZE * 2}) {
+        SCOPED_TRACE(testing::Message() << "-msg-size=" << msg_size);
+        string message(msg_size, 'a');
+
+        // Attempt to sign via Begin+Finish.
+        AuthorizationSet out_params;
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string signature;
+        auto result = Finish(message, &signature);
+        EXPECT_EQ(result, ErrorCode::INVALID_INPUT_LENGTH);
+
+        // Attempt to sign via Begin+Update (but never get to Finish)
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::SIGN, key_blob_, params, &out_params));
+        EXPECT_TRUE(out_params.empty());
+        string output;
+        result = Update(message, &output);
+        EXPECT_EQ(result, ErrorCode::INVALID_INPUT_LENGTH);
+    }
+
+    CheckedDeleteKey();
+}
+
+/*
  * SigningOperationsTest.EcdsaNoDigestHugeData
  *
  * Verifies that ECDSA operations support very large messages, even without digesting.  This
@@ -3509,6 +3870,255 @@
 }
 
 /*
+ * ImportKeyTest.Ed25519RawSuccess
+ *
+ * Verifies that importing and using a raw Ed25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, Ed25519RawSuccess) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_key));
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+
+    // The returned cert should hold the correct public key.
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(string(kmPubKeyData, kmPubKeyData + 32), ed25519_pubkey);
+
+    string message(32, 'a');
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+    string signature = SignMessage(message, params);
+    LocalVerifyMessage(message, signature, params);
+}
+
+/*
+ * ImportKeyTest.Ed25519Pkcs8Success
+ *
+ * Verifies that importing and using a PKCS#8-encoded Ed25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, Ed25519Pkcs8Success) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_pkcs8_key));
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+
+    // The returned cert should hold the correct public key.
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(string(kmPubKeyData, kmPubKeyData + 32), ed25519_pubkey);
+
+    string message(32, 'a');
+    auto params = AuthorizationSetBuilder().Digest(Digest::NONE);
+    string signature = SignMessage(message, params);
+    LocalVerifyMessage(message, signature, params);
+}
+
+/*
+ * ImportKeyTest.Ed25519CurveMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with a curve that doesn't match the key fails in
+ * the correct way.
+ */
+TEST_P(ImportKeyTest, Ed25519CurveMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK,
+              ImportKey(AuthorizationSetBuilder()
+                                .EcdsaSigningKey(EcCurve::P_224 /* Doesn't match key */)
+                                .Digest(Digest::NONE)
+                                .SetDefaultValidity(),
+                        KeyFormat::RAW, ed25519_key));
+}
+
+/*
+ * ImportKeyTest.Ed25519FormatMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, Ed25519FormatMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.Ed25519PurposeMismatch
+ *
+ * Verifies that importing an Ed25519 key pair with an invalid purpose fails.
+ */
+TEST_P(ImportKeyTest, Ed25519PurposeMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Can't have both SIGN and ATTEST_KEY
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::ATTEST_KEY)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, ed25519_key));
+    // AGREE_KEY is for X25519 (but can only tell the difference if the import key is in
+    // PKCS#8 format and so includes an OID).
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .Digest(Digest::NONE)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, ed25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.X25519RawSuccess
+ *
+ * Verifies that importing and using a raw X25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, X25519RawSuccess) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_key));
+
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+}
+
+/*
+ * ImportKeyTest.X25519Pkcs8Success
+ *
+ * Verifies that importing and using a PKCS#8-encoded X25519 private key works correctly.
+ */
+TEST_P(ImportKeyTest, X25519Pkcs8Success) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+
+    CheckCryptoParam(TAG_ALGORITHM, Algorithm::EC);
+    CheckCryptoParam(TAG_EC_CURVE, EcCurve::CURVE_25519);
+    CheckOrigin();
+}
+
+/*
+ * ImportKeyTest.X25519CurveMismatch
+ *
+ * Verifies that importing an X25519 key with a curve that doesn't match the key fails in
+ * the correct way.
+ */
+TEST_P(ImportKeyTest, X25519CurveMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::P_224 /* Doesn't match key */)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_key));
+}
+
+/*
+ * ImportKeyTest.X25519FormatMismatch
+ *
+ * Verifies that importing an X25519 key with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, X25519FormatMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::RAW, x25519_pkcs8_key));
+}
+
+/*
+ * ImportKeyTest.X25519PurposeMismatch
+ *
+ * Verifies that importing an X25519 key pair with an invalid format fails.
+ */
+TEST_P(ImportKeyTest, X25519PurposeMismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::ATTEST_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+    ASSERT_NE(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .EcdsaSigningKey(EcCurve::CURVE_25519)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+}
+
+/*
  * ImportKeyTest.AesSuccess
  *
  * Verifies that importing and using an AES key works.
@@ -6703,8 +7313,6 @@
 
 INSTANTIATE_KEYMINT_AIDL_TEST(TransportLimitTest);
 
-typedef KeyMintAidlTestBase KeyAgreementTest;
-
 static int EcdhCurveToOpenSslCurveName(EcCurve curve) {
     switch (curve) {
         case EcCurve::P_224:
@@ -6720,10 +7328,108 @@
     }
 }
 
+class KeyAgreementTest : public KeyMintAidlTestBase {
+  protected:
+    void GenerateLocalEcKey(EcCurve localCurve, EVP_PKEY_Ptr* localPrivKey,
+                            std::vector<uint8_t>* localPublicKey) {
+        // Generate EC key locally (with access to private key material)
+        if (localCurve == EcCurve::CURVE_25519) {
+            uint8_t privKeyData[32];
+            uint8_t pubKeyData[32];
+            X25519_keypair(pubKeyData, privKeyData);
+            *localPublicKey = vector<uint8_t>(pubKeyData, pubKeyData + 32);
+            *localPrivKey = EVP_PKEY_Ptr(EVP_PKEY_new_raw_private_key(
+                    EVP_PKEY_X25519, nullptr, privKeyData, sizeof(privKeyData)));
+        } else {
+            auto ecKey = EC_KEY_Ptr(EC_KEY_new());
+            int curveName = EcdhCurveToOpenSslCurveName(localCurve);
+            auto group = EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(curveName));
+            ASSERT_NE(group, nullptr);
+            ASSERT_EQ(EC_KEY_set_group(ecKey.get(), group.get()), 1);
+            ASSERT_EQ(EC_KEY_generate_key(ecKey.get()), 1);
+            *localPrivKey = EVP_PKEY_Ptr(EVP_PKEY_new());
+            ASSERT_EQ(EVP_PKEY_set1_EC_KEY(localPrivKey->get(), ecKey.get()), 1);
+
+            // Get encoded form of the public part of the locally generated key...
+            unsigned char* p = nullptr;
+            int localPublicKeySize = i2d_PUBKEY(localPrivKey->get(), &p);
+            ASSERT_GT(localPublicKeySize, 0);
+            *localPublicKey =
+                    vector<uint8_t>(reinterpret_cast<const uint8_t*>(p),
+                                    reinterpret_cast<const uint8_t*>(p + localPublicKeySize));
+            OPENSSL_free(p);
+        }
+    }
+
+    void GenerateKeyMintEcKey(EcCurve curve, EVP_PKEY_Ptr* kmPubKey) {
+        vector<uint8_t> challenge = {0x41, 0x42};
+        ErrorCode result =
+                GenerateKey(AuthorizationSetBuilder()
+                                    .Authorization(TAG_NO_AUTH_REQUIRED)
+                                    .Authorization(TAG_EC_CURVE, curve)
+                                    .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                    .Authorization(TAG_ALGORITHM, Algorithm::EC)
+                                    .Authorization(TAG_ATTESTATION_APPLICATION_ID, {0x61, 0x62})
+                                    .Authorization(TAG_ATTESTATION_CHALLENGE, challenge)
+                                    .SetDefaultValidity());
+        ASSERT_EQ(ErrorCode::OK, result) << "Failed to generate key";
+        ASSERT_GT(cert_chain_.size(), 0);
+        X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+        ASSERT_NE(kmKeyCert, nullptr);
+        // Check that keyAgreement (bit 4) is set in KeyUsage
+        EXPECT_TRUE((X509_get_key_usage(kmKeyCert.get()) & X509v3_KU_KEY_AGREEMENT) != 0);
+        *kmPubKey = EVP_PKEY_Ptr(X509_get_pubkey(kmKeyCert.get()));
+        ASSERT_NE(*kmPubKey, nullptr);
+        if (dump_Attestations) {
+            for (size_t n = 0; n < cert_chain_.size(); n++) {
+                std::cout << bin2hex(cert_chain_[n].encodedCertificate) << std::endl;
+            }
+        }
+    }
+
+    void CheckAgreement(EVP_PKEY_Ptr kmPubKey, EVP_PKEY_Ptr localPrivKey,
+                        const std::vector<uint8_t>& localPublicKey) {
+        ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+        string ZabFromKeyMintStr;
+        ASSERT_EQ(ErrorCode::OK,
+                  Finish(string(localPublicKey.begin(), localPublicKey.end()), &ZabFromKeyMintStr));
+        vector<uint8_t> ZabFromKeyMint(ZabFromKeyMintStr.begin(), ZabFromKeyMintStr.end());
+        vector<uint8_t> ZabFromTest;
+
+        if (EVP_PKEY_id(kmPubKey.get()) == EVP_PKEY_X25519) {
+            size_t kmPubKeySize = 32;
+            uint8_t kmPubKeyData[32];
+            ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+            ASSERT_EQ(kmPubKeySize, 32);
+
+            uint8_t localPrivKeyData[32];
+            size_t localPrivKeySize = 32;
+            ASSERT_EQ(1, EVP_PKEY_get_raw_private_key(localPrivKey.get(), localPrivKeyData,
+                                                      &localPrivKeySize));
+            ASSERT_EQ(localPrivKeySize, 32);
+
+            uint8_t sharedKey[32];
+            ASSERT_EQ(1, X25519(sharedKey, localPrivKeyData, kmPubKeyData));
+            ZabFromTest = std::vector<uint8_t>(sharedKey, sharedKey + 32);
+        } else {
+            // Perform local ECDH between the two keys so we can check if we get the same Zab..
+            auto ctx = EVP_PKEY_CTX_Ptr(EVP_PKEY_CTX_new(localPrivKey.get(), nullptr));
+            ASSERT_NE(ctx, nullptr);
+            ASSERT_EQ(EVP_PKEY_derive_init(ctx.get()), 1);
+            ASSERT_EQ(EVP_PKEY_derive_set_peer(ctx.get(), kmPubKey.get()), 1);
+            size_t ZabFromTestLen = 0;
+            ASSERT_EQ(EVP_PKEY_derive(ctx.get(), nullptr, &ZabFromTestLen), 1);
+            ZabFromTest.resize(ZabFromTestLen);
+            ASSERT_EQ(EVP_PKEY_derive(ctx.get(), ZabFromTest.data(), &ZabFromTestLen), 1);
+        }
+        EXPECT_EQ(ZabFromKeyMint, ZabFromTest);
+    }
+};
+
 /*
  * KeyAgreementTest.Ecdh
  *
- * Verifies that ECDH works for all curves
+ * Verifies that ECDH works for all required curves
  */
 TEST_P(KeyAgreementTest, Ecdh) {
     // Because it's possible to use this API with keys on different curves, we
@@ -6737,49 +7443,13 @@
     for (auto curve : ValidCurves()) {
         for (auto localCurve : ValidCurves()) {
             // Generate EC key locally (with access to private key material)
-            auto ecKey = EC_KEY_Ptr(EC_KEY_new());
-            int curveName = EcdhCurveToOpenSslCurveName(localCurve);
-            auto group = EC_GROUP_Ptr(EC_GROUP_new_by_curve_name(curveName));
-            ASSERT_NE(group, nullptr);
-            ASSERT_EQ(EC_KEY_set_group(ecKey.get(), group.get()), 1);
-            ASSERT_EQ(EC_KEY_generate_key(ecKey.get()), 1);
-            auto pkey = EVP_PKEY_Ptr(EVP_PKEY_new());
-            ASSERT_EQ(EVP_PKEY_set1_EC_KEY(pkey.get(), ecKey.get()), 1);
-
-            // Get encoded form of the public part of the locally generated key...
-            unsigned char* p = nullptr;
-            int encodedPublicKeySize = i2d_PUBKEY(pkey.get(), &p);
-            ASSERT_GT(encodedPublicKeySize, 0);
-            vector<uint8_t> encodedPublicKey(
-                    reinterpret_cast<const uint8_t*>(p),
-                    reinterpret_cast<const uint8_t*>(p + encodedPublicKeySize));
-            OPENSSL_free(p);
+            EVP_PKEY_Ptr localPrivKey;
+            vector<uint8_t> localPublicKey;
+            GenerateLocalEcKey(localCurve, &localPrivKey, &localPublicKey);
 
             // Generate EC key in KeyMint (only access to public key material)
-            vector<uint8_t> challenge = {0x41, 0x42};
-            EXPECT_EQ(
-                    ErrorCode::OK,
-                    GenerateKey(AuthorizationSetBuilder()
-                                        .Authorization(TAG_NO_AUTH_REQUIRED)
-                                        .Authorization(TAG_EC_CURVE, curve)
-                                        .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
-                                        .Authorization(TAG_ALGORITHM, Algorithm::EC)
-                                        .Authorization(TAG_ATTESTATION_APPLICATION_ID, {0x61, 0x62})
-                                        .Authorization(TAG_ATTESTATION_CHALLENGE, challenge)
-                                        .SetDefaultValidity()))
-                    << "Failed to generate key";
-            ASSERT_GT(cert_chain_.size(), 0);
-            X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
-            ASSERT_NE(kmKeyCert, nullptr);
-            // Check that keyAgreement (bit 4) is set in KeyUsage
-            EXPECT_TRUE((X509_get_key_usage(kmKeyCert.get()) & X509v3_KU_KEY_AGREEMENT) != 0);
-            auto kmPkey = EVP_PKEY_Ptr(X509_get_pubkey(kmKeyCert.get()));
-            ASSERT_NE(kmPkey, nullptr);
-            if (dump_Attestations) {
-                for (size_t n = 0; n < cert_chain_.size(); n++) {
-                    std::cout << bin2hex(cert_chain_[n].encodedCertificate) << std::endl;
-                }
-            }
+            EVP_PKEY_Ptr kmPubKey;
+            GenerateKeyMintEcKey(curve, &kmPubKey);
 
             // Now that we have the two keys, we ask KeyMint to perform ECDH...
             if (curve != localCurve) {
@@ -6788,30 +7458,12 @@
                 EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
                 string ZabFromKeyMintStr;
                 EXPECT_EQ(ErrorCode::INVALID_ARGUMENT,
-                          Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
+                          Finish(string(localPublicKey.begin(), localPublicKey.end()),
                                  &ZabFromKeyMintStr));
 
             } else {
                 // Otherwise if the keys are using the same curve, it should work.
-                EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
-                string ZabFromKeyMintStr;
-                EXPECT_EQ(ErrorCode::OK,
-                          Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
-                                 &ZabFromKeyMintStr));
-                vector<uint8_t> ZabFromKeyMint(ZabFromKeyMintStr.begin(), ZabFromKeyMintStr.end());
-
-                // Perform local ECDH between the two keys so we can check if we get the same Zab..
-                auto ctx = EVP_PKEY_CTX_Ptr(EVP_PKEY_CTX_new(pkey.get(), nullptr));
-                ASSERT_NE(ctx, nullptr);
-                ASSERT_EQ(EVP_PKEY_derive_init(ctx.get()), 1);
-                ASSERT_EQ(EVP_PKEY_derive_set_peer(ctx.get(), kmPkey.get()), 1);
-                size_t ZabFromTestLen = 0;
-                ASSERT_EQ(EVP_PKEY_derive(ctx.get(), nullptr, &ZabFromTestLen), 1);
-                vector<uint8_t> ZabFromTest;
-                ZabFromTest.resize(ZabFromTestLen);
-                ASSERT_EQ(EVP_PKEY_derive(ctx.get(), ZabFromTest.data(), &ZabFromTestLen), 1);
-
-                EXPECT_EQ(ZabFromKeyMint, ZabFromTest);
+                CheckAgreement(std::move(kmPubKey), std::move(localPrivKey), localPublicKey);
             }
 
             CheckedDeleteKey();
@@ -6819,6 +7471,140 @@
     }
 }
 
+/*
+ * KeyAgreementTest.EcdhCurve25519
+ *
+ * Verifies that ECDH works for curve25519. This is also covered by the general
+ * KeyAgreementTest.Ecdh case, but is pulled out separately here because this curve was added after
+ * KeyMint 1.0.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    // Agree on a key between local and KeyMint and check it.
+    CheckAgreement(std::move(kmPubKey), std::move(privKey), encodedPublicKey);
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519Imported
+ *
+ * Verifies that ECDH works for an imported curve25519 key.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519Imported) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Import x25519 key into KeyMint.
+    EcCurve curve = EcCurve::CURVE_25519;
+    ASSERT_EQ(ErrorCode::OK, ImportKey(AuthorizationSetBuilder()
+                                               .Authorization(TAG_NO_AUTH_REQUIRED)
+                                               .EcdsaKey(EcCurve::CURVE_25519)
+                                               .Authorization(TAG_PURPOSE, KeyPurpose::AGREE_KEY)
+                                               .SetDefaultValidity(),
+                                       KeyFormat::PKCS8, x25519_pkcs8_key));
+    ASSERT_GT(cert_chain_.size(), 0);
+    X509_Ptr kmKeyCert(parse_cert_blob(cert_chain_[0].encodedCertificate));
+    ASSERT_NE(kmKeyCert, nullptr);
+    EVP_PKEY_Ptr kmPubKey(X509_get_pubkey(kmKeyCert.get()));
+    ASSERT_NE(kmPubKey.get(), nullptr);
+
+    // Expect the import to emit corresponding public key data.
+    size_t kmPubKeySize = 32;
+    uint8_t kmPubKeyData[32];
+    ASSERT_EQ(1, EVP_PKEY_get_raw_public_key(kmPubKey.get(), kmPubKeyData, &kmPubKeySize));
+    ASSERT_EQ(kmPubKeySize, 32);
+    EXPECT_EQ(bin2hex(std::vector<uint8_t>(kmPubKeyData, kmPubKeyData + 32)),
+              bin2hex(std::vector<uint8_t>(x25519_pubkey.begin(), x25519_pubkey.end())));
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    // Agree on a key between local and KeyMint and check it.
+    CheckAgreement(std::move(kmPubKey), std::move(privKey), encodedPublicKey);
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519InvalidSize
+ *
+ * Verifies that ECDH fails for curve25519 if the wrong size of public key is provided.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519InvalidSize) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    // Generate EC key on same curve locally (with access to private key material).
+    EVP_PKEY_Ptr privKey;
+    vector<uint8_t> encodedPublicKey;
+    GenerateLocalEcKey(curve, &privKey, &encodedPublicKey);
+
+    ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+    string ZabFromKeyMintStr;
+    // Send in an incomplete public key.
+    ASSERT_NE(ErrorCode::OK, Finish(string(encodedPublicKey.begin(), encodedPublicKey.end() - 1),
+                                    &ZabFromKeyMintStr));
+
+    CheckedDeleteKey();
+}
+
+/*
+ * KeyAgreementTest.EcdhCurve25519Mismatch
+ *
+ * Verifies that ECDH fails between curve25519 and other curves.
+ */
+TEST_P(KeyAgreementTest, EcdhCurve25519Mismatch) {
+    if (!Curve25519Supported()) {
+        GTEST_SKIP() << "Test not applicable to device that is not expected to support curve 25519";
+    }
+
+    // Generate EC key in KeyMint (only access to public key material)
+    EcCurve curve = EcCurve::CURVE_25519;
+    EVP_PKEY_Ptr kmPubKey = nullptr;
+    GenerateKeyMintEcKey(curve, &kmPubKey);
+
+    for (auto localCurve : ValidCurves()) {
+        if (localCurve == curve) {
+            continue;
+        }
+        // Generate EC key on a different curve locally (with access to private key material).
+        EVP_PKEY_Ptr privKey;
+        vector<uint8_t> encodedPublicKey;
+        GenerateLocalEcKey(localCurve, &privKey, &encodedPublicKey);
+
+        EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::AGREE_KEY, AuthorizationSetBuilder()));
+        string ZabFromKeyMintStr;
+        EXPECT_EQ(ErrorCode::INVALID_ARGUMENT,
+                  Finish(string(encodedPublicKey.begin(), encodedPublicKey.end()),
+                         &ZabFromKeyMintStr));
+    }
+
+    CheckedDeleteKey();
+}
+
 INSTANTIATE_KEYMINT_AIDL_TEST(KeyAgreementTest);
 
