diff --git a/automotive/Android.bp b/automotive/Android.bp
index be58829..aec8865 100644
--- a/automotive/Android.bp
+++ b/automotive/Android.bp
@@ -1,6 +1,7 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "evs/1.0",
+    "evs/1.0/default",
     "evs/1.0/vts/functional",
     "vehicle/2.0",
     "vehicle/2.1",
diff --git a/automotive/evs/1.0/default/Android.bp b/automotive/evs/1.0/default/Android.bp
new file mode 100644
index 0000000..2574e86
--- /dev/null
+++ b/automotive/evs/1.0/default/Android.bp
@@ -0,0 +1,31 @@
+cc_binary {
+    name: "android.hardware.automotive.evs@1.0-service",
+    defaults: ["hidl_defaults"],
+    proprietary: true,
+    relative_install_path: "hw",
+    srcs: [
+        "service.cpp",
+        "EvsCamera.cpp",
+        "EvsEnumerator.cpp",
+        "EvsDisplay.cpp"
+    ],
+    init_rc: ["android.hardware.automotive.evs@1.0-service.rc"],
+
+    shared_libs: [
+        "android.hardware.automotive.evs@1.0",
+        "libui",
+        "libbase",
+        "libbinder",
+        "libcutils",
+        "libhardware",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libutils",
+    ],
+
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/automotive/evs/1.0/default/Android.mk b/automotive/evs/1.0/default/Android.mk
deleted file mode 100644
index 0ee7071..0000000
--- a/automotive/evs/1.0/default/Android.mk
+++ /dev/null
@@ -1,29 +0,0 @@
-LOCAL_PATH:=$(call my-dir)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.automotive.evs@1.0-service
-LOCAL_INIT_RC := android.hardware.automotive.evs@1.0-service.rc
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_VENDOR_MODULE := true
-
-LOCAL_SRC_FILES := \
-    service.cpp \
-    EvsCamera.cpp \
-    EvsEnumerator.cpp \
-    EvsDisplay.cpp \
-
-LOCAL_SHARED_LIBRARIES := \
-    android.hardware.automotive.evs@1.0 \
-    libui \
-    libbase \
-    libbinder \
-    libcutils \
-    libhardware \
-    libhidlbase \
-    libhidltransport \
-    liblog \
-    libutils \
-
-LOCAL_CFLAGS := -O0 -g
-
-include $(BUILD_EXECUTABLE)
diff --git a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
index fe34a3f..4800cd8 100644
--- a/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
+++ b/automotive/vehicle/2.0/default/impl/vhal_v2_0/EmulatedVehicleHal.cpp
@@ -61,10 +61,11 @@
 
 StatusCode EmulatedVehicleHal::set(const VehiclePropValue& propValue) {
     if (propValue.prop == kGenerateFakeDataControllingProperty) {
-        return handleGenerateFakeDataRequest(propValue);
-    };
-
-    if (mHvacPowerProps.count(propValue.prop)) {
+        StatusCode status = handleGenerateFakeDataRequest(propValue);
+        if (status != StatusCode::OK) {
+            return status;
+        }
+    } else if (mHvacPowerProps.count(propValue.prop)) {
         auto hvacPowerOn = mPropStore->readValueOrNull(toInt(VehicleProperty::HVAC_POWER_ON),
                                                       toInt(VehicleAreaZone::ROW_1));
 
@@ -176,6 +177,13 @@
 }
 
 bool EmulatedVehicleHal::setPropertyFromVehicle(const VehiclePropValue& propValue) {
+    if (propValue.prop == kGenerateFakeDataControllingProperty) {
+        StatusCode status = handleGenerateFakeDataRequest(propValue);
+        if (status != StatusCode::OK) {
+            return false;
+        }
+    }
+
     if (mPropStore->writeValue(propValue)) {
         doHalEvent(getValuePool()->obtain(propValue));
         return true;
diff --git a/automotive/vehicle/2.1/types.hal b/automotive/vehicle/2.1/types.hal
index 7be611c..2d1aa46 100644
--- a/automotive/vehicle/2.1/types.hal
+++ b/automotive/vehicle/2.1/types.hal
@@ -585,20 +585,26 @@
   /** A client publishes a data packet. */
   DATA = 3,
 
-  /* A client declaring layers offering. */
+  /** A client declaring layers offering. */
   OFFERING = 4,
 
-  /* Requesting the list of available layers. */
+  /** Requesting the list of available layers. */
   AVAILABILITY_REQUEST = 5,
 
-  /* Returning the list of available layers. */
+  /** Returning the list of available layers. */
   AVAILABILITY_RESPONSE = 6,
 
+  /** Sending to the HAL the current list of the available layers. */
+  AVAILABILITY_CHANGE = 7,
+
   /** Requesting layers that have subscribers. */
-  SUBSCRIPTION_REQUEST = 7,
+  SUBSCRIPTIONS_REQUEST = 8,
 
   /** Returning layers that have subscribers. */
-  SUBSCRIPTION_RESPONSE = 8,
+  SUBSCRIPTIONS_RESPONSE = 9,
+
+  /** Sending to the HAL the current list of the subscribed layers. */
+  SUBSCRIPTIONS_CHANGE = 10,
 };
 
 /**
@@ -620,6 +626,9 @@
 
   /* The version of the VMS layer. */
   VMS_LAYER_VERSION = 2,
+
+  /* The layer type as defined in the vms protocol */
+  VMS_LAYER_SUB_TYPE = 3,
 };
 
 /*
@@ -627,11 +636,14 @@
  * value properties
  */
 enum VmsOfferingMessageIntegerValuesIndex : VmsBaseMessageIntegerValuesIndex {
+  /* The ID assigend to the publisher by the VMS core. */
+  PUBLISHER_ID = 1,
+
   /* The number of VMS layer dependencies. */
-  VMS_NUMBER_OF_LAYERS_DEPENDENCIES = 1,
+  VMS_NUMBER_OF_LAYERS_DEPENDENCIES = 2,
 
   /* The first index that contain dependencies */
-  FIRST_DEPENDENCIES_INDEX = 2,
+  FIRST_DEPENDENCIES_INDEX = 3,
 };
 
 /**
diff --git a/broadcastradio/1.0/vts/functional/VtsHalBroadcastradioV1_0TargetTest.cpp b/broadcastradio/1.0/vts/functional/VtsHalBroadcastradioV1_0TargetTest.cpp
index ebeadb1..3ac6594 100644
--- a/broadcastradio/1.0/vts/functional/VtsHalBroadcastradioV1_0TargetTest.cpp
+++ b/broadcastradio/1.0/vts/functional/VtsHalBroadcastradioV1_0TargetTest.cpp
@@ -228,6 +228,7 @@
     bool getProperties();
     bool openTuner();
     bool checkAntenna();
+    BandConfig& getBand(unsigned idx);
 
     static const nsecs_t kConnectCallbacktimeoutNs = seconds_to_nanoseconds(1);
     static const nsecs_t kConfigCallbacktimeoutNs = seconds_to_nanoseconds(10);
@@ -237,6 +238,7 @@
     bool skipped;
     sp<IBroadcastRadio> mRadio;
     Properties mHalProperties;
+    bool mHalPropertiesInitialized = false;
     sp<ITuner> mTuner;
     sp<MyCallback> mTunerCallback;
     Mutex mLock;
@@ -280,23 +282,29 @@
 
 bool BroadcastRadioHidlTest::getProperties()
 {
-    if (mHalProperties.bands.size() == 0) {
-        Result halResult = Result::NOT_INITIALIZED;
-        Return<void> hidlReturn =
-                mRadio->getProperties([&](Result result, const Properties& properties) {
-                        halResult = result;
-                        if (result == Result::OK) {
-                            mHalProperties = properties;
-                        }
-                    });
+    if (mHalPropertiesInitialized) return true;
 
-        EXPECT_TRUE(hidlReturn.isOk());
-        EXPECT_EQ(Result::OK, halResult);
-        EXPECT_EQ(Class::AM_FM, mHalProperties.classId);
-        EXPECT_GT(mHalProperties.numTuners, 0u);
+    Result halResult = Result::NOT_INITIALIZED;
+    auto hidlReturn = mRadio->getProperties([&](Result result, const Properties& properties) {
+        halResult = result;
+        if (result == Result::OK) {
+            mHalProperties = properties;
+        }
+    });
+
+    EXPECT_TRUE(hidlReturn.isOk());
+    EXPECT_EQ(Result::OK, halResult);
+    EXPECT_EQ(radioClass, mHalProperties.classId);
+    EXPECT_GT(mHalProperties.numTuners, 0u);
+    if (radioClass == Class::AM_FM) {
         EXPECT_GT(mHalProperties.bands.size(), 0u);
     }
-    return mHalProperties.bands.size() > 0;
+
+    if (hidlReturn.isOk() && halResult == Result::OK) {
+        mHalPropertiesInitialized = true;
+        return true;
+    }
+    return false;
 }
 
 bool BroadcastRadioHidlTest::openTuner()
@@ -306,17 +314,18 @@
     }
     if (mTuner.get() == nullptr) {
         Result halResult = Result::NOT_INITIALIZED;
-        Return<void> hidlReturn =
-                mRadio->openTuner(mHalProperties.bands[0], true, mTunerCallback,
-                                  [&](Result result, const sp<ITuner>& tuner) {
-                        halResult = result;
-                        if (result == Result::OK) {
-                            mTuner = tuner;
-                        }
-                    });
+        auto openCb = [&](Result result, const sp<ITuner>& tuner) {
+            halResult = result;
+            if (result == Result::OK) {
+                mTuner = tuner;
+            }
+        };
+        auto hidlReturn = mRadio->openTuner(getBand(0), true, mTunerCallback, openCb);
         EXPECT_TRUE(hidlReturn.isOk());
         EXPECT_EQ(Result::OK, halResult);
-        EXPECT_EQ(true, waitForCallback(kConfigCallbacktimeoutNs));
+        if (radioClass == Class::AM_FM) {
+            EXPECT_EQ(true, waitForCallback(kConfigCallbacktimeoutNs));
+        }
     }
     EXPECT_NE(nullptr, mTuner.get());
     return nullptr != mTuner.get();
@@ -324,6 +333,8 @@
 
 bool BroadcastRadioHidlTest::checkAntenna()
 {
+    if (radioClass != Class::AM_FM) return true;
+
     BandConfig halConfig;
     Result halResult = Result::NOT_INITIALIZED;
     Return<void> hidlReturn =
@@ -337,6 +348,19 @@
     return ((halResult == Result::OK) && (halConfig.antennaConnected == true));
 }
 
+BandConfig& BroadcastRadioHidlTest::getBand(unsigned idx) {
+    static BandConfig dummyBandConfig = {};
+    if (radioClass == Class::AM_FM) {
+        EXPECT_GT(mHalProperties.bands.size(), idx);
+        if (mHalProperties.bands.size() > idx) {
+            return mHalProperties.bands[idx];
+        } else {
+            return dummyBandConfig;
+        }
+    } else {
+        return dummyBandConfig;
+    }
+}
 
 /**
  * Test IBroadcastRadio::getProperties() method
@@ -344,7 +368,7 @@
  * Verifies that:
  *  - the HAL implements the method
  *  - the method returns 0 (no error)
- *  - the implementation class is AM_FM
+ *  - the implementation class is radioClass
  *  - the implementation supports at least one tuner
  *  - the implementation supports at one band
  */
@@ -383,22 +407,20 @@
  * Test IBroadcastRadio::openTuner() method called twice.
  *
  * Verifies that:
- *  - the openTuner method fails when called for the second time without deleting previous
- *    ITuner instance
+ *  - the openTuner method fails with INVALID_STATE or succeeds when called for the second time
+ *    without deleting previous ITuner instance
  */
 TEST_P(BroadcastRadioHidlTest, OpenTunerTwice) {
     RETURN_IF_SKIPPED;
     EXPECT_TRUE(openTuner());
 
     Result halResult = Result::NOT_INITIALIZED;
-    Return<void> hidlReturn =
-            mRadio->openTuner(mHalProperties.bands[0], true, mTunerCallback,
-                              [&](Result result, const sp<ITuner>&) {
-                    halResult = result;
-                });
+    auto openCb = [&](Result result, const sp<ITuner>&) { halResult = result; };
+    auto hidlReturn = mRadio->openTuner(getBand(0), true, mTunerCallback, openCb);
     EXPECT_TRUE(hidlReturn.isOk());
-    EXPECT_EQ(Result::INVALID_STATE, halResult);
-    EXPECT_TRUE(waitForCallback(kConfigCallbacktimeoutNs));
+    if (halResult == Result::INVALID_STATE) {
+        EXPECT_TRUE(waitForCallback(kConfigCallbacktimeoutNs));
+    }
 }
 
 /**
@@ -411,16 +433,17 @@
  *  - the configuration read back from HAl has the same class Id
  */
 TEST_P(BroadcastRadioHidlTest, SetAndGetConfiguration) {
+    if (radioClass != Class::AM_FM) skipped = true;
     RETURN_IF_SKIPPED;
     ASSERT_EQ(true, openTuner());
     // test setConfiguration
     mCallbackCalled = false;
-    Return<Result> hidlResult = mTuner->setConfiguration(mHalProperties.bands[1]);
+    Return<Result> hidlResult = mTuner->setConfiguration(getBand(1));
     EXPECT_TRUE(hidlResult.isOk());
     EXPECT_EQ(Result::OK, hidlResult);
     EXPECT_EQ(true, waitForCallback(kConfigCallbacktimeoutNs));
     EXPECT_EQ(Result::OK, mResultCallbackData);
-    EXPECT_EQ(mHalProperties.bands[1], mBandConfigCallbackData);
+    EXPECT_EQ(getBand(1), mBandConfigCallbackData);
 