 using DestroyAttestationIdsTest = KeyMintAidlTestBase;
diff --git a/soundtrigger/aidl/Android.bp b/soundtrigger/aidl/Android.bp
index fcccc27..28e8090 100644
--- a/soundtrigger/aidl/Android.bp
+++ b/soundtrigger/aidl/Android.bp
@@ -10,6 +10,7 @@
 aidl_interface {
     name: "android.hardware.soundtrigger3",
     vendor_available: true,
+    host_supported: true,
     flags: ["-Werror", "-Weverything", ],
     srcs: [
         "android/hardware/soundtrigger3/ISoundTriggerHw.aidl",
diff --git a/usb/aidl/Android.bp b/usb/aidl/Android.bp
new file mode 100644
index 0000000..d1e9e68
--- /dev/null
+++ b/usb/aidl/Android.bp
@@ -0,0 +1,33 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+aidl_interface {
+    name: "android.hardware.usb",
+    vendor_available: true,
+    srcs: ["android/hardware/usb/*.aidl"],
+    stability: "vintf",
+    backend: {
+        cpp: {
+            enabled: false,
+        },
+        java: {
+            sdk_version: "module_current",
+        },
+        ndk: {
+            vndk: {
+                enabled: true,
+            },
+        },
+    },
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl
new file mode 100644
index 0000000..24c6966
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantDetectionStatus.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum ContaminantDetectionStatus {
+  NOT_SUPPORTED = 0,
+  DISABLED = 1,
+  NOT_DETECTED = 2,
+  DETECTED = 3,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl
new file mode 100644
index 0000000..9979869
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionMode.aidl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum ContaminantProtectionMode {
+  NONE = 0,
+  FORCE_SINK = 1,
+  FORCE_SOURCE = 2,
+  FORCE_DISABLE = 3,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl
new file mode 100644
index 0000000..9642261
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/ContaminantProtectionStatus.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum ContaminantProtectionStatus {
+  NONE = 0,
+  FORCE_SINK = 1,
+  FORCE_SOURCE = 2,
+  FORCE_DISABLE = 3,
+  DISABLED = 4,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl
new file mode 100644
index 0000000..4ba9ff8
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsb.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+interface IUsb {
+  oneway void enableContaminantPresenceDetection(in String portName, in boolean enable, long transactionId);
+  oneway void enableUsbData(in String portName, boolean enable, long transactionId);
+  oneway void enableUsbDataWhileDocked(in String portName, long transactionId);
+  oneway void queryPortStatus(long transactionId);
+  oneway void setCallback(in android.hardware.usb.IUsbCallback callback);
+  oneway void switchRole(in String portName, in android.hardware.usb.PortRole role, long transactionId);
+  oneway void limitPowerTransfer(in String portName, boolean limit, long transactionId);
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl
new file mode 100644
index 0000000..57f02c5
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/IUsbCallback.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+interface IUsbCallback {
+  oneway void notifyPortStatusChange(in android.hardware.usb.PortStatus[] currentPortStatus, in android.hardware.usb.Status retval);
+  oneway void notifyRoleSwitchStatus(in String portName, in android.hardware.usb.PortRole newRole, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyEnableUsbDataStatus(in String portName, boolean enable, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyEnableUsbDataWhileDockedStatus(in String portName, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyContaminantEnabledStatus(in String portName, boolean enable, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyQueryPortStatus(in String portName, in android.hardware.usb.Status retval, long transactionId);
+  oneway void notifyLimitPowerTransferStatus(in String portName, boolean limit, in android.hardware.usb.Status retval, long transactionId);
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl
new file mode 100644
index 0000000..105b316
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortDataRole.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum PortDataRole {
+  NONE = 0,
+  HOST = 1,
+  DEVICE = 2,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl
new file mode 100644
index 0000000..34e4334
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortMode.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum PortMode {
+  NONE = 0,
+  UFP = 1,
+  DFP = 2,
+  DRP = 3,
+  AUDIO_ACCESSORY = 4,
+  DEBUG_ACCESSORY = 5,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl
new file mode 100644
index 0000000..0e6f3fb
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortPowerRole.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum PortPowerRole {
+  NONE = 0,
+  SOURCE = 1,
+  SINK = 2,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl
new file mode 100644
index 0000000..c66aecc
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortRole.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+union PortRole {
+  android.hardware.usb.PortPowerRole powerRole = android.hardware.usb.PortPowerRole.NONE;
+  android.hardware.usb.PortDataRole dataRole;
+  android.hardware.usb.PortMode mode;
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl
new file mode 100644
index 0000000..dfd99fb
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PortStatus.aidl
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+parcelable PortStatus {
+  String portName;
+  android.hardware.usb.PortDataRole currentDataRole = android.hardware.usb.PortDataRole.NONE;
+  android.hardware.usb.PortPowerRole currentPowerRole = android.hardware.usb.PortPowerRole.NONE;
+  android.hardware.usb.PortMode currentMode = android.hardware.usb.PortMode.NONE;
+  boolean canChangeMode;
+  boolean canChangeDataRole;
+  boolean canChangePowerRole;
+  android.hardware.usb.PortMode[] supportedModes;
+  android.hardware.usb.ContaminantProtectionMode[] supportedContaminantProtectionModes;
+  boolean supportsEnableContaminantPresenceProtection;
+  android.hardware.usb.ContaminantProtectionStatus contaminantProtectionStatus = android.hardware.usb.ContaminantProtectionStatus.NONE;
+  boolean supportsEnableContaminantPresenceDetection;
+  android.hardware.usb.ContaminantDetectionStatus contaminantDetectionStatus = android.hardware.usb.ContaminantDetectionStatus.NOT_SUPPORTED;
+  android.hardware.usb.UsbDataStatus[] usbDataStatus;
+  boolean powerTransferLimited;
+  android.hardware.usb.PowerBrickStatus powerBrickStatus;
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl
new file mode 100644
index 0000000..01d2fdd
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/PowerBrickStatus.aidl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum PowerBrickStatus {
+  UNKNOWN = 0,
+  CONNECTED = 1,
+  NOT_CONNECTED = 2,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl
new file mode 100644
index 0000000..f28fc2a
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/Status.aidl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@Backing(type="int") @VintfStability
+enum Status {
+  SUCCESS = 0,
+  ERROR = 1,
+  INVALID_ARGUMENT = 2,
+  UNRECOGNIZED_ROLE = 3,
+  NOT_SUPPORTED = 4,
+}
diff --git a/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl
new file mode 100644
index 0000000..e2c0cfb
--- /dev/null
+++ b/usb/aidl/aidl_api/android.hardware.usb/current/android/hardware/usb/UsbDataStatus.aidl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+///////////////////////////////////////////////////////////////////////////////
+// THIS FILE IS IMMUTABLE. DO NOT EDIT IN ANY CASE.                          //
+///////////////////////////////////////////////////////////////////////////////
+
+// This file is a snapshot of an AIDL file. Do not edit it manually. There are
+// two cases:
+// 1). this is a frozen version file - do not edit this in any case.
+// 2). this is a 'current' file. If you make a backwards compatible change to
+//     the interface (from the latest frozen version), the build system will
+//     prompt you to update this file with `m <name>-update-api`.
+//
+// You must not make a backward incompatible change to any AIDL file built
+// with the aidl_interface module type with versions property set. The module
+// type is used to build AIDL files in a way that they can be used across
+// independently updatable components of the system. If a device is shipped
+// with such a backward incompatible change, it has a high risk of breaking
+// later when a module using the interface is updated, e.g., Mainline modules.
+
+package android.hardware.usb;
+@VintfStability
+enum UsbDataStatus {
+  UNKNOWN = 0,
+  ENABLED = 1,
+  DISABLED_OVERHEAT = 2,
+  DISABLED_CONTAMINANT = 3,
+  DISABLED_DOCK = 4,
+  DISABLED_FORCE = 5,
+  DISABLED_DEBUG = 6,
+}
diff --git a/usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl b/usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl
new file mode 100644
index 0000000..d9bc576
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/ContaminantDetectionStatus.aidl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum ContaminantDetectionStatus {
+    /**
+     * Contaminant presence detection is not supported.
+     */
+    NOT_SUPPORTED = 0,
+    /**
+     * Contaminant presence detection is supported but disabled.
+     */
+    DISABLED = 1,
+    /**
+     * Contaminant presence detection is enabled and contaminant not detected.
+     */
+    NOT_DETECTED = 2,
+    /**
+     * Contaminant presence detection is enabled and contaminant detected.
+     */
+    DETECTED = 3,
+}
diff --git a/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl b/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl
new file mode 100644
index 0000000..47c073d
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/ContaminantProtectionMode.aidl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum ContaminantProtectionMode {
+    /**
+     * No action performed upon detection of contaminant presence.
+     */
+    NONE = 0,
+    /**
+     * Upon detection of contaminant presence, Port is forced to sink only
+     * mode where a port shall only detect chargers until contaminant presence
+     * is no longer detected.
+     */
+    FORCE_SINK = 1,
+    /**
+     * Upon detection of contaminant presence, Port is forced to source only
+     * mode where a port shall only detect usb accessories such as headsets
+     * until contaminant presence is no longer detected.
+     */
+    FORCE_SOURCE = 2,
+    /**
+     * Upon detection of contaminant presence, port is disabled until contaminant
+     * presence is no longer detected. In the disabled state port will
+     * not respond to connection of chargers or usb accessories.
+     */
+    FORCE_DISABLE = 3,
+}
diff --git a/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl b/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl
new file mode 100644
index 0000000..c4fa979
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/ContaminantProtectionStatus.aidl
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.ContaminantProtectionMode;
+
+@VintfStability
+enum ContaminantProtectionStatus {
+    /**
+     * No action performed upon detection of contaminant presence.
+     */
+    NONE = 0,
+    /**
+     * Upon detection of contaminant presence, Port is forced to sink only
+     * mode where a port shall only detect chargers until contaminant presence
+     * is no longer detected.
+     */
+    FORCE_SINK = 1,
+    /**
+     * Upon detection of contaminant presence, Port is forced to source only
+     * mode where a port shall only detect usb accessories such as headsets
+     * until contaminant presence is no longer detected.
+     */
+    FORCE_SOURCE = 2,
+    /**
+     * Upon detection of contaminant presence, port is disabled until contaminant
+     * presence is no longer detected. In the disabled state port will
+     * not respond to connection of chargers or usb accessories.
+     */
+    FORCE_DISABLE = 3,
+    /**
+     * Client disabled cotaminant protection by calling
+     * enableContaminantPresencePortProtection set to false. Low level drivers should
+     * not autmomously take any corrective action when contaminant presence is detected.
+     */
+    DISABLED = 4,
+}
diff --git a/usb/aidl/android/hardware/usb/IUsb.aidl b/usb/aidl/android/hardware/usb/IUsb.aidl
new file mode 100644
index 0000000..d296fbb
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/IUsb.aidl
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.IUsbCallback;
+import android.hardware.usb.PortRole;
+
+@VintfStability
+oneway interface IUsb {
+    /**
+     * When supportsEnableContaminantPresenceDetection is true,
+     * enableContaminantPresenceDetection enables/disables contaminant
+     * presence detection algorithm. Calling enableContaminantPresenceDetection
+     * when supportsEnableContaminantPresenceDetection is false does
+     * not have any effect.
+     * Change in contantaminant presence status should be notified to the
+     * client via notifyPortStatusChange through PortStatus.
+     *
+     * @param portName name of the port.
+     * @param enable true Enable contaminant presence detection algorithm.
+     *               false Disable contaminant presence detection algorithm.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void enableContaminantPresenceDetection(in String portName, in boolean enable, long transactionId);
+
+    /**
+     * This function is used to enable/disable USB data controller.
+     *
+     * @param portName Name of the port.
+     * @param enable   true Enable USB data signaling.
+     *                 false Disable USB data signaling.
+     * @param transactionId ID to be used when invoking the callback.
+     *
+     */
+    void enableUsbData(in String portName, boolean enable, long transactionId);
+
+    /**
+     * This function is used to enable USB controller if and when the controller
+     * disabled due to docking event.
+     *
+     * @param portName Name of the port.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void enableUsbDataWhileDocked(in String portName, long transactionId);
+
+    /**
+     * This functions is used to request the hal for the current status
+     * status of the Type-C ports. The result of the query would be sent
+     * through the IUsbCallback object's notifyRoleSwitchStatus
+     * to the caller. This api would would let the caller know of the number
+     * of type-c ports that are present and their connection status through the
+     * PortStatus type.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void queryPortStatus(long transactionId);
+
+    /**
+     * This function is used to register a callback function which is
+     * called by the HAL to inform the client of port status updates and
+     * result of the requested operation. Please refer IUsbCallback for
+     * complete description of when each of the IUsbCallback's interface
+     * methods is expected to be called.
+     *
+     * @param callback IUsbCallback object used to convey status to the
+     * userspace.
+     */
+    void setCallback(in IUsbCallback callback);
+
+    /**
+     * This function is used to change the port role of a specific port.
+     * For example, when DR_SWAP or PR_SWAP is supported.
+     * The status of the role switch will be informed through IUsbCallback
+     * object's notifyPortStatusChange method.
+     *
+     * @param portName name of the port for which the role has to be changed
+     * @param role the new port role.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void switchRole(in String portName, in PortRole role, long transactionId);
+
+    /**
+     * This function is used to limit power transfer in and out of the port.
+     * When limited, the port does not charge from the partner port.
+     * Also, the port limits sourcing power to the partner port when the USB
+     * specification allows it to do so.
+     *
+     * @param portName name of the port for which power transfer is being limited.
+     * @param limit true limit power transfer.
+     *              false relax limiting power transfer.
+     * @param transactionId ID to be used when invoking the callback.
+     */
+    void limitPowerTransfer(in String portName, boolean limit, long transactionId);
+}
diff --git a/usb/aidl/android/hardware/usb/IUsbCallback.aidl b/usb/aidl/android/hardware/usb/IUsbCallback.aidl
new file mode 100644
index 0000000..e33672a
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/IUsbCallback.aidl
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.usb;
+
+import android.hardware.usb.PortRole;
+import android.hardware.usb.PortStatus;
+import android.hardware.usb.Status;
+
+/**
+ * Callback object used for all the IUsb async methods which expects a result.
+ * Caller is expected to register the callback object using setCallback method
+ * to receive updates on the PortStatus.
+ */
+@VintfStability
+oneway interface IUsbCallback {
+    /**
+     * Used to convey the current port status to the caller.
+     * Must be called either when PortState changes due to the port partner or
+     * when caller requested for the PortStatus update through queryPortStatus.
+     *
+     * @param currentPortStatus describes the status of all the USB ports in the
+     *                          device.
+     * @param retval SUCCESS when the required information was enquired form
+     *               kernel and the PortStatus object was built.
+     *               ERROR otherwise.
+     */
+    void notifyPortStatusChange(in PortStatus[] currentPortStatus, in Status retval);
+
+    /**
+     * Used to notify the result of the switchRole call to the caller.
+     *
+     * @param portName name of the port for which the roleswap is requested.
+     * @param newRole the new role requested by the caller.
+     * @param retval SUCCESS if the role switch succeeded. FAILURE otherwise.
+     * @param transactionId  transactionId sent during switchRole request.
+     */
+    void notifyRoleSwitchStatus(in String portName, in PortRole newRole, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of notifyEnableUsbDataStatus call to the caller.
+     *
+     * @param portName name of the port for which the enableUsbData is requested.
+     * @param enable true when usb data is enabled.
+     *               false when usb data is disabled.
+     * @param retval SUCCESS if current request succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during enableUsbData request.
+     */
+    void notifyEnableUsbDataStatus(in String portName, boolean enable, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of enableUsbDataWhileDocked call to the caller.
+     *
+     * @param portName name of the port for which the enableUsbDataWhileDocked is requested.
+     * @param retval SUCCESS if current request succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during enableUsbDataWhileDocked request.
+     */
+    void notifyEnableUsbDataWhileDockedStatus(in String portName, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the result of enableContaminantPresenceDetection.
+     *
+     * @param portName name of the port for which contaminant detection is enabled/disabled.
+     * @param enable true when contaminant detection is enabled.
+     *               false when disabled.
+     * @param retval SUCCESS if the request for enabling/disabling contamiant detection succeeds.
+     *               FAILURE otherwise.
+     * @param transactionId transactionId sent during queryPortStatus request
+     */
+    void notifyContaminantEnabledStatus(in String portName, boolean enable, in Status retval,
+            long transactionId);
+
+    /**
+     * Used to notify the request to query port status.
+     *
+     * @param portName name of the port for which port status is queried.
+     * @param retval SUCCESS if the port query succeeded. FAILURE otherwise.
+     * @param transactionId transactionId sent during queryPortStatus request
+     */
+    void notifyQueryPortStatus(in String portName, in Status retval, long transactionId);
+
+    /**
+     * Used to notify the result of requesting limitPowerTransfer.
+     *
+     * @param portName name of the port for which power transfer is being limited.
+     * @param limit true limit power transfer.
+     *              false relax limiting power transfer.
+     * @param retval SUCCESS if the request to enable/disable limitPowerTransfer succeeds.
+     *               FAILURE otherwise.
+     * @param transactionId ID sent during limitPowerTransfer request.
+     */
+    void notifyLimitPowerTransferStatus(in String portName, boolean limit, in Status retval, long transactionId);
+}
diff --git a/usb/aidl/android/hardware/usb/PortDataRole.aidl b/usb/aidl/android/hardware/usb/PortDataRole.aidl
new file mode 100644
index 0000000..a69f977
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortDataRole.aidl
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum PortDataRole {
+    /**
+     * Indicates that the port does not have a data role.
+     * In case of DRP, the current data role of the port is only resolved
+     * when the type-c handshake happens.
+     */
+    NONE = 0,
+    /**
+     * Indicates that the port is acting as a host for data.
+     */
+    HOST = 1,
+    /**
+     * Indicated that the port is acting as a device for data.
+     */
+    DEVICE = 2,
+}
diff --git a/usb/aidl/android/hardware/usb/PortMode.aidl b/usb/aidl/android/hardware/usb/PortMode.aidl
new file mode 100644
index 0000000..399f0eb
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortMode.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.PortMode;
+
+@VintfStability
+enum PortMode {
+    /**
+     * Indicates that the port does not have a mode.
+     * In case of DRP, the current mode of the port is only resolved
+     * when the type-c handshake happens.
+     */
+    NONE = 0,
+    /**
+     * Indicates that port can only act as device for data and sink for power.
+     */
+    UFP = 1,
+    /**
+     * Indicates the port can only act as host for data and source for power.
+     */
+    DFP = 2,
+    /**
+     * Indicates can either act as UFP or DFP at a given point of time.
+     */
+    DRP = 3,
+    /*
+     * Indicates that the port supports Audio Accessory mode.
+     */
+    AUDIO_ACCESSORY = 4,
+    /*
+     * Indicates that the port supports Debug Accessory mode.
+     */
+    DEBUG_ACCESSORY = 5,
+}
diff --git a/usb/aidl/android/hardware/usb/PortPowerRole.aidl b/usb/aidl/android/hardware/usb/PortPowerRole.aidl
new file mode 100644
index 0000000..ae3dc47
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortPowerRole.aidl
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum PortPowerRole {
+    /**
+     * Indicates that the port does not have a power role.
+     * In case of DRP, the current power role of the port is only resolved
+     * when the type-c handshake happens.
+     */
+    NONE = 0,
+    /**
+     * Indicates that the port is supplying power to the other port.
+     */
+    SOURCE = 1,
+    /**
+     * Indicates that the port is sinking power from the other port.
+     */
+    SINK = 2,
+}
diff --git a/usb/aidl/android/hardware/usb/PortRole.aidl b/usb/aidl/android/hardware/usb/PortRole.aidl
new file mode 100644
index 0000000..e0429c8
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortRole.aidl
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.PortDataRole;
+import android.hardware.usb.PortMode;
+import android.hardware.usb.PortPowerRole;
+
+/**
+ * Used as a container to send port role information.
+ */
+@VintfStability
+union PortRole {
+    PortPowerRole powerRole = PortPowerRole.NONE;
+    PortDataRole dataRole;
+    PortMode mode;
+}
diff --git a/usb/aidl/android/hardware/usb/PortStatus.aidl b/usb/aidl/android/hardware/usb/PortStatus.aidl
new file mode 100644
index 0000000..51bee71
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PortStatus.aidl
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+import android.hardware.usb.ContaminantDetectionStatus;
+import android.hardware.usb.ContaminantProtectionMode;
+import android.hardware.usb.ContaminantProtectionStatus;
+import android.hardware.usb.PortDataRole;
+import android.hardware.usb.PortMode;
+import android.hardware.usb.PortPowerRole;
+import android.hardware.usb.PowerBrickStatus;
+import android.hardware.usb.UsbDataStatus;
+
+@VintfStability
+parcelable PortStatus {
+    /**
+     * Name of the port.
+     * Used as the port's id by the caller.
+     */
+    String portName;
+    /**
+     * Data role of the port.
+     */
+    PortDataRole currentDataRole = PortDataRole.NONE;
+    /**
+     * Power Role of thte port.
+     */
+    PortPowerRole currentPowerRole = PortPowerRole.NONE;
+    /**
+     * Mode in which the port is connected.
+     * Can be UFP or DFP or AUDIO_ACCESSORY or
+     * DEBUG_ACCESSORY.
+     */
+    PortMode currentMode = PortMode.NONE;
+    /**
+     * True indicates that the port's mode can
+     * be changed. False otherwise.
+     */
+    boolean canChangeMode;
+    /**
+     * True indicates that the port's data role
+     * can be changed. False otherwise.
+     * For example, true if Type-C PD PD_SWAP
+     * is supported.
+     */
+    boolean canChangeDataRole;
+    /**
+     * True indicates that the port's power role
+     * can be changed. False otherwise.
+     * For example, true if Type-C PD PR_SWAP
+     * is supported.
+     */
+    boolean canChangePowerRole;
+    /**
+     * Identifies the type of the local port.
+     *
+     * UFP - Indicates that port can only act as device for
+     *       data and sink for power.
+     * DFP - Indicates the port can only act as host for data
+     *       and source for power.
+     * DRP - Indicates can either act as UFP or DFP at a
+     *       given point of time.
+     * AUDIO_ACCESSORY -  Indicates that the port supports
+     *                    Audio Accessory mode.
+     * DEBUG_ACCESSORY - Indicates that the port supports
+     *                   Debug Accessory mode.
+     */
+    PortMode[] supportedModes;
+    /**
+     * Contaminant presence protection modes supported by the port.
+     */
+    ContaminantProtectionMode[] supportedContaminantProtectionModes;
+    /**
+     * Client can enable/disable contaminant presence protection through
+     * enableContaminantPresenceProtection when true.
+     */
+    boolean supportsEnableContaminantPresenceProtection;
+    /**
+     * Contaminant presence protection modes currently active for the port.
+     */
+    ContaminantProtectionStatus contaminantProtectionStatus = ContaminantProtectionStatus.NONE;
+    /**
+     * Client can enable/disable contaminant presence detection through
+     * enableContaminantPresenceDetection when true.
+     */
+    boolean supportsEnableContaminantPresenceDetection;
+    /**
+     * Current status of contaminant detection algorithm.
+     */
+    ContaminantDetectionStatus contaminantDetectionStatus = ContaminantDetectionStatus.NOT_SUPPORTED;
+    /**
+     * UsbData status of the port.
+     * Lists reasons for USB data being disabled.
+     */
+    UsbDataStatus[] usbDataStatus;
+    /**
+     * Denoted whether power transfer is limited in the port.
+     */
+    boolean powerTransferLimited;
+    /**
+     * Denotes whether Power brick is connected.
+     */
+    PowerBrickStatus powerBrickStatus;
+}
diff --git a/usb/aidl/android/hardware/usb/PowerBrickStatus.aidl b/usb/aidl/android/hardware/usb/PowerBrickStatus.aidl
new file mode 100644
index 0000000..620fb25
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/PowerBrickStatus.aidl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum PowerBrickStatus {
+    /**
+     * Status not known.
+     */
+    UNKNOWN = 0,
+    /**
+     * Port partner is power brick.
+     */
+    CONNECTED = 1,
+    /**
+     * Port partner is not power brick.
+     */
+    NOT_CONNECTED = 2,
+}
diff --git a/usb/aidl/android/hardware/usb/Status.aidl b/usb/aidl/android/hardware/usb/Status.aidl
new file mode 100644
index 0000000..468ba4a
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/Status.aidl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+@Backing(type="int")
+enum Status {
+    SUCCESS = 0,
+    /**
+     * error value when the HAL operation fails for reasons not listed here.
+     */
+    ERROR = 1,
+    /**
+     * error value returned when input argument is invalid.
+     */
+    INVALID_ARGUMENT = 2,
+    /**
+     * error value returned when role string is unrecognized.
+     */
+    UNRECOGNIZED_ROLE = 3,
+    /**
+     * Error value returned when the operation is not supported.
+     */
+    NOT_SUPPORTED = 4,
+}
diff --git a/usb/aidl/android/hardware/usb/UsbDataStatus.aidl b/usb/aidl/android/hardware/usb/UsbDataStatus.aidl
new file mode 100644
index 0000000..4b6a41a
--- /dev/null
+++ b/usb/aidl/android/hardware/usb/UsbDataStatus.aidl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.usb;
+
+@VintfStability
+enum UsbDataStatus {
+    /**
+     * USB data status not known.
+     */
+    UNKNOWN = 0,
+    /**
+     * USB data is enabled.
+     */
+    ENABLED = 1,
+    /**
+     * USB data is disabled as the port is hot.
+     */
+    DISABLED_OVERHEAT = 2,
+    /**
+     * USB data is disabled as port is contaminated.
+     */
+    DISABLED_CONTAMINANT = 3,
+    /**
+     * USB data is disabled due to dock.
+     */
+    DISABLED_DOCK = 4,
+    /**
+     * USB data is disabled by USB Service.
+     */
+    DISABLED_FORCE = 5,
+    /**
+     * USB data disabled for debug.
+     */
+    DISABLED_DEBUG = 6
+}
diff --git a/usb/aidl/conversion.log b/usb/aidl/conversion.log
new file mode 100644
index 0000000..c090446
--- /dev/null
+++ b/usb/aidl/conversion.log
@@ -0,0 +1,11 @@
+Notes relating to hidl2aidl conversion of android.hardware.usb@1.3 to android.hardware.usb (if any) follow:
+Unhandled comments from android.hardware.usb@1.1::types follow. Consider using hidl-lint to locate these and fixup as many as possible.
+ // NOTE: suffix '_1_1' is for legacy ABI compatibility. It cannot be
+ // changed to 'PortMode' which the convention dictates.
+ // NOTE: suffix '_1_1' is for legacy ABI compatibility. It cannot be
+ // changed to 'PortStatus' which the convention dictates.
+
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+An unknown named type was found in translation: android.hardware.usb@1.0::PortStatus
+END OF LOG
diff --git a/usb/aidl/default/Android.bp b/usb/aidl/default/Android.bp
new file mode 100644
index 0000000..da0cff2
--- /dev/null
+++ b/usb/aidl/default/Android.bp
@@ -0,0 +1,35 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_binary {
+    name: "android.hardware.usb-service.example",
+    relative_install_path: "hw",
+    init_rc: ["android.hardware.usb-service.example.rc"],
+    vintf_fragments: ["android.hardware.usb-service.example.xml"],
+    vendor: true,
+    srcs: [
+        "service.cpp",
+        "Usb.cpp",
+    ],
+    shared_libs: [
+        "android.hardware.usb-V1-ndk",
+        "libbase",
+        "libbinder_ndk",
+	"libcutils",
+        "liblog",
+        "libutils",
+    ],
+}
diff --git a/usb/aidl/default/Usb.cpp b/usb/aidl/default/Usb.cpp
new file mode 100644
index 0000000..92b09a2
--- /dev/null
+++ b/usb/aidl/default/Usb.cpp
@@ -0,0 +1,727 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.usb.aidl-service"
+
+#include <aidl/android/hardware/usb/PortRole.h>
+#include <android-base/logging.h>
+#include <android-base/properties.h>
+#include <android-base/strings.h>
+#include <assert.h>
+#include <dirent.h>
+#include <pthread.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <chrono>
+#include <regex>
+#include <thread>
+#include <unordered_map>
+
+#include <cutils/uevent.h>
+#include <sys/epoll.h>
+#include <utils/Errors.h>
+#include <utils/StrongPointer.h>
+
+#include "Usb.h"
+
+using android::base::GetProperty;
+using android::base::Trim;
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace usb {
+
+constexpr char kTypecPath[] = "/sys/class/typec/";
+constexpr char kDataRoleNode[] = "/data_role";
+constexpr char kPowerRoleNode[] = "/power_role";
+
+// Set by the signal handler to destroy the thread
+volatile bool destroyThread;
+
+void queryVersionHelper(android::hardware::usb::Usb *usb,
+                        std::vector<PortStatus> *currentPortStatus);
+
+ScopedAStatus Usb::enableUsbData(const string& in_portName, bool in_enable, int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyEnableUsbDataStatus(
+            in_portName, true, in_enable ? Status::SUCCESS : Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyEnableUsbDataStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+    queryVersionHelper(this, &currentPortStatus);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::enableUsbDataWhileDocked(const string& in_portName, int64_t in_transactionId) {
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyEnableUsbDataWhileDockedStatus(
+            in_portName, Status::NOT_SUPPORTED, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyEnableUsbDataWhileDockedStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+Status queryMoistureDetectionStatus(std::vector<PortStatus> *currentPortStatus) {
+    string enabled, status, path, DetectedPath;
+
+    for (int i = 0; i < currentPortStatus->size(); i++) {
+        (*currentPortStatus)[i].supportedContaminantProtectionModes
+                .push_back(ContaminantProtectionMode::NONE);
+        (*currentPortStatus)[i].contaminantProtectionStatus
+                = ContaminantProtectionStatus::NONE;
+        (*currentPortStatus)[i].contaminantDetectionStatus
+                = ContaminantDetectionStatus::NOT_SUPPORTED;
+        (*currentPortStatus)[i].supportsEnableContaminantPresenceDetection = false;
+        (*currentPortStatus)[i].supportsEnableContaminantPresenceProtection = false;
+    }
+
+    return Status::SUCCESS;
+}
+
+string appendRoleNodeHelper(const string &portName, PortRole::Tag tag) {
+    string node(kTypecPath + portName);
+
+    switch (tag) {
+        case PortRole::dataRole:
+            return node + kDataRoleNode;
+        case PortRole::powerRole:
+            return node + kPowerRoleNode;
+        case PortRole::mode:
+            return node + "/port_type";
+        default:
+            return "";
+    }
+}
+
+string convertRoletoString(PortRole role) {
+    if (role.getTag() == PortRole::powerRole) {
+        if (role.get<PortRole::powerRole>() == PortPowerRole::SOURCE)
+            return "source";
+        else if (role.get<PortRole::powerRole>() == PortPowerRole::SINK)
+            return "sink";
+    } else if (role.getTag() == PortRole::dataRole) {
+        if (role.get<PortRole::dataRole>() == PortDataRole::HOST)
+            return "host";
+        if (role.get<PortRole::dataRole>() == PortDataRole::DEVICE)
+            return "device";
+    } else if (role.getTag() == PortRole::mode) {
+        if (role.get<PortRole::mode>() == PortMode::UFP)
+            return "sink";
+        if (role.get<PortRole::mode>() == PortMode::DFP)
+            return "source";
+    }
+    return "none";
+}
+
+void extractRole(string *roleName) {
+    std::size_t first, last;
+
+    first = roleName->find("[");
+    last = roleName->find("]");
+
+    if (first != string::npos && last != string::npos) {
+        *roleName = roleName->substr(first + 1, last - first - 1);
+    }
+}
+
+void switchToDrp(const string &portName) {
+    string filename = appendRoleNodeHelper(string(portName.c_str()), PortRole::mode);
+    FILE *fp;
+
+    if (filename != "") {
+        fp = fopen(filename.c_str(), "w");
+        if (fp != NULL) {
+            int ret = fputs("dual", fp);
+            fclose(fp);
+            if (ret == EOF)
+                ALOGE("Fatal: Error while switching back to drp");
+        } else {
+            ALOGE("Fatal: Cannot open file to switch back to drp");
+        }
+    } else {
+        ALOGE("Fatal: invalid node type");
+    }
+}
+
+bool switchMode(const string &portName, const PortRole &in_role, struct Usb *usb) {
+    string filename = appendRoleNodeHelper(string(portName.c_str()), in_role.getTag());
+    string written;
+    FILE *fp;
+    bool roleSwitch = false;
+
+    if (filename == "") {
+        ALOGE("Fatal: invalid node type");
+        return false;
+    }
+
+    fp = fopen(filename.c_str(), "w");
+    if (fp != NULL) {
+        // Hold the lock here to prevent loosing connected signals
+        // as once the file is written the partner added signal
+        // can arrive anytime.
+        pthread_mutex_lock(&usb->mPartnerLock);
+        usb->mPartnerUp = false;
+        int ret = fputs(convertRoletoString(in_role).c_str(), fp);
+        fclose(fp);
+
+        if (ret != EOF) {
+            struct timespec to;
+            struct timespec now;
+
+        wait_again:
+            clock_gettime(CLOCK_MONOTONIC, &now);
+            to.tv_sec = now.tv_sec + PORT_TYPE_TIMEOUT;
+            to.tv_nsec = now.tv_nsec;
+
+            int err = pthread_cond_timedwait(&usb->mPartnerCV, &usb->mPartnerLock, &to);
+            // There are no uevent signals which implies role swap timed out.
+            if (err == ETIMEDOUT) {
+                ALOGI("uevents wait timedout");
+                // Validity check.
+            } else if (!usb->mPartnerUp) {
+                goto wait_again;
+                // Role switch succeeded since usb->mPartnerUp is true.
+            } else {
+                roleSwitch = true;
+            }
+        } else {
+            ALOGI("Role switch failed while wrting to file");
+        }
+        pthread_mutex_unlock(&usb->mPartnerLock);
+    }
+
+    if (!roleSwitch)
+        switchToDrp(string(portName.c_str()));
+
+    return roleSwitch;
+}
+
+Usb::Usb()
+    : mLock(PTHREAD_MUTEX_INITIALIZER),
+      mRoleSwitchLock(PTHREAD_MUTEX_INITIALIZER),
+      mPartnerLock(PTHREAD_MUTEX_INITIALIZER),
+      mPartnerUp(false)
+{
+    pthread_condattr_t attr;
+    if (pthread_condattr_init(&attr)) {
+        ALOGE("pthread_condattr_init failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_condattr_setclock(&attr, CLOCK_MONOTONIC)) {
+        ALOGE("pthread_condattr_setclock failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_cond_init(&mPartnerCV, &attr)) {
+        ALOGE("pthread_cond_init failed: %s", strerror(errno));
+        abort();
+    }
+    if (pthread_condattr_destroy(&attr)) {
+        ALOGE("pthread_condattr_destroy failed: %s", strerror(errno));
+        abort();
+    }
+}
+
+ScopedAStatus Usb::switchRole(const string& in_portName,
+        const PortRole& in_role, int64_t in_transactionId) {
+    string filename = appendRoleNodeHelper(string(in_portName.c_str()), in_role.getTag());
+    string written;
+    FILE *fp;
+    bool roleSwitch = false;
+
+    if (filename == "") {
+        ALOGE("Fatal: invalid node type");
+        return ScopedAStatus::ok();
+    }
+
+    pthread_mutex_lock(&mRoleSwitchLock);
+
+    ALOGI("filename write: %s role:%s", filename.c_str(), convertRoletoString(in_role).c_str());
+
+    if (in_role.getTag() == PortRole::mode) {
+        roleSwitch = switchMode(in_portName, in_role, this);
+    } else {
+        fp = fopen(filename.c_str(), "w");
+        if (fp != NULL) {
+            int ret = fputs(convertRoletoString(in_role).c_str(), fp);
+            fclose(fp);
+            if ((ret != EOF) && ReadFileToString(filename, &written)) {
+                written = Trim(written);
+                extractRole(&written);
+                ALOGI("written: %s", written.c_str());
+                if (written == convertRoletoString(in_role)) {
+                    roleSwitch = true;
+                } else {
+                    ALOGE("Role switch failed");
+                }
+            } else {
+                ALOGE("failed to update the new role");
+            }
+        } else {
+            ALOGE("fopen failed");
+        }
+    }
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+         ScopedAStatus ret = mCallback->notifyRoleSwitchStatus(
+            in_portName, in_role, roleSwitch ? Status::SUCCESS : Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("RoleSwitchStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+    pthread_mutex_unlock(&mRoleSwitchLock);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::limitPowerTransfer(const string& in_portName, bool /*in_limit*/,
+        int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL && in_transactionId >= 0) {
+        ScopedAStatus ret = mCallback->notifyLimitPowerTransferStatus(
+                in_portName, false, Status::NOT_SUPPORTED, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("limitPowerTransfer error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+Status getAccessoryConnected(const string &portName, string *accessory) {
+    string filename = kTypecPath + portName + "-partner/accessory_mode";
+
+    if (!ReadFileToString(filename, accessory)) {
+        ALOGE("getAccessoryConnected: Failed to open filesystem node: %s", filename.c_str());
+        return Status::ERROR;
+    }
+    *accessory = Trim(*accessory);
+
+    return Status::SUCCESS;
+}
+
+Status getCurrentRoleHelper(const string &portName, bool connected, PortRole *currentRole) {
+    string filename;
+    string roleName;
+    string accessory;
+
+    // Mode
+
+    if (currentRole->getTag() == PortRole::powerRole) {
+        filename = kTypecPath + portName + kPowerRoleNode;
+        currentRole->set<PortRole::powerRole>(PortPowerRole::NONE);
+    } else if (currentRole->getTag() == PortRole::dataRole) {
+        filename = kTypecPath + portName + kDataRoleNode;
+        currentRole->set<PortRole::dataRole>(PortDataRole::NONE);
+    } else if (currentRole->getTag() == PortRole::mode) {
+        filename = kTypecPath + portName + kDataRoleNode;
+        currentRole->set<PortRole::mode>(PortMode::NONE);
+    } else {
+        return Status::ERROR;
+    }
+
+    if (!connected)
+        return Status::SUCCESS;
+
+    if (currentRole->getTag() == PortRole::mode) {
+        if (getAccessoryConnected(portName, &accessory) != Status::SUCCESS) {
+            return Status::ERROR;
+        }
+        if (accessory == "analog_audio") {
+            currentRole->set<PortRole::mode>(PortMode::AUDIO_ACCESSORY);
+            return Status::SUCCESS;
+        } else if (accessory == "debug") {
+            currentRole->set<PortRole::mode>(PortMode::DEBUG_ACCESSORY);
+            return Status::SUCCESS;
+        }
+    }
+
+    if (!ReadFileToString(filename, &roleName)) {
+        ALOGE("getCurrentRole: Failed to open filesystem node: %s", filename.c_str());
+        return Status::ERROR;
+    }
+
+    roleName = Trim(roleName);
+    extractRole(&roleName);
+
+    if (roleName == "source") {
+        currentRole->set<PortRole::powerRole>(PortPowerRole::SOURCE);
+    } else if (roleName == "sink") {
+        currentRole->set<PortRole::powerRole>(PortPowerRole::SINK);
+    } else if (roleName == "host") {
+        if (currentRole->getTag() == PortRole::dataRole)
+            currentRole->set<PortRole::dataRole>(PortDataRole::HOST);
+        else
+            currentRole->set<PortRole::mode>(PortMode::DFP);
+    } else if (roleName == "device") {
+        if (currentRole->getTag() == PortRole::dataRole)
+            currentRole->set<PortRole::dataRole>(PortDataRole::DEVICE);
+        else
+            currentRole->set<PortRole::mode>(PortMode::UFP);
+    } else if (roleName != "none") {
+        /* case for none has already been addressed.
+         * so we check if the role isn't none.
+         */
+        return Status::UNRECOGNIZED_ROLE;
+    }
+
+    return Status::SUCCESS;
+}
+
+Status getTypeCPortNamesHelper(std::unordered_map<string, bool> *names) {
+    DIR *dp;
+
+    dp = opendir(kTypecPath);
+    if (dp != NULL) {
+        struct dirent *ep;
+
+        while ((ep = readdir(dp))) {
+            if (ep->d_type == DT_LNK) {
+                if (string::npos == string(ep->d_name).find("-partner")) {
+                    std::unordered_map<string, bool>::const_iterator portName =
+                        names->find(ep->d_name);
+                    if (portName == names->end()) {
+                        names->insert({ep->d_name, false});
+                    }
+                } else {
+                    (*names)[std::strtok(ep->d_name, "-")] = true;
+                }
+            }
+        }
+        closedir(dp);
+        return Status::SUCCESS;
+    }
+
+    ALOGE("Failed to open /sys/class/typec");
+    return Status::ERROR;
+}
+
+bool canSwitchRoleHelper(const string &portName) {
+    string filename = kTypecPath + portName + "-partner/supports_usb_power_delivery";
+    string supportsPD;
+
+    if (ReadFileToString(filename, &supportsPD)) {
+        supportsPD = Trim(supportsPD);
+        if (supportsPD == "yes") {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+Status getPortStatusHelper(std::vector<PortStatus> *currentPortStatus) {
+    std::unordered_map<string, bool> names;
+    Status result = getTypeCPortNamesHelper(&names);
+    int i = -1;
+
+    if (result == Status::SUCCESS) {
+        currentPortStatus->resize(names.size());
+        for (std::pair<string, bool> port : names) {
+            i++;
+            ALOGI("%s", port.first.c_str());
+            (*currentPortStatus)[i].portName = port.first;
+
+            PortRole currentRole;
+            currentRole.set<PortRole::powerRole>(PortPowerRole::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS){
+                (*currentPortStatus)[i].currentPowerRole = currentRole.get<PortRole::powerRole>();
+            } else {
+                ALOGE("Error while retrieving portNames");
+                goto done;
+            }
+
+            currentRole.set<PortRole::dataRole>(PortDataRole::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS) {
+                (*currentPortStatus)[i].currentDataRole = currentRole.get<PortRole::dataRole>();
+            } else {
+                ALOGE("Error while retrieving current port role");
+                goto done;
+            }
+
+            currentRole.set<PortRole::mode>(PortMode::NONE);
+            if (getCurrentRoleHelper(port.first, port.second, &currentRole) == Status::SUCCESS) {
+                (*currentPortStatus)[i].currentMode = currentRole.get<PortRole::mode>();
+            } else {
+                ALOGE("Error while retrieving current data role");
+                goto done;
+            }
+
+            (*currentPortStatus)[i].canChangeMode = true;
+            (*currentPortStatus)[i].canChangeDataRole =
+                port.second ? canSwitchRoleHelper(port.first) : false;
+            (*currentPortStatus)[i].canChangePowerRole =
+                port.second ? canSwitchRoleHelper(port.first) : false;
+
+            (*currentPortStatus)[i].supportedModes.push_back(PortMode::DRP);
+            (*currentPortStatus)[i].usbDataStatus.push_back(UsbDataStatus::ENABLED);
+
+            ALOGI("%d:%s connected:%d canChangeMode:%d canChagedata:%d canChangePower:%d "
+                "usbDataEnabled:%d",
+                i, port.first.c_str(), port.second,
+                (*currentPortStatus)[i].canChangeMode,
+                (*currentPortStatus)[i].canChangeDataRole,
+                (*currentPortStatus)[i].canChangePowerRole, 0);
+        }
+
+        return Status::SUCCESS;
+    }
+done:
+    return Status::ERROR;
+}
+
+void queryVersionHelper(android::hardware::usb::Usb *usb,
+                        std::vector<PortStatus> *currentPortStatus) {
+    Status status;
+    pthread_mutex_lock(&usb->mLock);
+    status = getPortStatusHelper(currentPortStatus);
+    queryMoistureDetectionStatus(currentPortStatus);
+    if (usb->mCallback != NULL) {
+        ScopedAStatus ret = usb->mCallback->notifyPortStatusChange(*currentPortStatus,
+            status);
+        if (!ret.isOk())
+            ALOGE("queryPortStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGI("Notifying userspace skipped. Callback is NULL");
+    }
+    pthread_mutex_unlock(&usb->mLock);
+}
+
+ScopedAStatus Usb::queryPortStatus(int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    queryVersionHelper(this, &currentPortStatus);
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyQueryPortStatus(
+            "all", Status::SUCCESS, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("notifyQueryPortStatus error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus Usb::enableContaminantPresenceDetection(const string& in_portName,
+        bool /*in_enable*/, int64_t in_transactionId) {
+    std::vector<PortStatus> currentPortStatus;
+
+    pthread_mutex_lock(&mLock);
+    if (mCallback != NULL) {
+        ScopedAStatus ret = mCallback->notifyContaminantEnabledStatus(
+            in_portName, false, Status::ERROR, in_transactionId);
+        if (!ret.isOk())
+            ALOGE("enableContaminantPresenceDetection  error %s", ret.getDescription().c_str());
+    } else {
+        ALOGE("Not notifying the userspace. Callback is not set");
+    }
+    pthread_mutex_unlock(&mLock);
+
+    queryVersionHelper(this, &currentPortStatus);
+    return ScopedAStatus::ok();
+}
+
+
+struct data {
+    int uevent_fd;
+    ::aidl::android::hardware::usb::Usb *usb;
+};
+
+static void uevent_event(uint32_t /*epevents*/, struct data *payload) {
+    char msg[UEVENT_MSG_LEN + 2];
+    char *cp;
+    int n;
+
+    n = uevent_kernel_multicast_recv(payload->uevent_fd, msg, UEVENT_MSG_LEN);
+    if (n <= 0)
+        return;
+    if (n >= UEVENT_MSG_LEN) /* overflow -- discard */
+        return;
+
+    msg[n] = '\0';
+    msg[n + 1] = '\0';
+    cp = msg;
+
+    while (*cp) {
+        if (std::regex_match(cp, std::regex("(add)(.*)(-partner)"))) {
+            ALOGI("partner added");
+            pthread_mutex_lock(&payload->usb->mPartnerLock);
+            payload->usb->mPartnerUp = true;
+            pthread_cond_signal(&payload->usb->mPartnerCV);
+            pthread_mutex_unlock(&payload->usb->mPartnerLock);
+        } else if (!strncmp(cp, "DEVTYPE=typec_", strlen("DEVTYPE=typec_"))) {
+            std::vector<PortStatus> currentPortStatus;
+            queryVersionHelper(payload->usb, &currentPortStatus);
+
+            // Role switch is not in progress and port is in disconnected state
+            if (!pthread_mutex_trylock(&payload->usb->mRoleSwitchLock)) {
+                for (unsigned long i = 0; i < currentPortStatus.size(); i++) {
+                    DIR *dp =
+                        opendir(string(kTypecPath +
+                                       string(currentPortStatus[i].portName.c_str()) +
+                                       "-partner").c_str());
+                    if (dp == NULL) {
+                        switchToDrp(currentPortStatus[i].portName);
+                    } else {
+                        closedir(dp);
+                    }
+                }
+                pthread_mutex_unlock(&payload->usb->mRoleSwitchLock);
+            }
+            break;
+        } /* advance to after the next \0 */
+        while (*cp++) {
+        }
+    }
+}
+
+void *work(void *param) {
+    int epoll_fd, uevent_fd;
+    struct epoll_event ev;
+    int nevents = 0;
+    struct data payload;
+
+    uevent_fd = uevent_open_socket(UEVENT_MAX_EVENTS * UEVENT_MSG_LEN, true);
+
+    if (uevent_fd < 0) {
+        ALOGE("uevent_init: uevent_open_socket failed\n");
+        return NULL;
+    }
+
+    payload.uevent_fd = uevent_fd;
+    payload.usb = (::aidl::android::hardware::usb::Usb *)param;
+
+    fcntl(uevent_fd, F_SETFL, O_NONBLOCK);
+
+    ev.events = EPOLLIN;
+    ev.data.ptr = (void *)uevent_event;
+
+    epoll_fd = epoll_create(UEVENT_MAX_EVENTS);
+    if (epoll_fd == -1) {
+        ALOGE("epoll_create failed; errno=%d", errno);
+        goto error;
+    }
+
+    if (epoll_ctl(epoll_fd, EPOLL_CTL_ADD, uevent_fd, &ev) == -1) {
+        ALOGE("epoll_ctl failed; errno=%d", errno);
+        goto error;
+    }
+
+    while (!destroyThread) {
+        struct epoll_event events[UEVENT_MAX_EVENTS];
+
+        nevents = epoll_wait(epoll_fd, events, UEVENT_MAX_EVENTS, -1);
+        if (nevents == -1) {
+            if (errno == EINTR)
+                continue;
+            ALOGE("usb epoll_wait failed; errno=%d", errno);
+            break;
+        }
+
+        for (int n = 0; n < nevents; ++n) {
+            if (events[n].data.ptr)
+                (*(void (*)(int, struct data *payload))events[n].data.ptr)(events[n].events,
+                                                                           &payload);
+        }
+    }
+
+    ALOGI("exiting worker thread");
+error:
+    close(uevent_fd);
+
+    if (epoll_fd >= 0)
+        close(epoll_fd);
+
+    return NULL;
+}
+
+void sighandler(int sig) {
+    if (sig == SIGUSR1) {
+        destroyThread = true;
+        ALOGI("destroy set");
+        return;
+    }
+    signal(SIGUSR1, sighandler);
+}
+
+ScopedAStatus Usb::setCallback(
+        const shared_ptr<IUsbCallback>& in_callback) {
+
+    pthread_mutex_lock(&mLock);
+    if ((mCallback == NULL && in_callback == NULL) ||
+            (mCallback != NULL && in_callback != NULL)) {
+        mCallback = in_callback;
+        pthread_mutex_unlock(&mLock);
+        return ScopedAStatus::ok();
+    }
+
+    mCallback = in_callback;
+    ALOGI("registering callback");
+
+    if (mCallback == NULL) {
+        if  (!pthread_kill(mPoll, SIGUSR1)) {
+            pthread_join(mPoll, NULL);
+            ALOGI("pthread destroyed");
+        }
+        pthread_mutex_unlock(&mLock);
+        return ScopedAStatus::ok();
+    }
+
+    destroyThread = false;
+    signal(SIGUSR1, sighandler);
+
+    /*
+     * Create a background thread if the old callback value is NULL
+     * and being updated with a new value.
+     */
+    if (pthread_create(&mPoll, NULL, work, this)) {
+        ALOGE("pthread creation failed %d", errno);
+        mCallback = NULL;
+    }
+
+    pthread_mutex_unlock(&mLock);
+    return ScopedAStatus::ok();
+}
+
+} // namespace usb
+} // namespace hardware
+} // namespace android
+} // aidl
diff --git a/usb/aidl/default/Usb.h b/usb/aidl/default/Usb.h
new file mode 100644
index 0000000..7e8422e
--- /dev/null
+++ b/usb/aidl/default/Usb.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android-base/file.h>
+#include <aidl/android/hardware/usb/BnUsb.h>
+#include <aidl/android/hardware/usb/BnUsbCallback.h>
+#include <utils/Log.h>
+
+#define UEVENT_MSG_LEN     2048
+#define UEVENT_MAX_EVENTS  64
+// The type-c stack waits for 4.5 - 5.5 secs before declaring a port non-pd.
+// The -partner directory would not be created until this is done.
+// Having a margin of ~3 secs for the directory and other related bookeeping
+// structures created and uvent fired.
+#define PORT_TYPE_TIMEOUT 8
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace usb {
+
+using ::aidl::android::hardware::usb::IUsbCallback;
+using ::aidl::android::hardware::usb::PortRole;
+using ::android::base::ReadFileToString;
+using ::android::base::WriteStringToFile;
+using ::android::sp;
+using ::ndk::ScopedAStatus;
+using ::std::shared_ptr;
+using ::std::string;
+
+struct Usb : public BnUsb {
+    Usb();
+
+    ScopedAStatus enableContaminantPresenceDetection(const std::string& in_portName,
+            bool in_enable, int64_t in_transactionId) override;
+    ScopedAStatus queryPortStatus(int64_t in_transactionId) override;
+    ScopedAStatus setCallback(const shared_ptr<IUsbCallback>& in_callback) override;
+    ScopedAStatus switchRole(const string& in_portName, const PortRole& in_role,
+            int64_t in_transactionId) override;
+    ScopedAStatus enableUsbData(const string& in_portName, bool in_enable,
+            int64_t in_transactionId) override;
+    ScopedAStatus enableUsbDataWhileDocked(const string& in_portName,
+            int64_t in_transactionId) override;
+    ScopedAStatus limitPowerTransfer(const std::string& in_portName, bool in_limit,
+            int64_t in_transactionId)override;
+
+    shared_ptr<IUsbCallback> mCallback;
+    // Protects mCallback variable
+    pthread_mutex_t mLock;
+    // Protects roleSwitch operation
+    pthread_mutex_t mRoleSwitchLock;
+    // Threads waiting for the partner to come back wait here