     // test getConfiguration
     BandConfig halConfig;
@@ -434,7 +457,7 @@
             });
     EXPECT_TRUE(hidlReturn.isOk());
     EXPECT_EQ(Result::OK, halResult);
-    EXPECT_EQ(mHalProperties.bands[1], halConfig);
+    EXPECT_EQ(getBand(1), halConfig);
 }
 
 /**
@@ -445,6 +468,7 @@
  *  - the method recovers and succeeds after passing correct arguments
  */
 TEST_P(BroadcastRadioHidlTest, SetConfigurationFails) {
+    if (radioClass != Class::AM_FM) skipped = true;
     RETURN_IF_SKIPPED;
     ASSERT_EQ(true, openTuner());
 
@@ -463,7 +487,7 @@
 
     // Test setConfiguration recovering after passing good data.
     mCallbackCalled = false;
-    setResult = mTuner->setConfiguration(mHalProperties.bands[0]);
+    setResult = mTuner->setConfiguration(getBand(0));
     EXPECT_TRUE(setResult.isOk());
     EXPECT_EQ(Result::OK, setResult);
     EXPECT_EQ(true, waitForCallback(kConfigCallbacktimeoutNs));
@@ -508,6 +532,7 @@
  *  - skipping sub-channel or not does not fail the call
  */
 TEST_P(BroadcastRadioHidlTest, Step) {
+    if (radioClass != Class::AM_FM) skipped = true;
     RETURN_IF_SKIPPED;
     ASSERT_EQ(true, openTuner());
     ASSERT_TRUE(checkAntenna());
@@ -535,18 +560,21 @@
  *  - the tuned callback is received within kTuneCallbacktimeoutNs ns after tune()
  */
 TEST_P(BroadcastRadioHidlTest, TuneAndGetProgramInformationAndCancel) {
+    if (radioClass != Class::AM_FM) skipped = true;
     RETURN_IF_SKIPPED;
     ASSERT_EQ(true, openTuner());
     ASSERT_TRUE(checkAntenna());
 
+    auto& band = getBand(0);
+
     // test tune
-    ASSERT_GT(mHalProperties.bands[0].spacings.size(), 0u);
-    ASSERT_GT(mHalProperties.bands[0].upperLimit, mHalProperties.bands[0].lowerLimit);
+    ASSERT_GT(band.spacings.size(), 0u);
+    ASSERT_GT(band.upperLimit, band.lowerLimit);
 
     // test scan UP
-    uint32_t lowerLimit = mHalProperties.bands[0].lowerLimit;
-    uint32_t upperLimit = mHalProperties.bands[0].upperLimit;
-    uint32_t spacing = mHalProperties.bands[0].spacings[0];
+    uint32_t lowerLimit = band.lowerLimit;
+    uint32_t upperLimit = band.upperLimit;
+    uint32_t spacing = band.spacings[0];
 
     uint32_t channel =
             lowerLimit + (((upperLimit - lowerLimit) / 2 + spacing - 1) / spacing) * spacing;
@@ -593,6 +621,7 @@
  *  - the method recovers and succeeds after passing correct arguments
  */
 TEST_P(BroadcastRadioHidlTest, TuneFailsOutOfBounds) {
+    if (radioClass != Class::AM_FM) skipped = true;
     RETURN_IF_SKIPPED;
     ASSERT_TRUE(openTuner());
     ASSERT_TRUE(checkAntenna());
diff --git a/broadcastradio/1.1/default/BroadcastRadio.cpp b/broadcastradio/1.1/default/BroadcastRadio.cpp
index 68c9b93..d65fe6d 100644
--- a/broadcastradio/1.1/default/BroadcastRadio.cpp
+++ b/broadcastradio/1.1/default/BroadcastRadio.cpp
@@ -115,9 +115,17 @@
     return Void();
 }
 
-Return<void> BroadcastRadio::getProperties_1_1(getProperties_1_1_cb _hidl_cb __unused)
-{
-    return Status::fromExceptionCode(Status::EX_UNSUPPORTED_OPERATION);
+Return<void> BroadcastRadio::getProperties_1_1(getProperties_1_1_cb _hidl_cb) {
+    radio_hal_properties_t halProperties;
+    V1_1::Properties properties = {};
+
+    LOG_ALWAYS_FATAL_IF(mHwDevice == nullptr, "HW device is not set");
+    int rc = mHwDevice->get_properties(mHwDevice, &halProperties);
+    LOG_ALWAYS_FATAL_IF(rc != 0, "Couldn't get device properties");
+    Utils::convertPropertiesFromHal(&properties.base, &halProperties);
+
+    _hidl_cb(properties);
+    return Void();
 }
 
 Return<void> BroadcastRadio::openTuner(const BandConfig& config, bool audio,
diff --git a/camera/common/1.0/default/CameraParameters.cpp b/camera/common/1.0/default/CameraParameters.cpp
index d224483..e707b08 100644
--- a/camera/common/1.0/default/CameraParameters.cpp
+++ b/camera/common/1.0/default/CameraParameters.cpp
@@ -20,6 +20,7 @@
 
 #include <string.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include "CameraParameters.h"
 #include <system/graphics.h>
 