+    pthread_cond_t mPartnerCV;
+    // lock protecting mPartnerCV
+    pthread_mutex_t mPartnerLock;
+    // Variable to signal partner coming back online after type switch
+    bool mPartnerUp;
+  private:
+    pthread_t mPoll;
+};
+
+} // namespace usb
+} // namespace hardware
+} // namespace android
+} // aidl
diff --git a/usb/aidl/default/android.hardware.usb-service.example.rc b/usb/aidl/default/android.hardware.usb-service.example.rc
new file mode 100644
index 0000000..335bca7
--- /dev/null
+++ b/usb/aidl/default/android.hardware.usb-service.example.rc
@@ -0,0 +1,4 @@
+service vendor.usb_default /vendor/bin/hw/android.hardware.usb-service.example
+    class hal
+    user system
+    group system
diff --git a/usb/aidl/default/android.hardware.usb-service.example.xml b/usb/aidl/default/android.hardware.usb-service.example.xml
new file mode 100644
index 0000000..6088194
--- /dev/null
+++ b/usb/aidl/default/android.hardware.usb-service.example.xml
@@ -0,0 +1,10 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.usb</name>
+        <version>1</version>
+        <interface>
+            <name>IUsb</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/usb/aidl/default/service.cpp b/usb/aidl/default/service.cpp
new file mode 100644
index 0000000..398458a
--- /dev/null
+++ b/usb/aidl/default/service.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+#include "Usb.h"
+
+using ::aidl::android::hardware::usb::Usb;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<Usb> usb = ndk::SharedRefBase::make<Usb>();
+
+    const std::string instance = std::string() + Usb::descriptor + "/default";
+    binder_status_t status = AServiceManager_addService(usb->asBinder().get(), instance.c_str());
+    CHECK(status == STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return -1; // Should never be reached
+}
diff --git a/usb/aidl/vts/Android.bp b/usb/aidl/vts/Android.bp
new file mode 100644
index 0000000..00a7c93
--- /dev/null
+++ b/usb/aidl/vts/Android.bp
@@ -0,0 +1,43 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "hardware_interfaces_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["hardware_interfaces_license"],
+}
+
+cc_test {
+    name: "VtsAidlUsbTargetTest",
+    defaults: [
+        "VtsHalTargetTestDefaults",
+        "use_libaidlvintf_gtest_helper_static",
+    ],
+    srcs: ["VtsAidlUsbTargetTest.cpp"],
+    shared_libs: [
+        "libbinder_ndk",
+    ],
+    static_libs: [
+        "android.hardware.usb-V1-ndk",
+    ],
+    test_suites: [
+        "general-tests",
+        "vts",
+    ],
+}
diff --git a/usb/aidl/vts/VtsAidlUsbTargetTest.cpp b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
new file mode 100644
index 0000000..ed3bd6e
--- /dev/null
+++ b/usb/aidl/vts/VtsAidlUsbTargetTest.cpp
@@ -0,0 +1,523 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Probject
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "UsbAidlTest"
+#include <android-base/logging.h>
+
+#include <aidl/android/hardware/usb/IUsb.h>
+#include <aidl/android/hardware/usb/IUsbCallback.h>
+#include <aidl/android/hardware/usb/BnUsbCallback.h>
+#include <aidl/android/hardware/usb/PortDataRole.h>
+#include <aidl/android/hardware/usb/PortMode.h>
+#include <aidl/android/hardware/usb/PortPowerRole.h>
+#include <aidl/android/hardware/usb/PortRole.h>
+#include <aidl/android/hardware/usb/PortStatus.h>
+#include <aidl/android/hardware/usb/Status.h>
+#include <aidl/Vintf.h>
+#include <aidl/Gtest.h>
+
+#include <android/binder_auto_utils.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <gtest/gtest.h>
+
+#include <log/log.h>
+#include <stdlib.h>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+#define TIMEOUT_PERIOD 10
+
+using ::aidl::android::hardware::usb::BnUsbCallback;
+using ::aidl::android::hardware::usb::IUsb;
+using ::aidl::android::hardware::usb::IUsbCallback;
+using ::aidl::android::hardware::usb::PortDataRole;
+using ::aidl::android::hardware::usb::PortMode;
+using ::aidl::android::hardware::usb::PortPowerRole;
+using ::aidl::android::hardware::usb::PortRole;
+using ::aidl::android::hardware::usb::PortStatus;
+using ::aidl::android::hardware::usb::Status;
+
+using ::ndk::ScopedAStatus;
+using ::ndk::SpAIBinder;
+using std::vector;
+using std::shared_ptr;
+using std::string;
+
+// The main test class for the USB aidl hal
+class UsbAidlTest : public testing::TestWithParam<std::string> {
+ public:
+  // Callback class for the USB aidl hal.
+  // Usb Hal will call this object upon role switch or port query.
+  class UsbCallback : public BnUsbCallback {
+    UsbAidlTest& parent_;
+    int cookie;
+
+   public:
+    UsbCallback(UsbAidlTest& parent, int cookie)
+        : parent_(parent), cookie(cookie){};
+
+    virtual ~UsbCallback() = default;
+
+    // Callback method for the port status.
+    ScopedAStatus notifyPortStatusChange(const vector<PortStatus>& currentPortStatus,
+                                         Status retval) override {
+      if (retval == Status::SUCCESS && currentPortStatus.size() > 0) {
+        parent_.usb_last_port_status.portName =
+            currentPortStatus[0].portName.c_str();
+        parent_.usb_last_port_status.currentDataRole =
+            currentPortStatus[0].currentDataRole;
+        parent_.usb_last_port_status.currentPowerRole =
+            currentPortStatus[0].currentPowerRole;
+        parent_.usb_last_port_status.currentMode =
+            currentPortStatus[0].currentMode;
+      }
+      parent_.usb_last_cookie = cookie;
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of role switch operation.
+    ScopedAStatus notifyRoleSwitchStatus(const string& /*portName*/, const PortRole& newRole,
+                                         Status retval, int64_t transactionId) override {
+      parent_.usb_last_status = retval;
+      parent_.usb_last_cookie = cookie;
+      parent_.usb_last_port_role = newRole;
+      parent_.usb_role_switch_done = true;
+      parent_.last_transactionId = transactionId;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableUsbData operation
+    ScopedAStatus notifyEnableUsbDataStatus(const string& /*portName*/, bool /*enable*/,
+                                            Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_usb_data_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableUsbData operation
+    ScopedAStatus notifyEnableUsbDataWhileDockedStatus(const string& /*portName*/,
+                                                       Status /*retval*/,
+                                                       int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_usb_data_while_docked_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of enableContaminantPresenceDetection
+    ScopedAStatus notifyContaminantEnabledStatus(const string& /*portName*/, bool /*enable*/,
+                                                 Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.enable_contaminant_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of queryPortStatus operation
+    ScopedAStatus notifyQueryPortStatus(const string& /*portName*/, Status /*retval*/,
+                                        int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+
+    // Callback method for the status of limitPowerTransfer operation
+    ScopedAStatus notifyLimitPowerTransferStatus(const string& /*portName*/, bool /*limit*/,
+                                                 Status /*retval*/, int64_t transactionId) override {
+      parent_.last_transactionId = transactionId;
+      parent_.usb_last_cookie = cookie;
+      parent_.limit_power_transfer_done = true;
+      parent_.notify();
+      return ScopedAStatus::ok();
+    }
+  };
+
+  virtual void SetUp() override {
+    ALOGI("Setup");
+    usb = IUsb::fromBinder(
+                SpAIBinder(AServiceManager_waitForService(GetParam().c_str())));
+    ASSERT_NE(usb, nullptr);
+
+    usb_cb_2 = ::ndk::SharedRefBase::make<UsbCallback>(*this, 2);
+    ASSERT_NE(usb_cb_2, nullptr);
+    const auto& ret = usb->setCallback(usb_cb_2);
+    ASSERT_TRUE(ret.isOk());
+  }
+
+  virtual void TearDown() override { ALOGI("Teardown"); }
+
+  // Used as a mechanism to inform the test about data/event callback.
+  inline void notify() {
+    std::unique_lock<std::mutex> lock(usb_mtx);
+    usb_count++;
+    usb_cv.notify_one();
+  }
+
+  // Test code calls this function to wait for data/event callback.
+  inline std::cv_status wait() {
+    std::unique_lock<std::mutex> lock(usb_mtx);
+
+    std::cv_status status = std::cv_status::no_timeout;
+    auto now = std::chrono::system_clock::now();
+    while (usb_count == 0) {
+      status =
+          usb_cv.wait_until(lock, now + std::chrono::seconds(TIMEOUT_PERIOD));
+      if (status == std::cv_status::timeout) {
+        ALOGI("timeout");
+        return status;
+      }
+    }
+    usb_count--;
+    return status;
+  }
+
+  // USB aidl hal Proxy
+  shared_ptr<IUsb> usb;
+
+  // Callback objects for usb aidl
+  // Methods of these objects are called to notify port status updates.
+  shared_ptr<IUsbCallback> usb_cb_1, usb_cb_2;
+
+  // The last conveyed status of the USB ports.
+  // Stores information of currentt_data_role, power_role for all the USB ports
+  PortStatus usb_last_port_status;
+
+  // Status of the last role switch operation.
+  Status usb_last_status;
+
+  // Port role information of the last role switch operation.
+  PortRole usb_last_port_role;
+
+  // Flag to indicate the invocation of role switch callback.
+  bool usb_role_switch_done;
+
+  // Flag to indicate the invocation of notifyContaminantEnabledStatus callback.
+  bool enable_contaminant_done;
+
+  // Flag to indicate the invocation of notifyEnableUsbDataStatus callback.
+  bool enable_usb_data_done;
+
+  // Flag to indicate the invocation of notifyEnableUsbDataWhileDockedStatus callback.
+  bool enable_usb_data_while_docked_done;
+
+  // Flag to indicate the invocation of notifyLimitPowerTransferStatus callback.
+  bool limit_power_transfer_done;
+
+  // Stores the cookie of the last invoked usb callback object.
+  int usb_last_cookie;
+
+  // Last transaction ID that was recorded.
+  int64_t last_transactionId;
+  // synchronization primitives to coordinate between main test thread
+  // and the callback thread.
+  std::mutex usb_mtx;
+  std::condition_variable usb_cv;
+  int usb_count = 0;
+};
+
+/*
+ * Test to see if setCallback succeeds.
+ * Callback object is created and registered.
+ */
+TEST_P(UsbAidlTest, setCallback) {
+  ALOGI("UsbAidlTest setCallback start");
+  usb_cb_1 = ::ndk::SharedRefBase::make<UsbCallback>(*this, 1);
+  ASSERT_NE(usb_cb_1, nullptr);
+  const auto& ret = usb->setCallback(usb_cb_1);
+  ASSERT_TRUE(ret.isOk());
+  ALOGI("UsbAidlTest setCallback end");
+}
+
+/*
+ * Check to see if querying type-c
+ * port status succeeds.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, queryPortStatus) {
+  ALOGI("UsbAidlTest queryPortStatus start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+  ALOGI("UsbAidlTest queryPortStatus end: %s", usb_last_port_status.portName.c_str());
+}
+
+/*
+ * Trying to switch a non-existent port should fail.
+ * This test case tried to switch the port with empty
+ * name which is expected to fail.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchEmptyPort) {
+  ALOGI("UsbAidlTest switchEmptyPort start");
+  PortRole role;
+  role.set<PortRole::powerRole>(PortPowerRole::SOURCE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->switchRole("", role, transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(Status::ERROR, usb_last_status);
+  EXPECT_EQ(transactionId, last_transactionId);
+  EXPECT_EQ(2, usb_last_cookie);
+  ALOGI("UsbAidlTest switchEmptyPort end");
+}
+
+/*
+ * Test switching the power role of usb port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, a power role switch
+ * to SOURCE is attempted for the port.
+ * The callback parameters are checked to see if the transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchPowerRole) {
+  ALOGI("UsbAidlTest switchPowerRole start");
+  PortRole role;
+  role.set<PortRole::powerRole>(PortPowerRole::SOURCE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    string portBeingSwitched = usb_last_port_status.portName;
+    ALOGI("switchPower role portname:%s", portBeingSwitched.c_str());
+    usb_role_switch_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->switchRole(portBeingSwitched, role, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           usb_role_switch_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest switchPowerRole end");
+}
+
+/*
+ * Test switching the data role of usb port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, a data role switch
+ * to device is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, switchDataRole) {
+  ALOGI("UsbAidlTest switchDataRole start");
+  PortRole role;
+  role.set<PortRole::dataRole>(PortDataRole::DEVICE);
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    string portBeingSwitched = usb_last_port_status.portName;
+    ALOGI("portname:%s", portBeingSwitched.c_str());
+    usb_role_switch_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->switchRole(portBeingSwitched, role, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           usb_role_switch_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest switchDataRole end");
+}
+
+/*
+ * Test enabling contaminant presence detection of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling contaminant detection
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableContaminantPresenceDetection) {
+  ALOGI("UsbAidlTest enableContaminantPresenceDetection start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_contaminant_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableContaminantPresenceDetection(usb_last_port_status.portName,
+                                                              true, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_contaminant_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableContaminantPresenceDetection end");
+}
+
+/*
+ * Test enabling Usb data of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling Usb data is attempted
+ * for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableUsbData) {
+  ALOGI("UsbAidlTest enableUsbData start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_usb_data_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableUsbData(usb_last_port_status.portName, true, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_usb_data_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableUsbData end");
+}
+
+/*
+ * Test enabling Usb data while being docked.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, enabling Usb data while docked
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, enableUsbDataWhileDocked) {
+  ALOGI("UsbAidlTest enableUsbDataWhileDocked start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    enable_usb_data_while_docked_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->enableUsbDataWhileDocked(usb_last_port_status.portName, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           enable_usb_data_while_docked_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest enableUsbDataWhileDocked end");
+}
+
+/*
+ * Test enabling Usb data of the port.
+ * Test case queries the usb ports present in device.
+ * If there is at least one usb port, relaxing limit power transfer
+ * is attempted for the port.
+ * The callback parameters are checked to see if transaction id
+ * matches.
+ */
+TEST_P(UsbAidlTest, limitPowerTransfer) {
+  ALOGI("UsbAidlTest limitPowerTransfer start");
+  int64_t transactionId = rand() % 10000;
+  const auto& ret = usb->queryPortStatus(transactionId);
+  ASSERT_TRUE(ret.isOk());
+  EXPECT_EQ(std::cv_status::no_timeout, wait());
+  EXPECT_EQ(2, usb_last_cookie);
+  EXPECT_EQ(transactionId, last_transactionId);
+
+  if (!usb_last_port_status.portName.empty()) {
+    ALOGI("portname:%s", usb_last_port_status.portName.c_str());
+    limit_power_transfer_done = false;
+    transactionId = rand() % 10000;
+    const auto& ret = usb->limitPowerTransfer(usb_last_port_status.portName, false, transactionId);
+    ASSERT_TRUE(ret.isOk());
+
+    std::cv_status waitStatus = wait();
+    while (waitStatus == std::cv_status::no_timeout &&
+           limit_power_transfer_done == false)
+      waitStatus = wait();
+
+    EXPECT_EQ(std::cv_status::no_timeout, waitStatus);
+    EXPECT_EQ(2, usb_last_cookie);
+    EXPECT_EQ(transactionId, last_transactionId);
+  }
+  ALOGI("UsbAidlTest limitPowerTransfer end");
+}
+
+GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(UsbAidlTest);
+INSTANTIATE_TEST_SUITE_P(
+        PerInstance, UsbAidlTest,
+        testing::ValuesIn(::android::getAidlHalInstanceNames(IUsb::descriptor)),
+        ::android::PrintInstanceNameToString);
+
+int main(int argc, char** argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    ABinderProcess_setThreadPoolMaxThreadCount(1);
+    ABinderProcess_startThreadPool();
+    return RUN_ALL_TESTS();
+}
diff --git a/wifi/1.6/Android.bp b/wifi/1.6/Android.bp
index d293c73..14cb2e0 100644
--- a/wifi/1.6/Android.bp
+++ b/wifi/1.6/Android.bp
@@ -14,6 +14,13 @@
     root: "android.hardware",
     srcs: [
         "IWifi.hal",
+        "IWifiChip.hal",
+        "IWifiNanIface.hal",
+        "IWifiNanIfaceEventCallback.hal",
+        "IWifiRttController.hal",
+        "IWifiRttControllerEventCallback.hal",
+        "IWifiStaIface.hal",
+        "types.hal",
     ],
     interfaces: [
         "android.hardware.wifi@1.0",
diff --git a/wifi/1.6/IWifiChip.hal b/wifi/1.6/IWifiChip.hal
new file mode 100644
index 0000000..301bd82
--- /dev/null
+++ b/wifi/1.6/IWifiChip.hal
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::IWifiIface;
+import @1.0::WifiStatus;
+import @1.5::WifiBand;
+import @1.5::IWifiChip;
+import @1.5::WifiIfaceMode;
+import IWifiRttController;
+
+/**
+ * Interface that represents a chip that must be configured as a single unit.
+ */
+interface IWifiChip extends @1.5::IWifiChip {
+
+    /**
+     * Create a RTTController instance.
+     *
+     * RTT controller can be either:
+     * a) Bound to a specific iface by passing in the corresponding |IWifiIface|
+     * object in |iface| param, OR
+     * b) Let the implementation decide the iface to use for RTT operations by
+     * passing null in |iface| param.
+     *
+     * @param boundIface HIDL interface object representing the iface if
+     *        the responder must be bound to a specific iface, null otherwise.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_CHIP_INVALID|
+     */
+    createRttController_1_6(IWifiIface boundIface)
+        generates (WifiStatus status, IWifiRttController rtt);
+
+    /**
+     * Retrieve list of usable Wifi channels for the specified band &
+     * operational modes.
+     *
+     * The list of usable Wifi channels in a given band depends on factors
+     * like current country code, operational mode (e.g. STA, SAP, WFD-CLI,
+     * WFD-GO, TDLS, NAN) and other restrictons due to DFS, cellular coexistence
+     * and conncurency state of the device.
+     *
+     * @param band |WifiBand| for which list of usable channels is requested.
+     * @param ifaceModeMask Bitmask of the modes represented by |WifiIfaceMode|
+     *        Bitmask respresents all the modes that the caller is interested
+     *        in (e.g. STA, SAP, CLI, GO, TDLS, NAN). E.g. If the caller is
+     *        interested in knowing usable channels for P2P CLI, P2P GO & NAN,
+     *        ifaceModeMask would be set to
+     *        IFACE_MODE_P2P_CLIENT|IFACE_MODE_P2P_GO|IFACE_MODE_NAN.
+     * @param filterMask Bitmask of filters represented by
+     *        |UsableChannelFilter|. Specifies whether driver should filter
+     *        channels based on additional criteria. If no filter is specified
+     *        driver should return usable channels purely based on regulatory
+     *        constraints.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.FAILURE_UNKNOWN|
+     * @return channels List of channels represented by |WifiUsableChannel|
+     *         Each entry represents a channel frequency, bandwidth and
+     *         bitmask of modes (e.g. STA, SAP, CLI, GO, TDLS, NAN) that are
+     *         allowed on that channel. E.g. If only STA mode can be supported
+     *         on an indoor channel, only the IFACE_MODE_STA bit would be set
+     *         for that channel. If 5GHz SAP cannot be supported, then none of
+     *         the 5GHz channels will have IFACE_MODE_SOFTAP bit set.
+     *         Note: Bits do not represent concurrency state. Each bit only
+     *         represents whether particular mode is allowed on that channel.
+     */
+    getUsableChannels_1_6(WifiBand band, bitfield<WifiIfaceMode> ifaceModeMask,
+            bitfield<UsableChannelFilter> filterMask)
+        generates (WifiStatus status, vec<WifiUsableChannel> channels);
+};
diff --git a/wifi/1.6/IWifiNanIface.hal b/wifi/1.6/IWifiNanIface.hal
new file mode 100644
index 0000000..b92a880
--- /dev/null
+++ b/wifi/1.6/IWifiNanIface.hal
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::WifiStatus;
+import @1.5::IWifiNanIface;
+import IWifiNanIfaceEventCallback;
+
+/**
+ * Interface used to represent a single NAN (Neighbour Aware Network) iface.
+ *
+ * References to "NAN Spec" are to the Wi-Fi Alliance "Wi-Fi Neighbor Awareness
+ * Networking (NAN) Technical Specification".
+ */
+interface IWifiNanIface extends @1.5::IWifiNanIface {
+    /**
+     * Requests notifications of significant events on this iface. Multiple calls
+     * to this must register multiple callbacks each of which must receive all
+     * events.
+     *
+     * @param callback An instance of the |IWifiNanIfaceEventCallback| HIDL interface
+     *        object.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|
+     */
+    registerEventCallback_1_6(IWifiNanIfaceEventCallback callback) generates (WifiStatus status);
+};
diff --git a/wifi/1.6/IWifiNanIfaceEventCallback.hal b/wifi/1.6/IWifiNanIfaceEventCallback.hal
new file mode 100644
index 0000000..05b8ddf
--- /dev/null
+++ b/wifi/1.6/IWifiNanIfaceEventCallback.hal
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::CommandIdShort;
+import @1.0::WifiNanStatus;
+import @1.5::IWifiNanIfaceEventCallback;
+
+/**
+ * NAN Response and Asynchronous Event Callbacks.
+ *
+ * References to "NAN Spec" are to the Wi-Fi Alliance "Wi-Fi Neighbor Awareness
+ * Networking (NAN) Technical Specification".
+ */
+interface IWifiNanIfaceEventCallback extends @1.5::IWifiNanIfaceEventCallback {
+    /**
+     * Asynchronous callback indicating a data-path (NDP) setup has been completed: received by
+     * both Initiator and Responder.
+     *
+     * Note: supersedes the @1.0::IWifiNanIfaceEventCallback.eventDataPathConfirm() method which is
+     * deprecated as of HAL version 1.2.
+     *
+     * @param event: NanDataPathConfirmInd containing event details.
+     */
+    oneway eventDataPathConfirm_1_6(NanDataPathConfirmInd event);
+
+    /**
+     * Asynchronous callback indicating a data-path (NDP) schedule has been updated (e.g. channels
+     * have been changed).
+     *
+     * @param event: NanDataPathScheduleUpdateInd containing event details.
+     */
+    oneway eventDataPathScheduleUpdate_1_6(NanDataPathScheduleUpdateInd event);
+};
diff --git a/wifi/1.6/IWifiRttController.hal b/wifi/1.6/IWifiRttController.hal
new file mode 100644
index 0000000..0db1d2c
--- /dev/null
+++ b/wifi/1.6/IWifiRttController.hal
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::CommandId;
+import @1.0::WifiStatus;
+import @1.4::IWifiRttController;
+import IWifiRttControllerEventCallback;
+/**
+ * Interface used to perform RTT(Round trip time) operations.
+ */
+interface IWifiRttController extends @1.4::IWifiRttController {
+    /**
+     * Requests notifications of significant events on this rtt controller.
+     * Multiple calls to this must register multiple callbacks each of which must
+     * receive all events.
+     *
+     * @param callback An instance of the |IWifiRttControllerEventCallback| HIDL
+     *        interface object.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|
+     */
+    registerEventCallback_1_6(IWifiRttControllerEventCallback callback)
+        generates (WifiStatus status);
+
+    /**
+     * API to request RTT measurement.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @param rttConfigs Vector of |RttConfig| parameters.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    rangeRequest_1_6(CommandId cmdId, vec<RttConfig> rttConfigs) generates (WifiStatus status);
+
+    /**
+     * Get RTT responder information e.g. WiFi channel to enable responder on.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     * @return info Instance of |RttResponderInfo|.
+     */
+    getResponderInfo_1_6() generates (WifiStatus status, RttResponder info);
+
+    /**
+     * Enable RTT responder mode.
+     *
+     * @param cmdId command Id to use for this invocation.
+     * @parm channelHint Hint of the channel information where RTT responder must
+     *       be enabled on.
+     * @param maxDurationInSeconds Timeout of responder mode.
+     * @param info Instance of |RttResponderInfo|.
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_INVALID_ARGS|,
+     *         |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     */
+    enableResponder_1_6(CommandId cmdId, WifiChannelInfo channelHint,
+        uint32_t maxDurationInSeconds, RttResponder info) generates (WifiStatus status);
+
+    /**
+     * RTT capabilities of the device.
+     *
+     * @return status WifiStatus of the operation.
+     *         Possible status codes:
+     *         |WifiStatusCode.SUCCESS|,
+     *         |WifiStatusCode.ERROR_WIFI_RTT_CONTROLLER_INVALID|,
+     *         |WifiStatusCode.ERROR_UNKNOWN|
+     * @return capabilities Instance of |RttCapabilities|.
+     */
+    getCapabilities_1_6() generates (WifiStatus status, RttCapabilities capabilities);
+};
diff --git a/wifi/1.6/IWifiRttControllerEventCallback.hal b/wifi/1.6/IWifiRttControllerEventCallback.hal
new file mode 100644
index 0000000..0857b66
--- /dev/null
+++ b/wifi/1.6/IWifiRttControllerEventCallback.hal
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.4::IWifiRttControllerEventCallback;
+import @1.0::CommandId;
+
+/**
+ * RTT Response and Event Callbacks.
+ */
+interface IWifiRttControllerEventCallback extends @1.4::IWifiRttControllerEventCallback {
+    /*
+     * Invoked when an RTT result is available.
+     *
+     * @param cmdId command Id corresponding to the original request.
+     * @param results Vector of |RttResult| instances.
+     */
+    oneway onResults_1_6(CommandId cmdId, vec<RttResult> results);
+};
diff --git a/wifi/1.6/IWifiStaIface.hal b/wifi/1.6/IWifiStaIface.hal
new file mode 100644
index 0000000..c26e1a0
--- /dev/null
+++ b/wifi/1.6/IWifiStaIface.hal
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::WifiStatus;
+import @1.5::IWifiStaIface;
+
+/**
+ * Interface used to represent a single STA iface.
+ *
+ * IWifiChip.createStaIface() must return a @1.6::IWifiStaIface when supported.
+ */
+interface IWifiStaIface extends @1.5::IWifiStaIface {
+    /**
+     * Retrieve the latest link layer stats.
+     * Must fail if |StaIfaceCapabilityMask.LINK_LAYER_STATS| is not set or if
+     * link layer stats collection hasn't been explicitly enabled.
+     *
+     * @return status WifiStatus of the operation.
+     *     Possible status codes:
+     *     |WifiStatusCode.SUCCESS|,
+     *     |WifiStatusCode.ERROR_WIFI_IFACE_INVALID|,
+     *     |WifiStatusCode.ERROR_NOT_SUPPORTED|,
+     *     |WifiStatusCode.ERROR_NOT_STARTED|,
+     *     |WifiStatusCode.ERROR_NOT_AVAILABLE|,
+     *     |WifiStatusCode.ERROR_UNKNOWN|
+     * @return stats Instance of |LinkLayerStats|.
+     */
+    getLinkLayerStats_1_6() generates (WifiStatus status, StaLinkLayerStats stats);
+};
diff --git a/wifi/1.6/default/hidl_struct_util.cpp b/wifi/1.6/default/hidl_struct_util.cpp
index 3489c9e..2a6b131 100644
--- a/wifi/1.6/default/hidl_struct_util.cpp
+++ b/wifi/1.6/default/hidl_struct_util.cpp
@@ -438,7 +438,7 @@
 
 bool convertLegacyWifiUsableChannelToHidl(
         const legacy_hal::wifi_usable_channel& legacy_usable_channel,
-        V1_5::WifiUsableChannel* hidl_usable_channel) {
+        V1_6::WifiUsableChannel* hidl_usable_channel) {
     if (!hidl_usable_channel) {
         return false;
     }
@@ -454,13 +454,13 @@
 
 bool convertLegacyWifiUsableChannelsToHidl(
         const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
-        std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels) {
+        std::vector<V1_6::WifiUsableChannel>* hidl_usable_channels) {
     if (!hidl_usable_channels) {
         return false;
     }
     *hidl_usable_channels = {};
     for (const auto& legacy_usable_channel : legacy_usable_channels) {
-        V1_5::WifiUsableChannel hidl_usable_channel;
+        V1_6::WifiUsableChannel hidl_usable_channel;
         if (!convertLegacyWifiUsableChannelToHidl(legacy_usable_channel, &hidl_usable_channel)) {
             return false;
         }
@@ -894,28 +894,28 @@
 
 bool convertLegacyLinkLayerRadioStatsToHidl(
         const legacy_hal::LinkLayerRadioStats& legacy_radio_stat,
-        V1_5::StaLinkLayerRadioStats* hidl_radio_stat) {
+        V1_6::StaLinkLayerRadioStats* hidl_radio_stat) {
     if (!hidl_radio_stat) {
         return false;
     }
     *hidl_radio_stat = {};
 
     hidl_radio_stat->radioId = legacy_radio_stat.stats.radio;
-    hidl_radio_stat->V1_3.V1_0.onTimeInMs = legacy_radio_stat.stats.on_time;
-    hidl_radio_stat->V1_3.V1_0.txTimeInMs = legacy_radio_stat.stats.tx_time;
-    hidl_radio_stat->V1_3.V1_0.rxTimeInMs = legacy_radio_stat.stats.rx_time;
-    hidl_radio_stat->V1_3.V1_0.onTimeInMsForScan = legacy_radio_stat.stats.on_time_scan;
-    hidl_radio_stat->V1_3.V1_0.txTimeInMsPerLevel = legacy_radio_stat.tx_time_per_levels;
-    hidl_radio_stat->V1_3.onTimeInMsForNanScan = legacy_radio_stat.stats.on_time_nbd;
-    hidl_radio_stat->V1_3.onTimeInMsForBgScan = legacy_radio_stat.stats.on_time_gscan;
-    hidl_radio_stat->V1_3.onTimeInMsForRoamScan = legacy_radio_stat.stats.on_time_roam_scan;
-    hidl_radio_stat->V1_3.onTimeInMsForPnoScan = legacy_radio_stat.stats.on_time_pno_scan;
-    hidl_radio_stat->V1_3.onTimeInMsForHs20Scan = legacy_radio_stat.stats.on_time_hs20;
+    hidl_radio_stat->V1_0.onTimeInMs = legacy_radio_stat.stats.on_time;
+    hidl_radio_stat->V1_0.txTimeInMs = legacy_radio_stat.stats.tx_time;
+    hidl_radio_stat->V1_0.rxTimeInMs = legacy_radio_stat.stats.rx_time;
+    hidl_radio_stat->V1_0.onTimeInMsForScan = legacy_radio_stat.stats.on_time_scan;
+    hidl_radio_stat->V1_0.txTimeInMsPerLevel = legacy_radio_stat.tx_time_per_levels;
+    hidl_radio_stat->onTimeInMsForNanScan = legacy_radio_stat.stats.on_time_nbd;
+    hidl_radio_stat->onTimeInMsForBgScan = legacy_radio_stat.stats.on_time_gscan;
+    hidl_radio_stat->onTimeInMsForRoamScan = legacy_radio_stat.stats.on_time_roam_scan;
+    hidl_radio_stat->onTimeInMsForPnoScan = legacy_radio_stat.stats.on_time_pno_scan;
+    hidl_radio_stat->onTimeInMsForHs20Scan = legacy_radio_stat.stats.on_time_hs20;
 
-    std::vector<V1_3::WifiChannelStats> hidl_channel_stats;
+    std::vector<V1_6::WifiChannelStats> hidl_channel_stats;
 
     for (const auto& channel_stat : legacy_radio_stat.channel_stats) {
-        V1_3::WifiChannelStats hidl_channel_stat;
+        V1_6::WifiChannelStats hidl_channel_stat;
         hidl_channel_stat.onTimeInMs = channel_stat.on_time;
         hidl_channel_stat.ccaBusyTimeInMs = channel_stat.cca_busy_time;
         /*
@@ -929,13 +929,13 @@
         hidl_channel_stats.push_back(hidl_channel_stat);
     }
 
-    hidl_radio_stat->V1_3.channelStats = hidl_channel_stats;
+    hidl_radio_stat->channelStats = hidl_channel_stats;
 
     return true;
 }
 
 bool convertLegacyLinkLayerStatsToHidl(const legacy_hal::LinkLayerStats& legacy_stats,
-                                       V1_5::StaLinkLayerStats* hidl_stats) {
+                                       V1_6::StaLinkLayerStats* hidl_stats) {
     if (!hidl_stats) {
         return false;
     }
@@ -1010,9 +1010,9 @@
     hidl_stats->iface.timeSliceDutyCycleInPercent =
             legacy_stats.iface.info.time_slicing_duty_cycle_percent;
     // peer info legacy_stats conversion.
-    std::vector<V1_5::StaPeerInfo> hidl_peers_info_stats;
+    std::vector<V1_6::StaPeerInfo> hidl_peers_info_stats;
     for (const auto& legacy_peer_info_stats : legacy_stats.peers) {
-        V1_5::StaPeerInfo hidl_peer_info_stats;
+        V1_6::StaPeerInfo hidl_peer_info_stats;
         if (!convertLegacyPeerInfoStatsToHidl(legacy_peer_info_stats, &hidl_peer_info_stats)) {
             return false;
         }
@@ -1020,9 +1020,9 @@
     }
     hidl_stats->iface.peers = hidl_peers_info_stats;
     // radio legacy_stats conversion.
-    std::vector<V1_5::StaLinkLayerRadioStats> hidl_radios_stats;
+    std::vector<V1_6::StaLinkLayerRadioStats> hidl_radios_stats;
     for (const auto& legacy_radio_stats : legacy_stats.radios) {
-        V1_5::StaLinkLayerRadioStats hidl_radio_stats;
+        V1_6::StaLinkLayerRadioStats hidl_radio_stats;
         if (!convertLegacyLinkLayerRadioStatsToHidl(legacy_radio_stats, &hidl_radio_stats)) {
             return false;
         }
@@ -1036,7 +1036,7 @@
 }
 
 bool convertLegacyPeerInfoStatsToHidl(const legacy_hal::WifiPeerInfo& legacy_peer_info_stats,
-                                      V1_5::StaPeerInfo* hidl_peer_info_stats) {
+                                      V1_6::StaPeerInfo* hidl_peer_info_stats) {
     if (!hidl_peer_info_stats) {
         return false;
     }
@@ -1044,9 +1044,9 @@
     hidl_peer_info_stats->staCount = legacy_peer_info_stats.peer_info.bssload.sta_count;
     hidl_peer_info_stats->chanUtil = legacy_peer_info_stats.peer_info.bssload.chan_util;
 
-    std::vector<V1_5::StaRateStat> hidlRateStats;
+    std::vector<V1_6::StaRateStat> hidlRateStats;
     for (const auto& legacy_rate_stats : legacy_peer_info_stats.rate_stats) {
-        V1_5::StaRateStat rateStat;
+        V1_6::StaRateStat rateStat;
         if (!convertLegacyWifiRateInfoToHidl(legacy_rate_stats.rate, &rateStat.rateInfo)) {
             return false;
         }
@@ -2134,7 +2134,7 @@
 }
 
 bool convertLegacyNdpChannelInfoToHidl(const legacy_hal::NanChannelInfo& legacy_struct,
-                                       V1_2::NanDataPathChannelInfo* hidl_struct) {
+                                       V1_6::NanDataPathChannelInfo* hidl_struct) {
     if (!hidl_struct) {
         LOG(ERROR) << "convertLegacyNdpChannelInfoToHidl: hidl_struct is null";
         return false;
@@ -2150,7 +2150,7 @@
 }
 
 bool convertLegacyNanDataPathConfirmIndToHidl(const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-                                              V1_2::NanDataPathConfirmInd* hidl_ind) {
+                                              V1_6::NanDataPathConfirmInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanDataPathConfirmIndToHidl: hidl_ind is null";
         return false;
@@ -2166,9 +2166,9 @@
     hidl_ind->V1_0.status.status = convertLegacyNanStatusTypeToHidl(legacy_ind.reason_code);
     hidl_ind->V1_0.status.description = "";  // TODO: b/34059183
 
-    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_6::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        V1_2::NanDataPathChannelInfo hidl_struct;
+        V1_6::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i], &hidl_struct)) {
             return false;
         }
@@ -2181,7 +2181,7 @@
 
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
         const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-        V1_2::NanDataPathScheduleUpdateInd* hidl_ind) {
+        V1_6::NanDataPathScheduleUpdateInd* hidl_ind) {
     if (!hidl_ind) {
         LOG(ERROR) << "convertLegacyNanDataPathScheduleUpdateIndToHidl: "
                       "hidl_ind is null";
@@ -2190,9 +2190,9 @@
     *hidl_ind = {};
 
     hidl_ind->peerDiscoveryAddress = hidl_array<uint8_t, 6>(legacy_ind.peer_mac_addr);
-    std::vector<V1_2::NanDataPathChannelInfo> channelInfo;
+    std::vector<V1_6::NanDataPathChannelInfo> channelInfo;
     for (unsigned int i = 0; i < legacy_ind.num_channels; ++i) {
-        V1_2::NanDataPathChannelInfo hidl_struct;
+        V1_6::NanDataPathChannelInfo hidl_struct;
         if (!convertLegacyNdpChannelInfoToHidl(legacy_ind.channel_info[i], &hidl_struct)) {
             return false;
         }
@@ -2260,13 +2260,16 @@
             return legacy_hal::WIFI_CHAN_WIDTH_5;
         case WifiChannelWidthInMhz::WIDTH_10:
             return legacy_hal::WIFI_CHAN_WIDTH_10;
+        case V1_6::WifiChannelWidthInMhz::WIDTH_320:
+            return legacy_hal::WIFI_CHAN_WIDTH_320;
         case WifiChannelWidthInMhz::WIDTH_INVALID:
             return legacy_hal::WIFI_CHAN_WIDTH_INVALID;
     };
     CHECK(false);
 }
 
-WifiChannelWidthInMhz convertLegacyWifiChannelWidthToHidl(legacy_hal::wifi_channel_width type) {
+V1_6::WifiChannelWidthInMhz convertLegacyWifiChannelWidthToHidl(
+        legacy_hal::wifi_channel_width type) {
     switch (type) {
         case legacy_hal::WIFI_CHAN_WIDTH_20:
             return WifiChannelWidthInMhz::WIDTH_20;
@@ -2282,35 +2285,41 @@
             return WifiChannelWidthInMhz::WIDTH_5;
         case legacy_hal::WIFI_CHAN_WIDTH_10:
             return WifiChannelWidthInMhz::WIDTH_10;
+        case legacy_hal::WIFI_CHAN_WIDTH_320:
+            return V1_6::WifiChannelWidthInMhz::WIDTH_320;
         default:
             return WifiChannelWidthInMhz::WIDTH_INVALID;
     };
 }
 
-legacy_hal::wifi_rtt_preamble convertHidlRttPreambleToLegacy(V1_4::RttPreamble type) {
+legacy_hal::wifi_rtt_preamble convertHidlRttPreambleToLegacy(V1_6::RttPreamble type) {
     switch (type) {
-        case V1_4::RttPreamble::LEGACY:
+        case V1_6::RttPreamble::LEGACY:
             return legacy_hal::WIFI_RTT_PREAMBLE_LEGACY;
-        case V1_4::RttPreamble::HT:
+        case V1_6::RttPreamble::HT:
             return legacy_hal::WIFI_RTT_PREAMBLE_HT;
-        case V1_4::RttPreamble::VHT:
+        case V1_6::RttPreamble::VHT:
             return legacy_hal::WIFI_RTT_PREAMBLE_VHT;
-        case V1_4::RttPreamble::HE:
+        case V1_6::RttPreamble::HE:
             return legacy_hal::WIFI_RTT_PREAMBLE_HE;
+        case V1_6::RttPreamble::EHT:
+            return legacy_hal::WIFI_RTT_PREAMBLE_EHT;
     };
     CHECK(false);
 }
 
-V1_4::RttPreamble convertLegacyRttPreambleToHidl(legacy_hal::wifi_rtt_preamble type) {
+V1_6::RttPreamble convertLegacyRttPreambleToHidl(legacy_hal::wifi_rtt_preamble type) {
     switch (type) {
         case legacy_hal::WIFI_RTT_PREAMBLE_LEGACY:
-            return V1_4::RttPreamble::LEGACY;
+            return V1_6::RttPreamble::LEGACY;
         case legacy_hal::WIFI_RTT_PREAMBLE_HT:
-            return V1_4::RttPreamble::HT;
+            return V1_6::RttPreamble::HT;
         case legacy_hal::WIFI_RTT_PREAMBLE_VHT:
-            return V1_4::RttPreamble::VHT;
+            return V1_6::RttPreamble::VHT;
         case legacy_hal::WIFI_RTT_PREAMBLE_HE:
-            return V1_4::RttPreamble::HE;
+            return V1_6::RttPreamble::HE;
+        case legacy_hal::WIFI_RTT_PREAMBLE_EHT:
+            return V1_6::RttPreamble::EHT;
     };
     CHECK(false) << "Unknown legacy type: " << type;
 }
@@ -2329,6 +2338,8 @@
             return legacy_hal::WIFI_RTT_BW_80;
         case RttBw::BW_160MHZ:
             return legacy_hal::WIFI_RTT_BW_160;
+        case RttBw::BW_320MHZ:
+            return legacy_hal::WIFI_RTT_BW_320;
     };
     CHECK(false);
 }
@@ -2347,6 +2358,8 @@
             return RttBw::BW_80MHZ;
         case legacy_hal::WIFI_RTT_BW_160:
             return RttBw::BW_160MHZ;
+        case legacy_hal::WIFI_RTT_BW_320:
+            return RttBw::BW_320MHZ;
     };
     CHECK(false) << "Unknown legacy type: " << type;
 }
@@ -2363,20 +2376,22 @@
     CHECK(false);
 }
 
-V1_4::WifiRatePreamble convertLegacyWifiRatePreambleToHidl(uint8_t preamble) {
+V1_6::WifiRatePreamble convertLegacyWifiRatePreambleToHidl(uint8_t preamble) {
     switch (preamble) {
         case 0:
-            return V1_4::WifiRatePreamble::OFDM;
+            return V1_6::WifiRatePreamble::OFDM;
         case 1:
-            return V1_4::WifiRatePreamble::CCK;
+            return V1_6::WifiRatePreamble::CCK;
         case 2:
-            return V1_4::WifiRatePreamble::HT;
+            return V1_6::WifiRatePreamble::HT;
         case 3:
-            return V1_4::WifiRatePreamble::VHT;
+            return V1_6::WifiRatePreamble::VHT;
         case 4:
-            return V1_4::WifiRatePreamble::HE;
+            return V1_6::WifiRatePreamble::HE;
+        case 5:
+            return V1_6::WifiRatePreamble::EHT;
         default:
-            return V1_4::WifiRatePreamble::RESERVED;
+            return V1_6::WifiRatePreamble::RESERVED;
     };
     CHECK(false) << "Unknown legacy preamble: " << preamble;
 }
@@ -2464,7 +2479,7 @@
     return true;
 }
 
-bool convertHidlRttConfigToLegacy(const V1_4::RttConfig& hidl_config,
+bool convertHidlRttConfigToLegacy(const V1_6::RttConfig& hidl_config,
                                   legacy_hal::wifi_rtt_config* legacy_config) {
     if (!legacy_config) {
         return false;
@@ -2491,7 +2506,7 @@
 }
 
 bool convertHidlVectorOfRttConfigToLegacy(
-        const std::vector<V1_4::RttConfig>& hidl_configs,
+        const std::vector<V1_6::RttConfig>& hidl_configs,
         std::vector<legacy_hal::wifi_rtt_config>* legacy_configs) {
     if (!legacy_configs) {
         return false;
@@ -2542,7 +2557,7 @@
     return true;
 }
 
-bool convertHidlRttResponderToLegacy(const V1_4::RttResponder& hidl_responder,
+bool convertHidlRttResponderToLegacy(const V1_6::RttResponder& hidl_responder,
                                      legacy_hal::wifi_rtt_responder* legacy_responder) {
     if (!legacy_responder) {
         return false;
@@ -2556,7 +2571,7 @@
 }
 
 bool convertLegacyRttResponderToHidl(const legacy_hal::wifi_rtt_responder& legacy_responder,
-                                     V1_4::RttResponder* hidl_responder) {
+                                     V1_6::RttResponder* hidl_responder) {
     if (!hidl_responder) {
         return false;
     }
@@ -2570,7 +2585,7 @@
 
 bool convertLegacyRttCapabilitiesToHidl(
         const legacy_hal::wifi_rtt_capabilities& legacy_capabilities,
-        V1_4::RttCapabilities* hidl_capabilities) {
+        V1_6::RttCapabilities* hidl_capabilities) {
     if (!hidl_capabilities) {
         return false;
     }
@@ -2582,17 +2597,19 @@
     hidl_capabilities->responderSupported = legacy_capabilities.responder_supported;
     hidl_capabilities->preambleSupport = 0;
     for (const auto flag : {legacy_hal::WIFI_RTT_PREAMBLE_LEGACY, legacy_hal::WIFI_RTT_PREAMBLE_HT,
-                            legacy_hal::WIFI_RTT_PREAMBLE_VHT, legacy_hal::WIFI_RTT_PREAMBLE_HE}) {
+                            legacy_hal::WIFI_RTT_PREAMBLE_VHT, legacy_hal::WIFI_RTT_PREAMBLE_HE,
+                            legacy_hal::WIFI_RTT_PREAMBLE_EHT}) {
         if (legacy_capabilities.preamble_support & flag) {
             hidl_capabilities->preambleSupport |=
-                    static_cast<std::underlying_type<V1_4::RttPreamble>::type>(
+                    static_cast<std::underlying_type<V1_6::RttPreamble>::type>(
                             convertLegacyRttPreambleToHidl(flag));
         }
     }
     hidl_capabilities->bwSupport = 0;
     for (const auto flag :
          {legacy_hal::WIFI_RTT_BW_5, legacy_hal::WIFI_RTT_BW_10, legacy_hal::WIFI_RTT_BW_20,
-          legacy_hal::WIFI_RTT_BW_40, legacy_hal::WIFI_RTT_BW_80, legacy_hal::WIFI_RTT_BW_160}) {
+          legacy_hal::WIFI_RTT_BW_40, legacy_hal::WIFI_RTT_BW_80, legacy_hal::WIFI_RTT_BW_160,
+          legacy_hal::WIFI_RTT_BW_320}) {
         if (legacy_capabilities.bw_support & flag) {
             hidl_capabilities->bwSupport |=
                     static_cast<std::underlying_type<RttBw>::type>(convertLegacyRttBwToHidl(flag));
@@ -2603,7 +2620,7 @@
 }
 
 bool convertLegacyWifiRateInfoToHidl(const legacy_hal::wifi_rate& legacy_rate,
-                                     V1_4::WifiRateInfo* hidl_rate) {
+                                     V1_6::WifiRateInfo* hidl_rate) {
     if (!hidl_rate) {
         return false;
     }
@@ -2618,7 +2635,7 @@
 }
 
 bool convertLegacyRttResultToHidl(const legacy_hal::wifi_rtt_result& legacy_result,
-                                  V1_4::RttResult* hidl_result) {
+                                  V1_6::RttResult* hidl_result) {
     if (!hidl_result) {
         return false;
     }
@@ -2660,13 +2677,13 @@
 
 bool convertLegacyVectorOfRttResultToHidl(
         const std::vector<const legacy_hal::wifi_rtt_result*>& legacy_results,
-        std::vector<V1_4::RttResult>* hidl_results) {
+        std::vector<V1_6::RttResult>* hidl_results) {
     if (!hidl_results) {
         return false;
     }
     *hidl_results = {};
     for (const auto legacy_result : legacy_results) {
-        V1_4::RttResult hidl_result;
+        V1_6::RttResult hidl_result;
         if (!convertLegacyRttResultToHidl(*legacy_result, &hidl_result)) {
             return false;
         }
diff --git a/wifi/1.6/default/hidl_struct_util.h b/wifi/1.6/default/hidl_struct_util.h
index 15a3205..7f0266a 100644
--- a/wifi/1.6/default/hidl_struct_util.h
+++ b/wifi/1.6/default/hidl_struct_util.h
@@ -25,8 +25,8 @@
 #include <android/hardware/wifi/1.3/types.h>
 #include <android/hardware/wifi/1.4/IWifiChipEventCallback.h>
 #include <android/hardware/wifi/1.4/types.h>
-#include <android/hardware/wifi/1.5/IWifiChip.h>
-#include <android/hardware/wifi/1.5/types.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+#include <android/hardware/wifi/1.6/types.h>
 