diff --git a/cas/1.0/Android.bp b/cas/1.0/Android.bp
new file mode 100644
index 0000000..2251f11
--- /dev/null
+++ b/cas/1.0/Android.bp
@@ -0,0 +1,84 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.cas@1.0_hal",
+    srcs: [
+        "types.hal",
+        "ICas.hal",
+        "ICasListener.hal",
+        "IDescramblerBase.hal",
+        "IMediaCasService.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.cas@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++-sources -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.cas@1.0",
+    srcs: [
+        ":android.hardware.cas@1.0_hal",
+    ],
+    out: [
+        "android/hardware/cas/1.0/types.cpp",
+        "android/hardware/cas/1.0/CasAll.cpp",
+        "android/hardware/cas/1.0/CasListenerAll.cpp",
+        "android/hardware/cas/1.0/DescramblerBaseAll.cpp",
+        "android/hardware/cas/1.0/MediaCasServiceAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.cas@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++-headers -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.cas@1.0",
+    srcs: [
+        ":android.hardware.cas@1.0_hal",
+    ],
+    out: [
+        "android/hardware/cas/1.0/types.h",
+        "android/hardware/cas/1.0/hwtypes.h",
+        "android/hardware/cas/1.0/ICas.h",
+        "android/hardware/cas/1.0/IHwCas.h",
+        "android/hardware/cas/1.0/BnHwCas.h",
+        "android/hardware/cas/1.0/BpHwCas.h",
+        "android/hardware/cas/1.0/BsCas.h",
+        "android/hardware/cas/1.0/ICasListener.h",
+        "android/hardware/cas/1.0/IHwCasListener.h",
+        "android/hardware/cas/1.0/BnHwCasListener.h",
+        "android/hardware/cas/1.0/BpHwCasListener.h",
+        "android/hardware/cas/1.0/BsCasListener.h",
+        "android/hardware/cas/1.0/IDescramblerBase.h",
+        "android/hardware/cas/1.0/IHwDescramblerBase.h",
+        "android/hardware/cas/1.0/BnHwDescramblerBase.h",
+        "android/hardware/cas/1.0/BpHwDescramblerBase.h",
+        "android/hardware/cas/1.0/BsDescramblerBase.h",
+        "android/hardware/cas/1.0/IMediaCasService.h",
+        "android/hardware/cas/1.0/IHwMediaCasService.h",
+        "android/hardware/cas/1.0/BnHwMediaCasService.h",
+        "android/hardware/cas/1.0/BpHwMediaCasService.h",
+        "android/hardware/cas/1.0/BsMediaCasService.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.cas@1.0",
+    defaults: ["hidl-module-defaults"],
+    generated_sources: ["android.hardware.cas@1.0_genc++"],
+    generated_headers: ["android.hardware.cas@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.cas@1.0_genc++_headers"],
+    vendor_available: true,
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+    ],
+}
diff --git a/cas/1.0/CasHal.mk b/cas/1.0/CasHal.mk
new file mode 100644
index 0000000..3cae6bf
--- /dev/null
+++ b/cas/1.0/CasHal.mk
@@ -0,0 +1,192 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+########################################################################
+# Included by frameworks/base for MediaCas. Hidl HAL can't be linked as
+# Java lib from frameworks because it has dependency on frameworks itself.
+#
+
+intermediates := $(TARGET_OUT_COMMON_GEN)/JAVA_LIBRARIES/android.hardware.cas-V1.0-java_intermediates
+
+HIDL := $(HOST_OUT_EXECUTABLES)/hidl-gen$(HOST_EXECUTABLE_SUFFIX)
+HIDL_PATH := system/libhidl/transport/base/1.0
+
+#
+# Build types.hal (DebugInfo)
+#
+GEN := $(intermediates)/android/hidl/base/V1_0/DebugInfo.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hidl:system/libhidl/transport \
+        android.hidl.base@1.0::types.DebugInfo
+
+$(GEN): $(HIDL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IBase.hal
+#
+GEN := $(intermediates)/android/hidl/base/V1_0/IBase.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/IBase.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/types.hal
+$(GEN): $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hidl:system/libhidl/transport \
+        android.hidl.base@1.0::IBase
+
+$(GEN): $(HIDL_PATH)/IBase.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+HIDL_PATH := hardware/interfaces/cas/1.0
+
+#
+# Build types.hal (HidlCasPluginDescriptor)
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/HidlCasPluginDescriptor.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::types.HidlCasPluginDescriptor
+
+$(GEN): $(HIDL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build types.hal (Status)
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/Status.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::types.Status
+
+$(GEN): $(HIDL_PATH)/types.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build ICas.hal
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/ICas.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/ICas.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/types.hal
+$(GEN): $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::ICas
+
+$(GEN): $(HIDL_PATH)/ICas.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build ICasListener.hal
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/ICasListener.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/ICasListener.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::ICasListener
+
+$(GEN): $(HIDL_PATH)/ICasListener.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IDescramblerBase.hal
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/IDescramblerBase.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/IDescramblerBase.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/types.hal
+$(GEN): $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::IDescramblerBase
+
+$(GEN): $(HIDL_PATH)/IDescramblerBase.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
+#
+# Build IMediaCasService.hal
+#
+GEN := $(intermediates)/android/hardware/cas/V1_0/IMediaCasService.java
+$(GEN): $(HIDL)
+$(GEN): PRIVATE_HIDL := $(HIDL)
+$(GEN): PRIVATE_DEPS := $(HIDL_PATH)/IMediaCasService.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/ICas.hal
+$(GEN): $(HIDL_PATH)/ICas.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/ICasListener.hal
+$(GEN): $(HIDL_PATH)/ICasListener.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/IDescramblerBase.hal
+$(GEN): $(HIDL_PATH)/IDescramblerBase.hal
+$(GEN): PRIVATE_DEPS += $(HIDL_PATH)/types.hal
+$(GEN): $(HIDL_PATH)/types.hal
+$(GEN): PRIVATE_OUTPUT_DIR := $(intermediates)
+$(GEN): PRIVATE_CUSTOM_TOOL = \
+        $(PRIVATE_HIDL) -o $(PRIVATE_OUTPUT_DIR) \
+        -Ljava \
+        -randroid.hardware:hardware/interfaces \
+        -randroid.hidl:system/libhidl/transport \
+        android.hardware.cas@1.0::IMediaCasService
+
+$(GEN): $(HIDL_PATH)/IMediaCasService.hal
+	$(transform-generated-source)
+LOCAL_GENERATED_SOURCES += $(GEN)
+
diff --git a/cas/1.0/ICas.hal b/cas/1.0/ICas.hal
new file mode 100644
index 0000000..08a92da
--- /dev/null
+++ b/cas/1.0/ICas.hal
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.cas@1.0;
+
+import android.hardware.cas@1.0::types;
+
+/**
+  * ICas is the API to control the cas system and is accessible from both
+ * Java and native level. It is used to manage sessions, provision/refresh
+ * the cas system, and process the EMM/ECM messages. It also allows bi-directional,
+ * scheme-specific communications between the client and the cas system.
+ */
+
+interface ICas {
+    /**
+     * Provide the CA private data from a CA_descriptor in the conditional
+     * access table to a CasPlugin.
+     *
+     * @param pvtData a byte array containing the private data, the format of
+     * which is scheme-specific and opaque to the framework.
+     * @return status the status of the call.
+     */
+    setPrivateData(vec<uint8_t> pvtData) generates (Status status);
+
+    /**
+     * Open a session to descramble one or more streams scrambled by the
+     * conditional access system.
+     *
+     * @return status the status of the call.
+     * @return sessionId the id of the newly opened session.
+     */
+    openSession() generates(Status status, HidlCasSessionId sessionId);
+
+    /**
+     * Close a session.
+     *
+     * @param sessionId the id of the session to be closed.
+     * @return status the status of the call.
+     */
+    closeSession(HidlCasSessionId sessionId) generates (Status status);
+
+    /**
+     * Provide the CA private data from a CA_descriptor in the program map
+     * table to a session.
+     *
+     * @param sessionId the id of the session which the private data applies to.
+     * @param pvtData a byte array containing the private data, the format of
+     * which is scheme-specific and opaque to the framework.
+     * @return status the status of the call.
+     */
+    setSessionPrivateData(HidlCasSessionId sessionId, vec<uint8_t> pvtData)
+        generates (Status status);
+
+    /**
+     * Process an ECM from the ECM stream for this session’s elementary stream.
+     *
+     * @param sessionId the id of the session which the ecm data applies to.
+     * @param ecm a byte array containing the ecm data.
+     * @return status the status of the call.
+     */
+    processEcm(HidlCasSessionId sessionId, vec<uint8_t> ecm)
+        generates (Status status);
+
+    /**
+     * Process an in-band EMM from the EMM stream.
+     *
+     * @param emm a byte array containing the emm data.
+     * @return status the status of the call.
+     */
+    processEmm(vec<uint8_t> emm) generates (Status status);
+
+    /**
+     * Send an scheme-specific event to the CasPlugin.
+     *
+     * @param event an integer denoting a scheme-specific event to be sent.
+     * @param arg a scheme-specific integer argument for the event.
+     * @param data a byte array containing scheme-specific data for the event.
+     * @return status the status of the call.
+     */
+    sendEvent(int32_t event, int32_t arg, vec<uint8_t> eventData)
+        generates (Status status);
+
+    /**
+     * Initiate a provisioning operation for a CA system.
+     *
+     * @param provisionString string containing information needed for the
+     * provisioning operation, the format of which is scheme and implementation
+     * specific.
+     * @return status the status of the call.
+     */
+    provision(string provisionString) generates (Status status);
+
+    /**
+     * Notify the CA system to refresh entitlement keys.
+     *
+     * @param refreshType the type of the refreshment.
+     * @param refreshData private data associated with the refreshment.
+     * @return status the status of the call.
+     */
+    refreshEntitlements(int32_t refreshType, vec<uint8_t> refreshData)
+        generates (Status status);
+
+    /**
+     * Release the descrambler instance.
+     *
+     * @return status the status of the call.
+     */
+    release() generates (Status status);
+};
diff --git a/cas/1.0/ICasListener.hal b/cas/1.0/ICasListener.hal
new file mode 100644
index 0000000..8ae6014
--- /dev/null
+++ b/cas/1.0/ICasListener.hal
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.cas@1.0;
+
+interface ICasListener {
+    /**
+      * Notify the listener of a scheme-specific event from the CA system.
+      *
+      * @param event an integer whose meaning is scheme-specific.
+      * @param arg an integer whose meaning is scheme-specific.
+      * @param data a byte array of data whose format and meaning are
+      * scheme-specific.
+      */
+    onEvent(int32_t event, int32_t arg, vec<uint8_t> data);
+};
diff --git a/cas/1.0/IDescramblerBase.hal b/cas/1.0/IDescramblerBase.hal
new file mode 100644
index 0000000..a126084
--- /dev/null
+++ b/cas/1.0/IDescramblerBase.hal
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.cas@1.0;
+
+import android.hardware.cas@1.0::types;
+
+/**
+ * IDescramblerBase is the API to control the descrambler and is accessible
+ * from both Java and native level.
+ */
+
+interface IDescramblerBase {
+    /**
+     * Associate a MediaCas session with this MediaDescrambler instance.
+     *
+     * @param sessionId the id of the session to associate with this descrambler instance.
+     * @return status the status of the call.
+     */
+    setMediaCasSession(HidlCasSessionId sessionId) generates (Status status);
+
+    /**
+     * Query if the scrambling scheme requires the use of a secure decoder
+     * to decode data of the given mime type.
+     *
+     * @param mime the mime type of the media data.
+     * @return result whether the descrambler requires a secure decoder.
+     */
+    requiresSecureDecoderComponent(string mime) generates (bool result);
+
+    /**
+     * Release the descrambler instance.
+     *
+     * @return status the status of the call.
+     */
+    release() generates (Status status);
+};
diff --git a/cas/1.0/IMediaCasService.hal b/cas/1.0/IMediaCasService.hal
new file mode 100644
index 0000000..cfeafad
--- /dev/null
+++ b/cas/1.0/IMediaCasService.hal
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.cas@1.0;
+
+import android.hardware.cas@1.0::ICas;
+import android.hardware.cas@1.0::ICasListener;
+import android.hardware.cas@1.0::IDescramblerBase;
+
+/**
+ * IMediaCasService is the main entry point for interacting with a vendor's
+ * cas HAL to create cas and descrambler plugin instances. A cas plugin instance
+ * opens cas sessions which are used to obtain keys for a descrambler session,
+ * which can in turn be used to descramble protected video content.
+ */
+interface IMediaCasService {
+    /**
+     * List all available CA systems on the device.
+     *
+     * @return descriptors an array of descriptors for the available CA systems.
+     */
+    enumeratePlugins() generates (vec<HidlCasPluginDescriptor> descriptors);
+
+    /**
+     * Query if a certain CA system is supported on this device.
+     *
+     * @param CA_system_id the id of the CA system.
+     * @return result whether the specified CA system is supported on this device.
+     */
+    isSystemIdSupported(int32_t CA_system_id) generates (bool result);
+
+    /**
+     * Construct a new instance of a CasPlugin given a CA_system_id.
+     *
+     * @param CA_system_id the id of the CA system.
+     * @param listener the event listener to receive events coming from the CasPlugin.
+     * @return cas the newly created CasPlugin interface.
+     */
+    createPlugin(int32_t CA_system_id, ICasListener listener) generates (ICas cas);
+
+    /**
+     * Query if the descrambling scheme for a CA system is supported on this device.
+     *
+     * @param CA_system_id the id of the CA system.
+     * @return result whether the specified descrambling scheme is supported on this device.
+     */
+    isDescramblerSupported(int32_t CA_system_id) generates (bool result);
+
+    /**
+     * Construct a new instance of a DescramblerPlugin given a CA_system_id.
+     *
+     * @param CA_system_id the id of the CA system.
+     * @return descrambler the newly created plugin interface.
+     */
+    createDescrambler(int32_t CA_system_id) generates (IDescramblerBase descrambler);
+};
diff --git a/cas/1.0/default/Android.bp b/cas/1.0/default/Android.bp
new file mode 100644
index 0000000..953aa37
--- /dev/null
+++ b/cas/1.0/default/Android.bp
@@ -0,0 +1,35 @@
+cc_binary {
+    name: "android.hardware.cas@1.0-service",
+    defaults: ["hidl_defaults"],
+    vendor: true,
+    relative_install_path: "hw",
+    srcs: [
+      "CasImpl.cpp",
+      "DescramblerImpl.cpp",
+      "MediaCasService.cpp",
+      "service.cpp",
+      "SharedLibrary.cpp",
+      "TypeConvert.cpp",
+    ],
+
+    product_variables: {
+        treble: {
+            cflags: ["-DUSE_VNDBINDER"],
+        },
+    },
+
+    compile_multilib: "32",
+    init_rc: ["android.hardware.cas@1.0-service.rc"],
+
+    shared_libs: [
+      "android.hardware.cas@1.0",
+      "android.hardware.cas.native@1.0",
+      "android.hidl.memory@1.0",
+      "libbinder",
+      "libhidlbase",
+      "libhidlmemory",
+      "libhidltransport",
+      "liblog",
+      "libutils",
+    ],
+}
diff --git a/cas/1.0/default/CasImpl.cpp b/cas/1.0/default/CasImpl.cpp
new file mode 100644
index 0000000..9d1f4a3
--- /dev/null
+++ b/cas/1.0/default/CasImpl.cpp
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-CasImpl"
+
+#include <android/hardware/cas/1.0/ICasListener.h>
+#include <media/cas/CasAPI.h>
+#include <utils/Log.h>
+
+#include "CasImpl.h"
+#include "SharedLibrary.h"
+#include "TypeConvert.h"
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+struct CasImpl::PluginHolder : public RefBase {
+public:
+    explicit PluginHolder(CasPlugin *plugin) : mPlugin(plugin) {}
+    ~PluginHolder() { if (mPlugin != NULL) delete mPlugin; }
+    CasPlugin* get() { return mPlugin; }
+
+private:
+    CasPlugin *mPlugin;
+    DISALLOW_EVIL_CONSTRUCTORS(PluginHolder);
+};
+
+CasImpl::CasImpl(const sp<ICasListener> &listener)
+    : mPluginHolder(NULL), mListener(listener) {
+    ALOGV("CTOR");
+}
+
+CasImpl::~CasImpl() {
+    ALOGV("DTOR");
+    release();
+}
+
+//static
+void CasImpl::OnEvent(
+        void *appData,
+        int32_t event,
+        int32_t arg,
+        uint8_t *data,
+        size_t size) {
+    if (appData == NULL) {
+        ALOGE("Invalid appData!");
+        return;
+    }
+    CasImpl *casImpl = static_cast<CasImpl *>(appData);
+    casImpl->onEvent(event, arg, data, size);
+}
+
+void CasImpl::init(const sp<SharedLibrary>& library, CasPlugin *plugin) {
+    mLibrary = library;
+    mPluginHolder = new PluginHolder(plugin);
+}
+
+void CasImpl::onEvent(
+        int32_t event, int32_t arg, uint8_t *data, size_t size) {
+    if (mListener == NULL) {
+        return;
+    }
+
+    HidlCasData eventData;
+    if (data != NULL) {
+        eventData.setToExternal(data, size);
+    }
+
+    mListener->onEvent(event, arg, eventData);
+}
+
+Return<Status> CasImpl::setPrivateData(const HidlCasData& pvtData) {
+    ALOGV("%s", __FUNCTION__);
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+    return toStatus(holder->get()->setPrivateData(pvtData));
+}
+
+Return<void> CasImpl::openSession(openSession_cb _hidl_cb) {
+    ALOGV("%s", __FUNCTION__);
+    CasSessionId sessionId;
+
+    sp<PluginHolder> holder = mPluginHolder;
+    status_t err = INVALID_OPERATION;
+    if (holder != NULL) {
+        err = holder->get()->openSession(&sessionId);
+    }
+
+    _hidl_cb(toStatus(err), sessionId);
+
+    return Void();
+}
+
+Return<Status> CasImpl::setSessionPrivateData(
+        const HidlCasSessionId &sessionId, const HidlCasData& pvtData) {
+    ALOGV("%s: sessionId=%s", __FUNCTION__,
+            sessionIdToString(sessionId).string());
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+    return toStatus(
+            holder->get()->setSessionPrivateData(
+                    sessionId, pvtData));
+}
+
+Return<Status> CasImpl::closeSession(const HidlCasSessionId &sessionId) {
+    ALOGV("%s: sessionId=%s", __FUNCTION__,
+            sessionIdToString(sessionId).string());
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+    return toStatus(holder->get()->closeSession(sessionId));
+}
+
+Return<Status> CasImpl::processEcm(
+        const HidlCasSessionId &sessionId, const HidlCasData& ecm) {
+    ALOGV("%s: sessionId=%s", __FUNCTION__,
+            sessionIdToString(sessionId).string());
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->get()->processEcm(sessionId, ecm));
+}
+
+Return<Status> CasImpl::processEmm(const HidlCasData& emm) {
+    ALOGV("%s", __FUNCTION__);
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->get()->processEmm(emm));
+}
+
+Return<Status> CasImpl::sendEvent(
+        int32_t event, int32_t arg,
+        const HidlCasData& eventData) {
+    ALOGV("%s", __FUNCTION__);
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    status_t err = holder->get()->sendEvent(event, arg, eventData);
+    return toStatus(err);
+}
+
+Return<Status> CasImpl::provision(const hidl_string& provisionString) {
+    ALOGV("%s: provisionString=%s", __FUNCTION__, provisionString.c_str());