 #include "wifi_legacy_hal.h"
 
@@ -95,7 +95,7 @@
         const std::vector<legacy_hal::wifi_cached_scan_results>& legacy_cached_scan_results,
         std::vector<StaScanData>* hidl_scan_datas);
 bool convertLegacyLinkLayerStatsToHidl(const legacy_hal::LinkLayerStats& legacy_stats,
-                                       V1_5::StaLinkLayerStats* hidl_stats);
+                                       V1_6::StaLinkLayerStats* hidl_stats);
 bool convertLegacyRoamingCapabilitiesToHidl(
         const legacy_hal::wifi_roaming_capabilities& legacy_caps,
         StaRoamingCapabilities* hidl_caps);
@@ -156,40 +156,40 @@
 bool convertLegacyNanDataPathRequestIndToHidl(const legacy_hal::NanDataPathRequestInd& legacy_ind,
                                               NanDataPathRequestInd* hidl_ind);
 bool convertLegacyNanDataPathConfirmIndToHidl(const legacy_hal::NanDataPathConfirmInd& legacy_ind,
-                                              V1_2::NanDataPathConfirmInd* hidl_ind);
+                                              V1_6::NanDataPathConfirmInd* hidl_ind);
 bool convertLegacyNanDataPathScheduleUpdateIndToHidl(
         const legacy_hal::NanDataPathScheduleUpdateInd& legacy_ind,
-        V1_2::NanDataPathScheduleUpdateInd* hidl_ind);
+        V1_6::NanDataPathScheduleUpdateInd* hidl_ind);
 
 // RTT controller conversion methods.
-bool convertHidlVectorOfRttConfigToLegacy(const std::vector<V1_4::RttConfig>& hidl_configs,
+bool convertHidlVectorOfRttConfigToLegacy(const std::vector<V1_6::RttConfig>& hidl_configs,
                                           std::vector<legacy_hal::wifi_rtt_config>* legacy_configs);
 bool convertHidlRttLciInformationToLegacy(const RttLciInformation& hidl_info,
                                           legacy_hal::wifi_lci_information* legacy_info);
 bool convertHidlRttLcrInformationToLegacy(const RttLcrInformation& hidl_info,
                                           legacy_hal::wifi_lcr_information* legacy_info);
-bool convertHidlRttResponderToLegacy(const V1_4::RttResponder& hidl_responder,
+bool convertHidlRttResponderToLegacy(const V1_6::RttResponder& hidl_responder,
                                      legacy_hal::wifi_rtt_responder* legacy_responder);
-bool convertHidlWifiChannelInfoToLegacy(const WifiChannelInfo& hidl_info,
+bool convertHidlWifiChannelInfoToLegacy(const V1_6::WifiChannelInfo& hidl_info,
                                         legacy_hal::wifi_channel_info* legacy_info);
 bool convertLegacyRttResponderToHidl(const legacy_hal::wifi_rtt_responder& legacy_responder,
-                                     V1_4::RttResponder* hidl_responder);
+                                     V1_6::RttResponder* hidl_responder);
 bool convertLegacyRttCapabilitiesToHidl(
         const legacy_hal::wifi_rtt_capabilities& legacy_capabilities,
-        V1_4::RttCapabilities* hidl_capabilities);
+        V1_6::RttCapabilities* hidl_capabilities);
 bool convertLegacyVectorOfRttResultToHidl(
         const std::vector<const legacy_hal::wifi_rtt_result*>& legacy_results,
-        std::vector<V1_4::RttResult>* hidl_results);
+        std::vector<V1_6::RttResult>* hidl_results);
 uint32_t convertHidlWifiBandToLegacyMacBand(V1_5::WifiBand band);
 uint32_t convertHidlWifiIfaceModeToLegacy(uint32_t hidl_iface_mask);
 uint32_t convertHidlUsableChannelFilterToLegacy(uint32_t hidl_filter_mask);
 bool convertLegacyWifiUsableChannelsToHidl(
         const std::vector<legacy_hal::wifi_usable_channel>& legacy_usable_channels,
-        std::vector<V1_5::WifiUsableChannel>* hidl_usable_channels);
+        std::vector<V1_6::WifiUsableChannel>* hidl_usable_channels);
 bool convertLegacyPeerInfoStatsToHidl(const legacy_hal::WifiPeerInfo& legacy_peer_info_stats,
-                                      V1_5::StaPeerInfo* hidl_peer_info_stats);
+                                      V1_6::StaPeerInfo* hidl_peer_info_stats);
 bool convertLegacyWifiRateInfoToHidl(const legacy_hal::wifi_rate& legacy_rate,
-                                     V1_4::WifiRateInfo* hidl_rate);
+                                     V1_6::WifiRateInfo* hidl_rate);
 }  // namespace hidl_struct_util
 }  // namespace implementation
 }  // namespace V1_6
diff --git a/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp b/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
index 1182a58..077c6cc 100644
--- a/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
+++ b/wifi/1.6/default/tests/hidl_struct_util_unit_tests.cpp
@@ -37,7 +37,7 @@
 namespace V1_6 {
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
-using ::android::hardware::wifi::V1_0::WifiChannelWidthInMhz;
+using ::android::hardware::wifi::V1_6::WifiChannelWidthInMhz;
 
 class HidlStructUtilTest : public Test {};
 
@@ -216,7 +216,7 @@
         peer.rate_stats.push_back(rate_stat2);
     }
 
-    V1_5::StaLinkLayerStats converted{};
+    V1_6::StaLinkLayerStats converted{};
     hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats, &converted);
     EXPECT_EQ(legacy_stats.iface.beacon_rx, converted.iface.V1_0.beaconRx);
     EXPECT_EQ(legacy_stats.iface.rssi_mgmt, converted.iface.V1_0.avgRssiMgmt);
@@ -294,43 +294,42 @@
     EXPECT_EQ(legacy_stats.radios.size(), converted.radios.size());
     for (size_t i = 0; i < legacy_stats.radios.size(); i++) {
         EXPECT_EQ(legacy_stats.radios[i].stats.radio, converted.radios[i].radioId);
-        EXPECT_EQ(legacy_stats.radios[i].stats.on_time, converted.radios[i].V1_3.V1_0.onTimeInMs);
-        EXPECT_EQ(legacy_stats.radios[i].stats.tx_time, converted.radios[i].V1_3.V1_0.txTimeInMs);
-        EXPECT_EQ(legacy_stats.radios[i].stats.rx_time, converted.radios[i].V1_3.V1_0.rxTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.on_time, converted.radios[i].V1_0.onTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.tx_time, converted.radios[i].V1_0.txTimeInMs);
+        EXPECT_EQ(legacy_stats.radios[i].stats.rx_time, converted.radios[i].V1_0.rxTimeInMs);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_scan,
-                  converted.radios[i].V1_3.V1_0.onTimeInMsForScan);
+                  converted.radios[i].V1_0.onTimeInMsForScan);
         EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels.size(),
-                  converted.radios[i].V1_3.V1_0.txTimeInMsPerLevel.size());
+                  converted.radios[i].V1_0.txTimeInMsPerLevel.size());
         for (size_t j = 0; j < legacy_stats.radios[i].tx_time_per_levels.size(); j++) {
             EXPECT_EQ(legacy_stats.radios[i].tx_time_per_levels[j],
-                      converted.radios[i].V1_3.V1_0.txTimeInMsPerLevel[j]);
+                      converted.radios[i].V1_0.txTimeInMsPerLevel[j]);
         }
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_nbd,
-                  converted.radios[i].V1_3.onTimeInMsForNanScan);
+                  converted.radios[i].onTimeInMsForNanScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_gscan,
-                  converted.radios[i].V1_3.onTimeInMsForBgScan);
+                  converted.radios[i].onTimeInMsForBgScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_roam_scan,
-                  converted.radios[i].V1_3.onTimeInMsForRoamScan);
+                  converted.radios[i].onTimeInMsForRoamScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_pno_scan,
-                  converted.radios[i].V1_3.onTimeInMsForPnoScan);
+                  converted.radios[i].onTimeInMsForPnoScan);
         EXPECT_EQ(legacy_stats.radios[i].stats.on_time_hs20,
-                  converted.radios[i].V1_3.onTimeInMsForHs20Scan);
+                  converted.radios[i].onTimeInMsForHs20Scan);
         EXPECT_EQ(legacy_stats.radios[i].channel_stats.size(),
-                  converted.radios[i].V1_3.channelStats.size());
+                  converted.radios[i].channelStats.size());
         for (size_t k = 0; k < legacy_stats.radios[i].channel_stats.size(); k++) {
             auto& legacy_channel_st = legacy_stats.radios[i].channel_stats[k];
             EXPECT_EQ(WifiChannelWidthInMhz::WIDTH_20,
-                      converted.radios[i].V1_3.channelStats[k].channel.width);
+                      converted.radios[i].channelStats[k].channel.width);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq);
+                      converted.radios[i].channelStats[k].channel.centerFreq);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq0),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq0);
+                      converted.radios[i].channelStats[k].channel.centerFreq0);
             EXPECT_EQ(WifiChannelInMhz(legacy_channel_st.channel.center_freq1),
-                      converted.radios[i].V1_3.channelStats[k].channel.centerFreq1);
+                      converted.radios[i].channelStats[k].channel.centerFreq1);
             EXPECT_EQ(legacy_channel_st.cca_busy_time,
-                      converted.radios[i].V1_3.channelStats[k].ccaBusyTimeInMs);
-            EXPECT_EQ(legacy_channel_st.on_time,
-                      converted.radios[i].V1_3.channelStats[k].onTimeInMs);
+                      converted.radios[i].channelStats[k].ccaBusyTimeInMs);
+            EXPECT_EQ(legacy_channel_st.on_time, converted.radios[i].channelStats[k].onTimeInMs);
         }
     }
 
diff --git a/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp b/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
index 5390411..542b180 100644
--- a/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
+++ b/wifi/1.6/default/tests/wifi_chip_unit_tests.cpp
@@ -238,7 +238,7 @@
 
     bool createRttController() {
         bool success = false;
-        chip_->createRttController_1_4(
+        chip_->createRttController_1_6(
                 NULL, [&success](const WifiStatus& status, const sp<IWifiRttController>& rtt) {
                     if (WifiStatusCode::SUCCESS == status.code) {
                         ASSERT_NE(rtt.get(), nullptr);
@@ -716,7 +716,7 @@
 
     // Create RTT controller
     sp<IWifiRttController> rtt_controller;
-    chip_->createRttController_1_4(
+    chip_->createRttController_1_6(
             NULL, [&rtt_controller](const WifiStatus& status, const sp<IWifiRttController>& rtt) {
                 if (WifiStatusCode::SUCCESS == status.code) {
                     ASSERT_NE(rtt.get(), nullptr);
diff --git a/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp b/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
index c7c566b..13b2849 100644
--- a/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
+++ b/wifi/1.6/default/tests/wifi_nan_iface_unit_tests.cpp
@@ -85,8 +85,13 @@
     MOCK_METHOD1(eventDataPathConfirm,
                  Return<void>(const android::hardware::wifi::V1_0::NanDataPathConfirmInd&));
     MOCK_METHOD1(eventDataPathTerminated, Return<void>(uint32_t));
-    MOCK_METHOD1(eventDataPathConfirm_1_2, Return<void>(const NanDataPathConfirmInd&));
-    MOCK_METHOD1(eventDataPathScheduleUpdate, Return<void>(const NanDataPathScheduleUpdateInd&));
+    MOCK_METHOD1(eventDataPathConfirm_1_2,
+                 Return<void>(const android::hardware::wifi::V1_2::NanDataPathConfirmInd&));
+    MOCK_METHOD1(eventDataPathConfirm_1_6, Return<void>(const NanDataPathConfirmInd&));
+    MOCK_METHOD1(eventDataPathScheduleUpdate,
+                 Return<void>(const android::hardware::wifi::V1_2::NanDataPathScheduleUpdateInd&));
+    MOCK_METHOD1(eventDataPathScheduleUpdate_1_6,
+                 Return<void>(const NanDataPathScheduleUpdateInd&));
     MOCK_METHOD3(notifyCapabilitiesResponse_1_5,
                  Return<void>(uint16_t, const WifiNanStatus&, const V1_5::NanCapabilities&));
 };
diff --git a/wifi/1.6/default/wifi_chip.cpp b/wifi/1.6/default/wifi_chip.cpp
index c1ce766..11512f4 100644
--- a/wifi/1.6/default/wifi_chip.cpp
+++ b/wifi/1.6/default/wifi_chip.cpp
@@ -707,6 +707,21 @@
                            &WifiChip::triggerSubsystemRestartInternal, hidl_status_cb);
 }
 
+Return<void> WifiChip::createRttController_1_6(const sp<IWifiIface>& bound_iface,
+                                               createRttController_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::createRttControllerInternal_1_6, hidl_status_cb, bound_iface);
+}
+
+Return<void> WifiChip::getUsableChannels_1_6(
+        WifiBand band, hidl_bitfield<V1_5::WifiIfaceMode> ifaceModeMask,
+        hidl_bitfield<V1_5::IWifiChip::UsableChannelFilter> filterMask,
+        getUsableChannels_1_6_cb _hidl_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_CHIP_INVALID,
+                           &WifiChip::getUsableChannelsInternal_1_6, _hidl_cb, band, ifaceModeMask,
+                           filterMask);
+}
+
 void WifiChip::invalidateAndRemoveAllIfaces() {
     invalidateAndClearBridgedApAll();
     invalidateAndClearAll(ap_ifaces_);
@@ -1114,7 +1129,7 @@
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
-std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> WifiChip::createStaIfaceInternal() {
+std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> WifiChip::createStaIfaceInternal() {
     if (!canCurrentModeSupportIfaceOfTypeWithCurrentIfaces(IfaceType::STA)) {
         return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
     }
@@ -1144,7 +1159,7 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), getNames(sta_ifaces_)};
 }
 
-std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> WifiChip::getStaIfaceInternal(
+std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> WifiChip::getStaIfaceInternal(
         const std::string& ifname) {
     const auto iface = findUsingName(sta_ifaces_, ifname);
     if (!iface.get()) {
@@ -1351,16 +1366,9 @@
 }
 
 std::pair<WifiStatus, sp<V1_4::IWifiRttController>> WifiChip::createRttControllerInternal_1_4(
-        const sp<IWifiIface>& bound_iface) {
-    if (sta_ifaces_.size() == 0 && !canCurrentModeSupportIfaceOfType(IfaceType::STA)) {
-        LOG(ERROR) << "createRttControllerInternal_1_4: Chip cannot support STAs "
-                      "(and RTT by extension)";
-        return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
-    }
-    sp<WifiRttController> rtt =
-            new WifiRttController(getFirstActiveWlanIfaceName(), bound_iface, legacy_hal_);
-    rtt_controllers_.emplace_back(rtt);
-    return {createWifiStatus(WifiStatusCode::SUCCESS), rtt};
+        const sp<IWifiIface>& /*bound_iface*/) {
+    LOG(ERROR) << "createRttController_1_4 is not supported on this HAL";
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
 }
 
 WifiStatus WifiChip::registerEventCallbackInternal_1_4(
@@ -1409,7 +1417,31 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-std::pair<WifiStatus, std::vector<WifiUsableChannel>> WifiChip::getUsableChannelsInternal(
+std::pair<WifiStatus, std::vector<V1_5::WifiUsableChannel>> WifiChip::getUsableChannelsInternal(
+        WifiBand /*band*/, uint32_t /*ifaceModeMask*/, uint32_t /*filterMask*/) {
+    LOG(ERROR) << "getUsableChannels is not supported on this HAL";
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+WifiStatus WifiChip::triggerSubsystemRestartInternal() {
+    auto legacy_status = legacy_hal_.lock()->triggerSubsystemRestart();
+    return createWifiStatusFromLegacyError(legacy_status);
+}
+
+std::pair<WifiStatus, sp<V1_6::IWifiRttController>> WifiChip::createRttControllerInternal_1_6(
+        const sp<IWifiIface>& bound_iface) {
+    if (sta_ifaces_.size() == 0 && !canCurrentModeSupportIfaceOfType(IfaceType::STA)) {
+        LOG(ERROR) << "createRttControllerInternal_1_6: Chip cannot support STAs "
+                      "(and RTT by extension)";
+        return {createWifiStatus(WifiStatusCode::ERROR_NOT_AVAILABLE), {}};
+    }
+    sp<WifiRttController> rtt =
+            new WifiRttController(getFirstActiveWlanIfaceName(), bound_iface, legacy_hal_);
+    rtt_controllers_.emplace_back(rtt);
+    return {createWifiStatus(WifiStatusCode::SUCCESS), rtt};
+}
+
+std::pair<WifiStatus, std::vector<V1_6::WifiUsableChannel>> WifiChip::getUsableChannelsInternal_1_6(
         WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask) {
     legacy_hal::wifi_error legacy_status;
     std::vector<legacy_hal::wifi_usable_channel> legacy_usable_channels;
@@ -1421,7 +1453,7 @@
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    std::vector<WifiUsableChannel> hidl_usable_channels;
+    std::vector<V1_6::WifiUsableChannel> hidl_usable_channels;
     if (!hidl_struct_util::convertLegacyWifiUsableChannelsToHidl(legacy_usable_channels,
                                                                  &hidl_usable_channels)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
@@ -1429,11 +1461,6 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_usable_channels};
 }
 
-WifiStatus WifiChip::triggerSubsystemRestartInternal() {
-    auto legacy_status = legacy_hal_.lock()->triggerSubsystemRestart();
-    return createWifiStatusFromLegacyError(legacy_status);
-}
-
 WifiStatus WifiChip::handleChipConfiguration(
         /* NONNULL */ std::unique_lock<std::recursive_mutex>* lock, ChipModeId mode_id) {
     // If the chip is already configured in a different mode, stop
diff --git a/wifi/1.6/default/wifi_chip.h b/wifi/1.6/default/wifi_chip.h
index 8a06898..73bdf3a 100644
--- a/wifi/1.6/default/wifi_chip.h
+++ b/wifi/1.6/default/wifi_chip.h
@@ -22,8 +22,9 @@
 #include <mutex>
 
 #include <android-base/macros.h>
-#include <android/hardware/wifi/1.4/IWifiRttController.h>
-#include <android/hardware/wifi/1.5/IWifiChip.h>
+#include <android/hardware/wifi/1.6/IWifiChip.h>
+#include <android/hardware/wifi/1.6/IWifiRttController.h>
+#include <android/hardware/wifi/1.6/IWifiStaIface.h>
 
 #include "hidl_callback_util.h"
 #include "ringbuffer.h"
@@ -43,14 +44,13 @@
 namespace implementation {
 using namespace android::hardware::wifi::V1_0;
 using V1_5::WifiBand;
-using V1_5::WifiUsableChannel;
 
 /**
  * HIDL interface object used to control a Wifi HAL chip instance.
  * Since there is only a single chip instance used today, there is no
  * identifying handle information stored here.
  */
-class WifiChip : public V1_5::IWifiChip {
+class WifiChip : public V1_6::IWifiChip {
   public:
     WifiChip(ChipId chip_id, bool is_primary,
              const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -154,6 +154,12 @@
                                    hidl_bitfield<UsableChannelFilter> filterMask,
                                    getUsableChannels_cb _hidl_cb) override;
     Return<void> triggerSubsystemRestart(triggerSubsystemRestart_cb hidl_status_cb) override;
+    Return<void> createRttController_1_6(const sp<IWifiIface>& bound_iface,
+                                         createRttController_1_6_cb hidl_status_cb) override;
+    Return<void> getUsableChannels_1_6(WifiBand band,
+                                       hidl_bitfield<V1_5::WifiIfaceMode> ifaceModeMask,
+                                       hidl_bitfield<UsableChannelFilter> filterMask,
+                                       getUsableChannels_1_6_cb _hidl_cb) override;
 
   private:
     void invalidateAndRemoveAllIfaces();
@@ -191,9 +197,9 @@
     std::pair<WifiStatus, std::vector<hidl_string>> getP2pIfaceNamesInternal();
     std::pair<WifiStatus, sp<IWifiP2pIface>> getP2pIfaceInternal(const std::string& ifname);
     WifiStatus removeP2pIfaceInternal(const std::string& ifname);
-    std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> createStaIfaceInternal();
+    std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> createStaIfaceInternal();
     std::pair<WifiStatus, std::vector<hidl_string>> getStaIfaceNamesInternal();
-    std::pair<WifiStatus, sp<V1_5::IWifiStaIface>> getStaIfaceInternal(const std::string& ifname);
+    std::pair<WifiStatus, sp<V1_6::IWifiStaIface>> getStaIfaceInternal(const std::string& ifname);
     WifiStatus removeStaIfaceInternal(const std::string& ifname);
     std::pair<WifiStatus, sp<V1_0::IWifiRttController>> createRttControllerInternal(
             const sp<IWifiIface>& bound_iface);
@@ -225,13 +231,12 @@
     WifiStatus setCoexUnsafeChannelsInternal(std::vector<CoexUnsafeChannel> unsafe_channels,
                                              uint32_t restrictions);
     WifiStatus setCountryCodeInternal(const std::array<int8_t, 2>& code);
-    std::pair<WifiStatus, std::vector<WifiUsableChannel>> getUsableChannelsInternal(
+    std::pair<WifiStatus, std::vector<V1_5::WifiUsableChannel>> getUsableChannelsInternal(
             WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask);
     WifiStatus handleChipConfiguration(std::unique_lock<std::recursive_mutex>* lock,
                                        ChipModeId mode_id);
     WifiStatus registerDebugRingBufferCallback();
     WifiStatus registerRadioModeChangeCallback();
-
     std::vector<V1_4::IWifiChip::ChipIfaceCombination> getCurrentModeIfaceCombinations();
     std::map<IfaceType, size_t> getCurrentIfaceCombination();
     std::vector<std::map<IfaceType, size_t>> expandIfaceCombinations(
@@ -258,6 +263,10 @@
     void invalidateAndClearBridgedAp(const std::string& br_name);
     bool findUsingNameFromBridgedApInstances(const std::string& name);
     WifiStatus triggerSubsystemRestartInternal();
+    std::pair<WifiStatus, sp<V1_6::IWifiRttController>> createRttControllerInternal_1_6(
+            const sp<IWifiIface>& bound_iface);
+    std::pair<WifiStatus, std::vector<V1_6::WifiUsableChannel>> getUsableChannelsInternal_1_6(
+            WifiBand band, uint32_t ifaceModeMask, uint32_t filterMask);
 