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    return toStatus(holder->get()->provision(String8(provisionString.c_str())));
+}
+
+Return<Status> CasImpl::refreshEntitlements(
+        int32_t refreshType,
+        const HidlCasData& refreshData) {
+    ALOGV("%s", __FUNCTION__);
+    sp<PluginHolder> holder = mPluginHolder;
+    if (holder == NULL) {
+        return toStatus(INVALID_OPERATION);
+    }
+
+    status_t err = holder->get()->refreshEntitlements(refreshType, refreshData);
+    return toStatus(err);
+}
+
+Return<Status> CasImpl::release() {
+    ALOGV("%s: plugin=%p", __FUNCTION__,
+            mPluginHolder != NULL ? mPluginHolder->get() : NULL);
+    mPluginHolder.clear();
+    return Status::OK;
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
diff --git a/cas/1.0/default/CasImpl.h b/cas/1.0/default/CasImpl.h
new file mode 100644
index 0000000..841d64e
--- /dev/null
+++ b/cas/1.0/default/CasImpl.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_CAS_IMPL_H_
+#define ANDROID_HARDWARE_CAS_V1_0_CAS_IMPL_H_
+
+#include <media/stagefright/foundation/ABase.h>
+#include <android/hardware/cas/1.0/ICas.h>
+
+namespace android {
+struct CasPlugin;
+
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+struct ICasListener;
+namespace implementation {
+
+class SharedLibrary;
+
+class CasImpl : public ICas {
+public:
+    CasImpl(const sp<ICasListener> &listener);
+    virtual ~CasImpl();
+
+    static void OnEvent(
+            void *appData,
+            int32_t event,
+            int32_t arg,
+            uint8_t *data,
+            size_t size);
+
+    void init(const sp<SharedLibrary>& library, CasPlugin *plugin);
+    void onEvent(
+            int32_t event,
+            int32_t arg,
+            uint8_t *data,
+            size_t size);
+
+    // ICas inherits
+
+    virtual Return<Status> setPrivateData(
+            const HidlCasData& pvtData) override;
+
+    virtual Return<void> openSession(
+            openSession_cb _hidl_cb) override;
+
+    virtual Return<Status> closeSession(
+            const HidlCasSessionId& sessionId) override;
+
+    virtual Return<Status> setSessionPrivateData(
+            const HidlCasSessionId& sessionId,
+            const HidlCasData& pvtData) override;
+
+    virtual Return<Status> processEcm(
+            const HidlCasSessionId& sessionId,
+            const HidlCasData& ecm) override;
+
+    virtual Return<Status> processEmm(
+            const HidlCasData& emm) override;
+
+    virtual Return<Status> sendEvent(
+            int32_t event, int32_t arg,
+            const HidlCasData& eventData) override;
+
+    virtual Return<Status> provision(
+            const hidl_string& provisionString) override;
+
+    virtual Return<Status> refreshEntitlements(
+            int32_t refreshType,
+            const HidlCasData& refreshData) override;
+
+    virtual Return<Status> release() override;
+
+private:
+    struct PluginHolder;
+    sp<SharedLibrary> mLibrary;
+    sp<PluginHolder> mPluginHolder;
+    sp<ICasListener> mListener;
+
+    DISALLOW_EVIL_CONSTRUCTORS(CasImpl);
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_CAS_IMPL_H_
diff --git a/cas/1.0/default/DescramblerImpl.cpp b/cas/1.0/default/DescramblerImpl.cpp
new file mode 100644
index 0000000..3d90809
--- /dev/null
+++ b/cas/1.0/default/DescramblerImpl.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-DescramblerImpl"
+
+#include <hidlmemory/mapping.h>
+#include <media/hardware/CryptoAPI.h>
+#include <media/cas/DescramblerAPI.h>
+#include <utils/Log.h>
+
+#include "DescramblerImpl.h"
+#include "SharedLibrary.h"
+#include "TypeConvert.h"
+
+namespace android {
+using hidl::memory::V1_0::IMemory;
+
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+#define CHECK_SUBSAMPLE_DEF(type) \
+static_assert(sizeof(SubSample) == sizeof(type::SubSample), \
+        "SubSample: size doesn't match"); \
+static_assert(offsetof(SubSample, numBytesOfClearData) \
+        == offsetof(type::SubSample, mNumBytesOfClearData), \
+        "SubSample: numBytesOfClearData offset doesn't match"); \
+static_assert(offsetof(SubSample, numBytesOfEncryptedData) \
+        == offsetof(type::SubSample, mNumBytesOfEncryptedData), \
+        "SubSample: numBytesOfEncryptedData offset doesn't match")
+
+CHECK_SUBSAMPLE_DEF(DescramblerPlugin);
+CHECK_SUBSAMPLE_DEF(CryptoPlugin);
+
+DescramblerImpl::DescramblerImpl(
+        const sp<SharedLibrary>& library, DescramblerPlugin *plugin) :
+        mLibrary(library), mPlugin(plugin) {
+    ALOGV("CTOR: mPlugin=%p", mPlugin);
+}
+
+DescramblerImpl::~DescramblerImpl() {
+    ALOGV("DTOR: mPlugin=%p", mPlugin);
+    release();
+}
+
+Return<Status> DescramblerImpl::setMediaCasSession(const HidlCasSessionId& sessionId) {
+    ALOGV("%s: sessionId=%s", __FUNCTION__,
+            sessionIdToString(sessionId).string());
+
+    return toStatus(mPlugin->setMediaCasSession(sessionId));
+}
+
+Return<bool> DescramblerImpl::requiresSecureDecoderComponent(
+        const hidl_string& mime) {
+    return mPlugin->requiresSecureDecoderComponent(String8(mime.c_str()));
+}
+
+Return<void> DescramblerImpl::descramble(
+        ScramblingControl scramblingControl,
+        const hidl_vec<SubSample>& subSamples,
+        const SharedBuffer& srcBuffer,
+        uint64_t srcOffset,
+        const DestinationBuffer& dstBuffer,
+        uint64_t dstOffset,
+        descramble_cb _hidl_cb) {
+    ALOGV("%s", __FUNCTION__);
+
+    sp<IMemory> srcMem = mapMemory(srcBuffer.heapBase);
+    void *srcPtr = (uint8_t *)(void *)srcMem->getPointer() + srcBuffer.offset;
+    void *dstPtr = NULL;
+    if (dstBuffer.type == BufferType::SHARED_MEMORY) {
+        // When using shared memory, src buffer is also used as dst,
+        // we don't map it again here.
+        dstPtr = srcPtr;
+    } else {
+        native_handle_t *handle = const_cast<native_handle_t *>(
+                dstBuffer.secureMemory.getNativeHandle());
+        dstPtr = static_cast<void *>(handle);
+    }
+    // Casting hidl SubSample to DescramblerPlugin::SubSample, but need
+    // to ensure structs are actually idential
+
+    int32_t result = mPlugin->descramble(
+            dstBuffer.type != BufferType::SHARED_MEMORY,
+            (DescramblerPlugin::ScramblingControl)scramblingControl,
+            subSamples.size(),
+            (DescramblerPlugin::SubSample*)subSamples.data(),
+            srcPtr,
+            srcOffset,
+            dstPtr,
+            dstOffset,
+            NULL);
+
+    _hidl_cb(toStatus(result >= 0 ? OK : result), result, NULL);
+    return Void();
+}
+
+Return<Status> DescramblerImpl::release() {
+    ALOGV("%s: mPlugin=%p", __FUNCTION__, mPlugin);
+
+    if (mPlugin != NULL) {
+        delete mPlugin;
+        mPlugin = NULL;
+    }
+    return Status::OK;
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
diff --git a/cas/1.0/default/DescramblerImpl.h b/cas/1.0/default/DescramblerImpl.h
new file mode 100644
index 0000000..d3b146e
--- /dev/null
+++ b/cas/1.0/default/DescramblerImpl.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_DESCRAMBLER_IMPL_H_
+#define ANDROID_HARDWARE_CAS_V1_0_DESCRAMBLER_IMPL_H_
+
+#include <media/stagefright/foundation/ABase.h>
+#include <android/hardware/cas/native/1.0/IDescrambler.h>
+
+namespace android {
+struct DescramblerPlugin;
+using namespace hardware::cas::native::V1_0;
+
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+class SharedLibrary;
+
+class DescramblerImpl : public IDescrambler {
+public:
+    DescramblerImpl(const sp<SharedLibrary>& library, DescramblerPlugin *plugin);
+    virtual ~DescramblerImpl();
+
+    virtual Return<Status> setMediaCasSession(
+            const HidlCasSessionId& sessionId) override;
+
+    virtual Return<bool> requiresSecureDecoderComponent(
+            const hidl_string& mime) override;
+
+    virtual Return<void> descramble(
+            ScramblingControl scramblingControl,
+            const hidl_vec<SubSample>& subSamples,
+            const SharedBuffer& srcBuffer,
+            uint64_t srcOffset,
+            const DestinationBuffer& dstBuffer,
+            uint64_t dstOffset,
+            descramble_cb _hidl_cb) override;
+
+    virtual Return<Status> release() override;
+
+private:
+    sp<SharedLibrary> mLibrary;
+    DescramblerPlugin *mPlugin;
+
+    DISALLOW_EVIL_CONSTRUCTORS(DescramblerImpl);
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_DESCRAMBLER_IMPL_H_
diff --git a/cas/1.0/default/FactoryLoader.h b/cas/1.0/default/FactoryLoader.h
new file mode 100644
index 0000000..18c2186
--- /dev/null
+++ b/cas/1.0/default/FactoryLoader.h
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_FACTORY_LOADER_H_
+#define ANDROID_HARDWARE_CAS_V1_0_FACTORY_LOADER_H_
+
+#include <dirent.h>
+#include <dlfcn.h>
+#include "SharedLibrary.h"
+#include <utils/KeyedVector.h>
+#include <utils/Mutex.h>
+#include <media/cas/CasAPI.h>
+
+using namespace std;
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+template <class T>
+class FactoryLoader {
+public:
+    FactoryLoader(const char *name) :
+        mFactory(NULL), mCreateFactoryFuncName(name) {}
+
+    virtual ~FactoryLoader() { closeFactory(); }
+
+    bool findFactoryForScheme(
+            int32_t CA_system_id,
+            sp<SharedLibrary> *library = NULL,
+            T** factory = NULL);
+
+    bool enumeratePlugins(vector<HidlCasPluginDescriptor>* results);
+
+private:
+    typedef T*(*CreateFactoryFunc)();
+
+    Mutex mMapLock;
+    T* mFactory;
+    const char *mCreateFactoryFuncName;
+    sp<SharedLibrary> mLibrary;
+    KeyedVector<int32_t, String8> mCASystemIdToLibraryPathMap;
+    KeyedVector<String8, wp<SharedLibrary> > mLibraryPathToOpenLibraryMap;
+
+    bool loadFactoryForSchemeFromPath(
+            const String8 &path,
+            int32_t CA_system_id,
+            sp<SharedLibrary> *library,
+            T** factory);
+
+    bool queryPluginsFromPath(
+            const String8 &path,
+            vector<HidlCasPluginDescriptor>* results);
+
+    bool openFactory(const String8 &path);
+    void closeFactory();
+};
+
+template <class T>
+bool FactoryLoader<T>::findFactoryForScheme(
+        int32_t CA_system_id, sp<SharedLibrary> *library, T** factory) {
+    if (library != NULL) {
+        library->clear();
+    }
+    if (factory != NULL) {
+        *factory = NULL;
+    }
+
+    Mutex::Autolock autoLock(mMapLock);
+
+    // first check cache
+    ssize_t index = mCASystemIdToLibraryPathMap.indexOfKey(CA_system_id);
+    if (index >= 0) {
+        return loadFactoryForSchemeFromPath(
+                mCASystemIdToLibraryPathMap[index],
+                CA_system_id, library, factory);
+    }
+
+    // no luck, have to search
+    String8 dirPath("/vendor/lib/mediacas");
+    DIR* pDir = opendir(dirPath.string());
+
+    if (pDir == NULL) {
+        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        return false;
+    }
+
+    struct dirent* pEntry;
+    while ((pEntry = readdir(pDir))) {
+        String8 pluginPath = dirPath + "/" + pEntry->d_name;
+        if (pluginPath.getPathExtension() == ".so") {
+            if (loadFactoryForSchemeFromPath(
+                    pluginPath, CA_system_id, library, factory)) {
+                mCASystemIdToLibraryPathMap.add(CA_system_id, pluginPath);
+                closedir(pDir);
+
+                return true;
+            }
+        }
+    }
+
+    closedir(pDir);
+
+    ALOGE("Failed to find plugin");
+    return false;
+}
+
+template <class T>
+bool FactoryLoader<T>::enumeratePlugins(
+        vector<HidlCasPluginDescriptor>* results) {
+    ALOGI("enumeratePlugins");
+
+    results->clear();
+
+    String8 dirPath("/vendor/lib/mediacas");
+    DIR* pDir = opendir(dirPath.string());
+
+    if (pDir == NULL) {
+        ALOGE("Failed to open plugin directory %s", dirPath.string());
+        return false;
+    }
+
+    Mutex::Autolock autoLock(mMapLock);
+
+    struct dirent* pEntry;
+    while ((pEntry = readdir(pDir))) {
+        String8 pluginPath = dirPath + "/" + pEntry->d_name;
+        if (pluginPath.getPathExtension() == ".so") {
+            queryPluginsFromPath(pluginPath, results);
+        }
+    }
+    return true;
+}
+
+template <class T>
+bool FactoryLoader<T>::loadFactoryForSchemeFromPath(
+        const String8 &path, int32_t CA_system_id,
+        sp<SharedLibrary> *library, T** factory) {
+    closeFactory();
+
+    if (!openFactory(path) || !mFactory->isSystemIdSupported(CA_system_id)) {
+        closeFactory();
+        return false;
+    }
+
+    if (library != NULL) {
+        *library = mLibrary;
+    }
+    if (factory != NULL) {
+        *factory = mFactory;
+    }
+    return true;
+}
+
+template <class T>
+bool FactoryLoader<T>::queryPluginsFromPath(
+        const String8 &path, vector<HidlCasPluginDescriptor>* results) {
+    closeFactory();
+
+    vector<CasPluginDescriptor> descriptors;
+    if (!openFactory(path) || mFactory->queryPlugins(&descriptors) != OK) {
+        closeFactory();
+        return false;
+    }
+
+    for (auto it = descriptors.begin(); it != descriptors.end(); it++) {
+        results->push_back( HidlCasPluginDescriptor {
+                .caSystemId = it->CA_system_id,
+                .name = it->name.c_str()});
+    }
+    return true;
+}
+
+template <class T>
+bool FactoryLoader<T>::openFactory(const String8 &path) {
+    // get strong pointer to open shared library
+    ssize_t index = mLibraryPathToOpenLibraryMap.indexOfKey(path);
+    if (index >= 0) {
+        mLibrary = mLibraryPathToOpenLibraryMap[index].promote();
+    } else {
+        index = mLibraryPathToOpenLibraryMap.add(path, NULL);
+    }
+
+    if (!mLibrary.get()) {
+        mLibrary = new SharedLibrary(path);
+        if (!*mLibrary) {
+            return false;
+        }
+
+        mLibraryPathToOpenLibraryMap.replaceValueAt(index, mLibrary);
+    }
+
+    CreateFactoryFunc createFactory =
+        (CreateFactoryFunc)mLibrary->lookup(mCreateFactoryFuncName);
+    if (createFactory == NULL || (mFactory = createFactory()) == NULL) {
+        return false;
+    }
+    return true;
+}
+
+template <class T>
+void FactoryLoader<T>::closeFactory() {
+    delete mFactory;
+    mFactory = NULL;
+    mLibrary.clear();
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_FACTORY_LOADER_H_
diff --git a/cas/1.0/default/MediaCasService.cpp b/cas/1.0/default/MediaCasService.cpp
new file mode 100644
index 0000000..ca43224
--- /dev/null
+++ b/cas/1.0/default/MediaCasService.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-MediaCasService"
+
+#include <android/hardware/cas/1.0/ICasListener.h>
+#include <media/cas/CasAPI.h>
+#include <media/cas/DescramblerAPI.h>
+#include <utils/Log.h>
+
+#include "CasImpl.h"
+#include "DescramblerImpl.h"
+#include "MediaCasService.h"
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+MediaCasService::MediaCasService() :
+    mCasLoader("createCasFactory"),
+    mDescramblerLoader("createDescramblerFactory") {
+}
+
+MediaCasService::~MediaCasService() {
+}
+
+Return<void> MediaCasService::enumeratePlugins(enumeratePlugins_cb _hidl_cb) {
+
+    ALOGV("%s", __FUNCTION__);
+
+    vector<HidlCasPluginDescriptor> results;
+    mCasLoader.enumeratePlugins(&results);
+
+    _hidl_cb(results);
+    return Void();
+}
+
+Return<bool> MediaCasService::isSystemIdSupported(int32_t CA_system_id) {
+    ALOGV("isSystemIdSupported: CA_system_id=%d", CA_system_id);
+
+    return mCasLoader.findFactoryForScheme(CA_system_id);
+}
+
+Return<sp<ICas>> MediaCasService::createPlugin(
+        int32_t CA_system_id, const sp<ICasListener>& listener) {
+
+    ALOGV("%s: CA_system_id=%d", __FUNCTION__, CA_system_id);
+
+    sp<ICas> result;
+
+    CasFactory *factory;
+    sp<SharedLibrary> library;
+    if (mCasLoader.findFactoryForScheme(CA_system_id, &library, &factory)) {
+        CasPlugin *plugin = NULL;
+        sp<CasImpl> casImpl = new CasImpl(listener);
+        if (factory->createPlugin(CA_system_id, (uint64_t)casImpl.get(),
+                &CasImpl::OnEvent, &plugin) == OK && plugin != NULL) {
+            casImpl->init(library, plugin);
+            result = casImpl;
+        }
+    }
+
+    return result;
+}
+
+Return<bool> MediaCasService::isDescramblerSupported(int32_t CA_system_id) {
+    ALOGV("%s: CA_system_id=%d", __FUNCTION__, CA_system_id);
+
+    return mDescramblerLoader.findFactoryForScheme(CA_system_id);
+}
+
+Return<sp<IDescramblerBase>> MediaCasService::createDescrambler(int32_t CA_system_id) {
+
+    ALOGV("%s: CA_system_id=%d", __FUNCTION__, CA_system_id);
+
+    sp<IDescrambler> result;
+
+    DescramblerFactory *factory;
+    sp<SharedLibrary> library;
+    if (mDescramblerLoader.findFactoryForScheme(
+            CA_system_id, &library, &factory)) {
+        DescramblerPlugin *plugin = NULL;
+        if (factory->createPlugin(CA_system_id, &plugin) == OK
+                && plugin != NULL) {
+            result = new DescramblerImpl(library, plugin);
+        }
+    }
+
+    return result;
+}
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
diff --git a/cas/1.0/default/MediaCasService.h b/cas/1.0/default/MediaCasService.h
new file mode 100644
index 0000000..77ddac6
--- /dev/null
+++ b/cas/1.0/default/MediaCasService.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_MEDIA_CAS_SERVICE_H_
+#define ANDROID_HARDWARE_CAS_V1_0_MEDIA_CAS_SERVICE_H_
+
+#include <android/hardware/cas/1.0/IMediaCasService.h>
+
+#include "FactoryLoader.h"
+
+namespace android {
+struct CasFactory;
+struct DescramblerFactory;
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+class MediaCasService : public IMediaCasService {
+public:
+    MediaCasService();
+
+    virtual Return<void> enumeratePlugins(
+            enumeratePlugins_cb _hidl_cb) override;
+
+    virtual Return<bool> isSystemIdSupported(
+            int32_t CA_system_id) override;
+
+    virtual Return<sp<ICas>> createPlugin(
+            int32_t CA_system_id, const sp<ICasListener>& listener) override;
+
+    virtual Return<bool> isDescramblerSupported(
+            int32_t CA_system_id) override;
+
+    virtual Return<sp<IDescramblerBase>> createDescrambler(
+            int32_t CA_system_id) override;
+
+private:
+    FactoryLoader<CasFactory> mCasLoader;
+    FactoryLoader<DescramblerFactory> mDescramblerLoader;
+
+    virtual ~MediaCasService();
+};
+
+} // namespace implementation
+} // namespace V1_0
+} // namespace cas
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_MEDIA_CAS_SERVICE_H_
diff --git a/cas/1.0/default/SharedLibrary.cpp b/cas/1.0/default/SharedLibrary.cpp
new file mode 100644
index 0000000..9c7f385
--- /dev/null
+++ b/cas/1.0/default/SharedLibrary.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-SharedLibrary"
+
+#include <dlfcn.h>
+#include <media/stagefright/foundation/ADebug.h>
+#include "SharedLibrary.h"
+#include <utils/Log.h>
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+SharedLibrary::SharedLibrary(const String8 &path) {
+    mLibHandle = dlopen(path.string(), RTLD_NOW);
+}
+
+SharedLibrary::~SharedLibrary() {
+    if (mLibHandle != NULL) {
+        dlclose(mLibHandle);
+        mLibHandle = NULL;
+    }
+}
+
+bool SharedLibrary::operator!() const {
+    return mLibHandle == NULL;
+}
+
+void *SharedLibrary::lookup(const char *symbol) const {
+    if (!mLibHandle) {
+        return NULL;
+    }
+    // Clear last error before we load the symbol again,
+    // in case the caller didn't retrieve it.
+    (void)dlerror();
+    return dlsym(mLibHandle, symbol);
+}
+
+const char *SharedLibrary::lastError() const {
+    const char *error = dlerror();
+    return error ? error : "No errors or unknown error";
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace cas
+}  // namespace hardware
+}  // namespace android
diff --git a/cas/1.0/default/SharedLibrary.h b/cas/1.0/default/SharedLibrary.h
new file mode 100644
index 0000000..18130a5
--- /dev/null
+++ b/cas/1.0/default/SharedLibrary.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_SHARED_LIBRARY_H_
+#define ANDROID_HARDWARE_CAS_V1_0_SHARED_LIBRARY_H_
+
+#include <utils/RefBase.h>
+#include <utils/String8.h>
+#include <media/stagefright/foundation/ABase.h>
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+class SharedLibrary : public RefBase {
+public:
+    explicit SharedLibrary(const String8 &path);
+    ~SharedLibrary();
+
+    bool operator!() const;
+    void *lookup(const char *symbol) const;
+    const char *lastError() const;
+
+private:
+    void *mLibHandle;
+    DISALLOW_EVIL_CONSTRUCTORS(SharedLibrary);
+};
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace cas
+}  // namespace hardware
+}  // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_SHARED_LIBRARY_H_
diff --git a/cas/1.0/default/TypeConvert.cpp b/cas/1.0/default/TypeConvert.cpp
new file mode 100644
index 0000000..de1f92b
--- /dev/null
+++ b/cas/1.0/default/TypeConvert.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-TypeConvert"
+
+#include <utils/Log.h>
+#include "TypeConvert.h"
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+Status toStatus(status_t legacyStatus) {
+    Status status;
+    switch(legacyStatus) {
+    case android::OK:
+        status = Status::OK;
+        break;
+    case android::ERROR_CAS_NO_LICENSE:
+        status = Status::ERROR_CAS_NO_LICENSE;
+        break;
+    case android::ERROR_CAS_LICENSE_EXPIRED:
+        status = Status::ERROR_CAS_LICENSE_EXPIRED;
+        break;
+    case android::ERROR_CAS_SESSION_NOT_OPENED:
+        status = Status::ERROR_CAS_SESSION_NOT_OPENED;
+        break;
+    case android::ERROR_CAS_CANNOT_HANDLE:
+        status = Status::ERROR_CAS_CANNOT_HANDLE;
+        break;
+    case android::ERROR_CAS_TAMPER_DETECTED:
+        status = Status::ERROR_CAS_INVALID_STATE;
+        break;
+    case android::BAD_VALUE:
+        status = Status::BAD_VALUE;
+        break;
+    case android::ERROR_CAS_NOT_PROVISIONED:
+        status = Status::ERROR_CAS_NOT_PROVISIONED;
+        break;
+    case android::ERROR_CAS_RESOURCE_BUSY:
+        status = Status::ERROR_CAS_RESOURCE_BUSY;
+        break;
+    case android::ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION:
+        status = Status::ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION;
+        break;
+    case android::ERROR_CAS_DEVICE_REVOKED:
+        status = Status::ERROR_CAS_DEVICE_REVOKED;
+        break;
+    case android::ERROR_CAS_DECRYPT:
+        status = Status::ERROR_CAS_DECRYPT;
+        break;
+    default:
+        ALOGW("Unable to convert legacy status: %d, defaulting to UNKNOWN",
+            legacyStatus);
+        status = Status::ERROR_CAS_UNKNOWN;
+        break;
+    }
+    return status;
+}
+
+String8 sessionIdToString(const CasSessionId &sessionId) {
+    String8 result;
+    for (size_t i = 0; i < sessionId.size(); i++) {
+        result.appendFormat("%02x ", sessionId[i]);
+    }
+    if (result.isEmpty()) {
+        result.append("(null)");
+    }
+    return result;
+}
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace cas
+}  // namespace hardware
+}  // namespace android
diff --git a/cas/1.0/default/TypeConvert.h b/cas/1.0/default/TypeConvert.h
new file mode 100644
index 0000000..7c3dded
--- /dev/null
+++ b/cas/1.0/default/TypeConvert.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_CAS_V1_0_TYPE_CONVERT_H
+#define ANDROID_HARDWARE_CAS_V1_0_TYPE_CONVERT_H
+
+#include <android/hardware/cas/1.0/types.h>
+#include <media/cas/CasAPI.h>
+#include <media/stagefright/MediaErrors.h>
+#include <utils/String8.h>
+
+namespace android {
+namespace hardware {
+namespace cas {
+namespace V1_0 {
+namespace implementation {
+
+Status toStatus(status_t legacyStatus);
+
+String8 sessionIdToString(const CasSessionId &sessionId);
+
+}  // namespace implementation
+}  // namespace V1_0
+}  // namespace cas
+}  // namespace hardware
+}  // namespace android
+
+#endif // ANDROID_HARDWARE_CAS_V1_0_TYPE_CONVERT_H
diff --git a/cas/1.0/default/android.hardware.cas@1.0-service.rc b/cas/1.0/default/android.hardware.cas@1.0-service.rc
new file mode 100644
index 0000000..93de794
--- /dev/null
+++ b/cas/1.0/default/android.hardware.cas@1.0-service.rc
@@ -0,0 +1,6 @@
+service cas-hal-1-0 /vendor/bin/hw/android.hardware.cas@1.0-service
+    class hal
+    user media
+    group mediadrm drmrpc
+    ioprio rt 4
+    writepid /dev/cpuset/foreground/tasks
diff --git a/cas/1.0/default/service.cpp b/cas/1.0/default/service.cpp
new file mode 100644
index 0000000..3f1df5a
--- /dev/null
+++ b/cas/1.0/default/service.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "android.hardware.cas@1.0-service"
+
+#include <binder/ProcessState.h>
+#include <hidl/HidlTransportSupport.h>
+#include <hidl/LegacySupport.h>
+
+#include "MediaCasService.h"
+
+using android::hardware::configureRpcThreadpool;
+using android::hardware::joinRpcThreadpool;
+using android::hardware::cas::V1_0::implementation::MediaCasService;
+using android::hardware::cas::V1_0::IMediaCasService;
+
+int main() {
+    ALOGD("android.hardware.cas@1.0-service starting...");
+
+#ifdef USE_VNDBINDER
+    // The CAS HAL may communicate to other vendor components via
+    // /dev/vndbinder
+    android::ProcessState::initWithDriver("/dev/vndbinder");
+#endif // USE_VNDBINDER
+
+    configureRpcThreadpool(8, true /* callerWillJoin */);
+
+    // Setup hwbinder service
+    android::sp<IMediaCasService> service = new MediaCasService();
+    android::status_t status = service->registerAsService();
+    LOG_ALWAYS_FATAL_IF(
+            status != android::OK,
+            "Error while registering cas service: %d", status);
+    joinRpcThreadpool();
+    return 0;
+}
diff --git a/cas/1.0/types.hal b/cas/1.0/types.hal
new file mode 100644
index 0000000..7337f00
--- /dev/null
+++ b/cas/1.0/types.hal
@@ -0,0 +1,124 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.cas@1.0;
+
+enum Status : uint32_t {
+    /**
+     * The CAS plugin must return OK when an operation completes without any
+     * errors.
+     */
+    OK,
+
+    /**
+     * The CAS plugin must return ERROR_CAS_NO_LICENSE, when descrambling is
+     * attempted and no license keys have been provided.
+     */
+    ERROR_CAS_NO_LICENSE,
+
+    /**
+     * ERROR_CAS_LICENSE_EXPIRED must be returned when an attempt is made
+     * to use a license and the keys in that license have expired.
+     */
+    ERROR_CAS_LICENSE_EXPIRED,
+
+    /**
+     * The CAS plugin must return ERROR_CAS_SESSION_NOT_OPENED when an
+     * attempt is made to use a session that has not been opened.
+     */
+    ERROR_CAS_SESSION_NOT_OPENED,
+
+    /**
+     * The CAS plugin must return ERROR_CAS_CANNOT_HANDLE when an unsupported
+     * data format or operation is attempted.
+     */
+    ERROR_CAS_CANNOT_HANDLE,
+
+    /**
+     * ERROR_CAS_INVALID_STATE must be returned when the device is in a state
+     * where it is not able to perform descrambling.
+     */
+    ERROR_CAS_INVALID_STATE,
+
+    /**
+     * The CAS plugin must return BAD_VALUE whenever an illegal parameter is
+     * passed to one of the interface functions.
+     */
+    BAD_VALUE,
+
+    /**
+     * The CAS plugin must return ERROR_CAS_NOT_PROVISIONED when the device
+     * has not yet been provisioned.
+     */
+    ERROR_CAS_NOT_PROVISIONED,
+
+    /**
+     * ERROR_CAS_RESOURCE_BUSY must be returned when resources, such as CAS
+     * sessions or secure buffers are not available to perform a requested
+     * operation because they are already in use.
+     */
+    ERROR_CAS_RESOURCE_BUSY,
+
+    /**
+     * The CAS Plugin must return ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION
+     * when the output protection level enabled on the device is not
+     * sufficient to meet the requirements in the license policy. HDCP is an
+     * example of a form of output protection.
+     */
+    ERROR_CAS_INSUFFICIENT_OUTPUT_PROTECTION,
+
+    /**
+     * The CAS Plugin must return ERROR_CAS_TAMPER_DETECTED if an attempt to
+     * tamper with the CAS system is detected.
+     */
+    ERROR_CAS_TAMPER_DETECTED,
+
+    /**
+     * The CAS Plugin must return ERROR_CAS_DEVICE_REVOKED if the response
+     * indicates that the device has been revoked. Device revocation means
+     * that the device is no longer permitted to play content.
+     */
+    ERROR_CAS_DEVICE_REVOKED,
+
+    /**
+     * The CAS plugin must return ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED when
+     * descrambling is failing because the session is not initialized properly.
+     */
+    ERROR_CAS_DECRYPT_UNIT_NOT_INITIALIZED,
+
+    /**
+     * The CAS Plugin must return ERROR_CAS_DECRYPT if the DescramblerPlugin's
+     * descramble operation fails.
+     */
+    ERROR_CAS_DECRYPT,
+
+    /**
+     * ERROR_CAS_UNKNOWN must be returned when a fatal failure occurs and no
+     * other defined error is appropriate.
+     */
+    ERROR_CAS_UNKNOWN,
+};
+
+typedef vec<uint8_t> HidlCasSessionId;
+typedef vec<uint8_t> HidlCasData;
+
+/**
+ * Describes a CAS plugin with its system id and name.
+ */
+struct HidlCasPluginDescriptor {
+    int32_t caSystemId;
+    string name;
+};
diff --git a/cas/Android.bp b/cas/Android.bp
new file mode 100644
index 0000000..57532a0
--- /dev/null
+++ b/cas/Android.bp
@@ -0,0 +1,6 @@
+// This is an autogenerated file, do not edit.
+subdirs = [
+    "1.0",
+    "1.0/default",
+    "native/1.0",
+]
diff --git a/cas/native/1.0/Android.bp b/cas/native/1.0/Android.bp
new file mode 100644
index 0000000..414fca7
--- /dev/null
+++ b/cas/native/1.0/Android.bp
@@ -0,0 +1,65 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+filegroup {
+    name: "android.hardware.cas.native@1.0_hal",
+    srcs: [
+        "types.hal",
+        "IDescrambler.hal",
+    ],
+}
+
+genrule {
+    name: "android.hardware.cas.native@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++-sources -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.cas.native@1.0",
+    srcs: [
+        ":android.hardware.cas.native@1.0_hal",
+    ],
+    out: [
+        "android/hardware/cas/native/1.0/types.cpp",
+        "android/hardware/cas/native/1.0/DescramblerAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.cas.native@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++-headers -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.cas.native@1.0",
+    srcs: [
+        ":android.hardware.cas.native@1.0_hal",
+    ],
+    out: [
+        "android/hardware/cas/native/1.0/types.h",
+        "android/hardware/cas/native/1.0/hwtypes.h",
+        "android/hardware/cas/native/1.0/IDescrambler.h",
+        "android/hardware/cas/native/1.0/IHwDescrambler.h",
+        "android/hardware/cas/native/1.0/BnHwDescrambler.h",
+        "android/hardware/cas/native/1.0/BpHwDescrambler.h",
+        "android/hardware/cas/native/1.0/BsDescrambler.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.cas.native@1.0",
+    defaults: ["hidl-module-defaults"],
+    generated_sources: ["android.hardware.cas.native@1.0_genc++"],
+    generated_headers: ["android.hardware.cas.native@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.cas.native@1.0_genc++_headers"],
+    vendor_available: true,
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hardware.cas@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hardware.cas@1.0",
+    ],
+}
diff --git a/cas/native/1.0/IDescrambler.hal b/cas/native/1.0/IDescrambler.hal
new file mode 100644
index 0000000..459e5e3
--- /dev/null
+++ b/cas/native/1.0/IDescrambler.hal
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.cas.native@1.0;
+
+import android.hardware.cas@1.0::IDescramblerBase;
+
+/**
+ * IDescrambler is the native plugin API for descrambling operations.
+ */
+
+interface IDescrambler extends IDescramblerBase {
+    /**
+     * Descramble the data in a source SharedBuffer, described by an array of
+     * SubSample structures.
+     *
+     * @param scramblingControl an enumeration indicating the key that the subsamples
+     * were scrambled with.
+     * @param subSamples an array of SubSample structures describing the number of
+     * clear and scrambled bytes within each subsample.
+     * @param srcBuffer the SharedBuffer containing the source scrambled data.
+     * @param srcOffset the position where the source scrambled data starts at.
+     * @param dstBuffer the DestinationBuffer to hold the descrambled data.
+     * @param dstOffset the position where the descrambled data should start at.
+     *
+     * @return status the status of the call.
+     * @return bytesWritten number of bytes that have been successfully descrambled.
+     * @return detailedError a detailed message describing the error (if any).
+     */
+    descramble(ScramblingControl scramblingControl, vec<SubSample> subSamples,
+        SharedBuffer srcBuffer, uint64_t srcOffset, DestinationBuffer dstBuffer, uint64_t dstOffset)
+        generates(Status status, uint32_t bytesWritten, string detailedError);
+};
diff --git a/cas/native/1.0/types.hal b/cas/native/1.0/types.hal
new file mode 100644
index 0000000..a576d03
--- /dev/null
+++ b/cas/native/1.0/types.hal
@@ -0,0 +1,90 @@
+/**
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.cas.native@1.0;
+
+import android.hardware.cas@1.0::types;
+
+/**
+ * Enumerates the keys used to scramble the content.
+ */
+enum ScramblingControl : uint32_t {
+    UNSCRAMBLED = 0,
+    RESERVED    = 1,
+    EVENKEY     = 2,
+    ODDKEY      = 3,
+};
+
+/**
+ * A subsample consists of some number of bytes of clear (unscrambled)
+ * data followed by a number of bytes of scrambled data.
+ */
+struct SubSample {
+    uint32_t numBytesOfClearData;
+    uint32_t numBytesOfEncryptedData;
+};
+
+/**
+ * SharedBuffer describes a shared buffer which is defined by a heapBase, an
+ * offset and a size. The offset is relative to the shared memory base for the
+ * memory region identified by heapBase.
+ */
+struct SharedBuffer {
+    /**
+     * The shared memory base handle
+     */
+    memory heapBase;
+
+    /**
+     * The offset from the shared memory base
+     */
+    uint64_t offset;
+
+    /**
+     * The size of the shared buffer in bytes
+     */
+    uint64_t size;
+};
+
+/**
+ * A descrambling destination buffer can be either normal user-space shared
+ * memory for the non-secure descrambling case, or it can be a secure buffer
+ * which is referenced by a native-handle. The native handle is allocated
+ * by the vendor's buffer allocator.
+ */
+enum BufferType : uint32_t {
+    SHARED_MEMORY = 0,
+    NATIVE_HANDLE = 1,
+};
+
+struct DestinationBuffer {
+    /**
+     * The type of the buffer
+     */
+    BufferType type;
+
+    /**
+     * If type == SHARED_MEMORY, the descrambled data must be written
+     * to user-space non-secure shared memory.
+     */
+    SharedBuffer nonsecureMemory;
+
+    /**
+     * If type == NATIVE_HANDLE, the descrambled data must be written
+     * to secure memory referenced by the vendor's buffer allocator.
+     */
+    handle secureMemory;
+};
diff --git a/media/omx/1.0/vts/functional/audio/VtsHalMediaOmxV1_0TargetAudioDecTest.cpp b/media/omx/1.0/vts/functional/audio/VtsHalMediaOmxV1_0TargetAudioDecTest.cpp
index fe67cb9..031584b 100644
--- a/media/omx/1.0/vts/functional/audio/VtsHalMediaOmxV1_0TargetAudioDecTest.cpp
+++ b/media/omx/1.0/vts/functional/audio/VtsHalMediaOmxV1_0TargetAudioDecTest.cpp
@@ -568,7 +568,8 @@
                             android::Vector<BufferInfo>* iBuffer,
                             android::Vector<BufferInfo>* oBuffer,
                             OMX_AUDIO_CODINGTYPE eEncoding,
-                            OMX_U32 kPortIndexInput, OMX_U32 kPortIndexOutput) {
+                            OMX_U32 kPortIndexInput, OMX_U32 kPortIndexOutput,
+                            AudioDecHidlTest::standardComp comp) {
     android::hardware::media::omx::V1_0::Status status;
     Message msg;
     int timeOut = TIMEOUT_COUNTER;
@@ -580,7 +581,7 @@
         if (status == android::hardware::media::omx::V1_0::Status::OK) {
             EXPECT_EQ(msg.type, Message::Type::EVENT);
             portReconfiguration(omxNode, observer, iBuffer, oBuffer, eEncoding,
-                                kPortIndexInput, kPortIndexOutput, msg);
+                                kPortIndexInput, kPortIndexOutput, msg, comp);
         }
         // status == TIMED_OUT, it could be due to process time being large
         // than DEFAULT_TIMEOUT or component needs output buffers to start
@@ -789,7 +790,7 @@
                   (int)Info.size(), compName);
     eleStream.close();
     waitOnInputConsumption(omxNode, observer, &iBuffer, &oBuffer, eEncoding,
-                           kPortIndexInput, kPortIndexOutput);
+                           kPortIndexInput, kPortIndexOutput, compName);
     testEOS(omxNode, observer, &iBuffer, &oBuffer, false, eosFlag);
     EXPECT_EQ(timestampUslist.empty(), true);
     // set state to idle
@@ -933,7 +934,7 @@
                   compName);
     eleStream.close();
     waitOnInputConsumption(omxNode, observer, &iBuffer, &oBuffer, eEncoding,
-                           kPortIndexInput, kPortIndexOutput);
+                           kPortIndexInput, kPortIndexOutput, compName);
     testEOS(omxNode, observer, &iBuffer, &oBuffer, false, eosFlag);
     flushPorts(omxNode, observer, &iBuffer, &oBuffer, kPortIndexInput,
                kPortIndexOutput);
@@ -949,7 +950,7 @@
                   compName, false);
     eleStream.close();
     waitOnInputConsumption(omxNode, observer, &iBuffer, &oBuffer, eEncoding,
-                           kPortIndexInput, kPortIndexOutput);
+                           kPortIndexInput, kPortIndexOutput, compName);
     testEOS(omxNode, observer, &iBuffer, &oBuffer, true, eosFlag);
     flushPorts(omxNode, observer, &iBuffer, &oBuffer, kPortIndexInput,
                kPortIndexOutput);
@@ -1034,7 +1035,7 @@
                   (int)Info.size(), compName, false);
     eleStream.close();
     waitOnInputConsumption(omxNode, observer, &iBuffer, &oBuffer, eEncoding,
-                           kPortIndexInput, kPortIndexOutput);
+                           kPortIndexInput, kPortIndexOutput, compName);
     testEOS(omxNode, observer, &iBuffer, &oBuffer, true, eosFlag);
     flushPorts(omxNode, observer, &iBuffer, &oBuffer, kPortIndexInput,
                kPortIndexOutput);
diff --git a/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp b/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
index cd6eaf5..f6bc93a 100644
--- a/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
+++ b/media/omx/1.0/vts/functional/video/VtsHalMediaOmxV1_0TargetVideoEncTest.cpp
@@ -521,12 +521,15 @@
 // Set Default port param.
 void setDefaultPortParam(sp<IOmxNode> omxNode, OMX_U32 portIndex,
                          OMX_VIDEO_CODINGTYPE eCompressionFormat,
+                         OMX_U32 nFrameWidth, OMX_U32 nFrameHeight,
                          OMX_U32 nBitrate, OMX_U32 xFramerate) {
     android::hardware::media::omx::V1_0::Status status;
     OMX_PARAM_PORTDEFINITIONTYPE portDef;
     status = getPortParam(omxNode, OMX_IndexParamPortDefinition, portIndex,
                           &portDef);
     EXPECT_EQ(status, ::android::hardware::media::omx::V1_0::Status::OK);
+    portDef.format.video.nFrameWidth = nFrameWidth;
+    portDef.format.video.nFrameHeight = nFrameHeight;
     portDef.format.video.nBitrate = nBitrate;
     portDef.format.video.xFramerate = xFramerate;
     portDef.format.video.bFlagErrorConcealment = OMX_TRUE;
@@ -1028,6 +1031,9 @@
             } else if (msg.data.eventData.event == OMX_EventError) {
                 EXPECT_TRUE(false) << "Received OMX_EventError, not sure why";
                 break;
+            } else if (msg.data.eventData.event == OMX_EventDataSpaceChanged) {
+                // TODO: how am i supposed to respond now?
+                std::cout << "[          ] Info ! OMX_EventDataSpaceChanged \n";
             } else {
                 ASSERT_TRUE(false);
             }
@@ -1234,8 +1240,8 @@
 