     ChipId chip_id_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
diff --git a/wifi/1.6/default/wifi_legacy_hal.h b/wifi/1.6/default/wifi_legacy_hal.h
index d87242c..7dc6bd6 100644
--- a/wifi/1.6/default/wifi_legacy_hal.h
+++ b/wifi/1.6/default/wifi_legacy_hal.h
@@ -216,6 +216,7 @@
 using ::WIFI_CHAN_WIDTH_10;
 using ::WIFI_CHAN_WIDTH_160;
 using ::WIFI_CHAN_WIDTH_20;
+using ::WIFI_CHAN_WIDTH_320;
 using ::WIFI_CHAN_WIDTH_40;
 using ::WIFI_CHAN_WIDTH_5;
 using ::WIFI_CHAN_WIDTH_80;
@@ -289,12 +290,14 @@
 using ::WIFI_RTT_BW_10;
 using ::WIFI_RTT_BW_160;
 using ::WIFI_RTT_BW_20;
+using ::WIFI_RTT_BW_320;
 using ::WIFI_RTT_BW_40;
 using ::WIFI_RTT_BW_5;
 using ::WIFI_RTT_BW_80;
 using ::wifi_rtt_capabilities;
 using ::wifi_rtt_config;
 using ::wifi_rtt_preamble;
+using ::WIFI_RTT_PREAMBLE_EHT;
 using ::WIFI_RTT_PREAMBLE_HE;
 using ::WIFI_RTT_PREAMBLE_HT;
 using ::WIFI_RTT_PREAMBLE_LEGACY;
diff --git a/wifi/1.6/default/wifi_nan_iface.cpp b/wifi/1.6/default/wifi_nan_iface.cpp
index 236cb64..1add6dc 100644
--- a/wifi/1.6/default/wifi_nan_iface.cpp
+++ b/wifi/1.6/default/wifi_nan_iface.cpp
@@ -378,15 +378,15 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                V1_2::NanDataPathConfirmInd hidl_struct;
+                V1_6::NanDataPathConfirmInd hidl_struct;
                 if (!hidl_struct_util::convertLegacyNanDataPathConfirmIndToHidl(msg,
                                                                                 &hidl_struct)) {
                     LOG(ERROR) << "Failed to convert nan capabilities response";
                     return;
                 }
 
-                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_2()) {
-                    if (!callback->eventDataPathConfirm_1_2(hidl_struct).isOk()) {
+                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+                    if (!callback->eventDataPathConfirm_1_6(hidl_struct).isOk()) {
                         LOG(ERROR) << "Failed to invoke the callback";
                     }
                 }
@@ -430,15 +430,15 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                V1_2::NanDataPathScheduleUpdateInd hidl_struct;
+                V1_6::NanDataPathScheduleUpdateInd hidl_struct;
                 if (!hidl_struct_util::convertLegacyNanDataPathScheduleUpdateIndToHidl(
                             msg, &hidl_struct)) {
                     LOG(ERROR) << "Failed to convert nan capabilities response";
                     return;
                 }
 
-                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_2()) {
-                    if (!callback->eventDataPathScheduleUpdate(hidl_struct).isOk()) {
+                for (const auto& callback : shared_ptr_this->getEventCallbacks_1_6()) {
+                    if (!callback->eventDataPathScheduleUpdate_1_6(hidl_struct).isOk()) {
                         LOG(ERROR) << "Failed to invoke the callback";
                     }
                 }
@@ -510,6 +510,10 @@
     return event_cb_handler_1_5_.getCallbacks();
 }
 
+std::set<sp<V1_6::IWifiNanIfaceEventCallback>> WifiNanIface::getEventCallbacks_1_6() {
+    return event_cb_handler_1_6_.getCallbacks();
+}
+
 Return<void> WifiNanIface::getName(getName_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
                            &WifiNanIface::getNameInternal, hidl_status_cb);
@@ -703,6 +707,14 @@
     return {createWifiStatus(WifiStatusCode::SUCCESS), IfaceType::NAN};
 }
 
+Return<void> WifiNanIface::registerEventCallback_1_6(
+        const sp<V1_6::IWifiNanIfaceEventCallback>& callback,
+        registerEventCallback_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiNanIface::registerEventCallback_1_6Internal, hidl_status_cb,
+                           callback);
+}
+
 WifiStatus WifiNanIface::registerEventCallbackInternal(
         const sp<V1_0::IWifiNanIfaceEventCallback>& callback) {
     if (!event_cb_handler_.addCallback(callback)) {
@@ -898,6 +910,25 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
+WifiStatus WifiNanIface::registerEventCallback_1_6Internal(
+        const sp<V1_6::IWifiNanIfaceEventCallback>& callback) {
+    sp<V1_0::IWifiNanIfaceEventCallback> callback_1_0 = callback;
+    if (!event_cb_handler_.addCallback(callback_1_0)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    sp<V1_2::IWifiNanIfaceEventCallback> callback_1_2 = callback;
+    if (!event_cb_handler_1_2_.addCallback(callback_1_2)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    sp<V1_5::IWifiNanIfaceEventCallback> callback_1_5 = callback;
+    if (!event_cb_handler_1_5_.addCallback(callback_1_5)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    if (!event_cb_handler_1_6_.addCallback(callback)) {
+        return createWifiStatus(WifiStatusCode::ERROR_UNKNOWN);
+    }
+    return createWifiStatus(WifiStatusCode::SUCCESS);
+}
 }  // namespace implementation
 }  // namespace V1_6
 }  // namespace wifi
diff --git a/wifi/1.6/default/wifi_nan_iface.h b/wifi/1.6/default/wifi_nan_iface.h
index c445afc..b732ef1 100644
--- a/wifi/1.6/default/wifi_nan_iface.h
+++ b/wifi/1.6/default/wifi_nan_iface.h
@@ -18,8 +18,8 @@
 #define WIFI_NAN_IFACE_H_
 
 #include <android-base/macros.h>
-#include <android/hardware/wifi/1.5/IWifiNanIface.h>
-#include <android/hardware/wifi/1.5/IWifiNanIfaceEventCallback.h>
+#include <android/hardware/wifi/1.6/IWifiNanIface.h>
+#include <android/hardware/wifi/1.6/IWifiNanIfaceEventCallback.h>
 
 #include "hidl_callback_util.h"
 #include "wifi_iface_util.h"
@@ -36,7 +36,7 @@
 /**
  * HIDL interface object used to control a NAN Iface instance.
  */
-class WifiNanIface : public V1_5::IWifiNanIface {
+class WifiNanIface : public V1_6::IWifiNanIface {
   public:
     WifiNanIface(const std::string& ifname, bool is_dedicated_iface,
                  const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -104,6 +104,8 @@
                                    configRequest_1_4_cb hidl_status_cb) override;
     Return<void> getCapabilitiesRequest_1_5(uint16_t cmd_id,
                                             getCapabilitiesRequest_cb hidl_status_cb) override;
+    Return<void> registerEventCallback_1_6(const sp<V1_6::IWifiNanIfaceEventCallback>& callback,
+                                           registerEventCallback_1_6_cb hidl_status_cb) override;
 
   private:
     // Corresponding worker functions for the HIDL methods.
@@ -145,6 +147,8 @@
     WifiStatus configRequest_1_5Internal(uint16_t cmd_id, const V1_4::NanConfigRequest& msg,
                                          const V1_5::NanConfigRequestSupplemental& msg2);
     WifiStatus getCapabilitiesRequest_1_5Internal(uint16_t cmd_id);
+    WifiStatus registerEventCallback_1_6Internal(
+            const sp<V1_6::IWifiNanIfaceEventCallback>& callback);
 
     // all 1_0 and descendant callbacks
     std::set<sp<V1_0::IWifiNanIfaceEventCallback>> getEventCallbacks();
@@ -152,6 +156,8 @@
     std::set<sp<V1_2::IWifiNanIfaceEventCallback>> getEventCallbacks_1_2();
     // all 1_5 and descendant callbacks
     std::set<sp<V1_5::IWifiNanIfaceEventCallback>> getEventCallbacks_1_5();
+    // all 1_6 and descendant callbacks
+    std::set<sp<V1_6::IWifiNanIfaceEventCallback>> getEventCallbacks_1_6();
 
     std::string ifname_;
     bool is_dedicated_iface_;
@@ -161,6 +167,7 @@
     hidl_callback_util::HidlCallbackHandler<V1_0::IWifiNanIfaceEventCallback> event_cb_handler_;
     hidl_callback_util::HidlCallbackHandler<V1_2::IWifiNanIfaceEventCallback> event_cb_handler_1_2_;
     hidl_callback_util::HidlCallbackHandler<V1_5::IWifiNanIfaceEventCallback> event_cb_handler_1_5_;
+    hidl_callback_util::HidlCallbackHandler<V1_6::IWifiNanIfaceEventCallback> event_cb_handler_1_6_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiNanIface);
 };
diff --git a/wifi/1.6/default/wifi_rtt_controller.cpp b/wifi/1.6/default/wifi_rtt_controller.cpp
index f5e1d5a..b328f31 100644
--- a/wifi/1.6/default/wifi_rtt_controller.cpp
+++ b/wifi/1.6/default/wifi_rtt_controller.cpp
@@ -43,7 +43,7 @@
     return is_valid_;
 }
 
-std::vector<sp<V1_4::IWifiRttControllerEventCallback>> WifiRttController::getEventCallbacks() {
+std::vector<sp<V1_6::IWifiRttControllerEventCallback>> WifiRttController::getEventCallbacks() {
     return event_callbacks_;
 }
 
@@ -102,7 +102,7 @@
 }
 
 Return<void> WifiRttController::enableResponder(uint32_t cmd_id,
-                                                const WifiChannelInfo& channel_hint,
+                                                const V1_0::WifiChannelInfo& channel_hint,
                                                 uint32_t max_duration_seconds,
                                                 const V1_0::RttResponder& info,
                                                 enableResponder_cb hidl_status_cb) {
@@ -144,7 +144,7 @@
 }
 
 Return<void> WifiRttController::enableResponder_1_4(uint32_t cmd_id,
-                                                    const WifiChannelInfo& channel_hint,
+                                                    const V1_0::WifiChannelInfo& channel_hint,
                                                     uint32_t max_duration_seconds,
                                                     const V1_4::RttResponder& info,
                                                     enableResponder_1_4_cb hidl_status_cb) {
@@ -153,6 +153,42 @@
                            channel_hint, max_duration_seconds, info);
 }
 
+Return<void> WifiRttController::registerEventCallback_1_6(
+        const sp<V1_6::IWifiRttControllerEventCallback>& callback,
+        registerEventCallback_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::registerEventCallbackInternal_1_6, hidl_status_cb,
+                           callback);
+}
+
+Return<void> WifiRttController::rangeRequest_1_6(uint32_t cmd_id,
+                                                 const hidl_vec<V1_6::RttConfig>& rtt_configs,
+                                                 rangeRequest_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::rangeRequestInternal_1_6, hidl_status_cb, cmd_id,
+                           rtt_configs);
+}
+
+Return<void> WifiRttController::getCapabilities_1_6(getCapabilities_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::getCapabilitiesInternal_1_6, hidl_status_cb);
+}
+
+Return<void> WifiRttController::getResponderInfo_1_6(getResponderInfo_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::getResponderInfoInternal_1_6, hidl_status_cb);
+}
+
+Return<void> WifiRttController::enableResponder_1_6(uint32_t cmd_id,
+                                                    const V1_6::WifiChannelInfo& channel_hint,
+                                                    uint32_t max_duration_seconds,
+                                                    const V1_6::RttResponder& info,
+                                                    enableResponder_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_RTT_CONTROLLER_INVALID,
+                           &WifiRttController::enableResponderInternal_1_6, hidl_status_cb, cmd_id,
+                           channel_hint, max_duration_seconds, info);
+}
+
 std::pair<WifiStatus, sp<IWifiIface>> WifiRttController::getBoundIfaceInternal() {
     return {createWifiStatus(WifiStatusCode::SUCCESS), bound_iface_};
 }
@@ -210,10 +246,9 @@
     return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
 }
 
-WifiStatus WifiRttController::enableResponderInternal(uint32_t /* cmd_id */,
-                                                      const WifiChannelInfo& /* channel_hint */,
-                                                      uint32_t /* max_duration_seconds */,
-                                                      const V1_0::RttResponder& /* info */) {
+WifiStatus WifiRttController::enableResponderInternal(
+        uint32_t /* cmd_id */, const V1_0::WifiChannelInfo& /* channel_hint */,
+        uint32_t /* max_duration_seconds */, const V1_0::RttResponder& /* info */) {
     // Deprecated support for this api
     return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED)};
 }
@@ -224,14 +259,43 @@
 }
 
 WifiStatus WifiRttController::registerEventCallbackInternal_1_4(
-        const sp<V1_4::IWifiRttControllerEventCallback>& callback) {
+        const sp<V1_4::IWifiRttControllerEventCallback>& /* callback */) {
+    // Deprecated support for this api
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+WifiStatus WifiRttController::rangeRequestInternal_1_4(
+        uint32_t /* cmd_id */, const std::vector<V1_4::RttConfig>& /* rtt_configs */) {
+    // Deprecated support for this api
+    return createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED);
+}
+
+std::pair<WifiStatus, V1_4::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_4() {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+std::pair<WifiStatus, V1_4::RttResponder> WifiRttController::getResponderInfoInternal_1_4() {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+WifiStatus WifiRttController::enableResponderInternal_1_4(
+        uint32_t /* cmd_id */, const V1_0::WifiChannelInfo& /* channel_hint */,
+        uint32_t /* max_duration_seconds */, const V1_4::RttResponder& /* info */) {
+    // Deprecated support for this api
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED)};
+}
+
+WifiStatus WifiRttController::registerEventCallbackInternal_1_6(
+        const sp<V1_6::IWifiRttControllerEventCallback>& callback) {
     // TODO(b/31632518): remove the callback when the client is destroyed
     event_callbacks_.emplace_back(callback);
     return createWifiStatus(WifiStatusCode::SUCCESS);
 }
 
-WifiStatus WifiRttController::rangeRequestInternal_1_4(
-        uint32_t cmd_id, const std::vector<V1_4::RttConfig>& rtt_configs) {
+WifiStatus WifiRttController::rangeRequestInternal_1_6(
+        uint32_t cmd_id, const std::vector<V1_6::RttConfig>& rtt_configs) {
     std::vector<legacy_hal::wifi_rtt_config> legacy_configs;
     if (!hidl_struct_util::convertHidlVectorOfRttConfigToLegacy(rtt_configs, &legacy_configs)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
@@ -245,14 +309,14 @@
                     LOG(ERROR) << "Callback invoked on an invalid object";
                     return;
                 }
-                std::vector<V1_4::RttResult> hidl_results;
+                std::vector<V1_6::RttResult> hidl_results;
                 if (!hidl_struct_util::convertLegacyVectorOfRttResultToHidl(results,
                                                                             &hidl_results)) {
                     LOG(ERROR) << "Failed to convert rtt results to HIDL structs";
                     return;
                 }
                 for (const auto& callback : shared_ptr_this->getEventCallbacks()) {
-                    callback->onResults_1_4(id, hidl_results);
+                    callback->onResults_1_6(id, hidl_results);
                 }
             };
     legacy_hal::wifi_error legacy_status = legacy_hal_.lock()->startRttRangeRequest(
@@ -260,38 +324,38 @@
     return createWifiStatusFromLegacyError(legacy_status);
 }
 
-std::pair<WifiStatus, V1_4::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_4() {
+std::pair<WifiStatus, V1_6::RttCapabilities> WifiRttController::getCapabilitiesInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::wifi_rtt_capabilities legacy_caps;
     std::tie(legacy_status, legacy_caps) = legacy_hal_.lock()->getRttCapabilities(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_4::RttCapabilities hidl_caps;
+    V1_6::RttCapabilities hidl_caps;
     if (!hidl_struct_util::convertLegacyRttCapabilitiesToHidl(legacy_caps, &hidl_caps)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_caps};
 }
 
-std::pair<WifiStatus, V1_4::RttResponder> WifiRttController::getResponderInfoInternal_1_4() {
+std::pair<WifiStatus, V1_6::RttResponder> WifiRttController::getResponderInfoInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::wifi_rtt_responder legacy_responder;
     std::tie(legacy_status, legacy_responder) = legacy_hal_.lock()->getRttResponderInfo(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_4::RttResponder hidl_responder;
+    V1_6::RttResponder hidl_responder;
     if (!hidl_struct_util::convertLegacyRttResponderToHidl(legacy_responder, &hidl_responder)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
     return {createWifiStatus(WifiStatusCode::SUCCESS), hidl_responder};
 }
 
-WifiStatus WifiRttController::enableResponderInternal_1_4(uint32_t cmd_id,
-                                                          const WifiChannelInfo& channel_hint,
+WifiStatus WifiRttController::enableResponderInternal_1_6(uint32_t cmd_id,
+                                                          const V1_6::WifiChannelInfo& channel_hint,
                                                           uint32_t max_duration_seconds,
-                                                          const V1_4::RttResponder& info) {
+                                                          const V1_6::RttResponder& info) {
     legacy_hal::wifi_channel_info legacy_channel_info;
     if (!hidl_struct_util::convertHidlWifiChannelInfoToLegacy(channel_hint, &legacy_channel_info)) {
         return createWifiStatus(WifiStatusCode::ERROR_INVALID_ARGS);
diff --git a/wifi/1.6/default/wifi_rtt_controller.h b/wifi/1.6/default/wifi_rtt_controller.h
index b4a2116..fd5f68b 100644
--- a/wifi/1.6/default/wifi_rtt_controller.h
+++ b/wifi/1.6/default/wifi_rtt_controller.h
@@ -19,8 +19,8 @@
 
 #include <android-base/macros.h>
 #include <android/hardware/wifi/1.0/IWifiIface.h>
-#include <android/hardware/wifi/1.4/IWifiRttController.h>
-#include <android/hardware/wifi/1.4/IWifiRttControllerEventCallback.h>
+#include <android/hardware/wifi/1.6/IWifiRttController.h>
+#include <android/hardware/wifi/1.6/IWifiRttControllerEventCallback.h>
 
 #include "wifi_legacy_hal.h"
 
@@ -33,14 +33,14 @@
 /**
  * HIDL interface object used to control all RTT operations.
  */
-class WifiRttController : public V1_4::IWifiRttController {
+class WifiRttController : public V1_6::IWifiRttController {
   public:
     WifiRttController(const std::string& iface_name, const sp<IWifiIface>& bound_iface,
                       const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal);
     // Refer to |WifiChip::invalidate()|.
     void invalidate();
     bool isValid();
-    std::vector<sp<V1_4::IWifiRttControllerEventCallback>> getEventCallbacks();
+    std::vector<sp<V1_6::IWifiRttControllerEventCallback>> getEventCallbacks();
     std::string getIfaceName();
 
     // HIDL methods exposed.
@@ -57,7 +57,7 @@
     Return<void> setLcr(uint32_t cmd_id, const RttLcrInformation& lcr,
                         setLcr_cb hidl_status_cb) override;
     Return<void> getResponderInfo(getResponderInfo_cb hidl_status_cb) override;
-    Return<void> enableResponder(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    Return<void> enableResponder(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                  uint32_t max_duration_seconds, const V1_0::RttResponder& info,
                                  enableResponder_cb hidl_status_cb) override;
     Return<void> disableResponder(uint32_t cmd_id, disableResponder_cb hidl_status_cb) override;
@@ -68,9 +68,19 @@
                                   rangeRequest_1_4_cb hidl_status_cb) override;
     Return<void> getCapabilities_1_4(getCapabilities_1_4_cb hidl_status_cb) override;
     Return<void> getResponderInfo_1_4(getResponderInfo_1_4_cb hidl_status_cb) override;
-    Return<void> enableResponder_1_4(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    Return<void> enableResponder_1_4(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                      uint32_t max_duration_seconds, const V1_4::RttResponder& info,
                                      enableResponder_1_4_cb hidl_status_cb) override;
+    Return<void> registerEventCallback_1_6(
+            const sp<V1_6::IWifiRttControllerEventCallback>& callback,
+            registerEventCallback_1_6_cb hidl_status_cb) override;
+    Return<void> rangeRequest_1_6(uint32_t cmd_id, const hidl_vec<V1_6::RttConfig>& rtt_configs,
+                                  rangeRequest_1_6_cb hidl_status_cb) override;
+    Return<void> getCapabilities_1_6(getCapabilities_1_6_cb hidl_status_cb) override;
+    Return<void> getResponderInfo_1_6(getResponderInfo_1_6_cb hidl_status_cb) override;
+    Return<void> enableResponder_1_6(uint32_t cmd_id, const V1_6::WifiChannelInfo& channel_hint,
+                                     uint32_t max_duration_seconds, const V1_6::RttResponder& info,
+                                     enableResponder_1_6_cb hidl_status_cb) override;
 
   private:
     // Corresponding worker functions for the HIDL methods.
@@ -85,7 +95,7 @@
     WifiStatus setLciInternal(uint32_t cmd_id, const RttLciInformation& lci);
     WifiStatus setLcrInternal(uint32_t cmd_id, const RttLcrInformation& lcr);
     std::pair<WifiStatus, V1_0::RttResponder> getResponderInfoInternal();
-    WifiStatus enableResponderInternal(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    WifiStatus enableResponderInternal(uint32_t cmd_id, const V1_0::WifiChannelInfo& channel_hint,
                                        uint32_t max_duration_seconds,
                                        const V1_0::RttResponder& info);
     WifiStatus disableResponderInternal(uint32_t cmd_id);
@@ -95,14 +105,25 @@
                                         const std::vector<V1_4::RttConfig>& rtt_configs);
     std::pair<WifiStatus, V1_4::RttCapabilities> getCapabilitiesInternal_1_4();
     std::pair<WifiStatus, V1_4::RttResponder> getResponderInfoInternal_1_4();
-    WifiStatus enableResponderInternal_1_4(uint32_t cmd_id, const WifiChannelInfo& channel_hint,
+    WifiStatus enableResponderInternal_1_4(uint32_t cmd_id,
+                                           const V1_0::WifiChannelInfo& channel_hint,
                                            uint32_t max_duration_seconds,
                                            const V1_4::RttResponder& info);
+    WifiStatus registerEventCallbackInternal_1_6(
+            const sp<V1_6::IWifiRttControllerEventCallback>& callback);
+    WifiStatus rangeRequestInternal_1_6(uint32_t cmd_id,
+                                        const std::vector<V1_6::RttConfig>& rtt_configs);
+    std::pair<WifiStatus, V1_6::RttCapabilities> getCapabilitiesInternal_1_6();
+    std::pair<WifiStatus, V1_6::RttResponder> getResponderInfoInternal_1_6();
+    WifiStatus enableResponderInternal_1_6(uint32_t cmd_id,
+                                           const V1_6::WifiChannelInfo& channel_hint,
+                                           uint32_t max_duration_seconds,
+                                           const V1_6::RttResponder& info);
 
     std::string ifname_;
     sp<IWifiIface> bound_iface_;
     std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal_;
-    std::vector<sp<V1_4::IWifiRttControllerEventCallback>> event_callbacks_;
+    std::vector<sp<V1_6::IWifiRttControllerEventCallback>> event_callbacks_;
     bool is_valid_;
 
     DISALLOW_COPY_AND_ASSIGN(WifiRttController);
diff --git a/wifi/1.6/default/wifi_sta_iface.cpp b/wifi/1.6/default/wifi_sta_iface.cpp
index f852d36..dd11839 100644
--- a/wifi/1.6/default/wifi_sta_iface.cpp
+++ b/wifi/1.6/default/wifi_sta_iface.cpp
@@ -150,6 +150,11 @@
                            &WifiStaIface::getLinkLayerStatsInternal_1_5, hidl_status_cb);
 }
 