     // Configure output port
     uint32_t nBitRate = 512000;
-    setDefaultPortParam(omxNode, kPortIndexOutput, eCompressionFormat, nBitRate,
-                        xFramerate);
+    setDefaultPortParam(omxNode, kPortIndexOutput, eCompressionFormat,
+                        nFrameWidth, nFrameHeight, nBitRate, xFramerate);
     setRefreshPeriod(omxNode, kPortIndexOutput, 0);
 
     unsigned int index;
@@ -1319,6 +1325,11 @@
     setupRAWPort(omxNode, kPortIndexInput, nFrameWidth, nFrameHeight, 0,
                  xFramerate, eColorFormat);
 
+    // Configure output port
+    uint32_t nBitRate = 512000;
+    setDefaultPortParam(omxNode, kPortIndexOutput, eCompressionFormat,
+                        nFrameWidth, nFrameHeight, nBitRate, xFramerate);
+
     // CreateInputSurface
     EXPECT_TRUE(omx->createInputSurface(
                        [&](android::hardware::media::omx::V1_0::Status _s,
diff --git a/oemlock/1.0/vts/functional/Android.bp b/oemlock/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..a13b3dc
--- /dev/null
+++ b/oemlock/1.0/vts/functional/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2016 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalOemLockV1_0TargetTest",
+    defaults: ["hidl_defaults"],
+    srcs: ["VtsHalOemLockV1_0TargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.oemlock@1.0",
+    ],
+    static_libs: ["VtsHalHidlTargetTestBase"],
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/oemlock/1.0/vts/functional/VtsHalOemLockV1_0TargetTest.cpp b/oemlock/1.0/vts/functional/VtsHalOemLockV1_0TargetTest.cpp
new file mode 100644
index 0000000..a924fec
--- /dev/null
+++ b/oemlock/1.0/vts/functional/VtsHalOemLockV1_0TargetTest.cpp
@@ -0,0 +1,189 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android/hardware/oemlock/1.0/IOemLock.h>
+
+#include <VtsHalHidlTargetTestBase.h>
+
+using ::android::hardware::oemlock::V1_0::IOemLock;
+using ::android::hardware::oemlock::V1_0::OemLockStatus;
+using ::android::hardware::oemlock::V1_0::OemLockSecureStatus;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::sp;
+
+struct OemLockHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+    virtual void SetUp() override {
+        oemlock = ::testing::VtsHalHidlTargetTestBase::getService<IOemLock>();
+        ASSERT_NE(oemlock, nullptr);
+    }
+
+    virtual void TearDown() override {}
+
+    sp<IOemLock> oemlock;
+};
+
+/*
+ * Check the name can be retrieved
+ */
+TEST_F(OemLockHidlTest, GetName) {
+    std::string name;
+    OemLockStatus status;
+
+    bool callbackCalled = false;
+    const auto ret = oemlock->getName([&](OemLockStatus s, hidl_string n) {
+        callbackCalled = true;
+        status = s;
+        name = n.c_str();
+    });
+
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    EXPECT_EQ(status, OemLockStatus::OK);
+    // Any value acceptable
+};
+
+/*
+ * Check the unlock allowed by device state can be queried
+ */
+TEST_F(OemLockHidlTest, QueryUnlockAllowedByDevice) {
+    bool allowed;
+    OemLockStatus status;
+
+    bool callbackCalled = false;
+    const auto ret = oemlock->isOemUnlockAllowedByDevice([&](OemLockStatus s, bool a) {
+        callbackCalled = true;
+        status = s;
+        allowed = a;
+    });
+
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    EXPECT_EQ(status, OemLockStatus::OK);
+    // Any value acceptable
+}
+
+/*
+ * Check unlock allowed by device state can be toggled
+ */
+TEST_F(OemLockHidlTest, AllowedByDeviceCanBeToggled) {
+    bool allowed;
+    OemLockStatus status;
+
+    auto getAllowedCallback = [&](OemLockStatus s, bool a) {
+        status = s;
+        allowed = a;
+    };
+
+    // Get the original state so it can be restored
+    const auto get_ret = oemlock->isOemUnlockAllowedByDevice(getAllowedCallback);
+    ASSERT_TRUE(get_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+    const bool originallyAllowed = allowed;
+
+    // Toggle the state
+    const auto set_ret = oemlock->setOemUnlockAllowedByDevice(!originallyAllowed);
+    ASSERT_TRUE(set_ret.isOk());
+    ASSERT_EQ(set_ret, OemLockStatus::OK);
+    const auto check_set_ret = oemlock->isOemUnlockAllowedByDevice(getAllowedCallback);
+    ASSERT_TRUE(check_set_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+    ASSERT_EQ(allowed, !originallyAllowed);
+
+    // Restore the state
+    const auto restore_ret = oemlock->setOemUnlockAllowedByDevice(originallyAllowed);
+    ASSERT_TRUE(restore_ret.isOk());
+    ASSERT_EQ(restore_ret, OemLockStatus::OK);
+    const auto check_restore_ret = oemlock->isOemUnlockAllowedByDevice(getAllowedCallback);
+    ASSERT_TRUE(check_restore_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+    ASSERT_EQ(allowed, originallyAllowed);
+};
+
+/*
+ * Check the unlock allowed by device state can be queried
+ */
+TEST_F(OemLockHidlTest, QueryUnlockAllowedByCarrier) {
+    bool allowed;
+    OemLockStatus status;
+
+    bool callbackCalled = false;
+    const auto ret = oemlock->isOemUnlockAllowedByCarrier([&](OemLockStatus s, bool a) {
+        callbackCalled = true;
+        status = s;
+        allowed = a;
+    });
+
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    EXPECT_EQ(status, OemLockStatus::OK);
+    // Any value acceptable
+}
+
+/*
+ * Attempt to check unlock allowed by carrier can be toggled
+ *
+ * The implementation may involve a signature which cannot be tested here. That
+ * is a valid implementation so the test will pass. If there is no signature
+ * required, the test will toggle the value.
+ */
+TEST_F(OemLockHidlTest, CarrierUnlock) {
+    const hidl_vec<uint8_t> noSignature = {};
+    bool allowed;
+    OemLockStatus status;
+
+    auto getAllowedCallback = [&](OemLockStatus s, bool a) {
+        status = s;
+        allowed = a;
+    };
+
+    // Get the original state so it can be restored
+    const auto get_ret = oemlock->isOemUnlockAllowedByCarrier(getAllowedCallback);
+    ASSERT_TRUE(get_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+    const bool originallyAllowed = allowed;
+
+    if (originallyAllowed) {
+        // Only applied to locked devices
+        return;
+    }
+
+    // Toggle the state
+    const auto set_ret = oemlock->setOemUnlockAllowedByCarrier(!originallyAllowed, noSignature);
+    ASSERT_TRUE(set_ret.isOk());
+    ASSERT_NE(set_ret, OemLockSecureStatus::FAILED);
+    const auto check_set_ret = oemlock->isOemUnlockAllowedByCarrier(getAllowedCallback);
+    ASSERT_TRUE(check_set_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+
+    if (set_ret == OemLockSecureStatus::INVALID_SIGNATURE) {
+        // Signature is required so we cannot toggle the value in the test, but this is allowed
+        ASSERT_EQ(allowed, originallyAllowed);
+        return;
+    }
+
+    ASSERT_EQ(set_ret, OemLockSecureStatus::OK);
+    ASSERT_EQ(allowed, !originallyAllowed);
+
+    // Restore the state
+    const auto restore_ret = oemlock->setOemUnlockAllowedByCarrier(originallyAllowed, noSignature);
+    ASSERT_TRUE(restore_ret.isOk());
+    ASSERT_EQ(restore_ret, OemLockSecureStatus::OK);
+    const auto check_restore_ret = oemlock->isOemUnlockAllowedByCarrier(getAllowedCallback);
+    ASSERT_TRUE(check_restore_ret.isOk());
+    ASSERT_EQ(status, OemLockStatus::OK);
+    ASSERT_EQ(allowed, originallyAllowed);
+};
diff --git a/oemlock/Android.bp b/oemlock/Android.bp
index bbb3e4b..33f70eb 100644
--- a/oemlock/Android.bp
+++ b/oemlock/Android.bp
@@ -1,4 +1,5 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "1.0",
+    "1.0/vts/functional",
 ]
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_cell_broadcast.cpp b/radio/1.0/vts/functional/radio_hidl_hal_cell_broadcast.cpp
index 14d14d4..e0c3a15 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_cell_broadcast.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_cell_broadcast.cpp
@@ -123,7 +123,8 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckGeneralError() ||
-                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS);
+                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
+                    radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -140,7 +141,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(CheckGeneralError());
+        ASSERT_TRUE(CheckGeneralError() || radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -159,7 +160,8 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckGeneralError() ||
-                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS);
+                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
+                    radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
index 69da6b2..e6d10ba 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_misc.cpp
@@ -184,7 +184,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
+        ASSERT_TRUE(CheckGeneralError() || radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -216,7 +216,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
+        ASSERT_TRUE(CheckGeneralError() || radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -651,6 +651,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
+        std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(CheckGeneralError() ||
                     radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
                     radioRsp->rspInfo.error == RadioError::INVALID_STATE);
@@ -669,6 +670,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
+        std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::RADIO_NOT_AVAILABLE ||
                     radioRsp->rspInfo.error == RadioError::LCE_NOT_SUPPORTED ||
                     radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
@@ -705,7 +707,8 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::RADIO_NOT_AVAILABLE || CheckOEMError() ||
-                    radioRsp->rspInfo.error == RadioError::INTERNAL_ERR);
+                    radioRsp->rspInfo.error == RadioError::INTERNAL_ERR ||
+                    radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -745,7 +748,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
+        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE || CheckGeneralError());
   }
 
   /* Reset back to no carrier restriction */
@@ -759,7 +762,7 @@
   EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
   if (cardStatus.cardState == CardState::ABSENT) {
-      ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
+      ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE || CheckGeneralError());
   }
 }
 
@@ -775,7 +778,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
-        ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE);
+        EXPECT_EQ(radioRsp->rspInfo.error, RadioError::NONE);
     }
 }
 
@@ -825,6 +828,7 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
+        std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(radioRsp->rspInfo.error == RadioError::NONE ||
                     radioRsp->rspInfo.error == RadioError::REQUEST_NOT_SUPPORTED);
     }
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_stk.cpp b/radio/1.0/vts/functional/radio_hidl_hal_stk.cpp
index 6ff0330..9a9a4ae 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_stk.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_stk.cpp
@@ -37,7 +37,8 @@
         std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(CheckGeneralError() ||
                     radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
-                    radioRsp->rspInfo.error == RadioError::NONE);
+                    radioRsp->rspInfo.error == RadioError::NONE ||
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
     }
 
     // Test with sending random string
@@ -54,7 +55,8 @@
         std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(CheckGeneralError() ||
                     radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
-                    radioRsp->rspInfo.error == RadioError::NONE);
+                    radioRsp->rspInfo.error == RadioError::NONE ||
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
     }
 }
 
@@ -153,7 +155,8 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckGeneralError() ||
-                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS);
+                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
     }
 
     // Test with sending random string
@@ -168,6 +171,7 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckGeneralError() ||
-                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS);
+                    radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
     }
 }
diff --git a/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp b/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
index 8fe04fd..c7570c8 100644
--- a/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
+++ b/radio/1.0/vts/functional/radio_hidl_hal_voice.cpp
@@ -214,7 +214,8 @@
 
     if (cardStatus.cardState == CardState::ABSENT) {
         ASSERT_TRUE(CheckGeneralError() || radioRsp->rspInfo.error == RadioError::INVALID_STATE ||
-                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR ||
+                    radioRsp->rspInfo.error == RadioError::NONE);
     }
 }
 
@@ -365,12 +366,14 @@
     EXPECT_EQ(serial, radioRsp->rspInfo.serial);
 
     if (cardStatus.cardState == CardState::ABSENT) {
+        std::cout << static_cast<int>(radioRsp->rspInfo.error) << std::endl;
         ASSERT_TRUE(CheckGeneralError() ||
                     radioRsp->rspInfo.error == RadioError::INVALID_ARGUMENTS ||
                     radioRsp->rspInfo.error == RadioError::NONE ||
                     radioRsp->rspInfo.error == RadioError::INVALID_CALL_ID ||
                     radioRsp->rspInfo.error == RadioError::INVALID_MODEM_STATE ||
-                    radioRsp->rspInfo.error == RadioError::MODEM_ERR);
+                    radioRsp->rspInfo.error == RadioError::MODEM_ERR ||
+                    radioRsp->rspInfo.error == RadioError::MODE_NOT_SUPPORTED);
     }
 }
 
diff --git a/radio/1.1/types.hal b/radio/1.1/types.hal
index a8d836c..93d5d44 100644
--- a/radio/1.1/types.hal
+++ b/radio/1.1/types.hal
@@ -176,26 +176,6 @@
     vec<CellInfo> networkInfos;             // List of network information as CellInfo
 };
 