+Return<void> WifiStaIface::getLinkLayerStats_1_6(getLinkLayerStats_1_6_cb hidl_status_cb) {
+    return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
+                           &WifiStaIface::getLinkLayerStatsInternal_1_6, hidl_status_cb);
+}
+
 Return<void> WifiStaIface::startRssiMonitoring(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
                                                startRssiMonitoring_cb hidl_status_cb) {
     return validateAndCall(this, WifiStatusCode::ERROR_WIFI_IFACE_INVALID,
@@ -422,13 +427,17 @@
 }
 
 std::pair<WifiStatus, V1_5::StaLinkLayerStats> WifiStaIface::getLinkLayerStatsInternal_1_5() {
+    return {createWifiStatus(WifiStatusCode::ERROR_NOT_SUPPORTED), {}};
+}
+
+std::pair<WifiStatus, V1_6::StaLinkLayerStats> WifiStaIface::getLinkLayerStatsInternal_1_6() {
     legacy_hal::wifi_error legacy_status;
     legacy_hal::LinkLayerStats legacy_stats;
     std::tie(legacy_status, legacy_stats) = legacy_hal_.lock()->getLinkLayerStats(ifname_);
     if (legacy_status != legacy_hal::WIFI_SUCCESS) {
         return {createWifiStatusFromLegacyError(legacy_status), {}};
     }
-    V1_5::StaLinkLayerStats hidl_stats;
+    V1_6::StaLinkLayerStats hidl_stats;
     if (!hidl_struct_util::convertLegacyLinkLayerStatsToHidl(legacy_stats, &hidl_stats)) {
         return {createWifiStatus(WifiStatusCode::ERROR_UNKNOWN), {}};
     }
diff --git a/wifi/1.6/default/wifi_sta_iface.h b/wifi/1.6/default/wifi_sta_iface.h
index 37358a5..c01c50b 100644
--- a/wifi/1.6/default/wifi_sta_iface.h
+++ b/wifi/1.6/default/wifi_sta_iface.h
@@ -19,7 +19,7 @@
 
 #include <android-base/macros.h>
 #include <android/hardware/wifi/1.0/IWifiStaIfaceEventCallback.h>
-#include <android/hardware/wifi/1.5/IWifiStaIface.h>
+#include <android/hardware/wifi/1.6/IWifiStaIface.h>
 
 #include "hidl_callback_util.h"
 #include "wifi_iface_util.h"
@@ -35,7 +35,7 @@
 /**
  * HIDL interface object used to control a STA Iface instance.
  */
-class WifiStaIface : public V1_5::IWifiStaIface {
+class WifiStaIface : public V1_6::IWifiStaIface {
   public:
     WifiStaIface(const std::string& ifname,
                  const std::weak_ptr<legacy_hal::WifiLegacyHal> legacy_hal,
@@ -71,6 +71,7 @@
     Return<void> getLinkLayerStats(getLinkLayerStats_cb hidl_status_cb) override;
     Return<void> getLinkLayerStats_1_3(getLinkLayerStats_1_3_cb hidl_status_cb) override;
     Return<void> getLinkLayerStats_1_5(getLinkLayerStats_1_5_cb hidl_status_cb) override;
+    Return<void> getLinkLayerStats_1_6(getLinkLayerStats_1_6_cb hidl_status_cb) override;
     Return<void> startRssiMonitoring(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi,
                                      startRssiMonitoring_cb hidl_status_cb) override;
     Return<void> stopRssiMonitoring(uint32_t cmd_id, stopRssiMonitoring_cb hidl_status_cb) override;
@@ -116,6 +117,7 @@
     std::pair<WifiStatus, V1_0::StaLinkLayerStats> getLinkLayerStatsInternal();
     std::pair<WifiStatus, V1_3::StaLinkLayerStats> getLinkLayerStatsInternal_1_3();
     std::pair<WifiStatus, V1_5::StaLinkLayerStats> getLinkLayerStatsInternal_1_5();
+    std::pair<WifiStatus, V1_6::StaLinkLayerStats> getLinkLayerStatsInternal_1_6();
     WifiStatus startRssiMonitoringInternal(uint32_t cmd_id, int32_t max_rssi, int32_t min_rssi);
     WifiStatus stopRssiMonitoringInternal(uint32_t cmd_id);
     std::pair<WifiStatus, StaRoamingCapabilities> getRoamingCapabilitiesInternal();
diff --git a/wifi/1.6/types.hal b/wifi/1.6/types.hal
new file mode 100644
index 0000000..f1d9d45
--- /dev/null
+++ b/wifi/1.6/types.hal
@@ -0,0 +1,670 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.wifi@1.6;
+
+import @1.0::MacAddress;
+import @1.0::NanDataPathConfirmInd;
+import @1.0::Rssi;
+import @1.0::RttBw;
+import @1.0::RttPeerType;
+import @1.0::RttStatus;
+import @1.0::RttType;
+import @1.0::StaLinkLayerIfaceStats;
+import @1.0::StaLinkLayerRadioStats;
+import @1.0::TimeSpanInPs;
+import @1.0::TimeStampInUs;
+import @1.0::TimeStampInMs;
+import @1.0::WifiChannelInMhz;
+import @1.0::WifiChannelWidthInMhz;
+import @1.0::WifiInformationElement;
+import @1.0::WifiRateNss;
+import @1.4::RttPreamble;
+import @1.4::WifiRatePreamble;
+import @1.5::StaLinkLayerIfaceContentionTimeStats;
+import @1.5::WifiIfaceMode;
+
+/**
+ * Channel operating width in Mhz.
+ */
+enum WifiChannelWidthInMhz : @1.0::WifiChannelWidthInMhz {
+    /**
+     * 320 MHz
+     */
+    WIDTH_320 = 7,
+};
+
+/**
+ * RTT Measurement Bandwidth.
+ */
+enum RttBw : @1.0::RttBw {
+    BW_320MHZ = 0x40,
+};
+
+/**
+ * RTT Measurement Preamble.
+ */
+enum RttPreamble : @1.4::RttPreamble {
+    /**
+     * Preamble type for 11be
+     */
+    EHT = 0x10,
+};
+
+/**
+ * Wifi Rate Preamble
+ */
+enum WifiRatePreamble : @1.4::WifiRatePreamble {
+    /**
+     * Preamble type for 11be
+     */
+    EHT = 6,
+};
+
+/**
+ * Channel information.
+ */
+struct WifiChannelInfo {
+  /**
+   * Channel width (20, 40, 80, 80+80, 160, 320).
+   */
+  WifiChannelWidthInMhz width;
+  /**
+   * Primary 20 MHz channel.
+   */
+  WifiChannelInMhz centerFreq;
+  /**
+   * Center frequency (MHz) first segment.
+   */
+  WifiChannelInMhz centerFreq0;
+  /**
+   * Center frequency (MHz) second segment.
+   */
+  WifiChannelInMhz centerFreq1;
+};
+
+/**
+ * RTT configuration.
+ */
+struct RttConfig {
+    /**
+     * Peer device mac address.
+     */
+    MacAddress addr;
+
+    /**
+     * 1-sided or 2-sided RTT.
+     */
+    RttType type;
+
+    /**
+     * Optional - peer device hint (STA, P2P, AP).
+     */
+    RttPeerType peer;
+
+    /**
+     * Required for STA-AP mode, optional for P2P, NBD etc.
+     */
+    WifiChannelInfo channel;
+
+    /**
+     * Time interval between bursts (units: 100 ms).
+     * Applies to 1-sided and 2-sided RTT multi-burst requests.
+     * Range: 0-31, 0: no preference by initiator (2-sided RTT).
+     */
+    uint32_t burstPeriod;
+
+    /**
+     * Total number of RTT bursts to be executed. It will be
+     * specified in the same way as the parameter "Number of
+     * Burst Exponent" found in the FTM frame format. It
+     * applies to both: 1-sided RTT and 2-sided RTT. Valid
+     * values are 0 to 15 as defined in 802.11mc std.
+     * 0 means single shot
+     * The implication of this parameter on the maximum
+     * number of RTT results is the following:
+     * for 1-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst)
+     * for 2-sided RTT: max num of RTT results = (2^num_burst)*(num_frames_per_burst - 1)
+     */
+    uint32_t numBurst;
+
+    /**
+     * Num of frames per burst.
+     * Minimum value = 1, Maximum value = 31
+     * For 2-sided this equals the number of FTM frames
+     * to be attempted in a single burst. This also
+     * equals the number of FTM frames that the
+     * initiator will request that the responder send
+     * in a single frame.
+     */
+    uint32_t numFramesPerBurst;
+
+    /**
+     * Number of retries for a failed RTT frame.
+     * Applies to 1-sided RTT only. Minimum value = 0, Maximum value = 3
+     */
+    uint32_t numRetriesPerRttFrame;
+
+    /**
+     * Following fields are only valid for 2-side RTT.
+     *
+     *
+     * Maximum number of retries that the initiator can
+     * retry an FTMR frame.
+     * Minimum value = 0, Maximum value = 3
+     */
+    uint32_t numRetriesPerFtmr;
+
+    /**
+     * Whether to request location civic info or not.
+     */
+    bool mustRequestLci;
+
+    /**
+     * Whether to request location civic records or not.
+     */
+    bool mustRequestLcr;
+
+    /**
+     * Applies to 1-sided and 2-sided RTT. Valid values will
+     * be 2-11 and 15 as specified by the 802.11mc std for
+     * the FTM parameter burst duration. In a multi-burst
+     * request, if responder overrides with larger value,
+     * the initiator will return failure. In a single-burst
+     * request if responder overrides with larger value,
+     * the initiator will sent TMR_STOP to terminate RTT
+     * at the end of the burst_duration it requested.
+     */
+    uint32_t burstDuration;
+
+    /**
+     * RTT preamble to be used in the RTT frames.
+     */
+    RttPreamble preamble;
+
+    /**
+     * RTT BW to be used in the RTT frames.
+     */
+    RttBw bw;
+};
+
+/**
+ * RTT Responder information
+ */
+struct RttResponder {
+    WifiChannelInfo channel;
+
+    RttPreamble preamble;
+};
+
+struct WifiChannelStats {
+   /**
+    * Channel information.
+    */
+    WifiChannelInfo channel;
+    /**
+     * Total time for which the radio is awake on this channel.
+     */
+    uint32_t onTimeInMs;
+    /**
+     * Total time for which CCA is held busy on this channel.
+     */
+    uint32_t ccaBusyTimeInMs;
+};
+
+struct StaLinkLayerRadioStats {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::StaLinkLayerRadioStats V1_0;
+
+    /**
+     * Total time for which the radio is awake due to NAN scan since boot or crash.
+     */
+    uint32_t onTimeInMsForNanScan;
+
+    /**
+     * Total time for which the radio is awake due to background scan since boot or crash.
+     */
+    uint32_t onTimeInMsForBgScan;
+
+    /**
+     * Total time for which the radio is awake due to roam scan since boot or crash.
+     */
+    uint32_t onTimeInMsForRoamScan;
+
+    /**
+     * Total time for which the radio is awake due to PNO scan since boot or crash.
+     */
+    uint32_t onTimeInMsForPnoScan;
+
+    /**
+     * Total time for which the radio is awake due to Hotspot 2.0 scans and GAS exchange since boot
+     * or crash.
+     */
+    uint32_t onTimeInMsForHs20Scan;
+
+    /**
+     * List of channel stats associated with this radio
+     */
+    vec<WifiChannelStats> channelStats;
+
+    /**
+     * Radio ID: An implementation specific value identifying the radio interface for which the
+     * stats are produced. Framework must not interpret this value. It must use this value for
+     * persistently identifying the statistics between calls,
+     * e.g. if the HAL provides them in different order.
+     */
+    int32_t radioId;
+};
+
+/**
+ * Per peer statistics.  The types of peer include the Access Point (AP), the Tunneled Direct Link
+ * Setup (TDLS), the Group Owner (GO), the Neighbor Awareness Networking (NAN), etc.
+ */
+struct StaPeerInfo {
+    /**
+     * Station count: The total number of stations currently associated with the peer.
+     */
+    uint16_t staCount;
+    /**
+     * Channel utilization: The percentage of time (normalized to 255, i.e., x% corresponds to
+     * (int) x * 255 / 100) that the medium is sensed as busy measured by either physical or
+     * virtual carrier sense (CS) mechanism.
+     */
+    uint16_t chanUtil;
+    /**
+     * Per rate statistics
+     */
+    vec<StaRateStat> rateStats;
+};
+
+/**
+ * Iface statistics for the current connection.
+ */
+struct StaLinkLayerIfaceStats {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::StaLinkLayerIfaceStats V1_0;
+
+    /**
+     * Duty cycle for the iface.
+     * if this iface is being served using time slicing on a radio with one or more ifaces
+     * (i.e MCC), then the duty cycle assigned to this iface in %.
+     * If not using time slicing (i.e SCC or DBS), set to 100.
+     */
+    uint8_t timeSliceDutyCycleInPercent;
+
+    /**
+     * WME Best Effort (BE) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeBeContentionTimeStats;
+
+    /**
+     * WME Background (BK) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeBkContentionTimeStats;
+
+    /**
+     * WME Video (VI) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeViContentionTimeStats;
+
+    /**
+     * WME Voice (VO) Access Category (AC) contention time statistics.
+     */
+    StaLinkLayerIfaceContentionTimeStats wmeVoContentionTimeStats;
+
+    /**
+     * Per peer statistics.
+     */
+    vec<StaPeerInfo> peers;
+};
+
+/**
+ * Link layer stats retrieved via |getLinkLayerStats|.
+ */
+struct StaLinkLayerStats {
+    StaLinkLayerIfaceStats iface;
+
+    vec<StaLinkLayerRadioStats> radios;
+
+    /**
+     * TimeStamp for each stats sample.
+     * This is the absolute milliseconds from boot when these stats were
+     * sampled.
+     */
+    TimeStampInMs timeStampInMs;
+};
+
+/**
+ * Wifi rate info.
+ */
+struct WifiRateInfo {
+    /**
+     * Preamble used for RTT measurements.
+     */
+    WifiRatePreamble preamble;
+
+    /**
+     * Number of spatial streams.
+     */
+    WifiRateNss nss;
+
+    /**
+     * Bandwidth of channel.
+     */
+    WifiChannelWidthInMhz bw;
+
+    /**
+     * OFDM/CCK rate code would be as per ieee std in the units of 0.5mbps.
+     * HT/VHT/HE/EHT it would be mcs index.
+     */
+    uint8_t rateMcsIdx;
+
+    /**
+     * Bitrate in units of 100 Kbps.
+     */
+    uint32_t bitRateInKbps;
+};
+
+/**
+ * Per rate statistics.  The rate is characterized by the combination of preamble, number of spatial
+ * streams, transmission bandwidth, and modulation and coding scheme (MCS).
+ */
+struct StaRateStat{
+    /**
+     * Wifi rate information: preamble, number of spatial streams, bandwidth, MCS, etc.
+     */
+    WifiRateInfo rateInfo;
+    /**
+     * Number of successfully transmitted data packets (ACK received)
+     */
+    uint32_t txMpdu;
+    /**
+     * Number of received data packets
+     */
+    uint32_t rxMpdu;
+    /**
+     * Number of data packet losses (no ACK)
+     */
+    uint32_t mpduLost;
+    /**
+     * Number of data packet retries
+     */
+    uint32_t retries;
+};
+
+/**
+ * RTT results.
+ */
+struct RttResult {
+    /**
+     * Peer device mac address.
+     */
+    MacAddress addr;
+
+    /**
+     * Burst number in a multi-burst request.
+     */
+    uint32_t burstNum;
+
+    /**
+     * Total RTT measurement frames attempted.
+     */
+    uint32_t measurementNumber;
+
+    /**
+     * Total successful RTT measurement frames.
+     */
+    uint32_t successNumber;
+
+    /**
+     * Maximum number of "FTM frames per burst" supported by
+     * the responder STA. Applies to 2-sided RTT only.
+     * If reponder overrides with larger value:
+     * - for single-burst request initiator will truncate the
+     * larger value and send a TMR_STOP after receiving as
+     * many frames as originally requested.
+     * - for multi-burst request, initiator will return
+     * failure right away.
+     */
+    uint8_t numberPerBurstPeer;
+
+    /**
+     * Ranging status.
+     */
+    RttStatus status;
+
+    /**
+     * When status == RTT_STATUS_FAIL_BUSY_TRY_LATER,
+     * this will be the time provided by the responder as to
+     * when the request can be tried again. Applies to 2-sided
+     * RTT only. In sec, 1-31sec.
+     */
+    uint8_t retryAfterDuration;
+
+    /**
+     * RTT type.
+     */
+    RttType type;
+
+    /**
+     * Average rssi in 0.5 dB steps e.g. 143 implies -71.5 dB.
+     */
+    Rssi rssi;
+
+    /**
+     * Rssi spread in 0.5 dB steps e.g. 5 implies 2.5 dB spread (optional).
+     */
+    Rssi rssiSpread;
+
+    /**
+     * 1-sided RTT: TX rate of RTT frame.
+     * 2-sided RTT: TX rate of initiator's Ack in response to FTM frame.
+     */
+    WifiRateInfo txRate;
+
+    /**
+     * 1-sided RTT: TX rate of Ack from other side.
+     * 2-sided RTT: TX rate of FTM frame coming from responder.
+     */
+    WifiRateInfo rxRate;
+
+    /**
+     * Round trip time in picoseconds
+     */
+    TimeSpanInPs rtt;
+
+    /**
+     * Rtt standard deviation in picoseconds.
+     */
+    TimeSpanInPs rttSd;
+
+    /**
+     * Difference between max and min rtt times recorded in picoseconds.
+     */
+    TimeSpanInPs rttSpread;
+
+    /**
+     * Distance in mm (optional).
+     */
+    int32_t distanceInMm;
+
+    /**
+     * Standard deviation in mm (optional).
+     */
+    int32_t distanceSdInMm;
+
+    /**
+     * Difference between max and min distance recorded in mm (optional).
+     */
+    int32_t distanceSpreadInMm;
+
+    /**
+     * Time of the measurement (in microseconds since boot).
+     */
+    TimeStampInUs timeStampInUs;
+
+    /**
+     * in ms, actual time taken by the FW to finish one burst
+     * measurement. Applies to 1-sided and 2-sided RTT.
+     */
+    uint32_t burstDurationInMs;
+
+    /**
+     * Number of bursts allowed by the responder. Applies
+     * to 2-sided RTT only.
+     */
+    uint32_t negotiatedBurstNum;
+
+    /**
+     * for 11mc only.
+     */
+    WifiInformationElement lci;
+
+    /**
+     * for 11mc only.
+     */
+    WifiInformationElement lcr;
+};
+
+/**
+ * NAN data path channel information provided to the framework.
+ */
+struct NanDataPathChannelInfo {
+    /**
+     * Channel frequency in MHz.
+     */
+    WifiChannelInMhz channelFreq;
+    /**
+     * Channel bandwidth in MHz.
+     */
+    WifiChannelWidthInMhz channelBandwidth;
+    /**
+     * Number of spatial streams used in the channel.
+     */
+    uint32_t numSpatialStreams;
+};
+
+/**
+ * NAN Data path confirmation Indication structure.
+ * Event indication is received on both initiator and responder side when negotiation for a
+ * data-path finish: on success or failure.
+ */
+struct NanDataPathConfirmInd {
+    /**
+     * Baseline information as defined in HAL 1.0.
+     */
+    @1.0::NanDataPathConfirmInd V1_0;
+    /**
+     * The channel(s) on which the NDP is scheduled to operate.
+     * Updates to the operational channels are provided using the |eventDataPathScheduleUpdate|
+     * event.
+     */
+    vec<NanDataPathChannelInfo> channelInfo;
+};
+
+/**
+ * NAN data path channel information update indication structure.
+ * Event indication is received by all NDP owners whenever the channels on which the NDP operates
+ * are updated.
+ * Note: multiple NDPs may share the same schedule, the indication specifies all NDPs to which it
+ * applies.
+ */
+struct NanDataPathScheduleUpdateInd {
+    /**
+     * The discovery address (NMI) of the peer to which the NDP is connected.
+     */
+    MacAddress peerDiscoveryAddress;
+    /**
+     * The updated channel(s) information.
+     */
+    vec<NanDataPathChannelInfo> channelInfo;
+    /**
+     * The list of NDPs to which this update applies.
+     */
+    vec<uint32_t> ndpInstanceIds;
+};
+
+/**
+ * Wifi usable channel information.
+ */
+struct WifiUsableChannel {
+    /**
+     * Wifi channel freqeuncy in MHz.
+     */
+    WifiChannelInMhz channel;
+
+    /**
+     * Wifi channel bandwidth in MHz.
+     */
+    WifiChannelWidthInMhz channelBandwidth;
+
+    /**
+     * Iface modes feasible on this channel.
+     */
+    bitfield<WifiIfaceMode> ifaceModeMask;
+};
+
+/**
+ * RTT Capabilities.
+ */
+struct RttCapabilities {
+    /**
+     * if 1-sided rtt data collection is supported.
+     */
+    bool rttOneSidedSupported;
+
+    /**
+     * if ftm rtt data collection is supported.
+     */
+    bool rttFtmSupported;
+
+    /**
+     * if initiator supports LCI request. Applies to 2-sided RTT.
+     */
+    bool lciSupported;
+
+    /**
+     * if initiator supports LCR request. Applies to 2-sided RTT.
+     */
+    bool lcrSupported;
+
+    /**
+     * if 11mc responder mode is supported.
+     */
+    bool responderSupported;
+
+    /**
+     * Bit mask indicates what preamble is supported by initiator.
+     * Combination of |RttPreamble| values.
+     */
+    bitfield<RttPreamble> preambleSupport;
+
+    /**
+     * Bit mask indicates what BW is supported by initiator.
+     * Combination of |RttBw| values.
+     */
+    bitfield<RttBw> bwSupport;
+
+    /**
+     * Draft 11mc spec version supported by chip.
+     * For instance, version 4.0 must be 40 and version 4.3 must be 43 etc.
+     */
+    uint8_t mcVersion;
+};
diff --git a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
index 18baea6..bdc5f34 100644
--- a/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
+++ b/wifi/supplicant/aidl/aidl_api/android.hardware.wifi.supplicant/current/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
@@ -125,6 +125,7 @@
   void setWapiCertSuite(in String suite);
   void setWepKey(in int keyIdx, in byte[] wepKey);
   void setWepTxKeyIdx(in int keyIdx);
+  void setRoamingConsortiumSelection(in byte[] selectedRcoi);
   const int SSID_MAX_LEN_IN_BYTES = 32;
   const int PSK_PASSPHRASE_MIN_LEN_IN_BYTES = 8;
   const int PSK_PASSPHRASE_MAX_LEN_IN_BYTES = 63;
diff --git a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
index 603e2ad..1a2087d 100644
--- a/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
+++ b/wifi/supplicant/aidl/android/hardware/wifi/supplicant/ISupplicantStaNetwork.aidl
@@ -1092,4 +1092,17 @@
      *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
      */
     void setWepTxKeyIdx(in int keyIdx);
+
+    /**
+     * Set the roaming consortium selection.
+     *
+     * @param selectedRcoi Indicates the roaming consortium selection. This is a
+     *            3 or 5-octet long byte array that indicates the selected RCOI
+     *            used for a Passpoint connection.
+     * @throws ServiceSpecificException with one of the following values:
+     *         |SupplicantStatusCode.FAILURE_ARGS_INVALID|,
+     *         |SupplicantStatusCode.FAILURE_UNKNOWN|,
+     *         |SupplicantStatusCode.FAILURE_NETWORK_INVALID|
+     */
+    void setRoamingConsortiumSelection(in byte[] selectedRcoi);
 }
diff --git a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
index 0a35f66..c6dd981 100644
--- a/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
+++ b/wifi/supplicant/aidl/vts/functional/supplicant_sta_network_aidl_test.cpp
@@ -784,6 +784,14 @@
     EXPECT_NE(retrievedToken.size(), 0);
 }
 
+/*
+ * SetRoamingConsortiumSelection
+ */
+TEST_P(SupplicantStaNetworkAidlTest, SetRoamingConsortiumSelection) {
+    const std::vector<uint8_t> testSelection = std::vector<uint8_t>({0x11, 0x21, 0x33, 0x44});
+    EXPECT_TRUE(sta_network_->setRoamingConsortiumSelection(testSelection).isOk());
+}
+
 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(SupplicantStaNetworkAidlTest);
 INSTANTIATE_TEST_SUITE_P(Supplicant, SupplicantStaNetworkAidlTest,
                          testing::ValuesIn(android::getAidlHalInstanceNames(