-struct ImsiEncryptionInfo {
-    string mcc;                   // MCC of the Carrier.
-    string mnc;                   // MNC of the Carrier.
-    vec<uint8_t> carrierKey;      // Carrier specific key to be used for encryption. It must
-                                  // be opaque to the framework. This is the byte-stream
-                                  // representation of the key. This is an external encoded
-                                  // form for the key used when a standard representation of
-                                  // the key is needed outside the Java Virtual Machine, as
-                                  // when transmitting the key to some other party.
-                                  // The key is encoded according to a standard format
-                                  // (such as X.509 SubjectPublicKeyInfo or PKCS#8), and is
-                                  // returned using the getEncoded method as defined on the
-                                  // java.security.Key interface.
-    string keyIdentifier;         // This is an opaque value we're given by the carrier
-                                  // and is returned to the carrier. This is used by the server to
-                                  // help it locate the private key to decrypt the permanent
-                                  // identity.
-    int64_t expirationTime;       // date-time in UTC when the key will expire.
-};
-
 struct KeepaliveRequest {
     KeepaliveType type;                     // The format of the keepalive packet
     vec<uint8_t> sourceAddress;             // source address with type = family, in network
@@ -216,3 +196,23 @@
     int32_t sessionHandle;                  // the sessionHandle provided by the api
     KeepaliveStatusCode code;               // status for the given keepalive
 };
+
+struct ImsiEncryptionInfo {
+    string mcc;                   // MCC of the Carrier.
+    string mnc;                   // MNC of the Carrier.
+    vec<uint8_t> carrierKey;      // Carrier specific key to be used for encryption. It must
+                                  // be opaque to the framework. This is the byte-stream
+                                  // representation of the key. This is an external encoded
+                                  // form for the key used when a standard representation of
+                                  // the key is needed outside the Java Virtual Machine, as
+                                  // when transmitting the key to some other party.
+                                  // The key is encoded according to a standard format
+                                  // (such as X.509 SubjectPublicKeyInfo or PKCS#8), and is
+                                  // returned using the getEncoded method as defined on the
+                                  // java.security.Key interface.
+    string keyIdentifier;         // This is an opaque value we're given by the carrier
+                                  // and is returned to the carrier. This is used by the server to
+                                  // help it locate the private key to decrypt the permanent
+                                  // identity.
+    int64_t expirationTime;       // date-time in UTC when the key will expire.
+};
diff --git a/weaver/1.0/vts/functional/Android.bp b/weaver/1.0/vts/functional/Android.bp
new file mode 100644
index 0000000..9b0ff6d
--- /dev/null
+++ b/weaver/1.0/vts/functional/Android.bp
@@ -0,0 +1,36 @@
+//
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_test {
+    name: "VtsHalWeaverV1_0TargetTest",
+    defaults: ["hidl_defaults"],
+    srcs: ["VtsHalWeaverV1_0TargetTest.cpp"],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libcutils",
+        "libhidlbase",
+        "libhidltransport",
+        "libnativehelper",
+        "libutils",
+        "android.hardware.weaver@1.0",
+    ],
+    static_libs: ["VtsHalHidlTargetTestBase"],
+    cflags: [
+        "-O0",
+        "-g",
+    ],
+}
diff --git a/weaver/1.0/vts/functional/VtsHalWeaverV1_0TargetTest.cpp b/weaver/1.0/vts/functional/VtsHalWeaverV1_0TargetTest.cpp
new file mode 100644
index 0000000..372d787
--- /dev/null
+++ b/weaver/1.0/vts/functional/VtsHalWeaverV1_0TargetTest.cpp
@@ -0,0 +1,336 @@
+/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android/hardware/weaver/1.0/IWeaver.h>
+
+#include <limits>
+
+#include <VtsHalHidlTargetTestBase.h>
+
+using ::android::hardware::weaver::V1_0::IWeaver;
+using ::android::hardware::weaver::V1_0::WeaverConfig;
+using ::android::hardware::weaver::V1_0::WeaverReadStatus;
+using ::android::hardware::weaver::V1_0::WeaverReadResponse;
+using ::android::hardware::weaver::V1_0::WeaverStatus;
+using ::android::hardware::Return;
+using ::android::sp;
+
+const std::vector<uint8_t> KEY{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
+const std::vector<uint8_t> WRONG_KEY{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+const std::vector<uint8_t> VALUE{16, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1};
+const std::vector<uint8_t> OTHER_VALUE{0, 1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144, 233, 255, 255};
+
+struct WeaverHidlTest : public ::testing::VtsHalHidlTargetTestBase {
+    virtual void SetUp() override {
+        weaver = ::testing::VtsHalHidlTargetTestBase::getService<IWeaver>();
+        ASSERT_NE(weaver, nullptr);
+    }
+
+    virtual void TearDown() override {}
+
+    sp<IWeaver> weaver;
+};
+
+/*
+ * Checks config values are suitably large
+ */
+TEST_F(WeaverHidlTest, GetConfig) {
+    WeaverStatus status;
+    WeaverConfig config;
+
+    bool callbackCalled = false;
+    auto ret = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        callbackCalled = true;
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    EXPECT_GE(config.slots, 16u);
+    EXPECT_GE(config.keySize, 16u);
+    EXPECT_GE(config.valueSize, 16u);
+}
+
+/*
+ * Gets the config twice and checks they are the same
+ */
+TEST_F(WeaverHidlTest, GettingConfigMultipleTimesGivesSameResult) {
+    WeaverConfig config1;
+    WeaverConfig config2;
+
+    WeaverStatus status;
+    bool callbackCalled = false;
+    auto ret = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        callbackCalled = true;
+        status = s;
+        config1 = c;
+    });
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    callbackCalled = false;
+    ret = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        callbackCalled = true;
+        status = s;
+        config2 = c;
+    });
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    EXPECT_EQ(config1, config2);
+}
+
+/*
+ * Gets the number of slots from the config and writes a key and value to the last one
+ */
+TEST_F(WeaverHidlTest, WriteToLastSlot) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    const uint32_t lastSlot = config.slots - 1;
+    const auto writeRet = weaver->write(lastSlot, KEY, VALUE);
+    ASSERT_TRUE(writeRet.isOk());
+    ASSERT_EQ(writeRet, WeaverStatus::OK);
+}
+
+/*
+ * Writes a key and value to a slot
+ * Reads the slot with the same key and receives the value that was previously written
+ */
+TEST_F(WeaverHidlTest, WriteFollowedByReadGivesTheSameValue) {
+    constexpr uint32_t slotId = 0;
+    const auto ret = weaver->write(slotId, KEY, VALUE);
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_EQ(ret, WeaverStatus::OK);
+
+    bool callbackCalled = false;
+    WeaverReadStatus status;
+    std::vector<uint8_t> readValue;
+    uint32_t timeout;
+    const auto readRet = weaver->read(slotId, KEY, [&](WeaverReadStatus s, WeaverReadResponse r) {
+        callbackCalled = true;
+        status = s;
+        readValue = r.value;
+        timeout = r.timeout;
+    });
+    ASSERT_TRUE(readRet.isOk());
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_EQ(status, WeaverReadStatus::OK);
+    EXPECT_EQ(readValue, VALUE);
+    EXPECT_EQ(timeout, 0u);
+}
+
+/*
+ * Writes a key and value to a slot
+ * Overwrites the slot with a new key and value
+ * Reads the slot with the new key and receives the new value
+ */
+TEST_F(WeaverHidlTest, OverwritingSlotUpdatesTheValue) {
+    constexpr uint32_t slotId = 0;
+    const auto initialWriteRet = weaver->write(slotId, WRONG_KEY, VALUE);
+    ASSERT_TRUE(initialWriteRet.isOk());
+    ASSERT_EQ(initialWriteRet, WeaverStatus::OK);
+
+    const auto overwriteRet = weaver->write(slotId, KEY, OTHER_VALUE);
+    ASSERT_TRUE(overwriteRet.isOk());
+    ASSERT_EQ(overwriteRet, WeaverStatus::OK);
+
+    bool callbackCalled = false;
+    WeaverReadStatus status;
+    std::vector<uint8_t> readValue;
+    uint32_t timeout;
+    const auto readRet = weaver->read(slotId, KEY, [&](WeaverReadStatus s, WeaverReadResponse r) {
+        callbackCalled = true;
+        status = s;
+        readValue = r.value;
+        timeout = r.timeout;
+    });
+    ASSERT_TRUE(readRet.isOk());
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_EQ(status, WeaverReadStatus::OK);
+    EXPECT_EQ(readValue, OTHER_VALUE);
+    EXPECT_EQ(timeout, 0u);
+}
+
+/*
+ * Writes a key and value to a slot
+ * Reads the slot with a different key so does not receive the value
+ */
+TEST_F(WeaverHidlTest, WriteFollowedByReadWithWrongKeyDoesNotGiveTheValue) {
+    constexpr uint32_t slotId = 0;
+    const auto ret = weaver->write(slotId, KEY, VALUE);
+    ASSERT_TRUE(ret.isOk());
+    ASSERT_EQ(ret, WeaverStatus::OK);
+
+    bool callbackCalled = false;
+    WeaverReadStatus status;
+    std::vector<uint8_t> readValue;
+    const auto readRet =
+        weaver->read(slotId, WRONG_KEY, [&](WeaverReadStatus s, WeaverReadResponse r) {
+            callbackCalled = true;
+            status = s;
+            readValue = r.value;
+        });
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_TRUE(readRet.isOk());
+    ASSERT_EQ(status, WeaverReadStatus::INCORRECT_KEY);
+    EXPECT_TRUE(readValue.empty());
+}
+
+/*
+ * Writing to an invalid slot fails
+ */
+TEST_F(WeaverHidlTest, WritingToInvalidSlotFails) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    if (config.slots == std::numeric_limits<uint32_t>::max()) {
+        // If there are no invalid slots then pass
+        return;
+    }
+
+    const auto writeRet = weaver->write(config.slots, KEY, VALUE);
+    ASSERT_TRUE(writeRet.isOk());
+    ASSERT_EQ(writeRet, WeaverStatus::FAILED);
+}
+
+/*
+ * Reading from an invalid slot fails rather than incorrect key
+ */
+TEST_F(WeaverHidlTest, ReadingFromInvalidSlotFails) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    if (config.slots == std::numeric_limits<uint32_t>::max()) {
+        // If there are no invalid slots then pass
+        return;
+    }
+
+    bool callbackCalled = false;
+    WeaverReadStatus readStatus;
+    std::vector<uint8_t> readValue;
+    uint32_t timeout;
+    const auto readRet =
+        weaver->read(config.slots, KEY, [&](WeaverReadStatus s, WeaverReadResponse r) {
+            callbackCalled = true;
+            readStatus = s;
+            readValue = r.value;
+            timeout = r.timeout;
+        });
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_TRUE(readRet.isOk());
+    ASSERT_EQ(readStatus, WeaverReadStatus::FAILED);
+    EXPECT_TRUE(readValue.empty());
+    EXPECT_EQ(timeout, 0u);
+}
+
+/*
+ * Writing a key that is too large fails
+ */
+TEST_F(WeaverHidlTest, WriteWithTooLargeKeyFails) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    std::vector<uint8_t> bigKey(config.keySize + 1);
+
+    constexpr uint32_t slotId = 0;
+    const auto writeRet = weaver->write(slotId, bigKey, VALUE);
+    ASSERT_TRUE(writeRet.isOk());
+    ASSERT_EQ(writeRet, WeaverStatus::FAILED);
+}
+
+/*
+ * Writing a value that is too large fails
+ */
+TEST_F(WeaverHidlTest, WriteWithTooLargeValueFails) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    std::vector<uint8_t> bigValue(config.valueSize + 1);
+
+    constexpr uint32_t slotId = 0;
+    const auto writeRet = weaver->write(slotId, KEY, bigValue);
+    ASSERT_TRUE(writeRet.isOk());
+    ASSERT_EQ(writeRet, WeaverStatus::FAILED);
+}
+
+/*
+ * Reading with a key that is loo large fails
+ */
+TEST_F(WeaverHidlTest, ReadWithTooLargeKeyFails) {
+    WeaverStatus status;
+    WeaverConfig config;
+    const auto configRet = weaver->getConfig([&](WeaverStatus s, WeaverConfig c) {
+        status = s;
+        config = c;
+    });
+    ASSERT_TRUE(configRet.isOk());
+    ASSERT_EQ(status, WeaverStatus::OK);
+
+    std::vector<uint8_t> bigKey(config.keySize + 1);
+
+    constexpr uint32_t slotId = 0;
+    bool callbackCalled = false;
+    WeaverReadStatus readStatus;
+    std::vector<uint8_t> readValue;
+    uint32_t timeout;
+    const auto readRet =
+        weaver->read(slotId, bigKey, [&](WeaverReadStatus s, WeaverReadResponse r) {
+            callbackCalled = true;
+            readStatus = s;
+            readValue = r.value;
+            timeout = r.timeout;
+        });
+    ASSERT_TRUE(callbackCalled);
+    ASSERT_TRUE(readRet.isOk());
+    ASSERT_EQ(readStatus, WeaverReadStatus::FAILED);
+    EXPECT_TRUE(readValue.empty());
+    EXPECT_EQ(timeout, 0u);
+}
diff --git a/weaver/Android.bp b/weaver/Android.bp
index bbb3e4b..33f70eb 100644
--- a/weaver/Android.bp
+++ b/weaver/Android.bp
@@ -1,4 +1,5 @@
 // This is an autogenerated file, do not edit.
 subdirs = [
     "1.0",
+    "1.0/vts/functional",
 ]